AnyPS5/docs/dev/debt/libc.md

libc technical debt

Silent stubs

• _Mtx_current_owns (libSceLibcInternal, implemented in libc, NID VYQwFs4CC4Y) returns 1 and ignores its argument. This follows the PS5 12.00 body reading reported in PR8859, rather than inspecting host mutex ownership. The firmware observation is attributed to that contributor; other firmware versions and the argument's console type remain unverified.

Unknown function info

• strtonum (libc) is unverified on the console. Its signature, decimal parsing, inclusive bounds, error strings, error precedence and errno preservation follow FreeBSD 11.4 strtonum.c. Parsing uses the host strtoll with base 10. It is not exported by libSceLibcInternal.sprx on a PS5 (firmware 13.60), so a payload process cannot call it there

• fegetexcept (libSceLibcInternal, implemented in libc) has not been read from the PS5 library or measured on a console. It follows FreeBSD 11.4 amd64 fenv.h, reporting the six unmasked x87 exceptions independently of MXCSR; whether the PS5 uses the same rule when the units disagree is unverified.

• sceLibcBacktraceGetBufferSize, sceLibcBacktraceSelf (libc) - signatures and frame record layout inferred from a title (next pointer, u32 module offset, module name at +0x10); the u32 at +0xC is unknown and written as 0. Module names are host file names without the .guest.prx suffix, so their case may differ from the PS5 module name. On Windows, unwinding uses _Unwind_Backtrace and stops at a frame without .ehmeta or .ehfram tables whose PE unwind data has an exception or termination handler, leaving the trace empty or cut short while still returning 0. Implemented only on Linux and Windows; other platforms throw

• ApplicationGuestHeapApi (libc) - on Linux, HLE application allocation uses a loaded guest SDK's ten allocator exports when the title's replacement table has an allocator entry and the exports belong to one native module. With an empty table it keeps the default heap, since a bundled libc.prx may export the allocator NIDs while forwarding them to HLE. Its CRT owns application allocator initialization and finalization; HLE retains the module until process exit. Partial or mixed providers throw. This avoids reinitializing an allocator already used by SDK startup; console behavior and other host platforms remain unverified.

• fdopen (libc) validates descriptor access modes as FreeBSD 11.4 fdopen.c does: a requested mode incompatible with a descriptor not opened for both reading and writing returns null with EINVAL, leaving the descriptor open. Windows reads the handle's granted access through the same host helper as fcntl(F_GETFL); a closed descriptor returns null with EBADF. Console behavior is unverified.

• scriptingGetMem, scriptingFreeMem (libc) - runtime allocator hooks for Unity titles. The allocation signature (alignment, size), minimum alignment 16 and null result for a non-power-of-two alignment follow KytyPS5; the free hook's one-pointer signature follows Raeen's recorded contract. Both use libc's own guest heap, not the title's registered allocator. A title that ships its own libc.prx (Metal Gear Solid Master Collection, PPSA18194) has already initialized that allocator, and reaching it from here would run its initializer a second time. That title's IL2CPP runtime looks up only scriptingGetMem, by name from Il2cppUserAssemblies.prx, and asks it for 256 KiB blocks aligned to 4 KiB. Which console library exports the hooks is unknown, and there is no console measurement. Allocation failure and sizes that overflow return null.

• _Mtx_trylock (libc, NID k6pGNMwJB08) - returns busy for a non-recursive mutex already owned by the caller. The libc.prx that titles ship (read from disassembly of PPSA13934's copy, 0x5cf0, not measured on a console) passes its argument to scePthreadMutexTrylock and returns 0 for success, _Thrd_busy (3) for SCE_KERNEL_ERROR_EBUSY and _Thrd_error (4) for any other error, so busy for an owned non-recursive mutex comes from the kernel mutex there; this libc keeps its own owner and count instead, and its result for a kernel error other than busy is not compared.

• nearbyintf (libc, NID c+4r-T-tEIc) rounds with the MXCSR rounding mode, as the console's libSceLibcInternal.sprx does in a payload process on a PS5 (firmware 13.60): with the x87 mode set to upward and MXCSR to nearest it rounded 2.5 to 2, and with MXCSR upward to 3, and the four modes gave the results the host gives. The console also raised FE_INEXACT for those inexact inputs, which the host's nearbyintf does not; whether it does for exact inputs was not measured

• __std_find_trivial_unsized_N (libc) - matches the libc.prx bundled with PPSA08427 (disassembly, and that binary run side by side on random inputs): when nothing matches between first and the end of its 32-byte-aligned block, the console rescans that whole block without masking and so can return a match up to 31 bytes before first

• _Thrd_sleep (libc, NID jfRI3snge3o) follows the Dinkumware threads library shipped with Visual C++ 2013 (xtime.c) and C11 Annex K, without console verification. It reads a 16-byte xtime (64-bit seconds and nanoseconds) on the guest CLOCK_REALTIME, normalizes the nanoseconds and sleeps through nanosleep on POSIX, retrying on EINTR, or high-resolution waitable timers on Windows; a null xtime or one whose normalization overflows throws. Guest thread cancellation is not integrated with this wait. The console's _Thrd_sleep (disassembled from a title's libc.prx) also takes an optional xtime* of remaining time and returns int; here the sleep is never cut short, so it returns 0 and leaves the remaining time untouched.

• setjmp, longjmp (libc) save the signal mask at 72 in the jump buffer and restore it, as FreeBSD 11.4's setjmp and longjmp do, which is unverified on a console. They go through the sigprocmask libkernel registers when it loads and mark the buffer at 88 as sigsetjmp does, so a buffer saved before then is jumped to without changing the mask

• _Mtx_init_with_name (libc, NID tgioGpKtmbE) forwards to _Mtx_init and ignores the mutex name parameter.

• _Cnd_timedwait (libc, NID McaImWKXong) follows the console's _Cnd_timedwait (disassembled from a title's libc.prx), where xtime is an absolute deadline converted against the current time: it returns _Thrd_timedout (2) on expiration and _Thrd_success (0) on notification. The console returns 4 for other internal pthread errors while this implementation throws.

• fegetround, fesetround, fetestexcept, feclearexcept, fegetexceptflag and fesetexceptflag (libSceLibcInternal, implemented in libc) follow FreeBSD 11.4 amd64 fenv.h: rounding modes use x87 control bits 10-11, exception flags include denormals (0x3f), and fexcept_t is 16 bits. They access the current host thread's x87 and MXCSR state. Under Rosetta 2 the six MXCSR exception masks always read back set, so an SSE exception the guest unmasks stays masked; the x87 masks and the other MXCSR bits are kept. This console ABI is assumed, as for fegetenv, not measured on hardware. Null flag pointers throw instead of faulting.

• feenableexcept, fedisableexcept, __feenableexcept, __fedisableexcept, fegettrapenable and fesettrapenable (libc) change only the x87 masks under Rosetta 2: MXCSR keeps its six exception masks set there, so no SSE trap is enabled, and the enable and disable results, which report the traps enabled on both units, report none

• fegetenv (libSceLibcInternal, implemented in libc, NID psx0YiAKm7k) follows FreeBSD 11 amd64 fenv.c with the 32-byte fenv_t of x86/fenv.h: fnstenv fills the 28-byte x87 part, MXCSR follows at 0x1c, and the x87 control word is reloaded because fnstenv masks every x87 exception. That the console's libSceLibcInternal has the same code and layout is assumed, not read from its binary. A null pointer throws instead of faulting

• feholdexcept (libSceLibcInternal, implemented in libc, NID 1kduKXMqx7k) - console equivalence and module/library versions are unverified. The signature and 32-byte amd64 environment layout follow the public SDK fenv.h; saving both units, masking exceptions and clearing pending flags follows FreeBSD 11 amd64 fenv.c. The NID comes from the public 3.20 stub inventory, not a module examined here. Null storage throws before modifying the environment, where the reference dereferences it

• feupdateenv (libSceLibcInternal, implemented in libc, NID YXQ4gXamCrY) follows FreeBSD 11.4 amd64 fenv.c: capture the old x87/MXCSR exception union (0x3f), restore the saved 32-byte environment, raise those flags in both units, then fwait. The console's layout, behavior and module versions are unmeasured; state belongs to the current host thread. A null input or MXCSR bits unsupported by the host's FXSAVE mask throw before changing floating-point state; the mask's architectural zero fallback is 0xffbf. Console fault behavior for malformed environments is unknown. The separate __fe_dfl_env object remains unimplemented; no host FE_DFL_ENV sentinel is substituted.

• Guest arena (libc) - the application map area is assumed to end at 0xFC_0000_0000, as SCE_KERNEL_APP_MAP_AREA_END_ADDR does on the PS4. On Windows, host allocations made in the arena before libc loads stay, and a fixed guest mapping over one throws. The console's low-address layout is not measured. Linux and Windows reserve free addresses from 64 KiB, except host mappings and low chunks the Linux address policy refuses; null hints still allocate from 8 GiB. macOS and ASan builds still start the arena at 8 GiB and cannot supply low 32-bit addresses. Guest thread creation ignores a stack address set in its attributes. A host-loaded executable is not moved, so a PIE above the arena gets no memory within 2 GiB of its code (#5217)

• sceLibcInternalBacktraceForGame (libSceLibcInternal, implemented in libc) - (const char* heapName) and its return follow the libc.prx ASTRO BOT (PPSA21564 01.007.000) bundles: its four calls (0x6801, 0x7F46, 0xE75E, 0xEE02) are in the malloc_stats and sceLibcMspaceMallocStats paths, each after a [%s] ... line printed with the same heap name buffer, and the caller ignores the result and continues. The console's backtrace output is not reproduced: the heap name and the guest return address are written to the host standard error

• sceLibcInternalHeapErrorReportForGame (libSceLibcInternal, implemented in libc) - (void* heap, void* block, uint32 error) writes to the guest's standard output what a payload process on a PS5 (firmware 13.60) wrote: [SceLibc] A heap error is detected., [SceLibc] -- Mspace Name --, then the C string at heap+0x3B0 followed by (%2u) of the 32-bit value at heap+0x3F4 when it is not 0, the reason segment out of range. for error 1 only (38 other measured values print none), and pid:<0x..> tid:<0x..>, and returns. The pid and tid are the host's, where the console prints its own process and kernel thread ids. The block's contents did not change the console's output and it is not read here; the values and the guest return address also go to the host's standard error. A null heap faulted on the console and throws here. What the other heap fields and error values mean is unknown

• sceLibcPafMspaceCreate, Destroy, Malloc, Memalign, PosixMemalign, Free, Calloc, Realloc, Reallocalign, MallocStats and MallocStatsFast - PAF exports delegate to sceLibcMspace without malloc hooks; Memalign and PosixMemalign forward to their Mspace counterparts with owner ignored and are unverified on console. Create's options block (version, type 1 or 2 at +2, field at +0x10) throws when non-null as its meaning is unknown. Block footers are not modelled, so owners are ignored: on PS5 firmware 13.60 mismatched owners in Reallocalign or in-place Realloc kill the process and MallocStats returns 1 if non-heap-owned blocks exist, which is not reproduced. MallocUsableSize, Trim, IsHeapEmpty, CheckMemoryBounds, ReportMemoryBlocks and GetFooterValue are not implemented.

• malloc_usable_size (libc) - with the default allocator it returns the size the block was requested with (the range registered for it), not the rounded-up chunk size Sony's allocator reports; both satisfy "at least the requested size", and bytes past the request would not be write-watched. With an application allocator it calls entry 9 of the replacement table (malloc_usable_size in KytyPS5's MallocReplace order) and throws when the table leaves it null, like malloc_stats_fast

• malloc_stats_fast (libc) - with the default allocator it fills the 0x28-byte managed-size block as sceLibcMspaceMallocStatsFast does, from the default heap's own accounting, not Sony's allocator: the system sizes count the 1 MiB spans of its small-block classes and its committed large blocks, cached free ones included, and the in-use sizes count each handed-out block at its size-class or 64 KiB-granule size, header included. A block size below 0x28 or a null pointer returns 22, as in the mspace version; the version field is not checked. Ship of Harkinian (PPSA99320) calls it about 10 s after start-up.

• malloc, calloc, realloc, memalign, aligned_alloc, reallocalign and posix_memalign (libc) - the console's own heap was measured in a payload process on firmware 13.60, not in a title. A heap a title replaces was not measured and keeps the FreeBSD jemalloc behaviour: ENOMEM on failure, EINVAL for an alignment that is zero or not a power of two, and realloc(ptr, 0) frees the block. With the console's heap, failures set EINVAL, and errno is left alone for a size above SIZE_MAX - 0x1008f (SIZE_MAX - (A + 0x100af) for an alignment over 32 rounded up to A), a calloc overflow or an alignment of 2^63 or more. Alignments round up to a power of two, and realloc(ptr, 0) keeps the block with 0 usable bytes. reallocalign(ptr, 0, alignment) for a block without that alignment was not measured and throws

• reallocf (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 lib/libc/stdlib/reallocf.c on top of this libc's realloc, as a payload process on a PS5 (firmware 13.60) does with the default heap (null and 0, size 0, 2^40 with errno 22 and the block freed, SIZE_MAX with errno untouched): size 0 does what realloc does here, keeping the block with 0 usable bytes with the default heap and freeing it and returning null with an application allocator, so the block is not freed twice; when realloc fails, the block is freed through the same allocator and null is returned with the errno that realloc left. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for realloc

• sceLibcMspaceReallocalign (libSceLibcInternal, implemented in libc) takes (void* heap, void* block, size_t alignment, size_t size), the order of the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x13880, whose internal routine at 0x12390 treats the third argument as the alignment and, for a null block, passes it to the routine sceLibcMspaceMemalign uses). Measured on a PS5 (firmware 13.60) from a homebrew payload: a null block with alignment 4096 and size 100 returns a 4096-aligned block; an alignment of 0 or 3 succeeds and 100 gives a 128-aligned block, as the routine raises it to at least 32 and to the next power of two; an alignment of 2^63 or more returns null, keeps the block and leaves errno alone; and a size of 0 returns a block (the same one when it is already suitable) instead of freeing it. A block that is aligned and large enough is kept where it is, without giving back the bytes past the new size as the console's in-place resize does

• acosl (libc) - computed by the host's math library, like the other libc math functions here, not by the console's (FreeBSD msun ld80 code in Sony's libc.prx): results can differ from the console's in the last bit, and on Linux glibc sets errno to EDOM for acosl outside [-1, 1] where msun only raises the floating-point exception. long double is the x87 80-bit format, as Sony's frexpl uses it (fldt 0x8(%rsp), result in st(0))

• atanl, sinl, cosl, tanl, sinhl, coshl, tanhl, expl, exp2l, logl, log10l and powl (libc) - computed by the host's math library, as acosl is, not by the console's FreeBSD msun ld80 code: results can differ from the console's in the last bit (glibc's log10l(1000) is not exactly 3), and on Linux glibc sets errno to EDOM or ERANGE where msun only raises the floating-point exception. ldexpl and truncl are exact operations and give the console's result; logb and remainder give the console's value too, but on Linux glibc sets errno (ERANGE for logb(0), EDOM for remainder by zero or of an infinity) where msun only raises the floating-point exception

• Dinkumware atomics (libc) - every operation is sequentially consistent whatever memory order it is given, which is never weaker than the console. Matching the libc.prx bundled with PPSA08427 (that binary run side by side on every order from 0 to 7), _Atomic_load_8 returns 0 for a release, acq_rel or invalid order and the 8-byte exchange and fetch operations return 0 without touching memory for an order above memory_order_seq_cst; the generic _Atomic_copy, _Atomic_exchange and _Atomic_compare_exchange_* lock the byte flag passed first, as the console does

• Fetch{and,or,xor}seq_cst{1,2,4} (libc) follow the two-argument unsigned 8-, 16- and 32-bit helpers in Dinkumware VC12 xatomic.h, using sequentially consistent atomic read-modify-write operations and returning the original value. The firmware 3.20 export inventory supplies the names and NIDs; the reference defines inline namespace helpers, so the equivalence to the console exports and their calling convention are inferred, not console-measured. A live, suitably aligned object is required as in the reference; invalid-pointer and misalignment fault behavior on the console is unverified. Windows tests cover raw and patched exports, values, neighboring storage and concurrent updates; a finite ordering litmus cannot prove the memory model.

• std_execute_once (libc) - assumed to be the plain-named twin of std::_Execute_once (_ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1_, the callee of Dinkumware call_once): it delegates there and gets the [thread.once.callonce] semantics already verified for that symbol (one invocation per flag, concurrent callers block until it completes, and a failing or throwing invocation leaves the flag unready so the next caller runs it). The name equivalence is not confirmed on a title, and the callback convention (called with (null, arg, null), non-zero return meaning success) is the twin's, unverified for this symbol

• __atomic_load, __atomic_store, __atomic_exchange and __atomic_compare_exchange (libc) - the generic, size-parameterised libatomic entry points are a single ud2 in the libc.prx bundled with PPSA08427 (disassembly), so the console traps on any call; these throw instead

• Sized __atomic calls (libc) - the 36 __atomic_load_N, __atomic_store_N, __atomic_exchange_N, __atomic_compare_exchange_N and __atomic_fetch_{add,sub,and,or,xor}_N calls (N = 1, 2, 4, 8) are sequentially consistent whatever order they are given. The libc.prx bundled with PPSA08427, run side by side on random values and on every order from -1 to 7, switches on the order but always uses a locked instruction or CAS loop, except that a store with an order other than memory_order_seq_cst is a plain store, so these are never weaker than the console. Unlike _Atomic_load_8 and the 8-byte _Atomic_* exchange and fetch calls above, the console accepts every order here, including release, acq_rel and invalid ones, and these do the same

• Dinkumware mutexes and conditions (libc) use pointer-to-handle arguments, matching the console aerolib signatures reported in #3079. The title's _Mtx_lock maps 0 to _Thrd_success (0), 0x8002000b to _Thrd_busy (3), and other failures to _Thrd_error (4); its internal mutex init recognizes recursive flag 0x100, while every other type uses default attributes. The observed relock failure for a plain mutex suggests those defaults are error-checking, but that has not been confirmed on hardware. The title's _Mtx_unlock and _Cnd_wait return success regardless of their internal result. The host implementation treats invalid ownership preconditions as no-ops, and throws for invalid handles, host wait errors and destroying a locked mutex as debug guards; those cases are not confirmed against the console.

• _Mtx_timedlock (libc, NID hPzYSd5Nasc) follows the console's libc.prx at 0x5d50 (PPSA02530): it takes an absolute xtime and returns _Thrd_timedout (2) on expiry (0x8002003c) or 5 on other failures. On non-Windows hosts the native mutex and condition are std::timed_mutex and std::condition_variable_any; Windows keeps the CRITICAL_SECTION/CONDITION_VARIABLE pair because std::condition_variable_any failed guest_libc_cnd_timed_wait on the Windows runner, and its _Mtx_timedlock polls TryEnterCriticalSection until the deadline. Windows timing is not measured on the console.

• Floating-point compiler-rt builtins (libc) follow the libc.prx bundled with PPSA08427 (disassembly, and that binary run side by side on random inputs) where it differs from current compiler-rt: the soft-float __add, __sub, __mul and __div (sf3, df3) round to nearest, raise no exception flags and ignore MXCSR, here done with SSE under a default MXCSR that is restored afterwards; division flushes a quotient below the smallest normal to a signed zero; __extendsfdf2 and __truncdfsf2 copy NaN payloads unshifted; float-to-integer conversions do not saturate but shift the significand by a count masked to the shift width. __mulsc3, __muldc3, __divsc3 and __divdc3 fuse the same products as the console with fma and scale through the x87 like its scalbn, so their values match, but NaN payloads and exception flags can differ, as the host fma and logb are not the console's VEX FMA code and libm

• random, srandom, initstate, setstate (libc) - not measured: the state setstate returns and its null return for a rear position past the degree, errno after initstate below 8 bytes, a null state (throws here), an initstate seed other than 1, concurrent callers (one lock serialises every call here) and a title's own libc. Measured in a payload process on a PS5 (firmware 12.70): a fresh process draws the srandom(1) sequence; srandom seeds an additive feedback generator through a good_rand that reads its argument as an int32, turns 0 into 123459876 and applies x = 16807 * (x % 127773) - 2836 * (x / 127773), adding 0x7fffffff to a negative result, which reproduces seeds 0, 1, 2, 12345, 0xffffffff and 0x80000000; initstate returns null at 0 and 7 bytes and selects types 0 to 4 by size as measured at 8, 15, 31, 32, 63, 64, 127, 128, 129, 255, 256, 257 and 1000 bytes.

• srandomdev (libSceLibcInternal, implemented in libc) is not verified against the console. The firmware 3.20 export inventory names NID a2MOZf++Wjg; it follows FreeBSD 11 random.c, filling every active generator word from host OS entropy instead of KERN_ARND, then resetting additive feedback positions without warming up. An entropy failure throws rather than leaving sysctl's failure unchecked. Calls share the generator lock.

• Integer compiler-rt builtins (libc) - the console traps in __divsi3, __modsi3 and the 64- and 128-bit divisions on a zero divisor (div) and in __negv*, __absv* and __mulv* on overflow (an abort helper, then ud2); these throw instead. As in the libc.prx bundled with PPSA08427 (disassembly), __addv* and __subv* wrap without an overflow check, and __udivsi3, __umodsi3 and __udivmodsi4 divide in software, giving a quotient of 0 and the dividend as remainder for a zero divisor; __clzdi2 and __ctzdi2 of 0 return 32 and __clzti2 and __ctzti2 of 0 return 64

• qsort (libc) follows FreeBSD 11 qsort.c: Bentley and McIlroy's quicksort, with insertion sort below 7 elements and after a partition pass that swaps nothing, so elements that compare equal end in FreeBSD's order and the comparator is called in the same sequence. That the console's libc uses this FreeBSD code is unverified

• memcpy_s, memmove_s, strcpy_s, strncpy_s, strcat_s, strncat_s, wmemcpy_s, wmemmove_s, wcsncpy_s, wcscat_s, wcsncat_s (libc) use the C11 Annex K destination size constraints, with RSIZE_MAX taken as (SIZE_MAX >> 1) / sizeof(char16_t) for wide operations and SIZE_MAX >> 1 for byte operations. An oversized destination size returns ERANGE (34) without touching the destination; the console's RSIZE_MAX and exact error value are unverified. Constraint violations return an error without invoking the registered constraint handler, as before.

• wcsncat_s and wcscat_s (libc) refuse a copy as overlapping only when the written range [dest + len1, dest + len1 + len2) meets the read range [src, src + len2). The rule comes from a static reading of the console's wcsncat_s in libc.prx (not run on a console); wcscat_s gets it through wcsncat_s, and its own console code was not read. The narrow strncat_s keeps a wider rule, [dest, dest + used + length + 1) against [src, src + length + 1), whose console code was not read either, so it refuses some copies whose wide equivalent proceeds.

• snwprintf_s (libc) - follows C11 K.3.9.1.3 with RSIZE_MAX assumed to be SIZE_MAX >> 1. A runtime-constraint violation only returns a negative value: the handler installed with set_constraint_handler_s is not invoked, and the console's default handler is unknown. An invalid multibyte %s argument is copied byte by byte instead of being reported as an encoding error, as in vswprintf

• swprintf_s and vswprintf_s (libc) - follow C11 K.3.9.1.4 with RSIZE_MAX assumed to be (SIZE_MAX >> 1) / sizeof(char16_t): the complete output, including the terminating null, must fit in the buffer, otherwise it is a runtime-constraint violation that sets buffer[0] to zero and returns a negative value, and the buffer is not partially written. Argument and encoding checks match snwprintf_s

• strerror (libc) - follows the libc.prx that CUSA04865 and CUSA12435 ship, loaded on a PS4 Pro (firmware 10.71): 0 gives "No error", 1 to 94 the FreeBSD texts, any other number "error_code=0x%08x", and errno is left alone. The console's system libc, which homebrew without a bundled libc.prx uses, answers differently ("No error information" for 0 and unknown numbers, 95 and 96 named). strerror_r and perror keep "No error: 0" and "Unknown error: %d"; they are not measured.

• strerror_s and strerrorlen_s (libc) follow C11 K.3.7.4.2 and K.3.7.4.3, using the existing FreeBSD error messages and unknown-error formatting. Truncation writes an ellipsis when capacity exceeds 3; constraint failures leave the destination untouched and invoke the registered guest-ABI handler. The console's RSIZE_MAX (SIZE_MAX >> 1 here), nonzero returns (EINVAL 22 for constraints, ERANGE 34 for truncation), handler arguments and default abort behavior are unverified. Messages remain in the C locale, and guest errno is preserved.

• getw and putw (libc) follow FreeBSD 11.4 getw.c and putw.c: one 32-bit little-endian word, getw returns -1 for EOF or an error, and putw returns 0 on success or -1 on error while holding the stream lock. They use the existing host-backed streams, so buffering and error timing follow the host CRT. Null streams throw and closed streams return -1 with EBADF, as existing byte I/O does. Console behavior is unverified. A payload process on a PS5 (firmware 13.60) gave the same results: two words written little-endian, -1 with end of file after them and for a 2-byte file, and -1 with the error flag for putw on a read-only stream

• vsnwprintf_s (libc) - va_list counterpart of snwprintf_s (C11 K.3.9.1.3): truncates to the buffer and returns the full length, with the same constraints and argument checks

• strndup and strdup (libc) return null with errno set to EINVAL (22) when source is null, preventing a host segfault on invalid guest input. POSIX.1-2008 and FreeBSD 11.4 libc leave strndup(NULL) and strdup(NULL) undefined (faulting). The libc.prx that titles ship has no null check either (read from disassembly of PPSA13934's copy, not measured on a console): strdup (0x6b440) calls strlen and strndup (0x6b650) calls strnlen on the source before allocating, so both fault on a null source there, except strndup(NULL, 0), whose strnlen reads nothing and which returns an empty copy; here it returns null with EINVAL.

• snprintf_s and vsnprintf_s (libc) - follow C11 K.3.5.3.5 and K.3.5.3.12 with RSIZE_MAX assumed to be SIZE_MAX >> 1, as snwprintf_s does: a null buffer or format, size of 0 or above RSIZE_MAX, any %n and a null %s, %ls or %S argument return a negative value and set buffer[0] to zero when the buffer and size allow it; otherwise the output is truncated to the buffer and the full length is returned. A violation only returns: the constraint handler is not invoked, and the console's error value is unverified. Not confirmed on a PS5 title

• vsscanf_s (libc) - returns the count of items converted before an undersized %s/%c/%[ destination (0 when it is the first), not EOF. Not confirmed on a PS5 title

• setlocale (libc) knows only the "C" locale, as the libc.prx that titles ship does: it ignores the category, returns "C" for a null, empty or "C" name and a null pointer for any other, "POSIX" included, without setting errno. Checked by running the copies bundled with PPSA07923 and PPSA13934 side by side for categories -40 to 79 and 2^30, not measured on a console.

• localeconv (libc, re-exported by libSceAmpr) - the 0x90-byte Dinkumware struct (empty monetary strings, CHAR_MAX for the 14 char fields, decimal_point ".", _False/_True "false"/"true") is read from the libc.prx that Astro's Playroom ships. It is a fixed C-locale table: whether the console changes it with setlocale is not known, and _Frac_grouping, _Frac_sep, _No, _Yes are empty strings as in that dump

• set_constraint_handler_s (libc, re-exported by libSceAmpr) - the default handler is assumed to abort; each module keeps its own handler state, so a handler set through one library is not seen by the other. Within a module every _s function calls the installed handler, with the guest's calling convention. ctime_s and asctime_s follow the Dinkumware 26-byte format with EINVAL for a buffer under 26 bytes, a null pointer or an out-of-range weekday/month; ctime_s uses the guest time zone of localtime_s, and the console's exact checks are not verified

• qsort_s (libc) sorts as qsort does and passes its context as the comparator's third argument, as FreeBSD 13's qsort_s (C11 Annex K) does. It returns EINVAL after calling the constraint handler when n or es exceeds RSIZE_MAX, or when n is not 0 and a or cmp is null; FreeBSD 11, which the rest of libc follows, has no qsort_s. An element size of 0 sorts nothing, where FreeBSD loops over the same address. The console's behaviour is unverified; the Quake homebrew (#6698) imports it from its libOSMesa.so.8

• __udivti3 (libc, re-exported by libSceAmpr) - the hardware traps on a zero divisor; this throws instead

• __umodti3 (libc) - the hardware traps on a zero divisor; this throws instead

• __modti3 (libc) - the hardware traps on a zero divisor; this throws instead

• snprintf and vsnprintf (libc) accept any size up to SIZE_MAX, as a payload process on a PS5 (firmware 13.60) does. A null buffer with a nonzero size throws here, where the console writes through it, and a result longer than INT_MAX throws, which was not measured

Functional

• _Cosh (libc) follows the two-argument Dinkumware CRT helper used by std::complex, including a scaled large-finite-input path; the signature, exact result and floating-point exception behavior are not verified against the console.

• std::thread::hardware_concurrency (libc, NID CHrhwd8QSBs) returns the host's std::thread::hardware_concurrency() (which may be 0 when unknown) instead of the console's processor count; no reference implements it and the value a title expects (PPSA34015 imports it) is unverified.

• fmodf (libc) - console errno, exception flags and NaN payloads remain unverified. The wrapper preserves errno like the existing double fmod, following FreeBSD 11.4 e_fmodf.c; host std::fmod still supplies the result and exception flags.

• _LCosh and _LSinh (libc) follow the two-argument Dinkumware CRT helpers y * cosh(x) and y * sinh(x), including scaled large-finite-input paths; the signatures are confirmed by Dinkumware's public ymath.h, but the exact console results, range-error thresholds and floating-point exception behavior are not verified.

• _FSinh and _FCosh (libc) finite results are not verified bit for bit against the console: the scaled product uses the host's binary64 hyperbolic function before rounding to binary32, rather than the float rational and _FExp sequence in PRAGMATA's bundled libc.prx. NaN preference and payloads, signed zeros, infinite operands and the range-error thresholds follow that binary's instructions; the system libSceLibcInternal implementation and nondefault flush-to-zero modes are unverified. Against libSceLibcInternal.sprx on a PS5 (firmware 13.60), 12 of 36 measured results differ by one unit in the last place (_FSinh(0.5, y) and _FCosh(1, y), _FCosh(10, y) for y of 0.5, 1 and 2); zeros, the overflow to infinity at 89 and 90 and the tiny-argument results matched

• _Divide, _FDivide, _Recip and _FRecip (libc) follow the Dinkumware CRT division and reciprocal contracts with IEEE-754 signed-zero, infinity and NaN behavior. The exact console results, signaling-NaN handling and floating-point exception behavior are not verified.

• sscanf_s and vsscanf_s (libc) return EOF when a reached conversion has a null destination, stopping before further assignments, following C11 K.3.5.3.7 and K.3.5.3.14. Earlier assignments are retained. The constraint handler is not invoked, and console behaviour is unverified.

• memmem and memccpy (libc) - memmem searches for needle occurrences in memory buffers and memccpy copies buffers until a character match, following FreeBSD and POSIX specifications; behavior is unverified on console. Neither is exported by libSceLibcInternal.sprx on a PS5 (firmware 13.60), so a payload process cannot call them there.

• strtof and wcstof (libc) round to the nearest float, where the console's _Stof in libSceLibcInternal.sprx (0x734a0) does not always: about a third of decimal inputs within a relative 2^-51 of a point halfway between two floats, and some hexadecimal inputs with more than 24 significant bits, come out one unit apart in the last place (1e-40 is 0x1.16c3p-133 there and 0x1.16c2p-133 here). The console's own rounding is not reproduced

• strtof and wcstof (libc) - ERANGE follows the libc.prx bundled with PPSA08427 (J03547016) and PPSA03671 (J03848509), both run side by side with this libc on a Linux host: a decimal input whose result is a nonzero subnormal sets it only when inexact, a hexadecimal one only when it lies below the smallest subnormal and rounds up to it, and underflow to zero and overflow set it. Both builds also take a NAN(...) payload in strtof from the sequence's leading digits (nan(0x123) is 0x7fc00123, -nan(5) is 0xffc00005); the sign is kept here, the payload is not. libSceLibcInternal's _Stof differs: no ERANGE for hexadecimal input, a positive nan, and after a minus sign a failed parse is -0.0 for a lone sign and +0.0 before an inf/nan spelling, the reverse of libc.prx. Decimal strtod sets ERANGE for a nonzero subnormal in J03547016 but not in J03848509 or libSceLibcInternal, whose result is kept.

• Guest time conversions rewrite the host process TZ when a guest changes its own TZ, so other host consumers of that variable (including libSceRtc local time) shift too; code outside libc does not take the zone lock. Zone syntax follows the host C runtime, not FreeBSD: Windows only accepts the std offset [dst] form, treats an empty guest TZ as UTC0 and reads :Europe/Berlin as an abbreviation (for example rop); only Linux honours zone file names. If the guest accepts a TZ value that the host rejects (on Windows, for example, one longer than the host environment limit), conversions throw std::runtime_error. A tm_zone saved before a TZ change can refer to storage now holding the new zone name; strftime does not read it.

• cbrtf (libc) is FreeBSD msun's s_cbrtf.c: a 5-bit first guess from the exponent bits, then two Newton steps in double precision. It sets no errno, as the libc.prx that titles ship does not. Floating-point exceptions are not compared. It gives the same bits as the cbrtf of the libc.prx bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host.

• __isfinitel - classifies the x87 80-bit exponent without narrowing to double or performing floating-point comparisons, following FreeBSD msun. The signature and classification follow FreeBSD; console behaviour is unmeasured. Requires little-endian x87 long double stored in 16 bytes, as the existing guest long-double ABI does. On a PS5 (firmware 13.60) __isfinitel returned 1 for 0, -0, 1, a denormal and ±1e4000, and 0 for a NaN and for the maximum exponent without the integer bit, which this classification gives too

• logf (libc) is FreeBSD msun's e_logf.c, with vzero read at run time as msun's volatile read does. As in the libc.prx that titles ship, errno is set to ERANGE for ±0 and to EDOM for every argument with the sign bit set, negative NaNs and -inf included; positive NaNs and +inf leave it unchanged. Floating-point exceptions are not compared. It gives the same bits and errno as the logf of the libc.prx bundled with PPSA07923 and PPSA05916 for all 2^32 arguments, run on a Windows host. The FMA-contracted build bundled with PPSA13934 differs from it by 1 ulp on 961,881 arguments, so no single port matches every title's last bit.

• Windows direct-memory backing reserves a paging-file section. A direct memory page mapped at one guest address is private write-watched memory at that address and is not committed in the section; a page mapped at a second address moves its whole resident run into the section (committed there) and every address becomes a view of it, tracked by write protection. An unmapped resident page that is not all zeros is kept in a private reservation until it is mapped again. Committed section contents remain across unmap/remap and are released when the backing and its remaining views are destroyed. A host import alias over part of a resident run is refused. Linux retains its existing backing. Peak gameplay memory and Windows versions other than the tested host remain unverified.

• getc_unlocked, putc_unlocked, getchar_unlocked, putchar_unlocked (libc) - byte I/O uses the host unlocked operations; guest EOF/error flags and macro counters follow FileStream. Linux status queries use feof_unlocked/ferror_unlocked because glibc feof and ferror can acquire the stream lock. Windows uses the CRT no-lock byte operations and feof/ferror, verified under a held stream lock on UCRT. Console behavior and other host CRTs remain unverified.

• strcasecmp and strncasecmp (libc) - console locale behavior is unmeasured. They use the guest's C-locale case conversion and return -1, 0 or 1, the sign of the folded unsigned-byte difference, as the libc.prx bundled with eleven titles does (FreeBSD 11.4's strcasecmp.c returns the difference itself); other guest locales are not implemented.

• feof_unlocked and ferror_unlocked (libSceLibcInternal, implemented in libc) have no console measurement. The firmware 3.20 export inventory names NIDs NuydofHcR1w and yxbGzBQC5xA. They follow FreeBSD 11 feof.c and ferror.c, returning 0 or 1 from the stream status without acquiring the stream lock. They inherit the host CRT limitations of the unlocked byte operations above.

• gets (libSceLibcInternal, implemented in libc, NID Ok+SYcoL19Y) follows FreeBSD 11.4 gets.c for byte input, newline removal and EOF, without PS5 verification or known module/library versions. It reads the guest stdin under its stream lock and preserves the destination when EOF or a read error precedes any byte; a partial line is terminated and returned. A null destination throws; its console behavior is unverified. It emits no diagnostic; FreeBSD writes a warning once, and the console's diagnostic behavior and stream orientation are unverified.

• fgetws, getwc, getwchar, putwc, putwchar (libc) - wide stream I/O encodes and decodes wide characters as UTF-8 on the underlying byte stream; fgetws follows the libc.prx that titles ship (read from disassembly of three titles' copies, PPSA13934, PPSA07923 and PPSA05916, not measured on a console): it returns null for a size below 2 without writing the buffer, errno or the stream, stores each fgetwc result as its low 16 bits until a newline (compared on all 32 bits), -1 or a full buffer, and null-terminates and returns the buffer whenever it stored a character, also after a read error. A null buffer or stream, which the console dereferences, sets errno to 22 here. The calls the console makes before and after reading, and the one it makes when bits 0xC of the stream's second flag byte are set, are not reproduced. Console wide stream buffering and fgetwc's decoding remain unverified.

• Closed standard descriptors (libc) - console startup descriptors remain unmeasured. Halo: Combat Evolved's PS5 host expects 0 to 2 closed and opens its eboot on them; here it leaves them open. Missing descriptors are opened on /dev/null on Linux/macOS or NUL on Windows, read-only for 0 and write-only for 1 and 2. Windows also reattaches the UCRT streams before any guest FileStream captures their descriptor. Initialization runs before libraries depending on libc; no earlier libc initializer may consume a missing standard descriptor. The guest_closed_standard_descriptors and guest_closed_standard_descriptors_windows tests cover startup.

• Guest path names (libc) are checked against FreeBSD 11.4's NAME_MAX (255 bytes per component) and MAXPATHLEN (1024 bytes with the terminating NUL) before they are resolved, and a longer name fails with ENAMETOOLONG, as namei does. The host's own limit still applies below that: on Windows a path whose host form exceeds MAX_PATH fails with ENOENT. A backslash counts as a path separator for the component length, because the guest path resolver turns it into / before the host call, while FreeBSD treats it as an ordinary name character, so a 301-byte name that contains one is accepted here. sceNgs2ParseWaveformFile resolves its path without a try block, so a long component ends in an uncaught filesystem_error there where a missing file ended in a runtime_error (both end the title). A path through a regular file (file/x, file/) is not always ENOTDIR on the calls that resolve it. None of this was measured on a console.

• Guest path names (libc) fail on macOS with ENAMETOOLONG once their host form, the root directory followed by the guest path, reaches 1024 bytes, so a guest path of 1023 bytes, which FreeBSD accepts, fails there under any root directory

• ftrylockfile (libc) - tries the host CRT stream lock that flockfile, funlockfile and each locking host stdio call on the stream take, so it returns -1 while another thread holds the stream through flockfile or is inside such a call, and 0 when it acquires the lock or already owns it (recursively, released by as many funlockfile calls), as FreeBSD 11 _ftrylockfile does. A libc export holds the lock only for each host call it makes, not across several host calls or while it updates the guest FILE prefix. Linux uses glibc ftrylockfile. UCRT has no try variant of _lock_file, so Windows calls TryEnterCriticalSection on the CRITICAL_SECTION that _lock_file enters, found through the private UCRT stream layout (__crt_stdio_stream_data in ucrt/inc/corecrt_internal_stdio.h, unchanged from Windows SDK 10.0.19041 to 10.0.26100); another CRT or a change of that layout breaks it. A null or closed stream throws where FreeBSD dereferences it

• sinf, cosf, tanf and sincosf (libc) are FreeBSD msun's s_sinf.c, s_cosf.c and s_tanf.c over its double-precision kernels and e_rem_pio2f.c, with k_rem_pio2.c (for |x| >= 2^28 * pi/2) ported only for one input word and prec 0; sincosf returns the two. As in the libc.prx that titles ship, only an infinite argument sets errno (EDOM); NaN leaves it unchanged. Floating-point exceptions are not compared. All four give the same bits and errno as the copies bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host.

• fgetln (libSceLibcInternal, implemented in libc) throws: in the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x5FE80) the export is a hlt instruction, which faults in user mode and ends the process

• Wide-character conversions (libc) - The wide wcsto* functions parse the ASCII prefix of the guest string, as the C locale accepts only ASCII white space and digits. The multibyte conversions follow the C locale of the console's libSceLibcInternal.sprx: UTF-8 of at most three bytes, so _Getmbcurmax returns 3, overlong forms and encoded surrogates decode, and four-byte forms are invalid. __mb_cur_max stays 1 like the console's variable; ___mb_cur_max is not in that module and also stays 1, unverified. Other locales are not supported. With a null destination, wcstombs returns the byte count; the console's count is wrong when the capacity argument equals the running count, because it reads past the terminator

• realpath (libc) follows FreeBSD 11's realpath.c except for symlinks. The console's guest filesystem has none, so a host symlink under the guest root is followed for existence and type but not expanded, and .. drops the previous component lexically, as Resolve does for every guest path. Through a host link linkdir -> sub/deep, linkdir/../x gives x beside the link, not beside its target.

• strtod, strtof, strtold (libc) - strtod and wcstod (and atof, which calls strtod here) read a NAN(...) sequence as FreeBSD 11's gdtoa hexnan does: hexadecimal digits with an optional 0x, blanks starting a new 32-bit word, the first 16 digits kept and the payload cut to 52 bits, a zero payload made 1, any other character giving the default NaN but consuming up to the closing parenthesis, and an unterminated sequence keeping its payload while consuming only nan. The payload goes under the quiet bit with the sign, as in gdtoa's strtod. strtof, wcstof, strtold and wcstold return the positive default quiet NaN (0x7fc00000; exponent 0x7fff, significand 0xc000000000000000) whatever the sign and the sequence, and consume a sequence of letters, digits and underscores up to its closing parenthesis. The console's libSceLibcInternal.sprx, called from a payload process on a PS5 (firmware 12.70), gives these results for the 64 NaN inputs tried through strtod and strtof, 50 of them also through strtold and wcstod, and 18 through wcstof and wcstold, and, through strtod, for nan(1 2) and for nan( followed by NUL and ); that a title's own libc.prx does the same is assumed. In hexnan, a blank after a payload digit, while a 32-bit word of the payload is still free, starts a blank skip that has no NUL check, so when only blanks follow up to the terminating NUL the console's strtod reads past it: nan(1 followed by NUL and ) consumes the ) after the NUL, so the result depends on the bytes after the string, and here that case throws. A blank right after nan( is skipped with a NUL check, and the console stopped at the NUL there

• remquol (libc) leaves *quo unchanged when the result is NaN; the libc.prx bundled with PPSA08427 writes a value that depends on earlier x87 state (remquol(1, 0) stored 0 on a first call and 4 on later ones)

• _Stod, _Stodx, _Stofx, _Stoldx, _Stof and _Stold (libSceLibcInternal, implemented in libc) throw for hexadecimal text with a non-zero power-of-ten scale. The console's result there does not follow a simple rule: 0x3 with a scale of -1 gives 0.29999999999999999. A nonzero subnormal result sets neither errno nor the error argument, as measured in firmware 13.60's libSceLibcInternal.sprx run in a Linux host process, not on a console; there about a fifth of decimal inputs with a subnormal result come out one unit apart in the last place (_Stodx("2.2250738585072014e-308", 0) is the largest subnormal), which is not reproduced

• _LDivide, _LRecip and _LLog (libc) follow the public Dinkumware CRT contracts: long-double division and reciprocal, and the _LLog base flag (0 natural, positive base 10, negative base 2). The exact console results, signaling-NaN behavior and floating-point exception behavior are not verified.

• Long double math in MathExact.cpp (libc) was compared with the libc.prx bundled with PPSA08427 only for canonical 80-bit encodings; unnormals, pseudo-denormals and pseudo-infinities passed to arithmetic functions (not the classifiers) follow the host x87 instead of the console

• atanf (libc) is FreeBSD msun's s_atanf.c, with atanlo[3] read at run time as msun's volatile does. Tiny arguments return x without raising FE_INEXACT. It gives the same bits as the atanf of the libc.prx bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host, and none of those sets errno. Whether other titles' builds differ is unverified.

• rename, sceKernelRename (libc, libkernel) fail a last path component of . or .. with EINVAL, after FreeBSD 11.4's lookup, which refuses . and, through its ISDOTDOT and ISLASTCN flags, .. as the last component for the DELETE and RENAME operations. unlink, rmdir, sceKernelUnlink and sceKernelRmdir follow the same rule. Both arguments are checked before any host access, so rename of a missing source onto dir/. answers EINVAL, where FreeBSD's kern_renameat looks the source up first and answers ENOENT. A backslash counts as a path separator here (the guest path resolver turns it into /); FreeBSD treats it as an ordinary name character. None of this was measured on a console.

• nan and nanf (libc) return fixed quiet NaN values (0x7fc00000 and 0x7ff8000000000000), ignoring the tag argument as observed in the console's libc.prx (both exports load a global constant via mov rax,[rip+..]; vmovsd xmm0,[rax]; ret); VLC (PPSA85300) imports nanf.

• jrand48 and mrand48 (libSceLibcInternal, implemented in libc) return the high 32 bits of the new 48-bit state zero-extended to 64 bits, as the console's libSceLibcInternal.sprx does when called from a homebrew payload process on a PS5 (firmware 12.70): a result with bit 31 set comes back between 0x80000000 and 0xFFFFFFFF, as FreeBSD 11.0's jrand48 and mrand48 return it; FreeBSD 11.1 and later cast it to int32_t (jrand48, mrand48), which makes it negative. lrand48 and nrand48 matched FreeBSD there. Whether a title's own libc does the same is unverified

• seed48 and lcong48 (libSceLibcInternal, implemented in libc) follow the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x6F460 and 0x6F420): the multiplier and addend are shared by the whole rand48 family, including erand48, nrand48 and jrand48 on a caller's seed; lcong48 sets them with the seed, and srand48 and seed48 restore 0x5DEECE66D and 0xB. Unlike FreeBSD, seed48 returns a static copy of the new seed rather than the previous one. A null argument, which the console dereferences, throws

• drand48 and erand48 (libc) return the upper 32 bits of the new 48-bit state over 2^32, as the libc.prx bundled with eleven titles does on 10,000 values per function; FreeBSD returns all 48 bits. Whether the console's libSceLibcInternal.sprx copy does the same is unmeasured.

• lgamma and signgam (libc) - lgamma returns the host's lgamma and stores the sign of Γ(x) in the exported signgam (NID 5gOOC0kzW0c, starting at 0 as in FreeBSD 11's s_signgam.c) by the rules of e_lgamma_r.c: -1 for -0 and for a negative non-integer whose floor is odd, 1 otherwise, including poles, infinities and NaN. Taken from the FreeBSD source, not measured on the console. The NID is in the aerolib symbol list; no title is known to read signgam. PPSA99004 imports lgamma

• coshf (libc) follows FreeBSD msun's e_coshf.c, using the expm1f and expf paths already inlined for sinhf below; the Windows UCRT differed from the libc.prx copies in PPSA07923 and PPSA13934 on 500,554 and 500,614 of 20 million inputs in the #9707 survey. The exact system libSceLibcInternal behavior and the FMA-contracted libc.prx results remain unverified

• expm1 (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's s_expm1.c with huge read at run time, and sets ERANGE only when a finite argument overflows to infinity, as the titles' libc.prx does. It gives the same bits and errno as the expm1 bundled with PPSA07923 and PPSA05916 on 320 million random and 47,222 structured arguments on a Windows host; the FMA-contracted build bundled with PPSA13934 differs on 43,433 of the random ones.

• log1p (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's s_log1p.c. As the titles' libc.prx does, it sets EDOM at msun's NaN return (arguments below -1, -inf and negative NaNs) and leaves errno alone for log1p(-1), where it returns -inf. It gives the same bits, NaN payloads included, and errno as the log1p bundled with PPSA07923 and PPSA05916 on 320 million random and 68,216 structured arguments on a Windows host. The FMA-contracted build bundled with PPSA13934 differs on 73,682 of the random ones.

• nextafter and nextafterf (libc) do not compare floating-point exceptions, and their inputs are checked by sampling, not exhaustively. They are FreeBSD msun's s_nextafter.c and s_nextafterf.c, with ERANGE at msun's overflow and underflow returns as the titles' libc.prx sets it; a step away from zero returns early and sets none. The copies bundled with eleven titles give the same bits and errno on 4,000,784 sampled pairs per function on a Windows host.

• tanh (libc) does not compare floating-point exceptions, and its double inputs are checked by sampling, not exhaustively. It is FreeBSD msun's s_tanh.c over this file's msun Expm1, with tiny read at run time; it sets no errno, as the titles' libc.prx does not. It gives the same bits as the tanh bundled with PPSA07923 and PPSA05916 on 16 million random and 68,211 structured arguments on a Windows host; the FMA-contracted build bundled with PPSA13934 differs on 1,054 of them.

• sinhf (libc) follows the sinhf of the libc.prx bundled with PPSA28319 (disassembly): FreeBSD msun's e_sinhf.c from before __ldexp_expf, which squares expf(|x| / 2) between logf(FLT_MAX) and the overflow threshold, calling msun's expm1f and expf, whose paths for the arguments it passes are inlined here. Past the threshold Sony's error helper sets errno to ERANGE before returning x * 1e37; msun itself sets no errno. That code, run on a Windows host, gives the same bits as this implementation for every finite argument up to the threshold, of both signs; it was not run on Linux. That the system libSceLibcInternal, which Ruffle (PPSA68091) and RetroArch (PPSA99169) import while bundling a zero-return libc.prx, has the same code is assumed

• acoshf (libc) exact system libSceLibcInternal behavior and FMA-contracted copies remain unverified. Positive finite inputs use msun range handling and this file's logf; the middle range divides -1 before addition under directed rounding. Bits, errno and SSE/x87 status and controls match the supplied PPSA03766/PPSA07923 copies on 236,592 positive finite calls (4,929 inputs, four rounding modes, DAZ/FTZ combinations and sticky flags); these samples are not exhaustive. Invalid-domain errno and SSE/x87 invalid flags are checked against two supplied bundled copies; those samples are not exhaustive either.

• acoshl, asinhl, atanhl, atan2l, cbrtl, erfl, erfcl, expm1l, hypotl, log1pl, log2l, lgammal, tgammal, j0f, j1f, jnf, y0f, y1f and ynf (libc) return the host C library's results (the float Bessel functions through its double ones), not those of the console's own code, so the last bits can differ (y0f, y1f, ynf follow the console at +-0). As in the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x56410), lgammal does not store the sign in signgam; hypotl returns infinity for an infinite argument even when the other is a NaN, as C11 F.10.4.3 requires. hypot3, hypot3f and hypot3l follow that module (0x51D30, 0x520D0, 0x52420): the first NaN of x, y and z is returned unchanged, any infinity gives positive infinity, a zero argument gives the two-argument hypot of the other two, and otherwise the largest magnitude is combined with the hypot of the other two

• asinl (libc) follows the asinl of the libc.prx bundled with PPSA28319 (disassembly), FreeBSD msun's e_asinl.c with the ld80 invtrig.c coefficients, which the binary holds as the same 80-bit constants. For |x| > 1, the infinities and NaN, Sony's error helper raises FE_INVALID and sets errno to EDOM before returning (x - x) / (x - x), so a NaN argument also sets EDOM; msun itself sets no errno. 20 million random arguments in (-1, 1) give the same bits as that code run on a Windows host. The result needs the x87 precision control at 64 bits, as FreeBSD amd64 starts threads (control word 0x37f), but guest threads do not set it: on Windows a thread started by _beginthreadex runs at 53 bits (0x27f), where asinl(0.75) returns mantissa 0xd91a98ae3406e000 instead of 0xd91a98ae3406e041. The system libSceLibcInternal that RetroArch (PPSA99169) imports is assumed to have the same code

• acosf (libc) - for |x| > 1 and NaN the console stores EDOM and raises FE_INVALID before returning (x - x) / (x - x); here those return the same NaNs and leave errno as it was (#3688). For |x| <= 1 it follows the acosf of the libc.prx bundled with PPSA28319 (disassembly): FreeBSD msun's e_acosf.c, with the same constants, pio2_lo read at run time and the 0xfffff000 mask on sqrtf(z), which the binary holds. Titles ship different builds of that libc.prx: PPSA13934's is FMA-contracted and differs from this one by 1 ulp on 129,170 inputs (#9668), so no single port matches every title's last bit.

• atanhf (libc) follows the atanhf of the libc.prx bundled with PPSA28319 (disassembly): FreeBSD msun's e_atanhf.c calling msun's log1pf, whose paths for the positive arguments it passes are inlined here; the exported log1pf is still the host's. For |x| > 1, the infinities and NaN, Sony's error helper raises FE_INVALID and sets errno to EDOM before returning (x - x) / (x - x), and for |x| = 1 it raises FE_DIVBYZERO and sets errno to ERANGE before returning x / 0; msun itself sets no errno. That code, run on a Windows host, gives the same bits, errno and floating-point exceptions as this implementation for all 2^32 arguments; it was not run on Linux. That the system libSceLibcInternal, which Dusklight (PPSA99305) imports while bundling a zero-return libc.prx, has the same code is assumed

• j0, j1, jn, y0, y1 and yn (libc) call the host's sin, cos, sincos and log, so the last bits can differ from the console. The rest follows the system libc.prx built as J03093718 (disassembly), which given the console's own sin, cos, sincos and log gave the same bits and exception flags for 90 million arguments: msun's e_j0.c, e_j1.c and e_jn.c with each multiply-add the console fuses done as one FMA. As in that release, before FreeBSD commit 186f620727, y0, y1 and yn return -inf for ±0 and 0x7ff8000000000000 for a negative argument without raising an exception. The order wraps at 32 bits as on the console: jn(1 << 30, x) never returns for 2^-29 <= |x| < 2^30

• getenv, setenv, unsetenv, putenv (libc) keep one guest environment that starts empty, like the environ libkernel exports, and never reads or changes the host's. A title sees only the variables it sets itself; host variables such as HOME and PATH name host paths a guest cannot use (PS5MC, PPSA99420, exits with XBMC_Run returned -1 when it gets the host's HOME). Whether the console starts a title with any variables set is not measured

• mergesort (libSceLibcInternal, implemented in libc) checks its arguments like the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x762D0): an element size under 4 sets errno to EINVAL (22) and returns -1, an empty array returns 0, and a failed malloc of the count times the size plus 8 bytes returns -1. The sort is a stable bottom-up merge, not FreeBSD's natural merge with its insertion sort for short runs, so the comparator is called in a different order and number of times; the result is the same for a consistent comparator. A null base or comparator and a size product that overflows, which the console does not check, throw

• On macOS the write watch write-protects watched pages and records the first write to each from a SIGBUS/SIGSEGV handler, because macOS has no counterpart to userfaultfd write-protect or MEM_WRITE_WATCH. The protection is real, so:

  • a system call that writes into a protected page fails with EFAULT instead of faulting. GuestArena::HostWrite lifts the protection for the calls it brackets (file reads and socket receives), as Host writes into guest memory requires; a host call that writes guest memory without it (clock_gettime and the like into a watched page) fails;
  • code that changes the protection of watched pages, or maps over them, has to call GuestWriteWatchProtectionChanged, and code that asks the kernel for a page's protection has to ask GuestWriteWatchProtection first, since a watched page is read-only between a collection and the next write. Nothing calls either yet: the macOS memory paths are not in the tree;
  • the handler is installed when libc loads and passes other faults to the handler installed before it. A handler installed later has to do the same.

• On macOS the guest arena finds host regions with mach_vm_region and reserves the rest with a fixed mach_vm_map, which fails instead of replacing, as macOS has no /proc/self/maps or MAP_FIXED_NOREPLACE. The kernel keeps the range up to 0x70_0000_0000 unmappable for every process (max protection none). It starts at 0x10_0000_0000 on macOS 26.5 (M1 Pro, arm64 and x86_64 under Rosetta) and at 0xF_C000_0000 on macOS 27 (27.0.1 on an M4 Pro, arm64 and x86_64 under Rosetta; 27.2 on an M2 Max, arm64). With dyld and the Rosetta runtime near 0x2_0200_0000 and 0x3_0400_0000, a guest mapping fixed inside those ranges fails where the console places it; mappings without a fixed address are placed around them.

• sceKernelSync (libkernel) flushes only the host files and directories recorded through RecordWrittenPath_nid_no_patch (the libc, libkernel, save data and app content file functions) and their changed parent directories. A host write in a library that does not record its path is not flushed by sceKernelSync

• sceKernelSync (libkernel) on Windows skips a recorded file it cannot open for writing (read-only, or held open by a handle that denies write sharing), since FlushFileBuffers needs a writable handle. On Linux, it skips a recorded file it cannot open for reading. Such a file's data may not reach the disk before a host crash; the guest reads the same data either way

• fopen and freopen (libc) on Windows: freopen onto a directory in a read mode fails with EACCES, where FreeBSD opens it. Reading a directory stream from fopen fails with EISDIR and sets the error indicator on every host, as FreeBSD 11 tmpfs does; FreeBSD 11 FFS returns the directory's raw blocks instead, and what the console's filesystems return is unverified

• readdir and readdir_r (libc) on Windows report, on a file system whose directory listing carries no file ID (the entry's ID is 0, or the volume refuses FileIdBothDirectoryInfo), a nonzero d_fileno hashed from the entry name and the directory's file index, which differs from lstat's st_ino. Not reproduced: NTFS lists an ID for every entry

• Writes on an update stream (libc) on Windows go through the UCRT, which drops a write that directly follows a read without fflush, fseek, fsetpos or rewind unless the read reached end of file: fwrite returns 0, and fputc and fprintf report success, without the error indicator. FreeBSD 11.4's __swsetup discards the read buffer and writes at the descriptor's offset, past a read-ahead of st_blksize bytes for a regular file, so where the console writes depends on its block size. Reads directly after writes follow FreeBSD's __srefill

• fopen of /dev/random and /dev/urandom (libc) in a read mode returns a stream over the host null device whose fread fills the buffer with host OS entropy, as the libkernel random device descriptors do. Only the exact paths are recognised, the stream has no descriptor, setvbuf, feof, ferror, clearerr, flockfile, ftrylockfile, funlockfile and fclose work on it, fflush returns 0 as on a FreeBSD read-only stream, and every other stream function throws, as does opening the paths for writing. freopen onto these paths still fails with ENOENT. ProsperoTV (PPSA99003) reads its phone pairing code this way

• RemoveTree (libc) removes a host tree itself on Windows instead of calling std::filesystem::remove_all: MinGW libstdc++ up to GCC 16 does not treat a reparse point as a link, so remove_all recurses through it and never terminates, and any tree that holds a symlink hangs. It builds the entry list from GetFileAttributesW, removes a reparse point as the link it is rather than its target, clears the read-only attribute and retries as remove_all does, and reports the first native error. The libstdc++ fix is in GCC 17 (commit 88856ad855ae); other hosts call remove_all.

• The _Unwind_Context that _Unwind_Backtrace passes to its callback starts with a table laid out like LLVM libunwind's AbstractUnwindCursor virtual table, because homebrew built with the ps5-payload-dev SDK links libunwind statically and reads the frames with its own _Unwind_GetIP (__unw_get_reg), which calls through that table. Only register reads and writes (validReg, getReg, setReg, with UNW_REG_IP and UNW_REG_SP), validFloatReg (always false) and isSignalFrame are answered; the other slots throw. The layout follows libunwind's UnwindCursor.hpp, not the console's own libSceLibcInternal, which is not checked

• The Windows libc exception unwinder cannot run arbitrary Windows exception or termination handlers. It accepts GCC C and C++ handlers identified by a project's .sehgcc section and interprets their LSDA with the guest personalities. A handler in an unmarked module, such as a C++ cleanup through __gxx_personality_seh0 in libstdc++-6.dll or a system DLL function like qsort in ucrtbase.dll (Windows 10 22H2), still stops unwinding and the exception is reported as unhandled. SjLj exceptions are unsupported; Scoop GCC 15.2.0 selects them when SEH is disabled and lacks the System V ABI SEH compiler fix carried by MSYS2.

• The libc SSE4a trap emulation on Windows is superseded by --to-intel and remains only until the relinked title has been verified without it.

• getifaddrs (libc) lists host interfaces and IPv4/IPv6 addresses in FreeBSD's layouts. Windows and macOS omit per-interface AF_LINK entries and interfaces without an address; on Windows the flags are only IFF_UP, IFF_RUNNING, IFF_LOOPBACK, IFF_BROADCAST and IFF_MULTICAST (PPP/tunnel adapters omit broadcast and point-to-point, and an unspecified prefix length gets a host mask). On Linux, AF_LINK if_data maps non-Ethernet/loopback/PPP types to IFT_OTHER (1) and leaves ifi_omcasts, ifi_noproto, ifi_hwassist, ifi_metric, ifi_epoch, ifi_lastchange, unknown baud rates and address-entry ifa_data as 0/null; a point-to-point address without a peer loses IFF_POINTOPOINT, and an omitted IPv4 broadcast is derived from the netmask. Interface names are the host's (if<index> on Windows above 15 bytes).

• gethostname (libc) reports an empty name without querying the host machine name, as a payload process read on a PS5 (firmware 13.60): 0 with only the terminator for a 256-byte and a 1-byte buffer. Buffer copying, null queries and ENAMETOOLONG follow FreeBSD gethostname; whether a title process or a console with a configured name reads another name, and the integration with sysctl and name resolution, are unverified and not implemented.

• wctomb_s, wcrtomb_s, mbstowcs_s and mbsrtowcs_s (libc) follow the console's libc.prx, but convert in the single-byte C locale of wctomb, wcrtomb and mbrtowc (MB_CUR_MAX 1): a character above 0xFF is EILSEQ in wctomb_s and wcrtomb_s, and each byte is one wide character in mbstowcs_s and mbsrtowcs_s. The locale of a title's libc.prx was not measured. The wcrtomb_s path where a character does not fit smax and the EILSEQ paths of mbstowcs_s and mbsrtowcs_s are not reached

• wcsrtombs_s (libc) follows the console's libc.prx, but a runtime-constraint violation only returns its error: the default handler there writes the message and a newline to stderr before returning, which is not done here. Conversion uses the C locale of wcrtomb (MB_CUR_MAX 1), so the path where a multibyte character does not fit the remaining space is not reached

• c16rtomb, c32rtomb, mbrtoc16 and mbrtoc32 (libSceLibcInternal, implemented in libc) - a null state, which the console dereferences, throws. Otherwise they follow the console's libSceLibcInternal.sprx (0x7D480 to 0x7D920), read from disassembly: UTF-8 whatever the locale, up to six bytes per sequence, with no surrogate or 0x10FFFF check when encoding. The state holds the value in its first eight bytes and the expected byte count (0x10 for a pending low surrogate, 1 for a stored high one) as 16 bits at 0xA. mbrtoc16 builds a low surrogate from the value the state last held, c16rtomb returns -1 without errno for an unpaired high surrogate, and EILSEQ is 86. On a PS5 (13.60) the system library's default locale converts UTF-8 in wcrtomb, wctomb, mbrtowc and mblen; a title's bundled libc.prx does too until setlocale installs a table (disassembly)

• The narrow printf family (libc) follows a payload process on a PS5 (firmware 13.60): each 16-bit unit of a %ls or %lc argument is encoded alone, so a surrogate pair gives two 3-byte sequences; a NaN keeps its sign and the + and space flags, and 0 pads it with spaces; argument positions above 99 work (up to 400 measured; above 65535 throw here); an unknown conversion such as %m or %k prints % and its letter, padded to the width, without taking an argument. The guest's wcrtomb and locales are not used. On Linux the formats without those conversions or a floating-point conversion go to glibc, which prints NaN the same way. The _s forms throw for an unknown conversion, %m included, which was not measured

• %a and %A (libc) format a finite double as the libc.prx that titles ship does, instead of through the host: a subnormal is normalised (0x1p-1074), a shorter precision rounds half up on the dropped hexadecimal digits and a carry stays in the leading digit (%.3a of 0x0.fffffffffffffp-1022 is 0x2.000p-1023), and - overrides 0. Checked by running the copies of PPSA13934, PPSA07923 and PPSA05916 side by side on 7 million random formats, not measured on a console. Infinities and long double still go to the host; NaN keeps its sign and flags through the formatter on current main.

• %e, %f and %g (libc) format a finite double or long double as the libc.prx that titles ship does, instead of through the host. It keeps the exact decimal digits down to position 4 * floor(k / 4) - 20, where k is the frexp exponent times 30103 / 100000 truncated, and prints zeros after them; a shorter precision rounds half up on the kept digits, except that an exact tie rounds down when k is at least 8 (%.0f of 67108865.5 is 67108865). The console computes the kept digits in extended precision, so about 7% of outputs longer than 17 significant digits end one unit lower than here (%f of 1e22 is 9999999999999999999999.000000). Checked by running the copies of PPSA07923, PPSA05916 and PPSA13934 side by side, not measured on a console. The wide printf family uses the same digits, as the titles' swprintf gives the same text as their snprintf.

• %p and %lp (libc) follow the console's libSceLibcInternal.sprx measured from a homebrew payload on firmware 12.70 (#7549), not FreeBSD: bare lowercase hex with no 0x prefix even under #, 0 for a null pointer, + and the space flag ignored, the width counting only the digits, - padding on the right, 0 padding with zeros when there is no precision, the precision as the minimum number of digits, nothing for a null pointer under %.0p, and l accepted. Only snprintf and swprintf of that module were measured, from a payload process rather than a title process, so a width beside %.0p, the 0 flag beside a precision (which C17 ignores) and %.0p of a non-null pointer follow this formatter's own rules and are not measured; swprintf was not run with %lp, so the wide family still refuses that conversion and returns -1. Linux routes %p and %lp to this formatter because glibc prints the FreeBSD form and (nil) for a null pointer, which means a format that combines %p with a conversion this formatter refuses, such as an argument position above 99, throws there instead of reaching glibc

• collate and collate<wchar_t> _Getcat (libc) build the facet for the C locale only and throw for any other locale name, the wide entry point following the narrow one it sits next to. The wide facet carries its own vtable, whose compare, transform and hash take the guest's 16-bit characters, so the length of a range is a count of characters: compare orders by 16-bit value (the C locale, as Dinkumware's char_traits<wchar_t>::compare does), transform copies the characters into the result and records size and capacity in 16-bit elements (inline capacity 7, heap capacity length | 7, (capacity + 1) * 2 bytes including the terminator), following Dinkumware's VC12 basic_string, and hash mixes one whole character per round, so wide text below 0x100 hashes like its narrow spelling and a character above 0xff hashes as one value instead of the two bytes it holds. The console's libc.prx exports both _Getcat (NIDs BSVJqITGCyI and 2wz4rthdiy8) with identical 0x19d-byte bodies, believed to build the same 0x20-byte facet; the console bodies themselves are unreadable (obfuscated dynsym, and the text of the relinked libc.prx is zeroed), so the wide entries follow the narrow algorithm and the C locale instead of the console's wide code, and no console run checks the two. The console's libc.prx stores pointers to its collation state tables at offsets 0x10 and 0x18 of the facet; ours leaves them null, as only the facet's own functions read them. do_transform throws for input with embedded null characters, which the console drops depending on the output buffer size. The narrow result capacity (length | 15) and the over-aligned storage of results of 4080 characters or more follow the console's libc.prx code and are not checked on hardware. No module of the PPSA59322, PPSA76677 or PPSA97358 dumps in this tree imports either _Getcat, so neither has been exercised by a title.

• codecvt, numpunct, num_put and time_put _Getcat (libc) build facets matching a bundled console libc.prx (dynsym decoded by NID, vtables disassembled): categories 2, 4, 4 and 5, sizes 0x10, 0x30, 0x10 and 0xb8. codecvt<char> reproduces the console virtuals (noconv conversions, length the shorter range); numpunct<char> copies its C-locale table ("", ., ,, false, true). num_put/time_put formatting virtuals throw rather than fabricate output, and time_put's _Locinfo table is unpopulated — the console's do_put bodies were not mirrored. The facets share the no-op destroy/deleteObject/retain/release base used for collate, so numpunct's static C-locale strings are never freed. Unlike collate, these _Getcat entries ignore the locale argument and always build the C-locale facet; the console's behaviour for a non-C name is unverified. std::clog and std::wclog are 0x400-byte zeroed objects like the rest of the NSTDSTR stream set (the console's libc.prx sizes std::clog at 96 bytes, measured from its dynsym st_size), and the numpunct<char>::id and time_put<char>::id objects are 8-byte zeros like the other facet ids.

• std::__throw_bad_variant_access (libc) throws std::bad_variant_access with the what() string bad_variant_access, the one LLVM libc++ returns, since the export carries libc++'s __throw_bad_variant_access name; the console's string is unverified. Onimusha: Way of the Sword (PPSA27836 01.000.001) imports it from libc, and its bundled libc.prx does not export it.

• std::bad_optional_access and std::_Throw_bad_optional_access (libc) provide the exception type, constructor, destructor, and what() exports alongside _Throw_bad_optional_access, returning the what() string bad_optional_access matching Dinkumware and libc++ conventions; the console libc.prx string is unverified. PPSA26578 (issue #7624) and PPSA34015 import _ZSt26_Throw_bad_optional_accessv (KwzEip7m6TM) from libc.

• The scanf family (libc), the _s forms included, decodes the input of the 16-bit wide conversions (%ls, %lc, %l[, %S, %C) on Linux as UTF-8, mirroring the narrow printf family, where FreeBSD uses the locale's mbrtowc (one byte per character in the C locale); the console's locale encoding is unverified. Input that is not UTF-8, a character outside the BMP, a scanset member outside ASCII, positional arguments next to a wide conversion and wide conversions in fscanf throw. Each character is stored as one 16-bit unit, widths and _s sizes count characters, and a %lc field cut short by the end of the input keeps what it read, as FreeBSD's convert_wchar does. Windows hands %ls, %lc and %l[ to the host, whose wchar_t is 16 bits

• The scanf family (libc) on Windows returns 0, as C17 and FreeBSD do, when input fails after only suppressed conversions have completed (sscanf("12", "%*d%d", &value)). Linux hands the format to glibc, which returns EOF there. On Windows the host stops a %x, %X, %i or %p after the x of a 0x that no hex digit follows (or that the width cuts off), and a float conversion (%e, %f, %g, %a) after the e of an exponent with no digits (1e), where C17 and FreeBSD stop before the x or the e

• The scanf family (libc) on Linux reads a q length as ll, as glibc does. On Windows a q directive ends the scan with nothing stored, as the console's own libc does for %qd; FreeBSD 11.4's source reads it as ll.

• Guest path resolution falls back to ASCII case-insensitive component lookup, following shadPS4's host filesystem. PPSA03747 requests Skyrim.INI, Data/Video and lowercase archive/plugin names that differ from the dump's filenames. Exact host names take precedence; multiple fallback matches throw instead of selecting an arbitrary file. Existing parent names are resolved when creating a new file, and guest mount aliases use the same ASCII comparison. Results are not cached, so renames and newly created files remain visible. Unicode case folding and PS5 behaviour for case-colliding host entries are unverified; host roots are used as supplied. Explicit native Windows drive and UNC paths bypass guest parent-component validation.. A relinked module's <name>.guest.prx is matched the same way when the original module is not beside it: Borderlands 4 (PPSA01494) loads /app0/prx/libRenoirCore.PS5.prx, which it ships as librenoircore.ps5.prx. A relinked module request that misses both the exact and the case-insensitive <name>.guest.prx takes the sibling whose stem (the name without its last extension, ASCII case ignored) equals the requested stem and that ends with .guest.prx, shortest name first: Unity IL2CPP titles load Media/Modules/<name>.prx and Media/Plugins/<name>.prx, and the relinker names the converted module after the ELF it was built from, <name>.elf.guest.prx. The console's module namespace is assumed to ignore case and the extension; several stem matches pick the shortest name instead of throwing, which is not measured on a console

• Guest file names on Windows (libc) are not escaped or mapped before the host call, so names Windows treats specially differ from FreeBSD, where only / and NUL are special. a*b, a?b, a<b>c, a|b and a"b fail with EINVAL (22) where FreeBSD creates them. trail. and trail both create the host file trail, so three FreeBSD names are one file here. NUL and a reopen of it succeed, but no file is created. con, aux.txt and COM1 create ordinary files. Colons are under Colons in guest names. Measured on Windows 11 (10.0.26200), MinGW-w64 GCC 15.2.0 r7, with open (O_CREAT|O_EXCL|O_WRONLY), a one-byte write and a listing of the host directory; not measured on Linux or a console. A fix needs a guest-to-host name mapping.

• Colons in guest names (libc) - on Windows (NTFS) a guest name containing : is not a plain file name: name:stream opens or creates the alternate data stream stream of the file name. Creating /savedata0/C:file makes an empty file C whose stream file holds the data, and stat of /savedata0/C then reports a regular file. mkdir of a name containing :, such as C: or dir:x, fails with EINVAL. name:stream already behaved this way before drive-letter components were kept under their mount

• tzname (libc) points at the host's zone names, read at load and again by tzset: the abbreviations a TZ string gives (EST5EDT is EST and EDT on both hosts), but on Windows without TZ the CRT's full names such as GMT Standard Time, which ICU's uprv_tzname (ES-DE in PPSA99169) cannot map to a zone ID. A payload process on a PS5 (firmware 13.60) read both names empty with TZ unset, and its %Z printed nothing whatever tm_zone held; the names a title process sees are not known

• localtime, mktime (libc) on Windows convert through the CRT's localtime_s and mktime, which accept about 1970 to January 3001 UTC and apply the CRT's daylight-saving rule. A time outside that range is converted a whole number of 400-year Gregorian cycles away, where the calendar repeats, so it gets the rule the CRT applies to that year and not the zone's historical one. On macOS mktime converts through the host's mktime, which refuses every year before 1900. A local time before 1900 is instead solved for directly: the offset localtime_r gives for a candidate time, which follows the zone's history (local mean time before its first transition), is subtracted from the local fields, and the step is repeated until the offset holds. tm_isdst is not consulted there, so a time with tm_isdst set where the zone had no daylight offset is taken as standard time. FreeBSD's time1 would instead shift it by the difference between one of the zone's daylight types and a standard one. gmtime converts every time whose year fits an int on both hosts.

• strftime and asctime (libc) follow a payload process on a PS5 (firmware 13.60) in the C locale. %G, %g and %V throw for a negative tm_yday, a tm_yday past the year or a tm_wday below -6, where no rule fits the console: %V is 01, 00, 00 and 52 for tm_yday -25, -13, -12 and -1 (tm_wday 5), tm_yday 400 of 2026 is week 01 of 2027 but 415 of 1997 is week 59 and 365 of 2013 week 53, and tm_wday -12 with tm_yday 18 is week 04. %k, %l, %P, %s, %+, %v, flags and widths are copied as written, E or O before an unknown conversion is dropped, and a format ending in either throws, where the console crashed. Negative fields print 0 and fields wrap at 100 (%j at 1000, %u and %w at 10); %Y and %G are the year mod 10000, %C is tm_year / 100 + 19. A negative weekday or month gives Sun or Jan. %z and %Z ignore tm_gmtoff and tm_zone and use the guest zone and tzname

• wcsftime (libc) converts the format to UTF-8, runs this library's strftime and converts the result back, where the console's libSceLibcInternal.sprx (0x854e0) copies literal wide characters and expands each conversion straight into the buffer; the results match for the formats tried, and it has the strftime gaps above. A result that does not fit returns 0 with the buffer untouched, where the console leaves the characters written so far. A null buffer returns 0, where the console writes through it, and a size too large for the narrow buffer returns 0 with EINVAL, where the console formats as usual. A null format or tm throws

• syslog (libc) writes each message to stderr as [syslog:<priority>] <message>, with a newline added when missing, instead of sending it to the console's system log. Priority and facility handling follow FreeBSD's vsyslog: %m expands to the guest errno's message, unknown bits are reported (as priority 0x23, since FreeBSD passes LOG_ERR|LOG_CONS|LOG_PERROR|LOG_PID as the priority) and masked, a missing facility becomes LOG_USER or the facility set by openlog, and errno is preserved. openlog applies its identity and LOG_PID; a null identity retains the previous one, and a valid nonzero facility replaces the default. closelog clears the identity but retains the options and facility, as in FreeBSD 11; when no identity is set, FreeBSD falls back to the program name, which this backend does not emit. LOG_PERROR has no extra effect because stderr is the emulated log sink; LOG_NDELAY/LOG_ODELAY, LOG_NOWAIT and LOG_CONS have no daemon, child or console backend to control. setlogmask follows FreeBSD 11: the process-wide mask defaults to 0xff, zero queries it, and nonzero values replace it; masked messages are skipped before formatting, including the unknown-priority diagnostic. The console's mask behaviour is unverified

• fwscanf, vfwscanf, wscanf, vwscanf and their _s forms (libc) run the swscanf scanner on characters read with fgetwc, so everything listed for swscanf in this file applies to them. As in the console's libc.prx, a field takes characters while they can still begin a valid item, so a failed field such as 0x for %x stays consumed, and only the character that ended the scan goes back to the stream. That character is pushed back as its UTF-8 bytes with ungetc, because ungetwc takes single bytes only; the Windows C runtime guarantees one byte of push-back, so a non-ASCII lookahead can be lost there. A null stream or format returns EOF; the console checks them only in the _s forms.

• daemon (libc) throws: forking into the background is not supported. PPSA85300 imports it and fails to load without it. VLC 3.0 calls it only when its daemon option is set (libvlc.c), and the title starts libVLC with --ignore-config and without --daemon (player.cc)

• _WStoul, _Iswctype, swscanf_s and swscanf (libc) - _WStoul is wcstoul and throws for a base other than 0 or 2 to 36. _Iswctype takes the class numbers of Dinkumware's xwcc.h (1 alnum to 11 xdigit, 12 blank) and throws for any other value, including the FreeBSD masks wctype returns; the numbering is not confirmed on the console's libc.prx. swscanf_s follows C11 7.29.2.2 and K.3.9.1.5, but reads the size argument as unsigned int like sscanf_s where K.3.9.1.5 specifies rsize_t; the console's width is unverified. A runtime-constraint violation (null buffer, format or receiving pointer) only returns EOF, and a too small array gets a null first element as in sscanf_s. A literal at end of input returns the number of assignments, including zero, rather than EOF as FreeBSD does, as reported from the console scanner in #8479; %% at end of input still returns EOF. A literal mismatch is a matching failure, where FreeBSD's vfwscanf reports an input failure. An incomplete floating exponent such as 1e+ converts its mantissa, as reported from the console scanner in #8479; other incomplete exponent forms are not separately verified. A short %c field is currently a matching failure without storing its available prefix, while #9321 reports that the console stores a short %3lc field; its return count, partial-output extent and precedence are unverified. An integer field that is only a prefix, such as 0x, does not convert; FreeBSD's vfwscanf pushes back the x and converts the 0. Integers out of range are truncated from strtoll/strtoull. %p follows FreeBSD 11's vfwscanf.c: a hexadecimal integer with an optional 0x, converted as unsigned and stored as a pointer; a length modifier on it throws, where FreeBSD ignores it. %S and %C, with any length modifier or *, end the scan as a matching failure, as the console's Dinkumware scanner in PPSA21564's libc.prx treats them as invalid conversions; this was read from the module, not run on a console, and whether input ending before them is an input failure instead is unverified. It throws for unknown length modifiers, scanset ranges, %n with suppression or width, and narrow %s, %c or %[ input that the C-locale wcrtomb cannot convert. swscanf runs the same scanner without the size arguments of %s, %c and %[, as FreeBSD's swscanf.c passes its arguments to vswscanf, so everything above except the sizes applies to it; it also keeps the null buffer, format and receiving pointer checks returning EOF, where C leaves those undefined. Neither variant is confirmed on a PS5 title

• flock (libkernel) on Windows shares one lock state between duplicated descriptors, following FreeBSD 11.4's flock(2). Independent opens have separate states; closing a descriptor or reopening a stream drops only its reference. Lock transitions on one open file description are serialized. The lock is a host LockFileEx lock on one byte at offset 2^63 - 2, which no file reaches, so it excludes other flock calls and leaves reads, writes and mapped views alone, like FreeBSD's advisory locks. Console behavior, signal interruption and concurrent closure of a descriptor while its lock call is pending are unverified.

• std::_Throw_Cpp_error (libc) follows Dinkumware thread0.cpp (VC12, STL), without console verification. Codes outside 0..6 throw std::out_of_range, the deleting destructor throws, and STREAMS errnos absent from FreeBSD 11.4 errno.h (ENODATA, ENOSR, ENOSTR, ETIME) are omitted. Codes 0..6 throw a 32-byte VC12 system_error with FreeBSD errnos (16, 22, 3, 12, 1, 11, 35), a static generic_category (not _Generic_object), and unverified 40-byte GuestLocale::String messages from syserror.cpp

• Call tracing (--trace-imports, APS5_TRACE_CALLS) records only the entry of a call, not its arguments or result. One process-wide ring keeps the last 65536 calls, so a busy thread pushes the others out; the reporting thread's own calls are listed only while they are still in that ring. Calls are counted per traced target; an import bound to a target already traced under another name is counted under the first name. The thunk saves the integer argument registers and xmm0 to xmm7; wider vector arguments survive only while the recording code avoids AVX, which is untested. Linux and macOS have no crash report, so they print the trace only on SIGABRT (guest or host abort()), not on SIGSEGV; a caller in a module loaded after the last traced import prints without a module name, and a thread aborting while another writes the report waits for it at most 2 seconds. An arm64 libc build omits the recorder

• _Dtest (libc) follows Dinkumware double classification matching _FDtest: finite values return -1, subnormals -2, zeros 0, infinities 1, and NaNs 2.

• _Exp and _FExp (libc) follow PRAGMATA PPSA02530's bundled libc.prx (static disassembly): both operands are classified first and only finite/denormal pairs take the finite path. The strict x-only cutoffs at ±229/±1842 store 0.0*y without an error below and y*inf with overflow above, so an offset does not compensate them. A zero multiplier keeps its sign, a NaN multiplier leaves *px unchanged, +inf with zero or -inf with infinity is invalid, and finite multipliers with +inf/-inf return signed infinity/zero without flags. Inside the cutoffs subnormals are Finite without flags, a zero from scaling raises underflow, and the negative cutoff itself raises nothing. _FExp uses the measured c1, c2, invln2, Q and P; _Exp finite constants, exact finite bits, signaling NaNs, directed rounding and flush-to-zero modes remain unverified.

• exp2f (libc) is FreeBSD msun's s_exp2f.c, with huge and twom100 read at run time and x + redux rounded to float, as msun's volatile reads and STRICT_ASSIGN do. As in the libc.prx that titles ship, errno is set to ERANGE only in msun's overflow (x >= 128) and underflow (x <= -150) branches, so a subnormal result leaves it unchanged. Floating-point exceptions are not compared. It gives the same bits and errno as the exp2f of the libc.prx bundled with PPSA07923, PPSA05916 and PPSA13934 for all 2^32 arguments, run on a Windows host.

• app0.zar (libc) - a ZArchive beside app0/ is a read-only layer under it: a path missing from app0/ is looked up in the archive, case-insensitively. It is not a console format; titles ship their files in a PFS image instead. Resolving an archive-only path through any call other than the archive-aware libkernel ones throws, so fopen, stat, access, opendir and the rest do not read the archive yet, and opendir of a directory that exists in both places, app0/ itself included, and fdopen of an archived descriptor throw instead of missing its entries or reading the null device. A damaged compressed block throws instead of returning EIO

• fopen_s (libc) - returns the errno of the failed open, as C11 K.3.5.2.1 leaves the nonzero value open and Microsoft's CRT returns errno; the console's Dinkumware fopen_s is not verified

• codecvt<wchar_t,char,_Mbstatet> vtable (libc, NID H-TDszhsYuY) is thirteen zeroed uintptr_t slots matching st_size 104 on title libc.prx from PPSA26344 and on libSceLibcInternal.sprx (offset-to-top, typeinfo, two destructors, _Incref/_Decref, and seven conversion virtuals). Facet calls through the object fault until those methods are wired.

• num_put<wchar_t> vtable (libc, NID 59oywaaZbJk) is fourteen zeroed uintptr_t slots matching st_size 112 on the title libc.prx from PPSA16833 (offset-to-top, typeinfo, two destructors, _Incref/_Decref, and eight do_put virtuals). Facet calls through the object fault until those methods are wired.

• time_get vtable (libc, NID o4kt51-uO48) is thirteen zeroed uintptr_t slots matching st_size 104 on console libSceLibcInternal.sprx (offset-to-top, typeinfo, two destructors, _Incref/_Decref, and seven do_* virtuals). Facet calls through the object fault until those methods are wired.

• time_get<wchar_t> vtable (libc, NID sEca1nUOueA) is thirteen zeroed uintptr_t slots matching st_size 104 on console libSceLibcInternal.sprx (offset-to-top, typeinfo, two destructors, _Incref/_Decref, and seven do_* virtuals). Facet calls through the object fault until those methods are wired.

• num_get<wchar_t> vtable (libc, NID Y9C9GeKyZ3A) is seventeen zeroed uintptr_t slots matching st_size 136 on console libSceLibcInternal.sprx (offset-to-top, typeinfo, two destructors, _Incref/_Decref, and eleven do_get virtuals). Facet calls through the object fault until those methods are wired.

• ios_base standard streams (libc) _Addstd queues the stream in the standard stream table of Dinkumware ios.cpp (stdstr, stdopens, _Addstd, _Ios_base_dtor): it takes the first of slots 1 to 7 that is free or already holds the stream, and slot 8 (NSTDSTR) when none is, so slot 8 is shared by every stream past the first seven and registration never fails. It stores the 1-based slot index in the guest IosBase::standardStream (Dinkumware's _Stdstr, where 0 means not a standard stream) and counts the stream objects registered per slot; registering the same stream again reuses its slot and raises its count. Measured on a PS5 (firmware 13.60) from a homebrew payload calling the system libSceLibcInternal export: in a process whose own standard streams already hold slots 1 to 7, twelve distinct streams and a repeated one all get 8, written as a 64-bit value at offset 0x8 with no other byte of the object touched; the assignment of slots 1 to 7 to fresh streams is not observable there and follows VC12. The counts are int, not VC12's char, and the registration and the destructor lock the table where VC12 locks only _Addstd; a slot index past the table throws in the destructor instead of indexing out of bounds. The destructor decrements its slot's count and suppresses the rest of the destruction while the count stays positive, as _Ios_base_dtor does, and the slots of destroyed streams keep their pointer and stay reserved for that stream, as stdstr does. The streams themselves are destroyed by the title's own code as it registers them through __cxa_atexit; when the last reference closes, the unsupported stream storage and callback cleanup is still the throw it was and the locale is released as for a non-standard stream.

• std::_Pad, _Thrd_join, _Thrd_detach, _Thrd_id (libc) follow Dinkumware V6.00 thr/xthread and thr/threadcall.cpp (crt.vc12 f1d47126), otherwise without console verification. _Thrd_id returns scePthreadSelf() unchanged, as measured on a PS5 (firmware 13.40) in two threads (#4164, #8711); _Launch omits _Cnd_do_broadcast_at_thread_exit; the two-argument form starts with default attributes and the three-argument form forwards the caller's attribute pointer, as PPSA02530's libc.prx does at 0x18090. The 32-byte pad layout is assumed from VC12, unverified. Failing primitives or thread start throw the guest std::system_error; null arguments throw. _Thrd_join returns _Thrd_error (4) on pthread_join failure and truncates the exit code to int; _Thrd_detach returns _Thrd_error (4) on pthread_detach failure and throws when none is registered

• siginterrupt (libc) runs FreeBSD 11.4's siginterrupt.c sequence through the sigaction and the _sigintr set that libkernel registers at load: it reads the signal's disposition, sets or clears the signal's bit and SA_RESTART, and installs the disposition again. The set is written outside libkernel's registration lock, as FreeBSD's libc writes it without one; a call before libkernel has registered throws.

• collate vtable (libc, NID ruZtIwbCFjk) is nine zeroed uintptr_t slots matching st_size 72 on the title libc.prx from PPSA16833 (offset-to-top, typeinfo, two destructors, _Incref/_Decref, and three do_* virtuals). Facet calls through the object fault until those methods are wired; _Getcat still installs the host g_collateVtable for facets it builds.

• num_get::id, time_get::id and the num_get vtable (libc) are data objects, as the public SDK's libSceLibcInternal table declares them and as the other facet ids and the num_put and codecvt vtables are kept: the ids start at zero and the vtable is 17 zeroed slots, the 136-byte size of KfcTPbeaOqg in the console's libSceLibcInternal, whose relocations fill the offset-to-top and typeinfo entries, the two destructors, locale::facet::_Incref and _Decref, and the eleven do_get of Dinkumware's crt.vc12 xlocnum, so a guest resolves the symbols and reads data, and a facet call through the vtable faults. libSceAmpr exported the three as throwing functions, which a data consumer reads as code; its qualified imports fall back to libc.

• printf family conversions (libc) - Windows FormatWindows follows the title libc.prx _Printf measured from PPSA13934, PPSA07923, PPSA05916 and PPSA04158: %q, %D, %O and %U are unknown conversions; an unknown character is printed with its leading %, and width, - and discarded length modifiers behave as measured (%5y is %y, %hhz is %z). %% takes a width. A trailing % reads past the format's NUL and is not reproduced; it throws. #, precision and a 0 without a width are ignored, as a payload process on a PS5 (firmware 13.60) printed %#k and %.2k as %k; +, space, ' and 0 with a width on an unknown conversion are unverified and throw. On Linux a format with an unknown conversion also goes to this formatter

• child process registry (libc) - RegisterChildProcess_nid_no_patch and WaitChildProcess_nid_no_patch track the native handles of children created by posix_spawn (libSceLibcInternal) so libkernel can reap them on Windows, where the host has no waitpid. The registry lives in libc because libSceLibcInternal imports libc but not libkernel. RegisterChildProcess_nid_no_patch stores the process ID and handle; only reaped handles are closed, and a process that exits without waiting leaks them. Registration without a live child is not validated, and a duplicate process ID is accepted. The decoder maps recognized structured-exception codes to guest signals, keeping the guest exit byte layout for anything else. These exports are internal glue for libkernel, not console ABI: their behavior is unverified against any PS5 library and a title importing their NIDs directly is not expected.

• fprintf_s, vfprintf_s, vprintf_s, fwprintf_s, wprintf_s, vfwprintf_s and vwprintf_s (libc) follow C11 K.3.5.3.1, K.3.5.3.10 and K.3.9.1.1 with the constraints of snprintf_s and swprintf_s: a null stream, format or argument list, any %n, and a null %s, %ls or %S argument return -1 and write nothing, because the output is formatted completely before it is written. A violation only returns: the constraint handler is not invoked, errno is untouched, and the value is the one the narrow snprintf_s returns on this branch, not a result measured for a stream function on a PS5. A closed stream sets EBADF (9) as fprintf does. vprintf_s and vwprintf_s write to the guest standard output stream, and the wide forms count characters while the narrow ones count bytes, as their unchecked siblings do

• scanf_s, fscanf_s, vscanf_s and vfscanf_s (libc) run the scanner of sscanf_s over the stream, taking the size of %s, %c and %[ as unsigned int after the pointer, so everything listed for sscanf_s applies, including the count of items converted before an undersized destination, whose first element is set to zero. Each directive is read from the stream with the host fscanf, with one character of look-ahead pushed back, so the stream stops after the last character a conversion used. A null stream, null format or null destination returns EOF, a closed stream also sets EBADF, and the constraint handler is not invoked. The 16-bit wide conversions (%ls, %lc, %l[, %S, %C) throw on Linux, as in fscanf. None of the stream forms were measured on a PS5, and the size type follows sscanf_s rather than rsize_t

• freopen_s (libc) follows C11 K.3.5.2.2 through freopen: a null result, mode or stream returns EINVAL (22) with *result set to null when it exists, and a null name is passed to freopen, which reports mode-only reopening as unsupported (ENOTSUP, 45) with *result null, and the constraint handler is not invoked, as in fopen_s. A successful reopen stores the stream in *result and returns 0, and a failed one stores null and returns the errno freopen left, closing the stream as freopen does. The console's return values are unverified