MihawkOS (PPSA99170) reads sysctl {1, 14, 8, 0} while it starts and the
runtime throws on the unsupported MIB, which aborts the title.
KERN_PROC_PROC takes no pid, so the node lists the one guest process the
runtime hosts, as the same kinfo_proc kern.proc.pid already builds.
AI-assisted: yes
GuestLoadAverage's braced initializer left its four bytes of padding after ldavg indeterminate, and the sysctl copies all 24 bytes to the guest. The scaled value of a load over UINT32_MAX / 2048 was converted out of range. The test now checks the padding and the exact fscale 2048 scaling against the host averages read just before and after the call.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD 11.4's sys___sysctl and userland_sysctl copy the name and the
old length in, and copy the value and the length out, so a bad pointer
gives EFAULT in that order. sysctl dereferenced them directly, and
sysctlbyname read its name with strcmp.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
On PS5 firmware 13.60 sceKernelGetProsperoSystemSwVersion and
sceKernelGetSystemSwVersion return 0 for every value in the leading size
field, keep it, write the string and the packed version, and return 0
without writing for a null block.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Source Port (PPSA20040) checks whether a debugger is attached with
sysctl {CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()} into a 1,088-byte
buffer and tests P_TRACED (0x800) in ki_flag at offset 0x170; the MIB was
unsupported, so the title threw at start-up. Return a FreeBSD 11 amd64
kinfo_proc for the calling process with ki_structsize, ki_pid, ki_ppid and
ki_comm filled and every other field 0, so P_TRACED is clear. Like
kern.proc.vmmap, any other pid fails with ESRCH, a write with EPERM and a
short buffer with ENOMEM. The rest of the record is not measured on a
console and is recorded as debt.
Main now returns ENOENT for unknown sysctlbyname and sysctlnametomib names, so the absent-names debt entry no longer says they throw and keeps main's unknown-names entry.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceKernelGetSystemExVersion, sysKernelGetLowerLimitSysexVersion,
sysKernelGetLowerLimitUpdVersion and sceKernelGetTraceMemoryStats were
NotImplemented stubs in libkernel_sys. libkernel, libkernel_sys and
libkernel_web of firmware 13.42 answer them without asking the kernel:
empty strings, a zero version and zero statistics, with the null checks
and return codes the firmware uses, including the plain 22 of
sceKernelGetSystemExVersion.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
FreeBSD 11.4 serves kern.boottime ({CTL_KERN, KERN_BOOTTIME}) from
sysctl_kern_boottime in sys/kern/kern_tc.c as a read-only 16-byte struct
timeval, so a size query reports 16, a short buffer gets a partial copy
and ENOMEM, and a write gets EPERM from sysctl_root. sysctl, sysctlbyname
and sysctlnametomib now answer it with the guest CLOCK_REALTIME minus
CLOCK_UPTIME, taken at the first read and kept. HotSpot reads it while
writing its error report, which aborted with "unsupported MIB 1.21".
PS5VR (PPSA99177) reads sysctl {CTL_KERN, KERN_PROC, KERN_PROC_ENV, pid}
for its own pid at start-up and stopped on "unsupported MIB 1.14.35.<pid>".
The call now returns the empty start-up environment that environ and
libc's getenv also begin with, and follows FreeBSD 11's
sysctl_kern_proc_env for the errors: EINVAL for a MIB without exactly one
pid, ESRCH for another pid or -1, EPERM for a write.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
In a payload process on a PS5 (firmware 12.70), sysctlbyname returns -1
with ENOENT for thirteen names that threw here, and leaves the buffer and
the length alone, for a read, a size query, a null length and a null
buffer with a null length. sysctl does the same for the fixed MIBs of
seven of them. sysctlnametomib gives those seven MIBs and returns ENOENT
for hw.cacheline_size and hw.usermem, which threw too.
machdep.cacheline_size already returned ENOENT and is now tested with
the others. A write to the new names and MIBs throws, as the console's
answer to a write was not tried. The hw.realmem and vm.overcommit debt
entries now say that a payload process gets ENOENT for them as well.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
In a payload process on a PS5 (firmware 12.70),
sysctlbyname("kern.rng_pseudo") answers a size query with 64 and gives
at most 64 bytes per call, up to a 65536-byte buffer. A buffer smaller
than 64 bytes gets as many bytes as its length and a null length gets
none, both with -1 and ENOMEM; a null buffer with a null length returns
0, and errno is kept when the call succeeds. Here the whole buffer was
filled, a size query threw and the length was never changed. The 64
random bytes are now drawn only for a read that passes both a buffer
and a length.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sysctl {CTL_KERN, KERN_PROC, KERN_PROC_VMMAP, pid} for the calling process
returns packed FreeBSD 11 kinfo_vmentry records, one per used range of the
guest arena, with the protection sceKernelVirtualQuery reports. Other pids
return ESRCH, a write EPERM, a short buffer ENOMEM. GuestArena gains a
query for the used range at or after an address.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
