AnyPS5/docs/dev/debt/libSceNet.md

libSceNet technical debt

Silent stubs

• sceNetShowRouteWithMemory (libSceNet) - validates memory pool ID and returns success without printing anything: the (poolId) signature and pool validation follow shadPS4 and sceNetShowNetstatWithMemory. What the console prints and where is unverified
• sceNetShowIfconfig, sceNetShowNetstat return the native not-initialized error and set errno before initialization. Initialized calls throw because native diagnostic collection and formatting are not implemented.
• sceNetShowPolicy, sceNetShowNetstatEx, sceNetShowRoute, sceNetShowRoute6 (libSceNet) - return success without printing anything: the () signatures and the success return follow shadPS4, which stubs each the same way. PPSA01530 fails to load without the sceNetShowIfconfig export (#3177); PPSA11386 imports sceNetShowNetstat but does not call it during start-up. What the console prints and where is unverified

Unknown function info

• sceNetGetsockopt - SO_PROTOCOL on raw sockets throws: FreeBSD's raw protocol-switch selection has not been mapped to host raw sockets. For stream and datagram sockets, the effective creation protocol and accepted-socket inheritance follow FreeBSD 11.4's protocol tables and sogetopt; the 0x1016 option and truncated integer output are not measured on PS5. Existing null-pointer validation still returns EINVAL.

• sceNetRecv, sceNetRecvfrom and sceNetRecvmsg (libSceNet) - zero-length TCP receives while connecting, after disconnect, or with a pending host error still use the host receive path. Error and output precedence in those states is unmeasured on a console. The established, error-free case follows FreeBSD 11.4's soreceive_generic.

• sceNetConfigAddIfaddr (libSceNet) - disassembly confirms the same interface/address/broadcast/netmask arguments as SetIfaddr, entering its shared handler with add mode selected. GetIfaddr copies up to two 16-byte interface-address records. GetRouteInfo uses a family, record buffer, signed capacity and byte flags; internal statistics output is 16 bytes. The address-record and internal-statistics fields remain incomplete.

• Resolver-connect, interface and diagnostic queries, WLAN configuration and DHCP queries retain unsupported implementations. Their restored argument lists still reference incomplete connection, interface, route, WLAN and statistics types. Kernel ioctl payloads need reconstruction from their handlers or consumers; buffer lengths alone do not establish field types.

• sceNetThreadCreate, sceNetThreadExit, sceNetThreadJoin, sceNetEmulationGet and sceNetEmulationSet (libSceNet) - the signatures, the { entry, arg, reserved, flags } parameter block and the EOPNOTSUPP of the two emulation calls ("not available on retail units") follow shadPS4 (PS4), not a PS5 measurement. The block is read on the new thread, so it must stay valid until the thread starts, flags is ignored (shadPS4 ends the thread with pthread_exit when bit 0 is set, which ends it the same way), and a failing scePthreadCreate or scePthreadJoin result is returned as it is, where shadPS4 also sets the net errno from it

• sceHttp2GetMemoryPoolStats, sceSslGetMemoryPoolStats, sceNetGetMemoryPoolStats (libSceHttp2, libSceSsl, libSceNet) - the signatures (int id, stats*), the layouts (pool size, peak and current use, and for Http2 and Ssl a 32-bit reserved field) and the error codes were measured on a PS5 (firmware 13.60). The pool size is the one given at init or pool creation. Http2 and Net allocate nothing from these pools. Ssl counts its certificate backend allocations and returned data against its pool; C++ bookkeeping is outside that budget. All three initially report zero use, where the console already reports 0x15C0 bytes for Ssl, 0x1640 for Http2 and 4 for a Net pool. Ssl's allocation sizes and peak usage do not reproduce the console allocator

• sceNetClearDnsCache (libSceNet) - the library has no DNS cache to clear because lookups use the host resolver. The host resolver cache is left unchanged.

• sceNetEtherStrton (libSceNet) - strings shorter than 17 bytes return EINVAL without changing the output, rather than reading past the terminating NUL as in the firmware 13.60 probe. Non-ASCII digit bytes throw because their decoding is unmeasured; other firmware versions remain unverified. Fixed character pairs, ignored separators, alphabetic values beyond f, non-alphanumeric ASCII values of 0x7f, and null-pointer EINVAL follow those measurements, not the strict shadPS4 parser

• sceNetGetDnsInfo (libSceNet) - host-interface selection, zeroing unused slots and returning 0 without a host IPv4 interface remain unverified on PS5 hardware. It reports the host interface's DNS servers until a guest override is set. The two network-order IPv4 slots and returned count follow the PS4 OpenOrbis musl resolver and Net.h.

• sceNetGetRandom (libSceNet) - generates values with the host random device; the system library maintains its own seeded PRNG state.

• sceNetInetPtonEx (libSceNet) - for IPv6 a null dst returns NET_EINVAL here, where it crashed a payload process on a PS5 (firmware 13.60). The (int af, const char* src, void* dst, int flags) signature follows shadPS4. On PS4 firmware 10.71 and on that PS5, IPv4 text is read as inet_aton reads it (a, a.b, a.b.c, hex and octal parts, values wrapping at 32 bits, the text ending at a space, tab or VT), except that a part starting with 09 is decimal ("0989" is 989) and an octal part with 8 or 9 fails; flags were ignored (PS4: 0, single bits up to 0x100, 0x10000, 0x80000000, -1; PS5: 1, 2, 4, 0x100, 0x10000, -1). On the PS5 only: LF, FF and CR also end the text, a null src returns NET_EINVAL, and a null dst returns 1 or 0 without writing or setting errno. IPv6 converts as sceNetInetPton does

• sceNetMemoryAllocate and sceNetMemoryFree (libSceNet) - allocations use the guest heap instead of the system network pool. Pool limits, its allocation accounting and free-time fill are not reproduced: a reused block allocated without flag 2 holds 0xdd bytes on the console and its previous contents here. Flag 4 bypasses the system pool reserve threshold; with no pool there is no threshold, so it allocates as other flags do. What the console returns once the pool is exhausted is unmeasured; AnyPS5 returns null without setting an errno. Measured on a PS5 (firmware 13.60): a size of 0 or less returns null and leaves sceNetErrnoLoc unchanged, flag 2 zero-fills, flags 1, 4, 8, 0x10, 0x100 and 0x80000000 had no visible effect, and every block of 1 to 65536 bytes was 64-byte aligned

• sceNetConfigCleanUpAllInterfaces (libSceNet) - the native routine consumes no arguments; the throwing implementation remains unchanged.

• sceNetDhcpdStart: six arguments and the three-argument address callback are confirmed. The 24-byte parameter contains five network-order addresses and a client limit. Individual address roles and the two unused thread-option meanings remain unresolved.

• sceNetPppoeStart: seven arguments are confirmed, including the parameter pointer on the stack. The 272-byte parameter contains two DNS addresses, two 128-byte credential arrays, MTU and flags. Callback arguments are user data, event and error; the two unused thread-option meanings remain unresolved.

• sceNetConfigRoutingStart: five pointer/scalar arguments are confirmed. Input address data is eight bytes; the mutable server parameter is 20 bytes and duplicates its first address when its count is one. Optional rules contain a count and pointer to 20-byte records with protocol, two address/port pairs and flags. Layouts are defined; rule flag meanings and protocol-specific port interpretation remain unresolved.

• sceNetConfigRoutingShowRoutingConfig (libSceNet) - the native routine consumes no arguments; the throwing implementation remains unchanged.

Functional

• sceNetRecv/sceNetRecvfrom (libSceNet) translate Windows WSAEMSGSIZE into the copied byte count for datagram sockets, including MSG_PEEK, and retain the sender address. This follows FreeBSD 11.4 recv(2) and Winsock's documented truncated-datagram behavior; the console measurement covered only libkernel_sys recv and recvfrom, not libSceNet.

• sceNetUsleep (libSceNet) - whether the console prints its [LIBNET] usleep <count> line for a negative count before sceNetInit is unmeasured; nothing is printed here. What an interrupted sleep returns is unmeasured: AnyPS5 returns the result of libkernel's sceKernelUsleep, a cancellation point. The signed 32-bit count (the upper half of the register is ignored) and the 0 result were measured on a PS5 (firmware 13.60)

• sceNetIoctl (libSceNet) - on a sceNetSocket socket only FIONBIO and FIONREAD are handled and other requests fail with ENOTTY, as in libkernel's ioctl, though FreeBSD 11.4's soo_ioctl handles more; not measured on a console. shadPS4 (PS4) returns EINVAL for other requests. FIONBIO sets SO_NBIO, assumed to be soo_ioctl's SS_NBIO. FIONREAD asks the host, which on Linux counts only the next datagram where soo_ioctl counts all. Libkernel's own sockets go to its ioctl; other descriptors get EBADF.

• sceNetResolverStartAton6 (libSceNet) reverse-resolves a 16-byte IPv6 address through the host resolver (getnameinfo with NI_NAMEREQD) into the caller's buffer of len bytes, as sceNetResolverStartAton does for IPv4. The (rid, addr, hostname, len, timeout, retry, flags) signature comes from SharpProspero. An address with no name, or a name longer than len - 1 bytes, fails with RESOLVER_ENODNS (0x804101E1) and leaves the buffer untouched; whether the console truncates instead is not verified. Abort flag 2 (ATON preservation) fails the next call with EINTR as it does sceNetResolverStartAton. Timeout and retry are ignored, and any nonzero flags throw because their meaning is unknown

• sceNetAccept (libSceNet) inherits the listener's non-blocking mode through the existing SO_NBIO setter, as the libkernel socket path does and FreeBSD's sonewconn copies the socket state. The mode is read after the host accept returns; changes between connection creation and accept are not modelled. Not measured on a console.

• sceNetConnect to AF_UNSPEC (libSceNet) dissolves a datagram association as FreeBSD 11.4's udp_disconnect() does, which resets the local address to the wildcard address and keeps the port. On Linux and on Windows a socket bound to an explicit port keeps its local address as well (127.0.0.1:<port> stays 127.0.0.1:<port>), because a bound socket cannot be bound again, and sceNetGetsockname reports that host address. On Windows a sendto on such a host socket to a non-loopback address fails with Winsock error 10051 (measured on the host socket, not through sceNetSendto), where FreeBSD sends it from the wildcard address. One bound to port 0 is bound again to the wildcard address with the port it had

• sceNetSetsockopt (libSceNet) sets SO_RCVTIMEO and SO_SNDTIMEO as the host socket's timeouts. Windows sockets stay non-blocking and the library waits for readiness until the stored timeout. Blocking stream sends return the queued byte count on timeout, or EAGAIN when no bytes were queued.

• sceNetSetsockopt, sceNetGetsockopt (libSceNet) take SO_SNDTIMEO and SO_RCVTIMEO (0x1005, 0x1006) as a 16-byte struct timeval, as FreeBSD 11.4's sosetopt and sogetopt do, and Sony's 0x1105 and 0x1106 as an int of microseconds. A console log of ProsperoLight (firmware 12.20) shows receives timing out every 100 ms after it gave 0x1006 a {0, 100000} timeval. The errors for a value shorter than a timeval (EINVAL) or out of range (EDOM), and sceNetGetsockopt cutting the timeval to the caller's length, follow FreeBSD's sooptcopyin and sooptcopyout and are not measured on a console

• SO_OOBINLINE uses native TCP urgent-data handling; its urgent-pointer and signalling behavior has not been compared with PS5. The flag bit (0x100), non-stream flag storage and truncated readback follow FreeBSD 11.4 sosetopt/sogetopt. Null pointers retain the existing libSceNet EINVAL result.

• sceNetSetsockopt (libSceNet) stores SO_ONESBCAST (0x10000, shadPS4's ORBIS_NET_SO_ONESBCAST) per socket and sceNetGetsockopt reads back the value that was set, as shadPS4 does; PPSA34501 sets it and crashes later when it fails with EOPNOTSUPP. Sends ignore it. FreeBSD 11.4's ip(4) documents the like-named IPPROTO_IP option IP_ONESBCAST: a datagram sent to an interface's directed broadcast address, such as 192.168.2.255, leaves through that interface with its destination rewritten to 255.255.255.255, and only on a socket allowed to set SO_BROADCAST. Here host routing selects the outgoing interface and the destination is not rewritten. shadPS4 also leaves sends unchanged, and its TODO reads the option the other way round: a send to 255.255.255.255 would be converted to the interface's broadcast address. Whether the console's SOL_SOCKET option behaves like IP_ONESBCAST, and what it reads back, is not verified on hardware. FreeBSD 11.4's sogetopt() reads several boolean socket options back as their flag bit (so_options & optname, sys/kern/uipc_socket.c), not as the value set; whether the console does so for 0x10000 is unknown

• SO_REUSEADDR and SO_BROADCAST readback follows FreeBSD 11.4's sogetopt: enabled options return their flag bit, and output is truncated to the supplied length. PS5 results are unverified. Values reflect the native socket; host restrictions on setting the options are unchanged. Null pointers retain libSceNet's existing EINVAL result. Windows passes SO_REUSEADDR directly to Winsock, which permits a second bind to an occupied address and port under its reuse rules, unlike FreeBSD's separate SO_REUSEPORT requirement for duplicate unicast binds. Guest SO_REUSEPORT (0x200) still fails with EOPNOTSUPP.

• sceNetGetsockopt (libSceNet) reads SO_ERROR from the host socket. Winsock does not clear a socket's pending error when it is read, so on Windows the library reports a pending error once and shows it again only after a new sceNetConnect; a second failure with the same code on the same socket without a sceNetConnect in between would be hidden. One title (PPSA02225) disassembled for this entry has one call site (0x1056d34), with level 0xffff, option 0x1007 (FreeBSD's SOL_SOCKET and SO_ERROR) and a length variable set to 4 beforehand, reached only after a helper called with the value 2 returned true. For a negative result it takes the thread's error code as the value; for a result of 0 or more with a value of 0 it reports the connection as made, and otherwise it turns the value into an error code of its own. The call does not show how often the title reads it or whether it keeps using the socket after an error.

• SO_KEEPALIVE uses the host TCP keepalive timers and probe count, which can differ from the console. The boolean flag, bit-valued readback and truncated output follow FreeBSD 11.4's sosetopt and sogetopt, without PS5 hardware verification. Non-stream sockets retain the flag without sending probes, as FreeBSD does. Null pointers retain the existing libSceNet EINVAL result instead of FreeBSD's EFAULT.

• sceNetSetsockopt, sceNetGetsockopt - TCP_MAXSEG, TCP_NOPUSH, TCP_KEEPIDLE and other TCP options remain unsupported (ENOPROTOOPT). TCP_NODELAY sets on refused, reset or TIME_WAIT sockets can succeed through the host where FreeBSD 11.4's tcp_ctloutput returns ECONNRESET. A null setter value returns EINVAL rather than kern_setsockopt's EFAULT. The non-stream IPPROTO_TCP error (EINVAL) and TF_NODELAY flag readback follow FreeBSD, not PS5 measurements.

• SO_TYPE and SO_ACCEPTCONN read the guest socket type and listening flag, with bit-valued listening results and truncated output following FreeBSD 11.4's sogetopt, without PS5 verification. Null pointers retain the existing libSceNet EINVAL result instead of FreeBSD's pointer handling.

• sceNetGetSockInfo (libSceNet) reports 0 for the name, pid, policy, priority, queue lengths, virtual ports, state, bandwidth, drops and waits, sets no status flag except SELF (0x1) and NONBLOCK (0x200000), and reports the host's buffer sizes where none was set. An IPv6 socket fails with EAFNOSUPPORT and is not counted or listed; shadPS4 lists it with zero addresses. flags bits other than 0x40 fail with EINVAL, where shadPS4 ignores flags; 0x40 adds sockets in TIME_WAIT (SharpProspero), but closed sockets are not kept. Otherwise the s below 0 count and list, the return value and EINVAL for a null info or an n below 1 follow shadPS4. Not measured on a console.

• SO_SNDBUF and SO_RCVBUF validation remains unverified on PS5, and positive sizes remain subject to host buffer limits. Nonpositive sizes fail with EINVAL before changing the native socket, following FreeBSD 11.4 sosetopt.

• sceNetSendmsg and sceNetRecvmsg (libSceNet) copy the scatter/gather list through one host buffer and accept only the flags sceNetSend/sceNetRecv accept. Sending control data throws; a receive never returns control data (msg_controllen 0), since no socket option that queues it is supported

• sceNetGetSockInfo6 (libSceNet) is not measured on a console; shadPS4 stubs it. It lists only IPv6 sockets and flags 0x1000 adds IPv4 sockets, reported with the IPv4 addresses, all-zero IPv6 addresses and no F_IPV6 (0x400000), which every IPv6 socket sets (SharpProspero, flags, docs). The default of leaving IPv4 sockets out, the zero IPv6 addresses of an IPv4 socket and accepting 0x40 are inferred from those names, not documented. An IPv4 socket without 0x1000 fails with EAFNOSUPPORT. The other gaps are those of sceNetGetSockInfo.

• sceNetSocketClose, sceNetEpollControl and sceNetEpollWait (libSceNet) - close and concurrent registration ordering are unmeasured on a console. Closed descriptors retire their registrations, and a wait discards snapshots invalidated by close, DEL or MOD; descriptor identity follows Linux epoll(7). ADD, MOD and DEL reject closed or invalid socket descriptors with EBADF, as Linux epoll_ctl(2) does; this error ordering is unmeasured on a console. Duplicate-descriptor alias lifetime is not modeled by this epoll backend.

• MSG_DONTWAIT (libSceNet) - console ordering between competing readers and writers is unmeasured. The per-call behavior follows FreeBSD 11.4's soreceive_generic and sosend_generic (sys/kern/uipc_socket.c); 0x80 is FreeBSD's flag value (sys/sys/socket.h). On Windows native sockets stay non-blocking. MSG_DONTWAIT and guest SO_NBIO return one host transfer's result. Blocking stream sends queue the whole buffer with one deadline and return progress after a timeout or host error. SSL uses this path through the native owner, retaining the socket, its mode and timeouts. Readiness waits poll at most every 10 ms for local close, so idle blocked operations wake periodically.

• Stream sends on macOS (libSceNet) - a MSG_DONTWAIT transfer also passes XNU's MSG_NBIO (0x20000, absent from the SDK headers), because XNU's MSG_DONTWAIT does not keep a stream send from waiting for buffer space. A blocking stream send goes to the host in sends of 64 KiB, so an error after some progress, such as an abort, reports the bytes already queued, which one host send would drop; the bytes that the failing 64 KiB send had queued are not counted

• sceNetRecv, sceNetRecvfrom and sceNetRecvmsg (libSceNet) on a datagram socket with no local address wait on Windows and macOS until a bind, connect or send gives it one, checking the host socket every 10 ms. Winsock fails such a receive with WSAEINVAL, where FreeBSD 11.4's soreceive_dgram waits for a datagram (sys/kern/uipc_socket.c). On macOS the host receive waits, but a receive-side shutdown does not wake it. A non-blocking socket fails with EAGAIN at once, and the receive timeout ends the wait with EAGAIN; when the address comes first, the call waits for a datagram only for what is left of the timeout. A sceNetShutdown of the receive side ends the wait and the receive returns 0, and a zero-length receive returns 0 without waiting, as soreceive_dgram does when the socket can't receive more or nothing was asked for. An abort or close ends the wait, and the host receive then fails as it did before

• sceNetResolverAbort and sceNetResolverStartNtoaMultipleRecords (libSceNet) follow shadPS4 (net.cpp, net_resolver.cpp); the (int rid, int flags) signature of the abort also matches SharpProspero. Unverified on hardware. Lookups run synchronously over the host resolver, which cannot be interrupted: an abort while a lookup runs on another thread returns at once, and that lookup fails with EINTR without writing its output only when the host call returns; the abort flags are then ignored, as shadPS4 does for a running lookup. With nothing running, abort flag 1 (NTOA preservation) or 2 (ATON preservation) makes the next sceNetResolverStartNtoa* or sceNetResolverStartAton call on that resolver fail with EINTR, reported by sceNetResolverGetError, after its arguments are checked. Unlike shadPS4, which ignores them, other abort flag bits throw, and sceNetResolverStartNtoaMultipleRecords throws for any flag, including async (1) and 0x10000 (IP address literals disabled), as sceNetResolverStartNtoaMultipleRecordsEx does

• sceNetResolverStartNtoa6 (libSceNet) resolves a host name to its first IPv6 address through the host resolver (getaddrinfo with AF_INET6) and writes the 16-byte address; the (rid, hostname, addr, timeout, retry, flags) signature follows sceNetResolverStartNtoa. A name with no IPv6 address fails with RESOLVER_ENODNS (0x804101E1) like a failed lookup; whether the console returns IPv4-mapped addresses instead is not verified. Timeout and retry are ignored as in sceNetResolverStartNtoa, and any nonzero flags throw because their meaning for this call is not known. Unverified on hardware.

• sceNetInetPton (libSceNet) - an IPv6 conversion with a null dst returns NET_EINVAL here, where it crashed a payload process on a PS5 (firmware 13.60). On that PS5 and on PS4 firmware 10.71 an IPv4 address ends at the first space, tab, LF, VT, FF or CR and the rest is ignored ("1.2.3.4 x" converts), and a failed conversion leaves the destination and sceNetErrnoLoc unchanged. On the PS5 the dotted IPv4 part of IPv6 text is read the same way ("::ffff:1.2.3.4 x" converts, "::ffff:01.2.3.4" fails), and an IPv4 conversion with a null dst returns 1 or 0 without writing. Leading whitespace, any other trailing byte (0x01, 0xa0) and whitespace after hexadecimal IPv6 text fail

• sceNetInetPton, sceNetInetNtop (libSceNet) convert IPv6 text with libkernel's inet_pton and inet_ntop, so they take the same FreeBSD 11.4 text forms; beyond the PS5 measurements in the entry above, these are unverified on a console. IPv4 text keeps the host conversion. The checks and errors before the conversion are libSceNet's own and unchanged

• sceNetResolverStartNtoa (libSceNet) ignores flag bits 0x1 and 0x10000 and does not apply the timeout or retry count: every lookup runs once, synchronously, through the host resolver. What those two bits do on a console is not known; the sceNetResolverAbort entry above gives shadPS4's names for them. A negative timeout or retry and any other flag bit fail with EINVAL before anything else is checked, as prosper's reading of the libSceNet module gives

• sceNetDhcpStart, sceNetAddrConfig6Start, sceNetDuplicateIpStart and sceNetInfoDumpStart - argument widths and callback ABI are recovered. Address callbacks receive user data, a 32-bit event and a 32-bit error. DHCP configuration is mutable; the 512-byte IPv6 configuration is read-only. Their complete field layouts remain unknown. The two 32-bit thread parameters are stored but not consumed by this firmware thread wrapper, so their original names and units are unconfirmed. Information-dump options contain flags, an interval in seconds and a 64-byte path. All four exports remain unimplemented.

• sceNetSetDnsInfo, sceNetSetDns6Info and sceNetGetDns6Info (libSceNet) - the resolver still uses the host's DNS servers; setters only store servers for the getters. Without an IPv6 override, the getter reports none. Counts follow shadPS4, not hardware measurements. All four DNS calls' initialization and argument errors match a reported firmware 13.42 module probe: ENOTINIT first, then EINVAL for nonzero flags, null getter outputs or zero primary servers; null setters clear the override. Setters use a checked guest read and return EFAULT for unreadable non-null inputs, an AnyPS5 safety measure absent from the probed module.