docs(libkernel): name what the emulators do for the size and flags of sceKernelVirtualQuery

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

docs/dev/debt/libkernel.md

@@ -338,6 +338,7 @@
 - [sceKernelVirtualQuery](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) returns [VirtualQueryInfo](../../../core/libs/SceTypes.hpp) with a one-byte flag allocation unit so Windows and SysV hosts return the same 72-byte representation, with the name at byte 33 and GPU mask at byte 65. This preserves the existing SysV representation; the console offsets beyond the address, protection and size fields observed in Astro Bot's AGC calls are not hardware-measured. Size and offset assertions plus a raw-byte named-mapping regression guard the host ABI. Title code agrees with this layout: of 34 calls in PPSA01494, PPSA03984, PPSA18194, PPSA21564, PPSA30839, PPSA31162 and PPSA34502, 31 pass an info size of 0x48; in the 30 instructions after the call, the 27 with the result on the stack read 64-bit values at 0x0, 0x8 and 0x10, 32-bit values at 0x18 and 0x1c and the flag byte at 0x20 (testing 0x2, 0x10 or 0x50, or masking 0x1f); one in PPSA21564 checks the name's first byte at 0x21.
 - [app0.zar files and directories](../../../core/libs/prx/libkernel/File/src/ArchivedFile.cpp) (libkernel) - archive directory snapshots refresh on rewind; ordering and seek cookies are host packaging behavior, not console-measured behavior. Disk entries shadow archive names under the archive component comparison. Virtual directory descriptors reject data I/O, mapping, locks, filesystem queries and metadata mutation before touching their null-device backing; ordinary host directories retain native operations. Archived files remain read-only, with duplicate descriptors sharing their cursor. `lstat`, access and other ordinary path operations on archive-only entries remain unsupported. Validation uses synthetic archives on Windows and WSL, without PS5 or title runs.
 - [sceKernelLoadStartModule](../../../core/libs/prx/libkernel/Module/src/Module.cpp) (libkernel) loads a system library named by its console path, `/system/common/lib/<name>.sprx` or the sandboxed `/<sandbox word>/common/lib/<name>.sprx` that `sceKernelGetFsSandboxRandomWord` names, from the host `libs/<name>.prx`, as libSceSysmodule loads modules by ID; a host library has no `module_start`, so `res` is 0. Other system directories, such as `/system/priv/lib`, are not mapped. The OpenOrbis piglet sample loads `libScePigletv2VSH.sprx` and `libScePrecompiledShaders.sprx` this way
+- [sceKernelVirtualQuery size and flags](../../../core/libs/prx/libkernel/DirectMemory/Export.cpp) (libkernel) - an `info_size` larger than the 72-byte record is accepted and only the record is written, and only bit 0 of `flags` is read. This was not measured on a console. KytyPS5 (PS5, `src/kernel/memory.cpp`, commit 5e837a9beac82c031868eaad9348d6a48245fb99) fails an `info_size` other than the record size and flags other than 0 and 1 with `EINVAL`, fpPS4 (PS4, `kernel/ps4_map_mm.pas`, commit 04cefd43e6fddd1ab033e7980cd356d14c964905) fails an `info_size` other than the record size with `EFAULT`, and shadPS4 (PS4, `src/core/libraries/kernel/memory.cpp`, commit 0614ce324be092791b758d79f93d9f1ca5b10a81) checks neither. Thirty-nine of the 53 local titles import `sceKernelVirtualQuery`.
 - [param.sfo](../../../core/libs/prx/libkernel/AppMetadata/src/ParamSfoParser.cpp) (libkernel) is read when `param.json` is absent, for `TITLE`, `TITLE_ID`, `DOWNLOAD_DATA_SIZE`, `USER_DEFINED_PARAM_1` to `_4` and `ATTRIBUTE`, and mounts `/data` and `/download0` like `param.json`; the localized `TITLE_00` to `TITLE_30` are not selected by the console language.
 - [sysctl MIBs for kern.smp.maxcpus, kern.stackprot, kern.sched.name and kern.timecounter.hardware](../../../core/libs/prx/libkernel/System/src/SystemConfiguration.cpp) (libkernel) - on a PS5 (firmware 12.70), a payload process resolves these names to {1, 2147482816, 2147482814}, {1, 2147483151}, {1, 2147483182, 2147483181} and {1, 2147482838, 2147482834}; `sysctl` returns -1 with `ENOENT` for reads and size queries by those exact MIBs, leaving the buffer and length unchanged, including when either or both output pointers are null. Writes were not measured and throw. `sysctlnametomib` has no mapping for these four names and returns -1 with `ENOENT`; #7541 implements the mappings for nine of the other names.
 - [sceKernelGetProcessAbiType](../../../core/libs/prx/libkernel/Unimplemented.cpp) (libkernel) throws: no measured value, prototype or documented consumer of the process ABI type was found, and PS5_MihawkOS (`mihawk-99/PS5_MihawkOS`, PPSA99170) is the only title known to import it. Returning a guessed constant would let a title branch on a value the console never answered with, so the declaration only resolves the import until the console value is measured