Firmware 13.42 accepts a PRT range whose end wraps past the top of the
address space and records only bits 14 to 40 of the size. The writers
here do the same; the test pins it and the debt entry records it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The PRT remap's last argument is checked but not recorded by firmware
13.42, and the comparison covered the recorded fields, not the bytes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceKernelWriteMapCommand2, sceKernelWriteUnmapToPrtCommand,
sceKernelWriteWriteAddressCommand, sceKernelWriteWriteCounterCommand,
sceKernelWriteWaitOnAddressCommand, sceKernelWriteWaitOnCounterCommand
and sceKernelWriteEventQueueOnCompletionCommand follow the checks of
firmware 13.42's libkernel and record this project's command layout.
Without the PRT flag, sceKernelWriteMapCommand2 is
sceKernelWriteMapCommand, as on the console. The debt files record where
the existing writers' checks differ from the firmware.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Reads already wait for END_STREAM when inflation applies, so keep the receive window open while the encoded body is buffered. This lets a gzip response larger than 65,535 bytes inflate instead of failing, and the split test now reads before the content length so it exercises the read path.
On Windows a sleep shorter than TimedWait's 0.5 ms lead, and the last 0.5 ms of a longer one, is a YieldProcessor spin in host code with no wait counted. A raise that found the target there could only be delivered through the return-address breakpoint or sampling, so sceKernelRaiseException at a thread looping on such sleeps was lost: a thread looping on sceKernelUsleep(200) lost the first raise in 5 of 5 runs.
The spins in SleepUntil and SleepNanosUnlessChanged now run under a DeliveryDeferral and drain APCs afterwards, as BeginPark and Unpark already do. A raise that finds the target spinning is queued as an APC and runs when the sleep ends.
GuestRaiseShortSleep raises 100 times each at a thread sleeping 100, 200 and 400 us in a loop, with sleep wakes on (SleepNanosUnlessChanged) and with APS5_NO_SLEEP_WAKE (SleepUntil). Both fail on main at the first or second raise.
AI-assisted (Claude Code).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
SSL_select_next_proto validated both lists and threw for an empty list,
a zero-length entry or a truncated entry. The firmware 13.42 report on
PR #9785 shows the module runs LibreSSL 3.4.1's loop with no validation:
a zero-length entry is negotiated, no overlap returns the first supported
entry with its unchecked length byte, even for an empty supported list,
and an empty peer list has no overlap. Follow that loop, and throw only
for the null pointers the module would read. The test places each
reported list before a guard page and checks the six reported cases.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
