sceKernelJitCreateSharedMemory's size object and maximum protection live
in libkernel's g_jitDescriptors, which the receive side of SCM_RIGHTS
doesn't fill, so a received JIT descriptor failed
sceKernelJitMapSharedMemory with EBADF (XairRrR's review). Passing one
now throws, with the random device and directory cases; IsJitSharedMemory
answers it. The merge of main brought #11296's rename of
IsKqueueDescriptor to IsKqueueDescriptor_nid_no_patch, which the kqueue
check now calls.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A guest kqueue and a guest /dev/urandom are /dev/null placeholders with
their behaviour in libkernel's tables, and a guest directory descriptor
keeps its reading state there too. sendmsg sent the placeholder, and the
receiver got a descriptor that failed kevent or read as empty. FreeBSD's
unp_internalize returns EOPNOTSUPP for a kqueue (no DFLAG_PASSABLE), so a
kqueue now gets that; a random device or a directory throws.
A zero-byte sendmsg carrying descriptors on a stream socket returned 0
and lost them, as Linux sends no record without data. It throws now.
FreeBSD sends the control data alone there.
guest_socket_rights checks the kqueue refusal and that the next send on
the pair arrives without control data.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Reuse the macOS disconnect prerequisite in the common POSIX path. Proceed only when getpeername positively reports ENOTCONN, retaining the original connect error for connected or indeterminate sockets.
Exercise actual UDP sockets with injected EAFNOSUPPORT and EINVAL results for IPv4 and IPv6, both disconnect entry points, all three binding modes, and still-connected or failed peer-query outcomes.
Keep native UDP bind, connect and disconnect operations coherent with the shared reported-address state. Reuse the existing connect lock and avoid additional locking on stream sockets.
Add a controlled overlapping disconnect/reconnect regression and check truncated address writes after disconnection. Clear an obsolete IPv6 scope ID when reporting the wildcard address.
Preserve the local port while reporting a wildcard address after a datagram association is dissolved. Share the state across descriptor aliases and clear it on a successful bind or reconnect.
Adapted from the fix branch linked in issue #8681, with expanded binding, reconnect and descriptor-alias regression coverage.
Co-authored-by: xXPBSXx <[email protected]>
pselect read its timeout directly, passed the guest signal mask straight
to SetSignalMaskCatching_nid_no_patch, which dereferences it, and saved
and restored the descriptor sets with memcpy after a caught signal, so a
non-null pointer into unmapped or read-only memory crashed the host. It
now copies the timeout and the mask in with GuestCopyIn_nid_no_patch,
as FreeBSD's sys_pselect does before changing the mask, and saves and
restores the sets with GuestCopyIn_nid_no_patch and
GuestCopyOut_nid_no_patch, failing with EFAULT. A bad timeout or mask
leaves the thread's signal mask unchanged.
poll read and wrote the guest pollfd array in place, so a non-null array
in unmapped or read-only memory crashed the host. It now copies the
array in with GuestCopyIn_nid_no_patch, polls the local copy and copies
the results back with GuestCopyOut_nid_no_patch, failing with EFAULT
like FreeBSD's copyin and copyout. Timeout validation still comes
first, and a failed poll copies nothing back.
A fault on the final message header write, or an installation that fails
part-way, now closes every received descriptor exactly once. A plain-data
MSG_PEEK with control space on a Unix socket reads the data again, as on
main, and the test includes the public headers and counts host descriptors
portably.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
XNU's poll reports POLLHUP as soon as either direction of a stream socket has ended, adds POLLPRI and POLLRDBAND to it and then drops POLLOUT. FreeBSD's sopoll_generic reports POLLHUP only once the receive and the send side are both shut, and Linux does the same, so on macOS a guest saw POLLIN|POLLHUP for a stream whose peer had only shut its sending side, and POLLHUP for one that had only shut its own.
When the host reports POLLHUP on a guest stream socket, ask it about each direction alone and keep POLLHUP only when both have ended, report the requested POLLOUT while the sending side is shut or writable, and leave urgent data to SIOCATMARK.
XNU's poll never reports POLLPRI for out-of-band data, so a guest poll
that asks for it never sees the urgent byte: guest_poll aborts at the
OOB case and a title waiting on priority data would sleep to its
timeout.
On macOS the pending byte is read from SIOCATMARK, which reports it
without consuming it and has no descriptor limit, unlike the fd_set
probe this replaces. POLLRDBAND is set with POLLPRI as FreeBSD 11.4's
sopoll_generic does, and the wait takes the sliced path main already
uses for a kqueue wait, so it wakes on the next slice instead of at the
deadline.
recv(MSG_OOB | MSG_PEEK) was measured to consume the byte on macOS
27.0.1 and kevent with NOTE_OOB does not fire there, which is why the
probe is SIOCATMARK. The select and libSceNet poll paths still miss
urgent data on macOS and are recorded in the debt entry.
Winsock does not answer SO_ACCEPTCONN on a datagram socket, so the
listening check returned the host error (ENOPROTOOPT). A datagram socket
can never listen, so it fails with EINVAL without asking the host, as
FreeBSD 11.4 does. Reported by @wachi35676.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Dean