Apply the firmware 13.42 module-probe report in PR #9506: all four DNS calls check initialization first; getters return EINVAL for null outputs or nonzero flags; setters reject flags before reading guest memory. Keep the checked input copy and document EFAULT as host safety, not firmware behavior. Use the current public Net.hpp declarations in the regression.
Rebased onto upstream e7e3e9c198. Ubuntu 24.04, GCC 13.3, Release: actual libc/libkernel/libSceNet libraries and both focused test executables built. guest_sce_net passes. A separate harness linked against those unmodified libraries passes initialization, errno, invalid flags, unreadable-input flag precedence, null clearing and unchanged-output checks. The full guest_net_dns_info test is blocked here: process_vm_readv is denied with EPERM by the execution environment. No full DNS regression pass is claimed. Public-header audit, conventions, test registration and whitespace checks pass.
The resolver still uses host DNS; IPv6 host-server discovery and firmware server-count behavior remain debt. Firmware evidence: https://github.com/boykopovar/AnyPS5/pull/9506#issuecomment-6390574180
AI-assisted: yes
On PS5 firmware 13.60 setpriority(PRIO_PROCESS, 0, v) returns 0 for -25,
-5, 5 and 25, and getpriority keeps returning 0. setpriority keeps its
target checks and returns 0 without storing the value.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Save r12 in the entry walk so TraceImport_nid_no_patch is called with an aligned stack, record only executable Mach-O segments in the module map, and make the test hook check the alignment.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Walk each macOS function import before the guest entry and pass it through TraceImport_nid_no_patch, as Linux and Windows already do. An x86-64 libc build records the call and prints it on SIGABRT.
Both exports threw and were declared without parameters. They follow
LibreSSL 2.5.4, unchanged in 2.7: X509_LOOKUP_file returns the static
80-byte file method, and X509_STORE_add_lookup returns the store's
lookup for a method, or mallocs a 32-byte lookup owned by the store and
pushes it on the store's methods, growing the stack the way sk_insert
does. X509_STORE_free now frees the store's lookups.
The file method's ctrl, which loads PEM files, throws: there is no
certificate model yet. Callbacks of guest-supplied methods throw
instead of being called.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Both exports threw and were declared without parameters. They follow
LibreSSL 2.5.4, unchanged in 2.7: set_hostflags stores the host
matching flags in the verify parameters' identity, and set1_ip_asc
parses an IPv4 or IPv6 address the way a2i_ipadd does, copies the 4 or
16 bytes into a guest malloc block that replaces the previous address,
and returns 0 without touching it for text the parser rejects. IPv4
parts are read with the guest sscanf, as the module would.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The three exports threw and were declared without parameters. They now
follow LibreSSL 2.5.4, the version the firmware 13.40 measurements
identify: X509_STORE_new allocates the 136-byte store with an empty
object cache, an empty lookup method stack and 64-byte verify
parameters at depth -1, X509_STORE_free drops a reference and frees the
store with its stacks, verify parameters and their host names, peer
name, email and IP, and X509_STORE_set_flags ORs the flags into the
verify parameters and adds the policy check for any policy flag.
No export adds certificates, CRLs or lookup methods yet, so freeing a
store that holds them, or verify parameters holding policy objects,
throws instead of freeing objects with no model.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A null batch address is refused whatever the size, so the accepted batch
of zero bytes is one at a real address, which is what TestConsoleEmptyBatch
starts.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A probe on a PS4 decoded exactly one frame and reported 0 for an ATRAC9
run job without RUN_MULTIPLE_FRAMES. Jobs read from a PS4 batch buffer
now do the same. Jobs from the PS5 builders keep decoding their whole
input, which FMOD in PPSA29141 relies on.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceAjmBatchStartBuffer let a null batch of zero bytes through its
parameter check and formed the end pointer from it. A null batch now
returns INVALID_PARAMETER whatever the size, as the PS5 builders'
sceAjmBatchInitialize does; a batch of zero bytes still starts, runs
nothing and completes at once. A test covers both; neither was measured
on a console, which the debt entry says.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
The gapless entry no longer says the one-frame behaviour is unverified,
since the probe measured it, and the libSceAjmi entry names the two
exports its file declares.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Review of the PS4 batch buffer change. The libSceAjmi stub of
sceAjmBatchJobRunBufferRa stays, declared with the _nid_disambig1 suffix
so that both libraries export the NID without defining one name.
sceAjmBatchStartBuffer reads the whole batch before running any job, as
probe batches on a PS4 showed: a buffer chunk of size zero is dropped
whatever its address, and a null address with a nonzero size refuses
the batch with INVALID_ADDRESS in the error record together with the job
chunk, the chunk's offset in the job and the job's return address, with
nothing of the batch run. Inputs and outputs share that rule. The
console-measured result flags move from test comments to the debt
entries.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
PS4 titles build AJM batches with the SDK's inline helpers, which call
sceAjmBatchJobControlBufferRa, sceAjmBatchJobRunBufferRa and
sceAjmBatchJobRunSplitBufferRa and start the buffer with
sceAjmBatchStartBuffer. The buffer belongs to the title, so it has to use
the console's chunk layout rather than this library's private records.
The builders write console jobs (job, return address, buffer and flags
chunks) and return the position after them. StartBuffer checks the
context, walks the chunks, skips inline data and runs each job as the
library's existing control, run or statistics job. Chunk headers are read
as the console's builders write them: bits 0-3 the kind, bit 4 a buffer's
output direction, bits 6-25 the payload; the other bits keep a reused
buffer's old bytes on a PS4. Malformed batches return MALFORMED_BATCH,
unknown chunk kinds and unimplemented control flags throw.
An ATRAC9 run with RUN_MULTIPLE_FRAMES reports which side ran out as a
PS4 does (0x8 input, 0x10 room, 0x18 both), and the ATRAC9 format reports
the frame's bitrate; both were measured on a PS4 with Knowledge is Power:
Decades (Wwise) batch dumps and probe runs. The vibration test's exact-fit
run expects 0x18 accordingly.
The throwing stubs in libSceAjm and the libSceAjmi copy of
sceAjmBatchJobRunBufferRa are dropped.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Co-Authored-By: Claude Fable 5.1 <[email protected]>
A DB_DEPTH_VIEW.MIPID above zero on a surface with DB_Z_INFO.MAXMIP zero selected no level and threw. Flashback sets it while it renders the six slices of a single-level 128x128 Z_X depth array, so the field cannot select another level; decode the first one as the console does.
Implement pthread_attr_setcreatesuspend_np, pthread_resume_np,
pthread_resume_all_np and pthread_multi_np with the sce forms
scePthreadAttrSetcreatesuspend, scePthreadResume, scePthreadResumeAll
and scePthreadMulti, following FreeBSD 11.4 libthr and the firmware
13.42 libkernel_sys module. A thread created suspended waits before its
start routine, outside any cancellation point, until it is resumed.
sceKernelRaiseException throws on Windows for a thread still suspended
at creation.
A handler that read the mask and put it back with SIG_SETMASK stored its
own signal, which sigprocmask reports from the hold, in the process mask
and cleared the hold, so the signal stayed blocked after the handler
returned. pselect, setcontext and a siglongjmp inside the handler replace
the mask the same way. When the handler's own thread releases a hold, the
signal now gets back its bit from before the handler when the handler
returns, as FreeBSD's sigreturn puts back the mask from before it. A mask
another thread sets meanwhile is kept.
Braxton Atkinson