The libc.prx that PS5 titles ship (PPSA05916, PPSA07923, PPSA13934) gives
strerror, strerror_r and strerror_s texts for eight numbers above the
FreeBSD range: 107 "State not recoverable", 108 "Owner dead", 152 "File
positioning error", 1040 "No message available", 1050 "No stream
resources", 1051 "Not a stream", 1062 "Other" and 1074 "Stream timeout".
AnyPS5 answered "error_code=0x%08x" for them. Every other number from
-2000 to 2000, INT_MAX and INT_MIN already matched.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Include upstream fixes for CVE-2026-23865 and CVE-2026-95512.
Add a bounded CID loader regression and preserve the existing guest
outline reference expectations with the updated native backend.
Cover combined null buffer and negative length in sceRegMgrGetStr and sceRegMgrGetBin, and non-positive keys 0 and -1 with minimum buffer size 1. Note the pinned host key-handling assumption in libSceRegMgr debt.
The swscanf of titles' libc.prx (PPSA07923 and PPSA05916 agree) reads
%Ld and %Lx as an int, ignores any length on %p (%lp, %hp), and ends
the scan at an unterminated scanset as a matching failure, even at the
end of the input. Here all three threw. The range test in InSet also no
longer forms a pointer past the end of a set shorter than two members.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The swscanf of titles' libc.prx (PPSA07923 and PPSA05916 agree) accepts
what this scanner threw for:
- a scanset range X-Y matches the units from X to Y; a reversed range
matches nothing, its ends included; a dash first, last or right after
a range is a member, and a ] that opens the set can start a range;
- %s, %c and %[ with any length but l (h, hh, ll, j, z, L) read narrow;
- an unknown conversion such as %y is a matching failure.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A read at a negative offset from a pointer the walker loaded from guest
memory (a null pointer behind a guarded branch, offset -4) wrapped below
zero in AddSignedAddress, and the walk threw "cannot evaluate" instead of
recording the read as inaccessible. Uncharted: The Lost Legacy threw it
while loading its first level. The read is now recorded as an SRT poison
at its address wrapped to 48 bits, like any other unreadable address, so
the binding faults only if the shader takes that path.
verifyGuardedNullPointers gains the case for both branch outcomes; it
throws the title's error without the change.
AI-assisted: yes
A cube T# whose last array slice is 6n - 1 is a cube array of n cubes.
The depth plane path accepted one cube only (last array 0 or 5) and
threw for the rest; it now gathers all 6n slices into the 2D array
view, as the texture path already lays cubes out. The refusal message
also names the last array slice and the copy format.
Uncharted 4's orphanage samples a two-cube D32 shadow array this way.
AI-assisted: yes
The stencil plane text named the game; debt entries carry title IDs
only. It also took the depth plane entry past the 1000-character limit,
so it now has an entry of its own.
AI-assisted: yes
Only the depth plane of a depth surface reached guest memory: stencil
lived in the host image alone. A title that moves stencil with buffer
copies read stale bytes from the source plane, and the destination
surface never saw what the copy wrote. Uncharted 4 clears its G-buffer
stencil plane with a fill, then copies it into the lighting depth
target and on into last frame's planes with a buffer copy kernel every
frame; its lighting kept the stencil marks of earlier frames, so
characters left trails and the image doubled while the camera moved.
The stencil plane of a single-sample surface with the 64 KiB Z swizzle
is now marked drawn when the surface is bound, stored whole when a read
overlaps it (FlushDepthPlanes, like the depth plane) and reloaded from
guest memory when a collected guest write changed it before the surface
is bound or its stencil sampled, unless a stencil clear is pending.
agc_driver_stencil_plane_memory draws stencil, reads the plane through
FlushDepthPlanes, then writes it from the CPU and tests it with stencil
EQUAL; it fails without the change.
AI-assisted: yes
Preserve the local port while reporting a wildcard address after a datagram association is dissolved. Share the state across descriptor aliases and clear it on a successful bind or reconnect.
Adapted from the fix branch linked in issue #8681, with expanded binding, reconnect and descriptor-alias regression coverage.
Co-authored-by: xXPBSXx <[email protected]>
The 28- and 32-byte M4AAC parameter blocks carry two fields at offsets
24 and 28 whose range errors fpPS4 names
SCE_AUDIODEC_ERROR_M4AAC_INVALID_ENABLE_NONDELAY_OUTPUT (0x807F0305) and
SCE_AUDIODEC_ERROR_M4AAC_INVALID_SURROUND_CHANNEL_INTERLEAVE_ORDER
(0x807F0306). shadPS4's AJM AAC decoder outputs every decoded frame from
the first one on when non-delay output is enabled, which is what the
decoder here does, so a decoder created with non-delay output 1 is
accepted and decodes as before. Surround channel interleave orders 1
and 2 still throw, now naming the order: no source says which order
each value selects. Name both errors and test that every access unit
yields its frame from the first one with non-delay output enabled.
The ps5-payload-sdk's fts_build calls __opendir2 with DTF_HIDEW,
DTF_NODUP and DTF_REWIND, and PS5 Bible Reader (PPSA99793) failed to
load on the unresolved import. In FreeBSD 11 those flags only change
reading a union mount, which AnyPS5 does not have, so the call opens
the directory as opendir does; other flags throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The shared UTF-8 decoder behind JSStringCreateWithUTF8CString and
JSStringIsEqualToUTF8CString now applies StringImpl::create's bounds: more
than INT32_MAX bytes throws before decoding, and non-ASCII input decoding to
more than 2147483635 UTF-16 units throws after a successful conversion.
GuestJSStringValidLength mirrors isValidLength and is tested at both limits.
Dean