Measured from a payload process on a PS5 (firmware 12.70), where
__inet_ntop/__inet_pton and the plain inet_ntop/inet_pton exports
resolve to the same functions:
- inet_ntop follows an AF_INET6 result with zero bytes up to size (sizes
4 to 65536 sampled) and never writes past size; AF_INET writes only the
text and its NUL.
- An unsupported family returns EAFNOSUPPORT first, even with null
pointers.
- A null source or text raises SIGSEGV during the call, before the size
is checked; here it throws instead of returning EFAULT.
- A null destination is reached only after the size check and the text
parse: ENOSPC for a size that is too small, 0 for text that does not
parse, and SIGSEGV (a throw here) otherwise.
The test pins the measured inet_pton and inet_ntop rows, including all
inputs the existing assertions use. The text-form debt entry is replaced
by one that records what a payload process measured (the text forms, the
order of the checks and the padding) and what is still assumed: the
sizes that were not sampled, sizes above 65536, and a title process.
inet_ntoa_r calls __inet_ntop, so a null inet_ntoa_r buffer with room
for the text now throws, and a null buffer that is too small sets ENOSPC
instead of EFAULT; the libSceLibcInternal debt entry says so.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The console's libSceLibcInternal.sprx (measured on firmware 12.70 in
#7549) prints %p as bare lowercase hex without a 0x prefix, prints 0 for
a null pointer, ignores #, + and the space flag, counts only the digits
towards the width, pads with spaces on the left (on the right for - and
with zeros for 0 when there is no precision), treats the precision as
the minimum number of digits, prints nothing for a null pointer under
%.0p, and accepts the l length. FormatPointer instead followed FreeBSD
and printed 0x..., which is what a title does not see on hardware.
FormatPointer now prints the digits alone, the narrow Windows formatter
accepts %lp, and Linux routes %p and %lp to the guest formatter instead
of glibc, which prints the FreeBSD form and (nil) for a null pointer.
The wide family still refuses %lp, because the console's swprintf was
not measured with it; it returns -1 as it does for any other conversion
the formatter rejects. The debt note records the pointer cases the
console was not measured with and what the Linux routing means for a
format that mixes %p with a refused conversion.
sceSystemServiceLoadExec found its own executable through /proc/self/exe
and replaced the process with fexecve after close_range, none of which
macOS has, so on macOS every call except "exit" threw. On macOS:
- the running executable's path comes from _NSGetExecutablePath, resolved
with std::filesystem::canonical, as libSceNpEntitlementAccess and
libSceFont already do;
- the target must be an x86-64 Mach-O executable (MH_MAGIC_64,
CPU_TYPE_X86_64, MH_EXECUTE) that the user may run;
- macOS has no fexecve, so the process is replaced by path with
posix_spawn and POSIX_SPAWN_SETEXEC; POSIX_SPAWN_CLOEXEC_DEFAULT closes
every descriptor but the standard streams, as close_range does on Linux;
- before the replacement the exit starts and the shutdown callbacks run
(LibcStartExit, then LibcRunShutdown), as on Linux, so guest threads
that call a stopped library wait instead of unwinding;
- descriptor 2 gets the host standard error back before the replacement,
as on Linux, and guest_system_load_exec_standard_error runs on macOS.
A launch without arguments keeps the Linux execv path, which macOS has.
guest_system_exit finds its own executable the same way on macOS.
A read event on a listening socket took its data from FIONREAD, which a listening socket refuses on Linux, so kevent and sceKernelAddReadEvent reported 0 connections while saying one was ready. FreeBSD 11.4 gives a listening socket filt_solisten, which reports so_qlen, the completed connections waiting for accept. Ready now checks SO_ACCEPTCONN and on Linux reads a TCP listener's accept backlog from TCP_INFO, where tcp_get_info puts it in tcpi_unacked; with no host call for the count (Windows, macOS, a listener that is not TCP) it reports 1, the lower bound the readiness already implies.
Onimusha: Way of the Sword (PPSA27836 01.000.001) imports
_ZSt26__throw_bad_variant_accessv (9G6z-nF6njg) from libc, and its
bundled libc.prx does not export it, so the title fails to load with
an unresolved import.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GtXavMkgCTCdmRpweviHcQ
A mounted folder uses the junction reparse tag and would otherwise be returned as a relative Volume GUID path. Only a drive path is reported, through the absolute-link text helpers.
