AnyPS5/docs/dev/debt/libSceNetCtl.md

libSceNetCtl technical debt

Unknown function info

• sceNetCtlScanIpcInt (libSceNetCtl) - argument registers and IPC transfer directions are recovered for the info, connection, scan, NAT, bandwidth and Wi-Fi queries. The connection configuration is 1464 bytes, scan options 88, BSSID output 96, scan info 112, IPv6 info 256, internal NAT info 196, bandwidth info 32, bandwidth-estimation info 28 and Wi-Fi info 48. Their field semantics still require the receiving service; incomplete declarations preserve this gap. Scan queries transfer a six-byte BSSID and use a 64-bit in/out buffer size.

• sceNetCtlGetInfo (libSceNetCtl) - answers from the host interface with an IPv4 address, preferring the default-route one: its address, netmask, gateway, MTU and first two IPv4 DNS servers. The device is always reported as wired, the link as connected, the IP configuration as DHCP and the HTTP proxy as off, and the Ethernet address is the one from sceNetGetMacAddress. A missing gateway or DNS server is 0.0.0.0; the console value is unknown. The DHCP host name (12), PPPoE user name (13), HTTP proxy server (20) and Wi-Fi BSSID and SSID (5, 6) are empty strings and the other Wi-Fi codes (7-10) and the proxy port (21) are 0, as that configuration sets none of them; this follows KytyPS5 and is not measured on hardware. One title (PPSA02225) calls code 12 at 0x1056f0f, 0xa0387f and 0xa26de5 and code 14 at 0x1056fa1; the meaning of the flag byte it checks is not shown.

• sceNetCtlGetInfoV6 (libSceNetCtl, NID Jy1EO5GdlcM) - imported by PPSA08587. (int code, SceNetCtlInfoV6* info) with codes 1-5 (IP address, link-local address, default route, primary and secondary DNS) comes only from SharpProspero, whose source is unknown; shadPS4 and fpPS4 only stub it. A null info answers INVALID_ADDR, a code outside 1-5 INVALID_CODE, and a host without an IPv6 address NOT_CONNECTED, as sceNetCtlGetStateV6 reports it. The layout of each answer is unverified, so every code throws on a host with an IPv6 address

• sceNetCtlGetResult (libSceNetCtl) - (int eventType, int* errorCode) reports no error: event types 1-3 (disconnected to IP obtained, the numbering sceNetCtlCheckCallback delivers) write 0 to errorCode, as sceNetCtlGetResultV6 does. The error code a console reports for each event, a disconnection's cause in particular, is unconfirmed. Callers found: PPSA20052 (Worms Armageddon: Anniversary Edition 01.003.000) calls it 2 s into boot, and PPSA24191 (Monster Hunter Wilds) without a network, with event 1 (disconnected) as its first call. A null errorCode answers INVALID_ADDR and other event types throw, as their error code on a console is unknown

• sceNetCtlGetResultV6 (libSceNetCtl, NID H5yARg37U5g) - (int eventType, int* errorCode) comes only from SharpProspero, whose source is unknown; shadPS4 only stubs it. The host backend has no IPv6 service errors, so event types 1-3 write 0 to errorCode; what a console writes before the first event is unmeasured. A null errorCode answers INVALID_ADDR, as sceNetCtlGetResult does, and other event types throw, as their error code on a console is unknown

• sceNetCtlRegisterCallbackForNpToolkit, sceNetCtlUnregisterCallbackForNpToolkit, sceNetCtlCheckCallbackForNpToolkit (libSceNetCtl) - a table of eight callbacks apart from the IPv4 and IPv6 ones, with the (int eventType, void* arg) callback, follows shadPS4, whose NpToolkit check delivers the same events to that table. The three share the register, unregister and dispatch of sceNetCtlRegisterCallback, sceNetCtlUnregisterCallback and sceNetCtlCheckCallback, so they return the same initialization, address, slot-limit and ID errors, and the check reports the state sceNetCtlCheckCallback does. Whether the console keeps this table apart, and what sceNetCtlCheckCallback does with it, is unverified on hardware

• sceNetCtlRegisterCallbackForLibIpcInt, sceNetCtlUnregisterCallbackForLibIpcInt, sceNetCtlCheckCallbackForLibIpcInt (libSceNetCtl) - the (callback, argument, callbackId) signature and separate eight-slot table are inferred by analogy with their NpToolkit and IpcInt siblings; shadPS4 only stubs them. They share the register, unregister and dispatch of the other callback helpers. Whether the console keeps a separate table for ForLib, and what sceNetCtlCheckCallback does with it, is unverified on hardware

• sceNetCtlGetStateIpcInt, sceNetCtlGetStateV6IpcInt, sceNetCtlGetResultIpcInt, sceNetCtlGetResultV6IpcInt, sceNetCtlGetInfoIpcInt, sceNetCtlGetInfoV6IpcInt, sceNetCtlRegisterCallbackIpcInt, sceNetCtlUnregisterCallbackIpcInt, sceNetCtlRegisterCallbackV6IpcInt and sceNetCtlUnregisterCallbackV6IpcInt (libSceNetCtl) - answer as their public twins, whose recovered argument registers they share: the getters return and write what sceNetCtlGetState, GetStateV6, GetResult, GetResultV6, GetInfo and GetInfoV6 do, throws included, and the callback forms use the IPv4 and IPv6 tables, as no IpcInt check is exported to deliver a table of their own. This rests on the matching call shapes, not on a measurement; whether the internal client answers a null pointer or a bad code before its service does is unknown

• ApRp exports are constant-success functions in the supplied native module and consume no arguments. No callers were found in the supplied system-library decompilations, so unused callback, output and configuration argument types remain unresolved.

Functional

• sceNetCtlCheckCallback - host address changes stand in for native service events, following the existing KytyPS5 state-transition model. Each IPv4 or IPv6 callback receives an initial connected/disconnected event and changes matching sceNetCtlGetState or sceNetCtlGetStateV6; intermediate connection states and errors are not represented, and console timing remains unverified. Native CheckCallback drains both service queues, as recorded in the recovered-contract correction. Dispatch snapshots both tables before invoking any callback, so a registration made during a callback waits for another check and unregistering concurrently may leave one callback in flight; native dispatch holds its registration lock.
• libSceNetCtl initialization (libSceNetCtl) - the library starts initialized, as titles find it: it is the internal sysmodule 0x80000009, and PPSA11386, PPSA20049, PPSA02530, PPSA14632 and PPSA15878 register and check NetCtl callbacks without importing sceNetCtlInit. PPSA11386 executes int 0x42 at start-up unless sceNetCtlRegisterCallback returns 0. So the supplied module's SCE_NET_CTL_ERROR_NOT_INITIALIZED answers are unreachable, since Term is a no-op. Whether the console's process start or the module's start sets that state is not measured.
• sceNetCtlGetInfo (libSceNetCtl) finds the host's default route in /proc/net/route on Linux and, on macOS, in the routing table read with sysctl(NET_RT_FLAGS, RTF_GATEWAY), where an interface-scoped default route ranks after the unscoped one
• sceNetCtlGetIfStat (libSceNetCtl) throws on macOS: an unprivileged process reads the interface byte counters (getifaddrs and sysctl(NET_RT_IFLIST2) alike) reduced to their low 32 bits, so a total would wrap every 4 GiB
• Host interface cache (libSceNetCtl) - on Windows, sceNetCtlGetState, sceNetCtlGetStateV6, sceNetCtlCheckCallback, sceNetCtlGetIfStat and sceNetCtlGetInfo reuse the last host interface query until NotifyUnicastIpAddressChange, NotifyIpInterfaceChange or NotifyRouteChange2 reports a change, instead of calling GetAdaptersAddresses on every call. A DNS server change with no address, interface or route change is seen only at the next such change. If the notifications cannot be registered, every call queries the host as before.
• sceNetCtlGetNatInfo (libSceNetCtl) - performs RFC 5389 STUN binding probes from the active host IPv4 interface against stun.playstation.net and fallback third-party STUN servers (stun.cloudflare.com, stun.l.google.com, stun1.l.google.com) instead of reading cached state from the console's background netctl service, which probes *.np.stun.playstation.net with authenticated Classic STUN (RFC 3489); those third-party hosts receive the host's IPv4 address when an uncached call resolves or probes them. Each discovery call has a 1000 ms total time budget (DNS resolution included, 300 ms per UDP probe), and successful results are cached for 60 s per local IPv4 address while failures re-probe on the next call. Console captures confirm NAT type 2, NAT type 3, and STUN failure; NAT type 1 when the mapped endpoint matches the local socket is not measured on a console with a direct public IP.