AnyPS5/docs/dev/debt/libSceLibreSsl.md

libSceLibreSsl technical debt

• EVP_PKEY_id returns the key's stored type, the first 32-bit field in LibreSSL 2.5.4's EVP_PKEY layout. Its signature and behavior follow p_lib.c and evp.h; PS5 behavior has not been independently measured. A null key throws where the reference dereferences it.
• EVP_PKEY_free - PS5 behavior has not been independently measured. A key that holds algorithm data, an engine or attributes throws and keeps its last reference, since no export can attach them yet. Reference counting and release follow LibreSSL 2.5.4 p_lib.c.
• EVP_PKEY_new - PS5 behavior has not been independently measured. The 56-byte LP64 layout and initial values follow LibreSSL 2.5.4 evp.h and p_lib.c.

Functional

• File and socket BIO adapters (BIO_s_file, BIO_new_fp, BIO_new_socket) extend the guest-ABI-compatible memory BIO implementation from #9536 using guest libc FileStream and libSceNet descriptors. File and socket BIOs have not been compared against the firmware or exercised on a console. Socket retry flags, socket pending-byte queries and extended file/socket control commands are not implemented; unsupported method controls return 0. File and socket ownership follows the caller's close flag.
• SSL_select_next_proto (libSceLibreSsl) follows LibreSSL 3.4.1 ssl_lib.c, which validates neither list: a zero-length entry is negotiated, no overlap returns supported + 1 with the unchecked length byte supported[0], read even for an empty supported list, and each pair of entries with equal length bytes is compared over that many bytes, past the end of a truncated list. Firmware 13.42 host-PC evidence of libSceLibreSsl.sprx (0xda6d0) reports the same status, pointer and length for 700,000 valid pairs and for the six unvalidated cases. Null outputs, a null supported list and a null peer list with a non-zero length throw, where the module faults; nothing is measured on a console.
• GENERAL_NAME_free and GENERAL_NAMES_free (libSceLibreSsl) - release all nine GENERAL_NAME choices and STACK_OF(GENERAL_NAME) using the guest allocator, following LibreSSL 2.5.4 v3_genn.c and its ASN.1 free dispatcher. ASN1_STRING and dynamically allocated OID contents are wiped before freeing; NDEF strings and static OIDs retain their borrowed memory. Nested X509_NAME entries and cached data are freed as in 2.5.4. Guest allocator tests check owned/borrowed memory and disposal of nested allocations. PS5 native module behavior and malformed-memory failure cases are not verified; negative owned data lengths throw rather than risk out-of-bounds memory erasure.

Unknown function info

• SSL_get_SSL_CTX, SSL_get_rbio, SSL_get_wbio, SSL_version, SSL_get_verify_result, SSL_get_shutdown, SSL_want (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow LibreSSL 2.5.4 ssl.h, ssl_locl.h and ssl_lib.c, the version in the firmware 13.40 measurements. No export of this module creates a connection yet, so only connections the caller builds reach them. A null connection, and for the fields kept in ssl_internal_st a null internal state, which LibreSSL dereferences, throw

• SSL_set_verify, SSL_get0_alpn_selected, SSL_set_connect_state, SSL_ctrl (libSceLibreSsl) - nothing is checked on the console. SSL_ctrl throws for the commands LibreSSL passes to ssl3_ctrl or dtls1_ctrl, including SSL_set_tlsext_host_name. SSL_set_connect_state throws when a cipher or hash context is set, which LibreSSL frees; they are null before a handshake. Layouts and results follow LibreSSL 2.5.4 ssl.h, ssl_locl.h and ssl_lib.c, the version in the firmware 13.40 measurements. No export creates a connection or SSL_METHOD yet, so only structures the caller builds reach them. Null pointers that LibreSSL dereferences throw

• libSceLibreSsl pending exports - the unimplemented named callable exports are listed in the PS5 3.20 export table and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through NotImplemented_nid_no_patch.

• MD4, MD5, SHA1, SHA224, SHA256, SHA384 and SHA512 Init/Update/Final and SHA256 (libSceLibreSsl) - signatures and context layouts follow the LibreSSL headers, and buffering and Final follow its sources; nothing is checked on the console. Null contexts, null input with a nonzero length, null digest buffers in the 32-bit Final functions and a buffered byte count that is not below the block size, which LibreSSL does not check, throw. SHA-384 and SHA-512 initialization retains the block buffer, following LibreSSL 2.5.4 sha512.c

• DES_set_key, DES_ecb_encrypt, DES_set_odd_parity (libSceLibreSsl) - the 128-byte DES_key_schedule holds the 8-byte key followed by zeros instead of LibreSSL's precomputed subkeys, so a title reading its contents sees different bytes; DES_ecb_encrypt derives the subkeys through mbedtls on each call. Not compared with the console. Results follow LibreSSL des_key.c and des.c: DES_set_key skips the parity and weak-key checks and returns 0, as it does while DES_check_key is 0 (that variable is not in the PS5 export inventory), a nonzero enc encrypts, and DES_set_odd_parity sets each byte's low bit for odd parity. Null pointers throw where LibreSSL faults

• X509_verify_cert_error_string - no console call is verified. The 64-bit argument, low-32-bit lookup, messages and shared numeric fallback follow LibreSSL 2.5.4, the version identified in published firmware 13.40 measurements. Console modifications and other firmware versions remain unverified. Unknown-code results share an overwritten static buffer and are not safe for concurrent use, as in that release; code 1 and codes above 54 use the numeric fallback.

• CRYPTO_num_locks, CRYPTO_set_locking_callback, CRYPTO_set_add_lock_callback, CRYPTO_THREADID_set_callback, CRYPTO_THREADID_set_numeric (libSceLibreSsl) - the locking, add-lock and thread id callbacks are stored but never called: LibreSSL calls them from CRYPTO_lock, CRYPTO_add_lock and CRYPTO_THREADID_current, which the module does not export, around its own shared state. Nothing is checked on the console. Results follow LibreSSL 2.5.4, the version in the firmware 13.40 measurements: 41 locks, the first non-null thread id callback is kept and later ones return 0, and CRYPTO_THREADID_set_numeric clears the 16-byte {ptr, val} structure; a null structure throws, as LibreSSL writes through it unchecked

• RAND_add, RAND_bytes, RAND_status, RAND_load_file, RAND_file_name, CRYPTO_malloc, CRYPTO_free, CRYPTO_set_mem_functions (libSceLibreSsl) - follow LibreSSL's rand_lib.c, randfile.c and malloc-wrapper.c, which are the same in 2.6.5 (3.4.3 linked); nothing is checked on the console. RAND_bytes reads host entropy and CRYPTO_malloc and CRYPTO_free use the guest heap. CRYPTO_malloc returns null for a size of zero or less, as LibreSSL 2.5.4 to 3.4 do; later versions take a size_t size and call malloc. A null buffer with a positive length throws

• AES_set_encrypt_key, AES_set_decrypt_key, AES_encrypt, AES_decrypt, AES_ecb_encrypt, AES_cbc_encrypt, AES_cfb128_encrypt, AES_ctr128_encrypt (libSceLibreSsl) - follow LibreSSL's aes.h and mode code. Nothing is checked on the console. Key setup follows LibreSSL 2.5.4's aes_core.c, the version the X509_verify_cert_error_string entry names: a null pointer returns -1 and a key length other than 128, 192 or 256 bits returns -2 before the key is written, and only the 44, 52 or 60 words the key length needs are written. The AES_KEY schedule uses that file's generic C layout (big-endian words, rounds 10, 12 or 14). The 2.5.4 amd64 build uses aes-x86_64 instead, which copies the key bytes without swapping, so each word is byte-reversed compared with the C layout (OpenSSL 3.0.13's x86-64 code gives the same schedules byte-reversed); the console's build options are unknown, so a schedule the title reads or fills is unverified. CTR leaves the last keystream block in ecount_buf even at a block boundary. Null pointers in the cipher and mode functions, other rounds values and a CFB or CTR position outside 0-15 throw

• ERR_get_error, ERR_peek_error, ERR_clear_error, ERR_remove_thread_state have no console execution verification. Memory BIO, CMAC, ENGINE, SSL_CTX_ctrl, SSL_CTX_callback_ctrl and SSL_CTX_set_session_id_context failures publish to this queue. The 16-slot calling-thread queue retains 15 codes following LibreSSL err.c and err.h. Firmware 13.42 module comparisons on a PC matched libSceLibreSsl3 queue ordering and overflow for 0-20 publications; whether the two firmware libraries share a queue was not tested. Explicit thread IDs throw because guest thread identity mapping is unverified; null clears the calling thread. File/line metadata is stored by the native producer helper but no guest export exposes it.

• ENGINE_by_id, ENGINE_cleanup, ENGINE_ctrl, ENGINE_ctrl_cmd, ENGINE_finish, ENGINE_free, ENGINE_get_first, ENGINE_get_next, ENGINE_init, ENGINE_load_builtin_engines, ENGINE_load_private_key (libSceLibreSsl) - take the engine list to be always empty, as in LibreSSL 2.5.4: both portable 2.5.4 builds compile out its only built-in engine, padlock, and the module exports no call that adds one. A console build with its own engines is not ruled out; nothing is checked on the console. ENGINE_get_first returns null, an unknown id pushes ENGINE_R_NO_SUCH_ENGINE without the id= data, and a null engine or command name pushes ERR_R_PASSED_NULL_PARAMETER, each with function code 0xfff. A non-null engine throws, as none can exist

• OCSP_check_validity - nothing is checked on the console, and no export produces an ASN1_GENERALIZEDTIME yet. It follows LibreSSL 2.5.4 ocsp_cl.c and a_time_tm.c: only the 15-character YYYYMMDDHHMMSSZ form parses, the type field is ignored, times compare field by field, and each failed check queues one OCSP error. The current time comes from guest time. A null thisupd throws where LibreSSL faults. The time plus or minus nsec or minus maxsec wraps around as in that build, and a result gmtime_s rejects returns 0 without an error, as in the 13.42 module; its console range is unverified

• OCSP_response_status_str, OCSP_cert_status_str and OCSP_crl_reason_str (libSceLibreSsl) - the module's strings are not measured on the console. The tables follow LibreSSL ocsp_prn.c, unchanged from revision 1.8 (2015) to 1.12 (2025), with codes from ocsp.h; the argument is a 64-bit long and every value not in a table returns (UNKNOWN)

• SSL_get_ex_new_index, SSL_CTX_get_ex_new_index, SSL_get_ex_data_X509_STORE_CTX_idx and CRYPTO_cleanup_all_ex_data (libSceLibreSsl) - unverified on a PS5. The stored argl, argp and callbacks are never called, because no export creates an SSL or SSL_CTX and SSL_get_ex_data/SSL_set_ex_data still throw. Index numbering follows LibreSSL 2.5.4's ex_data.c, ssl_lib.c and ssl_cert.c: per class from 0, the verify-callback index allocated once and kept across CRYPTO_cleanup_all_ex_data, which restarts every class at 0.

• EVP digest and HMAC functions (libSceLibreSsl) - follow LibreSSL 2.5.4's digest.c and hmac.c. They and the EVP_MD, EVP_MD_CTX and HMAC_CTX layouts behave the same up to 3.4.1, so this holds for 2.5.4 (the firmware 13.40 measurements) and for 2.7 or later (its SSL_get0_param export). Nothing is checked on the console. sign and verify in the EVP_MD tables are null as RSA_sign and RSA_verify still throw, failures add nothing to the error queue, and a failed allocation leaves the context without a digest, where LibreSSL keeps it. An ENGINE, an EVP_PKEY_CTX, a null context, EVP_DigestInit_ex without a type on a context that has a digest, and an update or final without a digest throw

• EC_GROUP_new_by_curve_name, EC_GROUP_free, EC_GROUP_get_degree, EC_KEY_new, EC_KEY_new_by_curve_name, EC_KEY_free, EC_KEY_set_group, EC_KEY_get0_group, ECDSA_size (libSceLibreSsl) - not checked on the console. They follow LibreSSL 2.5.4's ec and ecs_lib.c over mbedtls, which has 11 of LibreSSL's 90 curves (NIDs 409, 415, 711 to 716, 928, 932, 934). The other 79 throw; other NIDs return null without queuing EC_R_UNKNOWN_GROUP. Keys use the 4.0.0 layout libSceLibreSsl3's EC_KEY_up_ref retains and EC_KEY_new's defaults, but hold no keys; no export uses their form or flags. Setting a key's own group keeps it, where LibreSSL frees it first. Null groups and keys throw where LibreSSL dereferences them

• SSL_CIPHER_get_bits, SSL_CIPHER_get_name and SSL_CIPHER_get_version - the 88-byte guest cipher layout and these calls are not console-verified. They follow LibreSSL 2.5.4 ssl.h and ssl_ciph.c, matching the version in published firmware 13.40 measurements. Console modifications and other firmware layouts remain unverified. Protocol labels use the full 64-bit cipher ID, not the protocol flags; TLS 1.2 ciphers still report TLSv1/SSLv3, as in that release.

• SSL_library_init - returns 1 on every call, following the LibreSSL compatibility contract. Registration has no separate observable state because the replacement does not yet implement SSL contexts or handshakes. Nothing is checked on the console.

• sk_num, sk_value, sk_pop, sk_pop_free (libSceLibreSsl) - the 32-byte _STACK layout (num, data, sorted, num_alloc, comp) and the results follow LibreSSL 2.5.4 stack.h and stack.c, the version identified in published firmware 13.40 measurements; nothing is checked on the console. sk_pop_free releases the element array and the stack with the guest free, as the module would through libc. No export of this module creates a stack yet, so only stacks the caller builds reach them. A null element array that LibreSSL would read through, and a null free function with a non-null element, throw where LibreSSL faults

• RSA_flags, RSA_size (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow LibreSSL 2.5.4 rsa.h, rsa_crpt.c and bn_lib.c, the version in the firmware 13.40 measurements. RSA_size counts the modulus bytes from its top word, as BN_num_bytes, so a zero top word is not skipped. A null method, a null key or modulus, and a positive word count with null words, which LibreSSL dereferences, throw, as do a negative word count and a bit count that overflows int

• RSA_new, RSA_free (libSceLibreSsl) - nothing is checked on the console. They follow LibreSSL 2.5.4 rsa_lib.c and rsa_eay.c: the key comes from the guest malloc with the default method "Eric Young's PKCS#1 RSA" (method flags 0, key flags RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE) and one reference, and RSA_free drops a reference, runs the method's finish and clears and frees each BIGNUM as BN_clear_free does. The method's slots are host functions; its private-key operations, rsa_mod_exp and bn_mod_exp throw, as no export sets a private key yet. With no ENGINE, ex_data or blinding implemented, RSA_free throws for a key holding one, and for a Montgomery context, which this module never caches

• d2i_RSA_PUBKEY (libSceLibreSsl) - nothing is checked on the console. It decodes a SubjectPublicKeyInfo as LibreSSL 2.5.4's x_pubkey.c, rsa_ameth.c, rsa_asn1.c and tasn_dec.c do, without building the X509_PUBKEY and EVP_PKEY they use on the way: the rsaEncryption or rsa OID, any well-formed parameter, the masked BIT STRING and n and e read as unsigned BIGNUMs on a fresh RSA_new key, with the length, tag and header quirks of that decoder. The BER forms it also accepts throw: indefinite lengths, constructed strings and parameters, and a BIT STRING with 32 or more unused bits, whose mask is undefined C. A null input pointer, and a null input with a positive length, throw

• RSA_public_encrypt, RSA_public_decrypt (libSceLibreSsl) - nothing is checked on the console. They call the key method's slots; the default ones follow LibreSSL 2.5.4 rsa_eay.c, rsa_pk1.c, rsa_oaep.c and rsa_none.c: the modulus and exponent limits, encryption with PKCS#1 v1.5, OAEP (SHA-1, empty label) or no padding, decryption checking PKCS#1 v1.5 type 1 or no padding, and -1 for other paddings, without the error codes LibreSSL queues. Random padding comes from host entropy and the arithmetic from mbedtls, whose 8192-bit limit makes a larger modulus throw; the Montgomery context is never cached. RSA_SSLV23_PADDING encryption and RSA_X931_PADDING decryption throw, as do a method with its own bn_mod_exp, a negative BIGNUM and a null key, method or slot

• RSA_verify (libSceLibreSsl) - nothing is checked on the console. It follows LibreSSL 2.5.4 RSA_verify and int_rsa_verify: the method's rsa_verify under RSA_FLAG_SIGN_VER, the signature length, RSA_public_decrypt with PKCS#1 v1.5 padding, the 36-byte NID_md5_sha1 case and the X509_SIG decode with its trailing-data, parameter, object and digest checks, without the error codes LibreSSL queues. OBJ_obj2nid is modelled by the 15 digest objects of that version's object table, so a digest type and an object both outside them, NID_undef included, throw, and objects added with OBJ_create are not seen. The BER forms of the d2i_RSA_PUBKEY entry throw here too, as do a null key, a null method under RSA_FLAG_SIGN_VER, and a null digest or signature that LibreSSL reads

• X509_STORE_CTX_get_error, X509_STORE_CTX_set_error, X509_STORE_CTX_get_error_depth, X509_STORE_CTX_get_current_cert, X509_STORE_CTX_get_chain (libSceLibreSsl) - the 240-byte X509_STORE_CTX layout and the results follow LibreSSL 2.5.4 x509_vfy.h and x509_vfy.c, the version identified in published firmware 13.40 measurements; nothing is checked on the console. No export of this module creates or fills a context yet, so only contexts the caller builds reach them. A null context, which LibreSSL dereferences, throws

• X509_STORE_CTX_get_ex_data, X509_STORE_CTX_get1_chain (libSceLibreSsl) - unverified on a PS5, and no export of this module sets ex_data or builds a chain yet. A chain whose count is negative or above its allocation, or that holds a null certificate, throws before copying; LibreSSL 2.5.4 overruns or dereferences it. Otherwise both follow its x509_vfy.c: entry idx of the ex_data stack as CRYPTO_get_ex_data reads it, and a chain copied as sk_dup copies it, raising each certificate's references (X509 offset 28) by one.

• UI_set_result (libSceLibreSsl) - unverified on a PS5, and no export of this module creates a UI or UI_STRING yet. The "You must type in %d to %d characters" text LibreSSL 2.5.4 attaches to the size errors is not kept, because the error queue holds codes only. A null UI or result, or null boolean characters that must be compared, throws; LibreSSL dereferences them. The rest follows its ui_lib.c over the 40-byte UI and 64-byte UI_STRING of ui_locl.h: a result outside the bounds sets UI_FLAG_REDOABLE and queues UI_R_RESULT_TOO_SMALL or UI_R_RESULT_TOO_LARGE.

• PKCS12_PBE_add, SSL_load_error_strings (libSceLibreSsl) - unverified on a PS5; each returns without an observable effect and queues no error. SSL_load_error_strings builds no string table, because ERR_error_string and ERR_error_string_n throw (ssl_err.c); the tables are needed once a string lookup exists. PKCS12_PBE_add is empty in LibreSSL 2.5.4 (p12_crpt.c).

• EVP_PKEY_type (libSceLibreSsl) - follows the method table of LibreSSL 2.5.4 ameth_lib.c built without GOST and with no engine (every ENGINE_ export throws): RSA (6) and its alias 19 give 6, the DSA types 66, 67, 70, 113 and 116 give 116, DH (28), EC (408), HMAC (855) and CMAC (894) give themselves, and every other type, the GOST types 811, 815, 946 and 947 included, gives 0. These results match firmware 13.42's module run natively on a PC for every type from -1000 to 5000 and the int extremes; nothing is checked on the console

• X509_NAME_get_index_by_NID, X509_NAME_get_text_by_NID - no console call is verified. Only NID_undef, the X.520 (2.5.4.x) attribute types, emailAddress, domainComponent and userId have OID bytes, from LibreSSL 2.5.4's objects.txt. All other NIDs throw, including dynamic objects added by OBJ_create; these functions do not consult the added object table. For an unassigned built-in NID, LibreSSL returns -2 or -1 and queues OBJ_R_UNKNOWN_NID. A lastpos of INT_MAX and a matched len of INT_MIN throw: x509name.c overflows a signed int there.

• EVP_CIPHER_CTX_init, EVP_CIPHER_CTX_new, EVP_CIPHER_CTX_set_padding (libSceLibreSsl) - nothing is checked on the console. The 168-byte EVP_CIPHER_CTX layout and the results follow LibreSSL 2.5.4 evp.h and evp_enc.c, the version in the firmware 13.40 measurements, which also measured EVP_CIPHER_CTX_init clearing 168 bytes. EVP_CIPHER_CTX_new allocates through the guest calloc as the module would through libc. A null context, which LibreSSL dereferences, throws

• SSL_CTX_get_verify_mode, SSL_CTX_get_cert_store, SSL_CTX_set_quiet_shutdown, SSL_CTX_set_default_passwd_cb, SSL_CTX_set_default_passwd_cb_userdata (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow LibreSSL 2.5.4 ssl.h, ssl_locl.h and ssl_lib.c, the version in the firmware 13.40 measurements. No export of this module creates a context yet, so only contexts the caller builds reach them, and no export calls the stored password callback. A null context, and a null internal state in SSL_CTX_set_quiet_shutdown, which LibreSSL dereferences, throw

• SSL_CTX_ctrl, SSL_CTX_callback_ctrl, SSL_CTX_set_msg_callback, SSL_CTX_set_verify, SSL_CTX_set_session_id_context (libSceLibreSsl) - nothing is checked on the console. The internal layout, commands and results follow LibreSSL 2.5.4 ssl_locl.h, ssl_lib.c and s3_lib.c, the version in the firmware 13.40 measurements. Control commands 3, 4, 14, 20, 83, 91, 92, 94 and 118 and callback commands 6 and 7 throw for every input, as they use certificate, session table, DH, ECDH, stack or group state that no export builds yet. Commands outside 2.5.4's switch return 0, as in that release. A null context, a null internal state, a null output for command 82 and a null session ID context with a nonzero length throw

• EVP_CIPHER_block_size (libSceLibreSsl) - nothing is checked on the console. The 88-byte EVP_CIPHER layout and the result follow LibreSSL 2.5.4 evp.h and evp_lib.c, the version in the firmware 13.40 measurements: block_size is returned as stored. A null cipher, which LibreSSL dereferences, throws

• X509_NAME_get_entry, X509_NAME_ENTRY_get_data (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow LibreSSL 2.5.4 x509.h, x509name.c and stack.c, the version in the firmware 13.40 measurements. No export of this module creates a name yet, so only names and entries the caller builds reach them. A positive entry count with a null entry array, which LibreSSL dereferences, throws

• EVP_CIPHER_CTX_cleanup, EVP_CIPHER_CTX_free, EVP_CIPHER_CTX_ctrl (libSceLibreSsl) - nothing is checked on the console. A failure returns 0 without queueing an error code. A context holding an ENGINE throws in EVP_CIPHER_CTX_cleanup instead of releasing it, because no ENGINE function is implemented. Results follow LibreSSL 2.5.4's evp_enc.c with the 88-byte EVP_CIPHER of its evp.h: the cipher's cleanup and ctrl are called through the descriptor, a ctrl result of -1 becomes 0, and the cipher data and the context are cleared and freed through the guest free. A null context and a negative cipher context size, which LibreSSL dereferences or passes to explicit_bzero, throw

• EVP_CipherInit_ex, EVP_EncryptInit_ex, EVP_DecryptInit_ex, EVP_CipherUpdate, EVP_EncryptUpdate, EVP_DecryptUpdate, EVP_CipherFinal_ex, EVP_EncryptFinal_ex, EVP_DecryptFinal_ex (libSceLibreSsl) - nothing is checked on the console, and failures queue no error code. A non-null ENGINE argument throws, because no ENGINE function is implemented; with none registered, the context's ENGINE is null as in LibreSSL. Buffering, padding, IV setup and the custom-cipher path follow LibreSSL 2.5.4's evp_enc.c, and the cipher data comes from the guest malloc. Inputs LibreSSL dereferences or overruns throw: null contexts, lengths and buffers, a cipher without init or do_cipher, a CTR IV longer than 16 bytes, and a context whose buffered byte count or block mask no longer matches its cipher's block size

• EVP_aes_128_cfb8, EVP_aes_192_cfb8, EVP_aes_256_cfb8, EVP_aes_128_ctr, EVP_aes_192_ctr, EVP_aes_256_ctr (libSceLibreSsl) - nothing is checked on the console. The descriptors hold the values of LibreSSL 2.5.4's e_aes.c (NID, block size 1, 16-byte IV, EVP_CIPH_FLAG_FIPS with the mode and the 264-byte ctx_size of its LP64 EVP_AES_KEY), but init and do_cipher are host functions, not the module's. The cipher data holds only the AES_KEY schedule, laid out as the AES entry describes; the block and stream function pointers LibreSSL keeps after it are not stored. CFB8 follows CRYPTO_cfb128_8_encrypt and CTR follows CRYPTO_ctr128_encrypt with a 128-bit big-endian counter, checked against the SP 800-38A vectors. A context without cipher data, null buffers and a CTR position outside 0-15 throw

• EVP_aes_128_gcm, EVP_aes_192_gcm, EVP_aes_256_gcm (libSceLibreSsl) - nothing is checked on the console. The descriptors hold the values of LibreSSL 2.5.4's e_aes.c (NID, 12-byte IV, flags, the 680-byte LP64 ctx_size) with host init, do_cipher, cleanup and ctrl, and the cipher data has the port's own layout, so a title reading it sees different bytes. aes_gcm_ctrl, the TLS record path and gcm128.c are followed; EVP_CTRL_GCM_SET_IV_FIXED fills the IV from host entropy. A key length the AES setup rejects throws where LibreSSL keeps a stale schedule, as do missing cipher data, null buffers, EVP_CTRL_GCM_IV_GEN with an IV under 8 bytes and an invocation field longer than the IV

• EVP_cleanup (libSceLibreSsl) - nothing is checked on the console. LibreSSL 2.5.4's names.c empties the cipher and digest name tables, the PBE table, a deferred OBJ_cleanup and the signature-ID tables. Nothing in this module can fill them yet, because OPENSSL_add_all_algorithms_noconf, CONF_modules_load_file and OPENSSL_load_builtin_modules are not implemented, SSL_library_init returns 1 without adding a cipher or digest, PKCS12_PBE_add is empty as in LibreSSL 2.5.4, and no cipher or digest can be registered under an OBJ_create NID to defer OBJ_cleanup, so EVP_cleanup returns without doing anything; it must clear those tables once one of them fills them. The static cipher descriptors stay valid afterwards, as in LibreSSL

• OCSP_response_status, OCSP_single_get0_status (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow LibreSSL 2.5.4 ocsp.h, ocsp_cl.c and a_enum.c, the version in the firmware 13.40 measurements. No export of this module decodes a response yet, so only structures the caller builds reach them. Enumerated values follow ASN1_ENUMERATED_get (0 for a null value or null data, -1 for another type or more than 8 bytes), truncated to int. A null response, a null certificate status, and a null revocation record when its time or reason is requested, which LibreSSL dereferences, throw

• SSL_get_session, SSL_get_current_cipher, SSL_get_certificate, SSL_get_privatekey (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow LibreSSL 2.5.4 ssl.h, ssl_locl.h, ssl_lib.c and ssl_sess.c, the version in the firmware 13.40 measurements. No export of this module creates a connection yet, so only connections the caller builds reach them. A null connection, and a certificate set without a current key, which LibreSSL dereferences, throw

• OCSP_resp_count and OCSP_resp_get0 - not verified on the console. The signatures, the guest OCSP_BASICRESP, OCSP_RESPDATA and stack layouts and the results follow LibreSSL 2.5.4's ocsp.h and ocsp_cl.c and stack.h and stack.c, the version in published firmware 13.40 measurements. Console modifications and other firmware layouts remain unverified. A null response data pointer, and a null entry array with an index in range, throw where that release dereferences them.

• X509_get_issuer_name, X509_get_subject_name, X509_get_serialNumber (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow LibreSSL 2.5.4 x509.h and x509_cmp.c, the version in the firmware 13.40 measurements. No export of this module creates a certificate yet, so only certificates the caller builds reach them. A null certificate or certificate info, which LibreSSL dereferences, throws

• UI_get0_user_data, UI_get_string_type, UI_get_input_flags (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow LibreSSL 2.5.4 ui.h, ui_locl.h and ui_lib.c, the version in the firmware 13.40 measurements. No export of this module creates a UI or a UI string yet, so only ones the caller builds reach them. A null UI in UI_get0_user_data, which LibreSSL dereferences, throws

• SSL_CTX_set_info_callback, SSL_CTX_sess_set_new_cb, SSL_CTX_set_cert_verify_callback, SSL_CTX_set_client_cert_cb, SSL_CTX_set_next_proto_select_cb, SSL_CTX_set_alpn_select_cb (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow LibreSSL 2.5.4 ssl.h, ssl_locl.h, ssl_lib.c and ssl_sess.c, the version in the firmware 13.40 measurements. The callbacks and their arguments are only stored in ssl_ctx_internal_st; no export of this module creates a context or calls them yet, so only contexts the caller builds reach them. A null context or internal state, which LibreSSL dereferences, throws

Functional

• Error publication is integrated with memory BIO and CMAC cipher errors. The digest, low-level AES, allocator/RAND, DES, BIGNUM and EVP/HMAC implementations require separate error-publication integration. LibreSslPutError_nid_no_patch(int library, int function, int reason, const char* file, int line) has C linkage and the native host calling convention, accepts upstream numeric fields and publishes to the calling thread's queue. Three-argument source calls default file/line to null/zero. It stores file/line without taking ownership; producers must supply a filename with static lifetime. Guest ERR entry points use APS5_VABI. Unsupported producer exports continue throwing; the local tests publish through this helper.

• CMAC and AES-CBC descriptors have no PS5 equivalence verification. Signatures, the 88-byte cipher method and 168-byte cipher context follow LibreSSL 3.4.1; the console version remains unknown. AES cipher data uses Mbed TLS storage instead of LibreSSL's private key schedule. Guest-defined cipher methods run through guest-ABI callbacks. ENGINE-backed methods throw. Null contexts, null nonempty update buffers, null initialized-final length pointers, negative cipher dimensions and missing required callbacks throw where upstream dereferences unchecked pointers. Error metadata names host source locations.

• BN_new, BN_free, BN_CTX_new, BN_CTX_free, BN_CTX_start, BN_CTX_end, BN_bin2bn, BN_bn2bin, BN_hex2bn, BN_num_bits, BN_set_word, BN_add_word, BN_sub_word, BN_mul and BN_mod_inverse (libSceLibreSsl) - the BIGNUM layout (24 bytes, 64-bit limbs, top, dmax, neg, flags) and the documented semantics follow the public LibreSSL 2.x API; the module's LibreSSL version is unknown and nothing is checked on the console. BN_CTX is opaque and only counts BN_CTX_start and BN_CTX_end, since BN_CTX_get is not implemented, and BN_mul and BN_mod_inverse ignore it. BN_mod_inverse treats a negative modulus by its magnitude and returns 0 for a modulus of 1, which is not compared with LibreSSL. BN_hex2bn rejects a string without a hex digit, such as -, which older LibreSSL versions accept. Null BIGNUM pointers, which LibreSSL does not check, throw. BN_print still throws because it needs a BIO.

• Memory BIOs have no console execution verification. Firmware 13.42 module comparisons on a PC cover 1,048 sequences with stand-in allocators, including null/zero writes, callbacks and growth wiping. They support dispatching nonnegative writes to the method even with null source or zero length; LibreSSL 3.4.1 instead guards those calls. Negative public lengths retain that source's early return because the module report did not measure them. The 104-byte BIO, 80-byte method and 24-byte buffer use LP64 layouts. Allocator padding is zeroed rather than retaining the module allocator's fill. Other firmware and console imports remain unverified. CRYPTO ex-data, file, socket and SSL BIOs remain unsupported.

• Memory BIO unchecked inputs throw for null method or raw line-buffer pointers, negative raw method write sizes, an overflowing raw line-buffer size, inconsistent read-only buffer lengths, and memory write lengths that overflow size_t. Upstream does not validate these inputs. An unrepresentable string length throws instead of narrowing into an unchecked write.

• ERR string formatting is not console-verified. Firmware 13.42 modules run natively on a PC produced numeric-only strings before and after their loaders. Formatting, truncation and caller/static buffers matched with a standard-C snprintf stand-in; other firmware, console imports and concurrent static-buffer use remain unverified. Loading and freeing do not enable named strings or alter queued errors. Historical tables are generated only as regression-test inputs.

• ASN1_INTEGER_get has no console verification for nonpositive lengths. It follows LibreSSL 2.5.4: valid integer types return zero without reading data when length is zero or negative; invalid types return -1 first. Later LibreSSL versions reject negative lengths through ASN1_INTEGER_get_int64; that later contract is not used for this library.

• ASN1_INTEGER_get and ASN1_STRING_data/length/type/to_UTF8 are unverified on PS5. They follow LibreSSL 2.5.4, reported for firmware 13.40 in discussion #8981. These throw where 2.5.4 has undefined behaviour: a null structure passed to ASN1_STRING_data, ASN1_STRING_length or ASN1_STRING_type, a null conversion output, missing nonempty data, oversized converted output and unrepresentable signed integers. As in 2.5.4, ASN1_INTEGER_get(NULL) returns 0 and ASN1_STRING_to_UTF8 returns -1 for a null string, leaving the output alone; malformed input and allocation failure also return -1 and queue the ASN.1 error (129, 133, 134, 124, or 65, twice for a UTF8String copy). Conversion buffers come from the guest libc allocator.

• SSL_alert_desc_string_long - Console execution and equivalence across other firmware revisions remain unverified. BunnyFl reports identical strings for 3,841 inputs across three runs against the firmware 13.42 module executed natively on a PC (comparison); this is not a console run. The mapping follows LibreSSL 2.5.4.

• i2t_ASN1_OBJECT and the object table are unverified on PS5. The 956 objects and their search order are generated from LibreSSL 2.5.4 objects.txt and obj_mac.num with its objects.pl and obj_dat.pl, the version string the module holds; LibreSSL 2.7 adds NIDs 956-967, so its jurisdictionLocalityName, jurisdictionStateOrProvinceName and jurisdictionCountryName OIDs print by name there and numerically here. OBJ_obj2txt follows 2.5.4 obj_dat.c, and looks up objects added by OBJ_create before the table, as OBJ_obj2nid does. A negative buffer length, and a null buffer with a positive length, throw instead of being passed on as a size_t

• OBJ_create and OBJ_cleanup are unverified on PS5. They follow LibreSSL 2.5.4 obj_dat.c and the a2d_ASN1_OBJECT parser of a_object.c, with its error codes and arcs past 64 bits: each object takes the next NID from 956, the latest object with an encoding wins, and OBJ_cleanup drops them all without resetting the NID counter. Added objects live in host memory, so an allocation failure throws instead of queuing ERR_R_MALLOC_FAILURE. OBJ_cleanup is never deferred: check_defer only fires for ciphers or digests with an added NID, which no export registers. Name lookups (OBJ_sn2nid, OBJ_ln2nid) of added objects are not kept, as no export reads them yet. A null OID text throws where LibreSSL faults

• X509_STORE_new, X509_STORE_free and X509_STORE_set_flags are unverified on PS5. The 136-byte store, 64-byte verify parameters, 56-byte parameter identity, 32-byte stacks and the results follow LibreSSL 2.5.4 x509_lu.c and x509_vpm.c, the version in firmware 13.40 measurements. No export adds a certificate, CRL or policy object, so X509_STORE_free throws instead of freeing one and the object cache's comparator throws. A null store or verify parameters, a null verify parameter identity, and a null element array behind a positive count, throw where LibreSSL faults

• X509_VERIFY_PARAM_set_hostflags and X509_VERIFY_PARAM_set1_ip_asc are unverified on PS5. They follow LibreSSL 2.5.4 x509_vpm.c and the a2i_ipadd parser of its v3_utl.c, unchanged in 2.7, the first release whose symbols include X509_VERIFY_PARAM_set1_host, which the module also exports; IPv4 parts are read with the guest sscanf as the module would. LibreSSL 2.8 appends a poisoned field to the parameter identity, which these layouts lack. A null address text, and null verify parameters or identity once an address is accepted, throw where LibreSSL faults

• X509_LOOKUP_file and X509_STORE_add_lookup are unverified on PS5. The 80-byte method, the 32-byte lookup, the stack growth and the results follow LibreSSL 2.5.4 by_file.c, x509_lu.c and stack.c, unchanged in 2.7. The file method's ctrl, which loads PEM certificates and CRLs, throws: there is no certificate model. Callbacks of a guest-supplied method (new_item, shutdown, free) throw instead of being called, and a null store, method or listed lookup throws where LibreSSL faults

• X509_VERIFY_PARAM_set1_host is unverified on PS5. It follows int_x509_param_set_hosts of LibreSSL 2.7, the first release with this export, and copies the name with the guest strndup. LibreSSL 2.8 also marks the parameters as poisoned when the call fails, through a field the 2.5.4 to 2.7 layout lacks, so a failed call leaves no mark. Null verify parameters or identity throw where LibreSSL faults

• X509_EXTENSION_get_critical, X509_EXTENSION_get_data and X509_EXTENSION_get_object - signatures, null-input results, borrowed pointers and the signed critical > 0 rule follow LibreSSL 2.5.4 x509_v3.c. The 24-byte LP64 extension layout (object at 0, 32-bit critical at 8, data at 16) follows x509.h. Published firmware 13.40 measurements identify libSceLibreSsl as 2.5.4, but these getters and this layout have not been independently checked on a console. The getters do not validate or decode the referenced ASN.1 objects.