AnyPS5/docs/dev/debt/libSceHttp2.md

# libSceHttp2 technical debt

### Silent stubs

- [sceHttp2RedirectCacheFlush](../../../core/libs/prx/libSceHttp2/Export.cpp) - returns 0 for any argument without checking it, as the 13.42 module does ([#10536](https://github.com/boykopovar/AnyPS5/pull/10536)); automatic redirects throw, so there is no redirect cache to flush

### Unknown function info

- [Additional HTTP2 exports](../../../core/libs/prx/libSceHttp2/InventoryExports.cpp) - these name/NID pairs are present in the 13.60 export inventory. Parameter lists, return types and behavior are unverified. Parameterless `int` declarations are import-resolution placeholders, not verified ABI prototypes; every entry throws through `NotImplemented_nid_no_patch`. No runtime functionality is implemented.

| Name | NID |
| --- | --- |
| `sceHttp2GetAllTrailingHeaders` | `CjxqMyx2-pU` |
| `sceHttp2SetProxyWithURL` | `fkKvmzFNBe8` |
| `sceHttp2SetRequestServerName` | `zx9s1Lk+O90` |
| `sceHttp2SetStripGZIPHeadersEnabled` | `mMWZm0+7XHM` |
| `sceHttp2WebSocketClose` | `v2hFBiyS13w` |
| `sceHttp2WebSocketSendDataMessage` | `D1IAo-CNswA` |
| `sceHttp2WebSocketSendTextMessage` | `jSHMX1oSE+E` |
| `sceHttp2WebSocketSetCloseTimeout` | `4PUc7B6Zr+c` |

- [sceHttp2DeleteCookieBox](../../../core/libs/prx/libSceHttp2/Export.cpp) (libSceHttp2) - imported by PPSA35943's Unity player. The `(int cookieBoxId)` signature follows [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Http2.cs#L215-L217). A box `sceHttp2CreateCookieBox` returned is discarded; an unknown or already deleted id returns the library's invalid-id error (0x817B1100), as [prosper](https://github.com/mattias800/prosper/blob/b1bec57186a0/prosper/src/hle/net/hle_http2.cpp#L512-L523) does; not measured on a console
- [libSceHttp2 cookie boxes](../../../core/libs/prx/libSceHttp2/Export.cpp) (libSceHttp2) - `sceHttp2CreateCookieBox` takes a machine-sized pool size and requires at least 64 KiB. On 13.42 the pool is rounded up to 16 KiB (wrapping to 0 for `SIZE_MAX`) and mapped with `sceKernelMapNamedFlexibleMemory`, whose error is returned unchanged; the host maps it the same way under an assumed name, but does not reproduce native cookie-heap bookkeeping, identifier ranges or retained request references. Its delete signature and invalid-ID error are confirmed. `sceHttp2SetRequestNoContentLength` takes only the request id. `sceHttp2CookieFlush` empties a cookie box and answers 0 for any other id. Nonzero cookie-box binding by `sceHttp2SetCookieBox` throws
- [libSceHttp2 cookie store](../../../core/libs/prx/libSceHttp2/Cookies.cpp) (libSceHttp2) - behavior follows a run of `GuestHttp2Cookies.cpp`'s sequence against 13.42's `libSceHttp2.sprx` ([#10534](https://github.com/boykopovar/AnyPS5/pull/10534)). Not reproduced: the `0x817B1076` stack check below 0x1FD0 bytes of stack, and the pool size is not enforced. Assumed, not measured on libSceHttp2: the default total limit of 3000 with the 10 oldest dropped past it, and the NUL, space, NUL written after the header (both libSceHttp's), which of no match and null `cookie`/`required` is checked first, public-suffix rules for `Domain`, and dates beyond the tested ones. Equal-length paths come out with the first stored last, a rule inferred from the runs


- [libSceHttp2 pending exports](../../../core/libs/prx/libSceHttp2/Export.cpp) - 5 named callable exports were identified in the PS5 3.20 export table and cross-checked against firmware 13.60. Signatures and behavior remain unverified; declarations use the unknown-signature convention and throw through `NotImplemented_nid_no_patch`. Evidence: [3.20 export list](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceHttp2.c).
### Functional
- [Default TLS trust](../../../core/libs/prx/libSceHttp2/Transport.cpp) (libSceHttp2) - HTTPS connections also trust the system CA list, `/<sandbox word>/common/cert/CA_LIST.cer`, served by libkernel from the host trust store, after the title's own libSceSsl certificates. RetroArch (PPSA99169, [updater](https://github.com/mihawk-99/PS5_RetroArch/blob/7268510b12fe7461342e0cc4497c87a0910c1055/src/webui_update.cpp#L302-L312)), PS5LM (PPSA99575) and Porpoise (PPSA99764) send version-3 requests to public `https://` servers with no loaded certificate, verify callback or verification option, which pass the known-CA check only if the console trusts public roots by default. That the console's roots are exactly this file is not measured

- [libSceHttp2 transport](../../../core/libs/prx/libSceHttp2/Transport.cpp) - synchronous version 1/2 requests use HTTP/1.0 or HTTP/1.1 over HTTP or HTTPS; version 3 requires HTTPS and ALPN `h2`. HTTP/1.x supports fixed-length, chunked and close-delimited responses; chunk trailers are validated and discarded. Cleartext HTTP/2, negotiation fallback, connection reuse, multiplexing across requests, CONNECT, HTTP/2 response trailers and authentication challenges throw. Nonempty HTTP/1.0 uploads without Content-Length also throw. HTTP/1.x framing follows [RFC 9112](https://www.rfc-editor.org/rfc/rfc9112.html); HTTP/2 follows [RFC 9113](https://www.rfc-editor.org/rfc/rfc9113.html). Native behavior remains unverified.
- [libSceHttp2 transport ABI](../../../core/libs/prx/libSceHttp2/Transport.cpp) - version values, string methods, header overwrite/append modes, status/read/content-length signatures and timeout units follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Http2.cs). [prosper](https://github.com/mattias800/prosper/blob/b1bec57186a0/prosper/src/hle/net/hle_http2.cpp) records the method argument as an integer instead. These are public compatibility contracts, not console measurements.
- [libSceHttp2 error paths](../../../core/libs/prx/libSceHttp2/Transport.cpp) - these throw, as their console codes are not implemented: lookup failures, expired deadlines, other `sceSslConnect` results, cancellation, protocol failures, malformed inputs, concurrent calls on one request and exhausted connection slots. Handshake failures a PS5 payload measured against loopback TLS servers pass through unchanged, but two cannot be reached until libSceSsl changes: the console returned 0x80410136 for a peer that resets during the handshake and 0x80951D78 for a reply that is not TLS, where the host libSceSsl returns 0x8095170D and throws respectively. The other five, 0x8095F00B, 0x8095F00C, 0x8095F00D, 0x8095F010 and 0x8095170D, match the host libSceSsl; [#11922](https://github.com/boykopovar/AnyPS5/pull/11922) lists each case. After a failed send `sceHttp2GetStatusCode` returns 0 and stores 0, the content length and read calls return 0x817B1065, and another send returns the same error.
- [libSceHttp2 connections](../../../core/libs/prx/libSceHttp2/Transport.cpp) - socket connect errors propagate the libSceNet result, following the module-analysis report in [prosper #2894](https://github.com/mattias800/prosper/issues/2894); the report does not establish every exported error path. A request uses one connection; a context's concurrency cap counts connections until EOF, failure or deletion. Native pooling, scheduling, validation order and teardown semantics remain unverified. DNS uses two host workers and a queue of eight; cancellation/deadlines abandon the caller's wait, not libc's lookup. Library unload can wait for a host lookup to return. A resolve retry resubmits a failed lookup with a new timeout; a timed-out lookup isn't retried. The console's retry semantics are unverified.
- [libSceHttp2 request deadlines](../../../core/libs/prx/libSceHttp2/Transport.cpp) - the host checks the overall deadline before buffered as well as socket reads, matching its HTTP/2 path. Whether the console allows consuming a response buffered before expiry after that deadline is unmeasured. Native timeout errors and validation order remain unverified; expiry throws.
- [libSceHttp2 TLS settings](../../../core/libs/prx/libSceHttp2/Export.cpp) - minimum SSL versions outside 2 to 5 and flags outside `0x3d` throw. SSL callbacks use the verification adapter described below. Supported certificate-check bits follow SharpProspero and use libSceSsl's TLS 1.2 backend and CA context; native defaults and error translation are unverified. Settings on object kinds other than templates/requests throw, except for the request options below and context SSL flags; other native restrictions are unverified. Settings become immutable when transport is created. Zero timeout values, negative resolve retries and connection-slot wait timeouts throw; a failed lookup is retried up to the set count. Host HTTP allocations are not charged to the context pool, so `sceHttp2GetMemoryPoolStats` reports a live context's pool size with zero peak and current use. PPSA01494, PPSA30839 and PPSA31162 read them for logging without checking the result and stopped at startup while it threw.
- [sceHttp2SetMinSslVersion](../../../core/libs/prx/libSceHttp2/Export.cpp) - libSceHttp2's own range and validation order are not measured: versions 2 (SSL 3.0) to 5 (TLS 1.2) are accepted, the range `sceSslSetMinSslVersion` takes on a 13.40 console ([libSceSsl](libSceSsl.md)). The floor is not kept: libSceSsl negotiates TLS 1.2 only, which meets every accepted floor, so a server limited to versions older than TLS 1.2 fails the handshake whatever the floor; what a lower floor does with such a server on a console is not measured.
- [sceHttp2SslEnableOption, sceHttp2SslDisableOption](../../../core/libs/prx/libSceHttp2/Export.cpp) (libSceHttp2) - accept a context id as well as a template or request, as [prosper](https://github.com/mattias800/prosper/blob/b1bec57186a0/prosper/src/hle/net/hle_http2.cpp#L461-L478) does for any live object; PPSA06866 sets them on its context ([#13715](https://github.com/boykopovar/AnyPS5/issues/13715)). The context keeps the flags and templates created after the call copy them; that inheritance, and whether templates already created see the change, are not established by any source or measured on a console
- [libSceHttp2 request options](../../../core/libs/prx/libSceHttp2/Export.cpp) - extends the TLS settings entry: the auth and redirect flags, headers and the auth-info and pre-send callbacks live in `Http2::Settings`, are copied into each new request and become immutable once transport exists; the getters still read them then. Accepted kinds, defaults, copying, header modes, error codes and their order follow the 13.42 module run in an emulator ([#10536](https://github.com/boykopovar/AnyPS5/pull/10536)), not a console. A null out-pointer to `sceHttp2GetAuthEnabled` is written through on that module; here it throws. The pre-send callback type is unknown. The transport never calls either callback, and the auth cache flush only validates the context
- [sceHttp2GetAllResponseHeaders](../../../core/libs/prx/libSceHttp2/Export.cpp) returns the final raw HTTP/1.x header block, excluding the terminating NUL, owned until request deletion. Its native size/lifetime contract remains unverified. HTTP/2 serialization still throws because its representation has not been established. Status and Content-Length fields are decoded; chunked HTTP/1.x reports kind 2, absent Content-Length kind 1, following SharpProspero.
- [libSceHttp2 gzip responses](../../../core/libs/prx/libSceHttp2/Transport.cpp) - `sceHttp2SetInflateGZIPEnabled` stores the flag. When it is set and the response carries `content-encoding: gzip`, the HTTP/2 path inflates the body with the vendored zlib before `sceHttp2ReadData` and `sceHttp2GetResponseContentLength` see it, and reports the inflated length; both calls wait for END_STREAM while the enabled response is gzip. The transport neither adds nor inspects `Accept-Encoding`, so the guest supplies that request header and an unsolicited gzip response is inflated too. Whether a console rewrites the header block (Content-Encoding and Content-Length) is unverified, so the serialized headers keep the fields the server sent; other encodings are not inflated, a malformed or truncated stream, a bad checksum or size and concatenated members throw, and the optional gzip header CRC is not verified.
- [libSceHttp2 asynchronous requests](../../../core/libs/prx/libSceHttp2/Export.cpp) - send/read submission and `sceHttp2WaitAsync` throw. The previous offline implementation queued a fabricated network failure and used event type zero; public sources do not establish the completion event types, wait timeout updates, cancellation results or ownership of async buffers. PPSA17221's kqueue layout and PPSA15508's 24-byte wait result establish caller ABI only. No completion or equeue event is manufactured.
- [Host request header](../../../core/libs/prx/libSceHttp2/Transport.cpp) (libSceHttp2) - a `Host` header set with `sceHttp2AddRequestHeader` becomes the request's `:authority` pseudo-header and is not sent as a `Host` field, following the HTTP/1.1-to-HTTP/2 translation in [RFC 9113 section 8.3.1](https://www.rfc-editor.org/rfc/rfc9113.html#section-8.3.1). The last value set wins. The console's handling of a `Host` that differs from the URL authority and of whitespace in the value is not measured; here whitespace throws.

- [WebSocket ping settings](../../../core/libs/prx/libSceHttp2/Export.cpp): both setters take a 32-bit request ID and a 32-bit interval/timeout in microseconds, confirmed by the timer consumer and its clock conversion. The protected implementations remain unchanged.
- [sceHttp2Init](../../../core/libs/prx/libSceHttp2/Export.cpp) - a negative maximum concurrent request count throws, and the pool size is not checked. In a payload process on a PS5 (firmware 12.70), with a 64 KiB pool, a count of 0 returned `0x817B11FE` (invalid value) and a count of 1 returned `0x817B121D` (pool too small). A count of -1 with that pool, and a count of 1 with a 1 MiB pool in a second run, produced no result before the runner's timeout, so their return values and the smallest accepted pool are not measured. Every call with a constant count in the titles checked passes 1 to 32, and every call with a constant pool size passes 256 KiB to 2.75 MiB, the range above the measured 64 KiB pool; the value of the other calls is not known.

- [libSceHttp2 automatic proxy configuration](../../../core/libs/prx/libSceHttp2/Export.cpp) - flags 0 and 1 both use direct connections, matching [libSceNetCtl](../../../core/libs/prx/libSceNetCtl/Export.cpp), which reports proxy configuration off, an empty server and port zero. Other flag values throw. This is the host configuration policy, not a console measurement of proxy discovery; PAC/WPAD and configured proxies remain unsupported. The boolean argument and acceptance of 1 by callers are evidenced by [OliSe Player](https://github.com/Marice/OliSePlayer/blob/fb06d7ac7467a50ba1f2ee299dac20e43213d674/src/netxm.c#L73) and [RetroArch](https://github.com/mihawk-99/PS5_RetroArch/blob/7268510b12fe7461342e0cc4497c87a0910c1055/src/webui_update.cpp#L305); call sites do not establish library behavior.

- [libSceHttp2 redirects](../../../core/libs/prx/libSceHttp2/Transport.cpp) - native caching, callback scheduling, target-reference delivery and method/body rewriting remain unverified. The typed callback, zero-follow/nonzero-refuse behavior and six-redirect cap follow [SharpProspero](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Http2.cs#L327-L334), not console measurements. Refusal exposes the received status/body. Method selection follows [RFC 9110 section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#section-15.4); URI reference resolution follows [RFC 3986 section 5.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-5.2). HTTP/2 downgrade to HTTP, duplicate Location fields, invalid callback methods, redirect-limit exhaustion and changing active-request options throw; native error mappings are unknown.

- [libSceHttp2 SSL callbacks](../../../core/libs/prx/libSceHttp2/Transport.cpp) - callback scheduling and refusal error mappings remain unverified on a console. The SSL-context/error-mask/certificate-chain/user-argument signature follows the [on-device header](https://github.com/etaHEN/etaHEN/blob/03d016fd316ecf0a1841465bef8937a71352bff0/Source%20Code/include/libhttp2.h#L22-L27). Zero accepts the chain; nonzero refuses it, following [SharpProspero HTTPS callback semantics](https://github.com/SvenGDK/SharpProspero/blob/5dfdb4b0b166e83dc9ae275001afb695f12c7174/src/SharpProspero/Interop/Net/Http.cs#L700-L708). libSceSsl supplies real peer handles and verification flags for each TLS hop. Refusal, cancellation and unsupported verification failures throw while their native HTTP2 error mappings are unknown. Changing active-request options remains unsupported.

- [HTTP/1.x gzip inflation](../../../core/libs/prx/libSceHttp2/Transport.cpp) - a nonempty gzip response with inflation enabled throws; the HTTP/1.x decoder is not implemented. With inflation disabled, encoded bytes and wire lengths are retained. Non-gzip responses and bodyless responses retain their existing handling. Native error mapping remains unverified.

### Additional PS5 3.20 imports (xdCloudy #9485)

- [sceHttp2Unknown_*_nid_no_patch](../../../core/libs/prx/libSceHttp2/Export.cpp) (libSceHttp2) - 1 PS5 3.20 import declarations (`_Z5dummyv`). Their prototypes and behavior are unverified; each uses the no-parameter import-resolution convention and throws through `NotImplemented_nid_no_patch`. This records the export names without claiming an ABI or behavior. Source: [PS5-3.20_Libs](https://github.com/DNNDHH/PS5-3.20_Libs).