Prevent reached null conversion destinations from crashing sscanf_s and vsscanf_s. Return EOF before writes and retain earlier assignments. Add regression coverage through both guest ABI entry points.
AI-assisted: yes (OpenAI Codex). Windows WinLibs GCC 15.2 Release: production baseline crashes with the new regression; fixed shared libc passes guest_scan_count, guest_formatting, guest_wide_formatting and guest_strings (4/4). Conventions pass. Full all-target build was deliberately stopped after 83s with 3691 pending targets, not completed. No title or console run; constraint-handler invocation remains unimplemented as documented. No performance or coverage-percentage claim.
A v_mul_f32 in a FLOAT_MODE that flushes f32 denormals emits the
nearest-even tininess check, the NaN result selection and then a
result flush. The check already turns every product that rounds below
2^-126 into a zero of its sign, so the flush can't change what it
keeps. DenormalFlushEliminator now proves that: a select arm guarded
by the tiny-product check of the same denormal-free factors, an arm a
select takes only when its own bits are NaN, and an and with a mask
that has no significand bits are denormal-free.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A guest path is resolved by appending its components to the host root or
to a mount alias directory through std::filesystem::path. On Windows a
component such as "C:" that came first in the appended part was parsed as
a root name, so operator/ replaced the host directory instead of
appending: "/savedata0/C:/Windows/win.ini" and "/app0/../C:/Windows/win.ini"
resolved to "C:\Windows\win.ini", and "/C:/x" lost the component and
resolved to "<root>\x". A colon is an ordinary character in a FreeBSD
file name, so those names belong under the mount.
Guest paths are now split into component names and joined to the host
directory as text. Explicit native drive paths are still passed through.
On NTFS a name containing ":" still opens an alternate data stream; the
libc debt list now records it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
MayEvaluate and the evaluator track the first-lane reads they are inside, so a read reached again through a loop-carried phi or a constant slot is not evaluable instead of recursing.
A bind of slice 1 or later of a depth array read the slice's HTILE but took
its clear only when all its words were equal, because the HTILE word layout
of those slices is not modelled. Neither step needs the layout: the clear
is taken when every word of the range has ZMask 0 (a check over the set of
words), and the store-back rewrites each word in place from its own bits.
The value the surface is cleared to is DB_DEPTH_CLEAR, which the DB's depth
test reads for every cleared tile whatever its Min/Max Z (HTILE_Z_CLEAR_REG
in Mesa's src/amd/common/ac_descriptors.h), the same rule slice 0 already
follows.
PPSA05684 resets the four slices of its 2048x2048 D16 sun cascade array
every frame by writing ZMask 0 words with Min/Max Z 0 or 1 into their HTILE.
Slices 1 to 3 kept the previous frame's depth, and the main menu lost its
volumetric sun shafts and sunlit foliage.
agc_driver_depth_fast_clear_submit: slice 1 with words alternating 0x0 and
0xfffffff0 takes the clear, stores them back expanded and leaves slice 0's
HTILE alone. The refusal case keeps a word left expanded and is renamed.
AI-assisted: yes
The entry sat right after "connect to AF_UNSPEC", where the open #6884 adds
its own entry, so whichever merges second would conflict. Move it after the
mlockall entry, which no open pull request changes. The text is unchanged.
Written with AI assistance (Claude).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Broken Sword - Shadow of the Templars: Reforged (PPSA21480) decodes its
audio itself and uses AJM codec 23 only to resample interleaved s16 PCM
from 44.1 to 48 kHz: every block initializes the instance with
0, 2, 44100, sets the ratio 0.91875 and decodes 235 frames into a
256-frame output. The run threw "AJM: decoding codec 23 is not
implemented".
A codec 23 run now consumes its whole input and emits every output
frame whose position lies inside it, with the Catmull-Rom of the
existing resampler. Cases the title does not show throw, among them a
run after a resampled run without a new initialize.
A compute kernel that stores one colour to every texel of a storage image over a depth plane (a shadow atlas clear) copied
the whole plane depth image -> staging buffer -> mirror before the dispatch and mirror -> staging buffer -> depth image
after it, although the kernel reads nothing and writes every texel.
A dispatch of the 15-word 8x8x1 image clear kernel (direct, no partial last group) whose T# lies on a depth surface now
reads its colour from guest memory under the GPU mutex, the place the kernel reads it. When the dispatch covers the whole
plane, the plane is one layer of level 0, the colour is a value the plane's format holds exactly (0 or 1 for a 16-bit
unorm view, 0 or 0xffff for a 16-bit uint view, 0 or a normal float in (0, 1] for a 32-bit view) and nothing is waiting to
write the colour, the dispatch still writes the mirror but the copy-in is left out, and the copy-out becomes a clear of the
depth image to that value. The colour is read again when the copy-out is replaced; a changed value keeps the copy-out.
Every other dispatch, stencil planes and declined values keep both copies.
agc_driver_depth_clear_hle_tests runs the clear sequences with the clear taken and with the copies, and compares the depth
image texel by texel through the mirror, the guest memory and the depth tests.
socket() returned EPROTONOSUPPORT for every socket type it does not create.
FreeBSD 11.4's socreate returns EPROTOTYPE when no protocol is found, the
protocol is 0 and the type is not 0, and EPROTONOSUPPORT when a protocol was
given. Its inet domain (in_proto.c) has SOCK_RAW entries in every kernel and
a SOCK_SEQPACKET entry only with SCTP, and no SOCK_RDM or other type.
Return EPROTOTYPE for a type the inet domain never has, such as SOCK_RDM,
with protocol 0. SOCK_RAW and SOCK_SEQPACKET keep EPROTONOSUPPORT, since
whether the console creates them is not known. Test the unknown types and
mismatched protocols for AF_INET and AF_INET6, and list the socket types and
families that are not created in the library's technical debt file.
Written with AI assistance (Claude).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Rosetta conversion limits were measured on an M1 running macOS 15.3.1
and an M5 Max. A survey on an M5 running macOS 26.4 executes ANDN, RDRAND,
the rest of BMI1 and BMI2, LZCNT, PREFETCHW, CLFLUSHOPT, AVX, AVX2, FMA,
F16C and MOVBE while CPUID reports none of them, and raises an illegal
instruction for RDSEED, CLWB, RDPID, ADCX and ADOX.
`Path.write_text(newline=...)` and `zip(strict=True)` were added in
Python 3.10. macOS ships 3.9.6 as /usr/bin/python3, the interpreter CMake
finds when no newer one is installed, so `prepare_release_notes` raised
TypeError when the release workflow wrote its notes and the
`pr_overlap_tools`, `release_package` and `linux_fixed_base` tests failed
on a stock macOS host. Writing the encoded text keeps the newline
translation off on every host, and the dynamic tag counts are compared
before the pairs are walked.
select takes descriptors 0 to 2 as a console title's terminal with no input: 0 is never readable and 1 and 2 are always writable. poll threw for them unless the host happened to attach a pipe, so the same title could select on its standard streams but not poll them. poll now gives the same answer, with POLLOUT, the one bit ttydev_poll reports for a writable terminal, for 1 and 2 and nothing for 0.
selscan asks a descriptor once, with the flags of every set it is in (POLLRDNORM for the read set, POLLWRNORM for the write set, POLLRDBAND for the exception set, plus POLLHUP and POLLERR), and marks each set whose flags the answer shares. A seeded random device's randomdev_poll narrows a request with POLLRDNORM to that bit and returns any other request whole, so in the read set it is readable and in no other set, and otherwise it is in each write and exception set it was asked in; select reported it readable and writable together and never exceptional. A regular file or directory went to the host poll, which on Windows threw; vop_stdpoll makes it readable and writable and never exceptional, which select now answers in process on every host, as poll does.
poll threw for /dev/random and /dev/urandom, which select already treats as ready. FreeBSD 11.4's randomdev_poll, once the device is seeded, narrows a request that has POLLIN or POLLRDNORM to those bits and returns any other request whole, POLLOUT and the band bits included. poll now answers that, and the test that relied on the random device throwing uses a kqueue descriptor, which poll still does not support.
poll threw for any descriptor that is neither a socket nor a pipe, so a title polling a file it also reads stopped there. FreeBSD 11.4 hands a vnode to VOP_POLL, and both vop_stdpoll and vop_nopoll return POLLIN, POLLRDNORM and POLLOUT of the requested events for every event poll accepts and never POLLPRI, POLLRDBAND or POLLWRBAND. A file, a directory or a file read from app0.zar now answers that without a host call. File::IsVnode tells such a descriptor apart from the host file type without throwing, so a host socket lent by libSceNet still reaches its own path.
A fill that covers a depth surface's whole stencil plane with four equal
bytes, or its whole depth plane with a value in 0.0-1.0, now reaches the
host image through the pending fast clear the next time the surface is
bound, sampled or stored to. An HTILE fill or HTILE clear kernel noted
afterwards replaces the value with DB_DEPTH_CLEAR/DB_STENCIL_CLEAR.
NoteDepthMetadataFill only reacted to fills of DB_HTILE_DATA_BASE, so the
Cohtml UI of Heretic + Hexen (PPSA26525) and DOOM + DOOM II (PPSA21444),
which resets its stencil plane to 1 with a 0x01010101 fill every frame and
then draws with stencil Equal 1 and 2, kept the stencil of earlier frames
and showed black squares and clipped text. agc_driver_depth_plane_fill
pins the rules.
Cult of the Lamb (PPSA06465, #2686) stops at start-up on the first one:
FAIL: unresolved ELF import pXJh3aVk8Ks from libSceContentDelete.prx
Both exports have been on main without an implementation (#2740); the
call itself has not been observed yet.
Orbital (cc408367, tools/ida/db_types.json:541-542) and SharpProspero
(5dfdb4b0, Interop/Content/ContentDelete.cs:25-42) agree on the
signatures: a 64-bit SceContentSearchContentId and a UTF-8 path. The
content library is empty on the host, since libSceContentExport exports
nothing into it, so no id or path can be found. SharpProspero gives only
NoPermission (0x809D5006) and no public source gives the not-found code,
so both calls throw with the id or path named once the null path and the
initialization are checked, like the "not in the host content library"
throws of #3724. sceContentDeleteById moves from
guest_content_unimplemented to the new guest_content_delete test.
NIDs pXJh3aVk8Ks and qC3QW+AltHs match tools/nid_names.py and the shadPS4
aerolib list.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
(cherry picked from commit 928184824a4acdf36a58287034bff8154c861835)
On Linux, FIONREAD on a datagram socket reports the next datagram only,
where FreeBSD's sbavail counts every queued byte, so a read mark above 1
there could never fire. kevent now throws for it as before; stream
sockets and marks of 1 are unchanged.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The bundled PSNCore.prx of PPSA06888 calls sceNpTrophy2GetRewardIcon
with (context, handle, reward_id, buffer, size): once with a null buffer
to read the size, then with a buffer of that size. The function still
throws because the reward icon data is unknown.
Co-Authored-By: Claude Haiku 5.5 <[email protected]>
simonbronk