A family 255 instance with more than one channel carries no stream count
or mapping in its initialization words, so its decoder now opens on the
first packet: the multistream packet's self-delimited streams are counted
(RFC 6716 appendix B), each stream's TOC stereo flag marks it as coupled,
and the channels map in order. A packet whose streams do not make the
channel count throws.
Metal Gear Solid 4 Master Collection (PPSA18194) initializes a 4-channel
family 255 decoder for its intro movie.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
No additional content is ever installed, so deleting one finds nothing:
a null entitlement label answers PARAMETER and any other NOT_FOUND, the
same way sceAppContentAddcontEnqueueDownload does.
Metal Gear Solid 4 Master Collection (PPSA18194) imports it in its game
executable, which fails to load without it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
VLC (PPSA85300) fails to load on the missing getdtablesize import now that
readdir_r is in. Its only call is in a spawn child that never runs, and the
console's descriptor limit is unknown, so the export throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A 2D array storage view of a depth plane from slice 0 threw. It now gets
a storage image over all its slices: each slice with a depth surface at
the plane's address plus a whole depth slice per layer is copied from
that surface before every use and back after the work; the other slices
hold guest memory like any storage image. Cubes, stencil arrays, later
base slices and layer pitches other than the depth slice size still
throw.
GTA V (PPSA04264) stops at compute shader 0x242d4a200 on a 5-slice R32
Z_64KB_X array over its shadow depth surfaces.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01V1W4jdNSKTV7xwuS6xQPJV
SW_64KB_Z_X (0x18) color targets use the texture equations and 64 KiB
block geometry of that swizzle mode, including the equation bits above
the block that R_X targets already apply. PPSA12361 renders the R32
float copy of its depth into one.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PS5MC (PPSA99420, Kodi 22) imports getpriority (miQ1wVwSexE) from
libkernel.prx, one reference, next to chflags in its import order.
Predicted stop once the imports ahead of it are covered (not a run):
FAIL: unresolved ELF import miQ1wVwSexE from libkernel.prx
The NID is computed with tools/nid_names.py and matches aerolib.
Follows FreeBSD 11.4 sys/kern/kern_resource.c sys_getpriority
(8c639945a44588f6cfdddfb057bb5aad88735da0) for the only guest process,
taken to run at nice 0 and to lead its own process group (as kill and
setsid already assume): PRIO_PROCESS and PRIO_PGRP with 0 or its pid,
and PRIO_USER with 0 or its uid 0, return 0; other ids give ESRCH and
an unknown which gives EINVAL. getpriority is a bare system call in
FreeBSD's libc (lib/libc/sys/Symbol.map), so errno is left unchanged
on success.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
(cherry picked from commit 63262245d274342b693fda146ae9feca3752b6e3)
v_cvt_f32_ubyte0 accepts every SDWA source selector, but the other three byte
conversions had no VOP1 SDWA rule, so any SDWA source select on them was refused
("VOP1 SDWA source selector 4 of opcode 0x12 at pc 0xfcc is not supported").
The selected and optionally sign-extended source goes through the same operand
path as for ubyte0 before byte N is extracted: SDWA supplies source 0 (RDNA 2 ISA
guide 6.8 and 13.3.7) and the opcode reads S0.u[8N+7:8N] (12.8).
agc_driver_sdwa_cvt_f32_ubyte: WORD_0 and WORD_1 selects on ubyte1, and
sign-extended WORD_1 and BYTE_3 selects on ubyte2 and ubyte3.
Dead Cells (PPSA15552) calls sceNgs2VoiceGetState on custom sampler
voices with a 48-byte buffer and reads the 64-bit value at offset 16 as
a running counter. Fill it with the decoded sample count, keep the
common state flags, and return INVALID_OUT_SIZE for other sizes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The rebase onto main deleted docs/dev/TechnicalDebt.md, which is now the
index that points into docs/dev/debt/. Restore it from main and add the
missing final newline to docs/dev/debt/libSceNgs2.native.md.
Resolve a host name to its first IPv6 address through the host resolver
(getaddrinfo with AF_INET6) and write the 16-byte address. The lookup
shares the IPv4 path's resolver bookkeeping (abort preservation, error
state); a name without an IPv6 address fails with RESOLVER_ENODNS like a
failed lookup. Nonzero flags throw.
Metal Gear Solid 4 Master Collection (PPSA18194) imports it and failed to
load without it (unresolved zl35YNs9jnI from libSceNet.prx).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
With SIO_UDP_CONNRESET off, a datagram socket connected to a port
nobody listens on no longer fails its next send or receive at all on
Windows, where FreeBSD fails it with ECONNREFUSED.
PS5MC (PPSA99420, Kodi 22) imports chflags (ixrw0h2tWuI) from
libkernel.prx, one reference. Predicted stop once the imports ahead of
it (pthread_getthreadid_np, sendfile, wcstok, pause, setrlimit and the
termios calls) are covered (not a run):
FAIL: unresolved ELF import ixrw0h2tWuI from libkernel.prx
The NID is computed with tools/nid_names.py and matches aerolib.
Follows FreeBSD 11.4 (8c639945a44588f6cfdddfb057bb5aad88735da0)
sys/kern/vfs_syscalls.c kern_chflagsat and setfflags, and
sys/ufs/ufs/ufs_vnops.c ufs_setattr, for a root caller: the lookup
through the guest resolver gives EFAULT, ENOENT and ENOTDIR (also for a
file reached through a trailing slash or used as a directory), a bit
outside the 17 UFS flags of sys/sys/stat.h (VNOVAL included) gives
EOPNOTSUPP, and SF_SNAPSHOT gives EPERM, since the snapshot flag cannot
be toggled. No host keeps BSD file flags and stat reports st_flags 0,
so flags 0 succeed without touching the file and any other flag throws
with the flags named. UF_READONLY and the other Windows-attribute flags
are not mapped to FILE_ATTRIBUTE_READONLY and its siblings: UFS stores
them without enforcing them, and on Windows the read-only attribute is
already the owner write bit of chmod.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
(cherry picked from commit 16e5b7ccd04e6467a5a282b6cfc9271304f42244)
Windows 10 1903 deletes a file with open handles by moving it into
$Extend\$Deleted until the last handle closes, so the next snapshot of a
watched file that a title (or the test) deleted saw a new path, tried to
watch that directory's changes, got ERROR_ACCESS_DENIED and threw from
the watch thread, which aborts the process; the path change was also
reported as NOTE_RENAME next to NOTE_DELETE. A snapshot with a pending
delete or no links now reports NOTE_DELETE alone and drops the parent
directory watch instead of replacing it, as the file has no directory
to be renamed or removed from any more.
The signature is inferred from PPSA12361: a 16-bit keycode, a second
argument the title passes as 0, the type from
sceConvertKeycodeGetImeKeyboardType and a UTF-16 output. The keycode is a
USB HID keyboard usage and the unshifted US character is returned; a
keycode without a character returns 0. A second argument or keyboard type
other than 0 throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The sigaction entry said that the mask and flags of a running handler
are not applied. It now says what is: the signal itself unless
SA_NODEFER, and the first 32 signals of sa_mask, are added to the
process-wide mask while the handler runs, and SA_RESETHAND resets the
disposition first. It also notes what is not: SA_ONSTACK, and the
delivery of a signal left pending by a handler that a host signal ran
asynchronously, which waits for the next raise or _sigprocmask.
Windows writes an exception frame directly below RSP, so a fault resumed on
a guest thread overwrites values a System V leaf function keeps in its red
zone. With --frame-red-zone, a leaf function with a
push rbp; mov rbp, rsp; push ... prologue that reads or writes below its
pushes gets two kinds of trampoline: the prologue lowers RSP by 128 bytes
after its pushes, and each pop ...; pop rbp; ret exit raises it back first.
Sites a branch enters, sites shorter than a jump and sites over a --to-intel
stub are skipped; the conversion reports the framed and skipped counts.
PS5CEMU-HAR (PPSA99360, ps5-payload-dev build, relinks with
--trap-sdk-syscall-stubs) imports pthread_setaffinity_np (5KWrg7-ZqvE)
from libkernel.prx. babyhuey's run with #3787 merged onto main e7c70a2d
(PR #3787, 2026-10-12T10:54:44Z) stops at it:
Windows: FAIL: unresolved ELF import 5KWrg7-ZqvE (pthread_setaffinity_np) from libkernel.prx
Linux: undefined symbol: 5KWrg7-ZqvE (pthread_setaffinity_np)
It follows FreeBSD 11.4 libthr thr_affinity.c (8c639945) over
kern_cpuset_setaffinity: another thread is looked up first (EINVAL for
null, ESRCH when unknown or finished, as _thr_find_thread without dead
threads), a size other than the 32-byte cpuset_t returns ERANGE, the
mask is clipped to sceKernelGetAvailableCpumask and an empty result
returns EDEADLK, as cpuset_setaffinity does. The affinity is stored on
the guest thread through scePthreadSetaffinity, for the caller and for
any live guest thread.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The cache key of relinked images has no time stamp or check sum, so a
different module of the same size loaded at the same base was served the
old tables. The loader now forgets the image when it frees the module, the
cache has a separate valid flag, and the sysmodule name cache is left out
of this change.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
A commit failure inside the guest arena threw and left the reserved range in use. The heap now resets and releases the range, and returns null with ENOMEM when the host is out of memory. reallocalign returns null with EINVAL or ENOMEM like the other allocator entry points.
A size the default heap rejects or the guest arena cannot place, a calloc product that overflows, and an invalid alignment threw through the guest call, which aborted the process. FreeBSD 11.4 returns null with ENOMEM, or EINVAL for an alignment that is not a power of two. Guest arena exhaustion now throws bad_alloc.
Add missing libc.prx symbols required by Unity IL2CPP runtime:
- Implement _Dtest double classification in Math.cpp
- Implement _Inf double constant in Math.cpp
- Implement sceLibcBacktraceGetBufferSize and sceLibcBacktraceSelf in Backtrace.cpp
- Implement _Cnd_signal in Threads.cpp
- Implement _ZNSt8ios_base7_AddstdEPS_ in RuntimeSupport.cpp
- Implement __pointer_type_info and __function_type_info vtables in TypeInfo.cpp
- Remove duplicate stubs from libSceAmpr/Export.cpp
- Add unit tests in GuestMath.cpp and GuestLibcThreads.cpp
- Document unverified behaviors in docs/dev/debt/libc.md
Measured on a PS5 (firmware 13.60): before scePadInit the call returns
NOT_INITIALIZED (0x80920005); after it, a mode of 0 or below returns
INVALID_ARG before the handle is checked, and a bad handle with a
higher mode returns INVALID_HANDLE.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The allocation tracker threw a runtime_error (a hole in the protected range) from inside
sceKernelMprotect, which terminated the title. mprotect already turned the exception into
EINVAL. sceKernelMprotect and sceKernelMtypeprotect now check that the range is registered
first and return EINVAL; the retype of direct mappings is skipped on failure.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Dean