AnyPS5/docs/dev/debt/libSceLibreSsl.md

libSceLibreSsl technical debt

Functional

• SSL_select_next_proto leaves empty lists, zero-length names and truncated encodings unsupported and throws instead of following the reported firmware behavior. Null outputs also throw; their firmware behavior is unmeasured. Independent firmware 13.42 evidence reports host-PC execution of libSceLibreSsl.sprx at 0xda6d0, with matching six-argument valid-list selection, status, borrowed pointer and length. That report also observes negotiation of zero-length entries, unchecked fallback lengths and an empty-supported-list read; these paths remain unsupported here. Null outputs and console-hardware behavior remain unmeasured. The author-sourced signature and valid-list contract follow LibreSSL 3.4.1.

Unknown function info

• libSceLibreSsl pending exports - 318 named callable exports are listed in the PS5 3.20 export table and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through NotImplemented_nid_no_patch.

• MD4, MD5, SHA1, SHA224, SHA256, SHA384 and SHA512 Init/Update/Final and SHA256 (libSceLibreSsl) - signatures and context layouts follow the LibreSSL headers, and buffering and Final follow its sources; nothing is checked on the console. Null contexts, null input with a nonzero length, null digest buffers in the 32-bit Final functions and a buffered byte count that is not below the block size, which LibreSSL does not check, throw

• DES_set_key, DES_ecb_encrypt, DES_set_odd_parity (libSceLibreSsl) - the 128-byte DES_key_schedule holds the 8-byte key followed by zeros instead of LibreSSL's precomputed subkeys, so a title reading its contents sees different bytes; DES_ecb_encrypt derives the subkeys through mbedtls on each call. Not compared with the console. Results follow LibreSSL des_key.c and des.c: DES_set_key skips the parity and weak-key checks and returns 0, as it does while DES_check_key is 0 (that variable is not in the PS5 export inventory), a nonzero enc encrypts, and DES_set_odd_parity sets each byte's low bit for odd parity. Null pointers throw where LibreSSL faults

• X509_verify_cert_error_string - no console call is verified. The 64-bit argument, low-32-bit lookup, messages and shared numeric fallback follow LibreSSL 2.5.4, the version identified in published firmware 13.40 measurements. Console modifications and other firmware versions remain unverified. Unknown-code results share an overwritten static buffer and are not safe for concurrent use, as in that release; code 1 and codes above 54 use the numeric fallback.

• CRYPTO_num_locks, CRYPTO_set_locking_callback, CRYPTO_set_add_lock_callback, CRYPTO_THREADID_set_callback, CRYPTO_THREADID_set_numeric (libSceLibreSsl) - the locking, add-lock and thread id callbacks are stored but never called: LibreSSL calls them from CRYPTO_lock, CRYPTO_add_lock and CRYPTO_THREADID_current, which the module does not export, around its own shared state. Nothing is checked on the console. Results follow LibreSSL 2.5.4, the version in the firmware 13.40 measurements: 41 locks, the first non-null thread id callback is kept and later ones return 0, and CRYPTO_THREADID_set_numeric clears the 16-byte {ptr, val} structure; a null structure throws, as LibreSSL writes through it unchecked

• RAND_add, RAND_bytes, RAND_status, RAND_load_file, RAND_file_name, CRYPTO_malloc, CRYPTO_free, CRYPTO_set_mem_functions (libSceLibreSsl) - follow LibreSSL's rand_lib.c, randfile.c and malloc-wrapper.c, which are the same in 2.6.5 (3.4.3 linked); nothing is checked on the console. RAND_bytes reads host entropy and CRYPTO_malloc and CRYPTO_free use the guest heap. CRYPTO_malloc returns null for a size of zero or less, as LibreSSL 2.5.4 to 3.4 do; later versions take a size_t size and call malloc. A null buffer with a positive length throws

• AES_set_encrypt_key, AES_set_decrypt_key, AES_encrypt, AES_decrypt, AES_ecb_encrypt, AES_cbc_encrypt, AES_cfb128_encrypt, AES_ctr128_encrypt (libSceLibreSsl) - follow LibreSSL's aes.h and mode code. Nothing is checked on the console. Key setup follows LibreSSL 2.5.4's aes_core.c, the version the X509_verify_cert_error_string entry names: a null pointer returns -1 and a key length other than 128, 192 or 256 bits returns -2 before the key is written, and only the 44, 52 or 60 words the key length needs are written. The AES_KEY schedule uses that file's generic C layout (big-endian words, rounds 10, 12 or 14). The 2.5.4 amd64 build uses aes-x86_64 instead, which copies the key bytes without swapping, so each word is byte-reversed compared with the C layout (OpenSSL 3.0.13's x86-64 code gives the same schedules byte-reversed); the console's build options are unknown, so a schedule the title reads or fills is unverified. CTR leaves the last keystream block in ecount_buf even at a block boundary. Null pointers in the cipher and mode functions, other rounds values and a CFB or CTR position outside 0-15 throw

• ERR_get_error, ERR_peek_error, ERR_clear_error, ERR_remove_thread_state (libSceLibreSsl) - no export of this library adds an error yet, so the queue stays empty for guest code. The per-thread queue of 16 slots holding 15 codes, its order and the ERR_PACK layout follow LibreSSL's err.c and err.h; the module's LibreSSL version is unknown and nothing is checked on the console. The queue keeps no file, line or data, as no export reads them. ERR_remove_thread_state with a thread id throws: that version asserts a null id, while older versions remove the state of the thread the id names

• OCSP_response_status_str, OCSP_cert_status_str and OCSP_crl_reason_str (libSceLibreSsl) - the module's strings are not measured on the console. The tables follow LibreSSL ocsp_prn.c, unchanged from revision 1.8 (2015) to 1.12 (2025), with codes from ocsp.h; the argument is a 64-bit long and every value not in a table returns (UNKNOWN)

• SSL_CIPHER_get_bits, SSL_CIPHER_get_name and SSL_CIPHER_get_version - the 88-byte guest cipher layout and these calls are not console-verified. They follow LibreSSL 2.5.4 ssl.h and ssl_ciph.c, matching the version in published firmware 13.40 measurements. Console modifications and other firmware layouts remain unverified. Protocol labels use the full 64-bit cipher ID, not the protocol flags; TLS 1.2 ciphers still report TLSv1/SSLv3, as in that release.

• sk_num, sk_value, sk_pop, sk_pop_free (libSceLibreSsl) - the 32-byte _STACK layout (num, data, sorted, num_alloc, comp) and the results follow LibreSSL 2.5.4 stack.h and stack.c, the version identified in published firmware 13.40 measurements; nothing is checked on the console. sk_pop_free releases the element array and the stack with the guest free, as the module would through libc. No export of this module creates a stack yet, so only stacks the caller builds reach them. A null element array that LibreSSL would read through, and a null free function with a non-null element, throw where LibreSSL faults

• RSA_flags, RSA_size (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow LibreSSL 2.5.4 rsa.h, rsa_crpt.c and bn_lib.c, the version in the firmware 13.40 measurements. No export of this module creates a key yet, so only keys the caller builds reach them. RSA_size counts the modulus bytes from its top word, as BN_num_bytes, so a zero top word is not skipped. A null method, a null key or modulus, and a positive word count with null words, which LibreSSL dereferences, throw, as do a negative word count and a bit count that overflows int

• EVP_PKEY_type (libSceLibreSsl) - follows the method table of LibreSSL 2.5.4 ameth_lib.c built without GOST and with no engine (every ENGINE_ export throws): RSA (6) and its alias 19 give 6, the DSA types 66, 67, 70, 113 and 116 give 116, DH (28), EC (408), HMAC (855) and CMAC (894) give themselves, and every other type, the GOST types 811, 815, 946 and 947 included, gives 0. These results match firmware 13.42's module run natively on a PC for every type from -1000 to 5000 and the int extremes; nothing is checked on the console

Functional

• ASN1_INTEGER_get has no console verification for nonpositive lengths. It follows LibreSSL 2.5.4: valid integer types return zero without reading data when length is zero or negative; invalid types return -1 first. Later LibreSSL versions reject negative lengths through ASN1_INTEGER_get_int64; that later contract is not used for this library.

• ASN1_INTEGER_get and ASN1_STRING_data/length/type/to_UTF8 are unverified on PS5. They follow LibreSSL 2.5.4, reported for firmware 13.40 in discussion #8981. These throw where 2.5.4 has undefined behaviour: a null structure passed to ASN1_STRING_data, ASN1_STRING_length or ASN1_STRING_type, a null conversion output, missing nonempty data, oversized converted output and unrepresentable signed integers. As in 2.5.4, ASN1_INTEGER_get(NULL) returns 0 and ASN1_STRING_to_UTF8 returns -1 for a null string, leaving the output alone; malformed input and allocation failure also return -1 and queue the ASN.1 error (129, 133, 134, 124, or 65, twice for a UTF8String copy). Conversion buffers come from the guest libc allocator.

• SSL_alert_desc_string_long - Console execution and equivalence across other firmware revisions remain unverified. BunnyFl reports identical strings for 3,841 inputs across three runs against the firmware 13.42 module executed natively on a PC (comparison); this is not a console run. The mapping follows LibreSSL 2.5.4.