Follows firmware 13.42's libSceVrHand.sprx, read from its disassembly and
run natively on x86-64: a null pointer, a size word other than 0x20 or a
nonzero byte in parameter offsets 4 to 31 returns 0x8a870006 without
writing; otherwise the output receives 0x3c00000 and 0x10000 followed by
20 zero bytes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
