AnyPS5/docs/dev/TechnicalDebt.md

Project technical debt

Entries about one library or component are in debt, one file per library or component, under the same sections as this page. Entries that belong to none stay here.

Build

• Building on Windows requires a specific version of mingw - MinGW-w64 GCC 15.2.0 (winlibs-gcc15, x86_64-ucrt-posix-seh)
• Even compiled prx libraries on Windows require nearby (static linking of these dependencies causes conflicts):
  • libgcc_s_seh-1.dll
  • libstdc++-6.dll
  • libwinpthread-1.dll

Direct memory

• Windows direct-memory backing reserves a paging-file section and commits each mapped guest page before setting its protection. Committed physical contents remain in the section across unmap/remap and are released when the backing and its remaining views are destroyed; commitment is not recovered merely by unmapping a page. Linux retains its existing backing. Peak gameplay memory and Windows versions other than the tested host remain unverified.

Silent stubs

Throughout the project, every function at every stage either does exactly what it's supposed to or throws an exception. Everywhere... except:

Unknown function info

• getlogin_r (libkernel) returns the host effective account name: GetUserNameW as UTF-8 on Windows and getpwuid_r(geteuid()) on POSIX. A valid account returns a name even without a login session; host getlogin_r, USER and LOGNAME are not consulted. The console's login name and behaviour without a session are unknown. Account lookup or encoding failures, a missing or empty account name, and POSIX account records exceeding the 16 KiB lookup buffer throw; there is no replacement name or retry. A short guest buffer returns ERANGE without modifying it, and a null output returns EFAULT.

• sceHttpUriBuild (libSceHttp) retains // for a non-opaque URI independently of the selected fields, following shadPS4. Black Myth: Wukong builds its Scheme header with option 1 and expects http:// or https://. Other partial field combinations follow the PS4 reference and remain unverified on PS5 hardware.

• _Mtx_trylock (libc, NID k6pGNMwJB08) - returns busy for a non-recursive mutex already owned by the caller, assumed to match _Mtx_lock's ownership handling; exact console behavior is unverified.

• nearbyintf (libc, NID c+4r-T-tEIc) uses the host rounding mode, not the console's; console rounding mode state remains unverified.

• _Thrd_sleep (libc, NID jfRI3snge3o) follows the Dinkumware threads library shipped with Visual C++ 2013 (xtime.c) and C11 Annex K, without console verification. It reads a 16-byte xtime (64-bit seconds and nanoseconds) on the guest CLOCK_REALTIME, normalizes the nanoseconds and sleeps through nanosleep, retrying on EINTR, so it is a cancellation point; a null xtime or one whose normalization overflows throws. The console's _Thrd_sleep (disassembled from a title's libc.prx) also takes an optional xtime* of remaining time and returns int; here the sleep is never cut short, so it returns 0 and leaves the remaining time untouched.

• sceCoredumpGetThreadContextInfo (libkernel, NID ShChva57wIM) - declared as a throwing stub. The pointer and size arguments and integer return type follow SharpProspero's PS5 bindings. The context structure and console behavior are unverified; the stub does not read or write caller memory. PPSA01736 imports it

• sceNpAuthGetAuthorizedAppCode (libSceNpAuth) - declared without parameters as a throwing stub; Minecraft (PPSA17221) imports it and fails to load without it. The request parameter and code output are not known, and there is no PSN sign-in for it to succeed against.

• sceSaveDataUnknown_RvID8BVeg (libSceSaveData.native, NID RvID8BVeg+g) - declared without parameters as a throwing stub; Minecraft (PPSA17221) imports it beside sceSaveDataTransferringMountPs4 and sceSaveDataDirNameSearchPs4 and fails to load without it. No name in aerolib or among the PS4-migration variants tried with tools/nid_names.py hashes to it.

• sceNpWebApi2PushEventAbortHandle (libSceNpWebApi2, NID 1OLgvahaSco) is a throwing stub. The two signed 32-bit handle arguments and return type follow shadPS4 (PS4); the PS5 signature and abort behavior are unverified. PPSA01736 imports it.

• sceNpGetSandboxInfo (libSceNpManager, NID ZVZ++68nNI8) - the name hashes to the imported NID (found with nidhunt, confirmed with tools/nid_names.py). STAR WARS: Galactic Racer (PPSA28416) imports it; its OnlineSubsystemPS5 calls it with one pointer to a 0x50-byte stack buffer and reads the buffer as a string (discussions/3086). The returned string, the exact parameter struct and console errors are unknown, so every call throws without reading or writing caller memory. A working implementation belongs with that title's bring-up.

• sceKernelGetSystemSwVersion (libkernel) reports baseline system software version 0x01000000 ("01.000.000") for ProsperoStore (PPSA99000). The 0x28-byte layout (uint64_t size at 0, versionString at 8 and version at 0x24) matches ProsperoStore's caller, shadPS4, fpPS4 and OpenOrbis. These sources support the structure layout, but not the reported version value: the console firmware version remains unverified. The checks are unverified too: a null pointer returns SCE_KERNEL_ERROR_EFAULT and a size other than 0x28 returns SCE_KERNEL_ERROR_EINVAL, while shadPS4 returns success for null and never reads size.

• kern.rng_pseudo (libkernel) - sysctlbyname fills the whole output buffer with bytes from the host's std::random_device and leaves the length unchanged; a write returns -1 with EPERM and a call without an output buffer throws. The only caller seen is mbedTLS's mbedtls_hardware_poll in the catalog's ProsperoLight boilerplate, which asks for 64-byte blocks and fails if fewer come back. The console's generator, its per-call maximum and its answer to a size query are unknown

• kern.sdk_version (libkernel) - sysctlbyname reports the system software version as the 4-byte value 0x01000000 (1.00), the value sceKernelGetSystemSwVersion reports; a write returns -1 with EPERM. The major version is byte 3 and the minor version byte 2, in hex digits that read as decimal (13.60 is 0x1360xxxx), as Capy Mobile (PPSA92280), remote_lua_loader and the lapse payload read it. Capy Mobile only displays it. The console's firmware version is not modeled and the low two bytes are unknown

• PPSA01530, PPSA23827 and PPSA13356 imports declared without parameters, signatures unknown, added without an implementation because the titles fail to load without them: sceNetShowIfconfig (libSceNet), sce::Json::Value::setNullAccessCallBack (libSceJson2), kqueue and kevent (libkernel), and scePadUnknown_n3kSX62fgNo (libScePad), whose real name is unknown. _sceUltWaitingQueueResourcePoolCreate, _sceUltSemaphoreCreate, _sceUltMutexOptParamInitialize, _sceUltMutexCreate, _sceUltQueueDataResourcePoolCreate and _sceUltQueueCreate (libSceUlt) forward to the exports without the underscore; that their argument lists match is inferred from the other underscore Ult exports, not measured.

• sceVoiceQoSSetConnectionAttribute (libSceVoiceQoS, NID KCGOxg8iX7s) is a throwing stub declared without parameters, like the other endpoint calls of the library: PPSA04159 fails to load without it and its signature is unknown. The name hashes to the imported NID (tools/nid_names.py)

• Indices far past every vertex fetch (libSceAgcDriver) - when a draw's highest index is at least 64Ki vertices past the largest per-vertex record count, every index past that count is moved to it in a copy of the indices, so the zero-padded vertex copies are not sized to the original index (PPSA04159 draws a list of 0xffffffff with primitive restart off, which asked for 160 GiB). Each attribute fetched by vertex index reads zeros there as at the original index (out-of-bounds select 0 or 1); a draw with another out-of-bounds select keeps its indices. The vertex index the shader sees changes for the moved indices, which a shader that reads it directly would notice

• sceVideoOutGetOutputStatusWithVrr (libSceVideoOut, NID gWT7X8H0bYs) - the name hashes to the imported NID. PPSA26344 version 02.002.000 passes a VideoOut handle and an output pointer at three call sites. It compares a 32-bit value at byte 4 with 2, tests bit 0x10 at byte 16, and, when set, compares low 16-bit values at bytes 48, 50 and 52 with 48, 60 and 120. The full output layout, size, field meanings and console errors are unknown. Every call throws without reading or writing caller memory.

• sceHttp2WebSocketSetPingInterval (libSceHttp2, NID YfaXPnc8PJE) - imported by libdiscord_partner_sdk.prx of PPSA23126 (issue 2648). The parameters, the unit of the interval and the console errors are unknown. Every call throws.

• sceHttp2DeleteCookieBox (libSceHttp2) - imported by PPSA35943's Unity player. The (int cookieBoxId) signature follows SharpProspero. A box sceHttp2CreateCookieBox returned is discarded; an unknown or already deleted id returns the library's invalid-id error (0x817B1100), as prosper does; not measured on a console

• sceKernelGetProsperoSystemSwVersion (libkernel) reports system software version 0x01000000 ("01.000.000"); the console's firmware version is not modeled. The 0x28-byte block (a 64-bit size at 0, the version string at 8 and the packed version at 0x24) follows SharpProspero, which Prospero Multi Tools (PPSA99110) and Prospero Explorer (PPSA99109) are built with and which sets the size to 40, and the same fields in etaHEN and shsrv. A size other than 0x28 returns SCE_KERNEL_ERROR_EINVAL without writing; whether the console checks the size is unverified, since etaHEN and shsrv declare a 0x30-byte block and do not set it

• sceKernelGetAllowedSdkVersionOnSystem (libkernel) reports the system software version with the 12 patch bits set, 0x01000fff, as shadPS4 does on the PS4 and as SharpProspero describes it, which Prospero Explorer (PPSA99109) reads it through; a null pointer returns SCE_KERNEL_ERROR_EINVAL. The console's value and its errors are unverified

• sceSystemServiceLaunchApp (libSceSystemService) - AnyPS5 runs one title and cannot start another, so every call throws without reading its arguments. The (title ID, null-terminated argv, launch parameters) signature follows SharpProspero, whose AppLauncher Prospero Explorer (PPSA99109) and Prospero Multi Tools (PPSA99110) import it through and which passes a 0x20-byte launch context or null; the console's argument checks and errors are unknown

• getuid, geteuid, getgid, getegid and issetugid (libkernel) report the root identity (0) and a process that never changed credentials (issetugid 0), as a jailbroken process has; the host user and group are not exposed to the guest. The values a title sees on a console are unverified

• sceKernelGetAppInfo (libkernel) - only app_id and the title ID (offset 0x10, up to 9 characters plus a terminator) are written; callers declare the structure with different sizes, so the rest is left alone. app_id is 1, the running title's id in libSceSystemService, which is a guess, not something measured. The error codes follow shadPS4: EPERM for another process, and 0 without writing anything for a null pointer.

• libScePlayGo - the chunk set comes from playgo-chunkdefs.xml (every listed chunk plus chunks 0 through the default chunk), otherwise from sce_sys/playgo-chunk.dat, whose plgx header is read as holding the chunk count as a 16-bit value at offset 0x0A and ids 0 to count - 1 are taken as valid. The field was identified on four dumps, where exactly that many 0x20-byte entries follow from offset 0x100 (RIDE 4 PPSA01599: 35, Persona 5 Royal PPSA05110: 25, LEGO Horizon Adventures PPSA14632 and Kena PPSA01802: 1); the rest of the format is not decoded and ids are assumed to be contiguous. Every listed chunk is reported as installed (LOCAL_FAST). Without either file every chunk id is accepted while scePlayGoGetChunkId lists only chunk 0; the console's answer for an id outside the package's chunk table is not checked.

• sceFontSetScriptLanguage, sceFontGetScriptLanguage, sceFontSetTypographicDesign, sceFontGetTypographicDesign (libSceFont) - signatures follow SharpProspero, not confirmed for the PS5. The handle keeps the language set for each script and the feature set for each typographic design and returns them, with 0 for one never set; the console default and its valid ranges are unknown, so any value is accepted. Neither setting changes shaping or rendering yet

• Packed pixel ancillary word (shader recompiler) - the sample index at bits 8-11 and the render target index at bits 16-28 follow #295, and their equality with the SampleId and Layer builtins is inferred, not measured. A value passed through a select, move or phi is rebuilt from those two fields with bits 0-7, 12-15 and 29-31 zero. That is exact only because every read of the word must be an extract inside one modelled field; any other read throws. The other bits are unmodelled and their RDNA 2 layout is unknown: the RDNA 3.5 ISA is reported to give prim type at bits 0-1, VRS rates at bits 2-5 and eye id at bit 7, which was not checked against RDNA 2

• sceAudioPropagationSourceSetAudioPath (libSceAudioPropagation, NID tKSmk2JsMAA) - (uint64_t path, const void* data, float gain) follows SharpProspero and SAROS's call, which passes a handle from sceAudioPropagationSourceGetAudioPath, path data and gain 1.0. Path updates are unsupported and every call throws without reading or writing caller memory. The no-propagation model yields no path handles; path allocation, ownership, rendering and console error codes remain unknown.

• Color comparison descriptor forms: emulated color comparison supports UNORM, SNORM and float formats for 2D, 2D-array and cube views. 8-bit sRGB (Format8Srgb, Format8_8Srgb, Format8_8_8_8Srgb) returns 0 for every compare function, measured with image_sample_c_lz on gfx1035 over references -0.5..1.5 and texel codes 0..255. Anisotropic filters are refused. Bilinear cube comparisons of float, unorm and snorm formats without DISABLE_CUBE_WRAP are refused; on that hardware a 4x4 R32 float cube blends across faces (46 of 90 edge rows differ from a per-face clamp; face 0, ref 0.1, u=3.9 v=2.5 is 0.6016 and u=1.5 v=0.1 is 0.3984), and with DISABLE_CUBE_WRAP the per-face clamp matches. An 8-bit sRGB bilinear cube without that bit returns 0, since every texel comparison is already 0 for every compare function and the selected face cannot change the result. Cube-edge sampling behavior and console coverage on PS5's gfx1013 remain unverified.

• sceNpEntitlementAccessGetEntitlementKey - the three-argument signature, 16-byte key and errors 0x817D0002/0x817D0007 follow KytyPS5; PPSA01521 passes a service label, entitlement label and output pointer. Only the no-key path is implemented: local entitlement labels carry no keys, and the output is untouched on failure. Console error precedence and key provisioning are unverified

• sceNpEntitlementAccess{Request,Poll}{Unified,Service}EntitlementInfo{,List} - signatures unknown; no reference implements them, so they are declared without parameters. The single-item variants copy the behaviour of the list ones, with no source of their own. Like the consume requests in the same library, they report the signed-out NP state with SCE_NP_ERROR_SIGNED_OUT (0x80550006) and write nothing. PPSA15657 calls the unified request during start-up and continues past the error. Whether the console fails at the request or at the poll when signed out is unverified

• sceRudpGetStatus - PPSA01521 passes an output pointer and byte count 0xF8. Measured on a PS5 (firmware 13.60): the status is 0xF8 bytes; before sceRudpInit every call returns RUDP_ERROR_NOT_INITIALIZED, and after it a null pointer or a byte count of 0 or above 0xF8 returns RUDP_ERROR_INVALID_ARGUMENT. The layout matches SceRudpStatus in Vita3K with currentContexts at 0x64 and allocs, frees, memCurrent and memPeak at 0xC8 to 0xD4. Only currentContexts is reported: the traffic counters stay 0 because nothing is sent, and the allocator counters stay 0 because the library does not allocate from the title's pool (the console reports 6 allocations and 0x1260 bytes right after sceRudpInit, and 4 more allocations and 0x3F0 bytes per context). The console also writes currentContexts and the allocator counters when the byte count is smaller than their offset; only the requested bytes are written here.

• sceRudpGetMaxSegmentSize (libSceRudp) - measured on a PS5 (firmware 13.60) in #3073: before sceRudpInit it returns RUDP_ERROR_NOT_INITIALIZED and leaves the value untouched, also for a null pointer; after it a null pointer returns RUDP_ERROR_INVALID_ARGUMENT and a valid one gets 1410 with result 0. The library keeps no configurable segment size (there is no sceRudpSetMaxSegmentSize), so 1410 is always reported. The uint16_t* parameter is inferred: the measurement does not show how many bytes the console writes, PPSA03490 passes a pointer to a 16-bit value and RPCS3 declares the PS3 cellRudpSetMaxSegmentSize(u16 mss), so only 16 bits are written

• sceHttpSetCookieEnabled - the two-argument signature and 0/1 enable values follow VitaSDK and shadPS4; PPSA01521 passes 0 to disable cookies. Disabling succeeds because the offline HTTP backend has no cookie engine; enabling throws. Invalid enable values use the same error as sceHttpSetInflateGZIPEnabled. Like the existing offline HTTP setters, the handle is not validated; requests still fail with the network error. Console behavior is unverified

• sceHmd2Initialize (libSceHmd2) - the error the console returns when the PS VR2 runtime is unavailable is unknown; it returns libSceHmd's UNSUPPORTED_FEATURE (0x81110016). PPSA01317 passes a pointer to 16 zeroed bytes and only tests the result for non-zero

• PPSA01317 imports declared without parameters, signatures unknown: the remaining libSceHmd2 and libSceVrTracker2 exports. Names from the aerolib NID list

• PPSA15878 imports declared without parameters, signatures unknown: the libSceHmd2 reprojection and gaze exports, sceVrTracker2Finalize, sceVrTracker2GetPlayAreaOrientedBoundingBox and sceVrTracker2LocateCoordinateSystem in libSceVrTracker2, and the scePadVrController trigger effect exports in libScePad. Names from the aerolib NID list

• libSceMbus (libSceDeviceService) - signatures taken from PPSA01317, which calls sceDeviceServiceInitialize(3, 0), polls sceDeviceServiceGetEventState(1) and queries again when bit 0 or 1 is set, and calls sceDeviceServiceQueryDeviceInfo_(0x7001, 0, 0, infos, 1, &count, &unknown, 0x70), treating a negative result as an error and count as the number of entries. The host has no devices: the event state is 0 and a query returns 0 with count 0

• NGS2 ATRAC9 waveform loops accepts one integer forward smpl loop. Inclusive RIFF endpoints and encoder-delay adjustment follow vgmstream riff.c. PPSA03747 supplies a 60-byte sampler chunk with one loop, samplerData 24, start 256, inclusive end 299224 and delay 256 for 298969 audible samples. The chunk size and loop count bound the records; samplerData is not interpreted. Output positions are assumed to use audible samples and an exclusive end. Blocks split into an optional intro, a repeated range and an optional tail; zero play count means infinite repeats, positive play count includes the first pass. ATRAC9 ranges include a preceding codec frame for decoder history. The output block layout, repeat-count mapping and error codes are unverified on hardware. Multiple, reverse, alternating and fractional loops throw.

• NGS2 submixer UserFx (control 0x20000004) invokes the title's callback after input mixing on every playing grain, including silence. The 40-byte control and 48-byte process context follow shadPS4. PPSA03747 installs a peak-meter callback; its code confirms the channel pointers, user data 0, channel count, grain size and sample-rate offsets and returns 0. Other user data words are preserved. Flags are assumed to be 1 after registration/restart and 0 thereafter, following UserFx2's first-process convention; this callback does not inspect them. Null handlers disable the effect, setup clears it, and nonzero callback results throw. These lifecycle and error semantics are unverified on console hardware.

• NGS2 ATRAC9 streaming keeps waveform duration and skip counts across compressed input blocks. The shared APPEND flag (2), called ONLY_DATA in the compressed-data reference, ignores an ATRAC9 continuation block's sample, skip and repeat counts, following KytyPS5; PPSA03747 confirms a 262044-byte initial buffer declaring 11310532 samples, followed by 16384-byte buffers with flags 3. Incomplete superframes are retained until more input arrives. Input-block completion callbacks allow refills; the final callback of a logical waveform waits for its buffered PCM to drain, preserving the existing complete-block repeat behaviour. This buffering, callback timing, decoded-byte accounting and starvation silence are unverified on hardware. A closed ATRAC9 stream ending before its declared samples throws; fragmented ATRAC9 waveforms with repeats are unsupported. PCM streaming retains its existing append validation and early-close behaviour.

• PPSA01341 imports declared without parameters, signatures unknown: sceAgcSetSemaphoreMemory. Name from the shadPS4 aerolib NID list

• sceAppContentDownloadDataGetAvailableSpaceKb (libSceAppContent) - a title whose param.json declares downloadDataSize 0 gets 0 KB and OK; the console's behaviour for a title without a download data area is unverified (it may return an error instead). KytyPS5 does not special-case it, and shadPS4 stubs 1048576 KB

• sceNpEAAccessInitialize, sceNpEAAccessTerminate (libSceNpPartner001) - names and the no-argument signatures follow shadPS4; imported by PPSA23566, not confirmed on a PS5 title

• sceSigninDialogClose, sceSigninDialogGetResult (libSceSigninDialog) - SceSigninDialogResult layout (int32 result and 3 reserved int32 words, zeroed) follows KytyPS5 and SharpProspero; error codes follow libSceLoginDialog's 0x80B8xxxx common-dialog codes rather than KytyPS5's 0x8135xxxx, and offline calls finish as user cancelled without opening a dialog. Neither choice is verified on hardware

• libSceBluetoothHid (libSceBluetoothHid) - signatures taken from PPSA01317: sceBluetoothHidInit() and sceBluetoothHidUnregisterCallback() without arguments, sceBluetoothHidRegisterCallback(callback, 0, param) with a 16-byte param, and sceBluetoothHidRegisterDevice / sceBluetoothHidUnregisterDevice(vendorId, productId); the report and device name exports are declared without parameters

• sceAgcWaitRegMemPatchMask (libSceAgc) - follows sceAgcWaitRegMemPatchReference: the mask is taken as a 32-bit value and written to the low mask word of a 32- or 64-bit wait, as OpenAGC does; sharpemu writes both words of a 64-bit wait's mask. A mask above 32 bits throws

• scePsmlMfsr2CreateContext, scePsmlMfsr2CreateSharedResources, scePsmlMfsr2GetContextInitRequirement, scePsmlMfsr2GetDispatchPackets, scePsmlMfsr2GetDispatchPacketsSizeInDwords, scePsmlMfsr2GetSharedResourcesInitRequirement, scePsmlMfsr2Init, scePsmlMfsr2ReleaseContext, scePsmlMfsr2ReleaseSharedResources (libScePsml_mfsr2) - unknown signatures, imported by PPSA23566; declared without parameters

• sceAgcDcbSetCfRegisterDirect, sceAgcDcbSetCfRegisterRangeDirect (libSceAgc) - signatures follow OpenAGC and SharpProspero, which agree; the SET_CONFIG_REG (0x68) packet is OpenAGC's. The driver does not execute SET_CONFIG_REG, so a submitted packet throws

• scePadOpen and scePadOpenExt (libScePad) - special ports (type 2) return DEVICE_NOT_CONNECTED (0x80920007) because the host has no special controller, and scePadGetHandle has no handle for them; whether the console opens a handle and reports the device as disconnected later is unknown. scePadOpenExt handles only special ports. PPSA01317 passes a 16-byte param that names the device by vendor and product id (b7 0e 04 0e ... for 0x0eb7:0x0e04) and skips the user on any negative result. Other port types throw

• scePadVrControllerReadState (libScePad, NID iA-DdobUen8) - the name hashes to the imported NID; the (int handle, void* state) signature follows PS5VR (PPSA99177), which passes a PS VR2 Sense controller handle from scePadOpen type 3 or 4 and a 0x68-byte state it reads as buttons at 0, stick bytes at 4 and a connected byte at 0x40. The title calls it only after sceHmd2Initialize succeeds, which it does not here, so every call throws; the state layout is otherwise unknown

• scePadSetVibrationMode (libScePad) - modes 0 to 3 are accepted and stored; the meaning of mode 3 is unknown (PPSA21480 calls it with 3 right after scePadOpen and aborts on failure; SharpProspero names only 1 and 2). The stored mode has no other effect

• PPSA23566 imports declared without parameters, signatures unknown: sceAudioOut2UserGetSupportedAttributes, sceConvertKeycodeGetCharacterFromKeyboardData, sce::Json::MemAllocator::notifyError, sceNetResolverAbort, sceNpCommerceDialogOpen2, sceNpEntitlementAccessGetPftFlag, sceProprietaryVoiceChatHelper{Initialize,Terminate,SetVoiceChatState,GetVoiceChatUsageState}, sceVoice{GetResourceInfo,ResetPort,EnableChat,DisableChat}. Names from the shadPS4 aerolib NID list

• PPSA28416 imports declared without parameters, signatures unknown: sceAudioOut2EnableChat, imported by its bundled party-ps5-shipping.prx. Name from the shadPS4 aerolib NID list

• PPSA08427 imports declared without parameters, signatures unknown: sceNpEntitlementAccessGetGameTrialsFlag, imported by its bundled pros.sdk.Prospero.prx and not called before the main menu. Name from the aerolib NID list

• PPSA06888 imports declared without parameters, signatures unknown: sceRudpEnableInternalIOThread2, sceRudpGetOption, sceRudpGetRemoteInfo (libSceRudp), imported by its bundled Media/Plugins/SceRudp.prx and not called during start-up. Names from the NID table of shadPS4, which declares them without parameters too

• sceVoiceChatRequestCreateVoiceChatGroup, sceVoiceChatRequestJoinVoiceChatGroup, sceVoiceChatRequestLeaveVoiceChatGroup, sceVoiceChatRequestDeleteVoiceChatGroup (libSceVoiceChat) - assumed to take a request id and two pointers like the other sceVoiceChatRequest* calls; offline, every argument is ignored and SIGNED_OUT is returned, as for those

• sceAvPlayerAddSource (libSceAvPlayer) - requests up to 4 additional decode-ahead video framebuffers from the memory replacement beyond num_output_video_framebuffers when memory is available; the console's internal buffering behaviour is unknown

• sceTextToSpeech2Initialize (libSceTextToSpeech2) - the console's error for an unavailable speech engine is unknown; it returns the kernel's EOPNOTSUPP (0x8002002D). PPSA01317 passes a param that starts with 0x2000000 and only tests the result for non-zero; the other exports it imports are declared without parameters and return the same error

• sceSystemServiceLaunchWebBrowser (libSceSystemService) - the console's error for an unavailable web browser is unknown; it returns the kernel's EOPNOTSUPP (0x8002002D) for any arguments. The (uri, param) signature follows RommPS, which passes a URL and a null param and only tests the result for zero; the param layout and the console's argument checks are unknown

• Command buffer cursors (libSceAgc) - a null cursor_down is taken as a buffer without downward allocations, whose limit is top. PPSA16064 builds one-packet buffers of 8 dwords that way; the console's handling is unconfirmed

• sceVideoOutRegisterBuffers2 (libSceVideoOut) - buffer option 8 (STRICT_COLORIMETRY) is presented as option 0, with the stored values unchanged; what the console changes for it is unknown. Only options 0 and 8 are accepted

• sceAgcGetRegisterDefaultsInternal (libSceAgc) - returns the version 0 internal table, as sceAgcGetRegisterDefaults returns the version 0 public one; OpenAGC returns the table of the version passed to sceAgcInit instead, and null before it

• sceVideoOutAddBufferAttributeOption (libSceVideoOut, NID MBlv8YWoyOk) - the signature (VideoOutBufferAttribute2*, uint64_t option) comes from SharpProspero and the call site in PPSA25380, which passes 0x20 and ignores the result. The option is ORed into attribute->option; whether the console validates the bits, keeps them elsewhere or fails on an unknown option is unknown. A null attribute throws. Option 0x20 makes sceVideoOutRegisterBuffers2 throw, as every option other than 0 and 8; what it selects for an overlay buffer is unknown

• sceVideoOutRegisterBuffers2 (libSceVideoOut) - DCC buffers (category 1): dcc_control is taken as the CB_DCC_CONTROL block layout, only bits 0x10026c are accepted; dcc_cb_register_clear_color as the register-clear texel, only 32-bit values are presented

• sceVideoOutIsOutputSupported (libSceVideoOut) - mode 1 is supported; mode 15 is supported when the current host display runs at 120 Hz or above. Configuring mode 15 requires attribute3 bit 0x40; this single-bit mask is inferred from the measured full value 0x80040, not isolated by a console measurement. Vblanks run at 119.88 Hz until mode 1 restores 59.94 Hz. Display modes are read through SDL; a move to a slower display rejects further high-frame-rate presentation. Selecting another host display mode and VRR are not implemented. The console answers per display and per title: with a 120 Hz TV it also answers 1 for mode 15 (119.88 Hz), and PS5_Vulkan measured that sceVideoOutConfigureOutput accepts 15 only from a title whose param.json declares high-frame-rate output (attribute3 0x80040). Modes 4, 7, 8, 12-14, 16-17 and 19 return VIDEO_OUT_ERROR_UNSUPPORTED_OUTPUT_MODE here, as they did on the measured display. Mode 18 throws, because one console answered 0x80290016 and another 0x8029001E. The name VIDEO_OUT_ERROR_UNKNOWN_OUTPUT_MODE for 0x8029001E is ours. Word 3 of the output options is accepted with any value, as on the console, and its meaning is unknown. PPSA12544 probes 0xd000000a, which the console answers with 0x8029001E, so the title selects 3840 pixels

• sceVideoOutGetResolutionStatus (libSceVideoOut) - the 48-byte layout follows the declarations in ps5-opengl and EVO-PLAYER-PS5 (#1578), which agree; not confirmed on a console. screenSizeInInch is 0, the value EDID uses for an undefined size, since the host display's size is not read; flags is 0, its bits are unknown. The pane equals the full size because sceVideoOutSetWindowModeMargins applies no margins

• sceVideoOutOpen (libSceVideoOut) - the open param's first word is unknown (PPSA21564 passes 16; it is not the byte size, since the affinity mask is at offset 16); only 16 is accepted. Whether the param continues past offset 24 is also unknown

• s_setkill (core/shader/recompiler) - decoded as s_endpgm for any immediate: measured on RDNA2 hardware (gfx1035), a store before it is visible and nothing after it runs (#771); whether the KILL status bit it sets is observable differently from s_endpgm is unverified

• sceRtcParseDateTime (libSceRtc) - the console's zone name table is only known from the names measured on PS5 firmware 13.60 and 13.42; any other name is assumed to take the military letter offset of its first character, as every measured name outside the table does (HST, MSK, XYZ), so a name the console's table holds but nobody measured gets the wrong offset

• sceAudio3dPortOpen (libSceAudio3d) - buffer modes 0 and 1 (also selected by the 0x10 and 0x18 parameter sizes) and 3 beds depend on an SDK version check in the module (prosper) and throw. A repeated sceAudio3dInitialize (NOT_READY in shadPS4, 0 in prosper) and sceAudio3dPortAdvance on a full queue (NOT_READY in shadPS4, unhandled in KytyPS5) throw too

• sceAudiodecDecode (libSceAudiodec) - a raw M4AAC stream carries no channel configuration, so the decoder tries the mono/stereo configuration and then configurations 3 to 7 within ui_max_channels until one decodes the first access unit, and keeps that one. No reference documents how the library picks the layout (shadPS4 maps the channel count straight to the configuration; SharpProspero only describes the maximum). With the stereo configuration a mono raw stream decodes as 2 channels, so 2 is reported, not 1

• sceAudio3dObjectReserve (libSceAudio3d) - object ids, the max_objects limit and the checks of sceAudio3dObjectReserve and sceAudio3dObjectUnreserve follow shadPS4 (PS4), the only reference with a body: ids count up from 1 per port, skipping 0, 0xFFFFFFFF and ids in use, and a failed reserve writes 0xFFFFFFFF

• s_sethalt (core/shader/recompiler) - with SIMM16[0] clear it is a no-op: the RDNA 2 ISA guide describes that value as resuming a halted wave, and a wave that executes it is not halted; measured on a gfx1035 (RDNA 2) wave: s_sethalt 0 followed by a VALU op completes and gives the normal result. Only SIMM16[0] is read; with it set the instruction throws

• s_subvector_loop_begin and s_subvector_loop_end (core/shader/recompiler) - follow AMD's RDNA 2 instruction set reference and a gfx1036 (wave64) measurement, pinned in SubvectorLoop.cpp; S0 in the end instruction's elif(S0 == 0) is read as its SGPR operand. A wave32 shader and a destination other than an SGPR throw because neither is measured. Measured on PC RDNA2 (Radeon 610M), not on a PS5. The specialization pass keeps a constant-condition branch whose untaken target is a loop header, since folding it removes the loop's back edge, which SPIR-V requires exactly once per loop header (SPIRV-Tools rejects the module and the NVIDIA driver 615.78.08 crashes compiling it); a loop whose back-edge block becomes unreachable in another way is not handled

• AMPR WriteAddressFromCounterPairOnCompletion (libSceAmpr) - the pair of an even counter n is assumed to give counter n in the low 32 bits and n + 1 in the high 32 bits. Wait compare values, wait flush and counter index ranges follow the ampr_emu reimplementation; the flush is accepted and has no effect, as commands run in order

• AMPR command sizes (libSceAmpr) - commands use the emulator's own encoding with an 8-byte header, so Nop(n) takes 8 + 4n bytes where the console record is n dwords including its header (NopWithData(n): (n + 1) dwords). The measure functions agree with the appended sizes, but a title that pads to an exact offset or the end of the buffer with Nop(remaining / 4) gets SCE_AMPR_ERROR_BUFFER_FULL or a shifted offset. The at-start flag of the _04_00 writes is ignored; commands run in order, each after the previous one completes

• AMPR object layout and compact gathers - the 24-byte object and offsets (type 0, cursor 4, count 8, capacity 12, pointer 16) follow ampr_emu assertions and its C declaration. AnyPS5 represents the 32-bit type word as low 16-bit type and high 16-bit recording flags. Command encoding is AnyPS5 internal: opcode 29 and three 32-bit words encode the high offset byte, length minus one and low offset word. The 12-byte size reduces HFW's 1 MiB buffer pressure; it is not a claim about console opcode encoding. Existing 40-bit offsets and lengths 1 through 2^32 are retained; console behavior outside those limits is unverified.

• APR resolve ForEach result (libkernel) - sceKernelAprResolveFilepathsToIdsAndFileSizesForEach returns the number of paths that resolved, with the per-path status in results and the failed ids/sizes set to the invalid id and 0. The ampr_emu bridge passes the count of its resolver through and does not show what is counted; counting successes is not confirmed on a title. The guest errno of the failing non-ForEach resolves is set through __error_nid_postfix

• AMPR counter access (libSceAmpr) - signatures and checks of WaitOnCounter_04_00, WriteCounter_04_00, ConstructNop and ConstructMarker taken from the ampr_emu reimplementation, which hands counter commands to the console and does not show their effect. The counters are taken as 32 bits each: the 8-byte access of counter n spans n (low) and n + 1 (high), the 2- and 1-byte accesses select a half or a byte of the counter by its offset, waits compare at the access width (signed and wrapped compares included), the AND mask applies to both sides and the atomic writes wrap within the access. The ConstructNop type is not recorded

• APR gather and scatter reads (libSceAmpr) - signatures, argument checks and the read cursor taken from the ampr_emu reimplementation, not confirmed on a title: each read leaves the file, the next file offset and the next destination; a gather reads that file at a new offset into the next destination, a scatter continues in the file into a new destination, a gather-scatter takes both. Recording one needs a read file since the last ResetGatherScatterState; like ampr_emu, sceAmprCommandBufferReset keeps that state, and a gather or scatter with no read before it in the submitted buffer throws instead of returning SCE_AMPR_ERROR_APR_INVALIDGATHERSCATTERSTATE

• AMM map, map direct and unmap (libSceAmpr) - signatures and the protection mask (CPU, GPU, AMPR and ACP read and write) taken from the ampr_emu reimplementation, which hands the remaining checks and the mapping to the console kernel; the mapper model taken from PS5PCEM: sceAmprAmmGiveDirectMemory usage 1 gives the allocated direct memory to the pool plain maps take pages from, usage 0 only allocates it. Not confirmed on a title. The AMM virtual address ranges are a 32 GiB range and a 32 GiB multimap range reserved on first use at the top of the guest arena, above the addresses that maps without MAP_FIXED are given lowest first and that titles derive their next hints from; the console's addresses are not known (ampr_emu takes them from sceKernelMapperGetParam), and a reservation that cannot be made there throws. Maps outside them throw. Addresses, sizes and direct offsets must be 16 KiB aligned. The memory type and the GPU mask are ignored, AMPR and ACP access maps as CPU access, unmapped pages go back to the pool and stay reserved. Submission runs the buffer before returning, the submit result is always 0 and a failing command throws; the AMM measures return errors sign-extended, as ampr_emu does. sceAmprAmmGetVirtualAddressRanges throws for a null output

• AMM remap, multimap and protection changes (libSceAmpr) - signatures and the protection and mask checks taken from ampr_emu; the effects are inferred from the names, not confirmed on a title. A remap moves every page of a fully mapped range to the new address with the given protection and leaves the old range reserved; a multimap maps the same pages at a second address, anywhere in the AMM ranges, and a pool page goes back to the pool once its last mapping is unmapped; a multimap onto its own source range throws. A protection change sets the masked bits on every page of a fully mapped range; the memory type is recorded and ignored. A command on a range that is not fully mapped throws

• sceVideodec2GetAvcPictureInfo (libSceVideodec2) - runs the sceVideodec2GetPictureInfo body (KytyPS5 binds both NIDs to one function; SharpProspero gives both the same outputInfo, first, second signature); the second (bottom field) picture info is never written, since only progressive H.264 output is modelled. prosper calls the AVC layout unestablished (no title observed calling it)

• AMM PRT ranges (libSceAmpr) - signatures, checks and their order taken from ampr_emu, where MapAsPrt is a map with the PRT flag and protection 0 and AllocatePaForPrt a memory type and protection change with mask 1019, both checking the buffer memory after its size; the effects are inferred from the names, not confirmed on a title. Unbacked PRT pages are zero-filled pages with GPU read access, so CPU reads see zeros instead of faulting and GPU writes fault instead of being dropped. AllocatePaForPrt backs each unbacked page with a pool page and sets the type and protection of backed ones; RemapIntoPrt moves a fully mapped range into a PRT range, its opcode argument (1011 when 0, as in ampr_emu) is recorded and ignored; UnmapToPrt returns the pages to the pool and zero-fills them again. A plain map, unmap or remap over a PRT range ends it; AllocatePaForPrt, RemapIntoPrt or UnmapToPrt outside a PRT range throws

• AMM kernel write commands (libkernel) - signatures of sceKernelWriteModifyMtypeProtectCommand and sceKernelWriteRemapIntoPrtCommand taken from ampr_emu's libkernel hook targets, which forward to the real kernel; the measure mode (dst null reports the size, outSize null skips the report) follows ampr_emu's measure-then-record calls, not confirmed on a title. The range, protection and mask checks mirror the libSceAmpr siblings, and the recorded bytes match them exactly so the submitted buffer executes on the existing paths

• APR map begin and end (libSceAmpr) - as in ampr_emu, MapBegin/MapDirectBegin map when they run and MapEnd only closes the region; while a region is open a second begin and every completion write return EPERM, the at-start _04_00 writes are accepted

• AMPR markers (libSceAmpr) - signatures taken from the ampr_emu reimplementation, not confirmed on a title: sceAmprCommandBufferSetMarkerWithColor takes the color by pointer, the push and measure variants by value. Colors are not recorded

• sceFontGetRenderScaledKerning (libSceFont) - arguments, the cleared output and the bound renderer check taken from cellFontGetRenderScaledKerning in RPCS3 (PS3 predecessor of the library), not confirmed on a title. The kerning is the sceFontGetKerning one at the render scale

• sceFontGetPixelResolution (libSceFont) - signature taken from the IDA type database of Orbital, not confirmed on a title. The value is the one the library's driver reports (64 for FreeType); the argument checks and the cleared output follow sceFontGetLibrary

• sceFontDettachDeviceCacheBuffer (libSceFont) - signature taken from the IDA type database of Orbital, not confirmed on a title. It detaches the cache buffer attached by sceFontAttachDeviceCacheBuffer, returns the buffer and its size, and reports SCE_FONT_ERROR_NOT_ATTACHED_CACHE_BUFFER when no cache buffer is attached

• sceFontGetFontGlyphsCount, sceFontGetCharGlyphCode (libSceFont) - signatures taken from the IDA type database of Orbital and matching the SharpProspero bindings, not confirmed on a title. The count is the face's glyph count and the glyph code its glyph index, as the library's driver reports them; a code with no glyph returns NO_SUPPORT_GLYPH and code 0 NO_SUPPORT_CODE, as sceFontRenderCharGlyphImage does. The argument checks and the cleared output follow sceFontGetPixelResolution

• sceFontGetFontResolution (libSceFont) - signature taken from the IDA type database of Orbital, not confirmed on a title; the outputs are inferred from the names. The resolution is the face's units per EM and the scale pixel the driver's face scale (units per EM / 64 for FreeType), the pixel scale a font has when opened. Either output may be null, as in sceFontGetResolutionDpi

• sceFontCreateWritingLine, sceFontWritingLineWritesOrder (libSceFont) - signatures and the SceFontWritingLineStep/SceFontCreateWritingLineDetail layouts (detail id 0x0FD5) taken from SharpProspero, not confirmed on a title. The 64-bit writing attribute is read as the PS4 11.00 libSceFont.sprx reads it: low byte 0xFA, embedding level in bits 8-15 (0 to 126), bit 30 and bit 31 marking space before and after the run; the PS5 library was not measured, and the names of the two bits are ours. PPSA01325 builds its attribute the same way (0xFA | level << 8, bits 30 and 31) and passes a null metrics pointer when its run has no metrics object. Attribute 0 is accepted and treated as 0xFA with level 0 and no spacing bits, as before this reading; the PS4 library rejects it and what the PS5 library does with it is unknown. Any other attribute, a level above 126 and a null orderer throw: the PS4 library returns 0x80460002 for them, not confirmed for the PS5

• sceFontWritingRefersRenderStepCharacter (libSceFont) - the second argument is an out pointer to the writing's letter step, as in KytyPS5 and the SharpProspero bindings. Measured on PS4 firmware 11.00 libSceFont.sprx (not on a PS5): exactly 8 bytes are written, the address of a step stored inside the writing, and a null writing writes null; shadPS4 and prosper treat the argument as a struct, which the measurement contradicts. The letter step lives in the writing, so the pointer stays valid as long as the writing does, and its contents are rebuilt by each call of this function. On the PS4 library repeated calls on one step walk the characters it covers and then return null; here every call returns the step's one character, so the second call differs. Assumed: each step covers one character and one glyph. PPSA06699 (Hot Shots Golf 2) dereferences the returned pointer for its character counts.

• sceFontWritingLineGetOrderingSpace (libSceFont) - the four outputs are written in the order the PS4 11.00 libSceFont.sprx writes them (line advance, leading space, space between spaced runs, trailing space); the parameter names in the Orbital IDA type database and the SharpProspero bindings order them differently (head, inline, tail, advance), and the PS5 library was not measured. PPSA01325's only call uses them in the PS4 order: it computes first - second - fourth - 0.25 * third and compares that, divided by a scale, with its width limit. The PS4 library writes the trailing space through its pointer without a null check whenever the leading-space pointer is set; that call throws here

• sceSaveDataTransferringMountPs4, sceSaveDataDirNameSearchPs4 (libSceSaveData.native) - arguments assumed to be those of sceSaveDataTransferringMount and sceSaveDataDirNameSearch: KytyPS5 binds both NIDs to the PS5 functions, and prosper captured the same result layout on a title for the search. There is no PS4 save area, so the mount returns NOT_FOUND and the search reports zero hits

• sceCoredumpWriteUserString and sceSaveDataGetConvertProgress - imported by PPSA16064, not called during its start-up and added without an implementation; unknown signatures

• sceSaveDataConvert (libSceSaveData.native) - the parameter block (user id at +0x00, SceSaveDataDirName pointer at +0x08, 48 opaque bytes after it) is read from PPSA28416's single call, not confirmed by KytyPS5, shadPS4, fpPS4 or SharpProspero, which have no body for it. Host saves have no size limit, so an existing save returns SCE_OK without touching its files and no event is queued; what the console returns for a save that is mounted, already converted or needs no conversion is unknown. The directory name is validated as sceSaveDataDelete does

• sceSaveDataCancel (libSceSaveData.native) - imported by PPSA23126, which fails to load without it; added without an implementation because its signature is unknown. Every save data call here finishes before it returns, so nothing is ever in flight to cancel, but what the console returns then is unknown

• sceAudioOutExClose, sceAudioOutExConfigureOutput, sceAudioOutExGetMonitorInfo, sceAudioOutExOpen (libSceAudioOut) - imported by PPSA99505, which fails to load without them; added without an implementation and declared without parameters. PPSA99505 calls them only for its HDMI bitstream output, an option that is off by default, to read the formats the TV or receiver lists, switch the HDMI output mode and open a port for IEC 61937 bursts (Jelly5); EVO-PLAYER-PS5 also calls sceAudioOutExOpen, sceAudioOutExConfigureOutput and sceAudioOutExClose for HDMI bitstream output. The two declare the arguments of sceAudioOutExConfigureOutput differently and neither is confirmed on a console. Audio reaches the host device through SDL as PCM, so there is no encoded HDMI output to switch to

• sceOpusCeltDecCreateEx, sceOpusCeltDecDecode, sceOpusCeltDecDestroy, sceOpusCeltDecGetSize, sceOpusCeltDecInitialize, sceOpusCeltDecTerminate (libSceOpusCeltDec) - imported by PPSA99001, which fails to load without the module; added without an implementation. Their signatures match libSceOpusDec's in ProsperoRadio. PPSA99001 opens this decoder only as a fallback when libSceOpusDec reports a retryable error for a CELT packet, which libSceOpusDec here never returns, so the fallback is not reached

• sceContentDeleteById (libSceContentDelete) and sceContentSearchGetContentLastUpdateId, sceContentSearchOpenMetadataByContentId, sceContentSearchGetTotalContentSize, sceContentSearchGetNumOfContent (libSceContentSearch) - imported by PPSA06465, which fails to load without them; added without an implementation because their signatures are unknown

• sce::Json::Parser::parse with a read callback (libSceJson2) - the callback's contract is taken from PPSA04540's: it returns 0 with the next character, and at the end of its data writes '\0' and returns -1. Characters are read until the callback returns non-zero or gives '\0', and the text read is then parsed as by the (text, size) overload, so trailing characters after the value are rejected as there. Whether the console stops reading at the end of the top-level value, and what it returns when the callback fails before the end, are unknown

• sce::Json::Parser::parse (libSceJson2) - a number that overflows a double (e.g. 1e309) throws: whether the console rejects the document or stores an infinite real is unknown

• sceUserServiceGetNpAccountId (libSceUserService) - the account id for a user with no linked PSN account is assumed to be 0 with success; libSceNpManager's sceNpGetAccountIdA answers the same question with SCE_NP_ERROR_SIGNED_OUT

• sceUserServiceGetUserColor (libSceUserService) - the default profile colour is assumed to be blue (0)

• libSceVdecsw (libSceVdecsw) - structure layouts follow shadPS4's vdecsw.h and were checked against PPSA05684's movie decoder (movie-decoder-vdecsw.cpp), which asserts pictureCount == 1 at offset 0xb of OutputInfo and reads InputResult offset 0x10 as the number of frames an access unit produced. The compute, decoder memory and decode input structures and the first 0x28 bytes of the 0x50-byte decoder config are those of libSceVideodec2, and decoding goes through it. The 0x78-byte AVC picture info is filled with Videodec2's leading fields and the cropping fields only. OUTPUT_PENDING (0x81510115), INPUT_QUEUE_EMPTY (0x81510116) and DECODE_PENDING (0x81510117) follow from the codes each call's assert accepts. At most four decoded pictures are queued and the last one is held until sceVdecswFinalizeDecodeSequence; the console's queue depth is unknown

• sceGameLiveStreamingGetCurrentStatus2 (libSceGameLiveStreaming) - the status layout (user id, on-air flag, spectator, text and command message counts, broadcast resolution, 48 reserved bytes) is taken from shadPS4's OrbisGameLiveStreamingStatus2; the call reports that no stream is on air, with an invalid user id

• Depth clear draws (AGC driver) - a draw with DB_RENDER_CONTROL.DEPTH_CLEAR_ENABLE is taken to write DB_DEPTH_CLEAR to every pixel it covers whatever the depth test, depth bounds and depth bias say: it is drawn with an always-passing depth write and the viewport depth range pinned to the clear value. The draw is rasterized as submitted, so its coverage is the draw's own. Whether the DB still applies the depth test or HiZ to such a draw is not measured

• Alpha-to-coverage (AGC driver) - only DB_ALPHA_TO_MASK = 0xaa01 is accepted: the enable bit with the four quad offsets at 2 and no OFFSET_ROUND, the undithered setting radeonsi programs. Draws are single-sampled, so the pixel shader writes SampleMask 0 when its MRT0 alpha is below one half or NaN and all ones otherwise, and runs with late fragment tests. That rule was measured on a Radeon 660M (gfx1035, RADV with RADV_DEBUG=noatocdithering, which programs the same register) for 0, -0, 0.25, the two floats below one half, one half, the two above, 0.75, 1, 2, -1, both infinities and both NaNs, and is pinned in AlphaToCoverage.cpp; it is not measured on gfx1013. Vulkan's alphaToCoverageEnable is not used: the NVIDIA driver 615.78.08 dithers single-sample coverage (an alpha of 0.25 writes half the pixels of an RTX 3050 Laptop target). Other offsets, OFFSET_ROUND, a sample-mask export, and an MRT0 that is missing, swizzled, packed or exported without a floating-point alpha throw

• MSAA_ENABLE on a single-sample target (AGC driver) - PA_SC_MODE_CNTL_0.MSAA_ENABLE with PA_SC_AA_CONFIG.MSAA_NUM_SAMPLES = 0 is drawn like the same state without the bit when sample 0 of the four PA_SC_AA_SAMPLE_LOCS_PIXEL_*_0 registers is at the pixel center and the draw rasterizes filled triangles with alpha-to-coverage and conservative rasterization off. RADV programs this state for one-sample custom sample locations on GFX10 and later, where the bit makes the rasterizer use the programmed location of sample 0 (061bc615); that the bit changes nothing else for such a draw is inferred from that and is not measured on hardware. Other locations of sample 0, absent location registers, points, lines, rectangles, alpha-to-coverage and conservative rasterization throw

• GPU flips (libSceVideoOut) - a command-buffer flip of a buffer index with no registered buffer when the GPU reaches it presents black and completes like any flip (flip event, count, flipPendingNum). The console's behaviour is unknown; PPSA05684 requires that it completes: its renderer submits a flip of buffer 0 while another thread waits for sceVideoOutIsFlipPending to reach 0 before registering the buffers, and flipPendingNum counts that flip from its submission as in shadPS4

• sceAgcDriverGetEqContextId (libSceAgcDriver) - returns ident: an end-of-pipe interrupt is delivered only to the registration whose id equals the raising queue, so ident is that context's id (titles register 0 or 1 for graphics and 0x20 + 8 * pipe + queue for compute). The console's value is not known; KytyPS5 returns the event's data, which it fills with the interrupt's context id, whereas data here is the EV_CLEAR trigger count. Other event filters throw

• sceAgcSetSubmitMode (libSceAgc) - mode values unknown; only 0 is accepted

• User data registers (AGC driver) - a SPI_SHADER_USER_DATA_* or COMPUTE_USER_DATA_* register the title never wrote reads as 0 when a stage's RSRC2 count covers it, as Kyty (zeroed UserSgprInfo) and SharpEmu (missing registers read 0) do, and as AMD PAL and Mesa initialize them; the console's value is not confirmed

• SET_PREDICATION (AGC driver) - boolean predication follows the AMD PM4 encoding Mesa uses: operation 3 reads 64 bits and 4 reads 32 bits, and bit 8 runs predicated packets when the value is non-zero (clear: when it is zero); the bit 12 hint is ignored. The address must have its low 4 bits clear, as sceAgcDcbSetPredication writes it. Query predication (Z-pass, primitive count), a predicated COND_EXEC, predicated command buffer chains and flips in predicated command buffers throw

• sceAgcGetGsOversubscription (libSceAgc) - signature and occupancy formula (base and expanded vertex/export capacities, budget shift, GE_PC_ALLOC / SPI_SHADER_PGM_RSRC4_GS encoding) follow KytyPS5 only, not confirmed on hardware or a title; a negative or NaN factor that gives a negative target, a missing GS context register or a zero GE_MAX_OUTPUT_PER_SUBGROUP throws

• Vertex entry merged wave info (recompiler) - s3 of every vertex-path shader is set to waveSize | waveSize << 8 (vertex and primitive count of a full wave, wave index 0), or to 32 | 32 << 8 for a wave64 program on a 32-lane host subgroup, which runs it at one lane per invocation and holds no lanes 32-63. Layout taken from the prologue Mesa's ACO emits for NGG vertex shaders (s_bfe_u64 exec from s3), not measured on hardware. The driver gives every graphics program user data from s8, so the condition does not tell NGG from legacy vertex shaders: they just never read s3. A draw whose last wave is partial still reports a full wave, and so does a host wave with idle invocations (an RTX 5070 ran every vertex warp of a non-indexed triangle list with 30 of its 32 invocations).

• NGG vertex programs on the mesh path (AGC driver) - an unregistered vertex program with PRIMGEN_EN that uses LDS or s_barrier runs on the geometry (mesh) path. Each input primitive is assumed to yield at most one output primitive, the subgroup is bounded by GE_MAX_OUTPUT_PER_SUBGROUP as a vertex budget, and the GS/ES VGPR count checks are skipped, because the merged inputs keep their positions. Taken from the code Mesa's ACO emits for NGG culling and from PPSA59322 and PPSA99010 draws, not measured on hardware. Registered programs keep the vertex path

• s_barrier in vertex-path programs (recompiler) - emits no instruction when the program has no LDS or GDS access and no memory write or atomic, so no wave of the subgroup can observe another; the GS_ALLOC_REQ such a barrier orders on NGG passthrough programs is already dropped on the vertex path. The Vertex execution model has no workgroup barrier. Programs with LDS, GDS or memory writes throw. Not measured on hardware

• Strided buffer overhang (libSceAgcDriver) - a strided buffer descriptor that ends less than one stride past the end of the readable registered allocation holding its base is bound only up to that allocation's end, even when another readable allocation starts right there. This assumes the bytes past the end are the rounded-up num_records of the last record (RADV rounds it up), which no fetch inside the buffer reads; a guest that really keeps a vertex split across two adjacent allocations would read zeros for the cut tail. Taken from the RetroArch Dolphin core case in #2912, not measured on hardware.

• Zero-stride vertex fetch range (libSceAgcDriver) - for a stride-0 V# with OOB_SELECT 2 the whole fetch reads memory unless NUM_RECORDS is 0; with OOB_SELECT 3 it reads zero when NUM_RECORDS is 0 and throws when the fetch only partly fits. Rules taken from the GFX10 OOB_SELECT table in Mesa ac_descriptors.c, not measured on hardware. Whether OOB_SELECT 3 checks each dword of a multi-dword fetch separately is unknown. OOB_SELECT 0 and 1 keep the structured record checks.

• sceAgcCbCondWrite (libSceAgc) - argument order and the 9-dword COND_WRITE layout follow the clean-room OpenAGC and sharpemu, which agree on them; SharpProspero lists another order. The write space is accepted only as 1 (memory), the one value both encode the same way, and other values throw.

• sceAgcAcbAtomicGds_0900 (libSceAgc) - signature, control/mode bit mapping and the 11-dword ATOMIC_GDS (0x1d) layout follow the clean-room OpenAGC only, which derives them from the library's disassembly; KytyPS5 and shadPS4 have no body for it. Not confirmed on hardware or a title (PPSA07286 imports it, nothing was run), and the driver has no ATOMIC_GDS handler (opcode 0x1d is not executed as an atomic GDS operation)

• sceAgcGetIsTrinityMode (libSceAgc) - signature from the only PPSA26344 call (a pointer to a one-byte flag, result ignored); a null pointer throws because its error code is unknown

• sceAgcDcbAtomicGds_0900 (libSceAgc) - name from its NID (zARR5aCmkoY), the DCB counterpart of sceAgcAcbAtomicGds_0900, signature unknown

• sceAgcDcbContextStateOpGetSize (libSceAgc) - sizes from KytyPS5 only (5, 27, 27 and 32 dwords), equal to what sceAgcDcbContextStateOp_0100 writes; KytyPS5 returns 0 for an operation above 3, here it throws

• sceAgcBranchPatchSetThenTarget_0300, sceAgcBranchPatchSetElseTarget_0300 (libSceAgc) - names from their NIDs (7Wa3aeJgeVU, rP5xLdOf26k); the (packet, cachePolicy, target, sizeInDwords) signature is inferred from PPSA28416's calls (a branch packet, 0, an aligned target, 4), with the policy stored where sceAgcCbBranch puts it

• sceAgcDcbSet{Cx,Sh,Uc}RegistersIndirectGetSize (libSceAgc) - the count argument is ignored: PPSA28416 calls them with leftover register contents (0xf5f5039c), so the real functions likely take none; the size is 20 bytes either way

• sceAgcUpdateInterpolantMapping_0100 (libSceAgc) - name from its NID (k0E7vkgqAuE); the (regs, vs, ps) arguments are the declared ones, behaviour unknown

• sceFontCharacterGetSyllableStringState (libSceFont) - the signature (textCharacter, int* syllableStringState) follows SharpProspero. Measured on PS4 firmware 11.00 libSceFont.sprx (not on a PS5): the state is 0 for Latin, CJK, Hangul, Arabic, Hebrew, Devanagari and the other scripts tried, and the library sets 1, 3 or 4 (never 2 on real text) for Thai while it creates the string; a null character or a null result returns SCE_FONT_ERROR_INVALID_PARAMETER, and a null character writes 0 to a non-null result. This returns 0 for every character outside the Thai block (U+0E00 to U+0E7F), as KytyPS5 does, and throws for Thai characters, whose cluster states are not modelled. SharpProspero's SceFontSyllableString names 0 NonDetection, 1 Starting, 2 Following, 3 Depending and 4 Connecting. PPSA06699 (Hot Shots Golf 2) calls it.

• sceAgcWriteDataPatchSetDst, sceAgcWriteDataPatchSetCachePolicy and their Async forms (libSceAgc) - the signatures (packet, uint8 value) are inferred from the other patch functions, as no public declaration was found; the value is taken in the encoding of the dst and cachePolicy arguments of sceAgcDcbWriteData (graphics) and sceAgcAcbWriteData (Async, compute), and the patched packet is the one those calls would write. sceAgcAsyncWriteDataPatchSetAddressOrOffset is assumed to patch the address like sceAgcWriteDataPatchSetAddressOrOffset, as the compute WRITE_DATA packet keeps it in the same dwords

• dbOlWdppb4o (libSceAgc) - unknown name; same arguments as sceAgcCreateInterpolantMapping_0100; the SPI_PS_INPUT_CNTL bits for is_f16 2 inputs follow KytyPS5, not confirmed on hardware

• sceAgcGetDataPacketPayloadRange (libSceAgc) - signature, the {base, size in bytes} output and the type 0 range (header + 1, one dword longer than the type 1 payload) from KytyPS5 only, matching sceAgcGetDataPacketPayloadAddress_0090; prosper returns header + 2 for both types from that address function

• sceAgcAsyncCondExecPatchSetCommandAddress, sceAgcAsyncCondExecPatchSetEnd (libSceAgc) - no reference has a body for them; they are assumed to patch the COND_EXEC packet like sceAgcCondExecPatchSetCommandAddress and sceAgcCondExecPatchSetEnd, since sceAgcAcbCondExec writes the same packet as sceAgcDcbCondExec, as sceAgcAsyncRewindPatchSetRewindState does for REWIND

• sceAgcAcbAtomicGds_0900 (libSceAgc) - name from its NID (gQkqkLttcpw), signature unknown

• sceAgcDcbPrimeUtcl2 (libSceAgc) - assumed to write the packet sceAgcAcbPrimeUtcl2 writes: PRIME_UTCL2 has the same 5 dwords on the graphics and compute rings. Not confirmed on a title. Both write a NOP of that size, as there is no TLB to prime

• sceAgcDcbQueueEndOfShaderActionGetSize (libSceAgc) - the builder is inline in the SDK and not exported; the size is assumed to be that of the RELEASE_MEM packet sceAgcCbReleaseMem writes (32 bytes), the same as sceAgcAcbQueueEndOfShaderActionGetSize, as in OpenAGC and REmu

• sceKernelInternalMemoryGetModuleSegmentInfo (libkernel) - unknown signature

• sceKernelGetModuleInfoForUnwind (libkernel) - on Linux the tables come from sceKernelGetModuleInfoFromAddr, whose eh_frame_size includes the zero terminator, as measured on firmware 13.60 (reported in #2419, not reproduced here); on Windows it is assumed to stop before the terminator. LLVM libunwind's CFI_Parser::findFDE stops at the terminator or the length, whichever comes first, so it finds the same FDEs either way. Only the main executable and .guest.prx images report tables; other host images report none, as on Windows

• sceKernelGetModuleInfoFromAddr (libkernel) - the 0x1A8-byte info layout follows the shadPS4 reimplementation; a title's libc.prx reads only id (PPSA14632). The meaning of flags is unknown; only 2 is accepted. The input st_size is ignored, because PPSA21703's libc.prx passes an uninitialized 0x1A8-byte buffer; the full size is written back. The id is the sceKernelLoadStartModule handle of an image opened through the loader and otherwise a stable id from the same range. The name is the host file name without .guest.prx. An image with more than 4 load segments (the converted executable has 7) reports its first 4. tls_offset is 0 and ref_count is 1, as the host loader exposes neither. On Windows the module is the PE image holding the address: a relinked image reports its .elf sections as segments and the eh_frame_hdr recorded in .ehmeta, any other image its first 4 sections with memory access and the .ehfram section without an eh_frame_hdr; the TLS fields and init_proc_addr/fini_proc_addr are 0

• sceKernelGetModuleList (libkernel) - lists the main program and every loaded .prx image in load order; host runtime libraries are left out. The handles are the ids sceKernelGetModuleInfoFromAddr reports, not the console's. The (int32_t* handles, size_t count, size_t* actual) signature and returning ENOMEM without writing actual after filling the first count handles when more images are loaded follow shadPS4; whether the console writes any handles in that case is unknown

• sceKernelGetModuleInfo (libkernel) - the 0x160-byte layout (st_size, name[256], 4 segments, segment_count, fingerprint[20]) follows fpPS4 and shadPS4. Only that st_size is accepted, as in shadPS4; other sizes return EINVAL, a null pointer EFAULT and a handle sceKernelGetModuleList does not list ESRCH. Name and segments are the ones sceKernelGetModuleInfoFromAddr reports, on Windows from the same PE sections, so prot uses the read/write/execute bits 1/2/4, while fpPS4 and shadPS4 store the ELF p_flags. The fingerprint is left zero, as the host image does not carry it

• sceKernelReleaseFlexibleMemory (libkernel) - unmaps the range like sceKernelMunmap, as fpPS4 and prosper do; whether the console keeps the virtual range reserved after releasing its pages is unverified

• sceKernelAvailableFlexibleMemorySize (libkernel) - the segments of the title's executable and of its .guest.prx modules count against the 448 MiB flexible budget while they are loaded, for this size and for the flexible maps, as shadPS4 maps every segment of a module outside its system module directory as flexible memory on the PS4. Counted are the segments the title's ELF gives permissions, each rounded to 16 KiB pages; not counted are segments without permissions, the relinker's own blocks (on Linux both are the read/write/execute PT_LOADs, plus the header block at file offset 0; on Windows everything outside the .elf sections) and the host system libraries. The Linux image carries no marker for the relinker's blocks, so they are told apart by those flags and that offset only: a title segment that is writable and executable, or starts at file offset 0, is not counted. A module whose segments exceed what is left still loads, and the available size then reads 0; shadPS4 fails the segment map instead (memory.cpp returns EINVAL, module.cpp asserts). Which segments the PS5 charges, its rounding, whether system modules use the title's budget and when an unload releases the charge are not measured. PPSA15508 subtracts the reported size and a 10 MiB module allowance from its own 448 MiB budget at start-up and stops when the result exceeds its 146 MiB code and data limit (#2883)

• Memory protection bits 0x100 and 0x200 (libkernel) - taken as audio coprocessor (ACP) read and write, as in the KytyPS5 and etaHEN headers; the coprocessor work runs on the host CPU, so they grant host read and read/write access like the GPU bits

• _umtx_op (libkernel) - UMTX_OP_WAIT, UMTX_OP_WAKE, UMTX_OP_WAIT_UINT, UMTX_OP_WAIT_UINT_PRIVATE, UMTX_OP_WAKE_PRIVATE and UMTX_OP_NWAKE_PRIVATE follow FreeBSD 11's kern_umtx.c: a timeout whose size argument is at most 16 is a relative timespec, a larger one an _umtx_time, and a wake of 0 or fewer wakes one waiter. UMTX_OP_NWAKE_PRIVATE reads the value as an int count of pointers at the object and wakes every waiter on each one; a count of 0 or fewer reads nothing, and a null list fails with EFAULT, where FreeBSD's copyin would also fail for any other unreadable list. Waiters share the queue of sceKernelSyncOnAddressWait. Operation 0 fails with EOPNOTSUPP and operations above 26 with EINVAL, as in FreeBSD 11; UMTX_OP_WAIT_UINT with a value that does not fit in 32 bits returns 0 at once, as FreeBSD's zero-extended compare does. Operation 1 throws, since PPSA12544's call_once uses it in a way FreeBSD rejects; the other operations throw, and so does a misaligned object. PPSA12544's libc.prx passes UMTX_OP_WAIT and UMTX_OP_WAIT_UINT a pointer to a 4-byte microsecond timeout with size argument 0, which FreeBSD reads as a timespec, and waits for a running call_once with operation 1; its PS5Util.prx passes a timespec. Whether the console reads a microsecond timeout there, and what operation 1 does on it, is unverified. A libc call cannot be told apart from a timespec call by the size argument alone, so a timeout with size argument 0 is read as a timespec and only throws when it is not a valid one (negative seconds, nanoseconds outside [0, 1e9)), which is where FreeBSD would return EINVAL; a microsecond value that happens to read as a valid timespec is waited on as one

• sceKernelSyncOnAddressWait (libkernel) - the only known caller passes a null timeout and a name string as the fourth argument; the timeout is assumed to point to microseconds like the other kernel waits, and the name is ignored

• sceKernelSyncOnAddressWait8 / sceKernelSyncOnAddressWait16 / sceKernelSyncOnAddressWait32 / sceKernelSyncOnAddressWait64 (libkernel) - libc's __std_atomic_wait_direct_8/16/32/64 pass a microsecond timeout or null and ignore the result; the by-value comparand, return values and the 2- and 8-byte alignment of Wait16 and Wait64 are assumed

• scePthreadRwlockDestroy, pthread_rwlock_destroy (libkernel) - measured on a PS5 (firmware 13.60): destroying a rwlock returns 0 whether it is free or held for reading or writing, and leaves 1 in the handle; every call on that handle then returns EINVAL until it is initialized again, and a zero handle is initialized on first use by the scePthreadRwlock calls as by the POSIX ones. A rwlock destroyed while held is not freed, so its memory leaks. Destroying a rwlock while another thread is acquiring it is not guarded

• scePthreadCondWait / scePthreadCondTimedwait (libkernel) - before waiting, FreeBSD libthr's cond_wait_common checks ownership through _mutex_owned: an unowned mutex returns EPERM, while its destroyed marker returns EINVAL. An untouched adaptive static initializer (slot value 1) therefore returns EPERM; the test covers this, an uninitialized slot, a mutex owned by another thread, and the destroyed marker for both timed and untimed sce and POSIX waits. A recursive mutex locked several times is released completely for the wait and relocked to the same depth afterwards, as FreeBSD libthr does (_mutex_cv_unlock, _mutex_cv_lock). These FreeBSD-derived behaviors remain unverified on console hardware

• sceKernelAioSubmitReadCommandsMultiple / sceKernelAioSubmitWriteCommandsMultiple / sceKernelAioWaitRequests / sceKernelAioPollRequests / sceKernelAioCancelRequest / sceKernelAioCancelRequests / sceKernelAioDeleteRequests (libkernel) - behaviour from shadPS4 (one id per request for the Multiple submits, cancel turns any request aborted and id 0 reports processing, wait mode 2 returns once one request completed, poll copies every state without waiting); the 128 requests or ids per batch limit is from SharpProspero, with an unknown error, so larger batches throw; wait modes other than 1 (and) and 2 (or) throw; null pointers, negative counts and invalid ids return the codes the single-request siblings use, checked before any state is written

• scePthreadAttr setters and getters (libkernel) - measured on a PS5 (firmware 13.60): a null or uninitialized attribute returns EINVAL, as does a null output of the stack size, detach state and scheduling parameter getters; a policy other than 1 and 3, an inheritance other than 0 and 4, or a priority outside 256 to 767 (or a null parameter) returns ENOTSUP (0x8002002D); a detach state other than 0 and 1 and a stack size below 16384 return EINVAL; any affinity mask is accepted. A null attribute pointer to scePthreadAttrInit and a null output of scePthreadAttrGetaffinity crashed the payload, so they still throw. A new attribute holds a 64 KiB stack size on the console and 1 MiB here, which the host code that runs on guest threads needs

• sceKernelGetAvailableCpumask (libkernel) - returns the default thread affinity, 0x1FFF (CPUs 0 to 12), as KytyPS5 does. Titles pin threads within it (PPSA02664 passes 0x1FFB, Hades II PPSA36082 0x3 and 0x3F); whether CPU 13 is available to a title is not confirmed

• sceKernelGetCurrentCpu (libkernel) - guest affinities are not applied to host threads, so the host CPU index is mapped into the calling thread's affinity clipped to sceKernelGetAvailableCpumask (the available mask when they do not overlap): host CPU n reports the (n modulo the CPU count)-th CPU of that mask, so a thread pinned to one CPU reports that CPU, as a FreeBSD cpuset guarantees on the console. Which CPU the console reports for a thread allowed on several is not known; shadPS4 returns 0

• pthread_attr_setsolosched_np (libkernel) takes (attr, int) and stores the value through scePthreadAttrSetsolosched, returning EINVAL (22) for a null or uninitialized attribute like the other POSIX attribute setters. Only the name is public (aerolib 2+pVfgiEd7A); the signature and behaviour follow the SCE twin, which KytyPS5 and sharpemu store as an int without a range check, and PS5PCEM implements this alias over it. On a PS5 (firmware 13.60) only 0 and 16 are accepted; every other value returns ENOTSUP (45, 0x8002002D from the SCE call) and keeps the stored one, and the SCE calls return EINVAL for a null or uninitialized attribute. PPSA15878 passes 16. Threads created from the attribute are not scheduled differently; what solo scheduling does on the console is unknown. Returnal (PPSA01285 v03.000.005) stopped on it with what(): pthread_attr_setsolosched_np_nid_postfix not implemented (#2872, #1155); LEGO Horizon Adventures (PPSA14632, #734) and Palworld (PPSA23126, #2598) import it

• sceKernelMapNamedFlexibleMemoryInternal (libkernel) - flag 0x8000 is accepted and ignored; its meaning is not established. KytyPS5 (GUEST_MAP_UNKNOWN_8000) and sharpemu accept it without reading it. Every known caller is the SDK 9 libc.prx heap (Astro Bot PPSA21564, PPSA22520), which passes it with read/write protection and uses the mapping as an older libc.prx uses sceKernelMapNamedFlexibleMemory with flags 0

• sceKernelMtypeprotect (libkernel) - sets the memory type of the direct mappings in the page-rounded range and of the direct memory behind them, as shadPS4 and prosper do (KytyPS5 ignores the type); the type is not validated, flexible pages in the range only get the protection, and a later map of the retyped direct memory reports the type it was allocated with. sceKernelBatchMap2 operation 4 takes the same path with the entry type

• Map hints inside a reservation (libkernel) - sceKernelMapDirectMemory and the flexible and anonymous maps place a mapping without MAP_FIXED at its hint address when the whole range lies in a range still reserved by sceKernelReserveVirtualRange, as if MAP_FIXED were set. Taken from PPSA01474, which reserves 64 GiB and then maps its heaps inside it with hints and no MAP_FIXED, and uses the hint addresses afterwards; not measured on the console. Hints outside a reservation, or over a range that is partly mapped, stay hints

• Guest arena (libc) - the application map area is assumed to end at 0xFC_0000_0000, as SCE_KERNEL_APP_MAP_AREA_END_ADDR does on the PS4. On Windows, host allocations made in the arena before libc loads stay, and a fixed guest mapping over one throws

• sceLibcInternalBacktraceForGame (libSceLibcInternal, implemented in libc) - unknown signature

• sceLibcInternalHeapErrorReportForGame (libSceLibcInternal, implemented in libc) - unknown signature

• malloc_usable_size (libc) - with the default allocator it returns the size the block was requested with (the range registered for it), not the rounded-up chunk size Sony's allocator reports; both satisfy "at least the requested size", and bytes past the request would not be write-watched. With an application allocator it calls entry 9 of the replacement table (malloc_usable_size in KytyPS5's MallocReplace order) and throws when the table leaves it null, like malloc_stats_fast

• reallocf (libSceLibcInternal, implemented in libc) - follows FreeBSD 11 lib/libc/stdlib/reallocf.c on top of this libc's realloc, not measured on the console: size 0 frees the block and returns null as realloc does here, so the block is not freed twice; when realloc fails because the application allocator returns null or the default heap rejects the size, the block is freed through the same allocator, errno is ENOMEM and null is returned. Other failures (an exhausted guest arena, an unknown pointer) throw, as they do for realloc

• _sceLibcInternalThreadAtexit, _sceLibcInternalThreadDtors (libSceLibcInternal) - FreeBSD __cxa_thread_atexit semantics assumed; a null or non-image destructor and an allocation failure throw

• _sceKernelRtldThreadAtexitIncrement, _sceKernelRtldThreadAtexitDecrement (libkernel) - the argument is the dso address a title's libc.prx passes to __cxa_thread_atexit (PPSA14632), which fails when Increment returns nonzero. As in the fpPS4 reimplementation, Increment takes a reference on the loaded image containing the address and Decrement releases one; the variants without the leading underscore are assumed to match

• sceImeGetPanelPositionAndForm (libSceIme) - the output is taken to be the PositionAndForm that sceImeDialogGetPanelPositionAndForm fills; it is never written, since no panel can be open. That a closed panel is reported before a null output is assumed by analogy with sceImeSetCaret, not confirmed on a PS5 title

• _sceLibcInternalForceTlsDestructor (libSceLibcInternal) - behaviour follows sceLibcForceTlsDestructor(int) in a title's libc.prx (disassembly): the calling thread's destructors whose dso belongs to the module run newest first, only if the dso's module is loaded and the dso points to itself, in up to 4 passes. The return type is unknown (that function returns nothing), 0 is returned. The module of each dso is looked up when the destructors are forced, not when they are registered as libc.prx does

• acosl (libc) - computed by the host's math library, like the other libc math functions here, not by the console's (FreeBSD msun ld80 code in Sony's libc.prx): results can differ from the console's in the last bit, and on Linux glibc sets errno to EDOM for acosl outside [-1, 1] where msun only raises the floating-point exception. long double is the x87 80-bit format, as Sony's frexpl uses it (fldt 0x8(%rsp), result in st(0))

• atanl, sinl, cosl, tanl, sinhl, coshl, tanhl, expl, exp2l, logl, log10l and powl (libc) - computed by the host's math library, as acosl is, not by the console's FreeBSD msun ld80 code: results can differ from the console's in the last bit (glibc's log10l(1000) is not exactly 3), and on Linux glibc sets errno to EDOM or ERANGE where msun only raises the floating-point exception. ldexpl and truncl are exact operations and give the console's result; logb and remainder give the console's value too, but on Linux glibc sets errno (ERANGE for logb(0), EDOM for remainder by zero or of an infinity) where msun only raises the floating-point exception

• std_execute_once (libc) - assumed to be the plain-named twin of std::_Execute_once (_ZSt13_Execute_onceRSt9once_flagPFiPvS1_PS1_ES1_, the callee of Dinkumware call_once): it delegates there and gets the [thread.once.callonce] semantics already verified for that symbol (one invocation per flag, concurrent callers block until it completes, and a failing or throwing invocation leaves the flag unready so the next caller runs it). The name equivalence is not confirmed on a title, and the callback convention (called with (null, arg, null), non-zero return meaning success) is the twin's, unverified for this symbol

• Dinkumware mutexes and conditions (libc) use pointer-to-handle arguments, matching the console aerolib signatures reported in #3079. The title's _Mtx_lock maps 0 to _Thrd_success (0), 0x8002000b to _Thrd_busy (3), and other failures to _Thrd_error (4); its internal mutex init recognizes recursive flag 0x100, while every other type uses default attributes. The observed relock failure for a plain mutex suggests those defaults are error-checking, but that has not been confirmed on hardware. The title's _Mtx_unlock and _Cnd_wait return success regardless of their internal result. The host implementation treats invalid ownership preconditions as no-ops, and throws for invalid handles, host wait errors and destroying a locked mutex as debug guards; those cases are not confirmed against the console.

• random, srandom, initstate, setstate (libc) follow FreeBSD 11 random.c: the additive feedback generator on a default 128-byte TYPE_3 table, good_rand seeding, state sizes rounded down to 8, 32, 64, 128 or 256 bytes, and setstate returning the previous state or null for a rear position past the degree. initstate below 8 bytes returns null without setting errno, as that file and its manual do (glibc sets EINVAL). FreeBSD does not lock the generator; here every call is serialised by one lock, so concurrent callers draw the serial sequence between them. A null state throws, where FreeBSD faults. That the console's libSceLibcInternal uses this FreeBSD code and not another generator is unverified

• tcgetattr, tcsetattr (libkernel) - every file and pipe descriptor is taken as not a terminal (ENOTTY), and a socket gets EADDRNOTAVAIL for AF_INET and EOPNOTSUPP otherwise, as FreeBSD's in_control and pru_control_notsupp answer a termios ioctl; what descriptors 0 to 2 of a title are on the console, and whether any of them is a terminal there, is unknown

• select (libkernel) - descriptor 0 is never reported readable and descriptors 1 and 2 are always writable, as for a console title with no input; reads from descriptor 0 still go to the host stdin. /dev/random and /dev/urandom are always readable and writable, as FreeBSD reports a seeded random device. Other descriptors that are not libSceNet sockets throw. Dungeons (PPSA16064) selects on descriptor 0

• select (libkernel) - a descriptor the socket poller reports as unknown that is below GuestSockets::FirstDescriptor is polled on the host instead of throwing, except on Windows where it still throws; an invalid host descriptor fails with EBADF, and mixed host and socket sets are polled in short alternating slices so neither side waits out the full slice alone. Wobbly Life (PPSA29413) selects on file descriptors while streaming its bundles

• __progname (libkernel) - unknown data export

• environ (libkernel) - data export pointing to a fixed empty environment so titles that import it load; it is not the environment libc's getenv reads, so it lists none of those variables and setenv/putenv changes do not appear in it

• seteuid, setegid, setuid, setreuid, setgroups, getgroups (libkernel) - the guest process is assumed to run as root, with real, effective and saved user and group ids 0. As in FreeBSD's sys_seteuid, sys_setegid, sys_setuid and sys_setreuid, id 0 (or -1 for an unchanged setreuid id) is then accepted without a privilege check and changes no credential, so 0 is returned; any other id would change an id, which is not modelled, and throws. setgroups keeps the supplementary group list as kern_setgroups does (NGROUPS_MAX 1023, an empty list leaves the effective group as the only entry, a first entry other than 0 would change the effective group and throws) and getgroups reports it. The ids and privileges a title has on a console are unverified

• pthread_barrierattr_setpshared (libkernel) - PTHREAD_PROCESS_SHARED is accepted on the assumption that the console follows FreeBSD 11.0 libthr, which accepts it (9.0 rejects it with EINVAL); unverified on hardware. Guest code runs in one process, so a shared barrier behaves as a private one

• pthread_getname_np (libkernel) - a thread that has already been joined returns ESRCH (3) on a PS5 (firmware 13.60), but its object is freed after the join here, so the pointer cannot be told apart from a live thread and its name is read as for a live one

• sceSslClose (libSceSsl) - unknown signature

• sceSslGetSerialNumber (libSceSsl) - unknown signature

• sceAudioInIsPadEmbeddedMic (libSceAudioIn) - name from its NID (X+4jdIS75P0); signature int32_t(int32_t handle) from the Ghost of Yotei (PPSA26344) call site in #2355; the result's meaning is unconfirmed, so it still throws rather than invent one

• sceAudioOut2Set3DLatency (libSceAudioOut) - assumed to take (user_id, latency): KytyPS5 reads (user_id, output, latency_us), but the known calls set just edi and esi; only (0xFF, 2) (PPSA26344) and (0xFF, 1) (PPSA14632) are accepted

• sceAudioOut2MasteringInit (libSceAudioOut) - flag values unknown; only 0 is accepted. Whether the console reports an error for a repeated sceAudioOut2MasteringInit or for sceAudioOut2MasteringTerm without a matching initialization is unknown; both return 0. PPSA01289 creates the audio device of its next world before it destroys the previous one, so it calls Init twice before Term twice, and only logs a non-zero result

• sceAudioOutSetMixLevelPadSpk (libSceAudioOut) - effect of a negative mix level unknown; only 0 to 32768 (0 dB) is accepted

• sceAudioOutSetMixLevelPadSpk (libSceAudioOut) - no source applies the level (shadPS4 only stores it); it is assumed to be a linear gain on the port's own output, and the -9 dB default (11626) is applied to every pad speaker port, including those of titles that never call the function

• sceAudioOutGetLastOutputTime (libSceAudioOut) - signature and behaviour taken from the shadPS4 and fpPS4 reimplementations of the PS4 library, not confirmed on a PS5 title: the time is the process time at which sceAudioOutOutput or sceAudioOutOutputs accepted the port's last block, not the time the block reached the device

• sceAudioOutSysClose, sceAudioOutSysConfigureOutput, sceAudioOutSysOpen (libSceAudioOut) - imported by PPSA99051 and PPSA99997, which fail to load without them; added without an implementation and declared without parameters. EVO-PLAYER-PS5, whose audio code both titles share, calls sceAudioOutSysOpen, sceAudioOutSysConfigureOutput and sceAudioOutSysClose only to open a port for HDMI bitstream passthrough. Its declared arguments are not confirmed on a console. Audio reaches the host device through SDL as PCM, so there is no HDMI output to switch

• sceAudioOut2PortCreate (libSceAudioOut) - MAIN (type 0) format validation follows PS5 firmware 13.60 measurements: bits 8-11 accept 1, 2, 8 or 12, bits 0-6 accept 0 or 1, bit 7 requires 8 channels, and bits 12-31 do not affect validation. The sample types are still read as float and int16; bit 7's layout, the PCM effect of bits 12-31 and the port flags are unverified. Other port types retain unverified format validation, including 6 channels and rejection of bits 12-31

• sceAudioOut2PortCreate (libSceAudioOut) - 12 channels are assumed to be L R C LFE Ls Rs Lb Rb Ltf Rtf Ltb Rtb as in KytyPS5's 12-to-8 fold, and 6 and 8 channels to be its first 6 and 8; no title or SDK header confirms the order

• sceAudioOut2PortCreate (libSceAudioOut) - the stereo fold is assumed, not the console's downmix: C at -3 dB into both sides, Ls/Rs, Lb/Rb and Ltf/Rtf at -3 dB and Ltb/Rtb at -6 dB into their own side, LFE dropped

• sceAudioOut2PortSetAttributes (libSceAudioOut) - each PCM buffer set (attribute 0) is taken as one grain: buffers set between two pushes are queued and played one per grain, at most 16 queued. A grain with no new buffer repeats the last one only when the port has always been given that same buffer (rewritten in place); a port whose buffers move on plays silence instead. Inferred from PPSA12544, whose object port (type 6) is given one grain of a 64-grain ring per set, often two or three between pushes and then none for a few; the console behaviour for several sets per push and for a push without a new buffer is not documented

• scePsmlMfsrGetContextBufferRequirement1100, scePsmlMfsrCreateContext1100, scePsmlMfsrGetDispatchMfsrPacket1100 (libScePsml_debug) - argument layouts unknown; only 0x8A810001 (not initialized) is returned

• scePsmlMfsrGetDispatchMfsrPacket1000 (libScePsml) - unknown signature, imported by PPSA25344; declared without parameters. libScePsml and libScePsml_debug are built from the same source

• scePsmlMfsrCreateContext1300, scePsmlMfsrGetDispatchMfsrPacket1300 (libScePsml) - unknown signatures, imported by PPSA28416 next to scePsmlMfsrGetContextBufferRequirement1100; declared without parameters. The names are not in the aerolib NID list; they hash to the imported NIDs kLF7WtQ1-Dg and DDVUyPyYHTA (tools/nid_names.py)

• scePngEncEncode (libScePngEnc) - whether rows may stay unfiltered when filter_type names a subset of the filters is unknown; as in shadPS4, they may only for 0 and for the all-filters mask

• sceJpegEncEncode (libSceJpegEnc) - restart_interval follows SharpProspero's field doc (0 none, -1 every row of blocks, positive a block count); a positive value is taken as the JPEG DRI interval in MCUs and -1 as one restart per MCU row, which no reference confirms. Other negative values throw

• sceVoiceQoSInit (libSceVoiceQoS) - 0x804E0905 for a second initialization comes from prosper's reading of the module and was not measured: on a PS5 a valid call blocks inside a homebrew payload, so it never returns there. The app type and the block are not used, as no endpoint is implemented

• AudioIn and NpSessionSignaling exports added without an implementation have assumed signatures

• Font, Http2, Net, Ssl, SystemService and libkernel exports imported by PPSA12544 and added without an implementation have unknown signatures

• The Share, NpTrophy2, NpEntitlementAccess and WebBrowserDialog exports imported by PPSA12544's Unity plugins and added without an implementation have unknown signatures

• Acm, GameLiveStreaming, Net, NpEntitlementAccess, NpManager, NpWebApi2, VoiceQoS, WebBrowserDialog and libkernel exports imported by PPSA14632 and added without an implementation are declared without parameters

Functional

• Cancellation coverage checks deferred request handling and recovery, not full asynchronous support or console ABI compatibility. Cancellation during file/socket I/O, sleep interruption, cancellation versus exit/detach, condition signal conservation under cancellation, and safe rejection of non-null invalid or reclaimed thread handles remain unverified. No console title or homebrew establishes the cleanup NIDs or buffer layout. Accepted asynchronous mode currently has no diagnostic for its deferred behavior.
• --to-intel guest module trampolines are covered only by a synthetic relinker test; no game title has been verified with them on Linux or Windows.