AnyPS5/docs/dev/debt/libc.md

libc technical debt

Unknown function info

• sceLibcBacktraceGetBufferSize, sceLibcBacktraceSelf (libc) - signatures and frame record layout inferred from a title (next pointer, u32 module offset, module name at +0x10); the u32 at +0xC is unknown and written as 0. Module names are host file names without the .guest.prx suffix, so their case may differ from the PS5 module name. Implemented only on Linux; other platforms throw

• fdopen (libc) validates descriptor access modes as FreeBSD 11.4 fdopen.c does: a requested mode incompatible with a descriptor not opened for both reading and writing returns null with EINVAL, leaving the descriptor open. Windows reads the handle's granted access through the same host helper as fcntl(F_GETFL); a closed descriptor returns null with EBADF. Console behavior is unverified.

• scriptingGetMem, scriptingFreeMem (libc) - runtime allocator hooks for Unity titles. The allocation signature (alignment, size), minimum alignment 16 and null result for a non-power-of-two alignment follow KytyPS5; the free hook's one-pointer signature follows Raeen's recorded contract. Both use the registered application allocator. No console measurement; null allocation returns null and other allocator errors throw.

• _Mtx_trylock (libc, NID k6pGNMwJB08) - returns busy for a non-recursive mutex already owned by the caller, assumed to match _Mtx_lock's ownership handling; exact console behavior is unverified.

• nearbyintf (libc, NID c+4r-T-tEIc) uses the host rounding mode, not the console's; console rounding mode state remains unverified.

• __std_find_trivial_unsized_N (libc) - matches the libc.prx bundled with PPSA08427 (disassembly, and that binary run side by side on random inputs): when nothing matches between first and the end of its 32-byte-aligned block, the console rescans that whole block without masking and so can return a match up to 31 bytes before first

• _Thrd_sleep (libc, NID jfRI3snge3o) follows the Dinkumware threads library shipped with Visual C++ 2013 (xtime.c) and C11 Annex K, without console verification. It reads a 16-byte xtime (64-bit seconds and nanoseconds) on the guest CLOCK_REALTIME, normalizes the nanoseconds and sleeps through nanosleep, retrying on EINTR, so it is a cancellation point; a null xtime or one whose normalization overflows throws. The console's _Thrd_sleep (disassembled from a title's libc.prx) also takes an optional xtime* of remaining time and returns int; here the sleep is never cut short, so it returns 0 and leaves the remaining time untouched.

• _Mtx_init_with_name (libc, NID tgioGpKtmbE) forwards to _Mtx_init and ignores the mutex name parameter.

• _Cnd_timedwait (libc, NID McaImWKXong) follows the console's _Cnd_timedwait (disassembled from a title's libc.prx), where xtime is an absolute deadline converted against the current time: it returns _Thrd_timedout (2) on expiration and _Thrd_success (0) on notification. The console returns 4 for other internal pthread errors while this implementation throws.

• fegetenv (libSceLibcInternal, implemented in libc, NID psx0YiAKm7k) follows FreeBSD 11 amd64 fenv.c with the 32-byte fenv_t of x86/fenv.h: fnstenv fills the 28-byte x87 part, MXCSR follows at 0x1c, and the x87 control word is reloaded because fnstenv masks every x87 exception. That the console's libSceLibcInternal has the same code and layout is assumed, not read from its binary. A null pointer throws instead of faulting

• Guest arena (libc) - the application map area is assumed to end at 0xFC_0000_0000, as SCE_KERNEL_APP_MAP_AREA_END_ADDR does on the PS4. On Windows, host allocations made in the arena before libc loads stay, and a fixed guest mapping over one throws

• sceLibcInternalBacktraceForGame (libSceLibcInternal, implemented in libc) - (const char* heapName) and its return follow the libc.prx ASTRO BOT (PPSA21564 01.007.000) bundles: its four calls (0x6801, 0x7F46, 0xE75E, 0xEE02) are in the malloc_stats and sceLibcMspaceMallocStats paths, each after a [%s] ... line printed with the same heap name buffer, and the caller ignores the result and continues. The console's backtrace output is not reproduced: the heap name and the guest return address are written to the host standard error

• sceLibcInternalHeapErrorReportForGame (libSceLibcInternal, implemented in libc) - (void* heap, void* block, uint32 error) follows the same libc.prx (call at 0xF634): it passes the heap, the block and the nonzero result of its block check, and then calls a function that never returns, so the report only has to return. The meaning of the error values is unknown; the three values and the guest return address are written to the host standard error

• sceLibcPafMspaceCreate, Destroy, Malloc, Free, Calloc, Realloc, Reallocalign, MallocStats and MallocStatsFast (libSceLibcInternal, implemented in libc) follow the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x5D680 to 0x5D770): each calls the same internal routine as its sceLibcMspace counterpart without the malloc callback hook those add, and Reallocalign takes the alignment before the size as sceLibcMspaceReallocalign does. Create takes a fifth argument, a pointer to a creation options block (a version word, a type of 1 or 2 at offset 2, a field at 0x10) that the Mspace form passes as null; a non-null block throws, as its meaning is unknown. Malloc, Free, Calloc, Realloc and Reallocalign take a trailing owner value that the console XORs with its block magic and stores in each block's footer, where the Mspace forms pass the heap itself. Footers are not modelled here, so the owner is ignored. Measured on a PS5 (firmware 13.60) from a homebrew payload, the calls with a matching owner behave as here, but the console ends the process when Reallocalign is given a block whose owner differs and when it resizes a block in place with an owner other than the heap, and MallocStats returns 1 instead of 0 while the heap holds blocks owned by something other than the heap; none of this is reproduced. PafMspaceMemalign, PosixMemalign, MallocUsableSize, Trim, IsHeapEmpty, CheckMemoryBounds, ReportMemoryBlocks and GetFooterValue are not implemented

• malloc_usable_size (libc) - with the default allocator it returns the size the block was requested with (the range registered for it), not the rounded-up chunk size Sony's allocator reports; both satisfy "at least the requested size", and bytes past the request would not be write-watched. With an application allocator it calls entry 9 of the replacement table (malloc_usable_size in KytyPS5's MallocReplace order) and throws when the table leaves it null, like malloc_stats_fast

• malloc_stats_fast (libc) - with the default allocator it fills the 0x28-byte managed-size block as sceLibcMspaceMallocStatsFast does, from the default heap's own accounting, not Sony's allocator: the system sizes count the 1 MiB spans of its small-block classes and its committed large blocks, cached free ones included, and the in-use sizes count each handed-out block at its size-class or 64 KiB-granule size, header included. A block size below 0x28 or a null pointer returns 22, as in the mspace version; the version field is not checked. Ship of Harkinian (PPSA99320) calls it about 10 s after start-up.

• malloc, calloc, realloc, memalign, aligned_alloc and reallocalign (libc) - follow FreeBSD 11.4 contrib/jemalloc/src/jemalloc.c for failures, not measured on the console: a size the default heap rejects or the guest arena cannot place (including a calloc product that overflows) returns null with errno ENOMEM, and memalign and aligned_alloc return null with EINVAL for an alignment that is zero or not a power of two. FreeBSD's libc has no memalign, so setting errno there is assumed. A host commit failure for a block that fits in the arena (Windows ERROR_NOT_ENOUGH_MEMORY, ERROR_OUTOFMEMORY or ERROR_COMMITMENT_LIMIT, Linux ENOMEM) resets and releases the reserved range and returns null with ENOMEM; any other commit failure releases the range and throws. reallocalign returns null with EINVAL for an invalid alignment and ENOMEM like the others, which is an assumption as it is not in FreeBSD. realloc(ptr, 0) frees the block and returns null, where FreeBSD 11.4's jemalloc 4.5 resizes it to one byte and returns a block

• reallocf (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 lib/libc/stdlib/reallocf.c on top of this libc's realloc, not measured on the console: size 0 frees the block and returns null as realloc does here, so the block is not freed twice; when realloc fails because the application allocator returns null or the default heap rejects the size, the block is freed through the same allocator, errno is ENOMEM and null is returned. Other failures (a commit failure that is not out of memory, an unknown pointer) throw, as they do for realloc

• sceLibcMspaceReallocalign (libSceLibcInternal, implemented in libc) takes (void* heap, void* block, size_t alignment, size_t size), the order of the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x13880, whose internal routine at 0x12390 treats the third argument as the alignment and, for a null block, passes it to the routine sceLibcMspaceMemalign uses). Measured on a PS5 (firmware 13.60) from a homebrew payload: a null block with alignment 4096 and size 100 returns a 4096-aligned block; an alignment of 0 or 3 succeeds and 100 gives a 128-aligned block, as the routine raises it to at least 32 and to the next power of two; an alignment of 2^63 or more returns null, keeps the block and leaves errno alone; and a size of 0 returns a block (the same one when it is already suitable) instead of freeing it. A block that is aligned and large enough is kept where it is, without giving back the bytes past the new size as the console's in-place resize does

• acosl (libc) - computed by the host's math library, like the other libc math functions here, not by the console's (FreeBSD msun ld80 code in Sony's libc.prx): results can differ from the console's in the last bit, and on Linux glibc sets errno to EDOM for acosl outside [-1, 1] where msun only raises the floating-point exception. long double is the x87 80-bit format, as Sony's frexpl uses it (fldt 0x8(%rsp), result in st(0))

• atanl, sinl, cosl, tanl, sinhl, coshl, tanhl, expl, exp2l, logl, log10l and powl (libc) - computed by the host's math library, as acosl is, not by the console's FreeBSD msun ld80 code: results can differ from the console's in the last bit (glibc's log10l(1000) is not exactly 3), and on Linux glibc sets errno to EDOM or ERANGE where msun only raises the floating-point exception. ldexpl and truncl are exact operations and give the console's result; logb and remainder give the console's value too, but on Linux glibc sets errno (ERANGE for logb(0), EDOM for remainder by zero or of an infinity) where msun only raises the floating-point exception

• Dinkumware atomics (libc) - every operation is sequentially consistent whatever memory order it is given, which is never weaker than the console. Matching the libc.prx bundled with PPSA08427 (that binary run side by side on every order from 0 to 7), _Atomic_load_8 returns 0 for a release, acq_rel or invalid order and the 8-byte exchange and fetch operations return 0 without touching memory for an order above memory_order_seq_cst; the generic _Atomic_copy, _Atomic_exchange and _Atomic_compare_exchange_* lock the byte flag passed first, as the console does

• std_execute_once (libc) - assumed to be the plain-named twin of std::_Execute_once (_ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1_, the callee of Dinkumware call_once): it delegates there and gets the [thread.once.callonce] semantics already verified for that symbol (one invocation per flag, concurrent callers block until it completes, and a failing or throwing invocation leaves the flag unready so the next caller runs it). The name equivalence is not confirmed on a title, and the callback convention (called with (null, arg, null), non-zero return meaning success) is the twin's, unverified for this symbol

• __atomic_load, __atomic_store, __atomic_exchange and __atomic_compare_exchange (libc) - the generic, size-parameterised libatomic entry points are a single ud2 in the libc.prx bundled with PPSA08427 (disassembly), so the console traps on any call; these throw instead

• Dinkumware mutexes and conditions (libc) use pointer-to-handle arguments, matching the console aerolib signatures reported in #3079. The title's _Mtx_lock maps 0 to _Thrd_success (0), 0x8002000b to _Thrd_busy (3), and other failures to _Thrd_error (4); its internal mutex init recognizes recursive flag 0x100, while every other type uses default attributes. The observed relock failure for a plain mutex suggests those defaults are error-checking, but that has not been confirmed on hardware. The title's _Mtx_unlock and _Cnd_wait return success regardless of their internal result. The host implementation treats invalid ownership preconditions as no-ops, and throws for invalid handles, host wait errors and destroying a locked mutex as debug guards; those cases are not confirmed against the console.

• Floating-point compiler-rt builtins (libc) follow the libc.prx bundled with PPSA08427 (disassembly, and that binary run side by side on random inputs) where it differs from current compiler-rt: the soft-float __add, __sub, __mul and __div (sf3, df3) round to nearest, raise no exception flags and ignore MXCSR, here done with SSE under a default MXCSR that is restored afterwards; division flushes a quotient below the smallest normal to a signed zero; __extendsfdf2 and __truncdfsf2 copy NaN payloads unshifted; float-to-integer conversions do not saturate but shift the significand by a count masked to the shift width. __mulsc3, __muldc3, __divsc3 and __divdc3 fuse the same products as the console with fma and scale through the x87 like its scalbn, so their values match, but NaN payloads and exception flags can differ, as the host fma and logb are not the console's VEX FMA code and libm

• random, srandom, initstate, setstate (libc) follow FreeBSD 11 random.c: the additive feedback generator on a default 128-byte TYPE_3 table, good_rand seeding, state sizes rounded down to 8, 32, 64, 128 or 256 bytes, and setstate returning the previous state or null for a rear position past the degree. initstate below 8 bytes returns null without setting errno, as that file and its manual do (glibc sets EINVAL). FreeBSD does not lock the generator; here every call is serialised by one lock, so concurrent callers draw the serial sequence between them. A null state throws, where FreeBSD faults. That the console's libSceLibcInternal uses this FreeBSD code and not another generator is unverified

• Integer compiler-rt builtins (libc) - the console traps in __divsi3, __modsi3 and the 64- and 128-bit divisions on a zero divisor (div) and in __negv*, __absv* and __mulv* on overflow (an abort helper, then ud2); these throw instead. As in the libc.prx bundled with PPSA08427 (disassembly), __addv* and __subv* wrap without an overflow check, and __udivsi3, __umodsi3 and __udivmodsi4 divide in software, giving a quotient of 0 and the dividend as remainder for a zero divisor; __clzdi2 and __ctzdi2 of 0 return 32 and __clzti2 and __ctzti2 of 0 return 64

• qsort (libc) follows FreeBSD 11 qsort.c: Bentley and McIlroy's quicksort, with insertion sort below 7 elements and after a partition pass that swaps nothing, so elements that compare equal end in FreeBSD's order and the comparator is called in the same sequence. That the console's libc uses this FreeBSD code is unverified

• memcpy_s, memmove_s, wmemcpy_s, wmemmove_s, wcsncpy_s, wcscat_s, wcsncat_s (libc) use the C11 Annex K size constraints, with RSIZE_MAX taken as (SIZE_MAX >> 1) / sizeof(char16_t) for wide operations and SIZE_MAX >> 1 for byte operations. An oversized destination size returns ERANGE (34) without touching the destination; the console's RSIZE_MAX and exact error value are unverified. Constraint violations return an error without invoking the registered constraint handler, as before.

• snwprintf_s (libc) - follows C11 K.3.9.1.3 with RSIZE_MAX assumed to be SIZE_MAX >> 1. A runtime-constraint violation only returns a negative value: set_constraint_handler_s is not exported and the console's default handler is unknown. An invalid multibyte %s argument is copied byte by byte instead of being reported as an encoding error, as in vswprintf

• swprintf_s and vswprintf_s (libc) - follow C11 K.3.9.1.4 with RSIZE_MAX assumed to be SIZE_MAX >> 1: the complete output, including the terminating null, must fit in the buffer, otherwise it is a runtime-constraint violation that sets buffer[0] to zero and returns a negative value, and the buffer is not partially written. Argument and encoding checks match snwprintf_s

• strerror_s and strerrorlen_s (libc) follow C11 K.3.7.4.2 and K.3.7.4.3, using the existing FreeBSD error messages and unknown-error formatting. Truncation writes an ellipsis when capacity exceeds 3; constraint failures leave the destination untouched and invoke the registered guest-ABI handler. The console's RSIZE_MAX (SIZE_MAX >> 1 here), nonzero returns (EINVAL 22 for constraints, ERANGE 34 for truncation), handler arguments and default abort behavior are unverified. Messages remain in the C locale, and guest errno is preserved.

• getw and putw (libc) follow FreeBSD 11.4 getw.c and putw.c: one 32-bit little-endian word, getw returns -1 for EOF or an error, and putw returns 0 on success or -1 on error while holding the stream lock. They use the existing host-backed streams, so buffering and error timing follow the host CRT. Null streams throw and closed streams return -1 with EBADF, as existing byte I/O does. Console behavior is unverified.

• vsnwprintf_s (libc) - va_list counterpart of snwprintf_s (C11 K.3.9.1.3): truncates to the buffer and returns the full length, with the same constraints and argument checks

• strndup and strdup (libc) return null with errno set to EINVAL (22) when source is null, preventing a host segfault on invalid guest input. POSIX.1-2008 and FreeBSD 11.4 libc leave strndup(NULL) and strdup(NULL) undefined (faulting); exact console behavior on hardware is unverified.

• snprintf_s and vsnprintf_s (libc) - follow C11 K.3.5.3.5 and K.3.5.3.12 with RSIZE_MAX assumed to be SIZE_MAX >> 1, as snwprintf_s does: a null buffer or format, size of 0 or above RSIZE_MAX, any %n and a null %s, %ls or %S argument return a negative value and set buffer[0] to zero when the buffer and size allow it; otherwise the output is truncated to the buffer and the full length is returned. A violation only returns: the constraint handler is not invoked, and the console's error value is unverified. Not confirmed on a PS5 title

• vsscanf_s (libc) - returns the count of items converted before an undersized %s/%c/%[ destination (0 when it is the first), not EOF. Not confirmed on a PS5 title

• localeconv (libc, re-exported by libSceAmpr) - the 0x90-byte Dinkumware struct (empty monetary strings, CHAR_MAX for the 14 char fields, decimal_point ".", _False/_True "false"/"true") is read from the libc.prx that Astro's Playroom ships. It is a fixed C-locale table: whether the console changes it with setlocale is not known, and _Frac_grouping, _Frac_sep, _No, _Yes are empty strings as in that dump

• set_constraint_handler_s (libc, re-exported by libSceAmpr) - the default handler is assumed to abort; each module keeps its own handler state, so a handler set through one library is not seen by the other. ctime_s and asctime_s follow the Dinkumware 26-byte format with EINVAL for a buffer under 26 bytes, a null pointer or an out-of-range weekday/month; ctime_s uses the guest time zone of localtime_s, and the console's exact checks are not verified

• __udivti3 (libc, re-exported by libSceAmpr) - the hardware traps on a zero divisor; this throws instead

• __umodti3 (libc) - the hardware traps on a zero divisor; this throws instead

• __modti3 (libc) - the hardware traps on a zero divisor; this throws instead

Functional

• sscanf_s and vsscanf_s (libc) return EOF when a reached conversion has a null destination, stopping before further assignments, following C11 K.3.5.3.7 and K.3.5.3.14. Earlier assignments are retained. The constraint handler is not invoked, and console behaviour is unverified.

• __isfinitel - classifies the x87 80-bit exponent without narrowing to double or performing floating-point comparisons, following FreeBSD msun. The signature and classification follow FreeBSD; console behaviour is unmeasured. Requires little-endian x87 long double stored in 16 bytes, as the existing guest long-double ABI does.

• Windows direct-memory backing reserves a paging-file section. A direct memory page mapped at one guest address is private write-watched memory at that address and is not committed in the section; a page mapped at a second address moves its whole resident run into the section (committed there) and every address becomes a view of it, tracked by write protection. An unmapped resident page that is not all zeros is kept in a private reservation until it is mapped again. Committed section contents remain across unmap/remap and are released when the backing and its remaining views are destroyed. A host import alias over part of a resident run is refused. Linux retains its existing backing. Peak gameplay memory and Windows versions other than the tested host remain unverified.

• getc_unlocked, putc_unlocked, getchar_unlocked, putchar_unlocked (libc) - byte I/O uses the host unlocked operations; guest EOF/error flags and macro counters follow FileStream. Linux status queries use feof_unlocked/ferror_unlocked because glibc feof and ferror can acquire the stream lock. Windows uses the CRT no-lock byte operations and feof/ferror, verified under a held stream lock on UCRT. Console behavior and other host CRTs remain unverified.

• fgetws, getwc, getwchar, putwc, putwchar (libc) - wide stream I/O encodes and decodes wide characters as UTF-8 on the underlying byte stream; fgetws reads characters into the destination buffer until newline or EOF and null-terminates, returning null on stream error. Console wide stream buffering and encoding details remain unverified.

• Closed standard descriptors (libc) - on Linux and macOS, a descriptor 0, 1 or 2 that is closed when libc loads is opened on /dev/null (read-only for 0, write-only for 1 and 2) by a static initializer of libc, which runs before the libraries that depend on libc initialize and before the title starts. Within libc this relies on no static initializer opening a descriptor before it, which guest_closed_standard_descriptors checks. glibc does the same for set-user-ID programs (check_fds.c). Without it the first descriptor a library opens, the write watch's userfaultfd for one, becomes the guest's standard input or output. What the console gives a title as its standard descriptors is not measured, and on Windows a process started without standard handles is not handled.

• ftrylockfile (libc) - tries the host CRT stream lock that flockfile, funlockfile and each locking host stdio call on the stream take, so it returns -1 while another thread holds the stream through flockfile or is inside such a call, and 0 when it acquires the lock or already owns it (recursively, released by as many funlockfile calls), as FreeBSD 11 _ftrylockfile does. A libc export holds the lock only for each host call it makes, not across several host calls or while it updates the guest FILE prefix. Linux uses glibc ftrylockfile. UCRT has no try variant of _lock_file, so Windows calls TryEnterCriticalSection on the CRITICAL_SECTION that _lock_file enters, found through the private UCRT stream layout (__crt_stdio_stream_data in ucrt/inc/corecrt_internal_stdio.h, unchanged from Windows SDK 10.0.19041 to 10.0.26100); another CRT or a change of that layout breaks it. A null or closed stream throws where FreeBSD dereferences it

• fgetln (libSceLibcInternal, implemented in libc) throws: in the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x5FE80) the export is a hlt instruction, which faults in user mode and ends the process

• Wide-character conversions (libc) - The wide wcsto* functions parse the ASCII prefix of the guest string, as the C locale accepts only ASCII white space and digits. wcsrtombs uses the guest's single-byte C locale through wcrtomb; other encodings and shift states are not supported

• realpath (libc) follows FreeBSD 11's realpath.c except for symlinks. The console's guest filesystem has none, so a host symlink under the guest root is followed for existence and type but not expanded, and .. drops the previous component lexically, as Resolve does for every guest path. Through a host link linkdir -> sub/deep, linkdir/../x gives x beside the link, not beside its target.

• strtod, strtof, strtold (libc) - NAN(n-char-sequence) converts to the quiet NaN that nan and nanf return, negated after a minus sign, and ignores the sequence as they ignore their tag. This is inferred from C17 7.12.11.2p2, which makes nan("n") equivalent to strtod("NAN(n)", NULL), and not observed on the console. No console nanl was observed, so strtold returns the x87 default quiet NaN (exponent 0x7fff, significand 0xc000000000000000)

• nan and nanf (libc) return fixed quiet NaN values (0x7fc00000 and 0x7ff8000000000000), ignoring the tag argument as observed in the console's libc.prx (both exports load a global constant via mov rax,[rip+..]; vmovsd xmm0,[rax]; ret); VLC (PPSA85300) stops on nanf at start-up after strsep.

• seed48 and lcong48 (libSceLibcInternal, implemented in libc) follow the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x6F460 and 0x6F420): the multiplier and addend are shared by the whole rand48 family, including erand48, nrand48 and jrand48 on a caller's seed; lcong48 sets them with the seed, and srand48 and seed48 restore 0x5DEECE66D and 0xB. Unlike FreeBSD, seed48 returns a static copy of the new seed rather than the previous one. A null argument, which the console dereferences, throws

• lgamma and signgam (libc) - lgamma returns the host's lgamma and stores the sign of Γ(x) in the exported signgam (NID 5gOOC0kzW0c, starting at 0 as in FreeBSD 11's s_signgam.c) by the rules of e_lgamma_r.c: -1 for -0 and for a negative non-integer whose floor is odd, 1 otherwise, including poles, infinities and NaN. Taken from the FreeBSD source, not measured on the console. The NID is in the aerolib symbol list; no title is known to read signgam. PPSA99004 imports lgamma

• sinhf (libc) follows the sinhf of the libc.prx bundled with PPSA28319 (disassembly): FreeBSD msun's e_sinhf.c from before __ldexp_expf, which squares expf(|x| / 2) between logf(FLT_MAX) and the overflow threshold, calling msun's expm1f and expf, whose paths for the arguments it passes are inlined here. Past the threshold Sony's error helper sets errno to ERANGE before returning x * 1e37; msun itself sets no errno. That code, run on a Windows host, gives the same bits as this implementation for every finite argument up to the threshold, of both signs; it was not run on Linux. That the system libSceLibcInternal, which Ruffle (PPSA68091) and RetroArch (PPSA99169) import while bundling a zero-return libc.prx, has the same code is assumed

• acoshl, asinhl, atanhl, atan2l, cbrtl, erfl, erfcl, expm1l, hypotl, log1pl, log2l, lgammal, tgammal, j0f, j1f, jnf, y0f, y1f and ynf (libc) return the host C library's results (the float Bessel functions through its double ones), not those of the console's own code, so the last bits can differ. As in the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x56410), lgammal does not store the sign in signgam; hypotl returns infinity for an infinite argument even when the other is a NaN, as C11 F.10.4.3 requires. hypot3, hypot3f and hypot3l follow that module (0x51D30, 0x520D0, 0x52420): the first NaN of x, y and z is returned unchanged, any infinity gives positive infinity, a zero argument gives the two-argument hypot of the other two, and otherwise the largest magnitude is combined with the hypot of the other two

• asinl (libc) follows the asinl of the libc.prx bundled with PPSA28319 (disassembly), FreeBSD msun's e_asinl.c with the ld80 invtrig.c coefficients, which the binary holds as the same 80-bit constants. For |x| > 1, the infinities and NaN, Sony's error helper raises FE_INVALID and sets errno to EDOM before returning (x - x) / (x - x), so a NaN argument also sets EDOM; msun itself sets no errno. 20 million random arguments in (-1, 1) give the same bits as that code run on a Windows host. The result needs the x87 precision control at 64 bits, as FreeBSD amd64 starts threads (control word 0x37f), but guest threads do not set it: on Windows a thread started by _beginthreadex runs at 53 bits (0x27f), where asinl(0.75) returns mantissa 0xd91a98ae3406e000 instead of 0xd91a98ae3406e041. The system libSceLibcInternal that RetroArch (PPSA99169) imports is assumed to have the same code

• atanhf (libc) follows the atanhf of the libc.prx bundled with PPSA28319 (disassembly): FreeBSD msun's e_atanhf.c calling msun's log1pf, whose paths for the positive arguments it passes are inlined here; the exported log1pf is still the host's. For |x| > 1, the infinities and NaN, Sony's error helper raises FE_INVALID and sets errno to EDOM before returning (x - x) / (x - x), and for |x| = 1 it raises FE_DIVBYZERO and sets errno to ERANGE before returning x / 0; msun itself sets no errno. That code, run on a Windows host, gives the same bits, errno and floating-point exceptions as this implementation for all 2^32 arguments; it was not run on Linux. That the system libSceLibcInternal, which Dusklight (PPSA99305) imports while bundling a zero-return libc.prx, has the same code is assumed

• getenv, setenv, unsetenv, putenv (libc) keep one guest environment that starts empty, like the environ libkernel exports, and never reads or changes the host's. A title sees only the variables it sets itself; host variables such as HOME and PATH name host paths a guest cannot use (PS5MC, PPSA99420, exits with XBMC_Run returned -1 when it gets the host's HOME). Whether the console starts a title with any variables set is not measured

• mergesort (libSceLibcInternal, implemented in libc) checks its arguments like the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x762D0): an element size under 4 sets errno to EINVAL (22) and returns -1, an empty array returns 0, and a failed malloc of the count times the size plus 8 bytes returns -1. The sort is a stable bottom-up merge, not FreeBSD's natural merge with its insertion sort for short runs, so the comparator is called in a different order and number of times; the result is the same for a consistent comparator. A null base or comparator and a size product that overflows, which the console does not check, throw

• On macOS the write watch write-protects watched pages and records the first write to each from a SIGBUS/SIGSEGV handler, because macOS has no counterpart to userfaultfd write-protect or MEM_WRITE_WATCH. The protection is real, so:

  • a system call that writes into a protected page fails with EFAULT instead of faulting. GuestArena::HostWrite lifts the protection for the calls it brackets (file reads and socket receives); a host call that writes guest memory without it (clock_gettime and the like into a watched page) fails;
  • code that changes the protection of watched pages, or maps over them, has to call GuestWriteWatchProtectionChanged, and code that asks the kernel for a page's protection has to ask GuestWriteWatchProtection first, since a watched page is read-only between a collection and the next write. Nothing calls either yet: the macOS memory paths are not in the tree;
  • the handler is installed when libc loads and passes other faults to the handler installed before it. A handler installed later has to do the same.

• On macOS the guest arena finds host regions with mach_vm_region and reserves the rest with a fixed mach_vm_map, which fails instead of replacing, as macOS has no /proc/self/maps or MAP_FIXED_NOREPLACE. The kernel keeps 0x10_0000_0000-0x70_0000_0000 unmappable for every process (max protection none; macOS 26.5, M1 Pro, arm64 and x86_64 under Rosetta), and dyld and the Rosetta runtime sit near 0x2_0200_0000 and 0x3_0400_0000, so a guest mapping fixed inside those ranges fails where the console places it; mappings without a fixed address are placed around them.

• sceKernelSync (libkernel) flushes only the host files and directories recorded through RecordWrittenPath_nid_no_patch (the libc, libkernel, save data and app content file functions) and their changed parent directories. A host write in a library that does not record its path is not flushed by sceKernelSync

• sceKernelSync (libkernel) on Windows skips a recorded file it cannot open for writing (read-only, or held open by a handle that denies write sharing), since FlushFileBuffers needs a writable handle. On Linux, it skips a recorded file it cannot open for reading. Such a file's data may not reach the disk before a host crash; the guest reads the same data either way

• fopen streams (libc) on Windows share delete access, like the descriptors sceKernelOpen opens, so a file the guest holds open can be removed or renamed. A stream reopened with freopen still goes through _wfreopen, which does not share delete access. On Windows, opening a directory in a read mode fails with EACCES, where FreeBSD opens it; directory streams are not emulated

• The _Unwind_Context that _Unwind_Backtrace passes to its callback starts with a table laid out like LLVM libunwind's AbstractUnwindCursor virtual table, because homebrew built with the ps5-payload-dev SDK links libunwind statically and reads the frames with its own _Unwind_GetIP (__unw_get_reg), which calls through that table. Only register reads and writes (validReg, getReg, setReg, with UNW_REG_IP and UNW_REG_SP), validFloatReg (always false) and isSignalFrame are answered; the other slots throw. The layout follows libunwind's UnwindCursor.hpp, not the console's own libSceLibcInternal, which is not checked

• The Windows libc exception unwinder steps through frames of modules without the project's .ehmeta and .ehfram tables (system DLLs, and WinLibs GCC 15.2's libstdc++-6.dll and libwinpthread-1.dll, whose .eh_frame sections are empty) with their PE unwind data through RtlVirtualUnwind, but does not run Windows exception or termination handlers: it stops at a frame whose unwind data has one, such as a C++ cleanup through __gxx_personality_seh0 in libstdc++-6.dll or a system DLL function like qsort in ucrtbase.dll (Windows 10 22H2), and the exception is then reported as unhandled

• The libc SSE4a trap emulation on Windows is superseded by --to-intel and remains only until the relinked title has been verified without it.

• getifaddrs (libc) lists the host's IPv4 and IPv6 addresses in FreeBSD's ifaddrs and sockaddr layouts. FreeBSD's per-interface AF_LINK entries (MAC, index, MTU) and their if_data are not produced, so interfaces without an address are omitted. Names are the host's (Linux lo, eth0; Windows NDIS names such as ethernet_32769, or if<index> when one does not fit 15 bytes), not the console's. A Linux point-to-point address without a peer loses IFF_POINTOPOINT, and an IPv4 broadcast address the host omits is computed from the netmask. On Windows the flags are only IFF_UP, IFF_RUNNING, IFF_LOOPBACK, IFF_BROADCAST and IFF_MULTICAST, derived from the adapter: PPP and tunnel adapters get neither IFF_BROADCAST nor IFF_POINTOPOINT because their peer address is not reported, and an address whose prefix length the host reports as unspecified gets a host mask.

• gethostname (libc) reports the fixed guest name AnyPS5 without querying the host machine name. Buffer copying, null queries and ENAMETOOLONG follow FreeBSD gethostname; the console's configurable hostname and its integration with sysctl and name resolution are unverified and not implemented.

• wcsrtombs_s (libc) follows the console's libc.prx, but a runtime-constraint violation only returns its error: the default handler there writes the message and a newline to stderr before returning, which is not done here. Conversion uses the C locale of wcrtomb (MB_CUR_MAX 1), so the path where a multibyte character does not fit the remaining space is not reached

• c16rtomb, c32rtomb, mbrtoc16 and mbrtoc32 (libSceLibcInternal, implemented in libc) follow the console's libSceLibcInternal.sprx (SDK 4.5x build of J03950001, 0x7D480 to 0x7D920), which converts to and from UTF-8 whatever the locale, with the original sequences of up to six bytes and no check for surrogates or for values above 0x10FFFF when encoding. The conversion state keeps the value in its first eight bytes and the count of bytes still expected (or 0x10 for a pending low surrogate, 1 for a stored high surrogate) as 16 bits at offset 0xA; a null state, which the console dereferences, throws. As on the console, mbrtoc16 does not store the complete code point when it returns a high surrogate, so the low surrogate of the next call is built from the value the state last held, which is the partial value of an earlier incomplete call or whatever the caller initialised it to, c16rtomb returns -1 without setting errno when a high surrogate is not followed by a low one, and mbrtoc16 and mbrtoc32 report EILSEQ as 86. Measured on a PS5 (firmware 13.60) from a homebrew payload, the system libSceLibcInternal's default locale also converts UTF-8 in wcrtomb, wctomb, mbrtowc and mblen (wctomb of U+263A gives E2 98 BA, mblen of a lone 0xE9 gives -1); this libc keeps its single-byte C locale, so wctomb and mblen, which call wcrtomb and mbtowc here as they call the same internal routines on the console, share that difference. Titles bundle their own libc.prx, whose locale was not measured

• The narrow printf family (libc) converts 16-bit guest wide arguments to UTF-8 on both platforms, independently of the host locale. It does not use the guest's single-byte wcrtomb; the console's treatment of invalid UTF-16 and locale-specific encoding remains unverified. Linux retains host formatting for formats without wide arguments, %m or %p, so a NaN there still follows the host (glibc prints its sign, -nan, and honors the + and space flags, where FreeBSD prints nan); argument positions above 99 (FreeBSD's NL_ARGMAX) throw when a format requires the guest formatter

• %p and %lp (libc) follow the console's libSceLibcInternal.sprx measured from a homebrew payload on firmware 12.70 (#7549), not FreeBSD: bare lowercase hex with no 0x prefix even under #, 0 for a null pointer, + and the space flag ignored, the width counting only the digits, - padding on the right, 0 padding with zeros when there is no precision, the precision as the minimum number of digits, nothing for a null pointer under %.0p, and l accepted. Only snprintf and swprintf of that module were measured, from a payload process rather than a title process, so a width beside %.0p, the 0 flag beside a precision (which C17 ignores) and %.0p of a non-null pointer follow this formatter's own rules and are not measured; swprintf was not run with %lp, so the wide family still refuses that conversion and returns -1. Linux routes %p and %lp to this formatter because glibc prints the FreeBSD form and (nil) for a null pointer, which means a format that combines %p with a conversion this formatter refuses, such as an argument position above 99, throws there instead of reaching glibc

• collate and collate<wchar_t> _Getcat (libc) build the facet for the C locale only and throw for any other locale name, the wide entry point following the narrow one it sits next to. The wide facet carries its own vtable, whose compare, transform and hash take the guest's 16-bit characters, so the length of a range is a count of characters: compare orders by 16-bit value (the C locale, as Dinkumware's char_traits<wchar_t>::compare does), transform copies the characters into the result and records size and capacity in 16-bit elements (inline capacity 7, heap capacity length | 7, (capacity + 1) * 2 bytes including the terminator), following Dinkumware's VC12 basic_string, and hash mixes one whole character per round, so wide text below 0x100 hashes like its narrow spelling and a character above 0xff hashes as one value instead of the two bytes it holds. The console's libc.prx exports both _Getcat (NIDs BSVJqITGCyI and 2wz4rthdiy8) with identical 0x19d-byte bodies, believed to build the same 0x20-byte facet; the console bodies themselves are unreadable (obfuscated dynsym, and the text of the relinked libc.prx is zeroed), so the wide entries follow the narrow algorithm and the C locale instead of the console's wide code, and no console run checks the two. The console's libc.prx stores pointers to its collation state tables at offsets 0x10 and 0x18 of the facet; ours leaves them null, as only the facet's own functions read them. do_transform throws for input with embedded null characters, which the console drops depending on the output buffer size. The narrow result capacity (length | 15) and the over-aligned storage of results of 4080 characters or more follow the console's libc.prx code and are not checked on hardware. No module of the PPSA59322, PPSA76677 or PPSA97358 dumps in this tree imports either _Getcat, so neither has been exercised by a title.

• The scanf family (libc), the _s forms included, on Linux throws for the 16-bit wide conversions (%ls, %lc, %l[, %S, %C): glibc would store a 32-bit wchar_t per character into the guest's 16-bit buffer. Windows hands %ls, %lc and %l[ to the host, whose wchar_t is 16 bits

• The scanf family (libc) on Windows returns 0, as C17 and FreeBSD do, when input fails after only suppressed conversions have completed (sscanf("12", "%*d%d", &value)). Linux hands the format to glibc, which returns EOF there. On Windows the host stops a %x, %X, %i or %p after the x of a 0x that no hex digit follows (or that the width cuts off), and a float conversion (%e, %f, %g, %a) after the e of an exponent with no digits (1e), where C17 and FreeBSD stop before the x or the e

• Guest path resolution falls back to ASCII case-insensitive component lookup, following shadPS4's host filesystem. PPSA03747 requests Skyrim.INI, Data/Video and lowercase archive/plugin names that differ from the dump's filenames. Exact host names take precedence; multiple fallback matches throw instead of selecting an arbitrary file. Existing parent names are resolved when creating a new file, and guest mount aliases use the same ASCII comparison. Results are not cached, so renames and newly created files remain visible. Unicode case folding and PS5 behaviour for case-colliding host entries are unverified; host roots are used as supplied. Explicit native Windows drive and UNC paths bypass guest parent-component validation.. A relinked module's <name>.guest.prx is matched the same way when the original module is not beside it: Borderlands 4 (PPSA01494) loads /app0/prx/libRenoirCore.PS5.prx, which it ships as librenoircore.ps5.prx

• Colons in guest names (libc) - on Windows (NTFS) a guest name containing : is not a plain file name: name:stream opens or creates the alternate data stream stream of the file name. Creating /savedata0/C:file makes an empty file C whose stream file holds the data, and stat of /savedata0/C then reports a regular file. mkdir of a name containing :, such as C: or dir:x, fails with EINVAL. name:stream already behaved this way before drive-letter components were kept under their mount

• tzname (libc) points at the host's zone names, read at load and again by tzset: the abbreviations a TZ string gives (EST5EDT is EST and EDT on both hosts), but on Windows without TZ the CRT's full names such as GMT Standard Time, which ICU's uprv_tzname (ES-DE in PPSA99169) cannot map to a zone ID. A zone with no daylight-saving time has tzname[1] empty on Windows and equal to tzname[0] on Linux, where FreeBSD leaves three spaces. The console's names are not known

• Trailing slash on a mount alias (libc) - on Windows a trailing slash after a file name under a mount alias such as /savedata0 is still dropped, so unlink, rename, open and the other path calls act on the file where FreeBSD 11.4's lookup() fails with ENOTDIR; Linux and macOS pass the slash to the host, as for paths outside an alias

• localtime, mktime (libc) on Windows convert through the CRT's localtime_s and mktime, which accept about 1970 to January 3001 UTC and apply the CRT's daylight-saving rule. A time outside that range is converted a whole number of 400-year Gregorian cycles away, where the calendar repeats, so it gets the rule the CRT applies to that year and not the zone's historical one. gmtime converts every time whose year fits an int on both hosts.

• strftime and asctime (libc) follow FreeBSD 11 strftime.c and asctime.c with the C locale on every host, not measured on the console; other locales are not implemented. %s follows FreeBSD 9 and 11 and is the local-time mktime of the broken-down time (current FreeBSD uses tm_gmtoff), which is -1 on Windows outside the range above. %Z is tm_zone, or tzname[tm_isdst != 0] when it is null and tm_isdst is not negative. The two-digit year warning FreeBSD writes to stderr when CHECK_STRFTIME_FORMATS_FOR_TWO_DIGIT_YEARS is set is not written

• wcsftime (libc) follows FreeBSD 11.4's wcsftime.c over this library's wcsrtombs, strftime and mbsrtowcs in the single-byte C locale of none.c, with the guest's 16-bit wchar_t, without console verification. It has the strftime gaps above. A format unit above 255 returns 0 with EILSEQ; an empty result, a result that does not fit and a null buffer return 0 with errno unchanged, discarding the ERANGE or EINVAL that the Windows CRT's strftime sets. A null format or tm throws, where FreeBSD dereferences it (a null tm is read there only when the format has a conversion that needs it)

• syslog (libc) writes each message to stderr as [syslog:<priority>] <message>, with a newline added when missing, instead of sending it to the console's system log. Priority and facility handling follow FreeBSD's vsyslog: %m expands to the guest errno's message, unknown bits are reported (as priority 0x23, since FreeBSD passes LOG_ERR|LOG_CONS|LOG_PERROR|LOG_PID as the priority) and masked, a missing facility becomes LOG_USER or the facility set by openlog, and errno is preserved. openlog applies its identity and LOG_PID; a null identity retains the previous one, and a valid nonzero facility replaces the default. closelog clears the identity but retains the options and facility, as in FreeBSD 11; when no identity is set, FreeBSD falls back to the program name, which this backend does not emit. LOG_PERROR has no extra effect because stderr is the emulated log sink; LOG_NDELAY/LOG_ODELAY, LOG_NOWAIT and LOG_CONS have no daemon, child or console backend to control. setlogmask follows FreeBSD 11: the process-wide mask defaults to 0xff, zero queries it, and nonzero values replace it; masked messages are skipped before formatting, including the unknown-priority diagnostic. The console's mask behaviour is unverified

• daemon (libc) throws: forking into the background is not supported. PPSA85300 imports it and fails to load without it. VLC 3.0 calls it only when its daemon option is set (libvlc.c), and the title starts libVLC with --ignore-config and without --daemon (player.cc)

• _WStoul, _Iswctype, swscanf_s and swscanf (libc) - _WStoul is wcstoul and throws for a base other than 0 or 2 to 36. _Iswctype takes the class numbers of Dinkumware's xwcc.h (1 alnum to 11 xdigit, 12 blank) and throws for any other value, including the FreeBSD masks wctype returns; the numbering is not confirmed on the console's libc.prx. swscanf_s follows C11 7.29.2.2 and K.3.9.1.5, but reads the size argument as unsigned int like sscanf_s where K.3.9.1.5 specifies rsize_t; the console's width is unverified. A runtime-constraint violation (null buffer, format or receiving pointer) only returns EOF, and a too small array gets a null first element as in sscanf_s. A literal mismatch is a matching failure and a field that is only a prefix, such as 0x or 1e, does not convert, as C11 requires; FreeBSD's vfwscanf reports an input failure for the first and converts the second. Integers out of range are truncated from strtoll/strtoull. It throws for %p, %S, %C, unknown length modifiers, scanset ranges, %n with suppression or width, and narrow %s, %c or %[ input that the C-locale wcrtomb cannot convert. swscanf runs the same scanner without the size arguments of %s, %c and %[, as FreeBSD's swscanf.c passes its arguments to vswscanf, so everything above except the sizes applies to it; it also keeps the null buffer, format and receiving pointer checks returning EOF, where C leaves those undefined. Neither variant is confirmed on a PS5 title

• flock (libkernel) on Windows shares one lock state between duplicated descriptors, following FreeBSD 11.4's flock(2). Independent opens have separate states; closing a descriptor or reopening a stream drops only its reference. Lock transitions on one open file description are serialized. The lock is a host LockFileEx lock on one byte at offset 2^63 - 2, which no file reaches, so it excludes other flock calls and leaves reads, writes and mapped views alone, like FreeBSD's advisory locks. Console behavior, signal interruption and concurrent closure of a descriptor while its lock call is pending are unverified.

• std::_Throw_Cpp_error (libSceAmpr) follows Dinkumware's thread0.cpp as shipped with Visual C++ 2013 and in microsoft/STL, without console verification. _Cpp_error codes 0 to 6 throw a guest std::system_error whose error_code holds the FreeBSD errno of the errc value (EBUSY 16, EINVAL 22, ESRCH 3, ENOMEM 12, EPERM 1, EDEADLK 11, EAGAIN 35) and the generic category, and whose what() is the table message, ": " and the generic category's message for that errno, selected by the first matching errno entry in VC12's syserror.cpp; another code throws std::out_of_range on the host instead of reading past the table. The guest system_error is taken to be VC12's: the 16-byte runtime_error followed by error_code {int, const error_category*}, 32 bytes, so its copy constructor and assignment copy the code too. The generic category is a static libc object with VC12's error_category virtual order (destructors, name, message, default_error_condition, the two equivalent), not the console's _Error_objects<int>::_Generic_object, and the new generic_category() export returns that object; a title's inline category object in a bundled libc can still have a different identity. Its message and direct message export construct the existing GuestLocale::String model: a reserved eight-byte word, 16-byte inline buffer, length and capacity, with guest operator new storage above 15 bytes. This 40-byte string layout and virtual return ABI have not been verified against a console library. The deleting destructor still throws. _Syserror_map covers the 72 distinct Dinkumware errc values present in FreeBSD 11.4 errno.h, returning null for other values; category messages use unknown error for those. First-match aliases are EAGAIN/EWOULDBLOCK -> operation would block and ENOTSUP/EOPNOTSUPP -> not supported. STREAMS-only errno assignments absent from that header (ENODATA, ENOSR, ENOSTR, ETIME) are not inferred

• Call tracing (--trace-imports, APS5_TRACE_CALLS) exists on Windows only and records the entry of a call, not its arguments or its result. One process-wide ring keeps the last 65536 calls, so a thread that calls often pushes the others out. Calls are also counted per traced target since start-up; an import bound to a target already traced under another name is counted under the first name. The thunk saves the integer argument registers and xmm0 to xmm7; arguments in wider vector registers pass only as long as the recording code stays free of AVX instructions, which is not tested

• _Dtest (libc) follows Dinkumware double classification matching _FDtest: finite values return -1, subnormals -2, zeros 0, infinities 1, and NaNs 2.

• app0.zar (libc) - a ZArchive beside app0/ is a read-only layer under it: a path missing from app0/ is looked up in the archive, case-insensitively. It is not a console format; titles ship their files in a PFS image instead. Resolving an archive-only path through any call other than the archive-aware libkernel ones throws, so fopen, stat, access, opendir and the rest do not read the archive yet, and opendir of a directory that exists in both places, app0/ itself included, and fdopen of an archived descriptor throw instead of missing its entries or reading the null device. A damaged compressed block throws instead of returning EIO

• fopen_s (libc) - returns the errno of the failed open, as C11 K.3.5.2.1 leaves the nonzero value open and Microsoft's CRT returns errno; the console's Dinkumware fopen_s is not verified