PRAGMATA (PPSA02530): SaveData Prepare/Commit no-ops, ignored Json2 settings and unsupported UDS statistics #8005

Activity

1. Ondra97

   changed the title [-]PRAGMATA (PPSA02530): imported-library audit with binary evidence and tracked implementation gaps[/-] [+]PRAGMATA (PPSA02530): library gaps and contributor tasks[/+] on Oct 19, 2026
2. Ondra97

   changed the title [-]PRAGMATA (PPSA02530): library gaps and contributor tasks[/-] [+]PRAGMATA (PPSA02530): library gaps and tasks[/+] on Oct 19, 2026
3. Ondra97

   changed the title [-]PRAGMATA (PPSA02530): library gaps and tasks[/-] [+]PRAGMATA (PPSA02530): SaveData Prepare/Commit no-ops, ignored Json2 settings and unsupported UDS statistics[/+] on Oct 19, 2026
4. MarcZX10 commented on Oct 19, 2026

   

   MarcZX10

   on Oct 19, 2026

   Contributor

   More actions

   Update on C1 (heap trace table capacity): this finding is now covered by #8049. That PR extends the table from 64 to 65 entries while preserving the LibcHeapInfo ABI, mask, and base slot. Its first commit adds a boundary test that writes the base and final slots; the PR reports that the test reproduces a global buffer overflow at slot 64 under ASan before the fix and passes afterward. This addresses C1 only; it does not validate the other audit items.

   ❤️React with ❤️1Reacted by Ondřej
5. Ondra97 commented on Oct 21, 2026

   

   Ondra97

   on Oct 21, 2026

   ContributorAuthor

   More actions

   Archived audit (historical snapshot).

   Scope and result

   I audited the system-library interfaces referenced by PRAGMATA, PPSA02530, version 01.200.000, using the title's executable/module import registries, title-provided metadata and caller/consumer evidence, AnyPS5 source, existing test sources, technical debt and overlapping pull requests.

   Historical baseline: the original findings/links use 7a015c0946e2f421b7977129dc7fc255a133019b (2026-10-19). Current corrections and C9/C10 below are separately pinned to later source. Installed title files were an older bring-up installation, not a build of the reviewed main.

   Save transactions/icons, Json2 settings/recovery, UDS and gated PSML/signaling remain unresolved. PR status refreshed 2026-10-20; see the ownership table before starting work.

   The original pass was import-driven. Static callers do not prove execution. Round2 ran the parser/recognizer probe; C9/C10 use separate component probes. These findings do not establish the cause of title FPS, memory or shader problems in #6582.

   Contributor handoff: where to start

   Claim a focused item and recheck current main plus the PR table before patching. A confirmed gap is not a complete replacement specification. Some items are ready for a synthetic reproducer; others need API behavior established first. No proprietary assets are required for the proposed public fixtures.

   Library paths below are relative to core/libs/prx/; test links use the audited revision.

   Work items

   ID	Work item	Starting state	Entry point and first useful result
   C1	Heap trace table capacity	Fixed in main: #8049	65 slots, ABI/mask/base slot preserved; boundary test added. Evidence.
   C2	Json2 allocator/configuration	Callback ABI/lifetime first	libSceJson2/Export.cpp, Initializer, Node: establish allocation/configuration ownership; instrument a synthetic allocator. Evidence.
   C3	UDS statistics/rules	Rejected-shape fixture ready; update semantics first	libSceNpTrophy2/src/TrophyPackage.cpp, TrophyStore.cpp: select one aggregation/type/condition family. Actual shapes.
   C4	Save-data transactions	Resource/mode/error contract first	libSceSaveData.native/Export.cpp, SaveData.hpp, Prepare/Commit parameter types: specify lifetime and persistence transitions. Evidence.
   C5	Save-data icon persistence	Buffer/storage contract first	sceSaveDataSaveIcon / sceSaveDataLoadIcon: specify byte/size behavior, then test a mounted round trip. #7785 validation is merged; persistence remains open.
   C6	Audio/media controls	Partly improved; split by API	#7789 AJM ownership and #7567 ACM context checks are merged. Attribute/decoder meanings and command processing remain open. Evidence.
   C7	VideoOut latency/VRR	Field/event semantics first	libSceVideoOut/src/Output.cpp, Event.cpp: specify the 32-byte wait block and event producers; test marker/order behavior. #7814 owns resolution. Evidence.
   C8	PSML / signaling lookup	Reference ABI/behavior first	Establish layouts, outputs/errors and reachability. PSML's PSSR-gated path is not a proven normal-mode startup blocker. PSML, signaling.
   C9	Json2 failure-path ownership	Open fix: #8530	Parser and missing-key insertion lose allocations. Reproduction.
   C10	SSL orphaned connection records	Open fix: #8541	Term invalidates the parent while retaining undeletable records. Reproduction.

   C1: precise boundary and acceptance conditions

   Fixed by #8049, merged 2026-10-20: 65 entries, unchanged 32-byte LibcHeapInfo ABI/mask/base slot, registered slot-0/64 test. The author reports ASan failure before and success after; not rerun here. R2-I retains the original numeric evidence. PRAGMATA reachability/crash remains unproved.

   C2/C3: work without private title assets

   Extend public fixtures in GuestJson.cpp, JsonCopyFailure.cpp and GuestNpTrophyStats.cpp. The latter builds synthetic packages and statistic/rule JSON.

   For example, this minimal statistic definition captures one currently rejected shape:

   {"statDefinitionArray":[{"statId":1,"dataType":"uint64","aggregation":"count"}]}

   The audited parser rejects this aggregation. Establish repeated/duplicate/reset/out-of-range semantics before testing observable updates. Treat the other aggregation/type families, property conditions and conversions separately. Preserve latest/uint behavior and direct _UnlockTrophy.

   For Json2, observe allocator allocation/free callbacks across value/container lifetimes, failure cleanup and default configuration. Preserve old values on allocation failure (#7977). Establish recovery-callback arguments/errors and float-mode meaning separately.

   Requirements before a fix is considered complete

   • State the general contract/reference and add a behavioral regression failing on the baseline and passing after the fix. Distinguish source, title observations and console measurements.
   • Save transactions: validity/lifetime, modes, persistence and failure transitions. Icon PR: byte round trip, sizes, mount state and invalid buffers. Keep the two changes separate.
   • Media: exercise commands, processed data or state transitions, preserving real decode/mix behavior. Accepting return0 alone is insufficient. Respect the ownership table; removing a stop or adding bookkeeping does not prove processing.
   • Follow CONTRIBUTING.md, architecture and debt. Library fixes require the full build and relevant runtime tests. Do not invent success or per-title constants; record unknowns.

   Audit probes and author-reported PR tests are distinguished below.

   Re-review accounting: 100% (922/922 original records explicitly represented). This includes source, data/alias and native-provider checks at their stated scope. Complete SDK correctness is unmeasured: 358 host contracts and 146 native-function semantics remain reference-incomplete. See C9/C10 and the coverage limits below.

   Correctness re-review — 2026-10-20

   This pass re-read implemented behavior, not only missing exports. Source was frozen at 44e3389c882c8ee3249e16933aad6479c3e00d08; the later 30fda0a03a43339037677d3a9f4a021d5b078566 delta was checked. The tested Json2 and SSL files are unchanged there. No production fix or title/console run was made.

   C9. Json2 parse and missing-key insertion leak on allocation failure — reproduced

   Affected imports: Parser::parse(text,size) S5JxQnoGF3E and Object::operator[](String const&) ERuf9y0DY84. Parser construction and ObjectEntry construct raw-owned members before list insertion. A later allocation failure loses those temporaries; the outer cleanup reaches only linked entries.

   An exact-source allocation-budget probe ran 41 processes: 27 clean exits, 14 leak-detection exits, zero unexpected exits. Four success modes and all warm controls were clean; old values/entries stayed valid. After visible cleanup, [1] with budget 2 leaves one allocation of 104 bytes; {"a":1} at budgets 2/3 leaves 32/136 bytes; inserting a missing key at budgets 1/2 leaves 32/136 bytes. Nested input reproduces the same ownership problem. Counts are host requested bytes, not console sizes or process RSS.

   Open fix #8530 constructs parser entries in their owning lists and cleans up failed missing-key insertion. Its expanded JsonCopyFailure.cpp checks parse/callback/malformed/nested inputs, existing values and handlers: the author reports 34 operations/479 forced failures without leaks, with a failing baseline. Tests were not rerun for this update. C2 configuration/recovery remains separate; merged #7977 covers SetType and open #7215 numeric locale.

   C10. SSL Term leaves undeletable private connection records — reproduced

   Affected imports: Term 0K1yQ6Lv-Yc and DeleteConnection HJ1n138CQ2g. Term erases contexts only; FindConnection then rejects their connections before Delete can erase them.

   An exact-source, no-network probe repeated Init → CreateConnection → Term → Delete three times. Term returned 0, Delete returned 0x8095F006, and registry entries grew 0→1→2→3. Contexts were removed, sessions stayed null and socket lookup was called zero times. A negative descriptor deliberately uses the current host model's deferred validation; it does not prove SDK descriptor acceptance. The stored descriptor is not consulted on this path. Only orphaned bookkeeping was measured; larger TLS session/pool retention remains unmeasured.

   Control order Init → Create → Delete → Term returns both calls 0 and records 0→1→0→0, also without socket use.

   Open fix #8541 removes context-owned connection records while preserving in-flight shared ownership and post-Term INVALID_ID. The author reports baseline failure and passing regressions for both cleanup orders, multiple contexts, 32 concurrent cycles and an in-flight callback. Tests were not rerun for this update. Original probes: Windows 11 Pro 26300, Ryzen 9 7900X, 31.7 GiB RAM, GCC 15.2; RTX 4070 Ti SUPER unused. SysV/DWARF setup and source bytes were preserved. No title memory/performance cause is claimed.

   Coverage and remaining unknowns

   All 922 original import records have explicit dispositions: 4 entries in two reproduced defect families, 7 entries in four candidate families, 295 limited/offline models, 358 reference-incomplete host contracts, 90 bounded host/source checks, 6 data/alias checks, 146 native-function provider reviews and 16 native-data reviews. These are row counts, not independent bug counts or a compatibility score.

   Candidate follow-up: AttrGet policy reporting is fixed by merged #8583; socket-close/epoll reuse has open fix #8598; unstarted-aborted NP Auth polling has open fix #8611. Their console contracts remain unmeasured. AudioOut2 construction cleanup remains unvalidated. No title blocker is established; the 922-row accounting retains its original classifications.

   Module closure covers 59 declarations and 60 reachable owned host PRX targets; the extra host dependency is Keyboard. VideoRecording's build/package target exists but is dummy-only; VideoRecordingP is a separate partial target. Supplied sce_sys/about/right.sprx adds four separate metadata imports, including sceKernelMapNamedFlexibleMemory outside the original 922. Its loading is unproven; treat GameRight as title-provided code for conversion/provider mapping. Data-dependent plugin names and complete indirect/runtime loading remain unresolved.

   Import and provider accounting

   Input	Unique library/NID pairs in that importing image	Relocation records
   Executable registry	806	1,654
   Title's guest libc registry	116	117
   Total, preserving importing-image identity	922	1,771

   The executable declares 59 needed libraries. Its 124 records with an empty library name were matched by NID to source/installed exports and narrowed using those declared dependencies, including shared native-library sources. This gives a unique static owner candidate for each of those records; it does not trace a runtime resolver.

   Every registry NID has a candidate export in the inspected installed layout when the title's own module is included. That is export availability, not proof of a working implementation or successful startup. Some records refer to data, not functions; __stack_chk_guard and the IPv6 multicast-address constant must not be called missing functions because a C++ definition scanner cannot identify them.

   The title's libc is a crucial exclusion

   All 162 executable imports declared as libc.prx, accounting for 1,010 relocation records, exist in the converted title-provided libc.prx.guest.prx export table. It contains 2,950 exported NIDs. Of those 162 imports, five are absent from the inspected host libc but present in the title module: 9G6z-nF6njg, B2ZbqV9geCM, Slmz4HMpNGs, hNAh1l09UpA, pA9N3VIgEZ4.

   Source routing searches the matching guest module for a scoped libc.prx import. Its additional shared-host-libc fallback applies to other requested host libraries. Therefore an apparent host memcpy, math, locale or libc thread-helper gap must not be presented as an active PRAGMATA defect merely because that NID occurs in the executable registry. The exact installed executable's runtime-resolved provider addresses were not traced here.

   Similarly, the guest libc's __tls_get_addr import (vNe1w4diLCs) has a throwing host declaration, but the Windows resolver builder emits a guest TLS resolver for this case. It is a false positive for a simple stub/import intersection, not a demonstrated startup blocker.

   The guest module still contributes 109 distinct libkernel NIDs / 110 references, six libSceLibcInternal imports and one libSceSysmodule import. The LibcInternal routes include four exports from that host library and two from shared host libc; the audit includes these transitive requirements.

   1. Save-data transaction operations acknowledge work they do not perform

   Imported API	NID	Main behavior
   sceSaveDataCreateTransactionResource	gjRZNnw0JPE	Returns a counter after initialization; no resource object is created.
   sceSaveDataPrepare	sDCBrmc61XU	Ignores mount point and parameter block, returns success.
   sceSaveDataCommit	ie7qhZ4X0Cc	Ignores the entire parameter block, returns success.
   sceSaveDataSaveIcon	c88Yy54Mx0w	Checks the mount, then returns success without saving the icon.
   sceSaveDataCancel	e6y3WMBYbiM	Unconditionally calls NotImplemented_nid_no_patch.

   Each has one executable relocation. Sources: Commit/resource creation, Prepare/SaveIcon, Cancel.

   Prepare and Commit do not check initialization, parameter validity, transaction identity or mode. Their declared structures contain a resource identifier and mode fields. Mount3 also ignores the transaction resource and system_blocks. These functions are present as exports but do not implement a transaction protocol. The exact console durability, rollback, mode and error-order guarantees remain unknown; this report does not assert observed save corruption.

   Binary corroboration: the title has a real call to Prepare at original VA 0x9FA30F, passing a parameter block whose first word is a resource value and whose second word is 3, and it checks the returned status. At 0x9F8C04 it builds a zero-initialized Commit parameter block, writes a resource value into its first word, calls Commit and checks for a negative result. The containing control flow has conditions; these are static call sites, not an observed save session. The inspected spans match the original SELF bytes exactly.

   Additional limits in the same storage model:

   • Mount3 uses the read-only bit to select opening behavior but does not retain the mode in MountSlot; setParam cannot enforce it. This is a missing mode model. Enforcement of actual file writes through the path alias needs a separate backend check, and the audit did not establish a read-only PRAGMATA mount.
   • Normal mount/search/delete storage is keyed by _sd/<directory> without a user component, while save-data-memory storage is partitioned by user. The current single-local-user setup limits relevance; no cross-user title failure is claimed.
   • Saving an icon is a UI-asset omission; it is not evidence that the title's save-file bytes are discarded.

   Existing debt records synthetic transaction IDs and unknown cancellation/rollback behavior, but does not explicitly enumerate the Prepare/Commit/SaveIcon no-ops. GuestSaveDataCancel deliberately expects a throw. A targeted static search found no direct Prepare/Commit/SaveIcon behavioral tests; existing test names or a passing export check would not establish transaction support.

   Next evidence: capture the title's resource/mode/mount sequence during an isolated save, establish the general console contract, then test observable state/durability and failures. Do not implement a mode-3-only special case.

   2. PSML/MFSR 1100 is imported but cannot generate the title's reconstruction packets

   PRAGMATA has nine PSML import records. Four expose unsupported paths:

   API	NID	Behavior in main
   scePsmlMfsrGetContextBufferRequirement1100	VGjrQa-WqdU	Returns 0x8A810001 before init; throws after init.
   scePsmlMfsrCreateContext1100	fccGInHrj8A	Same.
   scePsmlMfsrGetDispatchMfsrPacket1100	94iBp3KvIuI	Same.
   scePsmlMfsrGetDispatchMfsrPacketSizeInDwords	AHalTX9wFZY	Always throws; declared without parameters.

   1100 exports, packet sizing. The remaining imported setup/release APIs maintain host bookkeeping objects. Their shared-resource blocks are validated but not used to reconstruct an image. Existing debt explicitly acknowledges the guessed memory requirements and unknown layouts.

   A caller establishes more than the import alone

   The routine at original title VA 0x578FE20, 220 bytes, contains:

   1. A call at 0x578FE4B to the packet-size import. It puts a stack uint32_t output address in RSI, preserves its incoming context in RDI and dispatch parameters in RDX, checks EAX as a status, and reads the DWORD count from the output slot after success.
   2. A capacity check against its command-buffer object. A refill callback can run when space is insufficient. If space remains short it returns 0x8A810006.
   3. A call at 0x578FECA to GetDispatchMfsrPacket1100 with RDI = context, RSI = pointer to a stack descriptor containing a cursor and a 32-bit DWORD count, RDX = dispatch parameters.
   4. On successful dispatch it advances the caller's cursor by four times the size-query output.

   This supports a status-returning packet-size query with an output pointer. A future implementation that simply returns a packet length in EAX would not satisfy this caller. The exact types/layouts of the opaque context and dispatch parameters, valid sizes, generated packet semantics and feature-gate reachability remain unresolved. This is ABI/caller evidence, not permission to invent packet contents.

   PSML debt describes similar command-buffer behavior in other titles; the caller above is specific evidence from this PRAGMATA input. GuestPsml currently tests untouched outputs before init and deliberate post-init refusal, not image reconstruction. No relevant PSML implementation PR was found in the captured open-PR inventory.

   Analysis update: Round2-C recovers setup and one named command-producer gate. Runtime execution, other generic writers and the general packet/output contract remain unverified; imports alone do not prove a normal-console rendering blocker.

   3. Imported Json2 options are accepted but ignored; two registered recovery handlers cannot run

   The executable references 58 Json2 NIDs, including these one-reference interfaces:

   Imported interface	NID	Confirmed behavior
   InitParameter2::setAllocator	I2QC8PYhJWY	Stores allocator and user-data pointers.
   InitParameter2::setFileBufferSize	Eu95jmqn5Rw	Stores the size.
   InitParameter2::setSpecialFloatFormatType	WVZBP4IyM+E	Stores the format integer.
   Initializer::initialize(InitParameter2 const*)	IXW-z8pggfg	Checks non-null, ignores every field, succeeds.
   Value::setElementAccessFailureHandler	6tTbrt1O1SY	Registers a handler, but failed access throws instead of calling it.
   Value::setSpecialFloatHandler	bJWBpvGCIJU	Registers a handler, but non-finite serialization throws instead of calling it.

   Configuration, handler registration, missing-element refusal, non-finite serialization.

   Nodes, strings and containers use host allocations; the supplied title allocator is not called. The configured user data, file-buffer size and special-float-format value have no effect. The enum meanings and console recovery-callback arguments are not established, so the current explicit refusals must not be replaced with guessed values.

   The type-mismatch callback and global null-access callback do execute in supported cases. They are not wholly unimplemented. GuestJson checks registered element/special-float handlers are called zero times while the corresponding path throws; those tests document current limits, not completed callback semantics. Json2 debt already records the configuration and handler gaps.

   Merged #7477 adds String/container/iterator/Value methods; its exact diff does not implement these settings or recovery callbacks. Merged #7977 repairs SetType exception safety under host allocation failure; it does not dispatch the title allocator or implement the callbacks. Their debt diff context must not be mistaken for a fix to these paths. Both were checked at the diff level.

   Next evidence: determine which non-default settings and exceptional JSON inputs the title actually uses, establish callback arguments/float modes from an authoritative contract, and test observable allocator calls and recovery rather than just successful registration.

   4. Imported NP signaling group lookup has no implementation

   sceNpSessionSignalingGetGroupFromSessionId, NID UGcXquhVYrY, has one relocation and unconditionally throws. It is declared without parameters, so its input/output ABI is also unresolved.

   The title contains a direct call at original VA 0x87C9118, through PLT 0x8FC3220 / GOT 0xA56DBB8; the inspected caller span matches the original bytes. A direct call still does not establish that an online/session path executes while signed out.

   The library's own debt file does not name this export, but the cross-library Functional entry in Json2 debt does; it is therefore not globally undocumented. GuestNpSessionSignaling tests other connection/context operations, not this lookup. No open PR in the captured inventory changes this library.

   Next evidence: derive the caller's argument/output shape and the console's signed-out behavior before choosing a return code or implementing lookup state.

   5. Online service support is deliberately partial; request success and service availability differ

   These are source-confirmed limitations, not an assertion that signed-out PSN operations should succeed:

   Library / imported operations	Observed source behavior	Boundary / action
   WebApi2: CreateRequest 3EI-OSJ65Xc, SendRequest lQOCF84lvzw, ReadData OOY9+ObfKec	Creation ignores API group/path/method/content and hands out a counter. Send/read/header queries return 0x80553406 UNAVAILABLE; no transport exists.	No request table/response model. Keep explicit offline failures; establish validation and lifecycle separately.
   WebApi2: push registration fY3QqeNkF8k, lxtHJMwBsaU	Hands out IDs without retaining callback/user-data; start succeeds without delivery.	Registration is not implemented callback delivery. Actual signed-out expectations remain unknown.
   Http2: SendRequestAsync A+NVAFu4eCg, WaitAsync MOp-AUhdfi8	Real offline completion queue and optional equeue notification; completion is 0x80436063, no HTTP request is sent. Some option/empty-queue combinations throw.	Conditional unsupported branches, not unconditional stubs. #7658 is now Hmd2-only, not an Http2 fix.
   Http2: ReadDataAsync bGN-6zbo7ms	Returns the network error synchronously and produces no completion.	Async-read/timeout semantics need a reference.
   NP manager: PollAsync uqcPJLWL08M, AbortRequest OzKvTvg3ZYU	Poll always reports finished/signed-out; request ID is ignored. Abort succeeds regardless of ID.	Incomplete per-request lifecycle/validation; title consequence unmeasured.
   UDS/Trophy2 registration and handles	Registration is a no-op; create-handle writes 1. Local contexts, events, trophy package reads and unlock persistence otherwise have real implementations.	Do not call the entire library a stub.

   Sources: WebApi2, send/read and callbacks, push-context callbacks, Http2 completion path, async read/send, NP manager poll. UDS registration/handles: Context and Handle. Trophy2 registration/handles: Context and Handle. Existing GuestNpWebApi2, GuestHttp2, GuestNpManager tests exercise the local/offline model; no network transaction was tested by this audit.

   UDS ignores _UpdateTrophyProgress; trophy-stat support is limited to latest aggregation, uint32/uint64 and simple event-name/property rules. Event handling, rule handling. PRAGMATA ships trophy00.ucp and uds00.ucp, but the bounded resource check found binary containers rather than loose rule XML/JSON. That first-pass header-only limitation is superseded by the actual payload/parser results in Round 2 below.

   6. Entitlement behavior is an offline policy; a suspected trial-flag ABI mismatch was not established

   Imported entitlement Request/Poll interfaces, including unified request jautSRs4OdQ and poll M4XlLFnzQaQ, are declared without parameters and return 0x80550006 SIGNED_OUT. They keep no request objects and do not fill caller structures. Abort/Delete return success without request state. Implementation. Their general ABI and validation remain incomplete.

   GetSkuFlag writes the fixed full-game value 3; GetGameTrialsFlag (y7JD1gfwyfA) writes a fixed uint32 zero with success, rather than reading a license/trial state. This is a fixed local policy, not a license implementation.

   Negative finding: at both inspected trial-flag calls, original VA 0x150F0EA and 0x150FEE2, PRAGMATA explicitly passes a stack-output address in RDI, checks EAX for success and compares that 32-bit output with 1. This is compatible with the current one-output-pointer shape. Other registers being live is insufficient to prove more arguments. The older debt note about four live registers must not be elevated into a demonstrated ABI bug or memory corruption. Additional console behavior and whole-program uses remain unknown.

   7. Imported network/thread interfaces have accepted-but-unapplied controls

   • DNS: sceNetResolverStartNtoa (Nd91WaWmG2w) ignores timeout, retry and flags and performs blocking host getaddrinfo. The request's deadline/retry/mode cannot govern the lookup; a concurrent abort cannot interrupt that host call. Resolver source. This is established debt, not a reproduced PRAGMATA stall. The next test needs a controllable resolver and the title's actual parameters.
   • Threads: imported scheduling/affinity setters retain guest attributes but do not generally apply equivalent host policy. scePthreadSetaffinity (bt3CTBKmGyI) updates stored affinity; its source does not set host affinity. scePthreadMutexattrSetprotocol (1FGvU0i9saQ) accepts protocols 0..2 but does not retain/apply them. Mutex source. Existing attribute tests do not establish scheduling order or priority inheritance.
   • Integrated fixes: at the original baseline sceNetGetSockInfo (hLuXdjHnhiI) could succeed without writing outputs. Merged fix(libSceNet): fill the address and port fields in sceNetGetSockInfo #7959 now writes records; flags/family/statistics limits remain. fix(libkernel): return ESRCH from scePthreadAttrGet for a thread that has ended #7957 integrated thread-attribute liveness/locking; merged fix(libkernel): report current thread scheduling policy in attributes #8583 corrects policy reporting, not host scheduling.

   No scheduling, DNS, performance or memory effect was measured in PRAGMATA during this audit.

   8. Optional input/capture paths contain explicit stops

   Six imported VR-controller functions unconditionally throw if reached:

   NID	Export
   DGCwN1Lmmys	scePadVrControllerSetVibration
   Wf6-PNCyY20	scePadVrControllerSetVibrationMode
   TABucyiW6AQ	scePadVrControllerReadCombinedState
   mbJHDdjhVeY	scePadVrControllerGetDeviceInformation
   v8P+9PRqg10	scePadVrControllerSetTriggerEffects
   AVr6AKXGc0M	scePadVrControllerGetTriggerEffectStates

   Pad source and remaining VR exports. #5038 changes overlapping APIs, but its proposed disconnected-device returns were not validated against a console by this audit. VR engine imports do not demonstrate that a non-VR title path calls them.

   The separate imported scePadSetVibrationMode (W2G-yoyMF5U) stores a mode, but the physical output backend does not interpret it. Stored state and output backend. This is a documented input-device partial, without a measured title effect.

   The imported driver sceAgcDriverRequestCaptureStart (SAfhzJPcjuk) and RequestCaptureStop (FOwvmNlFLjM) also throw explicitly. They are capture-feature gaps, not proof of missing normal draw submission. The 54 Agc and 11 AgcDriver imports were inventoried; this report does not certify all dynamic PM4/shader/resource behavior behind the implemented entry points. Open #8296 proposes unavailable-error returns for capture, plus instrumentation/query-size behavior; no capture/title validation is claimed. Graphics bring-up remains under #6582.

   9. UI, system queries and presentation have narrower models than their APIs

   These are relevant limits, with distinct severity from transaction/save bytes or a hard API stop:

   • sceSystemServiceParamGetInt (fZo48un7LK4) writes zero and succeeds for every unknown parameter ID. Source. However, the five direct call sites found in this executable pass IDs 1, 2, 3, 4 and 5 (language, date/time formats, time zone, summertime), all handled by main. Their inspected bytes match the original SELF. The unknown-ID fallback is a general implementation gap, not an established requirement of these PRAGMATA callers.
   • sceSystemServiceInitializePlayerDialogParam (m5CYKX20wfg) checks non-null and succeeds without initializing the buffer; LaunchPlayerDialog (uaieF+glFPs) displays nothing. Source. Open feat(libSceSystemService): fill the player dialog param as the console does #8337 supplies measured 0x40-byte defaults and tests; LaunchPlayerDialog UI remains absent. Title use is unverified.
   • Notice-screen skip setter does not store state; getter always writes false. SaveDataDialog.native and MsgDialog.native do not show a real choice UI and often finish immediately with a synthetic result. Other sign-in/browser/error/share/store behaviors are explicitly documented UI/offline limits, not newly discovered PSN transport failures.
   • VideoOut's imported latency-control wait eb-gvTYQcoY and start-point setter MCJ8SkzsQxY validate the handle but implement no input-latency wait/measurement. Source. GetOutputStatusWithVrr (gWT7X8H0bYs) returns the normal output status in an 80-byte zero-filled wrapper; the additional console fields remain unmodeled. Source and existing VideoOut debt. Neither proves a frame-rate problem.
   • AvPlayer.native shares the real AvPlayer implementation; it is not a success-only movie stub. Its imported InitEx accepts layouts inferred from references and ignores the thread-parameter blocks. AvPlayer debt. Decoder/clock fidelity and actual title media behavior were not measured.
   • sceRtcGetCurrentNetworkTick (zO9UL3qIINQ) used the local current-tick implementation at the original baseline. Current main maintains process-local clock state; external network-clock synchronization remains unproved. RTC source. No title timing failure was observed by this audit.

   Audio/AJM were inventory-only in the first pass. Round 2 below adds source review of all 62 imported audio/media NIDs, with selected byte-verified caller analysis; no audible output, codec equivalence or title playback was tested.

   Existing work: avoid duplicate fixes

   States checked 2026-10-20. Seven added PR diffs/tests were reviewed at the heads below. Tests are author-reported, not rerun here; their full Build jobs were skipped. Historical evidence keeps its original revision boundaries.

   PR	Status	Existing ownership / remaining boundary
   #8049	merged	C1:65-slot table and boundary test; title reachability unproved.
   #7959	merged	GetSockInfo outputs; implementation still has explicit enumeration/flag/IPv6/statistics limits.
   #7957	merged	Thread-attribute liveness/registry locking and ended-thread error behavior.
   #7756	merged	Measured SSL defaults, read/timeout/close/error semantics; SSL already has real Mbed TLS transport.
   #7597	merged	NP country/online-ID null-output validation.
   #6990	open	Explicit local offline account ID; does not create a signed-in PSN identity.
   #6313	open	Save-data conversion completion events.
   #7960	merged	Save-data block-count/64 KiB quantum correction; the PR's reference evidence is not a hardware measurement made by this audit.
   #7785	merged	Null validation for SaveData Umount2/LoadIcon/SaveIcon; does not make SaveIcon write icon data.
   #7477	merged	Json2 method coverage; does not implement the configuration/recovery-callback gaps above.
   #7977	merged	Json2 SetType allocation-failure exception safety; does not call title allocator callbacks.
   #5038	open	Pad exports/VR disconnected behavior; proposed semantics remain a separate validation question.
   #7856	merged	GameUpdate initialization/lifecycle validation.
   #7789	merged	AJM batch/context ownership; other lifecycle/priority gaps remain.
   #7567	merged	ACM context checks/bookkeeping; no command processing.
   #7680	merged	First paused video picture; not InitEx/PostInit settings.
   #7574	merged	Primitive touch events; not full gesture recognition.
   #8530	open, d28dc66e25f3	C9 parser/missing-key allocation ownership; C2 remains open.
   #8541	open, 15afb8647337	C10 context-owned SSL connections and in-flight lifetime.
   #8583	merged, ad1650686c06	AttrGet stored policy; host scheduling unchanged.
   #8598	open, c7032e6acf8c	Epoll close/reuse and stale wait snapshots.
   #8611	open, 6ce64bdfae1f	NP Auth Poll/Wait require a started async request.
   #8296	open, 22cd2ec5c711	Capture unavailable errors, instrumentation and query sizes.
   #8337	open, fe04a3c299a7	Player-dialog initializer bytes; no dialog UI.
   #7625	merged	AMPR null command-buffer validation.

   Other open references: #7881 (controllers/users), #6797 (non-imported keycode), #7814 (VideoOut resolution), #7215 (Json2 locale), #7412/#7622 (media details/worker FP), #7064 (ACM priority). #7658 is Hmd2-only.

   Reproducible evidence and validation limits

   Input identities

   Artifact	Bytes	SHA-256
   eboot.bin	217,934,438	2f75ba7ec4dacd9a763e0bac541e42b19d9a0ba010cbc443fe930b30dd5c3277
   libc.prx	1,882,818	03f2202ca1cbd497e136bc47a91e65677b0e8d7e4ae0fe3dea67b0e8f7b609cf
   PRAGMATA.exe	223,804,928	8d4c60c8ac845041603b34e289bd69a85842d8ff7c92a0734cd9e9bd8f45d3d5
   libc.prx.guest.prx	2,053,632	3b5de2b505af2378668871d287a50e9c8313736a38469523ef80c3a33236495e

   Registry SHA-256 values:

   • Executable: 0a3952389b2a46c3c5dfc07d7c9bde73a6f169061d01ab285fdfa33944d6cc6a.
   • Guest libc: 98f4ae6c539e8e600c981f4a959e8b1d58079092ee46297a9f6ff9cb589987dd.

   Input identities and source/caller evidence are retained below. No title payloads or account data are attached.

   Calling contracts and coverage

   The title uses the guest SysV AMD64 calling convention. Host Win64 parameter conventions are not interchangeable. Caller/consumer claims below identify original locations, arguments and output use; selected regions were matched to the original input bytes. They are static observations, not measurements that a title path executed. Whole-program control flow and all indirect targets have not been established.

   Original inventory conservation was checked: 806/1,654 plus 116/117. Provider records were inspected as data; existing tests were read, with no CTest rerun. C9/C10 specify separate new component probes. No production implementation, branch, commit or PR was created for this audit.

   Coverage by library

   NIDs / refs is counted separately per importing image. Empty-library imports are assigned only as the static source/provider candidates described above. Zero means no direct record in either supplied registry; dynamic loading or indirect use is not excluded. Inventory coverage does not mean every contract in a library was semantically validated.

   All 59 declared dependencies, including transitive guest-libc imports

   Declared dependency	Executable NIDs / refs	Guest-libc NIDs / refs
   libSceAcm.prx	6 / 6	0 / 0
   libSceAgc.prx	54 / 54	0 / 0
   libSceAgcDriver.prx	11 / 11	0 / 0
   libSceAjm.native.prx	18 / 18	0 / 0
   libSceAmpr.prx	11 / 11	0 / 0
   libSceAppContent.prx	7 / 7	0 / 0
   libSceAudio3d.prx	0 / 0	0 / 0
   libSceAudioIn.prx	0 / 0	0 / 0
   libSceAudioOut.prx	21 / 21	0 / 0
   libSceAudiodec.native.prx	0 / 0	0 / 0
   libSceAvPlayer.native.prx	17 / 17	0 / 0
   libSceCommonDialog.prx	1 / 1	0 / 0
   libSceContentExport.prx	2 / 2	0 / 0
   libSceConvertKeycode.prx	2 / 2	0 / 0
   libSceErrorDialog.prx	5 / 5	0 / 0
   libSceFiber.prx	0 / 0	0 / 0
   libSceGameLiveStreaming.prx	2 / 2	0 / 0
   libSceGameUpdate.prx	5 / 5	0 / 0
   libSceHttp2.prx	16 / 16	0 / 0
   libSceIme.prx	9 / 9	0 / 0
   libSceImeDialog.prx	6 / 6	0 / 0
   libSceJson2.prx	58 / 58	0 / 0
   libSceLibcInternal.prx	0 / 0	6 / 6
   libSceMouse.prx	4 / 4	0 / 0
   libSceMsgDialog.native.prx	8 / 8	0 / 0
   libSceNet.prx	28 / 28	0 / 0
   libSceNetCtl.prx	5 / 5	0 / 0
   libSceNpAuth.prx	5 / 5	0 / 0
   libSceNpCommerce.prx	10 / 10	0 / 0
   libSceNpEntitlementAccess.prx	15 / 15	0 / 0
   libSceNpGameIntent.prx	4 / 4	0 / 0
   libSceNpManager.prx	16 / 16	0 / 0
   libSceNpSessionSignaling.prx	10 / 10	0 / 0
   libSceNpTrophy2.prx	6 / 6	0 / 0
   libSceNpUniversalDataSystem.prx	14 / 14	0 / 0
   libSceNpUtility.prx	0 / 0	0 / 0
   libSceNpWebApi2.prx	24 / 24	0 / 0
   libScePad.prx	22 / 22	0 / 0
   libScePlayGo.prx	9 / 9	0 / 0
   libScePlayerInvitationDialog.prx	5 / 5	0 / 0
   libScePsml_debug.prx	9 / 9	0 / 0
   libSceRazorCpu.prx	1 / 1	0 / 0
   libSceRemoteplay.prx	0 / 0	0 / 0
   libSceRtc.prx	4 / 4	0 / 0
   libSceSaveData.native.prx	17 / 17	0 / 0
   libSceSaveDataDialog.native.prx	7 / 7	0 / 0
   libSceShare.prx	9 / 9	0 / 0
   libSceSharePlay.prx	4 / 4	0 / 0
   libSceSigninDialog.prx	4 / 4	0 / 0
   libSceSsl.prx	9 / 9	0 / 0
   libSceSysmodule.prx	2 / 2	1 / 1
   libSceSystemGesture.prx	9 / 9	0 / 0
   libSceSystemService.prx	11 / 11	0 / 0
   libSceUserService.prx	7 / 7	0 / 0
   libSceVideoOut.prx	21 / 21	0 / 0
   libSceVoice.prx	0 / 0	0 / 0
   libSceWebBrowserDialog.prx	6 / 6	0 / 0
   libc.prx	162 / 1010	0 / 0
   libkernel.prx	88 / 88	109 / 110

   Round 2: deeper analysis and actual title data

   This continuation closes several first-pass inventory-only areas. It preserves the distinction between an observed static caller, a read-only parser replay, an implementation limitation, and an unverified runtime consequence. No fixes, title execution, GPU/audio playback, or console measurements were performed.

   Round2 source was pinned to 7a015c0946e2f421b7977129dc7fc255a133019b. A follow-up fetch reached 68447804dad58653ca21ce0c1263b761047ad8e4; its ten-file delta was reviewed. It changes host libc locale/stream support and relinker null-symbol handling, not the audio, media, trophy/UDS, Json2, PSML, VideoOut or Sysmodule implementations analyzed below. The original input identities remain unchanged.

   R2-A. Actual UDS payloads expose unsupported statistics and rules

   The earlier header-only check is superseded: both UCP containers contain directly readable JSON. No decryption or key was required. A small read-only probe compiled from the baseline TrophyPackage.cpp and UdsEvent.cpp successfully read all 19 JSON documents, all 14 trophy locales, and all 36 trophy definitions. It executed the existing repository parsers, rather than only a replacement parser.

   For these exact inputs, the baseline accepts 0/53 statistic definitions and 0/59 extraction rules:

   Actual aggregation/type	Definitions	Rejection
   collection / enumSet	9	Unsupported aggregation
   eachLatest / enumStatusSet	6	Unsupported aggregation
   latest / enum	2	Unsupported type
   latest / enumSet	1	Unsupported type
   count / uint64	35	Unsupported aggregation

   The real parser returned skip diagnostics for 50 aggregations, three types, 55 property conditions and four unsupported output statistics: 112 total. All 55 property conditions are outside the parser's event-name-only rule support. The remaining four rules target an already rejected collection statistic. Twelve rules also contain conversions, but are rejected before conversion could matter. Definition and rule readers.

   This is not a finding that trophies cannot unlock. All 35 non-platinum trophies are non-progressive and have the shape accepted by the separate direct _UnlockTrophy path. The probe called the actual event recognizer with synthetic int32 trophy IDs from those definitions: 35/35 recognized. Recognition and dispatch route those events directly to local trophy recording, bypassing statistic extraction. Persistence, platinum completion and actual title event emission were not executed by this probe.

   The schema contains _UpdateTrophyProgress, but these packages have zero progressive trophies and zero extraction rules for that event. Its schema presence is not evidence of blocked game progression. The demonstrated gap is UDS activity/statistic rule coverage for real title data; the general aggregation/condition semantics still require an authoritative contract.

   Input SHA-256: trophy UCP 9b17911265f14a8d1197e7195971b94732d3b0a0f202a5b05407276d63d163ae; UDS UCP 34902f31243854c24b3e8c10f650e98eb12158ce9353b007736e44099105e708. The two originals were unchanged after the probe. No proprietary JSON body, image or binary payload is attached.

   Validation boundary: the final three-translation-unit parser/recognizer probe exited 0. An optional full exported PostEvent probe did not build in this standalone MinGW unwind setup; it was excluded without adding an unwind stub. Full dispatch/store conclusions above are static source/data evidence. Existing CTest suites were not rerun.

   R2-B. Json2 receives a real custom allocator and non-default settings

   The original title routine [0x1523E60,0x1523FDF) calls the Json2 parameter constructor and then supplies:

   • Allocator: a non-null title-owned object (self), with null user data, at call 0x1523FA9.
   • File-buffer size: 0x4000, at 0x1523FB6.
   • Special-float format: 2, at 0x1523FC3.
   • Initialize: the resulting parameter object, at 0x1523FCE; its status is stored by the title.

   Five original RELATIVE relocations independently identify the allocator object's virtual-method targets. The allocation/free slots lead to real guest forwarding routines; they are not null placeholder callbacks. The converted allocation routine has a 12-byte TLS rewrite, so that callback was analyzed from its original SELF bytes, not assumed identical to the PE.

   Main's configuration setters/initialize store those values but initialization ignores them. This upgrades the first-pass import-based concern to a concrete non-default title configuration that is accepted without effect. It does not prove that callbacks executed, that format 2 has a particular NaN/Infinity meaning, or that an exceptional JSON input occurred during a game run.

   R2-C. A concrete Trinity/requested-option gate narrows the PSML finding

   The byte-verified renderer constructor [0xE57340,0xE579C5) starts object flag bit 28 clear. At 0xE5772F, a nonzero result from sceKernelIsTrinityMode causes that bit to be set; a zero result leaves it clear. A separate requested-option byte is copied from constructor parameter offset 0xD6 into object offset 0x844.

   The inspected initialization chain tests bit 28, then object byte 0x844 == 1, before calling the PSML setup helper at 0xE69604. Current main's kernel Trinity query returns zero. Thus the current main result skips this demonstrated PSML initialization chain. The missing packet/1100 APIs remain real implementation gaps, but their imports must not be presented as normal-mode startup blockers.

   This is local control/data-flow proof, not a global proof that no other object writer, entry point or dispatch path can enable PSML. The opaque dispatch/context contracts remain unresolved.

   The separately inspected dispatch route selects command kind 0x1C, subtype 15, then reaches 0x206311 -> 0x8B7B120 -> 0x578FE20. Its case/leaf do not repeat the setup gate. RDS-guided analysis now identifies a gated producer: PSSRCore::executePSSR checks availability byte 0x845 before calling RenderContext::ps5Extention at 0x8BC7242 with type15. That writer allocates kind0x1C and stores subtype15 at record+0x10. The constructor clears byte0x845; setup sets it only after successful initializePSSR. Main's zero Trinity result therefore also blocks this demonstrated producer chain. Seven complete functions / 5071 bytes match SELF. This does not certify every generic writer/flag writer or prove global/runtime unreachability, and does not make the missing packet APIs safe to omit.

   R2-D. Static dependencies do not capture every module/symbol request

   The original executable has 33 verified direct Sysmodule-load sites and 22 unload sites, with 30 distinct constant load IDs. All 55 argument/call spans were checked against the SELF. One load is ID 0x85 (libSceVideoRecording) at 0x1E9D2D7, outside the 59 declared needed-library names. It occurs beside Share/GameLiveStreaming/SharePlay requests. Module ID table and load bookkeeping distinguish a known-ID counter increment from a real module open. The inspected installation has no exact libs/libSceVideoRecording.prx file; neither execution nor a missing-DLL startup failure is established.

   A separate complete, byte-matched helper [0x564FC10,0x564FD06) calls real sceKernelLoadStartModule, then sceKernelDlsym for g_pAKPluginList. Its computed NID 82XiaP80JDo is absent from both import registries. The caller checks the returned symbol pointer and dereferences this Wwise plugin-list data symbol.

   Its filename is built from a configured/default prefix, a parsed entry name and .prx; the inspected path does not establish a fixed PRX basename or runtime file availability. Kernel module open performs a real dlopen, unlike Sysmodule bookkeeping. These requests expand the analysis beyond static import accounting; they do not add new relocation records to the 922-pair/1,771-reference total.

   R2-E. Audio/AJM/ACM and AvPlayer now have detailed source/caller coverage

   Source was reviewed for all 62 imported NIDs in this group, with selected byte-verified caller analysis: 21 AudioOut, 18 native AJM, six ACM and 17 native/shared AvPlayer. Legacy AJM declaration stubs were not mistaken for the title's native provider. Decode/mix/playback paths exist; the following gaps must not be generalized into "all audio is a stub":

   Area	Source and concrete evidence	Boundary / overlap
   ACM command processing	StartBuffers still ignores commands; merged #7567 adds context checks/error clearing. Wait still ignores batch/timeout. Reverb/panner builders return success without encoding. Priority throws.	Known debt. At 0x575ABCB the title explicitly sets RDI = batch-object pointer, ESI = 1; the full prototype/second-argument meaning is unverified. #7064 merely removes the throw and returns 0; #7567 is merged: bookkeeping, not processing.
   AudioOut2 context attributes	At 0x5650005 the title supplies one attribute: ID 2, size 4, uint32 value 1. Main's setter traces and returns 0 without applying it.	Attribute meaning/audible consequence remain unknown. Supported-attribute masks honestly advertise no context features.
   Mastering	Init/SetParam contain no mastering stage. The title passes the same nonempty blob for output IDs 0, 2, 1, with flags 0.	No measured audible consequence; #7658 is now Hmd2-only.
   Native AJM lifecycle	Real PCM/Opus/AAC/ATRAC9 decode exists, but Finalize and module registration are no-ops; instances are not owned by validated initialized contexts. BatchStart is synchronous and ignores priority.	#7789 is merged: batch ownership/context checks, not asynchronous priority or full lifecycle. Codec-specific unsupported cases remain explicit.
   AvPlayer InitEx/PostInit	Title uses init size 0x230, nonzero thread priority/affinity fields, then a PostInit block with first word 0x200000, word +8=1 and nonzero video-decoder bytes. Main applies only the first PostInit demux-buffer field.	Ignored thread blocks are known debt. Nonzero video-decoder settings are ignored; HTTP fields are also ignored in source, but a nonzero HTTP request was not established. Opaque meanings remain unknown.

   Exact source/table evidence is retained locally for every one of the 62 NIDs. Representative sources: ACM, AvPlayer PostInit. Four inspected caller spans totaling 2,276 bytes match the original SELF exactly. This is static caller evidence, not playback or codec-output validation. #7680 is merged for the first paused picture. Open #7412/#7622 concern stream-info/worker-FP-state; none implements these settings.

   R2-F. Whole-file metadata and native symbol roles are now quantified

   All 328,652 executable FDE index records decoded with zero failures. The supplied RDS has 328,756 names/93,516 dictionary tokens; all 328,652 indexed starts/sizes match, with 104 additional named records. This is metadata coverage, not complete function/control-flow or runtime proof. RDS SHA-256: 9cc1610e14c9e8ba4fac7a3e62848a53fa91265bbe7b006846b3adc5ff518a81.

   The 162 imported native-libc NIDs comprise 146 FUNC and 16 OBJECT entries, with nonzero sizes/distinct addresses. These roles do not establish every function's semantics or turn data objects into missing functions.

   R2-G. VideoOut latency parameters, event producers and working controls

   All 21 imported VideoOut NIDs now have source/helper/test/debt review and a per-interface local table. New byte-verified evidence strengthens the latency finding: the title's marker wrapper increments a uint32, passes it to LatencyMeasureSetStartPoint, and both inspected WaitBeforeInput callers prepare a 32-byte block in RSI (word0=1, marker-minus-one at +8, another context value at +0x10) with EDX=0. Main's one-handle declaration ignores that block and performs no wait. The full console prototype and meanings of those fields remain unknown. Latency implementation.

   VRR event registration/teardown have real bookkeeping, but the driver has no VRR-transition producer; the output-status extension remains zero-filled. Output-mode events are initially delivered and respond to host HDR-generation changes, while ConfigureOutput itself does not emit that event. Accepted guest flip-mode values share the same presentation policy. Output-resolution reporting is derived from configured buffer dimensions; #7814 already owns the correction, while #7879 was closed without merge.

   Negative findings: SetFlipRate actually affects reservations/pacing as rate+1 vblank intervals; ConfigureOutput actually selects emulated 59.94/119.88 Hz cadence; buffer registration, flips and flip events have real effects. The title's inspected configuration caller selects supported mode 1 or 15, so this is not evidence of an unknown-mode failure. Four complete functions / 505 bytes match the SELF exactly. No GPU presentation or latency measurement was run.

   R2-H. AGC/driver review distinguishes real commands from ignored controls

   All 54 Agc plus 11 AgcDriver imported NIDs now have per-interface source/helper/debt coverage. Packet encoders advance checked caller buffers and write/patch real command words; shader helpers transform/register metadata; submission queues and EOP event delivery have actual implementations. A successful return after command encoding is not an empty stub merely because the GPU executes the command later.

   Specific limits include SetHsOffchipParam discarding its three values, and SetTFRing retaining queryable base/size without publishing guest tessellation-factor results. Capture exports throw at the baseline; open #8296 proposes unavailable errors. Debug RegisterOwner/Resource return an unavailable error, not made-up success.

   Conversely, Init_0090's validated-but-unchanged state and DebugRaiseException's logger behavior are explicit existing models/debt; their names alone do not establish a new title bug. SuspendPoint enqueues a real asynchronous driver boundary; it is not a synchronous caller wait. This API-level coverage does not certify every dynamically submitted packet, shader instruction, image/cache transition or hardware result; those live graphics questions remain separate from this audit's source-contract conclusions.

   R2-I. Transitive libc contracts and a conditional heap-table capacity mismatch

   All six LibcInternal imports in the title's libc were traced through their installed provider candidates, original thunks and 11 decoded direct-call sites. The two diagnostic exports provide reduced logging; the caller separates heap-error reporting from its own fatal handling. The three TLS/destructor exports have real registration/run/filter state. HeapGetTraceInfo provides real writable shared mask/table pointers: the guest retains and modifies them, so initial zero values are not evidence of an empty stub. Twenty-two inspected spans / 3,236 summed bytes including overlap match both the extracted ELF and the original module SELF, with zero differences.

   Original capacity mismatch (fixed by #8049): host heap backing storage has 64 uint64 table elements, valid indices 0..63. The native consumer writes the base heap to index 0, then its mask-based extra-mspace allocation can select 1..64, requiring 65 slots for the entire observed index set.

   In the complete inspected native allocation routine [0xBF30,0xC7C1), no local cap63, reserved high mask bit, or table-pointer minus-eight adjustment was found. Under an otherwise admitted creation, non-null returned pointers and a successful CAS with old mask 0x7FFFFFFFFFFFFFFF, the nonzero first-free-bit branch yields trailing-zero count 63, then increments to index64. The table write is at byte offset 512, beyond the host's 512-byte allocation. The base slot and mask allocation are distinct, and observed initialization clears the mask.

   C1 follow-up: #8049 is merged; 65-slot storage and a boundary test are in main. The original no-matching-PR search predates that fix. Actual PRAGMATA reachability remains unproved.

   R2-J. Original validation and execution limits

   Round2's parser probe used Windows11/MinGW15.2, Ryzen9 7900X and32GiB RAM; the RTX4070TiSUPER was unused. Three older mixed-build logs (3.51MB) show PSML loading but not command production; absence is not proof of nonexecution. Opaque SDK contracts, indirect paths and title reachability remain unresolved. C9/C10 describe separate new exact-source probes.

   AI-assisted: yes.