XNU's poll never reports POLLPRI for out-of-band data, so a guest poll
that asks for it never sees the urgent byte: guest_poll aborts at the
OOB case and a title waiting on priority data would sleep to its
timeout.
On macOS the pending byte is read from SIOCATMARK, which reports it
without consuming it and has no descriptor limit, unlike the fd_set
probe this replaces. POLLRDBAND is set with POLLPRI as FreeBSD 11.4's
sopoll_generic does, and the wait takes the sliced path main already
uses for a kqueue wait, so it wakes on the next slice instead of at the
deadline.
recv(MSG_OOB | MSG_PEEK) was measured to consume the byte on macOS
27.0.1 and kevent with NOTE_OOB does not fire there, which is why the
probe is SIOCATMARK. The select and libSceNet poll paths still miss
urgent data on macOS and are recorded in the debt entry.
The modules these entries were read from record SDK 13.60 (0x13600007)
in their module-param segment, so they are firmware 13.60. Only the
version label changes; the behaviour described is unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013XFS3FUfBtqCVfwmBrRQ6q
A target in host code got the delivery as an APC as well as through the
return breakpoint and the sampling. An APC runs in any alertable wait,
so host code that waits alertably while holding a lock would have run
the guest handler inside that wait with the lock held. The APC is now
queued only while the target is in a libkernel wait (Pthread waitCount),
the point where the handler already ran before; a target elsewhere in
host code takes the delivery when it returns into guest code.
guest_raise_leaves_host_code adds a target in an alertable
WaitForSingleObjectEx: each raise must return in under 500 ms and the
handler must run in the executable after the wait was released. The
earlier behaviour (an APC for every host-code target) fails it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
RaiseOn suspended the target and, while it sat in host code, resampled
it until a 50 ms limit and then redirected it into the handler there.
A handler that waits, as Unity's GC thread-stop handler does, then held
whatever host lock the thread had: in Graveyard Keeper 2 a job worker
stopped inside shader specialization kept the shader registration lock,
another worker blocked on that lock never ran its own stop, and the
load froze with 39 of 40 threads acknowledged (about 1 in 15 loads).
A target in host code is never redirected now. The raise queues the
delivery as an APC (taken when the thread waits alertably), arms a
debug register 0 execute breakpoint at the frame's return address into
guest code (found with the image's own .pdata and RtlVirtualUnwind,
stopping at frames that push a machine frame, guarded against faults),
and hands the target to a host deliverer thread that keeps sampling it.
The first of the three to reach the thread delivers, through one taken
flag per delivery. A target in guest code is still redirected at once;
a target inside NtContinue still makes the raise throw after 1 s.
guest_raise_leaves_host_code checks that a handler never runs in host
code, for a target blocked in WaitForSingleObject and one busy in
MultiByteToWideChar, and that each raise of the blocked one returns in
under 500 ms.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Retr0