AnyPS5/docs/dev/debt/libSceMbus.md

libSceMbus technical debt

Silent stubs

• libSceMbus implements only the no-device path: initialization and termination succeed, no device events are reported, device queries return no entries and sceDeviceServiceGetGeneration always returns 0, as the device set never changes. The generation a console starts at is unmeasured; SharpProspero documents int sceDeviceServiceGetGeneration() as a counter that advances when the device set changes

Unknown function info

• sceMbusGetCurrentChatBalanceId, sceMbusGetInitialUser, sceMbusGetSimulatedBusUsableStatusByBusType2, sceMbusSetChatBalance, sceMbusSetCronosOutputMode, sceMbusSetCronosPrimaryUser, sceMbusSetHmd2SocialScreenAudioMode, sceMbusSetVibrationTriggerEffectWeakWhileEmbeddedMicInUse, sceMbusSetVolumeDownForDiscPlayerFG, sceMbusStartAudioOutScreenShare and sceMbusStopAudioOutScreenShare have unknown signatures and behaviour. The parameterless int declarations are import-resolution placeholders, not confirmed ABI signatures, and every call throws through NotImplemented_nid_no_patch. Only the names and NIDs are established by the 13.60 export inventory; not measured on a console.

• sceDeviceServiceQueryDeviceInfo_: the 112-byte device-info layout and the third argument's meaning remain unresolved. The second argument is a six-byte HID usage filter pointer, not an integer. Initialization takes an optional 16-byte parameter structure with an optional thread configuration; custom scheduling throws because the host has no event worker. sceDeviceServiceGetEventState takes a clear flag, not a device type.

• sceMbusDebugGetStringToShow (logical libSceMbusDebug, NID k6Ki9MjO9sI) - signature and behavior are unknown. This parameterless int declaration is an import placeholder, not a verified ABI prototype; every call throws through NotImplemented_nid_no_patch. The binding is in the 13.60 inventory.

• sceMbus remaining declarations: SetDeviceFunctionState takes a 64-bit device identifier and a 180-byte aggregate by value on the stack. Its service-side fields and source alignment remain unresolved; the declaration preserves the observed stack ABI with opaque storage. AcquireControlList and Term return constants without reading incoming arguments, so their original parameter lists cannot be established from the callees.

• sceMbusAddHandleByDeviceId: the six-argument ABI is confirmed, including the 64-bit device ID. The meanings of the last three 32-bit fields require the device-service backend.

• sceMbus control and handle registration: argument positions and transmitted widths are recovered for control acquisition, handle registration, process attachment, user binding and device-ID conversion. Several scalar field meanings still depend on the service protocol; the 64-bit control value and unnamed registration fields must not be interpreted as pointers. AcquireControlList returns a constant error without reading its incoming arguments, so its source signature remains unresolved.

• sceMbus debug process and device queries: process information is transmitted as 16 bytes, startup input/output as eight bytes, control status as 24 bytes, internal information as 2832 bytes and priority information as 3088 bytes. Device enumeration writes a 32-bit count followed by 396-byte entries. These pointee fields and the semantics of unnamed process flags remain unresolved; declarations use distinct incomplete types instead of guessing their fields.

• sceMbus event subscriptions: the subscription transports two 32-bit and two 64-bit fields whose service-side meanings remain unresolved. EventCreate uses 80-byte queue records and copies a 16-byte callback table; event fields still require the dispatch path; the overflow callback takes an event handle and user data, and the event callback additionally takes a pointer to the queued event. EventCallbackFuncsInit has no defined return value and its recovered behavior is to clear memory. The second argument is treated here as a byte count, but the source analysis in merged PR #9137 does not record firmware, function offset or instructions establishing whether the native routine clamps it to the 16-byte callback table; this must be verified before claiming full parity. A null callback pointer with a nonzero size is not validated and is not measured on a console. Eight dump/BGM wrappers have confirmed zero-argument ABIs. EventBusStatusChangeUnsubscribe ignores its first incoming argument and consumes a 32-bit second argument; its first parameter type remains unresolved.

• sceMbus device and driver payloads: device-info records occupy 256 bytes, descriptions 264 bytes, simulated-handle status and Spark state 16 bytes each. Their service-side fields remain unresolved. Driver registration copies four callback pointers; driver-event notification transports two 64-bit values without dereferencing them. Init, IsBgmProhibited, ReenableBgmForShellUi and RemoveCameraAppModuleFocus consume no incoming arguments.

• sceMbus settings: USB power-list entries occupy 12 bytes, with an 8-bit count limited to 100; their fields remain unresolved. Several routing, scratch-data and proxy scalar meanings still require the service handler. Start/StopAudioOutAuxBroadcast and StopAudioOutSharePlay have confirmed zero-argument ABIs.

• sceMbusGetDeviceInfoByCondition_: its first parameter points to a 256-byte query condition; the second is a 32-bit scalar. Two optional 32-bit outputs and the sized 256-byte record array are confirmed, while condition fields and output meanings remain unresolved.

• sceMbusGetDeviceInfoByConditionForDeviceService: assembly and its DeviceService caller confirm five register arguments followed by a 256-byte condition passed by value on the stack. The condition keeps opaque storage because its service-side fields remain unresolved; byte 228 contains the 16-bit device class. Output records occupy 112 bytes. The two optional outputs are 32-bit values whose meanings remain unresolved.

Additional callable exports

• Additional callable exports - 4 entries observed in a 3.20-labelled image and a later 13.60-labelled image are import-resolution declarations only. Neither image label authenticates a retail firmware version. Parameter lists, return types and behavior are unverified; parameterless int declarations are placeholders, not verified ABI contracts. Every entry throws through NotImplemented_nid_no_patch. Unidentified names use literal NID aliases. No runtime functionality is implemented. Identified candidate names match their NIDs in the public symbol database or supplemental catalog.

Version-pinned selected ELF export records list every NID below with its image label, decoded export module and library, raw qualified symbol, ELF function type, value and size for each inspected version-labelled image. The extract SHA-256 is 02ab27f12bcd0cc9fa03fa33f55fc201110f0d54a86bbbaa093d55d0a8cf262d; its full-module sorted-function-NID digests and raw module-parameter words permit independent comparison. This is an analyst-produced metadata record, not independent authentication of the original images or proof of prototypes or behavior.

Name	NID
Unknown	0mRAu1IWNEA
Unknown	2qdZlkIIFDU
Unknown	RGJ3Rebmm2w
Unknown	edYHYROxzx4