On a PS5 the builder writes 15 dwords: a tag write of 0xc6000006, opcode 0x3a with its arguments, initiator 0x80 whatever the modifier, and a closing tag write; GetSize returns 60. AnyPS5 wrote NUM_INSTANCES and DRAW_INDEX_2 under argument meanings nothing confirms. The driver refuses 0x3a, whose field meanings are not known, and names it DRAW_INDEX_MULTI_INST as Linux's nvd.h does.
On a PS5, sceAgcAcbWaitOnAddressGetSize and sceAgcDcbWaitOnAddressGetSize return 56 for size 0, 64 for size 1 and 0 for any other 32-bit value, and sceAgcDcbContextStateOpGetSize returns 0 for an operation above 3. The ACB wait size takes a 32-bit argument instead of a byte.
sceAgcDcbWaitRegMem and sceAgcDcbDrawIndirectMulti now write their 0x342 tag writes with header flag bit 2 and sceAgcAcbWaitRegMem with no flags, as libSceAgc on a PS5 does, instead of the predicate bit. ValidateWait accepts both forms and Pm4::IsTagMarker no longer depends on the header flags.
On a PS5 (firmware 13.40) the builder writes SET_UCONFIG_REG 0x342 = 0xc6000005 before its DRAW_INDEX_INDIRECT_MULTI packet and 0xc6000000 after it, 64 bytes in all, and sceAgcDcbDrawIndexIndirectMultiGetSize returns 64.
The 2026-10-21 split PRs added Export.cpp stub files to seven libraries
that have their own CMakeLists.txt, so core/libs/CMakeLists.txt never
adds Export.cpp for them and no target compiled the 101 stubs. A title
that imports one fails to load instead of throwing on the call.
Ngs2, Ngs2.native and AvPlayer.native build with hidden visibility, so
their stub files also need default visibility. libSceNgs2 already
compiled PendingExports.cpp, but its 6 stubs stayed local.
A null command buffer with an unreadable text pointer must take the
checked error path in sceAgcAcbPushMarker; without the buffer check
before measuring the text, the test faults.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
sceAgcAcbPushMarkerSpan, sceAgcAcbSetMarkerSpan, sceAgcDcbPushMarkerSpan and
sceAgcDcbSetMarkerSpan take (buffer, text, length, color) and, on the console,
build the same user-data marker packet as their NUL-terminated counterparts
with the length given by the caller. They now share the existing marker
packets: the text is cut at the given length and terminated, and the set
variants push and pop as sceAgc*SetMarker does.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
PPSA03396 calls sceAgcAcbMemSemaphore and sceAgcDcbMemSemaphore as
(cb, address, waitForMailbox, signalType, operation). Both read the
address from the fourth argument instead, so the call aborted with
"null or misaligned address 0x1".
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAgcCbSetShRegistersDirect and sceAgcCbSetUcRegistersDirect refused a
register list that was not 4-byte aligned. PPSA26344 passes the sh
register list of a shader header that sits 1 byte past an 8-byte
boundary (core_common_subcore.core_b1_fx.sprig.xpps; the unaligned
headers themselves are accepted since #902), and the title aborted with
"null or misaligned address 0x8021363131" after about 11 minutes in the
open world.
The list entries are now copied byte for byte, as #7606 does for register
range values. A null list with a count still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Review on #8302: the ACB workload calls and the DCB stream-inactive call
throw again for a registered stream until a title is shown stopping on
them (as #3789 did for the DCB calls, and as #4709 kept). The debt
entry keeps the firmware's packet layout as the record of what is
missing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
Add the unversioned sceAgcCreateInterpolantMapping and
sceAgcUpdateInterpolantMapping and stop sceAgcUpdateInterpolantMapping_10000
throwing for split f16 defaults, all matching libSceAgc bit for bit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
sceAgcSetAmmSemaphoreMemory and sceAgcGetSemaphoreLabel return the
firmware's errors instead of throwing, registration clears the whole
memory, and sceAgcSetSemaphoreMemory shares the registration with its
1 GiB size limit.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
sceAgcSetStaticBuffer, sceAgcGetStaticBuffer, sceAgcSetStaticQword and
sceAgcGetStaticQword read and write the six 16-byte slots at 0xfe0040000
that the driver already maps for the fetch shader table, through a new
AgcDriverStaticTable_nid_postfix accessor.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
sceAgcAcbSetWorkloadsActive, sceAgcAcbSetWorkloadComplete and
sceAgcAcbSetWorkloadStreamInactive build the same packets as the DCB calls,
and sceAgcDcbSetWorkloadStreamInactive writes a 9-dword IT_NOP with the
stream id, the size of the console's user-data packet. The debt entry now
records the console layout read from libSceAgcDriver.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
sceAgcDriverRequestCaptureStart, sceAgcDriverRequestCaptureStop and
sceAgcDriverTriggerCapture return 0x8A6C1000 without doing anything.
sceAgcSetShaderInstrumentation keeps the flags and returns 0, and
sceAgcGetShaderInstrumentation returns them.
sceAgcDcbBeginOcclusionQueryGetSize is 0x10 for type 0, 0x120 for type 1
and 0 otherwise; sceAgcDcbEndOcclusionQueryGetSize is 0x10.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01RbLgECLQ2bpDM7oe2urGZK
Dean