Both libc debt entries said the console behaviour was unverified. The
libc.prx that PPSA13934 ships in sce_module/ settles them (read from
disassembly, not measured on a console):
- _Mtx_trylock (0x5cf0) passes its argument to scePthreadMutexTrylock
and returns 0 on success, 3 for SCE_KERNEL_ERROR_EBUSY and 4 for any
other error.
- strdup (0x6b440) calls strlen and strndup (0x6b650) calls strnlen on
the source with no null check, so both fault on a null source, except
strndup(NULL, 0), which returns an empty copy where this libc returns
null with EINVAL.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
strcoll called the host's strcmp, which returns -1, 0 or 1 on Windows.
The libc.prx bundled with eleven titles returns, in the C locale, the
difference of the unsigned bytes at the first mismatch, as its strcmp
does; strcoll now computes that.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
sceNetConfigGetIfFlags answers interface 0, lo0 in the sceNetGetIfName
numbering, with IFF_UP | IFF_LOOPBACK | IFF_RUNNING | IFF_MULTICAST, the
flags FreeBSD 11 gives a configured loopback. Other interfaces and a null
flags pointer throw: the library models no other interface.
sceNetInitParam initializes the library as sceNetInit does and returns
its result. NetInitializeParameter's layout is unknown, so its fields are
not read; a null parameter throws because its console result is unknown.
scePadSetVibrationForce takes the same handle and vibration parameter as
scePadSetVibration and returns its result. No system vibration-off state
exists here for it to override: scePadSetVibrationMode only stores its
mode.
scePadResetLightBarAll returns each standard port's light bar to its
default, as scePadResetLightBar does for one handle.
scePadResetLightBarAllByPortType does the same for the standard port
type and nothing for the special one. It throws for types 3, 4 and 16,
and rejects other types with INVALID_ARG, as scePadOpen does.
A handle is valid for its own port type while the handle table that
scePadGetHandle reads holds it open: a standard port that is open, a
special slot that is in use, or the open remote port. Any other port
type answers false.
The map, map direct and mtype-protect writers take type as a 64-bit
value and store it in the record's 32-bit field. That matches
sceKernelWriteModifyMtypeProtectCommand and the libSceAmpr siblings,
whose type is 32 bits, but nothing checked it. A type with bit 32 set
now has to record the same bytes as the sibling given the low 32 bits,
and the debt entry says the console's handling of such a type is not
measured.
sceKernelGetTscFrequency times 20 ms of TSC ticks against the monotonic
clock. A thread that moves to another CPU during the sleep reads its end
value from another TSC. Where the TSCs of the CPUs differ, as on a Windows
VM whose vCPU 0 counts about 3.8 billion ticks ahead of the others, the
frequency came out as 0 or as 180 GHz. Pin the calibrating thread to the
CPU it runs on and restore its affinity afterwards.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Source Port (PPSA20040) checks whether a debugger is attached with
sysctl {CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()} into a 1,088-byte
buffer and tests P_TRACED (0x800) in ki_flag at offset 0x170; the MIB was
unsupported, so the title threw at start-up. Return a FreeBSD 11 amd64
kinfo_proc for the calling process with ki_structsize, ki_pid, ki_ppid and
ki_comm filled and every other field 0, so P_TRACED is clear. Like
kern.proc.vmmap, any other pid fails with ESRCH, a write with EPERM and a
short buffer with ENOMEM. The rest of the record is not measured on a
console and is recorded as debt.
