Use a red-zone-safe, ABI-aligned stack window for pt_call, pt_call2, and
pt_syscall so elfldr_load cannot clobber SceShellUIMain mid-SwapBuffers.
Fix single-step return detection to compare against entry_rsp, and add
inject stage logs for the load/args window.
Allocate unique near trampolines without MAP_FIXED, gate hooks until
install completes, and make pt_attach/pt_call wait and stack alignment
fail-closed so controller use during inject cannot corrupt ShellUI.
Rename product, namespaces, libraries, paths, and assets from Orion/orion
to Onion/onion across the tree. TCP stack-shutdown magic is now ONIO
(0x4F4E494F) to match the corrected branding.
Root fix stays: elevate with PTRACE_AUTHID only. Rename away from
set_ucred_to_debugger so the API cannot imply DEBUG_AUTHID. Remove
pt_attach ECHILD poll loops and multi-attempt toolbox inject — those
were workarounds, not the cause. Keep a single waitpid(WUNTRACED) after
PT_ATTACH.
set_ucred_to_debugger() was using DEBUG_AUTHID (…0006). The kernel only
accepts PTRACE_AUTHID (…00010003 / SceTracer) for PT_*; attach then failed
with waitpid errno=10 (ECHILD) and toolbox inject aborted after liborion_elfldr
stopped per-syscall authid flips.
Also harden pt_attach wait (WUNTRACED + ECHILD retry) and retry toolbox
inject a few times after kstuff settle.
aydencharles