AnyPS5/docs/dev/debt/libSceHttp2.md

libSceHttp2 technical debt

Silent stubs

• sceHttp2RedirectCacheFlush - returns 0 for any argument without checking it, as the 13.42 module does (#10536); automatic redirects throw, so there is no redirect cache to flush

Unknown function info

• Additional HTTP2 exports - these name/NID pairs are present in the 13.60 export inventory. Parameter lists, return types and behavior are unverified. Parameterless int declarations are import-resolution placeholders, not verified ABI prototypes; every entry throws through NotImplemented_nid_no_patch. No runtime functionality is implemented.

Name	NID
sceHttp2GetAllTrailingHeaders	CjxqMyx2-pU
sceHttp2SetProxyWithURL	fkKvmzFNBe8
sceHttp2SetRequestServerName	zx9s1Lk+O90
sceHttp2SetStripGZIPHeadersEnabled	mMWZm0+7XHM
sceHttp2WebSocketClose	v2hFBiyS13w
sceHttp2WebSocketSendDataMessage	D1IAo-CNswA
sceHttp2WebSocketSendTextMessage	jSHMX1oSE+E
sceHttp2WebSocketSetCloseTimeout	4PUc7B6Zr+c

• sceHttp2DeleteCookieBox (libSceHttp2) - imported by PPSA35943's Unity player. The (int cookieBoxId) signature follows SharpProspero. A box sceHttp2CreateCookieBox returned is discarded; an unknown or already deleted id returns the library's invalid-id error (0x817B1100), as prosper does; not measured on a console

• libSceHttp2 cookie boxes (libSceHttp2) - sceHttp2CreateCookieBox takes a machine-sized pool size and requires at least 64 KiB. On 13.42 the pool is rounded up to 16 KiB (wrapping to 0 for SIZE_MAX) and mapped with sceKernelMapNamedFlexibleMemory, whose error is returned unchanged; the host maps it the same way under an assumed name, but does not reproduce native cookie-heap bookkeeping, identifier ranges or retained request references. Its delete signature and invalid-ID error are confirmed. sceHttp2SetRequestNoContentLength takes only the request id. sceHttp2CookieFlush empties a cookie box and answers 0 for any other id. Nonzero cookie-box binding by sceHttp2SetCookieBox throws

• libSceHttp2 cookie store (libSceHttp2) - behavior follows a run of GuestHttp2Cookies.cpp's sequence against 13.42's libSceHttp2.sprx (#10534). Not reproduced: the 0x817B1076 stack check below 0x1FD0 bytes of stack, and the pool size is not enforced. Assumed, not measured on libSceHttp2: the default total limit of 3000 with the 10 oldest dropped past it, and the NUL, space, NUL written after the header (both libSceHttp's), which of no match and null cookie/required is checked first, public-suffix rules for Domain, and dates beyond the tested ones. Equal-length paths come out with the first stored last, a rule inferred from the runs

• libSceHttp2 pending exports - 5 named callable exports were identified in the PS5 3.20 export table and cross-checked against firmware 13.60. Signatures and behavior remain unverified; declarations use the unknown-signature convention and throw through NotImplemented_nid_no_patch. Evidence: 3.20 export list.

Functional

• Default TLS trust (libSceHttp2) - HTTPS connections also trust the system CA list, /<sandbox word>/common/cert/CA_LIST.cer, served by libkernel from the host trust store, after the title's own libSceSsl certificates. RetroArch (PPSA99169, updater), PS5LM (PPSA99575) and Porpoise (PPSA99764) send version-3 requests to public https:// servers with no loaded certificate, verify callback or verification option, which pass the known-CA check only if the console trusts public roots by default. That the console's roots are exactly this file is not measured

• libSceHttp2 transport - synchronous version 1/2 requests use HTTP/1.0 or HTTP/1.1 over HTTP or HTTPS; version 3 requires HTTPS and ALPN h2. HTTP/1.x supports fixed-length, chunked and close-delimited responses; chunk trailers are validated and discarded. Cleartext HTTP/2, negotiation fallback, connection reuse, multiplexing across requests, CONNECT, HTTP/2 response trailers and authentication challenges throw. Nonempty HTTP/1.0 uploads without Content-Length also throw. HTTP/1.x framing follows RFC 9112; HTTP/2 follows RFC 9113. Native behavior remains unverified.

• libSceHttp2 transport ABI - version values, string methods, header overwrite/append modes, status/read/content-length signatures and timeout units follow SharpProspero. prosper records the method argument as an integer instead. These are public compatibility contracts, not console measurements.

• libSceHttp2 error paths - these throw, as their console codes are not implemented: lookup failures, expired deadlines, other sceSslConnect results, cancellation, protocol failures, malformed inputs, concurrent calls on one request and exhausted connection slots. Handshake failures a PS5 payload measured against loopback TLS servers pass through unchanged, but two cannot be reached until libSceSsl changes: the console returned 0x80410136 for a peer that resets during the handshake and 0x80951D78 for a reply that is not TLS, where the host libSceSsl returns 0x8095170D and throws respectively. The other five, 0x8095F00B, 0x8095F00C, 0x8095F00D, 0x8095F010 and 0x8095170D, match the host libSceSsl; #11922 lists each case. After a failed send sceHttp2GetStatusCode returns 0 and stores 0, the content length and read calls return 0x817B1065, and another send returns the same error.

• libSceHttp2 connections - socket connect errors propagate the libSceNet result, following the module-analysis report in prosper #2894; the report does not establish every exported error path. A request uses one connection; a context's concurrency cap counts connections until EOF, failure or deletion. Native pooling, scheduling, validation order and teardown semantics remain unverified. DNS uses two host workers and a queue of eight; cancellation/deadlines abandon the caller's wait, not libc's lookup. Library unload can wait for a host lookup to return. A resolve retry resubmits a failed lookup with a new timeout; a timed-out lookup isn't retried. The console's retry semantics are unverified.

• libSceHttp2 request deadlines - the host checks the overall deadline before buffered as well as socket reads, matching its HTTP/2 path. Whether the console allows consuming a response buffered before expiry after that deadline is unmeasured. Native timeout errors and validation order remain unverified; expiry throws.

• libSceHttp2 TLS settings - minimum SSL versions outside 2 to 5 and flags outside 0x3d throw. SSL callbacks use the verification adapter described below. Supported certificate-check bits follow SharpProspero and use libSceSsl's TLS 1.2 backend and CA context; native defaults and error translation are unverified. Settings on object kinds other than templates/requests throw, except for the request options below and context SSL flags; other native restrictions are unverified. Settings become immutable when transport is created. Zero timeout values, negative resolve retries and connection-slot wait timeouts throw; a failed lookup is retried up to the set count. Host HTTP allocations are not charged to the context pool, so sceHttp2GetMemoryPoolStats reports a live context's pool size with zero peak and current use. PPSA01494, PPSA30839 and PPSA31162 read them for logging without checking the result and stopped at startup while it threw.

• sceHttp2SetMinSslVersion - libSceHttp2's own range and validation order are not measured: versions 2 (SSL 3.0) to 5 (TLS 1.2) are accepted, the range sceSslSetMinSslVersion takes on a 13.40 console (libSceSsl). The floor is not kept: libSceSsl negotiates TLS 1.2 only, which meets every accepted floor, so a server limited to versions older than TLS 1.2 fails the handshake whatever the floor; what a lower floor does with such a server on a console is not measured.

• sceHttp2SslEnableOption, sceHttp2SslDisableOption (libSceHttp2) - accept a context id as well as a template or request, as prosper does for any live object; PPSA06866 sets them on its context (#13715). The context keeps the flags and templates created after the call copy them; that inheritance, and whether templates already created see the change, are not established by any source or measured on a console

• libSceHttp2 request options - extends the TLS settings entry: the auth and redirect flags, headers and the auth-info and pre-send callbacks live in Http2::Settings, are copied into each new request and become immutable once transport exists; the getters still read them then. Accepted kinds, defaults, copying, header modes, error codes and their order follow the 13.42 module run in an emulator (#10536), not a console. A null out-pointer to sceHttp2GetAuthEnabled is written through on that module; here it throws. The pre-send callback type is unknown. The transport never calls either callback, and the auth cache flush only validates the context

• sceHttp2GetAllResponseHeaders returns the final raw HTTP/1.x header block, excluding the terminating NUL, owned until request deletion. Its native size/lifetime contract remains unverified. HTTP/2 serialization still throws because its representation has not been established. Status and Content-Length fields are decoded; chunked HTTP/1.x reports kind 2, absent Content-Length kind 1, following SharpProspero.

• libSceHttp2 gzip responses - sceHttp2SetInflateGZIPEnabled stores the flag. When it is set and the response carries content-encoding: gzip, the HTTP/2 path inflates the body with the vendored zlib before sceHttp2ReadData and sceHttp2GetResponseContentLength see it, and reports the inflated length; both calls wait for END_STREAM while the enabled response is gzip. The transport neither adds nor inspects Accept-Encoding, so the guest supplies that request header and an unsolicited gzip response is inflated too. Whether a console rewrites the header block (Content-Encoding and Content-Length) is unverified, so the serialized headers keep the fields the server sent; other encodings are not inflated, a malformed or truncated stream, a bad checksum or size and concatenated members throw, and the optional gzip header CRC is not verified.

• libSceHttp2 asynchronous requests - send/read submission and sceHttp2WaitAsync throw. The previous offline implementation queued a fabricated network failure and used event type zero; public sources do not establish the completion event types, wait timeout updates, cancellation results or ownership of async buffers. PPSA17221's kqueue layout and PPSA15508's 24-byte wait result establish caller ABI only. No completion or equeue event is manufactured.

• Host request header (libSceHttp2) - a Host header set with sceHttp2AddRequestHeader becomes the request's :authority pseudo-header and is not sent as a Host field, following the HTTP/1.1-to-HTTP/2 translation in RFC 9113 section 8.3.1. The last value set wins. The console's handling of a Host that differs from the URL authority and of whitespace in the value is not measured; here whitespace throws.

• WebSocket ping settings: both setters take a 32-bit request ID and a 32-bit interval/timeout in microseconds, confirmed by the timer consumer and its clock conversion. The protected implementations remain unchanged.

• sceHttp2Init - a negative maximum concurrent request count throws, and the pool size is not checked. In a payload process on a PS5 (firmware 12.70), with a 64 KiB pool, a count of 0 returned 0x817B11FE (invalid value) and a count of 1 returned 0x817B121D (pool too small). A count of -1 with that pool, and a count of 1 with a 1 MiB pool in a second run, produced no result before the runner's timeout, so their return values and the smallest accepted pool are not measured. Every call with a constant count in the titles checked passes 1 to 32, and every call with a constant pool size passes 256 KiB to 2.75 MiB, the range above the measured 64 KiB pool; the value of the other calls is not known.

• libSceHttp2 automatic proxy configuration - flags 0 and 1 both use direct connections, matching libSceNetCtl, which reports proxy configuration off, an empty server and port zero. Other flag values throw. This is the host configuration policy, not a console measurement of proxy discovery; PAC/WPAD and configured proxies remain unsupported. The boolean argument and acceptance of 1 by callers are evidenced by OliSe Player and RetroArch; call sites do not establish library behavior.

• libSceHttp2 redirects - native caching, callback scheduling, target-reference delivery and method/body rewriting remain unverified. The typed callback, zero-follow/nonzero-refuse behavior and six-redirect cap follow SharpProspero, not console measurements. Refusal exposes the received status/body. Method selection follows RFC 9110 section 15.4; URI reference resolution follows RFC 3986 section 5.2. HTTP/2 downgrade to HTTP, duplicate Location fields, invalid callback methods, redirect-limit exhaustion and changing active-request options throw; native error mappings are unknown.

• libSceHttp2 SSL callbacks - callback scheduling and refusal error mappings remain unverified on a console. The SSL-context/error-mask/certificate-chain/user-argument signature follows the on-device header. Zero accepts the chain; nonzero refuses it, following SharpProspero HTTPS callback semantics. libSceSsl supplies real peer handles and verification flags for each TLS hop. Refusal, cancellation and unsupported verification failures throw while their native HTTP2 error mappings are unknown. Changing active-request options remains unsupported.

• HTTP/1.x gzip inflation - a nonempty gzip response with inflation enabled throws; the HTTP/1.x decoder is not implemented. With inflation disabled, encoded bytes and wire lengths are retained. Non-gzip responses and bodyless responses retain their existing handling. Native error mapping remains unverified.

Additional PS5 3.20 imports (xdCloudy #9485)

• sceHttp2Unknown_*_nid_no_patch (libSceHttp2) - 1 PS5 3.20 import declarations (_Z5dummyv). Their prototypes and behavior are unverified; each uses the no-parameter import-resolution convention and throws through NotImplemented_nid_no_patch. This records the export names without claiming an ABI or behavior. Source: PS5-3.20_Libs.