In a payload process on a PS5 (firmware 12.70),
sysctlbyname("kern.rng_pseudo") answers a size query with 64 and gives
at most 64 bytes per call, up to a 65536-byte buffer. A buffer smaller
than 64 bytes gets as many bytes as its length and a null length gets
none, both with -1 and ENOMEM; a null buffer with a null length returns
0, and errno is kept when the call succeeds. Here the whole buffer was
filled, a size query threw and the length was never changed. The 64
random bytes are now drawn only for a read that passes both a buffer
and a length.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
For each of the five: the size query, the value, a short buffer (ENOMEM, the copied prefix kept), a new value (EPERM) and a trailing name component (ENOTDIR).
Map hw.model, hw.ncpu, hw.physmem, hw.realmem, kern.arandom and
kern.proc.pathname to their FreeBSD MIBs with the size handling of
FreeBSD's libc wrapper over name2oid, fail with ENOENT and ENAMETOOLONG
as name2oid does, and throw for null pointers, which FreeBSD's wrapper
dereferences, and for names sysctl does not serve.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The mimalloc in PS5MC (PPSA99420) reads vm.overcommit at start-up and
stopped on the unsupported name. It reports FreeBSD's default, 0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The dolphin_libretro core of RetroArch (PPSA99169) reads {CTL_HW,
HW_REALMEM} as the machine's memory size and stopped on the unsupported
MIB. It reports the same value as hw.physmem.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
FreeBSD sysctl_find_oid returns ENOTDIR when the MIB continues below a leaf object. The supported hw.ncpu, hw.model, hw.physmem and kern.arandom MIBs threw an unsupported MIB error instead.
(cherry picked from commit 6968aea8af578c4d56dc614cbe449274bb6e76e7)
FreeBSD sysctl_root rejects a write to a read-only node with EPERM before the node handler checks the MIB length, so a write with a short or long kern.proc.pathname MIB fails with EPERM. sysctlbyname for kern.proc.pathname now goes through sysctl with its 3-component MIB so it follows the same order.
The Python in PS5MC (PPSA99420) reads sysconf(_SC_CLK_TCK) while
importing its posix module and failed with "cannot read
ticks_per_second". It returns FreeBSD's CLK_TCK, 128.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Preserve the leading field and bytes after the 40-byte legacy version record for the values measured in four PS5 firmware 13.42 hardware runs. Keep the emulator version policy unchanged and leave the separately proposed Prospero correction out of scope.
AI-assisted; regression tests are based on guarded hardware measurements.
ScreenTester5 (PPSA69420) stops at start-up on the unresolved sysctlbyname
import and also imports sysctl. hw.ncpu (CTL_HW.HW_NCPU) reports the same
processor count as sysconf(_SC_NPROCESSORS_ONLN). Other names and MIBs throw.
