The hmd2s sweep left 81 libSceHmd2 exports that answer 0x8a720008 to
all-null arguments but something else to zeroed buffers. A second probe
called each of them six times before sceHmd2Initialize, every argument
pointing at a zeroed 16 KiB buffer except one, to find which arguments
are the checked pointers. 62 exports answer 0x8a720008 exactly when one
of a fixed set of arguments is null and their all-present code otherwise:
48 check the first argument, 10 the second, 6 the first two, 2 the first
and third, 2 all six. They are bound here, by NID, to 18 handlers with
that many pointer parameters, each returning ParameterNull for a null
checked pointer and otherwise the measured code (0x8a720004 for 20 of
them, 0 for 11, 0x8a721002 for 10, -1 for 5, 0x8a720009 for 7,
0x8a72002c for 3, and 0x8a720003, 0x8a721003, 0x8a721010 and 0x800d0203
for the rest) while the library is not initialized, throwing if
sceHmd2Initialize ever succeeds.
Left out: 7 exports that write output and 12 whose first argument is a
handle or slot number rather than a pointer. The debt entries list every
NID with its aerolib name where one exists.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
A sweep of the 281 libSceHmd2 exports on a PS5 (firmware 13.60), each
called from a payload before sceHmd2Initialize once with every argument
null and once with every argument pointing at a zeroed 16 KiB buffer,
found 127 that answer the same code both ways and write nothing. 125 of
them are bound here, by NID, to one handler per answer: 45 return 0, 16
return 0x8a720008, 15 return 0x8a720004, 12 return -1, 10 reprojection
exports return 0x8a72000b, 9 return 0x8a720002, 9 return 0x8a720009, 5
return 0x8a721002 and one each returns 0x8a72002c, 0x8a721003, 0x400 and
0x20000. Each handler returns its measured value while the library is not
initialized and throws if sceHmd2Initialize ever succeeds, because the
initialized behaviour is not measured; since b378541e79 it fails with
UnsupportedFeature here, so these are the answers titles get.
Left out: the export that returns a pointer-like value, the one answering
0x8a72000a (which sceHmd2Initialize also returns for some applications),
the exports that answer differently to null and to zeroed arguments or
write output, the 16 that crashed the probe, and the exports that main,
its aerolib name where one exists.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Host logging opens its own FILE on the saved descriptor. The guest FILE stays on the replaced descriptor, so guest printf, puts and fprintf still reach the pipe.
Implement sceRudpPollCreate, sceRudpPollControl, sceRudpPollWait and
sceRudpPollDestroy with the PS Vita signatures and argument checks.
sceRudpTerminate removes the context from every poll and sceRudpEnd
destroys the polls and wakes their waiters.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
#7018 reads the low-half factors of v_mul_lo_u16 and v_pk_mul_lo_u16
as 24-bit fields because AMD's Windows driver stores the full 32-bit
product when it knows both factors fit in 16 bits. #7673's fold of
BitFieldUExtract(x, 0, n) into x removed those reads when the program
had masked the factors to 16 bits, so agc_driver_mul_lo_u16_high_half
failed again on that driver. The folder now keeps a field read that a
multiply uses.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The blocked-destination case checks a different file, so an in-place
rewrite passed it. The earlier case is back beside it: a directory at
<name>.tmp makes the write fail, and the previous aps5-bench.json.gz must
be unchanged. It is left out of Windows builds, where the
std::ios_base::failure thrown inside the MinGW ofstream did not unwind to
the test's catch.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
