FreeBSD 11.4's sys___sysctl and userland_sysctl copy the name and the
old length in, and copy the value and the length out, so a bad pointer
gives EFAULT in that order. sysctl dereferenced them directly, and
sysctlbyname read its name with strcmp.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
On PS5 firmware 13.60 sceKernelGetProsperoSystemSwVersion and
sceKernelGetSystemSwVersion return 0 for every value in the leading size
field, keep it, write the string and the packed version, and return 0
without writing for a null block.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Source Port (PPSA20040) checks whether a debugger is attached with
sysctl {CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()} into a 1,088-byte
buffer and tests P_TRACED (0x800) in ki_flag at offset 0x170; the MIB was
unsupported, so the title threw at start-up. Return a FreeBSD 11 amd64
kinfo_proc for the calling process with ki_structsize, ki_pid, ki_ppid and
ki_comm filled and every other field 0, so P_TRACED is clear. Like
kern.proc.vmmap, any other pid fails with ESRCH, a write with EPERM and a
short buffer with ENOMEM. The rest of the record is not measured on a
console and is recorded as debt.
Main now returns ENOENT for unknown sysctlbyname and sysctlnametomib names, so the absent-names debt entry no longer says they throw and keeps main's unknown-names entry.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceKernelGetSystemExVersion, sysKernelGetLowerLimitSysexVersion,
sysKernelGetLowerLimitUpdVersion and sceKernelGetTraceMemoryStats were
NotImplemented stubs in libkernel_sys. libkernel, libkernel_sys and
libkernel_web of firmware 13.42 answer them without asking the kernel:
empty strings, a zero version and zero statistics, with the null checks
and return codes the firmware uses, including the plain 22 of
sceKernelGetSystemExVersion.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD 11.4 serves kern.boottime ({CTL_KERN, KERN_BOOTTIME}) from
sysctl_kern_boottime in sys/kern/kern_tc.c as a read-only 16-byte struct
timeval, so a size query reports 16, a short buffer gets a partial copy
and ENOMEM, and a write gets EPERM from sysctl_root. sysctl, sysctlbyname
and sysctlnametomib now answer it with the guest CLOCK_REALTIME minus
CLOCK_UPTIME, taken at the first read and kept. HotSpot reads it while
writing its error report, which aborted with "unsupported MIB 1.21".
PS5VR (PPSA99177) reads sysctl {CTL_KERN, KERN_PROC, KERN_PROC_ENV, pid}
for its own pid at start-up and stopped on "unsupported MIB 1.14.35.<pid>".
The call now returns the empty start-up environment that environ and
libc's getenv also begin with, and follows FreeBSD 11's
sysctl_kern_proc_env for the errors: EINVAL for a MIB without exactly one
pid, ESRCH for another pid or -1, EPERM for a write.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
In a payload process on a PS5 (firmware 12.70), sysctlbyname returns -1
with ENOENT for thirteen names that threw here, and leaves the buffer and
the length alone, for a read, a size query, a null length and a null
buffer with a null length. sysctl does the same for the fixed MIBs of
seven of them. sysctlnametomib gives those seven MIBs and returns ENOENT
for hw.cacheline_size and hw.usermem, which threw too.
machdep.cacheline_size already returned ENOENT and is now tested with
the others. A write to the new names and MIBs throws, as the console's
answer to a write was not tried. The hw.realmem and vm.overcommit debt
entries now say that a payload process gets ENOENT for them as well.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
In a payload process on a PS5 (firmware 12.70),
sysctlbyname("kern.rng_pseudo") answers a size query with 64 and gives
at most 64 bytes per call, up to a 65536-byte buffer. A buffer smaller
than 64 bytes gets as many bytes as its length and a null length gets
none, both with -1 and ENOMEM; a null buffer with a null length returns
0, and errno is kept when the call succeeds. Here the whole buffer was
filled, a size query threw and the length was never changed. The 64
random bytes are now drawn only for a read that passes both a buffer
and a length.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sysctl {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, pid} for the calling process
returns packed FreeBSD 11 kinfo_vmentry records, one per used range of the
guest arena, with the protection sceKernelVirtualQuery reports. Other pids
return ESRCH, a write EPERM, a short buffer ENOMEM. GuestArena gains a
query for the used range at or after an address.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
For each of the five: the size query, the value, a short buffer (ENOMEM, the copied prefix kept), a new value (EPERM) and a trailing name component (ENOTDIR).
Map hw.model, hw.ncpu, hw.physmem, hw.realmem, kern.arandom and
kern.proc.pathname to their FreeBSD MIBs with the size handling of
FreeBSD's libc wrapper over name2oid, fail with ENOENT and ENAMETOOLONG
as name2oid does, and throw for null pointers, which FreeBSD's wrapper
dereferences, and for names sysctl does not serve.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Dean