The opt-in guest_libressl_oracle test downloads the LibreSSL 2.5.4
tarball at build time, checks its SHA-256, builds libcrypto and libssl
and compares the AES, digest, DES parity and error-string exports of
libSceLibreSsl and libSceLibreSsl3 with them, printing the cases and
differences per function. The option is off by default and adds no
download then. See #12537.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A capture snapshot read every committed block through the coherent path,
which refuses memory under a multisampled color target, its FMASK or
native multisample depth whose samples exist only on the host, so the
capture stopped there. The snapshot now writes those bytes as zeros,
counts them as host_only_sample_bytes in capture.json and adds a
warning, and the replay starts those targets without their earlier
contents.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The measured rows go into core/libs/prx/libSceAgcDriver/tests/execution/,
the only tests/execution directory in the tree; the guide named only
tests/execution/.
The libc.prx that PS5 titles ship (PPSA05916, PPSA07923, PPSA13934) gives
strerror, strerror_r and strerror_s texts for eight numbers above the
FreeBSD range: 107 "State not recoverable", 108 "Owner dead", 152 "File
positioning error", 1040 "No message available", 1050 "No stream
resources", 1051 "Not a stream", 1062 "Other" and 1074 "Stream timeout".
AnyPS5 answered "error_code=0x%08x" for them. Every other number from
-2000 to 2000, INT_MAX and INT_MIN already matched.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Include upstream fixes for CVE-2026-23865 and CVE-2026-95512.
Add a bounded CID loader regression and preserve the existing guest
outline reference expectations with the updated native backend.
Cover combined null buffer and negative length in sceRegMgrGetStr and sceRegMgrGetBin, and non-positive keys 0 and -1 with minimum buffer size 1. Note the pinned host key-handling assumption in libSceRegMgr debt.
A read at a negative offset from a pointer the walker loaded from guest
memory (a null pointer behind a guarded branch, offset -4) wrapped below
zero in AddSignedAddress, and the walk threw "cannot evaluate" instead of
recording the read as inaccessible. Uncharted: The Lost Legacy threw it
while loading its first level. The read is now recorded as an SRT poison
at its address wrapped to 48 bits, like any other unreadable address, so
the binding faults only if the shader takes that path.
verifyGuardedNullPointers gains the case for both branch outcomes; it
throws the title's error without the change.
AI-assisted: yes
A cube T# whose last array slice is 6n - 1 is a cube array of n cubes.
The depth plane path accepted one cube only (last array 0 or 5) and
threw for the rest; it now gathers all 6n slices into the 2D array
view, as the texture path already lays cubes out. The refusal message
also names the last array slice and the copy format.
Uncharted 4's orphanage samples a two-cube D32 shadow array this way.
AI-assisted: yes
The stencil plane text named the game; debt entries carry title IDs
only. It also took the depth plane entry past the 1000-character limit,
so it now has an entry of its own.
AI-assisted: yes
Only the depth plane of a depth surface reached guest memory: stencil
lived in the host image alone. A title that moves stencil with buffer
copies read stale bytes from the source plane, and the destination
surface never saw what the copy wrote. Uncharted 4 clears its G-buffer
stencil plane with a fill, then copies it into the lighting depth
target and on into last frame's planes with a buffer copy kernel every
frame; its lighting kept the stencil marks of earlier frames, so
characters left trails and the image doubled while the camera moved.
The stencil plane of a single-sample surface with the 64 KiB Z swizzle
is now marked drawn when the surface is bound, stored whole when a read
overlaps it (FlushDepthPlanes, like the depth plane) and reloaded from
guest memory when a collected guest write changed it before the surface
is bound or its stencil sampled, unless a stencil clear is pending.
agc_driver_stencil_plane_memory draws stencil, reads the plane through
FlushDepthPlanes, then writes it from the CPU and tests it with stencil
EQUAL; it fails without the change.
AI-assisted: yes
The 28- and 32-byte M4AAC parameter blocks carry two fields at offsets
24 and 28 whose range errors fpPS4 names
SCE_AUDIODEC_ERROR_M4AAC_INVALID_ENABLE_NONDELAY_OUTPUT (0x807F0305) and
SCE_AUDIODEC_ERROR_M4AAC_INVALID_SURROUND_CHANNEL_INTERLEAVE_ORDER
(0x807F0306). shadPS4's AJM AAC decoder outputs every decoded frame from
the first one on when non-delay output is enabled, which is what the
decoder here does, so a decoder created with non-delay output 1 is
accepted and decodes as before. Surround channel interleave orders 1
and 2 still throw, now naming the order: no source says which order
each value selects. Name both errors and test that every access unit
yields its frame from the first one with non-delay output enabled.
The ps5-payload-sdk's fts_build calls __opendir2 with DTF_HIDEW,
DTF_NODUP and DTF_REWIND, and PS5 Bible Reader (PPSA99793) failed to
load on the unresolved import. In FreeBSD 11 those flags only change
reading a union mount, which AnyPS5 does not have, so the call opens
the directory as opendir does; other flags throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
