AnyPS5/docs/dev/debt/libSceHttp2.md

libSceHttp2 technical debt

Silent stubs

• sceHttp2RedirectCacheFlush - returns 0 for any argument without checking it, as the 13.42 module does (#10536); automatic redirects throw, so there is no redirect cache to flush

Unknown function info

• Additional HTTP2 exports - these name/NID pairs are present in the 13.60 export inventory. Parameter lists, return types and behavior are unverified. Parameterless int declarations are import-resolution placeholders, not verified ABI prototypes; every entry throws through NotImplemented_nid_no_patch. No runtime functionality is implemented.

Name	NID
sceHttp2GetAllTrailingHeaders	CjxqMyx2-pU
sceHttp2SetProxyWithURL	fkKvmzFNBe8
sceHttp2SetRequestServerName	zx9s1Lk+O90
sceHttp2SetStripGZIPHeadersEnabled	mMWZm0+7XHM
sceHttp2WebSocketClose	v2hFBiyS13w
sceHttp2WebSocketSendDataMessage	D1IAo-CNswA
sceHttp2WebSocketSendTextMessage	jSHMX1oSE+E
sceHttp2WebSocketSetCloseTimeout	4PUc7B6Zr+c

• sceHttp2DeleteCookieBox (libSceHttp2) - imported by PPSA35943's Unity player. The (int cookieBoxId) signature follows SharpProspero. A box sceHttp2CreateCookieBox returned is discarded; an unknown or already deleted id returns the library's invalid-id error (0x817B1100), as prosper does; not measured on a console

• libSceHttp2 cookie boxes (libSceHttp2) - sceHttp2CreateCookieBox takes a machine-sized pool size and requires at least 64 KiB. On 13.42 the pool is rounded up to 16 KiB (wrapping to 0 for SIZE_MAX) and mapped with sceKernelMapNamedFlexibleMemory, whose error is returned unchanged; the host maps it the same way under an assumed name, but does not reproduce native cookie-heap bookkeeping, identifier ranges or retained request references. Its delete signature and invalid-ID error are confirmed. sceHttp2SetRequestNoContentLength takes only the request id. sceHttp2CookieFlush empties a cookie box and answers 0 for any other id. Nonzero cookie-box binding by sceHttp2SetCookieBox throws

• libSceHttp2 cookie store (libSceHttp2) - behavior follows a run of GuestHttp2Cookies.cpp's sequence against 13.42's libSceHttp2.sprx (#10534). Not reproduced: the 0x817B1076 stack check below 0x1FD0 bytes of stack, and the pool size is not enforced. Assumed, not measured on libSceHttp2: the default total limit of 3000 with the 10 oldest dropped past it, and the NUL, space, NUL written after the header (both libSceHttp's), which of no match and null cookie/required is checked first, public-suffix rules for Domain, and dates beyond the tested ones. Equal-length paths come out with the first stored last, a rule inferred from the runs

• libSceHttp2 pending exports - 5 named callable exports were identified in the PS5 3.20 export table and cross-checked against firmware 13.60. Signatures and behavior remain unverified; declarations use the unknown-signature convention and throw through NotImplemented_nid_no_patch. Evidence: 3.20 export list.

Functional

• Default TLS trust (libSceHttp2) - HTTPS connections also trust the system CA list, /<sandbox word>/common/cert/CA_LIST.cer, served by libkernel from the host trust store, after the title's own libSceSsl certificates. RetroArch (PPSA99169, updater), PS5LM (PPSA99575) and Porpoise (PPSA99764) send version-3 requests to public https:// servers with no loaded certificate, verify callback or verification option, which pass the known-CA check only if the console trusts public roots by default. That the console's roots are exactly this file is not measured

• libSceHttp2 transport - only synchronous HTTPS requests with version 3 and ALPN h2 are supported. HTTP/1.x, cleartext HTTP/2, negotiation fallback, connection reuse, multiplexing across requests, CONNECT, response trailers, automatic redirects and authentication challenges throw. Version values, method strings, header overwrite/append modes, status/read/content-length signatures and timeout units follow SharpProspero; wire framing and negotiation follow RFC 9113 sections 3, 5, 6 and 8. prosper instead records the method argument as an integer; the string signature follows SharpProspero. These are public compatibility contracts, not console measurements.

• libSceHttp2 error paths - these throw, as their console codes are not implemented: lookup failures, expired deadlines, other sceSslConnect results, cancellation, protocol failures, malformed inputs, concurrent calls on one request and exhausted connection slots. A PS5 payload with loopback TLS servers measured the handshake failures sceHttp2SendRequest returns as sceSslConnect reports them, which the transport passes through: an untrusted certificate 0x8095F00C, a host the certificate does not name 0x8095F00B, an expired certificate with 0x8 enabled 0x8095F00D, a fatal alert 0x8095F010 and a peer that closes during the handshake 0x8095170D, all of which libSceSsl reports the same on the host. The console also returned 0x80410136 for a peer that resets during the handshake and 0x80951D78 for a reply that is not TLS; the transport would pass both through, but the host libSceSsl reports the reset as 0x8095170D and throws for the non-TLS reply, so neither is reachable yet. After a failed send sceHttp2GetStatusCode returns 0 and stores 0, the content length and read calls return 0x817B1065, and another send returns the same error.

• libSceHttp2 connections - socket connect errors propagate the libSceNet result, following the module-analysis report in prosper #2894; the report does not establish every exported error path. A request uses one connection; a context's concurrency cap counts connections until EOF, failure or deletion. Native pooling, scheduling, validation order and teardown semantics remain unverified. DNS uses two host workers and a queue of eight; cancellation/deadlines abandon the caller's wait, not libc's lookup. Library unload can wait for a host lookup to return.

• libSceHttp2 TLS settings - minimum-version selection, nonnull SSL callbacks and flags outside 0x3d throw. Supported certificate-check bits follow SharpProspero and use libSceSsl's TLS 1.2 backend and CA context; native defaults and error translation are unverified. Settings on object kinds other than templates/requests throw, except for the request options below; native object-kind restrictions are otherwise unverified. Settings become immutable when transport is created. Zero timeout values, nonzero resolve retries, gzip inflation and connection-slot wait timeouts throw. Host HTTP allocations are not charged to the context pool; sceHttp2GetMemoryPoolStats throws for live contexts instead of reporting zero usage.

• libSceHttp2 request options - extends the TLS settings entry: the auth and redirect flags, headers and the auth-info and pre-send callbacks live in Http2::Settings, are copied into each new request and become immutable once transport exists; the getters still read them then. Accepted kinds, defaults, copying, header modes, error codes and their order follow the 13.42 module run in an emulator (#10536), not a console. A null out-pointer to sceHttp2GetAuthEnabled is written through on that module; here it throws. The pre-send callback type is unknown. The transport never calls either callback, and the auth cache flush only validates the context

• sceHttp2GetAllResponseHeaders throws: the serialization, size and lifetime of a decoded HTTP/2 header block have not been established. Status and Content-Length fields are decoded; absent Content-Length reports NotFound, following SharpProspero.

• libSceHttp2 asynchronous requests - send/read submission and sceHttp2WaitAsync throw. The previous offline implementation queued a fabricated network failure and used event type zero; public sources do not establish the completion event types, wait timeout updates, cancellation results or ownership of async buffers. PPSA17221's kqueue layout and PPSA15508's 24-byte wait result establish caller ABI only. No completion or equeue event is manufactured.

• WebSocket ping settings: both setters take a 32-bit request ID and a 32-bit interval/timeout in microseconds, confirmed by the timer consumer and its clock conversion. The protected implementations remain unchanged.

• libSceHttp2 automatic proxy configuration - flags 0 and 1 both use direct connections, matching libSceNetCtl, which reports proxy configuration off, an empty server and port zero. Other flag values throw. This is the host configuration policy, not a console measurement of proxy discovery; PAC/WPAD and configured proxies remain unsupported. The boolean argument and acceptance of 1 by callers are evidenced by OliSe Player and RetroArch; call sites do not establish library behavior.

• libSceHttp2 default trust - HTTPS currently uses only authorities explicitly loaded into the caller's libSceSsl context; a fresh context cannot validate public servers. Verification remains enabled. Loading host roots is left to the shared per-connection SSL work in #11134 and the stacked HTTP2 follow-up #11145, rather than adding a second trust-store implementation here. The exact console root set, trust updates and pool accounting remain unverified. This transport alone does not enable stock HTTPS callers that load no roots.