[Ampr] Fix PakDirectoryTracker to handle multiple directories with the same name

Directory.Build.props

@@ -9,7 +9,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <SharpEmuVersion>0.0.5-nexus</SharpEmuVersion>
+    <SharpEmuVersion>0.0.4-release.2</SharpEmuVersion>
     <Version>$(SharpEmuVersion)</Version>
 
     <RepoRoot>$([MSBuild]::NormalizeDirectory('$(MSBuildThisFileDirectory)'))</RepoRoot>

Directory.Packages.props

@@ -22,9 +22,6 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.EXT" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.KHR" Version="2.23.0" />
-    <!-- Reuse the font rasterizer already shipped with Avalonia.Skia. -->
-    <PackageVersion Include="SkiaSharp" Version="3.119.4" />
-    <PackageVersion Include="SkiaSharp.NativeAssets.Linux" Version="3.119.4" />
     <PackageVersion Include="System.IO.Hashing" Version="10.0.0" />
     <!-- Transitive of Avalonia.Desktop; pinned. Avalonia 12 requires 0.94.1+. -->
     <PackageVersion Include="Tmds.DBus.Protocol" Version="0.94.1" />

README.md

@@ -35,9 +35,6 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
 ---
 
-> [!IMPORTANT]
-> **Official channels:** Only **sharpemu.app** and the links listed in this GitHub repository are affiliated with SharpEmu. Any other websites, accounts, or donation pages are unofficial and unauthorized.
-
 > [!NOTE]  
 > SharpEmu supports Windows x64, Linux x64, and macOS x64. Apple Silicon Macs
 > can run the macOS x64 build through Rosetta 2, and Windows on ARM devices
@@ -58,17 +55,17 @@ Our goal is **not** to emulate PS4 games, as there is already an excellent emula
 
 ## Games Tested
 
-|               Demon's Souls Remake                   |                     ASTRO BOT                        |
+|               Demons Souls Remake                   |                     Tomb Raider V Remastered                        |
 | :-----------------------------------------------------------: | :--------------------------------------------------------------------------------------------: |
-| ![DeS screenshot](./.github/images/demons-souls.jpg) | ![Astro Bot](./.github/images/astro-bot.jpg) |
+| ![DeS screenshot](./.github/images/demons-souls.jpg) | ![Tomb Raider V](./.github/images/tomb-raider-v-remastered.jpg) |
 
-|                  ASTRO's PLAYROOM                    |                 Dead Cells                    |
+|                  Hades                    |                 Dead Cells                    |
 | :------------------------------------------------------------------------: | :------------------------------------------------------------------: |
-| ![Astro's Playroom](./.github/images/astros-playroom.jpg) | ![Dead Cells](./.github/images/dead-cells.jpg) |
+| ![Hades](./.github/images/hades.jpg) | ![Dead Cells](./.github/images/dead-cells.jpg) |
 
-|                  God of War: Sons of Sparta                    |                 Tomb Raider V Remastered                    |
+|                  PAC-MAN World Re-PAC                    |                 Cult of the Lamb                    |
 | :------------------------------------------------------------------------: | :------------------------------------------------------------------: |
-| ![GoW SOS](./.github/images/gow-sos.jpg) | ![Tomb Raider V](./.github/images/tomb-raider-v-remastered.jpg) |
+| ![Pac-Man](./.github/images/pac-man-world-re-pac.jpg) | ![Cult of the Lamb](./.github/images/cult-of-the-lamb.jpg) |
 
 ## Status
 

docs/bink2-bridge.md

@@ -9,12 +9,12 @@ Demon's Souls plays Bink 2 (.bk2) files through a Bink implementation linked
 directly into eboot.bin. It does not use libSceVideodec, therefore an HLE video
 decoder cannot observe or replace those frames.
 
-By default, SharpEmu leaves Bink decoding to the implementation linked into
-the game (`SHARPEMU_BINK_MODE=guest`).
+SharpEmu observes successful guest .bk2 opens and, when a Bink decoder is
+available, presents its decoded BGRA frames at the normal guest-flip boundary.
+This preserves the game's own timing and lets the host Vulkan presenter display
+the movie without trying to execute the PS5-specific Bink GPU decode path.
 
-Set `SHARPEMU_BINK_MODE=native` to use the optional host bridge. It observes
-guest .bk2 opens and presents decoded frames at the guest-flip boundary. The
-host path decodes by calling FFmpeg's C API directly from managed
+The default path decodes by calling FFmpeg's own C API directly from managed
 code (`src/SharpEmu.Libs/Bink/FfmpegNativeBinkFrameSource.cs`, via the
 [FFmpeg.AutoGen](https://github.com/Ruslan-B/FFmpeg.AutoGen) P/Invoke
 bindings) against a custom FFmpeg build
@@ -24,13 +24,26 @@ libraries come from. No proprietary RAD SDK is needed to build or run
 SharpEmu, and there is no C/C++ code of SharpEmu's own involved in decoding
 -- SharpEmu.CLI.csproj only downloads a prebuilt release archive.
 
-Set `SHARPEMU_BINK_MODE=skip` only when explicitly testing a title whose
-cinematics are optional.
+Set `SHARPEMU_BINK_MODE=guest` to leave decoding to the Bink implementation
+statically linked into the game instead. Set `skip` only when explicitly
+testing a title whose cinematics are optional.
 
 Set SHARPEMU_BINK_MODE=dummy to retain the open and show a built-in,
 non-decoded placeholder frame. This requires no SDK, but is a visual diagnostic
 only; it does not decode the movie or alter its game logic.
-`SHARPEMU_BINK_MODE=ffmpeg` is an alias for `native`.
+SHARPEMU_BINK_MODE=native is equivalent to the default and mainly useful for
+being explicit about it.
+
+The experimental `SHARPEMU_BINK_MODE=ffmpeg` override is unrelated to the
+default path above: instead of calling into FFmpeg in-process, it spawns a
+standalone `ffmpeg` executable and reads raw frames from its stdout
+(`src/SharpEmu.Libs/Bink/FfmpegBinkFrameSource.cs`). SharpEmu searches
+`SHARPEMU_FFMPEG_PATH`, the executable directory, its `ffmpeg` subdirectory,
+and then `PATH` (plus a couple of common Homebrew paths on macOS). That
+`ffmpeg` build must contain a Bink 2 decoder itself; a stock FFmpeg build that
+only recognizes the Bink container is not sufficient. Most users want the
+default `native` mode instead, which always has Bink 2 support since it's
+built against `ffmpeg-core` specifically.
 
 ## Supplying the FFmpeg libraries
 

docs/sharpemu-gui-undocumented-env-vars.md

@@ -14,7 +14,7 @@ The GUI shows 14 variables on its **Options** and **Game options** pages. This l
 `SHARPEMU_LOG_NP`, `SHARPEMU_PROFILE_PERFORMANCE`, `SHARPEMU_PROFILE_PERFORMANCE_FRAME_TRACE`,
 `SHARPEMU_RENDERDOC`, `SHARPEMU_VK_DISABLE_IMPLICITS`, `SHARPEMU_STRICT_COMPUTE`, `SHARPEMU_VK_VALIDATION`, `SHARPEMU_WRITABLE_APP0`.
 
-The list contains 269 variables. The source was examined on 2026-09-19, branch `dev`.
+The list contains 252 variables. The source was examined on 2026-09-19, branch `dev`.
 The descriptions come from the code that reads each variable. The emulator was not started for this list.
 
 ## How to use a variable
@@ -29,18 +29,18 @@ The descriptions come from the code that reads each variable. The emulator was n
 
 | Group | Variables |
 | --- | --- |
-| Behavior switches | 19 |
-| GPU and Vulkan | 59 |
+| Behavior switches | 16 |
+| GPU and Vulkan | 50 |
 | Metal | 10 |
-| Audio and video | 6 |
+| Audio and video | 7 |
 | Input | 5 |
-| Memory and CPU | 19 |
+| Memory and CPU | 17 |
 | Loader | 11 |
 | Debugger | 1 |
 | Log channels | 72 |
-| Traces | 25 |
+| Traces | 22 |
 | Data dumps | 12 |
-| Performance measurement | 17 |
+| Performance measurement | 16 |
 | Internal | 1 |
 | Tests and tools | 12 |
 
@@ -52,16 +52,13 @@ These variables change how the emulator operates.
 | --- | --- | --- | --- |
 | `SHARPEMU_AGC_VERSION13_DEFAULTS` | text (`legacy`, `generic` or `0`) | Selects the register defaults for AGC version 13 requests. The default uses the version 11 compact tables. The values `legacy`, `generic` and `0` use the older generic layout. | `AgcExports.Init.cs` |
 | `SHARPEMU_DISABLE_LLE_LIBC` | `1` | Stops the use of the guest libc module for libc exports. The emulator then uses its HLE handlers for these exports. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_HLE_FAST_MEMCPY` | `0` | Set to `0` to stop the native fast-path stub for the guest libc `memcpy` and `memmove`, so those imports use the managed HLE gateway again. | `DirectExecutionBackend.FastPath.cs` |
-| `SHARPEMU_HLE_FAST_PATH` | `0` | Set to `0` to stop the native fast-path stubs for `pthread_self` and `pthread_getspecific`, so those imports use the managed HLE gateway again. The stubs are on by default on macOS x64 and are off on any run that traces imports or pthreads. | `DirectExecutionBackend.FastPath.cs` |
 | `SHARPEMU_HOLD_FIRST_FLIP_MS` | number | Stops the thread that submits the flip for this number of milliseconds on one guest flip. The range is 0 to 60000 and the default is 0 (off). `SHARPEMU_HOLD_FLIP_NUMBER` selects the flip. | `VideoOutExports.cs` |
 | `SHARPEMU_HOLD_FLIP_NUMBER` | number | Selects the guest flip that `SHARPEMU_HOLD_FIRST_FLIP_MS` holds. The minimum is 1 and the default is 1 (the first flip). | `VideoOutExports.cs` |
 | `SHARPEMU_IGNORE_GUEST_EXCEPTIONS` | `1` | `sceKernelRaiseException` returns OK and does not call the installed guest exception handler. Default is off. | `KernelExceptionCompatExports.cs` |
-| `SHARPEMU_IMPORT_LOOP_GUARD_SECONDS` | number | When `SHARPEMU_DISABLE_IMPORT_LOOP_GUARD=0` enables the guard, sets how long an import call pattern can repeat before a guest exit. The default is 5 seconds; 0 turns the guard off. | `DirectExecutionBackend.Imports.cs`, `DirectExecutionBackend.cs` |
+| `SHARPEMU_IMPORT_LOOP_GUARD_SECONDS` | number | Sets the time that an import call pattern can repeat before the import loop guard forces a guest exit. The default is 5 seconds. The value 0 turns the guard off. | `DirectExecutionBackend.Imports.cs`, `DirectExecutionBackend.cs` |
 | `SHARPEMU_NET_REDIRECT` | IP address | Sends guest `connect` and `sendto` traffic to this host IP address. When unset, the emulator permits outbound guest traffic only to loopback addresses. If the value is not a valid IP address, the emulator keeps the original destination and permits the traffic. | `KernelSocketCompatExports.cs` |
 | `SHARPEMU_NO_FLIP_PACING` | `1` | Stops flip pacing. The emulator completes each flip immediately and does not wait for the display refresh time. The default is off. | `VideoOutExports.cs`, `VideoOutExports.FlipRequests.cs` |
 | `SHARPEMU_OVERLAY` | `0` | Hides the performance overlay at start, even when the video options have the overlay on. All other values use the video options. | `PerfOverlay.cs`, `PerformanceOverlayState.cs` |
-| `SHARPEMU_POSIX_GPU_FAULT_FAST_PATH` | `0` | Set to `0` to stop the POSIX fault bridge from offering GPU-tracked page faults to the GPU memory tracker before it builds the Win64 exception context. The fault then takes the full handler order again. | `DirectExecutionBackend.PosixSignals.cs` |
 | `SHARPEMU_RETAIN_SUBMITTED_INDEX_DATA` | `0` | The default is on. The emulator keeps a copy of submitted index data until the translated draws run. Set to `0` to stop this copy. Use `0` only for a comparison test. | `AgcExports.SubmittedGeometry.cs` |
 | `SHARPEMU_RETAIN_SUBMITTED_VERTEX_DATA` | `0` | The default is on. The emulator keeps a copy of submitted vertex data until the translated draws run. Set to `0` to stop this copy. Use `0` only for a comparison test. | `AgcExports.SubmittedGeometry.cs` |
 | `SHARPEMU_SAVEDATA_DIR` | path | Set the root directory for save data. The default is `user/savedata` next to the executable. When this variable is set, the emulator does not move save data from the old layout. | `SaveDataStorage.cs`, `SaveDataExports.cs` |
@@ -76,7 +73,6 @@ These variables change the GPU path or the Vulkan presenter.
 
 | Variable | Value | Function | Code that reads it |
 | --- | --- | --- | --- |
-| `SHARPEMU_ASYNC_GUEST_READBACK` | `0` | `0` makes a guest thread that reads GPU-written buffer memory wait until the render thread has copied the data back. The default starts the copy on the render thread and lets the guest thread wait for it on a separate readback slot, so the render thread continues. | `GuestBufferCache.cs` |
 | `SHARPEMU_CAPTURE_PIXEL_EXEC_PCS` | list (`pc:register` pairs) | At each given instruction PC, the pixel shader writes the execution flag to the given VGPR register. The value is 1.0 when the flag is set and 0.0 when it is not. `SHARPEMU_CAPTURE_PIXEL_VGPR_ADDRESS` must match the shader address. | `Gen5SpirvTranslator.cs` |
 | `SHARPEMU_CAPTURE_PIXEL_IMAGE_ADDRESS` | hex address | Selects the pixel shader for the image capture by its program address. The default is no capture. Use it with `SHARPEMU_CAPTURE_PIXEL_IMAGE_PC`. | `Gen5SpirvTranslator.cs` |
 | `SHARPEMU_CAPTURE_PIXEL_IMAGE_PC` | number (instruction PC) | Sets the image instruction whose result the SPIR-V translator copies to four VGPR registers. `SHARPEMU_CAPTURE_PIXEL_IMAGE_ADDRESS` must match the shader address. | `Gen5SpirvTranslator.cs` |
@@ -113,28 +109,20 @@ These variables change the GPU path or the Vulkan presenter.
 | `SHARPEMU_FORCE_TITLE_SOLID_FRAGMENT` | `1` | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect at this time. | `VulkanVideoPresenter.Draws.Recording.cs` |
 | `SHARPEMU_FORCE_TITLE_VERTEX_OUTPUTS_ONE` | `1` | Vertex export targets 32 to 35 write the vector (1, 1, 1, 1). This applies only to the vertex shader at guest address 0x0000000500780000. Default is off. | `Gen5SpirvTranslator.cs` |
 | `SHARPEMU_GPU_BACKEND` | `vulkan` or `metal` | Selects the guest GPU backend. The default is Vulkan. The value `metal` works only on macOS, and other hosts show a warning and use Vulkan. | `GuestGpu.cs` |
-| `SHARPEMU_GPU_WAIT_SPIN_US` | number (microseconds) | Sets how long a wait for GPU work polls before it blocks. A short poll saves the wake-up delay when the GPU finishes soon. `0` blocks at once. The default is 150. | `GpuWaitSpin.cs` |
 | `SHARPEMU_GRAPHICS_SUBGROUPS` | `0` or `1` | Set `1` to use native Vulkan subgroup operations in graphics shaders. Set `0` to use the fallback path. When unset, the presenter uses them only if the subgroup size is 32 and the vertex and fragment stages support subgroups. | `VulkanVideoPresenter.cs`, `VulkanVideoPresenter.Device.Setup.cs` |
-| `SHARPEMU_IMAGE_LOOKUP_MEMO` | `0` | `0` turns off the image lookup memo. The default keeps the result of each image lookup that found an image with the same backing, and gives it again for the same request until an image is registered or removed. | `GuestImageCache.Lookup.cs` |
 | `SHARPEMU_MARK_PIXEL_PCS` | list of `pc:register` pairs | Makes the SPIR-V pixel shader write the float value 1.0 to a shader register when execution reaches the given instruction PC. Use decimal numbers, a register below 256, and a comma between pairs. It has an effect only for the shader address in `SHARPEMU_CAPTURE_PIXEL_VGPR_ADDRESS`. | `Gen5SpirvTranslator.cs` |
 | `SHARPEMU_MAX_GUEST_WORK_PER_RENDER` | number | Sets the maximum number of guest command stream slices that the Vulkan presenter runs in one render pass. The default is 1024, or 256 on macOS. The value must be more than 0. | `VulkanVideoPresenter.cs`, `VulkanVideoPresenter.CommandStream.cs` |
 | `SHARPEMU_RENDERDOC_CAPTURE_TIMEOUT_SECONDS` | number (seconds) | Set the maximum time for a RenderDoc frame capture. The emulator discards a capture that does not end in this time. The range is 1 to 120. The default is 15. | `RenderDocCapture.cs` |
 | `SHARPEMU_RENDERDOC_DLL` | path | Set the path of the RenderDoc library file. The emulator tries this path first. When unset or when the load fails, it searches the default library name and the known install paths. | `RenderDocCapture.cs` |
 | `SHARPEMU_RENDERDOC_WAIT` | number (seconds) or `enter` | Set to make the emulator wait before it starts Vulkan, so that you can attach RenderDoc. `enter` waits until you press Enter. A number waits that many seconds, from 1 to 300. Other text waits 15 seconds. | `VulkanVideoPresenter.Device.Setup.cs` |
 | `SHARPEMU_RENDER_WORK_BUDGET_MS` | number (milliseconds) | Set the maximum time that one render call uses for queued guest work in the Vulkan presenter. Work that remains stays in the queue for the next frame. `0` removes the limit. The default is 12 on macOS and 0 on other hosts. | `VulkanVideoPresenter.cs`, `VulkanVideoPresenter.RenderLoop.cs` |
-| `SHARPEMU_RESOURCE_PREFETCH` | `0` | `0` makes the shader resource materialization read each guest word one at a time. The default reads adjacent words of descriptors and the flattened resource table in one read of resident guest memory. A range that the GPU may still own is read word by word as before. | `ShaderProgramCache.cs`, `RawReadPrefetch.cs` |
 | `SHARPEMU_SHADER_MAX_STEPS` | number | Set the maximum number of dispatcher loop steps in each translated shader invocation. The limit makes sure that an incorrect loop stops. `0` removes the limit. The default is 100000. | `Gen5SpirvTranslator.cs`, `Gen5MslTranslator.cs` |
-| `SHARPEMU_SHADER_PREWARM` | `0` | `0` turns off the shader prewarm list. By default, each compute program that a game compiles is added at once to `shader-prewarm.bin` in `user/pipeline_cache/<title id>/`, so a stopped game keeps the list. At the next launch after a change of the shader translator or of the GPU driver, background threads translate the listed programs again and create their pipelines, so that the driver compiles them before the game asks for them. The `shader-prewarm.stamp` file names the build and driver that last did this; with the same build and driver, the launch does no prewarm work. The log shows `Shader prewarm done` and `Shader prewarm hits`. On Windows it replaces the cache file by default; on Linux it works beside the cache file. It has no effect with the per-shader cache files of `SHARPEMU_VK_PIPELINE_CACHE_SHARDS`. | `VulkanVideoPresenter.ShaderPrewarm.cs`, `ShaderPrewarmList.cs`, `ShaderProgramCache.cs` |
 | `SHARPEMU_SKIP_ALL_COMPUTE` | `1` | Set to `1` to make the Metal presenter skip all compute dispatches. The Vulkan presenter reads the value but does not use it. The default is off. | `MetalVideoPresenter.Compute.cs`, `VulkanVideoPresenter.cs` |
 | `SHARPEMU_SKIP_TALL_COMPUTE_Z` | number | Effect not clear from the code. The Vulkan presenter reads the number into a field for a minimum Z group count. No code uses that field. The default is 0. | `VulkanVideoPresenter.cs` |
-| `SHARPEMU_SRT_NATIVE` | `0` | `0` turns off the compiled shader resource (SRT) evaluator. By default, the resource plan of each shader is compiled once to .NET code (`DynamicMethod`) on a low-priority background thread named `SRT compiler`; until it is ready, the plan is evaluated by the interpreter, so the first use of a new shader does not wait for the compilation. With `0`, every plan always uses the interpreter. The compiled path is also off when the runtime does not support dynamic code, for example in a Native AOT build. | `CompiledResourceEvaluator.cs`, `ShaderResourcePlan.cs`, `RuntimeValueEvaluator.cs` |
-| `SHARPEMU_SUSPEND_POINTS_IN_FLIGHT` | `0` | `0` makes `sceAgcSuspendPoint` wait until the frame boundary it queued is processed. The default lets one boundary wait behind the graphics commands, so the guest CPU can run one frame ahead. A wait that follows its own queue's store to the same label still sees that value when the title rewrites the label for the next frame (Dead Cells). | `CommandStreamQueue.cs`, `GpuCommandInterpreter.cs` |
 | `SHARPEMU_VK_DEBUG_LABELS` | `1` | Turns on Vulkan object names and command labels for capture tools. `SHARPEMU_VK_VALIDATION=1` also turns them on. Default is off because the labels add overhead to each draw. | `VulkanVideoPresenter.Draws.Recording.cs` |
 | `SHARPEMU_VK_DEVICE` | text (part of a device name) | Selects the Vulkan device whose name contains this text. The comparison ignores case. When unset, the presenter gives a score to each device and prefers a discrete GPU. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanVideoPresenter.cs` |
-| `SHARPEMU_VK_PIPELINE_CACHE_PATH` | path | Sets the path of the Vulkan pipeline cache file. The path can contain environment variables. Default is `user/pipeline_cache/<title id>/` below the application directory. The shader prewarm list goes to the same directory. With the per-shader cache, the files go to a `.shards` directory next to this path. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanPipelineCacheStorage.cs` |
-| `SHARPEMU_VK_PIPELINE_CACHE` | `0`, `1` or `file` | Selects the Vulkan pipeline cache file, which keeps the driver's compiled pipelines. `1` or `file` saves and loads one cache file. `0` keeps the cache in memory only on every system. The default is memory only on Windows: the GPU driver keeps its own shader cache on disk, and the shader prewarm list (`SHARPEMU_SHADER_PREWARM`) rebuilds it after an update. Linux keeps a cache file by default, and macOS keeps per-shader files. | `VulkanVideoPresenter.Device.Setup.cs` |
-| `SHARPEMU_VK_PIPELINE_CACHE_SHARDS` | `1` or `0` | `1` keeps one Vulkan pipeline cache file for each compute shader and for each vertex and pixel shader pair, in `vulkan-pipeline-cache.bin.shards`, also on Windows. `0` keeps the whole cache in one file. The default is `1` on macOS and `0` on other systems: NVIDIA adds about 2 MB of driver data to every cache file, so a file for each shader uses much more disk. A shard file loads when its pipeline is first created, and a save writes only the files that got new pipelines. The shard mode removes the old single file when `SHARPEMU_VK_PIPELINE_CACHE_PATH` is not set. A cache file that grows over 256 MiB is emptied, so the next launch starts it again. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanVideoPresenter.PipelineCacheShards.cs` |
-| `SHARPEMU_VK_PIPELINE_CACHE_LEGACY_SHARDS` | `1` | `1` names the per-shader cache files by the guest shader hash. The default names them by a hash of the translated SPIR-V, so a translator change does not load records that no longer match. | `VulkanVideoPresenter.PipelineCacheShards.cs` |
+| `SHARPEMU_VK_PIPELINE_CACHE_PATH` | path | Sets the path of the Vulkan pipeline cache file. The path can contain environment variables. Default is `user/pipeline_cache/<title id>/` below the application directory. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanPipelineCacheStorage.cs` |
+| `SHARPEMU_VK_PIPELINE_CACHE` | `0` | `0` stops the save and the load of the Vulkan pipeline cache file. The cache then stays in memory only. Default is a persistent cache file. | `VulkanVideoPresenter.Device.Setup.cs` |
 
 ## Metal
 
@@ -161,6 +149,7 @@ These variables apply to audio output and video playback.
 | --- | --- | --- | --- |
 | `SHARPEMU_ALSA_DEVICE` | text (ALSA device name) | Sets the ALSA playback device on Linux. The default is `default`. | `PosixAlsaAudioStream.cs` |
 | `SHARPEMU_AUDIO_LATENCY_MS` | number (milliseconds) | Sets the target depth of the SDL audio queue, which is the playback latency. The default is 60. Values of zero or less use the default. | `SdlHostAudio.cs` |
+| `SHARPEMU_AUDIO_OUT2_STACK_WRITES` | `1` or list (`portstate`, `systemstate`, `speaker`) | Controls writes of AudioOut2 results to output buffers on the guest stack. The default `1` permits all writes. A list permits only the named outputs and the other calls return success without a write. | `AudioOut2Exports.cs` |
 | `SHARPEMU_BINK_MODE` | text (`native`, `ffmpeg`, `dummy`, `skip`, `guest`) | Selects how the emulator handles Bink movies. `native` or `ffmpeg` decodes on the host and is the default. `dummy` shows a placeholder frame, `skip` skips the movie, and `guest` lets the guest decode. | `HostMovieBridge.cs` |
 | `SHARPEMU_LOG_MOVIE_SYNC` | `1` | Records the difference between the movie clock and the guest audio position during movie playback. The emulator reads the value one time at start. | `MediaFramePlayback.cs` |
 | `SHARPEMU_MOVIE_CLOCK` | `wall` | Sets the time base for host-decoded movie playback. By default, playback follows the guest audio clock and uses the wall clock when no guest audio flows. `wall` makes playback always use the wall clock. | `MediaFramePlayback.cs` |
@@ -193,9 +182,7 @@ These variables apply to guest memory and guest code execution.
 | `SHARPEMU_IGNORE_STACK_CHK` | `1` | Recovers from a guest stack-protector failure call (NID `Ou3iL1abvng`) when a UD2 instruction follows the call. The emulator sets the return address to the function epilogue 20 bytes before. It does this only when the code bytes match the known pattern. | `DirectExecutionBackend.Imports.cs` |
 | `SHARPEMU_LAZY_RESERVE_PRIME_MB` | number | Sets the number of megabytes that the emulator commits at the start of each reserve-only memory region. The default is 64 and the maximum is 4096. The value 0 turns the initial commit off. | `PhysicalVirtualMemory.cs` |
 | `SHARPEMU_NATIVE_WORKER_MAX_CONCURRENT` | number | Sets the maximum number of native guest worker runs that execute at the same time. The default is 2. The emulator limits the value to the range 1 to 64. | `DirectExecutionBackend.NativeWorker.cs`, `DirectExecutionBackend.cs` |
-| `SHARPEMU_GUEST_AFFINITY` | `1` | Applies the guest thread affinity to the host threads. The default leaves host threads unpinned, because pinning let spinning guest workers starve the render thread. | `DirectExecutionBackend.cs` |
-| `SHARPEMU_RENDER_CORE` | `0` | `0` turns off the render core reservation. On Windows hosts with 8 to 64 logical processors, the default gives the render thread the last physical core of the fastest efficiency class with a high priority, and keeps guest threads off that core. | `HostLaneReservation.cs`, `VulkanVideoPresenter.Present.cs`, `DirectExecutionBackend.cs` |
-| `SHARPEMU_RESERVED_HOST_LANES` | number | Set the number of host logical processors that guest thread affinity does not use. The emulator keeps these processors for its own threads. The default is three eighths of the processor count, with a minimum of 2. It has an effect only with `SHARPEMU_GUEST_AFFINITY=1`. | `DirectExecutionBackend.cs` |
+| `SHARPEMU_RESERVED_HOST_LANES` | number | Set the number of host logical processors that guest thread affinity does not use. The emulator keeps these processors for its own threads. The default is three eighths of the processor count, with a minimum of 2. | `DirectExecutionBackend.cs` |
 | `SHARPEMU_TSC_FREQ_HZ` | number (Hz, minimum 1000000) | Sets the TSC frequency that the kernel library reports to the guest. When unset, the emulator uses the calibrated RDTSC frequency, then the CPUID frequency, then the host stopwatch frequency. | `KernelRuntimeCompatExports.cs` |
 | `SHARPEMU_WATCH_BULK_DEST_HI` | hex number | Limits the `SHARPEMU_WATCH_BULK_TORN` scan to writes whose upper 32 address bits equal this value. When unset, the scan uses the direct-memory address band. | `GuestWriteWatch.cs` |
 | `SHARPEMU_WATCH_BULK_TORN` | `1` | Examines each aligned 8-byte value in managed bulk writes to guest memory. It reports torn values and shifted pointer values with a stack trace. It writes a maximum of 64 reports for each kind. | `GuestWriteWatch.cs` |
@@ -323,11 +310,9 @@ Each variable records a detailed sequence of events. Traces can be large.
 | `SHARPEMU_PROBE_IMPORT_RET` | text (NID or `*`) | Set an import NID, or `*` for all imports. For the first 8 applicable import calls, the emulator writes the bytes and the disassembly before the return address. The default is off. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs`, `DirectExecutionBackend.Diagnostics.cs` |
 | `SHARPEMU_RTC_PROBE_RANGE` | hex address range (`start-end`) | Set a range of guest addresses. When a caller of `sceRtcGetCurrentTick` returns into this range, the emulator writes 0x100 bytes of code near that return address. It does this one time only. | `RtcExports.cs` |
 | `SHARPEMU_TRACE_AGC_EQ_ACCESSORS` | `1` | Set to `1` to write an `agc.eq_accessor` line for calls to the AGC event accessor functions. Each line shows the accessor, the event address, the result and the event bytes. After 64 lines, the emulator writes only at power-of-two counts. | `AgcExports.Events.cs` |
-| `SHARPEMU_TRACE_DCC_WRITERS` | `1` | Writes a `[GPU][DCC_WRITER]` line with the shader program and a call stack for each GPU buffer write that overlaps DCC metadata. It also writes `[GPU][BOUNDED_FILL_REFUSED]` lines when a fill shader is not changed into a buffer fill. Each kind writes a maximum of 64 lines. | `DccWriterTrace.cs` |
 | `SHARPEMU_TRACE_FOCUSED_CONTINUATION` | `1` | Set to `1` to write `focused_continuation` lines for guest thread continuations. The emulator writes a line only when the stack pointer is in the range 0x6FFFAC000000 to 0x6FFFAC200000. | `DirectExecutionBackend.cs` |
 | `SHARPEMU_TRACE_FRAME_PACKETS` | `1` | Writes a `[FRAMEPKT]` line at a flip with the draw count and the dispatch count of the frame. It shows the first 8 flips, each 60th flip, and each flip that has no draws. Default is off. | `AgcExports.CommandStream.cs` |
 | `SHARPEMU_TRACE_GPU_MEMORY_ADDRESS` | hex address or `auto` | Writes `[GPU][MEMORY_TRACE]` lines for GPU memory events that touch the page of the given address. The value `auto` selects the page of the first device-address fault. Default is off. | `GuestGpuMemoryHook.cs` |
-| `SHARPEMU_TRACE_GPU_READS` | `1` | Writes a `[GPU][SYNC_READ]` line with the shader hash, the stage and the address when a shader resource read must wait for GPU-written memory. It writes one line for each shader and page, and a maximum of 64 lines. | `GpuReadTrace.cs`, `VulkanVideoPresenter.Pipelines.cs` |
 | `SHARPEMU_TRACE_GUEST_IMAGES` | `1`, `present` or `every:N[@M]` | `1` and `present` write Vulkan present trace lines (`vk.present_taken`, `vk.present_dropped`, `vk.present_sample`) and up to 64 Metal `agc.texture_fallback` lines. The code reads the `every:N[@M]` form, but no code uses the result. Default is off. | `VulkanVideoPresenter.Draws.Recording.cs`, `VulkanVideoPresenter.Present.cs`, `MetalTextureSnapshots.cs` |
 | `SHARPEMU_TRACE_GUEST_IMAGE_ADDRS` | list of hex addresses or `*` | The guest image write tracker writes `[WT][LIFETIME]` lines for each tracked range that contains a listed address. `*` selects all ranges. The Vulkan presenter also reads the list, but no code uses that filter. | `GuestImageWriteTracker.cs`, `VulkanVideoPresenter.Draws.Recording.cs` |
 | `SHARPEMU_TRACE_GUEST_IMAGE_FORMAT` | text (Vulkan format name) | Effect not clear from the code. The Vulkan presenter keeps the name for an image filter that compares the image format, but no code calls the filter. | `VulkanVideoPresenter.Draws.Recording.cs` |
@@ -339,7 +324,6 @@ Each variable records a detailed sequence of events. Traces can be large.
 | `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_ADDRS` | list of hex addresses or `*` | Writes a `vk.present_sample` trace line when the presenter shows a guest image at a listed address. It records the first presentation of each address unless `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_OCCURRENCE` is set. | `VulkanVideoPresenter.Draws.Recording.cs`, `VulkanVideoPresenter.RenderLoop.cs` |
 | `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_OCCURRENCE` | number | Selects which presentation of an address in `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_ADDRS` the presenter records. Default is 0, which selects the first presentation. | `VulkanVideoPresenter.Draws.Recording.cs` |
 | `SHARPEMU_TRACE_TITLE_INTERFACE` | `1` | The SPIR-V translator writes `[AGC][TITLE-INTERFACE]` lines with the export and interpolation instructions of a shader. It does this only for the programs at addresses 0x0000000500780000 and 0x0000000500781200. | `Gen5SpirvTranslator.cs` |
-| `SHARPEMU_TRACE_WRITER_ADDRESS` | hex address | Writes a `[GPU][TARGET_WRITER]` line with the shader program and a call stack for each GPU buffer write that covers this guest address. It writes a maximum of 64 lines. Default is off. | `DccWriterTrace.cs` |
 
 ## Data dumps
 
@@ -372,7 +356,6 @@ Each variable records timings or counts.
 | `SHARPEMU_PERF_MEM` | `1` | Set to `1` to count the POSIX fault signals that the signal handler receives. The emulator writes a `[PERF][MEM] posix_faults` line after each 100000 signals. This has an effect only on POSIX hosts. | `DirectExecutionBackend.PosixSignals.cs` |
 | `SHARPEMU_PROFILE_DCB_PARSE` | `1` | Set to `1` to measure the time to parse draw command buffers. The emulator writes `[PERF][DCB_PARSE]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `DcbParseProfile.cs` |
 | `SHARPEMU_PROFILE_DCB_SUBMISSION` | `1` | Set to `1` to measure command buffer submission and geometry snapshot work. The emulator writes `[PERF][DCB_SUBMIT]`, `[PERF][VERTEX_SNAPSHOT]` and `[PERF][SNAPSHOT_PREPASS]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `DcbSubmissionProfile.cs` |
-| `SHARPEMU_PROFILE_GPU_DRAWS` | `1` | Use with the render profile. Writes a GPU timestamp after each draw and dispatch, so that the `[PERF][GPU_INTERVAL]` lines give the GPU time of each pipeline. The default writes only two timestamps for each submission for the `[PERF][GPU_BUSY]` lines, because one timestamp for each draw can change the GPU time. | `VulkanCommandProfile.cs` |
 | `SHARPEMU_PROFILE_GUEST_IMAGE_TRACKER` | `1` | Set to `1` to record counters for the guest image write tracker. The emulator writes `[PERF][GUEST_IMAGE_TRACKER]` and `[PERF][GUEST_IMAGE_TRACKER_RANGE]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `GuestImageWriteTracker.cs` |
 | `SHARPEMU_PROFILE_GUEST_RIP_INTERVAL_MS` | number (milliseconds) | Set the time between samples of the guest code profiler. The value must be more than 0. The default is 2. | `DirectExecutionBackend.GuestSampler.cs` |
 | `SHARPEMU_PROFILE_GUEST_RIP_REPORT_S` | number (seconds) | Set the time between reports of the guest code profiler. The value must be more than 0. The default is 15. | `DirectExecutionBackend.GuestSampler.cs` |

src/SharpEmu.CLI/Program.cs

@@ -323,16 +323,6 @@ internal static partial class Program
                     VideoOutExports.NotifyHostInterrupt();
                 };
                 Console.CancelKeyPress += cancelHandler;
-                // SIGTERM (launchd, process managers, `kill`) takes the same cooperative shutdown: the
-                // runtime's default exits with GPU work in flight, which leaves the host driver to reclaim
-                // resources the device still owns.
-                using var terminateRegistration = OperatingSystem.IsWindows()
-                    ? null
-                    : PosixSignalRegistration.Create(PosixSignal.SIGTERM, context =>
-                    {
-                        context.Cancel = true;
-                        VideoOutExports.NotifyHostInterrupt();
-                    });
 
                 Console.Error.WriteLine($"[DEBUG] Running: {ebootPath}");
                 result = runtime.Run(ebootPath);

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Diagnostics.cs

@@ -88,14 +88,6 @@ public sealed partial class DirectExecutionBackend
 					return $"{kvp.Key}: {cores:F2}cores {seconds:F1}s n={callCount} {perCallUs:F2}us/call";
 				});
 			System.Console.Error.WriteLine($"[PERF][HLE] cost: {string.Join(" | ", top)}");
-
-			if (SharpEmu.HLE.GuestFastPath.Enabled)
-			{
-				var fastPath = SharpEmu.HLE.GuestFastPath.SnapshotCounters();
-				System.Console.Error.WriteLine(
-					$"[PERF][HLE] fast_path: self_hits={fastPath.SelfHits} " +
-					$"getspecific_hits={fastPath.GetspecificHits} blocks={fastPath.Blocks}");
-			}
 		}
 	}
 

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Exceptions.cs

@@ -114,7 +114,7 @@ public sealed partial class DirectExecutionBackend
 
 			ulong rip = ReadCtxU64(contextRecord, 248);
 			ulong rsp = ReadCtxU64(contextRecord, 152);
-			if (MayBeGuestInt41(exceptionRecord) && TryRecoverGuestInt41(exceptionCode, contextRecord, rip))
+			if (TryRecoverGuestInt41(exceptionCode, contextRecord, rip))
 			{
 				return -1;
 			}
@@ -619,16 +619,6 @@ public sealed partial class DirectExecutionBackend
 		return (ulong)(_workerAbortStack + (nint)WorkerAbortStackSize - 0x100) & ~0xFUL;
 	}
 
-	// On Windows an INT n the guest may not execute raises a general-protection fault,
-	// reported as an access violation whose fault address is all ones; a page fault
-	// carries the data address instead. GPU-tracked and lazily committed pages fault
-	// thousands of times per frame, so skip the opcode probe (a VirtualQuery and a
-	// read of the faulting instruction) for them.
-	private static unsafe bool MayBeGuestInt41(EXCEPTION_RECORD* exceptionRecord) =>
-		!OperatingSystem.IsWindows() ||
-		exceptionRecord->NumberParameters < 2 ||
-		exceptionRecord->ExceptionInformation[1] == ulong.MaxValue;
-
 	private unsafe bool TryRecoverGuestInt41(uint exceptionCode, void* contextRecord, ulong rip)
 	{
 		if (!_ignoreGuestInt41 || exceptionCode != 3221225477u || rip < 0x10000)

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.FastPath.cs

@@ -1,286 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System;
-using System.Collections.Generic;
-using System.Runtime.InteropServices;
-using SharpEmu.HLE;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-/// <summary>
-/// Native fast-path stubs for the trivial per-thread imports that dominate the
-/// HLE call count. Each stub answers from <see cref="GuestFastPath"/>'s
-/// per-host-thread block and jumps to the normal import trampoline whenever it
-/// cannot, so the managed implementation stays the single source of truth for
-/// every case the stub does not handle.
-/// </summary>
-public sealed unsafe partial class DirectExecutionBackend
-{
-	internal enum GuestFastPathStub
-	{
-		None,
-		PthreadSelf,
-		PthreadGetspecific,
-		MemoryCopy,
-	}
-
-	// scePthreadSelf / pthread_self.
-	private const string PthreadSelfNid = "aI+OeCz8xrQ";
-	private const string PosixPthreadSelfNid = "EotR8a3ASf4";
-
-	// scePthreadGetspecific / pthread_getspecific.
-	private const string PthreadGetspecificNid = "eoht7mQOCmo";
-	private const string PosixPthreadGetspecificNid = "0-KXaS70xy4";
-
-	// memcpy / memmove.
-	private const string MemcpyNid = "Q3VBxCXhUHs";
-	private const string MemmoveNid = "+P6FRGH4LfA";
-
-	// Guest memory is identity-mapped and every fault the copy can take (write tracking, lazy
-	// commit) is resolved from the fault address alone, so the copy may run as guest-side code.
-	// SHARPEMU_HLE_FAST_MEMCPY=0 keeps it on the managed export.
-	private static readonly bool GuestMemoryCopyStubEnabled =
-		!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_HLE_FAST_MEMCPY"), "0", StringComparison.Ordinal);
-
-	private uint _fastPathBlockTlsIndex = uint.MaxValue;
-	private bool _guestFastPathEnabled;
-	private int _guestFastPathStubCount;
-
-	/// <summary>
-	/// Decides whether native fast-path stubs may be installed for this run and
-	/// arms <see cref="GuestFastPath"/> if so. Any diagnostic mode that must
-	/// observe every import call keeps the fast path off, because a stub answers
-	/// without ever reaching the managed gateway that does the tracing.
-	/// </summary>
-	private void ConfigureGuestFastPath()
-	{
-		_guestFastPathEnabled = false;
-		_guestFastPathStubCount = 0;
-
-		// Emission uses the macOS pthread gs-indexed key array. Windows and
-		// Linux keep the managed gateway until their TLS read is emitted too.
-		if (!OperatingSystem.IsMacOS() ||
-			RuntimeInformation.ProcessArchitecture != Architecture.X64)
-		{
-			return;
-		}
-
-		if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_HLE_FAST_PATH"), "0", StringComparison.Ordinal))
-		{
-			Console.Error.WriteLine("[LOADER][INFO] HLE native fast path disabled by SHARPEMU_HLE_FAST_PATH=0.");
-			return;
-		}
-
-		if (_logAllImports ||
-			!string.IsNullOrEmpty(_importFilter) ||
-			string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_PTHREADS"), "1", StringComparison.Ordinal))
-		{
-			Console.Error.WriteLine(
-				"[LOADER][INFO] HLE native fast path disabled: import/pthread tracing needs every call in the gateway.");
-			return;
-		}
-
-		if (_fastPathBlockTlsIndex == uint.MaxValue)
-		{
-			_fastPathBlockTlsIndex = TlsAlloc();
-			if (_fastPathBlockTlsIndex == uint.MaxValue)
-			{
-				return;
-			}
-		}
-
-		var tlsIndex = _fastPathBlockTlsIndex;
-		GuestFastPath.Enable(block => TlsSetValue(tlsIndex, block));
-		_guestFastPathEnabled = true;
-	}
-
-	private static GuestFastPathStub ClassifyGuestFastPathStub(string nid) => nid switch
-	{
-		PthreadSelfNid or PosixPthreadSelfNid => GuestFastPathStub.PthreadSelf,
-		PthreadGetspecificNid or PosixPthreadGetspecificNid => GuestFastPathStub.PthreadGetspecific,
-		MemcpyNid or MemmoveNid => GuestFastPathStub.MemoryCopy,
-		_ => GuestFastPathStub.None,
-	};
-
-	/// <summary>
-	/// Builds the native stub for <paramref name="nid"/>, falling back to
-	/// <paramref name="fallbackTrampoline"/> (the import's managed gateway
-	/// trampoline) for every case the stub declines.
-	/// </summary>
-	private unsafe bool TryCreateGuestFastPathStub(string nid, nint fallbackTrampoline, out nint address)
-	{
-		address = 0;
-		if (!_guestFastPathEnabled || fallbackTrampoline == 0)
-		{
-			return false;
-		}
-
-		var kind = ClassifyGuestFastPathStub(nid);
-		if (kind == GuestFastPathStub.None ||
-			// The write watch inspects every managed guest write, which a native copy never reaches.
-			(kind == GuestFastPathStub.MemoryCopy && (!GuestMemoryCopyStubEnabled || GuestWriteWatch.Armed)))
-		{
-			return false;
-		}
-
-		var code = EmitGuestFastPathStub(kind, _fastPathBlockTlsIndex, fallbackTrampoline);
-		const uint stubAllocationSize = 128u;
-		if (code.Count > stubAllocationSize)
-		{
-			return false;
-		}
-
-		void* memory = VirtualAlloc(null, stubAllocationSize, 12288u, 64u);
-		if (memory == null)
-		{
-			return false;
-		}
-
-		for (var i = 0; i < code.Count; i++)
-		{
-			((byte*)memory)[i] = code[i];
-		}
-
-		uint oldProtect = 0;
-		if (!VirtualProtect(memory, stubAllocationSize, 32u, &oldProtect))
-		{
-			VirtualFree(memory, 0u, 32768u);
-			return false;
-		}
-
-		FlushInstructionCache(GetCurrentProcess(), memory, (nuint)code.Count);
-		address = (nint)memory;
-		_importHandlerTrampolines.Add(address);
-		_guestFastPathStubCount++;
-		return true;
-	}
-
-	/// <summary>
-	/// Emits one fast-path stub. The stubs obey the SysV ABI the guest calls
-	/// them with: the answer goes in RAX, only RAX and the arithmetic flags are
-	/// clobbered (both caller-saved across a call), and on the slow path every
-	/// register - including the incoming RAX that carries the variadic vector
-	/// count - is restored before jumping to the trampoline.
-	/// </summary>
-	internal static List<byte> EmitGuestFastPathStub(
-		GuestFastPathStub kind,
-		uint blockTlsIndex,
-		nint fallbackTrampoline)
-	{
-		if (kind == GuestFastPathStub.MemoryCopy)
-		{
-			return EmitGuestMemoryCopyStub(fallbackTrampoline);
-		}
-
-		var code = new List<byte>(48);
-		var slowPathFixups = new List<int>();
-
-		void Emit(params byte[] bytes) => code.AddRange(bytes);
-
-		// Emits a short conditional branch to the slow path; 0x74 is JE, 0x73 is JAE.
-		void EmitBranchToSlowPath(byte opcode)
-		{
-			Emit(opcode, 0x00); // rel8, patched once the slow-path offset is known
-			slowPathFixups.Add(code.Count - 1);
-		}
-
-		void EmitJumpToSlowPath() => EmitBranchToSlowPath(0x74);
-
-		// push rax: the guest's incoming RAX/AL must survive a slow-path bail.
-		Emit(0x50);
-
-		// mov rax, gs:[blockTlsIndex * 8] - the macOS pthread key array is the
-		// gs-based thread specific data array, so a key read is a single load.
-		Emit(0x65, 0x48, 0x8B, 0x04, 0x25);
-		code.AddRange(BitConverter.GetBytes(checked(blockTlsIndex * 8u)));
-
-		// test rax, rax / je slow: no block published on this host thread.
-		Emit(0x48, 0x85, 0xC0);
-		EmitJumpToSlowPath();
-
-		switch (kind)
-		{
-			case GuestFastPathStub.PthreadSelf:
-				// cmp qword [rax + SelfHandleOffset], 0 / je slow: no guest
-				// thread bound here, and a host thread's pthread_self has to
-				// reach the managed export for its scheduler registration.
-				Emit(0x48, 0x83, 0x78, checked((byte)GuestFastPath.BlockSelfHandleOffset), 0x00);
-				EmitJumpToSlowPath();
-				// inc qword [rax + SelfHitsOffset]
-				Emit(0x48, 0xFF, 0x40, checked((byte)GuestFastPath.BlockSelfHitsOffset));
-				// mov rax, [rax + SelfHandleOffset]
-				Emit(0x48, 0x8B, 0x40, checked((byte)GuestFastPath.BlockSelfHandleOffset));
-				break;
-
-			case GuestFastPathStub.PthreadGetspecific:
-				// cmp qword [rax + TlsValuesOffset], 0 / je slow: this thread
-				// has no value table published.
-				Emit(0x48, 0x83, 0x78, checked((byte)GuestFastPath.BlockTlsValuesOffset), 0x00);
-				EmitJumpToSlowPath();
-				// cmp rdi, TlsSlotCount / jae slow. An out-of-range or
-				// sign-extended negative key is answered by the managed path,
-				// which truncates it to int and consults the key registry.
-				Emit(0x48, 0x81, 0xFF);
-				code.AddRange(BitConverter.GetBytes(GuestFastPath.TlsSlotCount));
-				EmitBranchToSlowPath(0x73);
-				// inc qword [rax + GetspecificHitsOffset]
-				Emit(0x48, 0xFF, 0x40, checked((byte)GuestFastPath.BlockGetspecificHitsOffset));
-				// mov rax, [rax + TlsValuesOffset] / mov rax, [rax + rdi*8]
-				Emit(0x48, 0x8B, 0x40, checked((byte)GuestFastPath.BlockTlsValuesOffset));
-				Emit(0x48, 0x8B, 0x04, 0xF8);
-				break;
-
-			default:
-				throw new ArgumentOutOfRangeException(nameof(kind), kind, "Unknown fast-path stub kind.");
-		}
-
-		// add rsp, 8 (drop the saved RAX - the result replaces it) / ret
-		Emit(0x48, 0x83, 0xC4, 0x08);
-		Emit(0xC3);
-
-		var slowPathOffset = code.Count;
-
-		// pop rax / jmp qword [rip+0] - the absolute target follows the
-		// instruction, so nothing else is clobbered on the way out.
-		Emit(0x58);
-		Emit(0xFF, 0x25, 0x00, 0x00, 0x00, 0x00);
-		code.AddRange(BitConverter.GetBytes((long)fallbackTrampoline));
-
-		foreach (var fixup in slowPathFixups)
-		{
-			var delta = slowPathOffset - (fixup + 1);
-			if (delta is < 0 or > 127)
-			{
-				throw new InvalidOperationException("Fast-path stub slow-path branch is out of rel8 range.");
-			}
-
-			code[fixup] = (byte)delta;
-		}
-
-		return code;
-	}
-
-	/// <summary>
-	/// memcpy/memmove(dst, src, n) as a forward <c>rep movsb</c>, returning dst. The libc
-	/// export copies with memmove semantics, so a destination that starts inside the source
-	/// (where a forward copy would read bytes it already overwrote) takes the managed path.
-	/// Only RAX, RCX, RSI, RDI and the flags change - all caller-saved - and the direction
-	/// flag is clear on entry per the SysV ABI.
-	/// </summary>
-	internal static List<byte> EmitGuestMemoryCopyStub(nint fallbackTrampoline)
-	{
-		var code = new List<byte>(40);
-		// mov rcx, rdi / sub rcx, rsi / cmp rcx, rdx / jb slow: dst - src < n (unsigned) is
-		// exactly a destination in (src, src + n) or equal to src with a non-empty copy.
-		code.AddRange([0x48, 0x89, 0xF9, 0x48, 0x29, 0xF1, 0x48, 0x39, 0xD1, 0x72, 0x00]);
-		var slowPathFixup = code.Count - 1;
-		// mov rax, rdi / mov rcx, rdx / rep movsb / ret
-		code.AddRange([0x48, 0x89, 0xF8, 0x48, 0x89, 0xD1, 0xF3, 0xA4, 0xC3]);
-		code[slowPathFixup] = checked((byte)(code.Count - (slowPathFixup + 1)));
-		// jmp qword [rip+0] with the absolute trampoline address after it.
-		code.AddRange([0xFF, 0x25, 0x00, 0x00, 0x00, 0x00]);
-		code.AddRange(BitConverter.GetBytes((long)fallbackTrampoline));
-		return code;
-	}
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Imports.cs

@@ -185,11 +185,6 @@ public sealed partial class DirectExecutionBackend
 			return hotMemoryResult;
 		}
 
-		if (importStubEntry.IsTrivialLeaf && !_disableTrivialLeafDispatch)
-		{
-			return DispatchTrivialLeaf(cpuContext, in importStubEntry, argPackPtr, num);
-		}
-
 		if (importStubEntry.IsLeaf &&
 			TryDispatchLeafImport(cpuContext, importStubEntry, argPackPtr, num, out var leafResult))
 		{
@@ -345,14 +340,6 @@ public sealed partial class DirectExecutionBackend
 			Console.Error.WriteLine(
 				$"[LOADER][TRACE] bootstrap_call#{num}: op=0x{value:X16} sym_ptr=0x{value2:X16} sym='{symbolText}' out_ptr=0x{num3:X16} ret=0x{num7:X16}");
 		}
-		// Once the host is shutting down, a guest thread still running reaches no more HLE: the
-		// services behind the imports are being torn down, and a title that sees them fail (a null
-		// command buffer from the GPU library, say) crashes the process on its way out.
-		if (_forcedGuestExit && !ActiveForcedGuestExit && TryEndGuestSliceForShutdown(argPackPtr))
-		{
-			cpuContext[CpuRegister.Rax] = 1uL;
-			return 1uL;
-		}
 		if (!isGuestWorker &&
 			!ActiveForcedGuestExit &&
 			ShouldForceGuestExitOnImportLoop(in importStubEntry, num7, num, value, value2))
@@ -1244,17 +1231,6 @@ public sealed partial class DirectExecutionBackend
 			return TryReadHostQword(address, out value);
 		}
 
-		// Stack arguments sit on the calling guest thread's own stack, which the backend mapped read-write
-		// for the thread's lifetime and no tracker ever protects. Reading inside it needs no query: the
-		// cached range below is keyed by a mapping generation that every tracker protection change bumps,
-		// so falling through here cost a locked host region query per argument on nearly every import.
-		if (_activeGuestThreadState is { StackSize: > 0 } thread &&
-			address >= thread.StackBase && address <= thread.StackBase + thread.StackSize - sizeof(ulong))
-		{
-			value = *(ulong*)address;
-			return true;
-		}
-
 		var generation = HostMemory.MappingGeneration;
 		if (generation == _importReadableGeneration &&
 			address >= _importReadableStart && address <= _importReadableEnd - 8)
@@ -1518,68 +1494,6 @@ public sealed partial class DirectExecutionBackend
 		return true;
 	}
 
-	private static readonly bool _disableTrivialLeafDispatch = string.Equals(
-		Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_TRIVIAL_LEAF"), "1", StringComparison.Ordinal);
-
-	// Tiny exports called millions of times per second, where the ~250ns of full
-	// import bookkeeping costs more than the export itself. Each one reads only
-	// argument registers (RDI..R9) and thread-local state, returns in RAX, never
-	// blocks, yields, calls back into the guest or reads the guest stack.
-	private static bool IsTrivialLeafImport(string nid) =>
-		nid is
-			"0-KXaS70xy4" or // pthread_getspecific
-			"eoht7mQOCmo" or // scePthreadGetspecific
-			"EI-5-jlq2dE" or // scePthreadGetthreadid
-			"3eqs37G74-s" or // pthread_getthreadid_np
-			"BNowx2l588E" or // sceKernelGetProcessTimeCounterFrequency
-			"fgxnMeTNUtY" or // sceKernelGetProcessTimeCounter
-			"4J2sUJmuHZQ" or // sceKernelGetProcessTime
-			"-2IRUCO--PM" or // sceKernelReadTsc
-			"1j3S3n-tTW4" or // sceKernelGetTscFrequency
-			"ob5xAW4ln-0" or // strchr
-			"9yDWMxEFdJU" or // strrchr
-			"V++UgBtQhn0";   // sceAgcGetDataPacketPayloadAddress
-
-	private unsafe ulong DispatchTrivialLeaf(
-		CpuContext cpuContext,
-		in ImportStubEntry importStubEntry,
-		nint argPackPtr,
-		long dispatchIndex)
-	{
-		// Polling loops on the host main thread use the time queries as loop-guard
-		// boundaries; keep resetting the pattern so skipping the guard here cannot
-		// turn a legitimate time-polling loop into a forced exit.
-		if (importStubEntry.IsLoopGuardBoundary && !GuestThreadExecution.IsGuestThread)
-		{
-			ResetImportLoopPattern();
-		}
-
-		cpuContext.Rip = importStubEntry.Address;
-		cpuContext[CpuRegister.Rdi] = *(ulong*)argPackPtr;
-		cpuContext[CpuRegister.Rsi] = *(ulong*)(argPackPtr + 8);
-		cpuContext[CpuRegister.Rdx] = *(ulong*)(argPackPtr + 16);
-		cpuContext[CpuRegister.Rcx] = *(ulong*)(argPackPtr + 24);
-		cpuContext[CpuRegister.R8] = *(ulong*)(argPackPtr + 32);
-		cpuContext[CpuRegister.R9] = *(ulong*)(argPackPtr + 40);
-		cpuContext.ClearRaxWriteFlag();
-		var returnValue = importStubEntry.Export!.Function(cpuContext);
-		if (!cpuContext.WasRaxWritten)
-		{
-			cpuContext[CpuRegister.Rax] = unchecked((ulong)returnValue);
-		}
-
-		if (returnValue != (int)OrbisGen2Result.ORBIS_GEN2_OK &&
-			ShouldLogImportResult(importStubEntry.Nid, (OrbisGen2Result)returnValue))
-		{
-			Console.Error.WriteLine(
-				$"[LOADER][WARN] Import#{dispatchIndex} result: {(OrbisGen2Result)returnValue} ({importStubEntry.Nid}) " +
-				$"rdi=0x{cpuContext[CpuRegister.Rdi]:X16} rsi=0x{cpuContext[CpuRegister.Rsi]:X16} " +
-				$"ret=0x{*(ulong*)(argPackPtr + 96):X16}");
-		}
-
-		return cpuContext[CpuRegister.Rax];
-	}
-
 	private static bool IsNoBlockLeafImport(string nid) =>
 		nid is
 			"8aI7R7WaOlc" or // sceAmprCommandBufferConstructor
@@ -1637,19 +1551,6 @@ public sealed partial class DirectExecutionBackend
 		var expectedEqueueTimeout =
 			string.Equals(nid, "fzyMKs9kim0", StringComparison.Ordinal) &&
 			result == OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT;
-		// scePthreadCondTimedwait and sceKernelWaitEventFlag report an elapsed timeout.
-		var expectedWaitTimeout =
-			(nid is "BmMjYxmew1w" or "JTvBflhYazQ") &&
-			result == OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT;
-		// scePthreadMutexLock on an error-checking mutex the caller already owns; titles use it
-		// to build their own recursive locks.
-		var expectedErrorCheckRelock =
-			string.Equals(nid, "9UK1vLZQft4", StringComparison.Ordinal) &&
-			result == OrbisGen2Result.ORBIS_GEN2_ERROR_DEADLOCK;
-		// scePadReadState on a handle that is not open; titles poll every pad slot.
-		var expectedPadNotOpen =
-			string.Equals(nid, "YndgXqQVV7c", StringComparison.Ordinal) &&
-			resultValue == unchecked((int)0x80920003);
 		var expectedMutexTrylockBusy =
 			(nid is "K-jXhbt2gn4" or "upoVrzMHFeE") &&
 			result == OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY;
@@ -1674,9 +1575,6 @@ public sealed partial class DirectExecutionBackend
 		if (!expectedFileProbeMiss &&
 			!expectedTimedWaitTimeout &&
 			!expectedEqueueTimeout &&
-			!expectedWaitTimeout &&
-			!expectedErrorCheckRelock &&
-			!expectedPadNotOpen &&
 			!expectedMutexTrylockBusy &&
 			!expectedSemaphoreTrywaitAgain &&
 			!expectedPollSemaBusy &&
@@ -1869,20 +1767,6 @@ public sealed partial class DirectExecutionBackend
 		}
 	}
 
-	// Returns the import straight to the host entry stub, which ends this guest slice.
-	private unsafe bool TryEndGuestSliceForShutdown(nint argPackPtr)
-	{
-		ulong sentinel = ActiveEntryReturnSentinelRip;
-		if (sentinel < 65536 || !TryPatchActiveGuestReturnSlot(sentinel))
-		{
-			return false;
-		}
-
-		*(ulong*)(argPackPtr + 96) = sentinel;
-		ActiveForcedGuestExit = true;
-		return true;
-	}
-
 	private unsafe bool TryForceGuestExitToHostStub(nint argPackPtr, long dispatchIndex, ulong returnRip, string nid)
 	{
 		ulong num = ActiveEntryReturnSentinelRip;
@@ -2018,7 +1902,6 @@ public sealed partial class DirectExecutionBackend
 			"BmMjYxmew1w" or // scePthreadCondTimedwait
 			"Op8TBGY5KHg" or // pthread_cond_wait
 			"27bAgiJmOh0" or // pthread_cond_timedwait
-			"Zxa0VhQVTsk" or // sceKernelWaitSema
 			"n88vx3C5nW8" or // gettimeofday
 			"lLMT9vJAck0" or // clock_gettime
 			"-2IRUCO--PM" or // sceKernelReadTsc

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.MachExceptions.cs

@@ -1,51 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System;
-using System.Runtime.InteropServices;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-// On macOS the runtime receives EXC_BAD_ACCESS on each of its threads through a Mach exception
-// port before the kernel raises SIGSEGV or SIGBUS. It calls any fault in the page holding RSP, or
-// the page below it, a stack overflow and aborts, assuming RSP is on a stack it owns. Guest code
-// runs on guest stacks, and those pages fault whenever GPU or image write tracking has protected
-// them, so a thread running guest code must leave its access faults to the signal handler. The
-// handler resolves guest faults and chains every other one to the runtime's own signal handler,
-// the same path the runtime uses on Linux.
-public sealed unsafe partial class DirectExecutionBackend
-{
-	private const uint ExceptionMaskBadAccess = 1u << 1;
-	private const int ExceptionDefault = 1;
-	private const int ThreadStateNone = 13;
-
-	[ThreadStatic]
-	private static bool _guestFaultsUseSignals;
-
-	private static int _machExceptionPortWarning;
-
-	[DllImport("libSystem.dylib", EntryPoint = "mach_thread_self")]
-	private static extern uint MachThreadSelf();
-
-	[DllImport("libSystem.dylib", EntryPoint = "thread_set_exception_ports")]
-	private static extern int ThreadSetExceptionPorts(uint thread, uint exceptionMask, uint newPort, int behavior, int newFlavor);
-
-	[DllImport("libSystem.dylib", EntryPoint = "mach_port_deallocate")]
-	private static extern int MachPortDeallocate(uint task, uint name);
-
-	private static readonly uint _machTaskSelf = OperatingSystem.IsMacOS()
-		? (uint)Marshal.ReadInt32(NativeLibrary.GetExport(NativeLibrary.Load("libSystem.dylib"), "mach_task_self_"))
-		: 0;
-
-	private static void RouteGuestAccessFaultsToSignals()
-	{
-		if (_guestFaultsUseSignals || !OperatingSystem.IsMacOS())
-			return;
-		_guestFaultsUseSignals = true;
-		var thread = MachThreadSelf();
-		var result = ThreadSetExceptionPorts(thread, ExceptionMaskBadAccess, 0, ExceptionDefault, ThreadStateNone);
-		_ = MachPortDeallocate(_machTaskSelf, thread);
-		if (result != 0 && System.Threading.Interlocked.Exchange(ref _machExceptionPortWarning, 1) == 0)
-			Console.Error.WriteLine($"[LOADER][WARN] Cannot hand guest access faults to the signal handler: thread_set_exception_ports={result}.");
-	}
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.NativeWorker.cs

@@ -134,7 +134,7 @@ public sealed partial class DirectExecutionBackend
 			try
 			{
 				var state = _activeGuestThreadState;
-				if (LogThreadMode && state is { Name: "tbb_thead" })
+				if (state is { Name: "tbb_thead" })
 				{
 					var n = Interlocked.Increment(ref _tbbNativeRunEnterCount);
 					if (n <= 12 || n % 64 == 0)
@@ -750,7 +750,6 @@ public sealed partial class DirectExecutionBackend
 			_activeGuestThreadYieldReason = null;
 			_activeGuestThreadState = _runState;
 			backend.BindTlsBase(_runContext!);
-			RouteGuestAccessFaultsToSignals();
 			TlsSetValue(backend._hostRspSlotTlsIndex, _runHostRspSlot);
 			if (backend._workerDoneEventTlsIndex != uint.MaxValue)
 			{

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.PosixSignalStack.cs

@@ -1,140 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System;
-using System.Runtime.InteropServices;
-using Iced.Intel;
-using SharpEmu.HLE;
-using static Iced.Intel.AssemblerRegisters;
-
-namespace SharpEmu.Core.Cpu.Native;
-
-// Guest faults are delivered on the guest stack. The runtime only knows the thread's own stack,
-// so managed code that runs on the guest stack can make a garbage collection misread the frames
-// of that thread. Windows swaps the stack bounds in the TEB while guest code runs; POSIX cannot,
-// so the signal handler moves to the host stack below the frames that entered guest code first.
-public sealed unsafe partial class DirectExecutionBackend
-{
-	// Host stack below the saved host RSP that is still treated as the host frames in use.
-	private const ulong HostStackSearchBytes = 0x100_0000;
-	private const int SignalStackGap = 0x1000;
-
-	// [0] the host RSP TLS slot (uint.MaxValue while unknown), [8] the Win64 TlsGetValue stub.
-	private static nint _signalStackCells;
-
-	private static unsafe nint CreatePosixSignalTrampoline()
-	{
-		_signalStackCells = (nint)NativeMemory.AllocZeroed(16);
-		*(uint*)_signalStackCells = uint.MaxValue;
-
-		var a = new Assembler(64);
-		var direct = a.CreateLabel();
-		var call = a.CreateLabel();
-		var done = a.CreateLabel();
-		a.push(rbx);
-		a.push(r12);
-		a.push(r13);
-		a.push(r14);
-		a.push(r15);
-		a.mov(r12d, edi);
-		a.mov(r13, rsi);
-		a.mov(r14, rdx);
-		a.mov(rbx, rsp);
-
-		// The saved host RSP of this thread, when it entered guest code.
-		a.mov(rax, (ulong)_signalStackCells);
-		a.mov(ecx, __dword_ptr[rax]);
-		a.cmp(ecx, -1);
-		a.je(direct);
-		a.mov(rax, __qword_ptr[rax + 8]);
-		a.test(rax, rax);
-		a.je(direct);
-		a.sub(rsp, 48);
-		a.call(rax);
-		a.add(rsp, 48);
-		a.test(rax, rax);
-		a.je(direct);
-		a.mov(r15, __qword_ptr[rax]);
-		a.test(r15, r15);
-		a.je(direct);
-
-		// Already on the host stack below the saved RSP: an import or host code faulted.
-		a.cmp(rbx, r15);
-		a.jae(call);
-		a.mov(rax, r15);
-		a.sub(rax, rbx);
-		a.cmp(rax, (int)HostStackSearchBytes);
-		a.jb(direct);
-
-		a.Label(ref call);
-		a.lea(rsp, __[r15 - SignalStackGap]);
-		a.and(rsp, -16);
-		a.Label(ref direct);
-		a.mov(edi, r12d);
-		a.mov(rsi, r13);
-		a.mov(rdx, r14);
-		a.mov(rax, (ulong)(nint)(delegate* unmanaged<int, nint, nint, void>)&HandlePosixSignal);
-		a.call(rax);
-		a.Label(ref done);
-		a.mov(rsp, rbx);
-		a.pop(r15);
-		a.pop(r14);
-		a.pop(r13);
-		a.pop(r12);
-		a.pop(rbx);
-		a.ret();
-
-		var page = (byte*)HostMemory.Alloc(null, 4096, HostMemory.MEM_COMMIT | HostMemory.MEM_RESERVE, HostMemory.PAGE_EXECUTE_READWRITE);
-		if (page == null)
-		{
-			throw new OutOfMemoryException("Failed to allocate the POSIX signal trampoline page");
-		}
-
-		var writer = new SpanCodeWriter(new Span<byte>(page, 4096));
-		a.Assemble(writer, (ulong)page);
-		if (!HostMemory.Protect(page, 4096, HostMemory.PAGE_EXECUTE_READ, out _))
-		{
-			throw new InvalidOperationException("Failed to protect the POSIX signal trampoline page");
-		}
-
-		return (nint)page;
-	}
-
-	private unsafe void PublishSignalStackState()
-	{
-		if (_signalStackCells == 0)
-		{
-			return;
-		}
-
-		*(nint*)(_signalStackCells + 8) = _tlsGetValueAddress;
-		*(uint*)_signalStackCells = _hostRspSlotTlsIndex;
-	}
-
-	private sealed unsafe class SpanCodeWriter : CodeWriter
-	{
-		private readonly byte* _start;
-		private readonly int _length;
-		private int _offset;
-
-		public SpanCodeWriter(Span<byte> destination)
-		{
-			fixed (byte* start = destination)
-			{
-				_start = start;
-			}
-
-			_length = destination.Length;
-		}
-
-		public override void WriteByte(byte value)
-		{
-			if (_offset >= _length)
-			{
-				throw new InvalidOperationException("The POSIX signal trampoline does not fit its page.");
-			}
-
-			_start[_offset++] = value;
-		}
-	}
-}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.PosixSignals.cs

@@ -5,7 +5,6 @@ using System;
 using System.Runtime.InteropServices;
 using System.Threading;
 using SharpEmu.HLE;
-using SharpEmu.HLE.GpuMemory;
 
 namespace SharpEmu.Core.Cpu.Native;
 
@@ -24,7 +23,6 @@ public sealed unsafe partial class DirectExecutionBackend
 	private const int PosixSigIll = 4;
 	private const int PosixSigTrap = 5;
 	private const int PosixSigAbort = 6;
-	private const int PosixSigFpe = 8;
 	private const int PosixSigSegv = 11;
 	private static readonly int PosixSigBus = OperatingSystem.IsMacOS() ? 10 : 7;
 
@@ -79,7 +77,6 @@ public sealed unsafe partial class DirectExecutionBackend
 
 	private static DirectExecutionBackend? _posixSignalBackend;
 	private static bool _posixSignalHandlersInstalled;
-	private static nint _posixSignalTrampoline;
 	private static bool _posixRawRecoveryEnabled;
 	private static bool _posixSignalWarmup;
 	private static readonly nint[] _posixPreviousActions = new nint[32];
@@ -107,7 +104,6 @@ public sealed unsafe partial class DirectExecutionBackend
 		_posixSignalBackend = this;
 		if (_posixSignalHandlersInstalled)
 		{
-			PublishSignalStackState();
 			return;
 		}
 
@@ -121,20 +117,17 @@ public sealed unsafe partial class DirectExecutionBackend
 		WarmUpPosixSignalPath();
 		SharpEmu.HLE.GuestImageWriteTracker.WarmUp();
 
-		_posixSignalTrampoline = CreatePosixSignalTrampoline();
-		PublishSignalStackState();
 		if (!InstallPosixSignalHandler(PosixSigSegv) ||
 			!InstallPosixSignalHandler(PosixSigBus) ||
 			!InstallPosixSignalHandler(PosixSigIll) ||
 			!InstallPosixSignalHandler(PosixSigTrap) ||
-			!InstallPosixSignalHandler(PosixSigAbort) ||
-			!InstallPosixSignalHandler(PosixSigFpe))
+			!InstallPosixSignalHandler(PosixSigAbort))
 		{
 			throw new InvalidOperationException("Failed to install POSIX fault signal handlers");
 		}
 
 		_posixSignalHandlersInstalled = true;
-		Console.Error.WriteLine("[LOADER][INFO] POSIX signal exception bridge installed (SIGSEGV/SIGBUS/SIGILL/SIGFPE)");
+		Console.Error.WriteLine("[LOADER][INFO] POSIX signal exception bridge installed (SIGSEGV/SIGBUS/SIGILL)");
 	}
 
 	/// <summary>
@@ -198,7 +191,7 @@ public sealed unsafe partial class DirectExecutionBackend
 	{
 		byte* action = stackalloc byte[PosixSigactionSize];
 		new Span<byte>(action, PosixSigactionSize).Clear();
-		*(nint*)action = _posixSignalTrampoline;
+		*(nint*)action = (nint)(delegate* unmanaged<int, nint, nint, void>)&HandlePosixSignal;
 		// No SA_ONSTACK: the runtime's alternate stacks are far too small for
 		// the recovery/diagnostic path (JIT compilation of cold handler code
 		// can run inside the signal frame). Guest faults deliver onto the 2MB
@@ -245,7 +238,6 @@ public sealed unsafe partial class DirectExecutionBackend
 			// address (safe for host and guest threads alike) and must resume
 			// the faulting write immediately after restoring write access.
 			if (signal != PosixSigIll &&
-				signal != PosixSigFpe &&
 				siginfo != 0 &&
 				SharpEmu.HLE.GuestImageWriteTracker.TryHandleWriteFault(
 					*(ulong*)((byte*)siginfo + PosixSigInfoAddressOffset)))
@@ -253,17 +245,6 @@ public sealed unsafe partial class DirectExecutionBackend
 				return;
 			}
 
-			// GPU-tracked pages fault on every first CPU access after the GPU or an upload used them,
-			// thousands of times a second in a frame. Resolving them needs only the address and the
-			// access kind, so they skip the Win64 context conversion and the other handlers.
-			if (PosixGpuFaultFastPath && !_posixSignalWarmup &&
-				(signal == PosixSigSegv || signal == PosixSigBus) &&
-				siginfo != 0 &&
-				TryResolvePosixGpuFault(siginfo, ucontext))
-			{
-				return;
-			}
-
 			if (TryHandlePosixFault(signal, siginfo, ucontext))
 			{
 				return;
@@ -281,28 +262,6 @@ public sealed unsafe partial class DirectExecutionBackend
 		ChainPreviousPosixAction(signal, siginfo, ucontext);
 	}
 
-	private static readonly bool PosixGpuFaultFastPath =
-		Environment.GetEnvironmentVariable("SHARPEMU_POSIX_GPU_FAULT_FAST_PATH") != "0";
-
-	private static bool TryResolvePosixGpuFault(nint siginfo, nint ucontext)
-	{
-		byte* registers = GetPosixRegisterBase(ucontext);
-		if (registers == null)
-		{
-			return false;
-		}
-
-		ulong faultAddress = GetPosixFaultAddress(siginfo, registers);
-		ulong rip = *(ulong*)(registers + PosixRegisterOffsets[16]);
-		var kind = GetPosixAccessType(registers, faultAddress, rip) switch
-		{
-			0 => FaultKind.Read,
-			1 => FaultKind.Write,
-			_ => FaultKind.Unknown,
-		};
-		return kind != FaultKind.Unknown && GuestGpuMemoryHook.TryResolveFault(kind, faultAddress);
-	}
-
 	private static bool TryHandlePosixFault(int signal, nint siginfo, nint ucontext)
 	{
 		byte* registers = GetPosixRegisterBase(ucontext);
@@ -346,11 +305,6 @@ public sealed unsafe partial class DirectExecutionBackend
 		{
 			record.ExceptionCode = 1073741845u;
 		}
-		else if (signal == PosixSigFpe)
-		{
-			// STATUS_INTEGER_DIVIDE_BY_ZERO: #DE from div/idiv (zero divisor or quotient overflow).
-			record.ExceptionCode = 3221225620u;
-		}
 		else
 		{
 			ulong faultAddress = GetPosixFaultAddress(siginfo, registers);

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.StackBounds.cs

@@ -9,23 +9,10 @@ public sealed partial class DirectExecutionBackend
 {
     private const int HostStackStateBytes = 3 * sizeof(ulong);
 
-    internal static unsafe bool TryGetGuestStackBounds(ulong stackPointer, out ulong bottom, out ulong top)
+    private static unsafe bool TryGetGuestStackBounds(ulong stackPointer, out ulong bottom, out ulong top)
     {
-        if (OperatingSystem.IsWindows() &&
-            QueryVirtualMemoryInformation(-1, (void*)stackPointer, 0, out var allocation,
-                (nuint)sizeof(StackMemoryRegionInformation), null) != 0 &&
-            ((allocation.Flags & 1) == 0 || allocation.CommitSize == allocation.RegionSize) &&
-            allocation.RegionSize != 0 && allocation.RegionSize <= ulong.MaxValue - allocation.AllocationBase &&
-            stackPointer >= allocation.AllocationBase && stackPointer - allocation.AllocationBase < allocation.RegionSize)
-        {
-            bottom = allocation.AllocationBase;
-            top = bottom + allocation.RegionSize;
-            return true;
-        }
-
         bottom = top = 0;
-        var queried = VirtualQuery((void*)stackPointer, out var region, (nuint)sizeof(MEMORY_BASIC_INFORMATION64));
-        if (queried == 0 ||
+        if (VirtualQuery((void*)stackPointer, out var region, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0 ||
             region.State != 0x1000 || region.RegionSize == 0 || region.RegionSize > ulong.MaxValue - region.BaseAddress)
         {
             return false;
@@ -46,36 +33,6 @@ public sealed partial class DirectExecutionBackend
         EmitUInt32(code, ref offset, field);
     }
 
-    // Fiber switches replace the guest stack without passing through a guest-entry stub, so the
-    // context-transfer stub keeps the Windows TEB bounds in sync from the target state in R11
-    // (stack top at +160, bottom at +168). Only Windows keeps stack bounds at gs:[8]/gs:[16]: on
-    // macOS gs addresses the pthread TSD, where those slots hold errno's address and another key.
-    // Writing a fiber's bounds there nulled errno, and the next failed libc call on the thread
-    // crashed reading it (Demon's Souls, about 10 s into boot).
-    private static unsafe void EmitFiberStackBounds(byte* code, ref int offset)
-    {
-        if (!OperatingSystem.IsWindows()) return;
-        ReadOnlySpan<byte> loadTop = [0x4D, 0x8B, 0x93, 160, 0, 0, 0];     // mov r10, [r11+160]
-        foreach (var value in loadTop) EmitByte(code, ref offset, value);
-        EmitStackBound(code, ref offset, 10, 8, store: true);
-        ReadOnlySpan<byte> loadBottom = [0x4D, 0x8B, 0x93, 168, 0, 0, 0];  // mov r10, [r11+168]
-        foreach (var value in loadBottom) EmitByte(code, ref offset, value);
-        EmitStackBound(code, ref offset, 10, 16, store: true);
-    }
-
-    // Test hook: the bytes the fiber stack-bounds sync emits on this host.
-    internal static unsafe byte[] EmitFiberStackBoundsForTest()
-    {
-        var buffer = new byte[64];
-        var offset = 0;
-        fixed (byte* code = buffer)
-        {
-            EmitFiberStackBounds(code, ref offset);
-        }
-
-        return buffer[..offset];
-    }
-
     // R10 points to the entry state. R11 is scratch; RAX remains unchanged.
     private static unsafe void EmitHostStackBounds(byte* code, ref int offset, bool save)
     {
@@ -189,18 +146,4 @@ public sealed partial class DirectExecutionBackend
 
     [DllImport("kernel32.dll", ExactSpelling = true)]
     private static extern void GetCurrentThreadStackLimits(out ulong lowLimit, out ulong highLimit);
-
-    [StructLayout(LayoutKind.Sequential)]
-    private struct StackMemoryRegionInformation
-    {
-        public ulong AllocationBase;
-        public uint AllocationProtect;
-        public uint Flags;
-        public ulong RegionSize;
-        public ulong CommitSize;
-    }
-
-    [DllImport("api-ms-win-core-memory-l1-1-4.dll", ExactSpelling = true)]
-    private static extern unsafe int QueryVirtualMemoryInformation(nint process, void* address, int informationClass,
-        out StackMemoryRegionInformation information, nuint informationSize, nuint* returnSize);
 }

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.cs

@@ -53,10 +53,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 		public bool IsNoBlockLeaf { get; }
 
-		// Argument-register-only exports that never block or touch the guest
-		// stack; DispatchImport runs them without the full import bookkeeping.
-		public bool IsTrivialLeaf { get; }
-
 		public bool SuppressStrlenTrace { get; }
 
 		public bool IsLoopGuardBoundary { get; }
@@ -78,7 +74,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			Export = export;
 			IsLeaf = isLeaf;
 			IsNoBlockLeaf = isNoBlockLeaf;
-			IsTrivialLeaf = export is not null && IsTrivialLeafImport(nid);
 			SuppressStrlenTrace = suppressStrlenTrace;
 			IsLoopGuardBoundary = isLoopGuardBoundary;
 			NidHash = nidHash;
@@ -613,17 +608,9 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		private Action? _work;
 		private volatile bool _stopping;
 
-		// Every guest call that blocks in an HLE import resumes through a managed
-		// continuation frame, so a guest thread that blocks deep inside its own call
-		// tree nests host frames rather than unwinding. Demon's Souls' render thread
-		// overflowed the default thread stack within a minute of reaching its main
-		// loop; the reservation is virtual, so a generous stack costs nothing until
-		// it is touched.
-		private const int GuestExecutionStackBytes = 64 * 1024 * 1024;
-
 		public GuestExecutionRunner(ulong guestThreadHandle, string name, ThreadPriority priority)
 		{
-			_thread = new Thread(() => ThreadMain(guestThreadHandle), GuestExecutionStackBytes)
+			_thread = new Thread(() => ThreadMain(guestThreadHandle))
 			{
 				IsBackground = true,
 				Name = $"SharpEmu-{name}",
@@ -674,30 +661,18 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			finally
 			{
 				GuestThreadExecution.RestoreGuestThread(previousGuestThreadHandle);
-				_workAvailable.Dispose();
-			}
-		}
-
-		public void RequestStop()
-		{
-			lock (_gate)
-			{
-				if (_stopping)
-				{
-					return;
-				}
-				_stopping = true;
-				_workAvailable.Set();
 			}
 		}
 
 		public void Dispose()
 		{
-			RequestStop();
+			_stopping = true;
+			_workAvailable.Set();
 			if (!ReferenceEquals(Thread.CurrentThread, _thread))
 			{
 				_thread.Join(500);
 			}
+			_workAvailable.Dispose();
 		}
 	}
 
@@ -742,7 +717,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 	private int _readyGuestThreadCount;
 
 	private readonly Dictionary<ulong, GuestThreadState> _guestThreads = new Dictionary<ulong, GuestThreadState>();
-	private readonly Queue<(IVirtualMemory Memory, ulong StackBase, ulong StackSize, ulong TlsBase)> _reusableGuestThreadRegions = new();
 
 	private readonly Dictionary<ulong, ExternalGuestThreadState> _externalGuestThreads = new Dictionary<ulong, ExternalGuestThreadState>();
 
@@ -1211,9 +1185,9 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			Environment.GetEnvironmentVariable("SHARPEMU_PROBE_IMPORT_RET_ADDRESS"));
 		_probeImportReturnAddressCount = 0;
 		_importFilter = Environment.GetEnvironmentVariable("SHARPEMU_LOG_IMPORT_FILTER");
-		_disableImportLoopGuard = !string.Equals(
+		_disableImportLoopGuard = string.Equals(
 			Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD"),
-			"0",
+			"1",
 			StringComparison.Ordinal);
 		_importLoopGuardSeconds = GetImportLoopGuardSeconds();
 		_entryReturnSentinelRip = 0uL;
@@ -1240,7 +1214,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		_patchedEa020eLookupCall = false;
 		MarkExecutionProgress();
 		BindTlsBase(context);
-		RouteGuestAccessFaultsToSignals();
 		var previousGuestThreadScheduler = GuestThreadExecution.Scheduler;
 		GuestThreadExecution.Scheduler = this;
 		try
@@ -1289,7 +1262,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 	{
 		Console.Error.WriteLine($"[LOADER][INFO] Setting up {importStubs.Count} import stubs...");
 		ClearImportHandlerTrampolines();
-		ConfigureGuestFastPath();
 		_importEntries = new ImportStubEntry[importStubs.Count];
 		HashSet<ulong> hashSet = new HashSet<ulong>(importStubs.Keys);
 		int num = 0;
@@ -1356,10 +1328,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 				LastError = "Failed to create import trampoline for NID " + text2;
 				return false;
 			}
-			if (TryCreateGuestFastPathStub(text2, num5, out var fastPathStub))
-			{
-				num5 = fastPathStub;
-			}
 			if (_logAllImports)
 			{
 				Console.Error.WriteLine($"[LOADER][DEBUG] SetupImportStubs: Trampoline for {text2} -> 0x{num5:X16}");
@@ -1372,7 +1340,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			num2++;
 			num++;
 		}
-		Console.Error.WriteLine($"[LOADER][INFO] Setup {num2}/{importStubs.Count} import stubs (direct bridge, lle_redirects={num3}, fast_path_stubs={_guestFastPathStubCount})");
+		Console.Error.WriteLine($"[LOADER][INFO] Setup {num2}/{importStubs.Count} import stubs (direct bridge, lle_redirects={num3})");
 		return num2 == importStubs.Count;
 	}
 
@@ -1456,11 +1424,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 				var importIndex = currentEntries.Length + i;
 				var trampoline = CreateImportHandlerTrampoline(importIndex);
-				if (trampoline != 0 &&
-					TryCreateGuestFastPathStub(nid, trampoline, out var runtimeFastPathStub))
-				{
-					trampoline = runtimeFastPathStub;
-				}
 				if (trampoline == 0 || !PatchImportStub((nint)(long)address, trampoline))
 				{
 					error = $"failed to install runtime import trampoline at 0x{address:X16}";
@@ -1925,10 +1888,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		{
 			return HasUsableLleLibcExport("tcVi5SivF7Q", "sprintf");
 		}
-		if (IsLibcFileObjectExport(exportName))
-		{
-			return HasUsableLleLibcExport(ComputePsNid(exportName), exportName);
-		}
 		if (string.Equals(value, "0", StringComparison.Ordinal))
 		{
 			return true;
@@ -2302,7 +2261,12 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			}
 
 			Emit(0x49); Emit(0x89); Emit(0xC3); // mov r11, rax
-			EmitFiberStackBounds(code, ref offset);
+			// Fiber switches replace the guest stack without passing through a
+			// guest-entry stub, so keep the Windows TEB bounds in sync here.
+			EmitLoadFromR11Disp32(10, 160);     // r10 = target stack top
+			EmitStackBound(code, ref offset, 10, 8, store: true);
+			EmitLoadFromR11Disp32(10, 168);     // r10 = target stack bottom
+			EmitStackBound(code, ref offset, 10, 16, store: true);
 			// A new >=3.50 fiber receives the SDK-defined MXCSR verbatim. A
 			// resumed fiber follows _sceFiberLongJmp: preserve status bits 0-5
 			// while restoring the saved control bits.
@@ -2365,31 +2329,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		}
 	}
 
-	// A trampoline only encodes its import index, so a runtime module load that sets up every
-	// module's stubs again reuses them: the stubs then keep their bytes and are not rewritten
-	// under guest threads that may be executing them.
-	private readonly Dictionary<int, nint> _importHandlerTrampolineByIndex = new();
-
 	private unsafe nint CreateImportHandlerTrampoline(int importIndex)
-	{
-		lock (ImportStubPatchGate)
-		{
-			if (_importHandlerTrampolineByIndex.TryGetValue(importIndex, out var existing))
-			{
-				return existing;
-			}
-
-			var created = CreateImportHandlerTrampolineCore(importIndex);
-			if (created != 0)
-			{
-				_importHandlerTrampolineByIndex[importIndex] = created;
-			}
-
-			return created;
-		}
-	}
-
-	private unsafe nint CreateImportHandlerTrampolineCore(int importIndex)
 	{
 		const uint stubSize = 1024u;
 		void* ptr = VirtualAlloc(null, stubSize, 12288u, 64u);
@@ -2565,35 +2505,8 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		}
 	}
 
-	// Patches unprotect and re-protect whole pages: two threads patching code that shares a page
-	// (runtime module loads, lazy TLS site patches on guest threads) would restore the other's page
-	// to read-execute while it is still writing, so every patch runs under one gate.
-	private static readonly object ImportStubPatchGate = new();
-
 	private unsafe bool PatchImportStub(nint address, nint trampoline)
 	{
-		lock (ImportStubPatchGate)
-		{
-			return PatchImportStubLocked(address, trampoline);
-		}
-	}
-
-	private unsafe bool PatchImportStubLocked(nint address, nint trampoline)
-	{
-		// Every runtime module load sets up the stubs of all loaded modules again; a stub that
-		// already jumps to this trampoline needs no unprotect/write/restore cycle.
-		Span<byte> patch = stackalloc byte[16];
-		patch[0] = 0x48;
-		patch[1] = 0xB8;
-		System.Buffers.Binary.BinaryPrimitives.WriteInt64LittleEndian(patch[2..], trampoline);
-		patch[10] = 0xFF;
-		patch[11] = 0xE0;
-		patch[12..].Fill(0x90);
-		if (new ReadOnlySpan<byte>((void*)address, 16).SequenceEqual(patch))
-		{
-			return true;
-		}
-
 		uint flNewProtect = default(uint);
 		if (!VirtualProtect((void*)address, 16u, 64u, &flNewProtect))
 		{
@@ -2630,7 +2543,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			}
 		}
 		_importHandlerTrampolines.Clear();
-		_importHandlerTrampolineByIndex.Clear();
 	}
 
 	private unsafe void CreateTlsHandler()
@@ -3783,16 +3695,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 	}
 
 	private static unsafe bool WriteTlsInstruction(nint address, ReadOnlySpan<byte> replacement)
-	{
-		// Guest threads patch their TLS sites as they first reach them; two sites on one page would
-		// otherwise race the unprotect/restore pair exactly like the import stubs.
-		lock (ImportStubPatchGate)
-		{
-			return WriteTlsInstructionLocked(address, replacement);
-		}
-	}
-
-	private static unsafe bool WriteTlsInstructionLocked(nint address, ReadOnlySpan<byte> replacement)
 	{
 		if (replacement.Length is < 1 or > 15 ||
 			VirtualQuery((void*)address, out var information, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0 ||
@@ -3982,33 +3884,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 	public bool SupportsGuestContextTransfer => true;
 
-	public bool TryGetGuestThreadStackBounds(
-		ulong threadHandle,
-		out ulong stackBase,
-		out ulong stackSize)
-	{
-		stackBase = 0;
-		stackSize = 0;
-		if (threadHandle == 0)
-		{
-			return false;
-		}
-
-		lock (_guestThreadGate)
-		{
-			if (!_guestThreads.TryGetValue(threadHandle, out var thread) ||
-				thread.StackBase == 0 ||
-				thread.StackSize == 0)
-			{
-				return false;
-			}
-
-			stackBase = thread.StackBase;
-			stackSize = thread.StackSize;
-			return true;
-		}
-	}
-
 	public void RegisterGuestThreadContext(ulong threadHandle, CpuContext context)
 	{
 		if (threadHandle == 0)
@@ -5375,7 +5250,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		return true;
 	}
 
-	internal static bool TryWriteGuestExceptionContext(
+	private static bool TryWriteGuestExceptionContext(
 		CpuContext context,
 		ulong address,
 		GuestCpuContinuation continuation,
@@ -5386,7 +5261,11 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			BinaryPrimitives.WriteUInt64LittleEndian(bytes.AsSpan(offset, sizeof(ulong)), value);
 
 		var hasContinuation = continuation.Rip >= 65536 && continuation.Rsp != 0;
-		const int mcontext = 0;
+		// Orbis ucontext_t has a 0x10-byte signal mask and 0x30 bytes of
+		// private fields before its amd64 mcontext. These offsets match the
+		// platform ABI used by libScePs5Util and Unity's Boehm GC. Supplying a
+		// bare mcontext here makes the collector miss live register roots.
+		const int mcontext = 0x40;
 		Write64(mcontext + 0x08, hasContinuation ? continuation.Rdi : context[CpuRegister.Rdi]);
 		Write64(mcontext + 0x10, hasContinuation ? continuation.Rsi : context[CpuRegister.Rsi]);
 		Write64(mcontext + 0x18, hasContinuation ? continuation.Rdx : context[CpuRegister.Rdx]);
@@ -5405,10 +5284,9 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		var rip = hasContinuation ? continuation.Rip : context.Rip;
 		var rsp = hasContinuation ? continuation.Rsp : context[CpuRegister.Rsp];
 		Write64(mcontext + 0xA0, rip);
-		Write64(mcontext + 0xB0, hasContinuation ? continuation.Rflags : context.Rflags);
+		Write64(mcontext + 0xB0, hasContinuation ? continuation.Rflags : 0);
 		Write64(mcontext + 0xB8, rsp);
 		Write64(mcontext + 0xC8, 0x480); // sizeof(Orbis mcontext_t)
-		Write64(mcontext + 0xF8, rsp);
 		Write64(mcontext + 0x440, hasContinuation ? continuation.FsBase : context.FsBase);
 		Write64(mcontext + 0x448, hasContinuation ? continuation.GsBase : context.GsBase);
 		return context.Memory.TryWrite(address, bytes);
@@ -5464,7 +5342,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			_readyGuestThreads.Clear();
 			Interlocked.Exchange(ref _readyGuestThreadCount, 0);
 			_guestThreads.Clear();
-			_reusableGuestThreadRegions.Clear();
 			_externalGuestThreads.Clear();
 			_pendingGuestExceptions.Clear();
 			Volatile.Write(ref _pendingGuestExceptionCount, 0);
@@ -5503,50 +5380,13 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			stackSize = GuestThreadStackSize;
 		}
 
-		ulong stackBase = 0;
-		ulong tlsBase = 0;
-		lock (_guestThreadGate)
+		if (!TryMapGuestThreadRegion(virtualMemory, GuestThreadStackBaseAddress, stackSize, ProgramHeaderFlags.Read | ProgramHeaderFlags.Write, out var stackBase, out error))
 		{
-			var count = _reusableGuestThreadRegions.Count;
-			for (var i = 0; i < count; i++)
-			{
-				var region = _reusableGuestThreadRegions.Dequeue();
-				if (stackBase == 0 && ReferenceEquals(region.Memory, virtualMemory) && region.StackSize >= stackSize)
-				{
-					stackBase = region.StackBase;
-					stackSize = region.StackSize;
-					tlsBase = region.TlsBase;
-				}
-				else
-				{
-					_reusableGuestThreadRegions.Enqueue(region);
-				}
-			}
+			return false;
 		}
-		if (stackBase == 0)
+		if (!TryMapGuestThreadTlsRegion(virtualMemory, out var tlsBase, out error))
 		{
-			if (!TryMapGuestThreadRegion(virtualMemory, GuestThreadStackBaseAddress, stackSize, ProgramHeaderFlags.Read | ProgramHeaderFlags.Write, out stackBase, out error))
-			{
-				return false;
-			}
-			if (!TryMapGuestThreadTlsRegion(virtualMemory, out tlsBase, out error))
-			{
-				return false;
-			}
-		}
-		else
-		{
-			Span<byte> zero = stackalloc byte[4096];
-			zero.Clear();
-			var start = tlsBase - GuestThreadTlsPrefixSize;
-			for (ulong offset = 0; offset < GuestThreadTlsPrefixSize + GuestThreadTlsSize; offset += (ulong)zero.Length)
-			{
-				if (!virtualMemory.TryWrite(start + offset, zero[..(int)Math.Min((ulong)zero.Length, GuestThreadTlsPrefixSize + GuestThreadTlsSize - offset)]))
-				{
-					error = "failed to reset reused guest TLS";
-					return false;
-				}
-			}
+			return false;
 		}
 
 		var trackedMemory = new TrackedCpuMemory(virtualMemory);
@@ -5746,7 +5586,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		var hostAffinityMask = MapGuestThreadAffinity(guestAffinityMask);
 		if (hostAffinityMask == 0)
 		{
-			SharpEmu.HLE.Host.HostLaneReservation.ApplyToGuestThread();
 			return;
 		}
 
@@ -5760,7 +5599,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 	private static ulong MapGuestThreadAffinity(ulong guestAffinityMask)
 	{
-		if (guestAffinityMask == 0 || guestAffinityMask == ulong.MaxValue || !GuestAffinityEnabled)
+		if (guestAffinityMask == 0 || guestAffinityMask == ulong.MaxValue)
 		{
 			return 0;
 		}
@@ -5820,20 +5659,9 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 	}
 
 	/// <summary>
-	/// Guest affinity is not applied to host threads unless
-	/// SHARPEMU_GUEST_AFFINITY=1. A console title pins one spinning worker per
-	/// dedicated core; on a shared host, pinning traps its renderer and any lock
-	/// holder on a lane next to a busy spinner of equal priority, where it waits
-	/// out whole scheduler quanta. Measured with Demon's Souls on a 16-lane host:
-	/// intro 10.6 → 44.7 fps and menus 11.6 → 47.5 fps with pinning off.
-	/// </summary>
-	private static readonly bool GuestAffinityEnabled =
-		Environment.GetEnvironmentVariable("SHARPEMU_GUEST_AFFINITY") == "1";
-
-	/// <summary>
-	/// Host lanes kept away from pinned guest threads. Measured on a 16-lane host
-	/// with Demon's Souls: reserving 0/4/6/8 lanes gave 6.08/6.78/7.20/5.62 fps,
-	/// so the useful range is a bit over a third of the machine — too few and the
+	/// Host lanes kept away from guest threads. Measured on a 16-lane host with
+	/// Demon's Souls: reserving 0/4/6/8 lanes gave 6.08/6.78/7.20/5.62 fps, so
+	/// the useful range is a bit over a third of the machine — too few and the
 	/// emulator is crowded out, too many and the guest cannot make progress.
 	/// </summary>
 	private static readonly int EmulatorReservedLanes =
@@ -6023,12 +5851,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 				{
 					pendingAfterExecutorRelease = pending;
 				}
-				if (thread.State == GuestThreadRunState.Exited &&
-					TryGetVirtualMemory(thread.Context, out var memory))
-				{
-					_reusableGuestThreadRegions.Enqueue((memory, thread.StackBase, thread.StackSize, thread.Context.FsBase));
-					thread.ExecutionRunner?.RequestStop();
-				}
 			}
 			if (pendingAfterExecutorRelease is { } pendingException &&
 				!TryRaiseGuestException(
@@ -6187,7 +6009,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			_activeGuestThreadYieldRequested = false;
 			_activeGuestThreadYieldReason = null;
 			BindTlsBase(context);
-			RouteGuestAccessFaultsToSignals();
 			byte* ptr2 = (byte*)ptr;
 			// Rosetta does not reliably permit a generated x86 thunk to write data
 			// in the same page from which it is currently executing, even when the
@@ -6414,7 +6235,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			_activeGuestThreadYieldRequested = false;
 			_activeGuestThreadYieldReason = null;
 			BindTlsBase(context);
-			RouteGuestAccessFaultsToSignals();
 			byte* ptr2 = (byte*)ptr;
 			ulong hostRspSlot = (ulong)hostRspStorage;
 			var emitter = new NativeCodeEmitter(ptr2);
@@ -6645,7 +6465,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 	{
 		Console.Error.WriteLine($"[LOADER][INFO] ExecuteEntry starting at 0x{entryPoint:X16}");
 		Console.Error.WriteLine($"[LOADER][INFO] RSP=0x{context[CpuRegister.Rsp]:X16}, RDI=0x{context[CpuRegister.Rdi]:X16}");
-		SharpEmu.HLE.Host.HostLaneReservation.ApplyToGuestThread();
 		ulong num = context[CpuRegister.Rsp];
 		if (num == 0)
 		{
@@ -6688,7 +6507,6 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			_activeGuestThreadYieldRequested = false;
 			_activeGuestThreadYieldReason = null;
 			BindTlsBase(context);
-			RouteGuestAccessFaultsToSignals();
 			byte* ptr2 = (byte*)ptr;
 			ulong num2 = (ulong)hostRspStorage;
 			int num3 = 0;

src/SharpEmu.Core/Cpu/TrackedCpuMemory.cs

@@ -53,9 +53,6 @@ public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemo
 
     public bool CanRead(ulong address, ulong size) => _inner.CanRead(address, size);
 
-    public bool TryScanCString(ulong address, byte needle, bool findLast, ulong maxLength, out ulong match) =>
-        _inner.TryScanCString(address, needle, findLast, maxLength, out match);
-
     public bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address)
     {
         if (_inner is IGuestMemoryAllocator allocator)

src/SharpEmu.Core/Loader/GuestRedZonePatcher.cs

@@ -15,48 +15,10 @@ internal static class GuestRedZonePatcher
 {
     private const int GuestRedZoneBytes = 128;
     private const int MinimumJumpBytes = 5;
-    private const int EstimatedTrampolineBytesPerSite = 64;
+    private const int EstimatedTrampolineBytesPerSite = 48;
     private const ulong PageSize = 0x1000;
     private const ulong AllocationAlignment = 0x10000;
     private const ulong MaximumRelativeJumpDistance = 0x7FFF_FFFF;
-    private const int MaximumJumpTableEntries = 4096;
-    private const int MaximumJumpTableSetupInstructions = 6;
-    private const ulong LargeExecutableBytes = 32UL << 20;
-    private static readonly TimeSpan ProgressInterval = TimeSpan.FromSeconds(2);
-
-    private sealed class Progress(string hostName, string phase, int total)
-    {
-        private readonly long _started = System.Diagnostics.Stopwatch.GetTimestamp();
-        private long _lastReport = System.Diagnostics.Stopwatch.GetTimestamp();
-
-        public void Report(int done)
-        {
-            var now = System.Diagnostics.Stopwatch.GetTimestamp();
-            if (System.Diagnostics.Stopwatch.GetElapsedTime(_lastReport, now) < ProgressInterval)
-            {
-                return;
-            }
-
-            _lastReport = now;
-            Console.Error.WriteLine(
-                $"[LOADER] {hostName} red-zone {phase}: {done}/{total} ({(total == 0 ? 100 : done * 100L / total)}%) " +
-                $"after {System.Diagnostics.Stopwatch.GetElapsedTime(_started, now).TotalSeconds:F0} s");
-        }
-    }
-
-    private static ulong ExecutableBytes(IReadOnlyList<ProgramHeader> programHeaders)
-    {
-        var bytes = 0UL;
-        foreach (var header in programHeaders)
-        {
-            if (header.HeaderType == ProgramHeaderType.Load && (header.Flags & ProgramHeaderFlags.Execute) != 0)
-            {
-                bytes += header.FileSize;
-            }
-        }
-
-        return bytes;
-    }
 
     internal enum SpanRefusal
     {
@@ -65,7 +27,6 @@ internal static class GuestRedZonePatcher
         BranchTargetAfter,
         StackAfter,
         TooShort,
-        IndirectBranch,
     }
 
     public static PatchResult Patch(
@@ -101,19 +62,8 @@ internal static class GuestRedZonePatcher
             return default;
         }
 
-        var executableBytes = ExecutableBytes(programHeaders);
-        var large = executableBytes >= LargeExecutableBytes;
-        if (large)
-        {
-            Console.Error.WriteLine(
-                $"[LOADER] {hostName} red-zone patch: scanning {functionStarts.Length} functions in {executableBytes >> 20} MB of code; " +
-                "a large executable takes a while before the game window opens.");
-        }
-
         var sites = CollectPatchSites(
-            memory, programHeaders, imageBase, functionStarts, protectRedZone, splitVectorStores, rewriteSha, out var scan,
-            large ? new Progress(hostName, "scan", functionStarts.Length) : null);
-        sites.Sort(static (left, right) => left.Address.CompareTo(right.Address));
+            memory, programHeaders, imageBase, functionStarts, protectRedZone, splitVectorStores, rewriteSha, out var scan);
         if (sites.Count == 0)
         {
             Console.Error.WriteLine(
@@ -144,10 +94,8 @@ internal static class GuestRedZonePatcher
         var patched = 0;
         var failed = 0;
         var previousEnd = 0UL;
-        var patchProgress = large ? new Progress(hostName, "patch", sites.Count) : null;
         foreach (var site in sites)
         {
-            patchProgress?.Report(patched + failed);
             // Sites are produced in increasing address order. Patching two that
             // overlap would write one jump over another and send the trampoline
             // into whatever follows, so refuse rather than corrupt guest code.
@@ -180,7 +128,6 @@ internal static class GuestRedZonePatcher
             BranchTargetRefusals = scan.BranchTargetRefusals,
             StackRefusals = scan.StackRefusals,
             TooShortRefusals = scan.TooShortRefusals,
-            IndirectBranchRefusals = scan.IndirectBranchRefusals,
             TrampolineBytes = trampolineCursor - trampolineBase,
         };
         Console.Error.WriteLine(
@@ -188,8 +135,7 @@ internal static class GuestRedZonePatcher
             $"sites={result.PatchedSites}/{result.CandidateSites} failed={result.FailedSites} " +
             $"unrelocatable={result.UnrelocatableSites} " +
             $"(control_flow={result.ControlFlowRefusals} branch_target_after={result.BranchTargetRefusals} " +
-            $"stack_after={result.StackRefusals} too_short={result.TooShortRefusals} " +
-            $"indirect_branch={result.IndirectBranchRefusals}) " +
+            $"stack_after={result.StackRefusals} too_short={result.TooShortRefusals}) " +
             $"rosetta_vector_stores={result.VectorStoreCount} sha_rewrites={result.ShaInstructionCount} " +
             $"trampolines=0x{trampolineBase:X16}+0x{result.TrampolineBytes:X}.");
         return result;
@@ -203,17 +149,15 @@ internal static class GuestRedZonePatcher
         bool protectRedZone,
         bool splitVectorStores,
         bool rewriteSha,
-        out PatchResult result,
-        Progress? progress = null)
+        out PatchResult result)
     {
         var sites = new List<PatchSite>();
-        var scannedFunctions = 0;
         var functionCount = 0;
         var redZoneFunctionCount = 0;
         var instructionCount = 0;
         var vectorStoreCount = 0;
         var unrelocatableSites = 0;
-        var refusalCounts = new int[6];
+        var refusalCounts = new int[5];
         var shaInstructionCount = 0;
 
         foreach (var header in programHeaders)
@@ -246,7 +190,6 @@ internal static class GuestRedZonePatcher
 
             for (var functionIndex = 0; functionIndex < segmentFunctions.Length; functionIndex++)
             {
-                progress?.Report(scannedFunctions++);
                 var functionStart = segmentFunctions[functionIndex];
                 var functionEnd = functionIndex + 1 < segmentFunctions.Length
                     ? segmentFunctions[functionIndex + 1]
@@ -264,10 +207,7 @@ internal static class GuestRedZonePatcher
 
                 functionCount++;
                 instructionCount += decoded.Count;
-                var frameDelta = protectRedZone ? ComputeFramePointerDelta(decoded) : -1;
-                var usesRedZone = protectRedZone &&
-                    (decoded.Any(static entry => UsesRedZone(entry.Instruction)) ||
-                     decoded.Any(entry => UsesFramePointerRedZone(entry.Instruction, frameDelta)));
+                var usesRedZone = protectRedZone && decoded.Any(static entry => UsesRedZone(entry.Instruction));
 
                 if (!usesRedZone && !splitVectorStores && !rewriteSha)
                 {
@@ -279,14 +219,6 @@ internal static class GuestRedZonePatcher
                     redZoneFunctionCount++;
                 }
                 var branchTargets = CollectBranchTargets(decoded);
-                var canBorrowFollowingInstructions = TryCollectJumpTableTargets(
-                    memory,
-                    programHeaders,
-                    imageBase,
-                    decoded,
-                    functionStart,
-                    functionEnd,
-                    branchTargets);
 
                 var lastSiteEnd = 0UL;
 
@@ -301,29 +233,24 @@ internal static class GuestRedZonePatcher
                         continue;
                     }
 
-                    var span = default(PatchSite);
-                    var refusal = SpanRefusal.TooShort;
-                    var forward = TryBuildPatchSpan(
-                        decoded,
-                        instructionIndex,
-                        branchTargets,
-                        canBorrowFollowingInstructions,
-                        out span,
-                        out refusal);
-                    var backward = !forward &&
-                        canBorrowFollowingInstructions &&
-                        TryBuildEnclosingPatchSpan(decoded, instructionIndex, branchTargets, out span);
-                    if (!forward && !backward)
+                    // A backward span reaches instructions that an earlier site
+                    // may already have replaced with its own jump. Two jumps
+                    // written over each other corrupt control flow, so a span is
+                    // only usable when it starts at or after the end of the last
+                    // one. Forward spans cannot overlap by construction; the
+                    // check costs nothing and documents the invariant.
+                    var backward = false;
+                    if (!TryBuildPatchSpan(decoded, instructionIndex, branchTargets, out var span, out var refusal))
                     {
-                        unrelocatableSites++;
-                        refusalCounts[(int)refusal]++;
-                        continue;
+                        backward = TryBuildEnclosingPatchSpan(decoded, instructionIndex, branchTargets, out span);
                     }
 
-                    if (span.Address < lastSiteEnd)
+                    if ((!backward && refusal != SpanRefusal.None) || span.Address < lastSiteEnd)
                     {
+                        // Refused spans never enter the site list, so they are
+                        // invisible in FailedSites. Count them separately.
                         unrelocatableSites++;
-                        refusalCounts[(int)SpanRefusal.TooShort]++;
+                        refusalCounts[(int)refusal]++;
                         continue;
                     }
 
@@ -338,6 +265,8 @@ internal static class GuestRedZonePatcher
                         shaInstructionCount += span.Instructions.Count(static instruction => ShaInstructionRewrite.CanRewrite(instruction));
                     }
 
+                    // A backward span already ends at the current instruction, so
+                    // only a forward one consumes the instructions that follow.
                     if (!backward)
                     {
                         instructionIndex += span.Instructions.Count - 1;
@@ -358,7 +287,6 @@ internal static class GuestRedZonePatcher
             BranchTargetRefusals = refusalCounts[(int)SpanRefusal.BranchTargetAfter],
             StackRefusals = refusalCounts[(int)SpanRefusal.StackAfter],
             TooShortRefusals = refusalCounts[(int)SpanRefusal.TooShort],
-            IndirectBranchRefusals = refusalCounts[(int)SpanRefusal.IndirectBranch],
             ShaInstructionCount = shaInstructionCount,
         };
         return sites;
@@ -416,361 +344,11 @@ internal static class GuestRedZonePatcher
         return targets;
     }
 
-    private static bool TryCollectJumpTableTargets(
-        IVirtualMemory memory,
-        IReadOnlyList<ProgramHeader> programHeaders,
-        ulong imageBase,
-        IReadOnlyList<DecodedInstruction> decoded,
-        ulong functionStart,
-        ulong functionEnd,
-        HashSet<ulong> branchTargets)
-    {
-        List<ulong>? resolvedTargets = null;
-        HashSet<ulong>? instructionBoundaries = null;
-        for (var instructionIndex = 0; instructionIndex < decoded.Count; instructionIndex++)
-        {
-            if (decoded[instructionIndex].Instruction.FlowControl != FlowControl.IndirectBranch)
-            {
-                continue;
-            }
-
-            instructionBoundaries ??= decoded
-                .Select(static entry => entry.Instruction.IP)
-                .ToHashSet();
-            resolvedTargets ??= new List<ulong>();
-            if (!TryResolveJumpTable(
-                    memory,
-                    programHeaders,
-                    imageBase,
-                    decoded,
-                    instructionIndex,
-                    functionStart,
-                    functionEnd,
-                    instructionBoundaries,
-                    branchTargets,
-                    resolvedTargets))
-            {
-                return false;
-            }
-        }
-
-        if (resolvedTargets is not null)
-        {
-            branchTargets.UnionWith(resolvedTargets);
-        }
-
-        return true;
-    }
-
-    private static bool TryResolveJumpTable(
-        IVirtualMemory memory,
-        IReadOnlyList<ProgramHeader> programHeaders,
-        ulong imageBase,
-        IReadOnlyList<DecodedInstruction> decoded,
-        int jumpIndex,
-        ulong functionStart,
-        ulong functionEnd,
-        IReadOnlySet<ulong> instructionBoundaries,
-        IReadOnlySet<ulong> knownBranchTargets,
-        List<ulong> targets)
-    {
-        if (jumpIndex < 4)
-        {
-            return false;
-        }
-
-        var jump = decoded[jumpIndex].Instruction;
-        var add = decoded[jumpIndex - 1].Instruction;
-        var load = decoded[jumpIndex - 2].Instruction;
-        if (jump.OpCount != 1 || jump.GetOpKind(0) != OpKind.Register ||
-            add.Mnemonic != Mnemonic.Add || add.OpCount != 2 ||
-            add.GetOpKind(0) != OpKind.Register || add.GetOpKind(1) != OpKind.Register ||
-            load.Mnemonic != Mnemonic.Movsxd || load.OpCount != 2 ||
-            load.GetOpKind(0) != OpKind.Register || load.GetOpKind(1) != OpKind.Memory ||
-            load.MemorySize.GetSize() != sizeof(int) || load.MemoryIndexScale != sizeof(int) ||
-            load.MemoryBase == Register.None || load.MemoryIndex == Register.None ||
-            load.MemoryDisplacement64 != 0)
-        {
-            return false;
-        }
-
-        var targetRegister = jump.GetOpRegister(0).GetFullRegister();
-        var tableRegister = add.GetOpRegister(1).GetFullRegister();
-        var selectorRegister = load.MemoryIndex.GetFullRegister();
-        if (targetRegister != add.GetOpRegister(0).GetFullRegister() ||
-            targetRegister != load.GetOpRegister(0).GetFullRegister() ||
-            tableRegister != load.MemoryBase.GetFullRegister() ||
-            targetRegister.GetSize() != sizeof(ulong) ||
-            tableRegister.GetSize() != sizeof(ulong) ||
-            selectorRegister.GetSize() != sizeof(ulong) ||
-            tableRegister == selectorRegister)
-        {
-            return false;
-        }
-
-        var branchIndex = -1;
-        for (var index = jumpIndex - 3;
-             index >= 1 && index >= jumpIndex - MaximumJumpTableSetupInstructions;
-             index--)
-        {
-            var candidate = decoded[index].Instruction;
-            if (candidate.Mnemonic == Mnemonic.Ja)
-            {
-                branchIndex = index;
-                break;
-            }
-
-            if (candidate.Mnemonic != Mnemonic.Lea)
-            {
-                return false;
-            }
-        }
-
-        if (branchIndex < 1)
-        {
-            return false;
-        }
-
-        for (var index = branchIndex + 1; index <= jumpIndex; index++)
-        {
-            if (knownBranchTargets.Contains(decoded[index].Instruction.IP))
-            {
-                return false;
-            }
-        }
-
-        var boundsBranch = decoded[branchIndex].Instruction;
-        var boundsCompare = decoded[branchIndex - 1].Instruction;
-        if (boundsBranch.FlowControl != FlowControl.ConditionalBranch ||
-            !TryGetNearBranchTarget(boundsBranch, out var defaultTarget) ||
-            defaultTarget < functionStart || defaultTarget >= functionEnd ||
-            boundsCompare.Mnemonic != Mnemonic.Cmp || boundsCompare.OpCount != 2 ||
-            boundsCompare.GetOpKind(0) != OpKind.Register ||
-            boundsCompare.GetOpRegister(0).GetFullRegister() != selectorRegister ||
-            boundsCompare.GetOpRegister(0).GetSize() != sizeof(int) ||
-            !TryGetNonNegativeImmediate(boundsCompare, 1, out var maximumIndex) ||
-            maximumIndex >= MaximumJumpTableEntries)
-        {
-            return false;
-        }
-
-        var tableAddress = 0UL;
-        var tableDefinitionFound = false;
-        for (var index = branchIndex + 1; index <= jumpIndex - 3; index++)
-        {
-            var candidate = decoded[index].Instruction;
-            if (candidate.OpCount < 1 || candidate.GetOpKind(0) != OpKind.Register)
-            {
-                return false;
-            }
-
-            var writtenRegister = candidate.GetOpRegister(0).GetFullRegister();
-            if (writtenRegister == selectorRegister)
-            {
-                return false;
-            }
-
-            if (writtenRegister != tableRegister)
-            {
-                continue;
-            }
-
-            if (tableDefinitionFound || candidate.OpCount != 2 ||
-                candidate.GetOpKind(1) != OpKind.Memory || !candidate.IsIPRelativeMemoryOperand)
-            {
-                return false;
-            }
-
-            tableAddress = candidate.IPRelativeMemoryAddress;
-            tableDefinitionFound = true;
-        }
-
-        if (!tableDefinitionFound)
-        {
-            return false;
-        }
-
-        var entryCount = checked((int)maximumIndex + 1);
-        var tableBytes = checked(entryCount * sizeof(int));
-        if (!IsRangeInReadableLoad(programHeaders, imageBase, tableAddress, (ulong)tableBytes))
-        {
-            return false;
-        }
-
-        var entries = GC.AllocateUninitializedArray<byte>(tableBytes);
-        if (!memory.TryRead(tableAddress, entries))
-        {
-            return false;
-        }
-
-        var firstTarget = targets.Count;
-        for (var index = 0; index < entryCount; index++)
-        {
-            var relative = BinaryPrimitives.ReadInt32LittleEndian(entries.AsSpan(index * sizeof(int)));
-            if (!TryAddSignedOffset(tableAddress, relative, out var target) ||
-                target < functionStart || target >= functionEnd ||
-                !instructionBoundaries.Contains(target))
-            {
-                targets.RemoveRange(firstTarget, targets.Count - firstTarget);
-                return false;
-            }
-
-            targets.Add(target);
-        }
-
-        return true;
-    }
-
-    private static bool IsRangeInReadableLoad(
-        IReadOnlyList<ProgramHeader> programHeaders,
-        ulong imageBase,
-        ulong address,
-        ulong length)
-    {
-        foreach (var header in programHeaders)
-        {
-            if (header.HeaderType != ProgramHeaderType.Load ||
-                (header.Flags & ProgramHeaderFlags.Read) == 0 ||
-                header.FileSize == 0 ||
-                header.VirtualAddress > ulong.MaxValue - imageBase)
-            {
-                continue;
-            }
-
-            var start = imageBase + header.VirtualAddress;
-            if (address < start || address - start > header.FileSize ||
-                length > header.FileSize - (address - start))
-            {
-                continue;
-            }
-
-            return true;
-        }
-
-        return false;
-    }
-
-    private static bool TryAddSignedOffset(ulong address, int offset, out ulong result)
-    {
-        if (offset >= 0)
-        {
-            var positive = (ulong)offset;
-            if (positive <= ulong.MaxValue - address)
-            {
-                result = address + positive;
-                return true;
-            }
-        }
-        else
-        {
-            var negative = (ulong)-(long)offset;
-            if (negative <= address)
-            {
-                result = address - negative;
-                return true;
-            }
-        }
-
-        result = 0;
-        return false;
-    }
-
-    private static bool TryGetNearBranchTarget(in Instruction instruction, out ulong target)
-    {
-        for (var operand = 0; operand < instruction.OpCount; operand++)
-        {
-            switch (instruction.GetOpKind(operand))
-            {
-                case OpKind.NearBranch16:
-                    target = instruction.NearBranch16;
-                    return true;
-                case OpKind.NearBranch32:
-                    target = instruction.NearBranch32;
-                    return true;
-                case OpKind.NearBranch64:
-                    target = instruction.NearBranch64;
-                    return true;
-            }
-        }
-
-        target = 0;
-        return false;
-    }
-
-    private static bool TryGetNonNegativeImmediate(in Instruction instruction, int operand, out ulong value)
-    {
-        switch (instruction.GetOpKind(operand))
-        {
-            case OpKind.Immediate8:
-                value = instruction.Immediate8;
-                return true;
-            case OpKind.Immediate16:
-                value = instruction.Immediate16;
-                return true;
-            case OpKind.Immediate32:
-                value = instruction.Immediate32;
-                return true;
-            case OpKind.Immediate64:
-                value = instruction.Immediate64;
-                return true;
-            case OpKind.Immediate8to16 when instruction.Immediate8to16 >= 0:
-                value = (ulong)instruction.Immediate8to16;
-                return true;
-            case OpKind.Immediate8to32 when instruction.Immediate8to32 >= 0:
-                value = (ulong)instruction.Immediate8to32;
-                return true;
-            case OpKind.Immediate8to64 when instruction.Immediate8to64 >= 0:
-                value = (ulong)instruction.Immediate8to64;
-                return true;
-            case OpKind.Immediate32to64 when instruction.Immediate32to64 >= 0:
-                value = (ulong)instruction.Immediate32to64;
-                return true;
-            default:
-                value = 0;
-                return false;
-        }
-    }
-
     /// <summary>
     /// Runs the enclosing-span search over a raw instruction range, so the
     /// behaviour can be pinned on the byte sequences that occur in real guest
     /// code rather than on a mocked decode.
     /// </summary>
-    // Test hook: the forward span a site at siteAddress gets, as the patcher builds it.
-    internal static bool TryBuildForwardSpan(
-        byte[] code,
-        ulong baseAddress,
-        ulong siteAddress,
-        out int spanLength,
-        out int coreStart,
-        out int coreCount)
-    {
-        spanLength = 0;
-        coreStart = 0;
-        coreCount = 0;
-        var decoded = DecodeFunction(code, baseAddress, baseAddress, baseAddress + (ulong)code.Length);
-        var siteIndex = -1;
-        for (var index = 0; index < decoded.Count; index++)
-        {
-            if (decoded[index].Instruction.IP == siteAddress)
-            {
-                siteIndex = index;
-                break;
-            }
-        }
-
-        if (siteIndex < 0 ||
-            !TryBuildPatchSpan(decoded, siteIndex, CollectBranchTargets(decoded), true, out var site, out _))
-        {
-            return false;
-        }
-
-        spanLength = site.ByteLength;
-        coreStart = site.CoreStart;
-        coreCount = site.CoreCount;
-        return true;
-    }
-
     internal static bool TryBuildEnclosingSpan(
         byte[] code,
         ulong baseAddress,
@@ -801,10 +379,7 @@ internal static class GuestRedZonePatcher
             return false;
         }
 
-        var hasIndirectBranch = decoded.Any(static entry =>
-            entry.Instruction.FlowControl == FlowControl.IndirectBranch);
-        if (hasIndirectBranch ||
-            !TryBuildEnclosingPatchSpan(decoded, faultIndex, CollectBranchTargets(decoded), out var site))
+        if (!TryBuildEnclosingPatchSpan(decoded, faultIndex, CollectBranchTargets(decoded), out var site))
         {
             return false;
         }
@@ -842,13 +417,8 @@ internal static class GuestRedZonePatcher
 
         if (coreStart < 0)
         {
-            // Nothing in the span touches guest memory: it is a SHA or vector-store rewrite over
-            // register-only instructions. The span builder already refused anything that touches
-            // RSP, so the whole span can run inside the shift. Refusing it here left every SHA
-            // instruction unrewritten, trapping on each execution on hosts without SHA.
-            coreStart = 0;
-            coreCount = instructions.Count;
-            return true;
+            coreCount = 0;
+            return false;
         }
 
         for (var index = coreStart; index <= coreEnd; index++)
@@ -938,40 +508,22 @@ internal static class GuestRedZonePatcher
         int startIndex,
         IReadOnlySet<ulong> branchTargets,
         out PatchSite site) =>
-        TryBuildPatchSpan(decoded, startIndex, branchTargets, true, out site, out _);
+        TryBuildPatchSpan(decoded, startIndex, branchTargets, out site, out _);
 
     private static bool TryBuildPatchSpan(
         IReadOnlyList<DecodedInstruction> decoded,
         int startIndex,
         IReadOnlySet<ulong> branchTargets,
-        bool canBorrowFollowingInstructions,
         out PatchSite site,
         out SpanRefusal refusal)
     {
         refusal = SpanRefusal.None;
         var instructions = new List<Instruction>(3);
-        Instruction? terminalBranch = null;
         var byteLength = 0;
         for (var index = startIndex; index < decoded.Count && byteLength < MinimumJumpBytes; index++)
         {
             var instruction = decoded[index].Instruction;
-            if (index != startIndex &&
-                canBorrowFollowingInstructions &&
-                !branchTargets.Contains(instruction.IP) &&
-                IsRelocatableDirectBranch(instruction))
-            {
-                // A short access followed by its branch (TEST mem; JZ) closes the
-                // span with that branch; the trampoline runs it once RSP is restored.
-                terminalBranch = instruction;
-                byteLength += instruction.Length;
-                break;
-            }
-
-            if (index != startIndex && !canBorrowFollowingInstructions)
-            {
-                refusal = SpanRefusal.IndirectBranch;
-            }
-            else if (instruction.FlowControl != FlowControl.Next)
+            if (instruction.FlowControl != FlowControl.Next)
             {
                 refusal = SpanRefusal.ControlFlow;
             }
@@ -1008,15 +560,10 @@ internal static class GuestRedZonePatcher
             return false;
         }
 
-        site = new PatchSite(decoded[startIndex].Instruction.IP, byteLength, instructions, coreStart, coreCount, terminalBranch);
+        site = new PatchSite(decoded[startIndex].Instruction.IP, byteLength, instructions, coreStart, coreCount);
         return true;
     }
 
-    private static bool IsRelocatableDirectBranch(in Instruction instruction) =>
-        instruction.FlowControl is FlowControl.ConditionalBranch or FlowControl.UnconditionalBranch &&
-        instruction.OpCount == 1 &&
-        instruction.GetOpKind(0) is OpKind.NearBranch16 or OpKind.NearBranch32 or OpKind.NearBranch64;
-
     internal static bool UsesRedZone(in Instruction instruction)
     {
         if (!HasMemoryOperand(instruction) || instruction.MemoryBase != Register.RSP)
@@ -1028,84 +575,6 @@ internal static class GuestRedZonePatcher
         return displacement < 0 && displacement >= -GuestRedZoneBytes;
     }
 
-    // Clang spills into the red zone through the frame pointer as often as through
-    // RSP: with a standard 'push rbp; mov rbp, rsp' frame plus N callee-saved
-    // pushes, RSP sits at RBP-N, so every [rbp-d] with d > N is below RSP and a
-    // host exception frame would overwrite it. Matching only RSP-relative use left
-    // those functions unprotected.
-    internal static bool UsesFramePointerRedZone(in Instruction instruction, int frameDelta)
-    {
-        if (frameDelta < 0 || !HasMemoryOperand(instruction) || instruction.MemoryBase != Register.RBP)
-        {
-            return false;
-        }
-
-        var displacement = unchecked((long)instruction.MemoryDisplacement64);
-        return displacement < -frameDelta && displacement >= -(frameDelta + (long)GuestRedZoneBytes);
-    }
-
-    // Distance from the frame pointer down to RSP for a standard prologue, or -1
-    // when the function does not establish one. Only the leading pushes and the
-    // first 'sub rsp, imm' count, which under-estimates frames that grow later:
-    // under-estimating only widens the guarded window, so it stays conservative.
-    private static int ComputeFramePointerDelta(List<DecodedInstruction> decoded)
-    {
-        if (decoded.Count < 2)
-        {
-            return -1;
-        }
-
-        var push = decoded[0].Instruction;
-        if (push.Mnemonic != Mnemonic.Push ||
-            push.OpCount != 1 ||
-            push.GetOpKind(0) != OpKind.Register ||
-            push.GetOpRegister(0) != Register.RBP)
-        {
-            return -1;
-        }
-
-        var move = decoded[1].Instruction;
-        if (move.Mnemonic != Mnemonic.Mov ||
-            move.OpCount != 2 ||
-            move.GetOpKind(0) != OpKind.Register ||
-            move.GetOpRegister(0) != Register.RBP ||
-            move.GetOpKind(1) != OpKind.Register ||
-            move.GetOpRegister(1) != Register.RSP)
-        {
-            return -1;
-        }
-
-        var delta = 0;
-        for (var index = 2; index < decoded.Count; index++)
-        {
-            var instruction = decoded[index].Instruction;
-            if (instruction.Mnemonic == Mnemonic.Push &&
-                instruction.OpCount == 1 &&
-                instruction.GetOpKind(0) == OpKind.Register)
-            {
-                delta += 8;
-                continue;
-            }
-
-            if (instruction.Mnemonic == Mnemonic.Sub &&
-                instruction.OpCount == 2 &&
-                instruction.GetOpKind(0) == OpKind.Register &&
-                instruction.GetOpRegister(0) == Register.RSP &&
-                instruction.GetOpKind(1) is OpKind.Immediate8 or OpKind.Immediate8to64 or OpKind.Immediate32to64 or OpKind.Immediate32)
-            {
-                var immediate = (long)instruction.GetImmediate(1);
-                if (immediate > 0 && immediate < int.MaxValue - delta)
-                {
-                    delta += (int)immediate;
-                }
-            }
-
-            break;
-        }
-
-        return delta;
-    }
-
     private static bool UsesStackMemory(in Instruction instruction)
     {
         if (!HasMemoryOperand(instruction))
@@ -1235,20 +704,7 @@ internal static class GuestRedZonePatcher
         }
 
         var relocated = writer.ToArray();
-        byte[]? branch = null;
-        if (site.TerminalBranch is { } terminalBranch &&
-            !TryEncodeSegment(
-                [terminalBranch],
-                0,
-                1,
-                trampolineCursor + (ulong)prefixLength + 5 + (ulong)relocated.Length + 8,
-                out branch))
-        {
-            return false;
-        }
-
-        var branchLength = branch?.Length ?? 0;
-        var trampolineLength = checked(prefixLength + 5 + relocated.Length + 8 + branchLength + 5);
+        var trampolineLength = checked(prefixLength + 5 + relocated.Length + 8 + 5);
         if (trampolineCursor > trampolineEnd || (ulong)trampolineLength > trampolineEnd - trampolineCursor)
         {
             return false;
@@ -1273,10 +729,7 @@ internal static class GuestRedZonePatcher
         trampoline[restoreOffset + 5] = 0;
         trampoline[restoreOffset + 6] = 0;
         trampoline[restoreOffset + 7] = 0;
-        // LEA leaves the flags alone, so a conditional branch still sees the
-        // result of the relocated compare.
-        branch?.CopyTo(trampoline, restoreOffset + 8);
-        var returnJumpOffset = restoreOffset + 8 + branchLength;
+        var returnJumpOffset = restoreOffset + 8;
         if (!TryWriteRelativeJump(
                 trampoline.AsSpan(returnJumpOffset, 5),
                 trampolineCursor + (ulong)returnJumpOffset,
@@ -1359,34 +812,6 @@ internal static class GuestRedZonePatcher
             }
         }
 
-        // The image can sit among dense host allocations (the runtime's own heaps) where
-        // every fixed step above is taken. Look for any free range in reach instead.
-        var low = Math.Max(maximumSite > MaximumRelativeJumpDistance ? maximumSite - MaximumRelativeJumpDistance : 0, AllocationAlignment);
-        var highExclusive = minimumSite <= ulong.MaxValue - MaximumRelativeJumpDistance - 1
-            ? minimumSite + MaximumRelativeJumpDistance + 1
-            : ulong.MaxValue;
-        foreach (var candidate in memory.EnumerateFreeHostRanges(low, highExclusive, requiredBytes, AllocationAlignment))
-        {
-            if (!CanReach(candidate, minimumSite) ||
-                !CanReach(candidate + requiredBytes - 1, maximumSite))
-            {
-                continue;
-            }
-
-            try
-            {
-                address = memory.AllocateAt(candidate, requiredBytes, executable: true, allowAlternative: false);
-                if (address == candidate)
-                {
-                    return true;
-                }
-            }
-            catch (InvalidOperationException)
-            {
-                // Taken since it was listed; keep looking.
-            }
-        }
-
         address = 0;
         return false;
     }
@@ -1445,8 +870,7 @@ internal static class GuestRedZonePatcher
         int ByteLength,
         IList<Instruction> Instructions,
         int CoreStart,
-        int CoreCount,
-        Instruction? TerminalBranch = null);
+        int CoreCount);
 
     internal readonly record struct PatchResult
     {
@@ -1482,8 +906,6 @@ internal static class GuestRedZonePatcher
 
         public int TooShortRefusals { get; init; }
 
-        public int IndirectBranchRefusals { get; init; }
-
         public ulong TrampolineBytes { get; init; }
     }
 

src/SharpEmu.Core/Memory/PhysicalVirtualMemory.cs

@@ -371,33 +371,6 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         return true;
     }
 
-    // Aligned starts of the free host ranges in [low, highExclusive) that can hold size
-    // bytes, from the host's own region map. The ranges are free when listed; another
-    // thread may take one before the caller allocates it.
-    public IEnumerable<ulong> EnumerateFreeHostRanges(ulong low, ulong highExclusive, ulong size, ulong alignment)
-    {
-        var address = low;
-        while (address < highExclusive && _hostMemory.Query(address, out var info) && info.RegionSize != 0)
-        {
-            var regionEnd = info.BaseAddress + info.RegionSize;
-            if (regionEnd <= address)
-            {
-                yield break;
-            }
-
-            if (info.State == HostRegionState.Free)
-            {
-                var start = (address + alignment - 1) & ~(alignment - 1);
-                if (start >= address && start + size >= start && start + size <= Math.Min(regionEnd, highExclusive))
-                {
-                    yield return start;
-                }
-            }
-
-            address = regionEnd;
-        }
-    }
-
     public string DescribeAddressForDiagnostics(ulong address)
     {
         if (!_hostMemory.Query(address, out var info))
@@ -1081,13 +1054,6 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     public bool IsBackedRange(ulong address, ulong size)
     {
-        // A backed range confirmed from the view snapshot needs no lock; a miss (partly
-        // unbacked, or a view being remapped) takes the locked path.
-        if (_backedSpace is { } backed && !_disposed && backed.IsBackedWithoutLock(address, size))
-        {
-            return true;
-        }
-
         _gate.EnterReadLock();
         try
         {
@@ -1174,18 +1140,6 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         }
     }
 
-    public object? BackingAliasSnapshot => _backedSpace?.AliasSnapshot;
-
-    public bool TryEnterBackingAliasAccess() => !_disposed && _backedSpace is { } backed && backed.TryEnterAliasAccess();
-
-    public void ExitBackingAliasAccess() => _backedSpace?.ExitAliasAccess();
-
-    public bool TryResolveBackingAlias(ulong address, ulong size, out ulong alias)
-    {
-        alias = 0;
-        return !_disposed && _backedSpace is { } backed && backed.TryResolveAlias(address, size, out alias);
-    }
-
     private bool HasBackingOwner() => !_disposed && _backedSpace != null;
 
     // A span may cross adjacent view records; the owner validates full coverage.
@@ -1830,15 +1784,6 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     public bool TryRead(ulong virtualAddress, Span<byte> destination)
     {
-        // Backed guest memory is the shared backing itself, and the backing's view table
-        // is readable without a lock; only other memory needs _gate to find its region.
-        // Descriptor evaluation alone reads guest words ~40 at a time per draw here.
-        if (!destination.IsEmpty && _backedSpace is { } backed && !_disposed &&
-            backed.TryReadSingleView(virtualAddress, destination))
-        {
-            return true;
-        }
-
         var requiresExclusiveAccess = false;
         _gate.EnterReadLock();
         try
@@ -1906,85 +1851,6 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         }
     }
 
-    public bool TryScanCString(ulong address, byte needle, bool findLast, ulong maxLength, out ulong match)
-    {
-        match = 0;
-        _gate.EnterReadLock();
-        try
-        {
-            // Scan page by page in place, with the same region and protection
-            // checks TryRead applies before its copy. Anything TryRead would
-            // handle specially (backed views, lazy commit, protection changes)
-            // is left to the caller's copying path.
-            ulong offset = 0;
-            while (offset < maxLength)
-            {
-                var current = address + offset;
-                if (current < address)
-                {
-                    return false;
-                }
-
-                var length = Math.Min(PageSize - (current & (PageSize - 1)), maxLength - offset);
-                var region = FindRegion(current, length);
-                if (region is null ||
-                    region.IsReservedOnly ||
-                    IsBackedSpan(region, current, length) ||
-                    !TryResolveRegionOffset(current, length, region, out var regionOffset))
-                {
-                    return false;
-                }
-
-                var hostAddress = region.VirtualAddress + regionOffset;
-                if (!CanReadWithoutProtectionChange(hostAddress, length, region))
-                {
-                    return false;
-                }
-
-                var bytes = new ReadOnlySpan<byte>((void*)hostAddress, (int)length);
-                if (!findLast)
-                {
-                    // One pass that stops at the needle or the terminator,
-                    // whichever comes first.
-                    var stop = bytes.IndexOfAny(needle, (byte)0);
-                    if (stop >= 0)
-                    {
-                        match = bytes[stop] == needle ? current + (ulong)stop : 0;
-                        return true;
-                    }
-
-                    offset += length;
-                    continue;
-                }
-
-                var nulIndex = bytes.IndexOf((byte)0);
-                var searched = nulIndex >= 0 ? bytes[..(nulIndex + 1)] : bytes;
-                var found = findLast ? searched.LastIndexOf(needle) : searched.IndexOf(needle);
-                if (found >= 0)
-                {
-                    match = current + (ulong)found;
-                    if (!findLast)
-                    {
-                        return true;
-                    }
-                }
-
-                if (nulIndex >= 0)
-                {
-                    return true;
-                }
-
-                offset += length;
-            }
-
-            return true;
-        }
-        finally
-        {
-            _gate.ExitReadLock();
-        }
-    }
-
     public bool TryCompare(ulong virtualAddress, ReadOnlySpan<byte> expected) =>
         TryCompare(virtualAddress, expected, out var equal) && equal;
 

src/SharpEmu.Core/Runtime/SharpEmuRuntime.cs

@@ -159,7 +159,6 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         FiberExports.ResetRuntimeState();
         Http2Exports.ResetRuntimeState();
         NpAuthExports.ResetRuntimeState();
-        NpUniversalDataSystemExports.ResetRuntimeState();
         KernelModuleRegistry.Reset();
         var image = LoadImage(normalizedEbootPath);
         VideoOutExports.ConfigureApplicationInfo(image.Title, image.TitleId, image.Version);
@@ -668,15 +667,14 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
 
         var moduleDirectories = new[]
         {
-            (Path: Path.Combine(ebootDirectory, "sce_module"), StartAtBoot: true, LinkedOnly: false, SearchOption: SearchOption.TopDirectoryOnly),
-            (Path: Path.Combine(ebootDirectory, "sce_modules"), StartAtBoot: true, LinkedOnly: false, SearchOption: SearchOption.TopDirectoryOnly),
-            (Path: Path.Combine(ebootDirectory, "Media", "Modules"), StartAtBoot: true, LinkedOnly: false, SearchOption: SearchOption.TopDirectoryOnly),
             // A linked PRX can be beside eboot.bin. Load only the app-root modules
-            // named by the main image at boot, after the normal module directories
-            // they may depend on. Map the other app-root modules so
+            // named by the main image at boot. Map the other app-root modules so
             // sceKernelLoadStartModule can start them later.
             (Path: ebootDirectory, StartAtBoot: true, LinkedOnly: true, SearchOption: SearchOption.TopDirectoryOnly),
             (Path: ebootDirectory, StartAtBoot: false, LinkedOnly: false, SearchOption: SearchOption.TopDirectoryOnly),
+            (Path: Path.Combine(ebootDirectory, "sce_module"), StartAtBoot: true, LinkedOnly: false, SearchOption: SearchOption.TopDirectoryOnly),
+            (Path: Path.Combine(ebootDirectory, "sce_modules"), StartAtBoot: true, LinkedOnly: false, SearchOption: SearchOption.TopDirectoryOnly),
+            (Path: Path.Combine(ebootDirectory, "Media", "Modules"), StartAtBoot: true, LinkedOnly: false, SearchOption: SearchOption.TopDirectoryOnly),
             // Unity native plugins are loaded later through sceKernelLoadStartModule. Map
             // them up front so the HLE loader can return a real module handle and dlsym
             // can resolve their exports, but defer DT_INIT until the guest requests them.

src/SharpEmu.GUI/GuiSettings.cs

@@ -82,12 +82,12 @@ public sealed class GuiSettings
 
     public bool OverlayEnabled { get; set; } = true;
     public string OverlayCorner { get; set; } = "TopRight";
-    public string OverlayMode { get; set; } = "TitleBar";
+    public string OverlayMode { get; set; } = "Full";
 
     /// <summary>Names of SHARPEMU_* switches set to "1" in the emulator's environment at launch.</summary>
-    public List<string> EnvironmentToggles { get; set; } = ["SHARPEMU_WRITABLE_APP0", "SHARPEMU_DISABLE_IMPORT_LOOP_GUARD"];
+    public List<string> EnvironmentToggles { get; set; } = ["SHARPEMU_WRITABLE_APP0"];
 
-    public string BinkPlaybackMode { get; set; } = "Guest";
+    public string BinkPlaybackMode { get; set; } = "Host";
 
     /// <summary>Internal render resolution scale (1.0 = native, 0.5 = half).</summary>
     public double RenderResolutionScale { get; set; } = 1.0;
@@ -131,7 +131,7 @@ public sealed class GuiSettings
 
         settings.GameFolders = FilterNullOrEmpty(settings.GameFolders);
         settings.ExcludedGames = FilterNullOrEmpty(settings.ExcludedGames);
-        settings.EnvironmentToggles = FilterNullOrEmpty(settings.EnvironmentToggles ?? ["SHARPEMU_WRITABLE_APP0", "SHARPEMU_DISABLE_IMPORT_LOOP_GUARD"]);
+        settings.EnvironmentToggles = FilterNullOrEmpty(settings.EnvironmentToggles ?? ["SHARPEMU_WRITABLE_APP0"]);
         settings.LogLevel ??= "Info";
         settings.Language ??= "en";
         var legacyProfile = settings.EnvironmentToggles
@@ -186,9 +186,9 @@ public sealed class GuiSettings
         settings.Resolution = NormalizeResolution(settings.Resolution);
         settings.ScalingMode = NormalizeChoice(settings.ScalingMode, "Fit", "Cover", "Stretch", "Integer");
         settings.HdrMode = NormalizeChoice(settings.HdrMode, "Auto", "On", "Off");
-        settings.BinkPlaybackMode = NormalizeChoice(settings.BinkPlaybackMode, "Guest", "Host", "Skip");
+        settings.BinkPlaybackMode = NormalizeChoice(settings.BinkPlaybackMode, "Host", "Guest", "Skip");
         settings.OverlayCorner = NormalizeChoice(settings.OverlayCorner, "TopRight", "TopLeft", "BottomRight", "BottomLeft");
-        settings.OverlayMode = NormalizeChoice(settings.OverlayMode, "TitleBar", "Full", "Minimal");
+        settings.OverlayMode = NormalizeChoice(settings.OverlayMode, "Full", "Minimal", "TitleBar");
         settings.DisplayIndex = Math.Max(0, settings.DisplayIndex);
         settings.RefreshRate = Math.Clamp(settings.RefreshRate, 0, 1000);
         settings.EmbeddedConsoleHeight = NormalizeConsoleSize(settings.EmbeddedConsoleHeight, 240, 120);

src/SharpEmu.GUI/Languages/ar.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "استخدام HDR عندما تدعمه الشاشة المحددة وواجهة الرسومات. يعود الوضع التلقائي إلى SDR.",
   "Options.Hdr.Auto": "تلقائي",
   "Options.Env.BinkPlayback.Label": "تشغيل فيديو Bink",
-  "Options.Env.BinkPlayback.Desc": "يقوم Host بتشغيل فيديوهات Bink عبر جسر FFmpeg، لكن قد تظهر مشكلات في بعض الألعاب.\nيستخدم Guest وحدة فك الترميز الخاصة بمحرك اللعبة.\nيتخطى Skip فيديوهات Bink، مما قد يجعل التطوير أسهل.",
+  "Options.Env.BinkPlayback.Desc": "يقوم Host بتشغيل فيديوهات Bink عبر جسر FFmpeg، لكن قد تظهر مشكلات في بعض الألعاب.\nيستخدم Guest وحدة فك الترميز الخاصة بمحرك اللعبة، والتي يدعمها SharpEmu حاليًا بشكل جزئي فقط.\nيتخطى Skip فيديوهات Bink، مما قد يجعل التطوير أسهل.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "تخطي"

src/SharpEmu.GUI/Languages/az.json

@@ -91,7 +91,7 @@
   "Options.Hdr.Desc": "Seçilmiş ekran və qrafik alt sistem dəstəklədikdə HDR istifadə edin. Avtomatik rejimdə dəstək yoxdursa, SDR istifadə olunur.",
   "Options.Hdr.Auto": "Avtomatik",
   "Options.Env.BinkPlayback.Label": "Bink video oynadılması",
-  "Options.Env.BinkPlayback.Desc": "Host Bink videolarını FFmpeg körpüsü vasitəsilə oynadır, lakin bəzi oyunlarda problemlər yarana bilər.\nGuest oyunun öz dekoderindən istifadə edir.\nSkip Bink videolarını ötürür və bu, inkişaf prosesini asanlaşdıra bilər.",
+  "Options.Env.BinkPlayback.Desc": "Host Bink videolarını FFmpeg körpüsü vasitəsilə oynadır, lakin bəzi oyunlarda problemlər yarana bilər.\nGuest oyunun öz dekoderindən istifadə edir; SharpEmu hazırda bunu yalnız qismən dəstəkləyir.\nSkip Bink videolarını ötürür və bu, inkişaf prosesini asanlaşdıra bilər.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Skip",

src/SharpEmu.GUI/Languages/br.json

@@ -237,7 +237,7 @@
   "Options.Hdr.Desc": "Usa HDR quando a tela selecionada e o backend gráfico oferecem suporte. O modo automático retorna ao SDR.",
   "Options.Hdr.Auto": "Automático",
   "Options.Env.BinkPlayback.Label": "Reprodução de vídeo Bink",
-  "Options.Env.BinkPlayback.Desc": "Host reproduz vídeos Bink pela ponte FFmpeg, mas alguns jogos podem apresentar problemas.\nGuest usa o decodificador do próprio motor do jogo.\nSkip ignora os vídeos Bink, o que pode facilitar o desenvolvimento.",
+  "Options.Env.BinkPlayback.Desc": "Host reproduz vídeos Bink pela ponte FFmpeg, mas alguns jogos podem apresentar problemas.\nGuest usa o decodificador do próprio motor do jogo, que o SharpEmu atualmente suporta apenas parcialmente.\nSkip ignora os vídeos Bink, o que pode facilitar o desenvolvimento.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Ignorar"

src/SharpEmu.GUI/Languages/de.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "HDR verwenden, wenn die ausgewählte Anzeige und das Grafik-Backend es unterstützen. Automatisch fällt auf SDR zurück.",
   "Options.Hdr.Auto": "Automatisch",
   "Options.Env.BinkPlayback.Label": "Bink-Videowiedergabe",
-  "Options.Env.BinkPlayback.Desc": "Host spielt Bink-Videos über die FFmpeg-Brücke ab, bei einigen Spielen können jedoch Probleme auftreten.\nGuest verwendet den spieleigenen Decoder.\nSkip überspringt Bink-Videos, was die Entwicklung erleichtern kann.",
+  "Options.Env.BinkPlayback.Desc": "Host spielt Bink-Videos über die FFmpeg-Brücke ab, bei einigen Spielen können jedoch Probleme auftreten.\nGuest verwendet den spieleigenen Decoder, den SharpEmu derzeit nur teilweise unterstützt.\nSkip überspringt Bink-Videos, was die Entwicklung erleichtern kann.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Überspringen"

src/SharpEmu.GUI/Languages/dk.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "Brug HDR, når den valgte skærm og grafik-backend understøtter det. Automatisk falder tilbage til SDR.",
   "Options.Hdr.Auto": "Automatisk",
   "Options.Env.BinkPlayback.Label": "Bink-videoafspilning",
-  "Options.Env.BinkPlayback.Desc": "Host afspiller Bink-videoer via FFmpeg-broen, men nogle spil kan opleve problemer.\nGuest bruger spilmotorens egen dekoder.\nSkip springer Bink-videoer over, hvilket kan gøre udviklingen nemmere.",
+  "Options.Env.BinkPlayback.Desc": "Host afspiller Bink-videoer via FFmpeg-broen, men nogle spil kan opleve problemer.\nGuest bruger spilmotorens egen dekoder, som SharpEmu i øjeblikket kun understøtter delvist.\nSkip springer Bink-videoer over, hvilket kan gøre udviklingen nemmere.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Spring over"

src/SharpEmu.GUI/Languages/ee.json

@@ -102,7 +102,7 @@
   "Options.Hdr.Desc": "Kasuta HDR-i, kui valitud kuvar ja graafikaliides seda toetavad. Automaatrežiim lülitub tagasi SDR-ile.",
   "Options.Hdr.Auto": "Automaatne",
   "Options.Env.BinkPlayback.Label": "Bink-video taasesitus",
-  "Options.Env.BinkPlayback.Desc": "Host esitab Bink-videoid FFmpegi silla kaudu, kuid mõnes mängus võib esineda probleeme.\nGuest kasutab mängumootori enda dekoodrit.\nSkip jätab Bink-videod vahele, mis võib arendust lihtsustada.",
+  "Options.Env.BinkPlayback.Desc": "Host esitab Bink-videoid FFmpegi silla kaudu, kuid mõnes mängus võib esineda probleeme.\nGuest kasutab mängumootori enda dekoodrit, mida SharpEmu praegu ainult osaliselt toetab.\nSkip jätab Bink-videod vahele, mis võib arendust lihtsustada.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Jäta vahele",

src/SharpEmu.GUI/Languages/en.json

@@ -102,7 +102,7 @@
   "Options.Hdr.Desc": "Use HDR when the selected display and graphics backend support it. Auto falls back to SDR.",
   "Options.Hdr.Auto": "Auto",
   "Options.Env.BinkPlayback.Label": "Bink video playback",
-  "Options.Env.BinkPlayback.Desc": "Host plays Bink videos through the FFmpeg bridge, but some games may have issues.\nGuest uses the game engine's own decoder.\nSkip skips Bink videos, which can make development easier.",
+  "Options.Env.BinkPlayback.Desc": "Host plays Bink videos through the FFmpeg bridge, but some games may have issues.\nGuest uses the game engine's own decoder, which SharpEmu currently supports only partially.\nSkip skips Bink videos, which can make development easier.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Skip",

src/SharpEmu.GUI/Languages/es.json

@@ -237,7 +237,7 @@
   "Options.Hdr.Desc": "Usa HDR cuando la pantalla seleccionada y el backend gráfico sean compatibles. El modo automático vuelve a SDR.",
   "Options.Hdr.Auto": "Automático",
   "Options.Env.BinkPlayback.Label": "Reproducción de vídeo Bink",
-  "Options.Env.BinkPlayback.Desc": "Host reproduce los vídeos Bink mediante el puente FFmpeg, aunque algunos juegos pueden presentar problemas.\nGuest usa el decodificador propio del motor del juego.\nSkip omite los vídeos Bink, lo que puede facilitar el desarrollo.",
+  "Options.Env.BinkPlayback.Desc": "Host reproduce los vídeos Bink mediante el puente FFmpeg, aunque algunos juegos pueden presentar problemas.\nGuest usa el decodificador propio del motor del juego, que SharpEmu actualmente solo admite de forma parcial.\nSkip omite los vídeos Bink, lo que puede facilitar el desarrollo.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Omitir"

src/SharpEmu.GUI/Languages/fr.json

@@ -237,7 +237,7 @@
   "Options.Hdr.Desc": "Utiliser le HDR lorsque l’écran sélectionné et le backend graphique le prennent en charge. Le mode automatique revient au SDR.",
   "Options.Hdr.Auto": "Automatique",
   "Options.Env.BinkPlayback.Label": "Lecture vidéo Bink",
-  "Options.Env.BinkPlayback.Desc": "Host lit les vidéos Bink via le pont FFmpeg, mais certains jeux peuvent rencontrer des problèmes.\nGuest utilise le décodeur propre au moteur du jeu.\nSkip ignore les vidéos Bink, ce qui peut faciliter le développement.",
+  "Options.Env.BinkPlayback.Desc": "Host lit les vidéos Bink via le pont FFmpeg, mais certains jeux peuvent rencontrer des problèmes.\nGuest utilise le décodeur propre au moteur du jeu, que SharpEmu ne prend actuellement en charge que partiellement.\nSkip ignore les vidéos Bink, ce qui peut faciliter le développement.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Ignorer"

src/SharpEmu.GUI/Languages/hu.json

@@ -237,7 +237,7 @@
   "Options.Hdr.Desc": "HDR használata, ha a kiválasztott kijelző és grafikus backend támogatja. Az automatikus mód SDR-re vált vissza.",
   "Options.Hdr.Auto": "Automatikus",
   "Options.Env.BinkPlayback.Label": "Bink videólejátszás",
-  "Options.Env.BinkPlayback.Desc": "A Host az FFmpeg hídon keresztül játssza le a Bink videókat, de egyes játékoknál problémák jelentkezhetnek.\nA Guest a játékmotor saját dekóderét használja.\nA Skip kihagyja a Bink videókat, ami megkönnyítheti a fejlesztést.",
+  "Options.Env.BinkPlayback.Desc": "A Host az FFmpeg hídon keresztül játssza le a Bink videókat, de egyes játékoknál problémák jelentkezhetnek.\nA Guest a játékmotor saját dekóderét használja, amelyet a SharpEmu jelenleg csak részben támogat.\nA Skip kihagyja a Bink videókat, ami megkönnyítheti a fejlesztést.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Kihagyás"

src/SharpEmu.GUI/Languages/it.json

@@ -241,7 +241,7 @@
   "Options.Hdr.Desc": "Usa HDR quando lo schermo selezionato e il backend grafico lo supportano. La modalità automatica torna a SDR.",
   "Options.Hdr.Auto": "Automatico",
   "Options.Env.BinkPlayback.Label": "Riproduzione video Bink",
-  "Options.Env.BinkPlayback.Desc": "Host riproduce i video Bink tramite il bridge FFmpeg, ma alcuni giochi potrebbero avere problemi.\nGuest usa il decoder del motore di gioco.\nSkip salta i video Bink, facilitando lo sviluppo.",
+  "Options.Env.BinkPlayback.Desc": "Host riproduce i video Bink tramite il bridge FFmpeg, ma alcuni giochi potrebbero avere problemi.\nGuest usa il decoder del motore di gioco, che SharpEmu attualmente supporta solo in parte.\nSkip salta i video Bink, facilitando lo sviluppo.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Salta"

src/SharpEmu.GUI/Languages/ja.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "選択したディスプレイとグラフィックスバックエンドが対応している場合にHDRを使用します。自動ではSDRにフォールバックします。",
   "Options.Hdr.Auto": "自動",
   "Options.Env.BinkPlayback.Label": "Bink 動画再生",
-  "Options.Env.BinkPlayback.Desc": "Host は FFmpeg ブリッジ経由で Bink 動画を再生しますが、一部のゲームで問題が発生する場合があります。\nGuest はゲームエンジン独自のデコーダーを使用します。\nSkip は Bink 動画をスキップし、開発を容易にする場合があります。",
+  "Options.Env.BinkPlayback.Desc": "Host は FFmpeg ブリッジ経由で Bink 動画を再生しますが、一部のゲームで問題が発生する場合があります。\nGuest はゲームエンジン独自のデコーダーを使用しますが、SharpEmu は現在これを部分的にしかサポートしていません。\nSkip は Bink 動画をスキップし、開発を容易にする場合があります。",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "スキップ"

src/SharpEmu.GUI/Languages/ko.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "선택한 디스플레이와 그래픽 백엔드가 지원하는 경우 HDR을 사용합니다. 자동 모드는 SDR로 대체됩니다.",
   "Options.Hdr.Auto": "자동",
   "Options.Env.BinkPlayback.Label": "Bink 비디오 재생",
-  "Options.Env.BinkPlayback.Desc": "Host는 FFmpeg 브리지를 통해 Bink 비디오를 재생하지만 일부 게임에서 문제가 발생할 수 있습니다.\nGuest는 게임 엔진 자체 디코더를 사용합니다.\nSkip은 Bink 비디오를 건너뛰어 개발을 더 쉽게 할 수 있습니다.",
+  "Options.Env.BinkPlayback.Desc": "Host는 FFmpeg 브리지를 통해 Bink 비디오를 재생하지만 일부 게임에서 문제가 발생할 수 있습니다.\nGuest는 게임 엔진 자체 디코더를 사용하며, SharpEmu는 현재 이를 부분적으로만 지원합니다.\nSkip은 Bink 비디오를 건너뛰어 개발을 더 쉽게 할 수 있습니다.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "건너뛰기"

src/SharpEmu.GUI/Languages/nl.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "Gebruik HDR wanneer het geselecteerde beeldscherm en de grafische backend dit ondersteunen. Automatisch valt terug op SDR.",
   "Options.Hdr.Auto": "Automatisch",
   "Options.Env.BinkPlayback.Label": "Bink-video afspelen",
-  "Options.Env.BinkPlayback.Desc": "Host speelt Bink-video's af via de FFmpeg-brug, maar sommige games kunnen problemen hebben.\nGuest gebruikt de eigen decoder van de game-engine.\nSkip slaat Bink-video's over, wat de ontwikkeling kan vergemakkelijken.",
+  "Options.Env.BinkPlayback.Desc": "Host speelt Bink-video's af via de FFmpeg-brug, maar sommige games kunnen problemen hebben.\nGuest gebruikt de eigen decoder van de game-engine, die SharpEmu momenteel slechts gedeeltelijk ondersteunt.\nSkip slaat Bink-video's over, wat de ontwikkeling kan vergemakkelijken.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Overslaan"

src/SharpEmu.GUI/Languages/pl.json

@@ -102,7 +102,7 @@
   "Options.Hdr.Desc": "Używaj HDR, gdy wybrany wyświetlacz i backend graficzny to obsługują. Automatyczny przełącza na SDR.",
   "Options.Hdr.Auto": "Automatyczny",
   "Options.Env.BinkPlayback.Label": "Odtwarzanie wideo Bink",
-  "Options.Env.BinkPlayback.Desc": "Host odtwarza filmy Bink przez most FFmpeg, ale w niektórych grach mogą wystąpić problemy.\nGuest używa dekodera silnika gry.\nSkip pomija filmy Bink, co może ułatwić rozwój.",
+  "Options.Env.BinkPlayback.Desc": "Host odtwarza filmy Bink przez most FFmpeg, ale w niektórych grach mogą wystąpić problemy.\nGuest używa dekodera silnika gry, który SharpEmu obecnie obsługuje tylko częściowo.\nSkip pomija filmy Bink, co może ułatwić rozwój.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Pomiń",

src/SharpEmu.GUI/Languages/pt.json

@@ -237,7 +237,7 @@
   "Options.Hdr.Desc": "Utiliza HDR quando o ecrã selecionado e o backend gráfico o suportam. O modo automático regressa a SDR.",
   "Options.Hdr.Auto": "Automático",
   "Options.Env.BinkPlayback.Label": "Reprodução de vídeo Bink",
-  "Options.Env.BinkPlayback.Desc": "Host reproduz vídeos Bink pela ponte FFmpeg, mas alguns jogos podem apresentar problemas.\nGuest usa o descodificador do próprio motor do jogo.\nSkip ignora os vídeos Bink, o que pode facilitar o desenvolvimento.",
+  "Options.Env.BinkPlayback.Desc": "Host reproduz vídeos Bink pela ponte FFmpeg, mas alguns jogos podem apresentar problemas.\nGuest usa o descodificador do próprio motor do jogo, que o SharpEmu atualmente suporta apenas parcialmente.\nSkip ignora os vídeos Bink, o que pode facilitar o desenvolvimento.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Ignorar"

src/SharpEmu.GUI/Languages/ru.json

@@ -98,7 +98,7 @@
   "Options.Hdr.Desc": "Использовать HDR, если выбранный монитор и графический бэкенд его поддерживают. Автоматический режим при необходимости переключается на SDR.",
   "Options.Hdr.Auto": "Авто",
   "Options.Env.BinkPlayback.Label": "Воспроизведение видео Bink",
-  "Options.Env.BinkPlayback.Desc": "Host воспроизводит видео Bink через мост FFmpeg, однако в некоторых играх могут возникать проблемы.\nGuest использует собственный декодер игрового движка.\nSkip пропускает видео Bink, что может упростить разработку.",
+  "Options.Env.BinkPlayback.Desc": "Host воспроизводит видео Bink через мост FFmpeg, однако в некоторых играх могут возникать проблемы.\nGuest использует собственный декодер игрового движка, который SharpEmu сейчас поддерживает лишь частично.\nSkip пропускает видео Bink, что может упростить разработку.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Пропустить",

src/SharpEmu.GUI/Languages/tr.json

@@ -240,7 +240,7 @@
   "Options.Scaling.Integer": "Tam sayı",
   "Options.Hdr.Auto": "Otomatik",
   "Options.Env.BinkPlayback.Label": "Bink video oynatma",
-  "Options.Env.BinkPlayback.Desc": "Host, Bink videolarını FFmpeg köprüsüyle oynatır ancak bazı oyunlarda sorunlarla karşılaşabilir.\nGuest, oyun motorunun kendi kod çözücüsünü kullanır.\nSkip, Bink videolarını atlar; bu, geliştirmeyi kolaylaştırabilir.",
+  "Options.Env.BinkPlayback.Desc": "Host, Bink videolarını FFmpeg köprüsüyle oynatır ancak bazı oyunlarda sorunlarla karşılaşabilir.\nGuest, oyun motorunun kendi kod çözücüsünü kullanır ancak SharpEmu bunu şu anda yalnızca kısmen desteklemektedir.\nSkip, Bink videolarını atlar; bu, geliştirmeyi kolaylaştırabilir.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Atla"

src/SharpEmu.GUI/MainWindow.GameOptions.cs

@@ -218,7 +218,7 @@ public partial class MainWindow
                 "Fit");
             GameVSyncToggle.IsChecked = effective.VSync;
             GameOverlayEnabledToggle.IsChecked = effective.OverlayEnabled;
-            GameOverlayModeBox.SelectedItem = FindChoice(_overlayModeChoices, effective.OverlayMode, "TitleBar");
+            GameOverlayModeBox.SelectedItem = FindChoice(_overlayModeChoices, effective.OverlayMode, "Full");
             GameOverlayCornerBox.SelectedItem = FindChoice(_overlayCornerChoices, effective.OverlayCorner, "TopRight");
             GameHdrModeBox.SelectedItem = FindChoice(
                 _hdrModeChoices,
@@ -285,7 +285,7 @@ public partial class MainWindow
             VSync = GameVSyncToggle.IsChecked == true,
             HdrMode = SelectedComboText(GameHdrModeBox, "Auto"),
             OverlayEnabled = GameOverlayEnabledToggle.IsChecked == true,
-            OverlayMode = SelectedComboText(GameOverlayModeBox, "TitleBar"),
+            OverlayMode = SelectedComboText(GameOverlayModeBox, "Full"),
             OverlayCorner = SelectedComboText(GameOverlayCornerBox, "TopRight"),
             EnvironmentToggles = BuildGameEnvironmentEntries(),
             CustomEnvironmentVariables = PerGameSettings.Load(_gameSettingsTitleId)?.CustomEnvironmentVariables,

src/SharpEmu.GUI/MainWindow.axaml.cs

@@ -327,7 +327,7 @@ public partial class MainWindow : Window
         VSyncToggle.IsCheckedChanged += (_, _) => _settings.VSync = VSyncToggle.IsChecked == true;
         HdrModeBox.SelectionChanged += (_, _) => _settings.HdrMode = SelectedComboText(HdrModeBox, "Auto");
         OverlayEnabledToggle.IsCheckedChanged += (_, _) => _settings.OverlayEnabled = OverlayEnabledToggle.IsChecked == true;
-        OverlayModeBox.SelectionChanged += (_, _) => _settings.OverlayMode = SelectedComboText(OverlayModeBox, "TitleBar");
+        OverlayModeBox.SelectionChanged += (_, _) => _settings.OverlayMode = SelectedComboText(OverlayModeBox, "Full");
         OverlayCornerBox.SelectionChanged += (_, _) => _settings.OverlayCorner = SelectedComboText(OverlayCornerBox, "TopRight");
         UpdateButton.Click += async (_, _) => await OnUpdateButtonAsync();
         SelectLogFilePathButton.Click += async (_, _) => await SelectLogFilePathAsync();
@@ -344,7 +344,7 @@ public partial class MainWindow : Window
         EnvWritableApp0Toggle.IsCheckedChanged += (_, _) =>
             SetEnvironmentToggle("SHARPEMU_WRITABLE_APP0", EnvWritableApp0Toggle.IsChecked == true);
         BinkPlaybackBox.SelectionChanged += (_, _) =>
-            _settings.BinkPlaybackMode = SelectedComboText(BinkPlaybackBox, "Guest");
+            _settings.BinkPlaybackMode = SelectedComboText(BinkPlaybackBox, "Host");
         EnvVkValidationToggle.IsCheckedChanged += (_, _) =>
             SetEnvironmentToggle("SHARPEMU_VK_VALIDATION", EnvVkValidationToggle.IsChecked == true);
         EnvDumpSpirvToggle.IsCheckedChanged += (_, _) =>
@@ -2545,11 +2545,6 @@ public partial class MainWindow : Window
         _appliedEnvironmentVariables.Add(StrictComputeSettings.VariableName);
         _appliedEnvironmentVariables.Add(DefaultProfileEnvironmentName);
 
-        // An absent switch now enables the guard opt-out by default; send 0 for a disabled GUI toggle.
-        Environment.SetEnvironmentVariable("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD",
-            effective.EnvironmentToggles.Contains("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD") ? "1" : "0");
-        _appliedEnvironmentVariables.Add("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD");
-
         Environment.SetEnvironmentVariable(
             BinkModeEnvironmentName,
             _settings.BinkPlaybackMode switch

src/SharpEmu.HLE/GpuMemory/CpuDirtySummary.cs

@@ -12,11 +12,6 @@ public sealed class CpuDirtySummary
 {
     private const int WordBits = 64;
     private readonly long[] _words = new long[(TrackerLayout.BlockCount + WordBits - 1) / WordBits];
-    private long _epoch;
-
-    public long Epoch => Volatile.Read(ref _epoch);
-
-    public void NoteDirtied() => Interlocked.Increment(ref _epoch);
 
     public void Set(ulong block, bool dirty)
     {
@@ -33,6 +28,4 @@ public sealed class CpuDirtySummary
     }
 
     public bool IsDirty(ulong block) => (Volatile.Read(ref _words[block / WordBits]) & (1L << (int)(block % WordBits))) != 0;
-
-    public ulong Word(int index) => (ulong)Volatile.Read(ref _words[index]);
 }

src/SharpEmu.HLE/GpuMemory/GuestGpuMemory.cs

@@ -30,9 +30,6 @@ public sealed class GuestGpuMemory : IDisposable
     private readonly PageGuard _pages;
     private readonly ReaderWriterLockSlim _spansLock = new();
     private readonly SpanSet _spans = new();
-    private long _spanVersion;
-
-    public long SpanVersion => Interlocked.Read(ref _spanVersion);
     private sealed record GpuAttachment(IGpuQueueRelay? Gpu, IGpuTickScheduler? Scheduler);
 
     private readonly object _attachGate = new();
@@ -177,26 +174,6 @@ public sealed class GuestGpuMemory : IDisposable
         }
     }
 
-    // Whether any GPU-registered span intersects the range. Memory outside every span holds no GPU
-    // cache entries and no tracked pages, so mapping changes there need nothing from the GPU worker.
-    public bool OverlapsRegistered(ulong address, ulong size)
-    {
-        if (!new GuestSpan(address, size).IsValid)
-        {
-            return false;
-        }
-
-        _spansLock.EnterReadLock();
-        try
-        {
-            return _spans.Overlaps(address, size);
-        }
-        finally
-        {
-            _spansLock.ExitReadLock();
-        }
-    }
-
     // The host mapping takes the guest protection here; the views themselves are mapped read-write.
     public void Register(ulong address, ulong size, GuestPageProtection protection)
     {
@@ -207,7 +184,6 @@ public sealed class GuestGpuMemory : IDisposable
         try
         {
             _spans.Add(address, size);
-            Interlocked.Increment(ref _spanVersion);
         }
         finally
         {
@@ -280,7 +256,6 @@ public sealed class GuestGpuMemory : IDisposable
                 try
                 {
                     _spans.Remove(address, size);
-                    Interlocked.Increment(ref _spanVersion);
                 }
                 finally
                 {

src/SharpEmu.HLE/GpuMemory/GuestGpuMemoryHook.cs

@@ -102,9 +102,6 @@ public static class GuestGpuMemoryHook
     public static bool NoteProtected(ulong address, ulong size, GuestPageProtection protection) =>
         _current != null && IsWithinGpuAddressSpace(address, size) && _current.NoteProtected(address, size, protection);
 
-    public static bool OverlapsRegistered(ulong address, ulong size) =>
-        _current != null && IsWithinGpuAddressSpace(address, size) && _current.OverlapsRegistered(address, size);
-
     public static void NoteUnmapped(ulong address, ulong size)
     {
         if (_current == null || !IsWithinGpuAddressSpace(address, size))

src/SharpEmu.HLE/GpuMemory/GuestPageTracker.cs

@@ -15,7 +15,6 @@ public sealed class GuestPageTracker
 
     private readonly PageGuard _pages;
     private readonly TrackedRegion?[] _regions = new TrackedRegion?[TrackerLayout.BlockCount];
-    private readonly long[] _presentRegions = new long[(TrackerLayout.BlockCount + 63) / 64];
     private readonly object _regionGate = new();
     private readonly CpuDirtySummary _cpuDirtySummary = new();
 
@@ -36,34 +35,6 @@ public sealed class GuestPageTracker
         });
     }
 
-    public bool MayHaveCpuDirtyPages(ulong vaddr, ulong size)
-    {
-        if (IsKnownCpuClean(vaddr, size))
-        {
-            return false;
-        }
-
-        var remaining = size;
-        var index = vaddr / BlockBytes;
-        var offset = vaddr % BlockBytes;
-        while (remaining != 0)
-        {
-            var bytes = Math.Min(BlockBytes - offset, remaining);
-            if (Volatile.Read(ref _regions[index]) is not { } region || region.IsModified(WriteOrigin.Cpu, offset, bytes))
-            {
-                return true;
-            }
-
-            remaining -= bytes;
-            offset = 0;
-            index++;
-        }
-
-        return false;
-    }
-
-    public long CpuDirtyEpoch => _cpuDirtySummary.Epoch;
-
     public bool HasGpuDirtyPages(ulong vaddr, ulong size)
     {
         RejectUploadCallbackReentry();
@@ -74,31 +45,6 @@ public sealed class GuestPageTracker
         });
     }
 
-    // Lock-free pre-check for hot readers: only the GPU queue thread sets GPU-dirty bits,
-    // so on that thread a clear answer is exact; a stale dirty answer merely sends the
-    // caller to HasGpuDirtyPages. Allocation- and lock-free.
-    public bool MayHaveGpuDirtyPages(ulong vaddr, ulong size)
-    {
-        ValidateRange(vaddr, size);
-        var remaining = size;
-        var index = vaddr / BlockBytes;
-        var offset = vaddr % BlockBytes;
-        while (remaining != 0)
-        {
-            var bytes = Math.Min(BlockBytes - offset, remaining);
-            if (Volatile.Read(ref _regions[index]) is { } region && region.IsModified(WriteOrigin.Gpu, offset, bytes))
-            {
-                return true;
-            }
-
-            remaining -= bytes;
-            offset = 0;
-            index++;
-        }
-
-        return false;
-    }
-
     public bool IsCpuWriteHotRange(ulong vaddr, ulong size)
     {
         RejectUploadCallbackReentry();
@@ -169,53 +115,29 @@ public sealed class GuestPageTracker
 
     // Removes protection from a range; a GPU-dirty region flushes through onFlush without the lock.
     public bool InvalidateRegion(ulong vaddr, ulong size, Action onFlush)
-    {
-        var tracked = InvalidateRegion(vaddr, size, out var needsGpuFlush);
-        if (needsGpuFlush)
-        {
-            onFlush();
-        }
-
-        return tracked;
-    }
-
-    // Marks the CPU write in every region whose bytes the GPU has not modified and
-    // reports whether any region still holds GPU data the caller must download first
-    // (one download of the whole range covers them all). Allocation-free: guest
-    // command writes land here once per dword.
-    public bool InvalidateRegion(ulong vaddr, ulong size, out bool needsGpuFlush)
     {
         RejectUploadCallbackReentry();
-        ValidateRange(vaddr, size);
         var tracked = false;
-        needsGpuFlush = false;
-        var remaining = size;
-        var index = vaddr / BlockBytes;
-        var offset = vaddr % BlockBytes;
-        while (remaining != 0)
+        VisitRegions(vaddr, size, create: false, (region, offset, bytes) =>
         {
-            var bytes = Math.Min(BlockBytes - offset, remaining);
-            if (Volatile.Read(ref _regions[index]) is { } region)
+            tracked = true;
+            bool shouldFlush;
+            using (region.Lock.Hold())
             {
-                tracked = true;
-                using (region.Lock.Hold())
+                shouldFlush = region.IsModified(WriteOrigin.Gpu, offset, bytes);
+                if (!shouldFlush)
                 {
-                    if (region.IsModified(WriteOrigin.Gpu, offset, bytes))
-                    {
-                        needsGpuFlush = true;
-                    }
-                    else
-                    {
-                        region.MarkCpuWrite(region.BaseAddress + offset, bytes);
-                    }
+                    region.MarkCpuWrite(region.BaseAddress + offset, bytes);
                 }
             }
 
-            remaining -= bytes;
-            offset = 0;
-            index++;
-        }
+            if (shouldFlush)
+            {
+                onFlush();
+            }
 
+            return false;
+        });
         return tracked;
     }
 
@@ -427,72 +349,6 @@ public sealed class GuestPageTracker
 
     // True when every block of the range is tracked and has no CPU-dirty page. A missing
     // region is not known clean: the precise path creates it, fully dirty.
-    // Visits the maximal runs of the range whose 4 MiB blocks may hold CPU-dirty pages: a block
-    // with no region yet starts all dirty, and a region's summary bit is set while any of its
-    // pages is dirty. Known-clean blocks are skipped without a lock, the same test
-    // HasCpuDirtyPages starts with, so a caller that only uploads dirty pages loses nothing.
-    public void ForEachPossiblyCpuDirtyRange(ulong vaddr, ulong size, Action<ulong, ulong> visit)
-    {
-        if (size == 0)
-        {
-            return;
-        }
-
-        if (!new GuestSpan(vaddr, size).IsValid)
-        {
-            // Outside the tracked space nothing is known clean; the caller decides as before.
-            visit(vaddr, size);
-            return;
-        }
-
-        var end = vaddr + size;
-        var last = (end - 1) / BlockBytes;
-        var runStart = 0UL;
-        var inRun = false;
-        var index = vaddr / BlockBytes;
-        var loadedWord = -1;
-        var possiblyDirty = 0UL;
-        while (index <= last)
-        {
-            var word = (int)(index / 64);
-            if (word != loadedWord)
-            {
-                loadedWord = word;
-                possiblyDirty = ~(ulong)Volatile.Read(ref _presentRegions[word]) | _cpuDirtySummary.Word(word);
-            }
-
-            var shift = (int)(index % 64);
-            var pending = (inRun ? ~possiblyDirty : possiblyDirty) >> shift;
-            if (pending == 0)
-            {
-                index = ((ulong)word + 1) * 64;
-                continue;
-            }
-
-            index += (ulong)System.Numerics.BitOperations.TrailingZeroCount(pending);
-            if (index > last)
-            {
-                break;
-            }
-
-            if (inRun)
-            {
-                visit(runStart, index * BlockBytes - runStart);
-                inRun = false;
-            }
-            else
-            {
-                runStart = Math.Max(vaddr, index * BlockBytes);
-                inRun = true;
-            }
-        }
-
-        if (inRun)
-        {
-            visit(runStart, end - runStart);
-        }
-    }
-
     private bool IsKnownCpuClean(ulong vaddr, ulong size)
     {
         ValidateRange(vaddr, size);
@@ -548,7 +404,6 @@ public sealed class GuestPageTracker
 
             var created = new TrackedRegion(_pages, index * BlockBytes, _cpuDirtySummary);
             Volatile.Write(ref _regions[index], created);
-            Interlocked.Or(ref _presentRegions[index / 64], 1L << (int)(index % 64));
             return created;
         }
     }

src/SharpEmu.HLE/GpuMemory/TrackedRegion.cs

@@ -33,7 +33,6 @@ public sealed class TrackedRegion
         _writable.Fill();
         _readable.Fill();
         _summary?.Set(BaseAddress / BlockBytes, dirty: true);
-        _summary?.NoteDirtied();
     }
 
     public RegionLock Lock { get; } = new();
@@ -213,11 +212,6 @@ public sealed class TrackedRegion
     private void UpdateCpuProtection(bool track)
     {
         _summary?.Set(BaseAddress / BlockBytes, _cpuDirty.Any);
-        if (_summary is not null && (_cpuDirty & ~_writable).Any)
-        {
-            _summary.NoteDirtied();
-        }
-
         var mask = _cpuDirty ^ _writable;
         _writable = _cpuDirty;
         if (mask.None)

src/SharpEmu.HLE/GuestFastPath.cs

@@ -1,414 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Collections.Concurrent;
-using System.Runtime.InteropServices;
-
-namespace SharpEmu.HLE;
-
-/// <summary>
-/// Per-host-thread state that emitted native x86-64 import stubs can read
-/// without entering managed code.
-///
-/// The hottest guest imports are trivial queries about the calling thread
-/// (pthread_self, pthread_getspecific). Routing them through the managed
-/// import gateway costs a guest-to-host stack switch, a full guest register
-/// pack, a GCHandle dereference and the whole dispatch bookkeeping - roughly
-/// three orders of magnitude more than the answer itself. This class publishes
-/// the few values those imports need into a flat native block whose address
-/// lives in a native TLS slot, so a stub can answer them in a handful of
-/// instructions and fall back to the managed gateway whenever the fast answer
-/// is not available.
-///
-/// The block is owned by the host thread; the values in it describe the guest
-/// thread currently bound to that host thread, and are republished by
-/// <see cref="GuestThreadExecution.EnterGuestThread"/> /
-/// <see cref="GuestThreadExecution.RestoreGuestThread"/>. A block whose
-/// ThreadHandle is zero means "no guest thread bound here": every stub then
-/// takes the managed path, which is also what happens before the fast path is
-/// enabled at all.
-/// </summary>
-public static unsafe class GuestFastPath
-{
-    /// <summary>
-    /// Byte offset of the guest thread handle pthread_self must answer with.
-    /// Only ever a real guest thread handle: for a host thread with no guest
-    /// thread bound, pthread_self has to reach the managed export (it registers
-    /// the thread's CPU context with the scheduler), so the slot stays zero.
-    /// </summary>
-    public const int BlockSelfHandleOffset = 0;
-
-    /// <summary>
-    /// Byte offset of the pointer to the pthread-specific value table of the
-    /// thread handle KernelPthreadState would report - the bound guest thread,
-    /// or the host thread's own synthetic handle when none is bound.
-    /// </summary>
-    public const int BlockTlsValuesOffset = 8;
-
-    /// <summary>Byte offset of the pthread_self fast-path hit counter.</summary>
-    public const int BlockSelfHitsOffset = 16;
-
-    /// <summary>Byte offset of the pthread_getspecific fast-path hit counter.</summary>
-    public const int BlockGetspecificHitsOffset = 32;
-
-    /// <summary>Size of the per-host-thread block. One cache line, room for future fast-path state.</summary>
-    public const int BlockSize = 64;
-
-    /// <summary>
-    /// pthread TLS keys the native table can answer. Keys are handed out
-    /// densely from 1 upwards by pthread_key_create, so a small dense table
-    /// covers every key a real title creates; anything at or above this limit
-    /// is answered by the managed dictionary through the slow path.
-    /// </summary>
-    public const int TlsSlotCount = 1024;
-
-    private static readonly ConcurrentDictionary<ulong, nint> TlsTables = new();
-
-    /// <summary>Values for keys at or above <see cref="TlsSlotCount"/>; effectively never used.</summary>
-    private static readonly ConcurrentDictionary<ulong, ConcurrentDictionary<int, ulong>> TlsOverflow = new();
-
-    private static readonly List<nint> Blocks = new();
-    private static readonly object BlocksGate = new();
-
-    private static Action<nint>? _publishBlock;
-    private static volatile bool _enabled;
-
-    [ThreadStatic]
-    private static nint _block;
-
-    [ThreadStatic]
-    private static ulong _hostThreadHandle;
-
-    [ThreadStatic]
-    private static ulong _cachedTableHandle;
-
-    [ThreadStatic]
-    private static nint _cachedTable;
-
-    /// <summary>True once a backend has installed native stubs that read the block.</summary>
-    public static bool Enabled => _enabled;
-
-    /// <summary>
-    /// Arms the fast path. <paramref name="publishBlock"/> stores a block
-    /// pointer in the native TLS slot the emitted stubs read, for the host
-    /// thread that calls it.
-    /// </summary>
-    public static void Enable(Action<nint> publishBlock)
-    {
-        _publishBlock = publishBlock ?? throw new ArgumentNullException(nameof(publishBlock));
-        _enabled = true;
-
-        // A block is published once per host thread, so a second backend (and
-        // therefore a second TLS slot) must be handed the block this thread
-        // already owns or its stubs would never see one.
-        if (_block != 0)
-        {
-            _publishBlock(_block);
-        }
-    }
-
-    /// <summary>Disarms every stub by clearing the calling thread's block; used by tests.</summary>
-    public static void Disable()
-    {
-        _enabled = false;
-        var block = _block;
-        if (block != 0)
-        {
-            *(ulong*)(block + BlockSelfHandleOffset) = 0;
-            *(nint*)(block + BlockTlsValuesOffset) = 0;
-        }
-    }
-
-    /// <summary>
-    /// Publishes <paramref name="guestThreadHandle"/> (and its pthread TLS
-    /// table) as the guest thread bound to the calling host thread. Pass 0 to
-    /// unbind, which leaves pthread_self on the managed gateway and falls the
-    /// value table back to the host thread's own pthread storage.
-    /// </summary>
-    public static void BindGuestThread(ulong guestThreadHandle)
-    {
-        if (!_enabled)
-        {
-            return;
-        }
-
-        var block = EnsureBlock();
-        if (block == 0)
-        {
-            return;
-        }
-
-        // Clear the self handle first so a stub can never answer with a handle
-        // that no longer owns this host thread.
-        *(ulong*)(block + BlockSelfHandleOffset) = 0;
-        var tlsHandle = guestThreadHandle != 0 ? guestThreadHandle : _hostThreadHandle;
-        *(nint*)(block + BlockTlsValuesOffset) = tlsHandle == 0 ? 0 : GetOrCreateTable(tlsHandle);
-        *(ulong*)(block + BlockSelfHandleOffset) = guestThreadHandle;
-    }
-
-    /// <summary>
-    /// Records the calling host thread's own pthread handle - the one
-    /// KernelPthreadState reports when no guest thread is bound - so
-    /// pthread_getspecific can be answered on threads the guest scheduler does
-    /// not own (the primary execution thread among them).
-    /// </summary>
-    public static void BindHostThread(ulong hostThreadHandle)
-    {
-        if (!_enabled || hostThreadHandle == 0)
-        {
-            return;
-        }
-
-        _hostThreadHandle = hostThreadHandle;
-        var block = EnsureBlock();
-        if (block == 0 || *(ulong*)(block + BlockSelfHandleOffset) != 0)
-        {
-            // A bound guest thread owns the value table while it runs.
-            return;
-        }
-
-        *(nint*)(block + BlockTlsValuesOffset) = GetOrCreateTable(hostThreadHandle);
-    }
-
-    /// <summary>
-    /// Drops every fast-path binding for the calling host thread, so each stub
-    /// falls back to the managed gateway until the thread is bound again.
-    /// </summary>
-    public static void UnbindCurrentThread()
-    {
-        _hostThreadHandle = 0;
-        var block = _block;
-        if (block != 0)
-        {
-            *(ulong*)(block + BlockSelfHandleOffset) = 0;
-            *(nint*)(block + BlockTlsValuesOffset) = 0;
-        }
-    }
-
-    /// <summary>Fast-path hit counts summed over every host thread, for diagnostics.</summary>
-    public static (long SelfHits, long GetspecificHits, int Blocks) SnapshotCounters()
-    {
-        long selfHits = 0;
-        long getspecificHits = 0;
-        int blocks;
-        lock (BlocksGate)
-        {
-            blocks = Blocks.Count;
-            foreach (var block in Blocks)
-            {
-                selfHits += *(long*)(block + BlockSelfHitsOffset);
-                getspecificHits += *(long*)(block + BlockGetspecificHitsOffset);
-            }
-        }
-
-        return (selfHits, getspecificHits, blocks);
-    }
-
-    /// <summary>Address of the calling host thread's block; allocates it on first use.</summary>
-    public static nint EnsureBlock()
-    {
-        var block = _block;
-        if (block != 0)
-        {
-            return block;
-        }
-
-        block = (nint)NativeMemory.AllocZeroed(BlockSize);
-        _block = block;
-        lock (BlocksGate)
-        {
-            Blocks.Add(block);
-        }
-
-        _publishBlock?.Invoke(block);
-        return block;
-    }
-
-    /// <summary>The pthread-specific value table for a guest (or host) thread handle.</summary>
-    public static nint GetOrCreateTable(ulong threadHandle)
-    {
-        if (threadHandle == 0)
-        {
-            return 0;
-        }
-
-        if (_cachedTableHandle == threadHandle && _cachedTable != 0)
-        {
-            return _cachedTable;
-        }
-
-        var table = TlsTables.GetOrAdd(
-            threadHandle,
-            static _ => (nint)NativeMemory.AllocZeroed((nuint)TlsSlotCount, sizeof(ulong)));
-        _cachedTableHandle = threadHandle;
-        _cachedTable = table;
-        return table;
-    }
-
-    /// <summary>pthread_getspecific, for the managed (slow) path and for keys the table cannot hold.</summary>
-    public static ulong GetSpecific(ulong threadHandle, int key)
-    {
-        if (threadHandle == 0 || key < 0)
-        {
-            return 0;
-        }
-
-        if ((uint)key < TlsSlotCount)
-        {
-            return TlsTables.TryGetValue(threadHandle, out var table) && table != 0
-                ? ((ulong*)table)[key]
-                : 0;
-        }
-
-        return TlsOverflow.TryGetValue(threadHandle, out var overflow) && overflow.TryGetValue(key, out var value)
-            ? value
-            : 0;
-    }
-
-    /// <summary>pthread_setspecific. Writes the same storage the native stubs read.</summary>
-    public static void SetSpecific(ulong threadHandle, int key, ulong value)
-    {
-        if (threadHandle == 0 || key < 0)
-        {
-            return;
-        }
-
-        if ((uint)key < TlsSlotCount)
-        {
-            ((ulong*)GetOrCreateTable(threadHandle))[key] = value;
-            return;
-        }
-
-        TlsOverflow
-            .GetOrAdd(threadHandle, static _ => new ConcurrentDictionary<int, ulong>())[key] = value;
-    }
-
-    /// <summary>
-    /// Compare-and-set used by the destructor loop: clears <paramref name="key"/>
-    /// only when it still holds <paramref name="expected"/>, so a destructor that
-    /// re-sets the key is handled on the next iteration instead of being lost.
-    /// </summary>
-    public static bool TryClearSpecific(ulong threadHandle, int key, ulong expected)
-    {
-        if (threadHandle == 0 || key < 0)
-        {
-            return false;
-        }
-
-        if ((uint)key < TlsSlotCount)
-        {
-            if (!TlsTables.TryGetValue(threadHandle, out var table) || table == 0)
-            {
-                return false;
-            }
-
-            return Interlocked.CompareExchange(ref ((ulong*)table)[key], 0, expected) == expected;
-        }
-
-        return TlsOverflow.TryGetValue(threadHandle, out var overflow) &&
-            overflow.TryUpdate(key, 0, expected);
-    }
-
-    /// <summary>pthread_key_delete: the key reads back as unset on every thread.</summary>
-    public static void ClearKeyEverywhere(int key)
-    {
-        if (key < 0)
-        {
-            return;
-        }
-
-        if ((uint)key < TlsSlotCount)
-        {
-            foreach (var table in TlsTables.Values)
-            {
-                if (table != 0)
-                {
-                    ((ulong*)table)[key] = 0;
-                }
-            }
-
-            return;
-        }
-
-        foreach (var overflow in TlsOverflow.Values)
-        {
-            overflow.TryRemove(key, out _);
-        }
-    }
-
-    /// <summary>Every non-zero (key, value) pair a thread currently holds, for the destructor loop.</summary>
-    public static List<KeyValuePair<int, ulong>> SnapshotThreadValues(ulong threadHandle)
-    {
-        var result = new List<KeyValuePair<int, ulong>>();
-        if (threadHandle == 0)
-        {
-            return result;
-        }
-
-        if (TlsTables.TryGetValue(threadHandle, out var table) && table != 0)
-        {
-            var values = (ulong*)table;
-            for (var key = 0; key < TlsSlotCount; key++)
-            {
-                if (values[key] != 0)
-                {
-                    result.Add(new KeyValuePair<int, ulong>(key, values[key]));
-                }
-            }
-        }
-
-        if (TlsOverflow.TryGetValue(threadHandle, out var overflow))
-        {
-            foreach (var entry in overflow)
-            {
-                if (entry.Value != 0)
-                {
-                    result.Add(entry);
-                }
-            }
-        }
-
-        return result;
-    }
-
-    /// <summary>True when the thread has ever stored a pthread-specific value.</summary>
-    public static bool HasThreadValues(ulong threadHandle) =>
-        threadHandle != 0 &&
-        (TlsTables.ContainsKey(threadHandle) || TlsOverflow.ContainsKey(threadHandle));
-
-    /// <summary>
-    /// Drops a thread's pthread-specific storage on thread exit. Called from
-    /// the exiting thread after its destructors have run, so no stub can still
-    /// be reading the table; the calling thread's block is disarmed first.
-    /// </summary>
-    public static void ReleaseThread(ulong threadHandle)
-    {
-        if (threadHandle == 0)
-        {
-            return;
-        }
-
-        var block = _block;
-        if (block != 0 && *(ulong*)(block + BlockSelfHandleOffset) == threadHandle)
-        {
-            *(ulong*)(block + BlockSelfHandleOffset) = 0;
-            *(nint*)(block + BlockTlsValuesOffset) = 0;
-        }
-        else if (block != 0 && _hostThreadHandle == threadHandle)
-        {
-            *(nint*)(block + BlockTlsValuesOffset) = 0;
-        }
-
-        if (_cachedTableHandle == threadHandle)
-        {
-            _cachedTableHandle = 0;
-            _cachedTable = 0;
-        }
-
-        TlsOverflow.TryRemove(threadHandle, out _);
-        if (TlsTables.TryRemove(threadHandle, out var table) && table != 0)
-        {
-            NativeMemory.Free((void*)table);
-        }
-    }
-}

src/SharpEmu.HLE/GuestMemory/GuestSpaceOwner.cs

@@ -64,23 +64,10 @@ public sealed class GuestSpaceOwner : IDisposable
 
     public bool TryReadBacking(ulong address, Span<byte> data) => _views.TryReadBacking(address, data);
 
-    // Reads through a view that covers the whole range without any lock; false otherwise.
-    public bool TryReadSingleView(ulong address, Span<byte> data) => _views.TryReadSingleView(address, data);
-
-    public object AliasSnapshot => _views.AliasSnapshot;
-
-    public bool TryEnterAliasAccess() => _views.TryEnterAliasAccess();
-
-    public void ExitAliasAccess() => _views.ExitAliasAccess();
-
-    public bool TryResolveAlias(ulong address, ulong size, out ulong alias) => _views.TryResolveAlias(address, size, out alias);
-
     public bool TryCopyBacking(ulong destination, ulong source, ulong size) => _views.TryCopyBacking(destination, source, size);
 
     public bool IsBacked(ulong address, ulong size) => _views.Contains(address, size);
 
-    public bool IsBackedWithoutLock(ulong address, ulong size) => _views.ContainsWithoutLock(address, size);
-
     public bool IsRestoredView(ulong address) => _views.IsRestoredView(address);
 
     public bool TryReserveAddressRange(ulong address, ulong size)

src/SharpEmu.HLE/GuestMemory/SharedBackingViews.cs

@@ -21,15 +21,6 @@ public sealed unsafe class SharedBackingViews : IDisposable
     private readonly SortedList<ulong, ViewRecord> _views = new();
     private bool _disposed;
 
-    // Guest command writes and their reads by the render thread reach TryWriteBacking and
-    // TryReadBacking millions of times per second, a few bytes at a time, while views
-    // change rarely. Single-view accesses search this immutable copy of _views without
-    // the lock; every change to _views republishes it under the lock.
-    private ViewRecord[] _snapshot = [];
-
-    // Single-view accesses in flight; Dispose waits for them before releasing the alias.
-    private int _activeAccesses;
-
     public SharedBackingViews(IHostViewMemory host, ulong size)
     {
         _host = host;
@@ -58,19 +49,6 @@ public sealed unsafe class SharedBackingViews : IDisposable
 
     public bool TryWriteBacking(ulong address, ReadOnlySpan<byte> data)
     {
-        if (TryAccessSingleView(address, (ulong)data.Length, out var target))
-        {
-            try
-            {
-                data.CopyTo(new Span<byte>((void*)target, data.Length));
-                return true;
-            }
-            finally
-            {
-                Interlocked.Decrement(ref _activeAccesses);
-            }
-        }
-
         lock (_lock)
         {
             if (IsAvailable && TryFindRecord(address, (ulong)data.Length, out var record))
@@ -99,40 +77,8 @@ public sealed unsafe class SharedBackingViews : IDisposable
         }
     }
 
-    // The lock-free single-view read only; false (with nothing read) for anything else.
-    public bool TryReadSingleView(ulong address, Span<byte> data)
-    {
-        if (!TryAccessSingleView(address, (ulong)data.Length, out var source))
-        {
-            return false;
-        }
-
-        try
-        {
-            new ReadOnlySpan<byte>((void*)source, data.Length).CopyTo(data);
-            return true;
-        }
-        finally
-        {
-            Interlocked.Decrement(ref _activeAccesses);
-        }
-    }
-
     public bool TryReadBacking(ulong address, Span<byte> data)
     {
-        if (TryAccessSingleView(address, (ulong)data.Length, out var source))
-        {
-            try
-            {
-                new ReadOnlySpan<byte>((void*)source, data.Length).CopyTo(data);
-                return true;
-            }
-            finally
-            {
-                Interlocked.Decrement(ref _activeAccesses);
-            }
-        }
-
         lock (_lock)
         {
             // A read inside one mapping needs no temporary segment list.
@@ -248,7 +194,6 @@ public sealed unsafe class SharedBackingViews : IDisposable
             }
 
             _views[address] = new ViewRecord(address, size, offset, protection) { WasRestored = wasRestored };
-            PublishSnapshot();
         }
 
         failure = HostViewFailure.None;
@@ -323,7 +268,6 @@ public sealed unsafe class SharedBackingViews : IDisposable
                 {
                     old = record;
                     _views.RemoveAt(index);
-                    PublishSnapshot();
                 }
             }
         }
@@ -402,49 +346,6 @@ public sealed unsafe class SharedBackingViews : IDisposable
         }
     }
 
-    // Contains over the published snapshot, without the lock: descriptor validation asks
-    // this for every bound buffer, and the lock is contended by guest threads. A true answer
-    // is as current as a locked one would be once the lock were released.
-    public bool ContainsWithoutLock(ulong address, ulong size)
-    {
-        if (size == 0 || ulong.MaxValue - address < size || Volatile.Read(ref _disposed))
-        {
-            return false;
-        }
-
-        var snapshot = Volatile.Read(ref _snapshot);
-        var end = address + size;
-        var current = address;
-        while (current < end)
-        {
-            var low = 0;
-            var high = snapshot.Length - 1;
-            var found = -1;
-            while (low <= high)
-            {
-                var middle = low + ((high - low) >> 1);
-                if (snapshot[middle].Address <= current)
-                {
-                    found = middle;
-                    low = middle + 1;
-                }
-                else
-                {
-                    high = middle - 1;
-                }
-            }
-
-            if (found < 0 || current >= snapshot[found].Address + snapshot[found].Size)
-            {
-                return false;
-            }
-
-            current = Math.Min(end, snapshot[found].Address + snapshot[found].Size);
-        }
-
-        return true;
-    }
-
     public bool Contains(ulong address, ulong size)
     {
         if (size == 0 || ulong.MaxValue - address < size)
@@ -484,15 +385,6 @@ public sealed unsafe class SharedBackingViews : IDisposable
             _disposed = true;
             views = new List<ViewRecord>(_views.Values);
             _views.Clear();
-            PublishSnapshot();
-        }
-
-        // A lock-free access that found a view before the snapshot emptied still copies
-        // through the alias; let it finish before the alias is released.
-        var spin = new SpinWait();
-        while (Volatile.Read(ref _activeAccesses) != 0)
-        {
-            spin.SpinOnce();
         }
 
         foreach (var view in views)
@@ -603,94 +495,6 @@ public sealed unsafe class SharedBackingViews : IDisposable
         return true;
     }
 
-    // Must be called under _lock after every change to _views.
-    private void PublishSnapshot()
-    {
-        var snapshot = new ViewRecord[_views.Count];
-        _views.Values.CopyTo(snapshot, 0);
-        Volatile.Write(ref _snapshot, snapshot);
-    }
-
-    // Resolves an access that lies inside one view to its alias address and registers
-    // it as in flight; the caller must decrement _activeAccesses when done. Anything
-    // else (spanning views, unmapped, disposed) is left to the locked path.
-    private bool TryAccessSingleView(ulong address, ulong size, out ulong target)
-    {
-        target = 0;
-        if (size == 0 || ulong.MaxValue - address < size)
-        {
-            return false;
-        }
-
-        Interlocked.Increment(ref _activeAccesses);
-        if (TryFindAlias(Volatile.Read(ref _snapshot), address, size, out target))
-        {
-            return true;
-        }
-
-        Interlocked.Decrement(ref _activeAccesses);
-        return false;
-    }
-
-    public object AliasSnapshot => Volatile.Read(ref _snapshot);
-
-    public bool TryEnterAliasAccess()
-    {
-        Interlocked.Increment(ref _activeAccesses);
-        if (!Volatile.Read(ref _disposed) && _backing != null)
-        {
-            return true;
-        }
-
-        Interlocked.Decrement(ref _activeAccesses);
-        return false;
-    }
-
-    public void ExitAliasAccess() => Interlocked.Decrement(ref _activeAccesses);
-
-    public bool TryResolveAlias(ulong address, ulong size, out ulong target)
-    {
-        target = 0;
-        return size != 0 && ulong.MaxValue - address >= size && TryFindAlias(Volatile.Read(ref _snapshot), address, size, out target);
-    }
-
-    private bool TryFindAlias(ViewRecord[] snapshot, ulong address, ulong size, out ulong target)
-    {
-        target = 0;
-        var low = 0;
-        var high = snapshot.Length - 1;
-        var found = -1;
-        while (low <= high)
-        {
-            var middle = low + ((high - low) >> 1);
-            if (snapshot[middle].Address <= address)
-            {
-                found = middle;
-                low = middle + 1;
-            }
-            else
-            {
-                high = middle - 1;
-            }
-        }
-
-        if (found >= 0 && !Volatile.Read(ref _disposed) && _backing != null)
-        {
-            var record = snapshot[found];
-            if (address + size <= record.Address + record.Size)
-            {
-                var offset = record.Offset + address - record.Address;
-                if (IsWithinBacking(offset, size))
-                {
-                    target = AliasBase + offset;
-                    return true;
-                }
-            }
-        }
-
-        return false;
-    }
-
     private bool IsWithinBacking(ulong offset, ulong size) =>
         size != 0 && offset < Size && size <= Size - offset;
 
@@ -699,7 +503,6 @@ public sealed unsafe class SharedBackingViews : IDisposable
         lock (_lock)
         {
             _views[record.Address] = record;
-            PublishSnapshot();
         }
     }
 

src/SharpEmu.HLE/GuestThreadExecution.cs

@@ -50,21 +50,6 @@ public interface IGuestThreadScheduler
     /// </summary>
     void RegisterGuestThreadContext(ulong threadHandle, CpuContext context);
 
-    /// <summary>
-    /// Returns the exact mapped guest stack owned by a scheduler thread. The
-    /// default keeps alternate/test schedulers source-compatible when they do
-    /// not own guest stack mappings.
-    /// </summary>
-    bool TryGetGuestThreadStackBounds(
-        ulong threadHandle,
-        out ulong stackBase,
-        out ulong stackSize)
-    {
-        stackBase = 0;
-        stackSize = 0;
-        return false;
-    }
-
     bool TryStartThread(CpuContext creatorContext, GuestThreadStartRequest request, out string? error);
 
     bool TryJoinThread(
@@ -294,7 +279,6 @@ public static class GuestThreadExecution
         GpuMemory.GpuMemoryAccessProfile.InitializeCurrentThread();
         var previous = _currentGuestThreadHandle;
         _currentGuestThreadHandle = threadHandle;
-        GuestFastPath.BindGuestThread(threadHandle);
         _pendingBlockReason = null;
         _pendingBlockContinuationValid = false;
         _pendingBlockContinuation = default;
@@ -316,7 +300,6 @@ public static class GuestThreadExecution
     public static void RestoreGuestThread(ulong previousThreadHandle)
     {
         _currentGuestThreadHandle = previousThreadHandle;
-        GuestFastPath.BindGuestThread(previousThreadHandle);
         _pendingBlockReason = null;
         _pendingBlockContinuationValid = false;
         _pendingBlockContinuation = default;

src/SharpEmu.HLE/HleDataSymbols.cs

@@ -21,7 +21,6 @@ public static class HleDataSymbols
     private static readonly nint _stackChkGuardAddress = Allocate(sizeof(ulong) * 2);
     private static readonly nint _progNameBufferAddress = Allocate(ProgNameMaxBytes + 1);
     private static readonly nint _progNamePointerAddress = Allocate(nint.Size);
-    private static readonly nint _argumentVectorAddress = Allocate(nint.Size * 2);
     private static readonly nint _libcNeedFlagAddress = Allocate(sizeof(uint));
     private static readonly nint _libcInternalNeedFlagAddress = Allocate(sizeof(uint));
 
@@ -56,12 +55,6 @@ public static class HleDataSymbols
         yield return LibcInternalNeedFlagNid;
     }
 
-    public static int ProcessArgumentCount =>
-        _progNameBufferAddress != 0 && _argumentVectorAddress != 0 ? 1 : 0;
-
-    public static ulong ProcessArgumentVectorAddress =>
-        unchecked((ulong)_argumentVectorAddress);
-
     public static void ConfigureProcessImageName(string? processImageName)
     {
         var effectiveName = string.IsNullOrWhiteSpace(processImageName)
@@ -72,9 +65,7 @@ public static class HleDataSymbols
 
         lock (_gate)
         {
-            if (_progNameBufferAddress == 0 ||
-                _progNamePointerAddress == 0 ||
-                _argumentVectorAddress == 0)
+            if (_progNameBufferAddress == 0 || _progNamePointerAddress == 0)
             {
                 return;
             }
@@ -86,8 +77,6 @@ public static class HleDataSymbols
 
             Marshal.Copy(encodedName, 0, _progNameBufferAddress, byteCount);
             WritePointer(_progNamePointerAddress, _progNameBufferAddress);
-            WritePointer(_argumentVectorAddress, _progNameBufferAddress);
-            WritePointer(IntPtr.Add(_argumentVectorAddress, nint.Size), 0);
         }
     }
 

src/SharpEmu.HLE/Host/HostLaneReservation.cs

@@ -1,121 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Runtime.InteropServices;
-
-namespace SharpEmu.HLE.Host;
-
-public static unsafe class HostLaneReservation
-{
-    private const int RelationProcessorCore = 0;
-    private const int ThreadPriorityHighest = 2;
-
-    public static readonly ulong ReservedMask;
-    public static readonly ulong GuestMask;
-
-    static HostLaneReservation()
-    {
-        if (!OperatingSystem.IsWindows() || Environment.GetEnvironmentVariable("SHARPEMU_RENDER_CORE") == "0")
-        {
-            return;
-        }
-
-        var lanes = Environment.ProcessorCount;
-        if (lanes < 8 || lanes > 64)
-        {
-            return;
-        }
-
-        var core = SelectCore();
-        var all = lanes == 64 ? ulong.MaxValue : (1UL << lanes) - 1;
-        if (core == 0 || (core & ~all) != 0 || (all & ~core) == 0)
-        {
-            return;
-        }
-
-        ReservedMask = core;
-        GuestMask = all & ~core;
-    }
-
-    public static bool Active => ReservedMask != 0;
-
-    public static void ApplyToRenderThread()
-    {
-        if (!Active)
-        {
-            return;
-        }
-
-        var thread = GetCurrentThread();
-        _ = SetThreadAffinityMask(thread, (nuint)ReservedMask);
-        _ = SetThreadPriority(thread, ThreadPriorityHighest);
-        Console.Error.WriteLine($"[LOADER][INFO] Render thread reserved host lanes 0x{ReservedMask:X}; guest threads use 0x{GuestMask:X}.");
-    }
-
-    public static void ApplyToGuestThread()
-    {
-        if (Active)
-        {
-            _ = SetThreadAffinityMask(GetCurrentThread(), (nuint)GuestMask);
-        }
-    }
-
-    private static ulong SelectCore()
-    {
-        uint length = 0;
-        _ = GetLogicalProcessorInformationEx(RelationProcessorCore, null, &length);
-        if (length == 0)
-        {
-            return 0;
-        }
-
-        var buffer = new byte[length];
-        fixed (byte* start = buffer)
-        {
-            if (!GetLogicalProcessorInformationEx(RelationProcessorCore, start, &length))
-            {
-                return 0;
-            }
-
-            ulong selected = 0;
-            var selectedClass = -1;
-            for (uint offset = 0; offset + 48 <= length;)
-            {
-                var entry = start + offset;
-                var size = *(uint*)(entry + 4);
-                if (size == 0)
-                {
-                    break;
-                }
-
-                var efficiencyClass = entry[9];
-                var groupCount = *(ushort*)(entry + 30);
-                var mask = *(ulong*)(entry + 32);
-                var group = *(ushort*)(entry + 40);
-                if (*(int*)entry == RelationProcessorCore && groupCount == 1 && group == 0 && mask != 0 && efficiencyClass >= selectedClass)
-                {
-                    selected = mask;
-                    selectedClass = efficiencyClass;
-                }
-
-                offset += size;
-            }
-
-            return selected;
-        }
-    }
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool GetLogicalProcessorInformationEx(int relationshipType, byte* buffer, uint* returnedLength);
-
-    [DllImport("kernel32.dll")]
-    private static extern nint GetCurrentThread();
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    private static extern nuint SetThreadAffinityMask(nint thread, nuint mask);
-
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool SetThreadPriority(nint thread, int priority);
-}

src/SharpEmu.HLE/Host/Sdl/SdlHostAudio.cs

@@ -212,15 +212,7 @@ internal sealed unsafe class SdlHostAudio : IHostPcmAudioOutput
                         break;
                     }
 
-                    // Sleep until the device should have drained to the cap rather than polling every
-                    // millisecond: this wait paces every audio grain, and 1 ms polls cost the audio
-                    // thread several wakeups per grain.
-                    var bytesPerMillisecond = _bytesPerFrame * (double)_sampleRate / 1_000;
-                    var drainMilliseconds = bytesPerMillisecond > 0
-                        ? (queued - _maximumQueuedBytes) / bytesPerMillisecond
-                        : 1;
-                    var remainingMilliseconds = (deadline - Stopwatch.GetTimestamp()) * 1_000.0 / Stopwatch.Frequency;
-                    Thread.Sleep((int)Math.Clamp(Math.Ceiling(Math.Min(drainMilliseconds, remainingMilliseconds)), 1, MaximumWaitMilliseconds));
+                    Thread.Sleep(1);
                 }
 
                 RecordSubmission(queued, blockStart, dropped: overrun, bytes: pcm.Length);

src/SharpEmu.HLE/ICpuMemory.cs

@@ -23,16 +23,6 @@ public interface ICpuMemory
 
     bool TryCopy(ulong destinationAddress, ulong sourceAddress, ulong length) => false;
 
-    // Finds the first (or last) byte equal to needle in the NUL-terminated string
-    // at address, the terminator included, scanning mapped memory in place.
-    // match is 0 when absent. False means this memory cannot scan directly and
-    // the caller should read the string through TryRead instead.
-    bool TryScanCString(ulong address, byte needle, bool findLast, ulong maxLength, out ulong match)
-    {
-        match = 0;
-        return false;
-    }
-
     // True when the whole range is mapped guest memory; no bytes are copied.
     bool CanRead(ulong address, ulong size) => false;
 

src/SharpEmu.HLE/IGuestBackedSpace.cs

@@ -24,18 +24,4 @@ public interface IGuestBackedSpace
     // Copies through the backing alias only: no protection change, no store notification.
     bool TryWriteBacking(ulong address, ReadOnlySpan<byte> data);
     bool TryReadBacking(ulong address, Span<byte> data);
-
-    object? BackingAliasSnapshot => null;
-
-    bool TryEnterBackingAliasAccess() => false;
-
-    void ExitBackingAliasAccess()
-    {
-    }
-
-    bool TryResolveBackingAlias(ulong address, ulong size, out ulong alias)
-    {
-        alias = 0;
-        return false;
-    }
 }

src/SharpEmu.LibAtrac9/Atrac9Config.cs

@@ -21,7 +21,6 @@ namespace LibAtrac9
         public int SampleRateIndex { get; }
         /// <summary>
         /// A 3-bit value specifying one of 6 substream channel mappings.
-        /// Always 0 for streams with independent mono channels.
         /// </summary>
         public int ChannelConfigIndex { get; }
         /// <summary>
@@ -71,12 +70,6 @@ namespace LibAtrac9
         /// The number of samples in one superframe.
         /// </summary>
         public int SuperframeSamples { get; }
-        /// <summary>
-        /// Non-zero for streams whose config header is 0x30: every channel is
-        /// an independent mono stream with this many bytes per superframe,
-        /// and the channels are interleaved frame by frame.
-        /// </summary>
-        public int IndependentBlockSuperframeBytes { get; }
 
         /// <summary>
         /// Reads ATRAC9 configuration data and calculates the stream parameters from it.
@@ -89,33 +82,16 @@ namespace LibAtrac9
                 throw new InvalidDataException("Config data must be 4 bytes long");
             }
 
-            ReadConfigData(configData, out int a, out int b, out int c, out int d, out int independentChannels);
+            ReadConfigData(configData, out int a, out int b, out int c, out int d);
             SampleRateIndex = a;
             ChannelConfigIndex = b;
+            FrameBytes = c;
             SuperframeIndex = d;
             ConfigData = configData;
 
-            if (independentChannels > 0)
-            {
-                // The frame size field holds one channel's share; the frame as
-                // a whole carries one mono block per channel.
-                ChannelConfig = ChannelConfig.CreateIndependentMono(independentChannels);
-                IndependentBlockSuperframeBytes = c << SuperframeIndex;
-                FrameBytes = c * independentChannels;
-            }
-            else
-            {
-                if (ChannelConfigIndex >= Tables.ChannelConfig.Length)
-                {
-                    throw new InvalidDataException("ATRAC9 Config Data is invalid");
-                }
-
-                ChannelConfig = Tables.ChannelConfig[ChannelConfigIndex];
-                FrameBytes = c;
-            }
-
             FramesPerSuperframe = 1 << SuperframeIndex;
             SuperframeBytes = FrameBytes << SuperframeIndex;
+            ChannelConfig = Tables.ChannelConfig[ChannelConfigIndex];
 
             ChannelCount = ChannelConfig.ChannelCount;
             SampleRate = Tables.SampleRates[SampleRateIndex];
@@ -125,36 +101,21 @@ namespace LibAtrac9
             SuperframeSamples = FrameSamples * FramesPerSuperframe;
         }
 
-        private static void ReadConfigData(byte[] configData, out int sampleRateIndex, out int channelConfigIndex, out int frameBytes, out int superframeIndex, out int independentChannels)
+        private static void ReadConfigData(byte[] configData, out int sampleRateIndex, out int channelConfigIndex, out int frameBytes, out int superframeIndex)
         {
             var reader = new BitReader(configData);
 
             int header = reader.ReadInt(8);
             sampleRateIndex = reader.ReadInt(4);
-            channelConfigIndex = 0;
-            independentChannels = 0;
-            if (header == IndependentMonoHeader)
-            {
-                // PS5 multichannel streams (ambisonics: 4, 9 or 16 channels)
-                // replace the 3-bit channel mapping with a 6-bit channel count.
-                independentChannels = reader.ReadInt(6) + 1;
-            }
-            else
-            {
-                channelConfigIndex = reader.ReadInt(3);
-            }
-
+            channelConfigIndex = reader.ReadInt(3);
             int validationBit = reader.ReadInt(1);
             frameBytes = reader.ReadInt(11) + 1;
             superframeIndex = reader.ReadInt(2);
 
-            if ((header != StandardHeader && header != IndependentMonoHeader) || validationBit != 0)
+            if (header != 0xFE || validationBit != 0)
             {
                 throw new InvalidDataException("ATRAC9 Config Data is invalid");
             }
         }
-
-        private const int StandardHeader = 0xFE;
-        private const int IndependentMonoHeader = 0x30;
     }
 }

src/SharpEmu.LibAtrac9/Block.cs

@@ -14,7 +14,6 @@ namespace LibAtrac9
 
         public bool FirstInSuperframe { get; set; }
         public bool ReuseBandParams { get; set; }
-        public int SuperframeBytesUsed { get; set; }
 
         public int BandCount { get; set; }
         public int StereoBand { get; set; }

src/SharpEmu.LibAtrac9/ChannelConfig.cs

@@ -1,7 +1,5 @@
 // SPDX-License-Identifier: MIT
 #nullable disable
-using System;
-
 namespace LibAtrac9
 {
     /// <summary>
@@ -19,13 +17,6 @@ namespace LibAtrac9
             }
         }
 
-        internal static ChannelConfig CreateIndependentMono(int channelCount)
-        {
-            var blockTypes = new BlockType[channelCount];
-            Array.Fill(blockTypes, BlockType.Mono);
-            return new ChannelConfig(blockTypes);
-        }
-
         /// <summary>
         /// The number of blocks or substreams in the ATRAC9 stream
         /// </summary>

src/SharpEmu.LibAtrac9/Unpack.cs

@@ -10,57 +10,12 @@ namespace LibAtrac9
     {
         public static void UnpackFrame(BitReader reader, Frame frame)
         {
-            if (frame.Config.IndependentBlockSuperframeBytes != 0)
-            {
-                UnpackIndependentMonoFrame(reader, frame);
-                return;
-            }
-
             foreach (Block block in frame.Blocks)
             {
                 UnpackBlock(reader, block);
             }
         }
 
-        // Each channel is a standalone mono superframe with a fixed byte budget,
-        // interleaved frame by frame. Blocks of the earlier frames are packed
-        // back to back; in the last frame every block gets whatever is left of
-        // its channel's budget, so those slots end in padding.
-        private static void UnpackIndependentMonoFrame(BitReader reader, Frame frame)
-        {
-            int budget = frame.Config.IndependentBlockSuperframeBytes;
-            bool lastFrame = frame.FrameIndex == frame.Config.FramesPerSuperframe - 1;
-            int slotStart = reader.Position / 8;
-
-            foreach (Block block in frame.Blocks)
-            {
-                if (frame.FrameIndex == 0)
-                {
-                    block.SuperframeBytesUsed = 0;
-                }
-
-                int usedBefore = block.SuperframeBytesUsed;
-                if (lastFrame)
-                {
-                    reader.Position = slotStart * 8;
-                }
-
-                int start = reader.Position;
-                UnpackBlock(reader, block);
-                block.SuperframeBytesUsed += (reader.Position - start) / 8;
-                if (block.SuperframeBytesUsed > budget)
-                {
-                    throw new InvalidDataException();
-                }
-
-                if (lastFrame)
-                {
-                    slotStart += budget - usedBefore;
-                    reader.Position = slotStart * 8;
-                }
-            }
-        }
-
         private static void UnpackBlock(BitReader reader, Block block)
         {
             ReadBlockHeader(reader, block);

src/SharpEmu.Libs/Agc/AgcExports.CommandPackets.cs

@@ -546,11 +546,8 @@ public static partial class AgcExports
 
         var increment = (uint)(incrementRaw & 0xFF);
         var writeConfirm = (uint)(writeConfirmRaw & 0xFF);
-        // A zero destination is legal: titles emit the packet into a template
-        // and set the address later with sceAgcWriteDataPatchSetAddressOrOffset.
-        // Rejecting it returned null, and patching that relocated null pointer
-        // wrote garbage into the label the packet was meant to clear.
         if (commandBufferAddress == 0 ||
+            destinationAddress == 0 ||
             dataAddress == 0 ||
             dwordCount > 0x3FFD)
         {

src/SharpEmu.Libs/Agc/AgcExports.DrawPackets.cs

@@ -184,6 +184,24 @@ public static partial class AgcExports
         var commandBufferAddress = ctx[CpuRegister.Rdi];
         var dataOffset = (uint)ctx[CpuRegister.Rsi];
         var drawModifier = ctx[CpuRegister.Rdx];
+        var emit = Interlocked.Increment(ref _indirectDrawEmitCount);
+
+        if (emit <= 12 || emit % 250 == 0)
+        {
+            var rcx = ctx[CpuRegister.Rcx];
+            var dump = string.Empty;
+            for (var word = 0; word < 8; word++)
+            {
+                dump += TryReadUInt32(ctx, rcx + dataOffset + ((ulong)word * 4), out var raw)
+                    ? $" {raw}"
+                    : " ?";
+            }
+
+            Console.Error.WriteLine(
+                $"[LOADER][WARN] agc.emit_indirect#{emit} buf=0x{commandBufferAddress:X16} " +
+                $"off=0x{dataOffset:X} rdx=0x{ctx[CpuRegister.Rdx]:X} rcx=0x{rcx:X} " +
+                $"r8=0x{ctx[CpuRegister.R8]:X} rcx_words:{dump}");
+        }
 
         if (commandBufferAddress == 0)
         {
@@ -224,7 +242,7 @@ public static partial class AgcExports
 
         TraceAgc(
             $"agc.dcb_draw_indirect buf=0x{commandBufferAddress:X16} " +
-            $"draw=0x{drawCommand:X16} offset=0x{dataOffset:X} modifier=0x{drawModifier:X}");
+            $"draw=0x{drawCommand:X16} offset=0x{dataOffset:X}");
 
         return ReturnPointer(ctx, drawCommand);
     }
@@ -456,5 +474,6 @@ public static partial class AgcExports
     }
     #pragma warning restore SHEM006
 
+    private static long _indirectDrawEmitCount;
     private static long _indirectDrawEmitRejectCount;
 }

src/SharpEmu.Libs/Agc/AgcExports.PacketPatching.cs

@@ -10,36 +10,6 @@ public static partial class AgcExports
 {
     // This partial patches previously constructed AGC command packets.
 
-    // Uncatalogued name; the NID and import library identify this AGC export.
-    // Observed ABI: packet, cache policy, next-buffer address, length in dwords.
-    // The caller patches the previous DcbJump after allocating its continuation.
-    #pragma warning disable SHEM006
-    [SysAbiExport(Nid = "Ikfdt-rIqCE", ExportName = "sceAgcUnknownIkfdt",
-        Target = Generation.Gen5, LibraryName = "libSceAgc")]
-    public static int UnknownIkfdt(CpuContext ctx)
-    {
-        var packet = ctx[CpuRegister.Rdi];
-        var cachePolicy = (uint)ctx[CpuRegister.Rsi];
-        var target = ctx[CpuRegister.Rdx];
-        var dwords = (uint)ctx[CpuRegister.Rcx];
-        if (cachePolicy > 3 || dwords > 0xFFFFFu ||
-            !TryGetPacketIdentity(ctx, packet, out var opcode, out _) ||
-            opcode != ItIndirectBuffer ||
-            !TryReadUInt32(ctx, packet, out var header) ||
-            ((header >> 16) & 0x3FFFu) != 2 ||
-            !TryReadUInt32(ctx, packet + 12, out var control))
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
-
-        // Preserve call/chain mode and every other control bit.
-        control = (control & ~0x300F_FFFFu) | (cachePolicy << 28) | dwords;
-        return TryWriteUInt32(ctx, packet + 4, (uint)target) &&
-               TryWriteUInt32(ctx, packet + 8, (uint)(target >> 32) & 0xFFFFu) &&
-               TryWriteUInt32(ctx, packet + 12, control)
-            ? SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK)
-            : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-    }
-    #pragma warning restore SHEM006
-
     [SysAbiExport(
         Nid = "vcmNN+AAXnY",
         ExportName = "sceAgcSetCxRegIndirectPatchSetAddress",

src/SharpEmu.Libs/Agc/AgcExports.ShaderHeaders.cs

@@ -10,8 +10,13 @@ public static partial class AgcExports
 {
     // This partial exposes the shader headers the create export registered.
 
-    internal static ulong GetShaderHeaderAddress(ulong codeAddress) =>
-        _shaderHeadersByCode.TryGetValue(codeAddress, out var header) ? header : 0;
+    internal static ulong GetShaderHeaderAddress(ulong codeAddress)
+    {
+        lock (_submitTraceGate)
+        {
+            return _shaderHeadersByCode.TryGetValue(codeAddress, out var header) ? header : 0;
+        }
+    }
 
     internal static ShaderHeaderRegistry CreateShaderHeaderRegistry(CpuContext context) =>
         new(

src/SharpEmu.Libs/Agc/AgcExports.ShaderState.cs

@@ -1,12 +1,10 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-using System.Buffers;
 using System.Buffers.Binary;
 using System.Collections.Concurrent;
 using System.Runtime.CompilerServices;
 using SharpEmu.HLE;
-using SharpEmu.Libs.Gpu.GpuCommands.Registers;
 using SharpEmu.Libs.Kernel;
 using SharpEmu.ShaderCompiler;
 
@@ -130,7 +128,10 @@ public static partial class AgcExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
-        _shaderHeadersByCode[codeAddress] = headerAddress;
+        lock (_submitTraceGate)
+        {
+            _shaderHeadersByCode[codeAddress] = headerAddress;
+        }
 
         TryRegisterEmbeddedFusedProgram(ctx, codeAddress, headerAddress);
 
@@ -354,17 +355,7 @@ public static partial class AgcExports
         ExportName = "sceAgcFuseShaderHalves",
         Target = Generation.Gen5,
         LibraryName = "libSceAgc")]
-    public static int FuseShaderHalves(CpuContext ctx) => FuseShaderHalvesCore(ctx, legacy: false);
-    #pragma warning restore SHEM004
-
-    [SysAbiExport(
-        Nid = "nApJjpKNBl4",
-        ExportName = "sceAgcFuseShaderHalves",
-        Target = Generation.Gen5,
-        LibraryName = "libSceAgc")]
-    public static int FuseShaderHalvesLegacy(CpuContext ctx) => FuseShaderHalvesCore(ctx, legacy: true);
-
-    private static int FuseShaderHalvesCore(CpuContext ctx, bool legacy)
+    public static int FuseShaderHalves(CpuContext ctx)
     {
         var fusedAddress = ctx[CpuRegister.Rdi];
         var frontAddress = ctx[CpuRegister.Rsi];
@@ -416,12 +407,6 @@ public static partial class AgcExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
-        ulong userDataAddress = 0;
-        if (legacy && !TryReadUInt64(ctx, frontAddress + ShaderUserDataOffset, out userDataAddress))
-        {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-        }
-
         Span<byte> header = stackalloc byte[ShaderStructBytes];
         if (!ctx.Memory.TryRead(backAddress, header) ||
             !ctx.Memory.TryWrite(fusedAddress, header))
@@ -443,13 +428,13 @@ public static partial class AgcExports
         }
 
         if (!TryWriteByte(ctx, fusedAddress + ShaderTypeOffset, isGeometryPair ? GsShaderType : HsShaderType) ||
-            !ctx.TryWriteUInt64(fusedAddress + ShaderUserDataOffset, userDataAddress) ||
+            !ctx.TryWriteUInt64(fusedAddress + ShaderUserDataOffset, 0) ||
             !ctx.TryWriteUInt64(fusedAddress + ShaderShRegistersOffset, fusedRegistersAddress))
         {
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
-        if (isGeometryPair || legacy)
+        if (isGeometryPair)
         {
             if (!TryReadUInt64(ctx, frontAddress + ShaderShRegistersOffset, out var frontRegistersAddress) ||
                 !TryReadByte(ctx, frontAddress + ShaderNumShRegistersOffset, out var frontRegisterCount))
@@ -457,19 +442,17 @@ public static partial class AgcExports
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
 
-            var merged = legacy
-                ? MergeLegacyFusedShaderRegisters(ctx, frontRegistersAddress, frontRegisterCount, fusedRegistersAddress, registerCount, isGeometryPair)
-                : MergeFusedUserScalarCount(ctx, frontRegistersAddress, frontRegisterCount, fusedRegistersAddress, registerCount);
-            if (!merged)
+            // Both halves share one user-data block, so the fused USER_SGPR count is
+            // the larger of the two.
+            if (!MergeFusedUserScalarCount(ctx, frontRegistersAddress, frontRegisterCount, fusedRegistersAddress, registerCount))
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
 
-            var checksumOffset = isGeometryPair ? SpiShaderPgmChksumGs : ShaderRegisterOffset.SpiShaderPgmChksumHs;
             for (var occurrence = 0; occurrence < 2; occurrence++)
             {
-                if (!TryFindShaderRegister(ctx, fusedRegistersAddress, registerCount, checksumOffset, occurrence, out var fusedEntry) ||
-                    !TryFindShaderRegister(ctx, frontRegistersAddress, frontRegisterCount, checksumOffset, occurrence, out var frontEntry))
+                if (!TryFindShaderRegister(ctx, fusedRegistersAddress, registerCount, SpiShaderPgmChksumGs, occurrence, out var fusedEntry) ||
+                    !TryFindShaderRegister(ctx, frontRegistersAddress, frontRegisterCount, SpiShaderPgmChksumGs, occurrence, out var frontEntry))
                 {
                     continue;
                 }
@@ -507,6 +490,7 @@ public static partial class AgcExports
         ctx[CpuRegister.Rax] = 0;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
+    #pragma warning restore SHEM004
 
     [SysAbiExport(
         Nid = "D9sr1xGUriE",
@@ -606,15 +590,9 @@ public static partial class AgcExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
-        Span<byte> registers = stackalloc byte[InterpolantRegisterCount * InterpolantRegisterPairSize];
-        for (var i = 0; i < InterpolantRegisterCount; i++)
-        {
-            SetInterpolantRegister(registers, i, (uint)i);
-        }
-
         if (inputSemanticsCount == 0)
         {
-            if (!ctx.Memory.TryWrite(registersAddress, registers))
+            if (!TryWriteIdentityInterpolantRegisters(ctx, registersAddress, 0))
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
@@ -642,74 +620,82 @@ public static partial class AgcExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
-        Span<byte> inputWords = stackalloc byte[(int)inputSemanticsCount * sizeof(uint)];
-        var outputBytes = outputSemanticsCount * sizeof(uint);
-        var rentedOutputWords = outputBytes > 1024 ? ArrayPool<byte>.Shared.Rent(outputBytes) : null;
-        try
+        for (uint inputIndex = 0; inputIndex < inputSemanticsCount; inputIndex++)
         {
-            var outputWords = rentedOutputWords is null ? stackalloc byte[outputBytes] : rentedOutputWords.AsSpan(0, outputBytes);
-            if (!ctx.Memory.TryRead(inputSemanticsAddress, inputWords) ||
-                (outputBytes != 0 && !ctx.Memory.TryRead(outputSemanticsAddress, outputWords)))
+            if (!TryReadUInt32(
+                    ctx,
+                    inputSemanticsAddress + (inputIndex * sizeof(uint)),
+                    out var source))
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
 
-            for (var inputIndex = 0; inputIndex < (int)inputSemanticsCount; inputIndex++)
+            var hasMask = false;
+            var mask = 0u;
+            for (uint outputIndex = 0; outputIndex < outputSemanticsCount; outputIndex++)
             {
-                var source = BinaryPrimitives.ReadUInt32LittleEndian(inputWords[(inputIndex * sizeof(uint))..]);
-                var hasMask = TryFindOutputSemantic(outputWords, source, out var mask);
-
-                var mode = (source >> 20) & 0x3u;
-                uint flags;
-                if (mode == 0)
+                if (!TryReadUInt32(
+                        ctx,
+                        outputSemanticsAddress + (outputIndex * sizeof(uint)),
+                        out var candidate))
                 {
-                    flags = (((source >> 24) & 0x1u) | (hasMask ? 0u : 1u)) << 5;
-                    flags = ApplyInterpolantTwoBitField(flags, source >> 28, 8);
+                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+
+                if ((byte)candidate == (byte)source)
+                {
+                    hasMask = true;
+                    mask = candidate;
+                    break;
+                }
+            }
+
+            var mode = (source >> 20) & 0x3u;
+            uint flags;
+            if (mode == 0)
+            {
+                flags = (((source >> 24) & 0x1u) | (hasMask ? 0u : 1u)) << 5;
+                flags = ApplyInterpolantTwoBitField(flags, source >> 28, 8);
+            }
+            else
+            {
+                flags = ((source << 4) & 0x0300_0000u) + 0x0008_0000u;
+                if (mode == 2)
+                {
+                    flags &= 0xFFEF_FFDFu;
+                    flags |= hasMask ? ((~(mask & source) >> 16) & 0x20u) : 0x20u;
+                    flags = ApplyInterpolantTwoBitField(flags, source >> 30, 8);
+                    flags = ApplyInterpolantTwoBitField(flags, source >> 30, 21);
                 }
                 else
                 {
-                    flags = ((source << 4) & 0x0300_0000u) + 0x0008_0000u;
-                    if (mode == 2)
+                    if (hasMask)
                     {
-                        flags &= 0xFFEF_FFDFu;
-                        flags |= hasMask ? ((~(mask & source) >> 16) & 0x20u) : 0x20u;
-                        flags = ApplyInterpolantTwoBitField(flags, source >> 30, 8);
-                        flags = ApplyInterpolantTwoBitField(flags, source >> 30, 21);
+                        var masked = mask & source;
+                        flags = (flags & 0xFFFF_FFDFu) | ((masked >> 15) & 0x20u);
+                        flags ^= 0x20u;
+                        flags = (flags & 0xFFEF_FFFFu) | ((~masked >> 1) & 0x0010_0000u);
                     }
                     else
                     {
-                        if (hasMask)
-                        {
-                            var masked = mask & source;
-                            flags = (flags & 0xFFFF_FFDFu) | ((masked >> 15) & 0x20u);
-                            flags ^= 0x20u;
-                            flags = (flags & 0xFFEF_FFFFu) | ((~masked >> 1) & 0x0010_0000u);
-                        }
-                        else
-                        {
-                            flags |= 0x0010_0020u;
-                        }
-
-                        flags = ApplyInterpolantTwoBitField(flags, source >> 28, 8);
-                        flags = ApplyInterpolantTwoBitField(flags, source >> 30, 21);
+                        flags |= 0x0010_0020u;
                     }
+
+                    flags = ApplyInterpolantTwoBitField(flags, source >> 28, 8);
+                    flags = ApplyInterpolantTwoBitField(flags, source >> 30, 21);
                 }
-
-                flags = hasMask
-                    ? ApplyInterpolantFinalMask(flags, source, mask)
-                    : flags & 0xFFFF_FBE0u;
-                SetInterpolantRegister(registers, inputIndex, flags);
             }
-        }
-        finally
-        {
-            if (rentedOutputWords is not null)
+
+            flags = hasMask
+                ? ApplyInterpolantFinalMask(flags, source, mask)
+                : flags & 0xFFFF_FBE0u;
+            if (!TryWriteInterpolantRegister(ctx, registersAddress, inputIndex, flags))
             {
-                ArrayPool<byte>.Shared.Return(rentedOutputWords);
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
         }
 
-        if (!ctx.Memory.TryWrite(registersAddress, registers))
+        if (!TryWriteIdentityInterpolantRegisters(ctx, registersAddress, inputSemanticsCount))
         {
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
@@ -825,17 +811,9 @@ public static partial class AgcExports
             }
         }
 
-        // The 32 (register, value) pairs are built here and written with one guest write; titles
-        // call this per draw, and 64 separate 4-byte writes each paid the guest write path.
-        Span<byte> registers = stackalloc byte[InterpolantRegisterCount * InterpolantRegisterPairSize];
-        for (var i = 0; i < InterpolantRegisterCount; i++)
-        {
-            SetInterpolantRegister(registers, i, (uint)i);
-        }
-
         if (inputSemanticsCount == 0 || inputSemanticsAddress == 0)
         {
-            if (!ctx.Memory.TryWrite(registersAddress, registers))
+            if (!TryWriteIdentityInterpolantRegisters(ctx, registersAddress, 0))
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
@@ -859,48 +837,53 @@ public static partial class AgcExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
-        inputSemanticsCount = Math.Min(inputSemanticsCount, (uint)InterpolantRegisterCount);
-        Span<byte> psWords = stackalloc byte[(int)inputSemanticsCount * sizeof(uint)];
-        if (!ctx.Memory.TryRead(inputSemanticsAddress, psWords))
+        inputSemanticsCount = Math.Min(inputSemanticsCount, 32u);
+        for (uint psIndex = 0; psIndex < inputSemanticsCount; psIndex++)
         {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-        }
-
-        var gsBytes = (outputSemanticsAddress != 0 ? outputSemanticsCount : 0) * sizeof(uint);
-        var rentedGsWords = gsBytes > 1024 ? ArrayPool<byte>.Shared.Rent(gsBytes) : null;
-        try
-        {
-            var gsWords = rentedGsWords is null ? stackalloc byte[gsBytes] : rentedGsWords.AsSpan(0, gsBytes);
-            if (gsBytes != 0 && !ctx.Memory.TryRead(outputSemanticsAddress, gsWords))
+            if (!TryReadUInt32(
+                    ctx,
+                    inputSemanticsAddress + (psIndex * sizeof(uint)),
+                    out var psWord))
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
 
-            for (var psIndex = 0; psIndex < (int)inputSemanticsCount; psIndex++)
+            var psSemantic = psWord & 0xFFu;
+            uint? gsWord = null;
+            if (outputSemanticsAddress != 0)
             {
-                var psWord = BinaryPrimitives.ReadUInt32LittleEndian(psWords[(psIndex * sizeof(uint))..]);
-                uint? gsWord = TryFindOutputSemantic(gsWords, psWord, out var candidate) ? candidate : null;
+                for (uint gsIndex = 0; gsIndex < outputSemanticsCount; gsIndex++)
+                {
+                    if (!TryReadUInt32(
+                            ctx,
+                            outputSemanticsAddress + (gsIndex * sizeof(uint)),
+                            out var candidate))
+                    {
+                        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                    }
 
-                var value = (psWord & 0x0030_0000u) != 0
-                    ? CreateInterpolantF16Value(psWord, gsWord)
-                    : CreateInterpolantNonF16Value(psWord, gsWord.HasValue);
-                SetInterpolantRegister(
-                    registers,
-                    psIndex,
-                    gsWord is { } matched
-                        ? CreateInterpolantMappingValue(value, psWord, matched)
-                        : CreateInterpolantDefaultParamValue(value, psWord));
+                    if ((candidate & 0xFFu) == psSemantic)
+                    {
+                        gsWord = candidate;
+                        break;
+                    }
+                }
             }
-        }
-        finally
-        {
-            if (rentedGsWords is not null)
+
+            var value = (psWord & 0x0030_0000u) != 0
+                ? CreateInterpolantF16Value(psWord, gsWord)
+                : CreateInterpolantNonF16Value(psWord, gsWord.HasValue);
+            value = gsWord is { } matched
+                ? CreateInterpolantMappingValue(value, psWord, matched)
+                : CreateInterpolantDefaultParamValue(value, psWord);
+
+            if (!TryWriteInterpolantRegister(ctx, registersAddress, psIndex, value))
             {
-                ArrayPool<byte>.Shared.Return(rentedGsWords);
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
         }
 
-        if (!ctx.Memory.TryWrite(registersAddress, registers))
+        if (!TryWriteIdentityInterpolantRegisters(ctx, registersAddress, inputSemanticsCount))
         {
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
@@ -979,31 +962,31 @@ public static partial class AgcExports
         return value;
     }
 
-    private const int InterpolantRegisterCount = 32;
-    private const int InterpolantRegisterPairSize = 2 * sizeof(uint);
-
-    // The output (GS/VS export) semantic word whose semantic id (low byte) matches an input's.
-    private static bool TryFindOutputSemantic(ReadOnlySpan<byte> outputWords, uint inputWord, out uint outputWord)
+    private static bool TryWriteInterpolantRegister(
+        CpuContext ctx,
+        ulong registersAddress,
+        uint index,
+        uint value)
     {
-        for (var offset = 0; offset + sizeof(uint) <= outputWords.Length; offset += sizeof(uint))
+        var destination = registersAddress + (index * 8);
+        return TryWriteUInt32(ctx, destination, SpiPsInputCntl0 + index) &&
+               TryWriteUInt32(ctx, destination + sizeof(uint), value);
+    }
+
+    private static bool TryWriteIdentityInterpolantRegisters(
+        CpuContext ctx,
+        ulong registersAddress,
+        uint firstIndex)
+    {
+        for (uint i = firstIndex; i < 32u; i++)
         {
-            outputWord = BinaryPrimitives.ReadUInt32LittleEndian(outputWords[offset..]);
-            if ((byte)outputWord == (byte)inputWord)
+            if (!TryWriteInterpolantRegister(ctx, registersAddress, i, i))
             {
-                return true;
+                return false;
             }
         }
 
-        outputWord = 0;
-        return false;
-    }
-
-    // Slot i is the pair (SPI_PS_INPUT_CNTL_0 + i, value).
-    private static void SetInterpolantRegister(Span<byte> registers, int index, uint value)
-    {
-        var pair = registers[(index * InterpolantRegisterPairSize)..];
-        BinaryPrimitives.WriteUInt32LittleEndian(pair, SpiPsInputCntl0 + (uint)index);
-        BinaryPrimitives.WriteUInt32LittleEndian(pair[sizeof(uint)..], value);
+        return true;
     }
 
     private static OrbisGen2Result PatchShaderProgramRegisters(CpuContext context, ulong headerAddress, ulong codeAddress)
@@ -1281,46 +1264,6 @@ public static partial class AgcExports
         return merged == fused || TryWriteUInt32(ctx, fusedEntry + sizeof(uint), merged);
     }
 
-    private static bool MergeLegacyFusedShaderRegisters(
-        CpuContext ctx, ulong frontRegisters, int frontCount, ulong fusedRegisters, int fusedCount, bool geometry)
-    {
-        var rsrc1Offset = geometry ? SpiShaderPgmRsrc1Gs : SpiShaderPgmRsrc1Hs;
-        var rsrc2Offset = geometry ? SpiShaderPgmRsrc2Gs : ShaderRegisterOffset.SpiShaderPgmRsrc2Hs;
-        if (!TryFindShaderRegister(ctx, frontRegisters, frontCount, rsrc1Offset, 0, out var frontEntry1) ||
-            !TryFindShaderRegister(ctx, frontRegisters, frontCount, rsrc2Offset, 0, out var frontEntry2) ||
-            !TryFindShaderRegister(ctx, fusedRegisters, fusedCount, rsrc1Offset, 0, out var fusedEntry1) ||
-            !TryFindShaderRegister(ctx, fusedRegisters, fusedCount, rsrc2Offset, 0, out var fusedEntry2))
-        {
-            return true;
-        }
-
-        if (!TryReadUInt32(ctx, frontEntry1 + sizeof(uint), out var front1) ||
-            !TryReadUInt32(ctx, frontEntry2 + sizeof(uint), out var front2) ||
-            !TryReadUInt32(ctx, fusedEntry1 + sizeof(uint), out var fused1) ||
-            !TryReadUInt32(ctx, fusedEntry2 + sizeof(uint), out var fused2))
-        {
-            return false;
-        }
-
-        // The older export takes maximum allocations, but user SGPRs and the
-        // ES component flag belong to the front half, not the back half.
-        fused1 = MergeMaxField(fused1, front1, 0, 0x3Fu);
-        fused1 = MergeMaxField(fused1, front1, geometry ? 29 : 28, 3u);
-        fused2 = MergeMaxField(fused2, front2, 28, 0xFu);
-        if (geometry)
-        {
-            fused2 = MergeMaxField(fused2, front2, 16, 3u);
-            fused2 = (fused2 & ~0x0004_0000u) | (front2 & 0x0004_0000u);
-        }
-
-        fused2 = (fused2 & ~0x0800_003Eu) | (front2 & 0x0800_003Eu);
-        return TryWriteUInt32(ctx, fusedEntry1 + sizeof(uint), fused1) &&
-               TryWriteUInt32(ctx, fusedEntry2 + sizeof(uint), fused2);
-
-        static uint MergeMaxField(uint destination, uint source, int shift, uint mask) =>
-            (destination & ~(mask << shift)) | (Math.Max((destination >> shift) & mask, (source >> shift) & mask) << shift);
-    }
-
     private static bool TryFindShaderRegister(
         CpuContext ctx,
         ulong registersAddress,

src/SharpEmu.Libs/Agc/AgcExports.cs

@@ -201,10 +201,10 @@ public static partial class AgcExports
     private const ulong CommandBufferCallbackOffset = 0x20;
     private const ulong CommandBufferUserDataOffset = 0x28;
     private const ulong CommandBufferReservedDwOffset = 0x30;
+    private static readonly object _submitTraceGate = new();
     // Every PM4 opcode with no handler, logged once with its first two
     // payload dwords as a possible target address.
-    // Read by the render thread for every draw; written by guest threads creating shaders.
-    private static readonly System.Collections.Concurrent.ConcurrentDictionary<ulong, ulong> _shaderHeadersByCode = new();
+    private static readonly Dictionary<ulong, ulong> _shaderHeadersByCode = new();
     private static readonly bool _traceAgc = string.Equals(
         Environment.GetEnvironmentVariable("SHARPEMU_LOG_AGC"),
         "1",

src/SharpEmu.Libs/AppContent/AppContentExports.cs

@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
-using SharpEmu.Libs.Kernel;
 using System.Buffers.Binary;
 using System.Text;
 using System.Text.Json;
@@ -12,9 +11,6 @@ namespace SharpEmu.Libs.AppContent;
 public static class AppContentExports
 {
     private const ulong FallbackAvailableSpaceKb = 1024UL * 1024UL; // 1 GiB
-    private const int AppContentErrorParameter = unchecked((int)0x80D90002);
-    private const int AppContentErrorDrmNoEntitlement = unchecked((int)0x80D90007);
-    private const int MountPointSize = 16;
     private const ulong BootParamAttrOffset = 4;
     private const string Temp0MountPoint = "/temp0";
     private const uint AppParamSkuFlag = 0;
@@ -102,29 +98,6 @@ public static class AppContentExports
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
-    [SysAbiExport(
-        Nid = "VANhIWcqYak",
-        ExportName = "sceAppContentAddcontMount",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceAppContent")]
-    public static int AppContentAddcontMount(CpuContext ctx)
-    {
-        var entitlementLabelAddress = ctx[CpuRegister.Rsi];
-        var mountPointAddress = ctx[CpuRegister.Rdx];
-        if (entitlementLabelAddress == 0 || mountPointAddress == 0)
-        {
-            return ctx.SetReturn(AppContentErrorParameter);
-        }
-
-        Span<byte> emptyMountPoint = stackalloc byte[MountPointSize];
-        if (!ctx.Memory.TryWrite(mountPointAddress, emptyMountPoint))
-        {
-            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-        }
-
-        return ctx.SetReturn(AppContentErrorDrmNoEntitlement);
-    }
-
     [SysAbiExport(
         Nid = "buYbeLOGWmA",
         ExportName = "sceAppContentTemporaryDataMount2",
@@ -138,7 +111,7 @@ public static class AppContentExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        Directory.CreateDirectory(KernelMemoryCompatExports.ResolveTemp0Root());
+        Directory.CreateDirectory(ResolveTemp0Root());
         var mountPointBytes = Encoding.ASCII.GetBytes($"{Temp0MountPoint}\0");
         if (!ctx.Memory.TryWrite(mountPointAddress, mountPointBytes))
         {
@@ -190,7 +163,7 @@ public static class AppContentExports
     {
         try
         {
-            var storageRoot = KernelMemoryCompatExports.ResolveTemp0Root();
+            var storageRoot = ResolveTemp0Root();
             Directory.CreateDirectory(storageRoot);
             var volumeRoot = Path.GetPathRoot(Path.GetFullPath(storageRoot));
             if (!string.IsNullOrWhiteSpace(volumeRoot))
@@ -267,4 +240,28 @@ public static class AppContentExports
         Console.Error.WriteLine($"[LOADER][TRACE] app_content.{message}");
     }
 
+    private static string ResolveTemp0Root()
+    {
+        const string temp0VariableName = "SHARPEMU_TEMP0_DIR";
+        var configuredRoot = Environment.GetEnvironmentVariable(temp0VariableName);
+        if (!string.IsNullOrWhiteSpace(configuredRoot))
+        {
+            return Path.GetFullPath(configuredRoot);
+        }
+
+        var app0Root = Environment.GetEnvironmentVariable("SHARPEMU_APP0_DIR");
+        var appName = string.IsNullOrWhiteSpace(app0Root)
+            ? "default"
+            : Path.GetFileName(Path.TrimEndingDirectorySeparator(app0Root));
+        if (string.IsNullOrWhiteSpace(appName))
+        {
+            appName = "default";
+        }
+
+        var invalidChars = Path.GetInvalidFileNameChars();
+        appName = new string(appName.Select(ch => invalidChars.Contains(ch) ? '_' : ch).ToArray());
+        var root = Path.Combine(AppContext.BaseDirectory, "user", "temp", appName, "temp0");
+        Environment.SetEnvironmentVariable(temp0VariableName, root);
+        return root;
+    }
 }

src/SharpEmu.Libs/Audio/AjmExports.cs

@@ -590,16 +590,7 @@ public static class AjmExports
             return ctx.SetReturn(OrbisAjmErrorJobCreation);
         }
 
-        var status = TryGetInstance(instanceId, out var instance) ? 0 : Atrac9DecodeState.ResultInvalidParameter;
-        Span<byte> gapless = stackalloc byte[AjmSidebandGaplessDecodeBytes];
-        if (status == 0 && gaplessAddress != 0 && ctx.Memory.TryRead(gaplessAddress, gapless))
-        {
-            instance!.Atrac9?.SetGapless(
-                BinaryPrimitives.ReadUInt32LittleEndian(gapless),
-                BinaryPrimitives.ReadUInt16LittleEndian(gapless[4..]),
-                reset != 0);
-        }
-
+        var status = TryGetInstance(instanceId, out _) ? 0 : Atrac9DecodeState.ResultInvalidParameter;
         WriteBasicResult(ctx, resultAddress, status);
         Trace(
             $"batch_job_set_gapless_decode instance=0x{instanceId:X8} " +
@@ -1172,10 +1163,6 @@ public static class AjmExports
 
         if ((flags & AjmJobSidebandFlagGaplessDecode) != 0 && (ulong)(offset + AjmSidebandGaplessDecodeBytes) <= size)
         {
-            var gapless = instance?.Atrac9?.Gapless ?? default;
-            BinaryPrimitives.WriteUInt32LittleEndian(sideband[offset..], gapless.TotalSamples);
-            BinaryPrimitives.WriteUInt16LittleEndian(sideband[(offset + 4)..], gapless.SkipSamples);
-            BinaryPrimitives.WriteUInt16LittleEndian(sideband[(offset + 6)..], gapless.SkippedSamples);
             offset += AjmSidebandGaplessDecodeBytes;
         }
 
@@ -1331,12 +1318,8 @@ public static class AjmExports
                TryWriteUInt64(ctx, infoAddress + AjmBatchInfoOffsetField, offset + jobSize);
     }
 
-    // SceAjmBatchError { int iErrorCode; const void *pJobAddress;
-    // unsigned int uiCommandOffset; const void *pJobOriginRa; }. The two pointers
-    // force 8-byte alignment, so the struct is 0x20 bytes (4+4 pad, 8, 4+4 pad, 8)
-    // rather than the 24-byte naive field sum — pJobOriginRa lives at +0x18 and was
-    // left holding stale guest bytes.
-    private const int AjmBatchErrorBytes = 0x20;
+    // AjmBatchError: int error_code; const void* job_addr; uint32_t cmd_offset; const void* job_ra;
+    private const int AjmBatchErrorBytes = 24;
 
     private static void ClearAjmBatchError(CpuContext ctx, ulong errorAddress)
     {

src/SharpEmu.Libs/Audio/Atrac9DecodeState.cs

@@ -20,8 +20,6 @@ internal readonly record struct Atrac9DecodeResult(
     ulong TotalDecodedSamples,
     uint Frames);
 
-internal readonly record struct Atrac9Gapless(uint TotalSamples, ushort SkipSamples, ushort SkippedSamples);
-
 internal sealed class Atrac9DecodeState
 {
     internal const int ResultNotInitialized = 0x00000001;
@@ -49,33 +47,6 @@ internal sealed class Atrac9DecodeState
     private int _containerHeaderLength;
     private int _compressedLength;
     private ulong _totalDecodedSamples;
-    private Atrac9Gapless _gaplessInit;
-    private Atrac9Gapless _gapless;
-
-    public Atrac9Gapless Gapless
-    {
-        get
-        {
-            lock (_gate)
-            {
-                return _gapless;
-            }
-        }
-    }
-
-    public void SetGapless(uint totalSamples, ushort skipSamples, bool reset)
-    {
-        lock (_gate)
-        {
-            _gaplessInit = new Atrac9Gapless(totalSamples, skipSamples, 0);
-            if (reset || _gapless == default)
-            {
-                _gapless = _gaplessInit;
-            }
-        }
-    }
-
-    private bool HasSampleLimit => _gaplessInit.TotalSamples is not 0 and not uint.MaxValue;
 
     public Atrac9Config? Config
     {
@@ -111,7 +82,6 @@ internal sealed class Atrac9DecodeState
                 _compressedLength = 0;
                 _totalDecodedSamples = 0;
                 _containerHeaderLength = 0;
-                _gapless = _gaplessInit;
                 Trace(
                     $"initialized config={Convert.ToHexString(normalizedConfig)} channels={config.ChannelCount} " +
                     $"rate={config.SampleRate} frame_samples={config.FrameSamples} " +
@@ -144,7 +114,6 @@ internal sealed class Atrac9DecodeState
             _compressedLength = 0;
             _totalDecodedSamples = 0;
             _containerHeaderLength = 0;
-            _gapless = _gaplessInit;
             if (_compressed is not null)
             {
                 Array.Clear(_compressed);
@@ -184,6 +153,7 @@ internal sealed class Atrac9DecodeState
             }
 
             var bytesPerSample = GetBytesPerSample(encoding);
+            var outputBytesPerSuperframe = checked(config.SuperframeSamples * channels * bytesPerSample);
             var consumed = 0;
             var written = 0;
             uint frames = 0;
@@ -192,11 +162,6 @@ internal sealed class Atrac9DecodeState
             while (_compressedLength == config.SuperframeBytes ||
                    consumed < input.Length)
             {
-                if (HasSampleLimit && _gapless.TotalSamples == 0)
-                {
-                    break;
-                }
-
                 // Titles that stream whole .at9 files hand AJM the RIFF/WAVE
                 // container rather than a pointer into its `data` chunk, so the
                 // stream has to be advanced past the header before the first
@@ -237,15 +202,7 @@ internal sealed class Atrac9DecodeState
                     break;
                 }
 
-                var skip = Math.Min(config.SuperframeSamples, (int)_gapless.SkipSamples);
-                var samples = config.SuperframeSamples - skip;
-                if (HasSampleLimit)
-                {
-                    samples = (int)Math.Min((uint)samples, _gapless.TotalSamples);
-                }
-
-                var outputBytes = checked(samples * channels * bytesPerSample);
-                if (output.Length - written < outputBytes)
+                if (output.Length - written < outputBytesPerSuperframe)
                 {
                     status |= ResultNotEnoughRoom;
                     break;
@@ -274,19 +231,14 @@ internal sealed class Atrac9DecodeState
 
                 WriteInterleaved(
                     _planarPcm,
-                    output.Slice(written, outputBytes),
-                    skip,
-                    samples,
+                    output.Slice(written, outputBytesPerSuperframe),
+                    config.SuperframeSamples,
                     channels,
                     encoding);
 
-                _gapless = new Atrac9Gapless(
-                    HasSampleLimit ? _gapless.TotalSamples - (uint)samples : _gapless.TotalSamples,
-                    (ushort)(_gapless.SkipSamples - skip),
-                    (ushort)Math.Min(ushort.MaxValue, _gapless.SkippedSamples + config.SuperframeSamples - samples));
-                written += outputBytes;
+                written += outputBytesPerSuperframe;
                 _compressedLength = 0;
-                _totalDecodedSamples += unchecked((uint)samples);
+                _totalDecodedSamples += unchecked((uint)config.SuperframeSamples);
                 frames += unchecked((uint)config.FramesPerSuperframe);
 
                 if (!multipleFrames)
@@ -401,13 +353,12 @@ internal sealed class Atrac9DecodeState
     private static void WriteInterleaved(
         short[][] source,
         Span<byte> destination,
-        int firstSample,
         int samples,
         int channels,
         Atrac9PcmEncoding encoding)
     {
         var offset = 0;
-        for (var sample = firstSample; sample < firstSample + samples; sample++)
+        for (var sample = 0; sample < samples; sample++)
         {
             for (var channel = 0; channel < channels; channel++)
             {

src/SharpEmu.Libs/Audio/AudioInExports.cs

@@ -1,18 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using SharpEmu.HLE;
-
-namespace SharpEmu.Libs.Audio;
-
-public static class AudioInExports
-{
-    [SysAbiExport(
-        Nid = "BohEAQ7DlUE",
-        ExportName = "sceAudioInGetSilentState",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceAudioIn")]
-    public static int GetSilentState(CpuContext ctx) =>
-        // No AudioIn ports can be opened until an input backend is implemented.
-        ctx.SetReturn(unchecked((int)0x80260101));
-}

src/SharpEmu.Libs/Audio/AudioOutExports.cs

@@ -12,13 +12,8 @@ namespace SharpEmu.Libs.Audio;
 
 public static class AudioOutExports
 {
-    // ABI: SceAudioOutOutputParam { int32_t handle; int32_t : 32; void *ptr; }.
     private const int AudioOutOutputParamSize = 16;
     private const int AudioOutMaximumOutputCount = 25;
-    // ABI: SceAudioOutPortState { u16 output; u8 channel; u8 reserved8_1[1];
-    // s16 volume; u16 rerouteCounter; u64 flag; u64 reserved64[2]; }.
-    private const int AudioOutPortStateSize = 0x20;
-    private const ushort AudioOutStateOutputConnectedPrimary = 1 << 0;
 
     internal const int AudioOutErrorInvalidPort = unchecked((int)0x80260003);
     internal const int AudioOutErrorInvalidPointer = unchecked((int)0x80260004);
@@ -234,30 +229,34 @@ public static class AudioOutExports
             return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
-        // ABI: int32_t sceAudioOutGetPortState(int32_t handle,
-        // SceAudioOutPortState *state) — rsi is the only out pointer and the write
-        // is exactly sizeof(SceAudioOutPortState):
-        //   +0x00 u16 output          = STATE_OUTPUT_CONNECTED_PRIMARY
-        //   +0x02 u8  channel         = SceAudioOutStateChannel
-        //   +0x03 u8  reserved8_1[1]
-        //   +0x04 s16 volume          = -1 (invalid outside PADSPK)
-        //   +0x06 u16 rerouteCounter  = 0 (the host mixer never reroutes)
-        //   +0x08 u64 flag            = SCE_AUDIO_OUT_STATE_FLAG_NONE
-        //   +0x10 u64 reserved64[2]
-        Span<byte> state = stackalloc byte[AudioOutPortStateSize];
+        // Same rule as AudioOut2 PortGetState: never bulk-write onto the caller
+        // stack. Some titles place small locals next to the canary; a full
+        // SceAudioOutPortState write smashes it.
+        if (IsGuestStackAddress(stateAddress))
+        {
+            return ctx.SetReturn(0);
+        }
+
+        // SceAudioOutPortState: report a connected primary output at full volume
+        // so pacing/mixing code sees a live port. We do no host rerouting, so
+        // rerouteCounter and flag stay zero.
+        Span<byte> state = stackalloc byte[16];
         state.Clear();
+        System.Buffers.Binary.BinaryPrimitives.WriteUInt16LittleEndian(state, 1);
         System.Buffers.Binary.BinaryPrimitives.WriteUInt16LittleEndian(
-            state, AudioOutStateOutputConnectedPrimary);
-        state[2] = (byte)Math.Clamp(port.Channels, 0, 8);
-        System.Buffers.Binary.BinaryPrimitives.WriteInt16LittleEndian(state[4..], -1);
+            state[2..], (ushort)port.Channels);
+        state[7] = 127;
         if (!ctx.Memory.TryWrite(stateAddress, state))
         {
-            return ctx.SetReturn(AudioOutErrorInvalidPointer);
+            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
         return ctx.SetReturn(0);
     }
 
+    private static bool IsGuestStackAddress(ulong value) =>
+        value >= 0x0000_7FF0_0000_0000UL && value <= 0x0000_7FFF_FFFF_FFFFUL;
+
     [SysAbiExport(
         Nid = "w3PdaSTSwGE",
         ExportName = "sceAudioOutOutputs",

src/SharpEmu.Libs/Audio/AudioPropagationExports.cs

@@ -17,21 +17,9 @@ public static class AudioPropagationExports
 {
     private const int Ok = 0;
 
-    // ABI: int32_t sceAudioPropagationSystemQueryMemory(
-    //   const SceAudioPropagationSystemOption *pOptions,
-    //   SceAudioPropagationSystemMemory *pOutMemorySize).
-    // SceAudioPropagationSystemMemory is NOT a {size, alignment} pair: it is
-    //   +0x00 SceAudioPropagationStructDescriptor desc { uint32 id; size_t size; }
-    //   +0x10 void  *pCpuMem      (the caller allocates and fills this)
-    //   +0x18 size_t sizeCpuMem
-    //   +0x20 void  *pGpuMem      (the caller allocates and fills this)
-    //   +0x28 size_t sizeGpuMem
-    // so only the two size fields belong to this call. Writing {size, alignment}
-    // at +0x00/+0x08 overwrote the descriptor the caller had already initialized.
-    private const int SystemMemoryCpuSizeOffset = 0x18;
-    private const int SystemMemoryGpuSizeOffset = 0x28;
-    private const ulong SystemMemoryCpuBytes = 0x10_0000;
-
+    // QueryMemory reports the working-set size the caller must allocate before
+    // SystemCreate. rsi points at the out size/alignment; write a modest,
+    // aligned block so the caller's allocation succeeds.
     [SysAbiExport(
         Nid = "7xyAxrusLko",
         ExportName = "sceAudioPropagationSystemQueryMemory",
@@ -40,15 +28,13 @@ public static class AudioPropagationExports
     public static int SystemQueryMemory(CpuContext ctx)
     {
         var outAddress = ctx[CpuRegister.Rsi];
-        if (outAddress == 0)
+        if (outAddress != 0)
         {
-            // SCE_AUDIO_PROPAGATION_ERROR_INVALID_POINTER.
-            return ctx.SetReturn(unchecked((int)0x8A70_0003));
+            // {size, alignment} — 1 MiB / 256 B covers the caller's allocation.
+            ctx.TryWriteUInt64(outAddress, 0x10_0000);
+            ctx.TryWriteUInt64(outAddress + sizeof(ulong), 0x100);
         }
 
-        // No GPU (Acm) propagation path exists here, so the GPU working set is 0.
-        ctx.TryWriteUInt64(outAddress + SystemMemoryCpuSizeOffset, SystemMemoryCpuBytes);
-        ctx.TryWriteUInt64(outAddress + SystemMemoryGpuSizeOffset, 0);
         return ctx.SetReturn(Ok);
     }
 

src/SharpEmu.Libs/AvPlayer/AvPlayerExports.cs

@@ -351,8 +351,6 @@ public static class AvPlayerExports
                 : VideoFrameReadResult.Pending;
         }
 
-        public int QueuedFrameCount => _frames.Reader.Count;
-
         private void DecodeFrames()
         {
             try
@@ -439,7 +437,6 @@ public static class AvPlayerExports
         public uint AvSyncMode { get; set; } = AvSyncModeDefault;
         public bool IsGen5 { get; init; }
         public bool Started { get; set; }
-        public bool Stopped { get; set; }
         public bool Paused { get; set; }
         public bool Looping { get; set; }
         public bool EndOfStream { get; set; }
@@ -459,12 +456,6 @@ public static class AvPlayerExports
         public ulong LastVideoTimestamp { get; set; }
         public ulong EventDataBuffer { get; set; }
         public long NextFrameIndex { get; set; }
-        public long VideoCalls { get; set; }
-        public long VideoDelivered { get; set; }
-        public long VideoPending { get; set; }
-        public long VideoSyncWait { get; set; }
-        public long VideoWriteFailures { get; set; }
-        public long VideoStatsSecond { get; set; } = -1;
         public ulong AudioBufferBase { get; set; }
         public int NextAudioBuffer { get; set; }
         public long NextAudioFrameIndex { get; set; }
@@ -507,12 +498,6 @@ public static class AvPlayerExports
             DisposePlaybackResources();
             PlaybackClock.Reset();
             NextFrameIndex = 0;
-            VideoCalls = 0;
-            VideoDelivered = 0;
-            VideoPending = 0;
-            VideoSyncWait = 0;
-            VideoWriteFailures = 0;
-            VideoStatsSecond = -1;
             LastGuestBuffer = 0;
             LastVideoTimestamp = 0;
             SeekVideoFramePending = false;
@@ -555,9 +540,7 @@ public static class AvPlayerExports
             {
                 Handle = handle,
                 IsGen5 = IsGen5Target(ctx.TargetGeneration),
-                AutoStart = StartsAutomatically(
-                    TryReadByte(ctx, initDataAddress + autoStartOffset, out var autoStart) && autoStart != 0,
-                    TryReadUInt64(ctx, initDataAddress + 88, out var eventCallbackForStart) ? eventCallbackForStart : 0),
+                AutoStart = TryReadByte(ctx, initDataAddress + autoStartOffset, out var autoStart) && autoStart != 0,
                 GuestBuffers = new ulong[ReadOutputVideoFrameBufferCount(
                     ctx,
                     initDataAddress,
@@ -631,9 +614,7 @@ public static class AvPlayerExports
             {
                 Handle = handle,
                 IsGen5 = IsGen5Target(ctx.TargetGeneration),
-                AutoStart = StartsAutomatically(
-                    TryReadByte(ctx, initDataAddress + autoStartOffset, out var autoStart) && autoStart != 0,
-                    TryReadUInt64(ctx, initDataAddress + 96, out var eventCallbackForStart) ? eventCallbackForStart : 0),
+                AutoStart = TryReadByte(ctx, initDataAddress + autoStartOffset, out var autoStart) && autoStart != 0,
                 GuestBuffers = new ulong[ReadOutputVideoFrameBufferCount(
                     ctx,
                     initDataAddress,
@@ -743,7 +724,6 @@ public static class AvPlayerExports
             player = foundPlayer;
 
             player.Started = true;
-            player.Stopped = false;
             player.Paused = false;
             player.EndOfStream = false;
             Trace($"start handle=0x{player.Handle:X16}");
@@ -787,7 +767,6 @@ public static class AvPlayerExports
 
             player.ResetPlayback();
             player.Started = false;
-            player.Stopped = true;
         }
 
         NotifyEvent(ctx, player, 1); // StateStop
@@ -814,7 +793,6 @@ public static class AvPlayerExports
             player.PlaybackClock.Stop();
             player.FallbackPlayback?.Pause();
             Console.Error.WriteLine($"[AVPLAYER][INFO] pause handle=0x{player.Handle:X16}");
-            TraceVideoStats(player);
         }
 
 
@@ -881,32 +859,6 @@ public static class AvPlayerExports
         }
     }
 
-    [SysAbiExport(
-        Nid = "N6Oy-EjduiY",
-        ExportName = "sceAvPlayerSetAvailableBandwidth",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceAvPlayer")]
-    [SysAbiExport(
-        Nid = "+7xJ+lFxmkQ",
-        ExportName = "sceAvPlayerSetAvailableBW",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceAvPlayer")]
-    public static int AvPlayerSetAvailableBandwidth(CpuContext ctx)
-    {
-        var handle = ctx[CpuRegister.Rdi];
-        var availableBandwidth = ctx[CpuRegister.Rsi];
-        lock (StateGate)
-        {
-            if (!Players.ContainsKey(handle))
-            {
-                return SetReturn(ctx, InvalidParameters);
-            }
-
-            Trace($"set_available_bandwidth handle=0x{handle:X16} bandwidth={availableBandwidth}");
-            return SetReturn(ctx, 0);
-        }
-    }
-
     [SysAbiExport(
         Nid = "ODJK2sn9w4A",
         ExportName = "sceAvPlayerEnableStream",
@@ -1049,9 +1001,7 @@ public static class AvPlayerExports
         lock (StateGate)
         {
             var found = Players.TryGetValue(ctx[CpuRegister.Rdi], out var player);
-            // Active from the moment a source is ready until it stops, fails or reaches its end,
-            // whether or not playback has started (titles poll it before calling sceAvPlayerStart).
-            var active = found && player!.SourcePath is not null && !player.Stopped && !player.EndOfStream;
+            var active = found && player!.Started && !player.EndOfStream;
             TraceOnce(
                 "is_active",
                 $"is_active found={found} started={(found && player!.Started)} " +
@@ -1438,7 +1388,6 @@ public static class AvPlayerExports
             player.DurationMilliseconds = duration;
             player.HasAudio = hasAudio;
             player.Started = player.AutoStart;
-            player.Stopped = false;
             autoStart = player.AutoStart;
             Trace(
                 $"source guest='{guestPath}' host='{hostPath}' {width}x{height} " +
@@ -1670,14 +1619,6 @@ public static class AvPlayerExports
                 return SetReturn(ctx, 0);
             }
 
-            player.VideoCalls++;
-            var statsSecond = player.PlaybackClock.ElapsedMilliseconds / 1000;
-            if (statsSecond > player.VideoStatsSecond)
-            {
-                player.VideoStatsSecond = statsSecond;
-                TraceVideoStats(player);
-            }
-
             if (player.Paused)
             {
                 if (player.SeekVideoFramePending &&
@@ -1717,26 +1658,47 @@ public static class AvPlayerExports
             }
 
             var fps = Math.Max(1.0, player.FramesPerSecond);
-            var expectedFrame = player.NextFrameIndex;
             if (player.AvSyncMode == AvSyncModeDefault)
             {
-                expectedFrame = CalculateExpectedDefaultSyncVideoFrame(
+                var expectedFrame = CalculateExpectedDefaultSyncVideoFrame(
                     player.HasAudio,
                     player.NextAudioFrameIndex,
                     player.PlaybackClock.Elapsed.TotalSeconds,
                     fps);
                 if (player.NextFrameIndex > expectedFrame)
                 {
-                    player.VideoSyncWait++;
                     return SetReturn(ctx, 0);
                 }
 
+                var behind = expectedFrame - player.NextFrameIndex;
+                if (behind > MaxCatchUpFrames)
+                {
+                    // Limit this call's work without changing the shared playback clock.
+                    expectedFrame = player.NextFrameIndex + MaxCatchUpFrames;
+                    TraceOnce(
+                        "catch_up_capped",
+                        $"catch_up capped behind={behind} max={MaxCatchUpFrames} " +
+                        $"fps={fps:F3} {player.Width}x{player.Height}");
+                }
+
+                while (player.NextFrameIndex < expectedFrame)
+                {
+                    var skippedFrame = ReadFrame(player);
+                    if (skippedFrame == VideoFrameReadResult.Pending)
+                    {
+                        return SetReturn(ctx, 0);
+                    }
+                    if (skippedFrame == VideoFrameReadResult.End)
+                    {
+                        return FinishStream(ctx, player);
+                    }
+                    player.NextFrameIndex++;
+                }
             }
 
             var frameResult = ReadFrame(player);
             if (frameResult == VideoFrameReadResult.Pending)
             {
-                player.VideoPending++;
                 return SetReturn(ctx, 0);
             }
             if (frameResult == VideoFrameReadResult.End)
@@ -1745,23 +1707,9 @@ public static class AvPlayerExports
             }
 
             var frameIndex = player.NextFrameIndex;
-            // Only discard old frames when a replacement is already decoded.
-            for (var skipped = 0;
-                 skipped < MaxCatchUpFrames &&
-                 player.NextFrameIndex < expectedFrame &&
-                 player.VideoDecoder!.QueuedFrameCount > 1;
-                 skipped++)
-            {
-                player.NextFrameIndex++;
-                if (ReadFrame(player) != VideoFrameReadResult.Ready)
-                {
-                    break;
-                }
-                frameIndex = player.NextFrameIndex;
-            }
             var timestamp = player.StartTimeMilliseconds +
                 checked((ulong)Math.Round(frameIndex * 1000.0 / fps));
-            player.NextFrameIndex = frameIndex + 1;
+            player.NextFrameIndex++;
             if (!WriteVideoFrame(
                     ctx,
                     player,
@@ -1770,28 +1718,15 @@ public static class AvPlayerExports
                     frameIndex,
                     extended))
             {
-                player.VideoWriteFailures++;
                 return SetReturn(ctx, 0);
             }
             player.LastVideoTimestamp = timestamp;
-            player.VideoDelivered++;
 
             Trace($"video_frame handle=0x{player.Handle:X16} ex={extended} ts={timestamp} data=0x{player.LastGuestBuffer:X16}");
             return SetReturn(ctx, 1);
         }
     }
 
-    private static void TraceVideoStats(PlayerState player)
-    {
-        Console.Error.WriteLine(
-            $"[AVPLAYER][INFO] video_stats handle=0x{player.Handle:X16} " +
-            $"clock_ms={player.PlaybackClock.ElapsedMilliseconds} audio_blocks={player.NextAudioFrameIndex} " +
-            $"calls={player.VideoCalls} delivered={player.VideoDelivered} " +
-            $"pending={player.VideoPending} sync_wait={player.VideoSyncWait} " +
-            $"write_fail={player.VideoWriteFailures} next_frame={player.NextFrameIndex} " +
-            $"queued={player.VideoDecoder?.QueuedFrameCount ?? 0} last_ts={player.LastVideoTimestamp}");
-    }
-
     private static int FinishStream(CpuContext ctx, PlayerState player)
     {
         TraceOnce(
@@ -2679,13 +2614,6 @@ public static class AvPlayerExports
     internal static bool IsGen5Target(Generation generation) =>
         (generation & Generation.Gen5) != 0;
 
-    // A player plays on its own once its source is ready when the title asks for autoStart or
-    // registers no event callback: without one nothing could observe the ready state and start
-    // it. Such a title never calls sceAvPlayerStart and waits for the player to go inactive at the
-    // end of the stream, so leaving it unstarted kept it active forever.
-    internal static bool StartsAutomatically(bool autoStartRequested, ulong eventCallback) =>
-        autoStartRequested || eventCallback == 0;
-
     internal static ulong GetAutoStartOffset(Generation generation, bool extended) =>
         IsGen5Target(generation)
             ? extended ? 116UL : 108UL

src/SharpEmu.Libs/Codec/Videodec2Decoder.cs

@@ -7,21 +7,6 @@ using SharpEmu.Libs.VideoOut;
 
 namespace SharpEmu.Libs.Codec;
 
-internal sealed record Videodec2DecodedFrame(
-    byte[] Nv12,
-    uint Width,
-    uint Height,
-    uint Pitch,
-    bool ErrorFrame)
-{
-    public ulong Pts { get; init; } = ulong.MaxValue;
-    public ulong Dts { get; init; } = ulong.MaxValue;
-    public ulong AttachedData { get; init; }
-    public bool KeyFrame { get; init; }
-    public uint Profile { get; init; }
-    public uint Level { get; init; }
-}
-
 /// <summary>
 /// Owns one FFmpeg H.264 decode session for a single sceVideodec2 decoder
 /// handle, feeding it pre-demuxed Annex-B access units from guest memory.
@@ -44,8 +29,6 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
     // Enough lookahead to absorb decode jitter without adding visible latency.
     private const int FrameQueueCapacity = 4;
 
-    private const int WorkQueueCapacity = 64;
-
     // Fallback when the stream doesn't declare a usable framerate.
     private const double FallbackFps = 30.0;
 
@@ -62,12 +45,12 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
     private AVPixelFormat _swsSourceFormat = AVPixelFormat.AV_PIX_FMT_NONE;
     private bool _disposed;
 
+    // Unbounded: access units are small, backpressure lives on the frame queue below.
     private readonly Channel<byte[]?> _workChannel =
-        Channel.CreateBounded<byte[]?>(new BoundedChannelOptions(WorkQueueCapacity)
+        Channel.CreateUnbounded<byte[]?>(new UnboundedChannelOptions
         {
-            FullMode = BoundedChannelFullMode.Wait,
             SingleReader = true,
-            SingleWriter = false,
+            SingleWriter = true,
         });
 
     // Bounded and blocking-on-full: the backpressure that keeps decode paced to playback.
@@ -91,10 +74,6 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
     private uint _lastWidth;
     private uint _lastHeight;
 
-    private long _workerInputCount;
-    private long _workerFrameCount;
-    private static readonly bool TraceEnabled = IsTraceEnabled();
-
     private Videodec2Decoder(AVCodecContext* codecContext, AVFrame* frame, AVPacket* packet)
     {
         _codecContext = codecContext;
@@ -127,22 +106,18 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
             var codec = ffmpeg.avcodec_find_decoder(AVCodecID.AV_CODEC_ID_H264);
             if (codec == null)
             {
-                Trace("create failed: H.264 decoder not found");
                 return null;
             }
 
             codecContext = ffmpeg.avcodec_alloc_context3(codec);
             if (codecContext == null)
             {
-                Trace("create failed: avcodec_alloc_context3 returned null");
                 return null;
             }
 
-            codecContext->flags |= ffmpeg.AV_CODEC_FLAG_COPY_OPAQUE;
             if (ffmpeg.avcodec_open2(codecContext, codec, null) < 0)
             {
                 ffmpeg.avcodec_free_context(&codecContext);
-                Trace("create failed: avcodec_open2 rejected H.264 decoder");
                 return null;
             }
 
@@ -161,18 +136,14 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
                 }
 
                 ffmpeg.avcodec_free_context(&codecContext);
-                Trace("create failed: frame or packet allocation returned null");
                 return null;
             }
 
-            var decoder = new Videodec2Decoder(codecContext, frame, packet);
-            Trace("create succeeded: FFmpeg H.264 worker and scheduler started");
-            return decoder;
+            return new Videodec2Decoder(codecContext, frame, packet);
         }
         catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException or TypeInitializationException)
         {
             // FFmpeg's native libraries are optional; missing ones degrade to the stub, not a crash.
-            Trace($"create failed: {ex.GetType().Name}: {ex.Message}");
             if (codecContext != null)
             {
                 ffmpeg.avcodec_free_context(&codecContext);
@@ -203,252 +174,18 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
         }
     }
 
-    public bool EnqueueAccessUnit(byte[] accessUnit)
+    /// <summary>Hands one Annex-B access unit to the decode worker and returns immediately.</summary>
+    public void EnqueueAccessUnit(byte[] accessUnit)
     {
-        return _workChannel.Writer.TryWrite(accessUnit);
+        _workChannel.Writer.TryWrite(accessUnit);
     }
 
     /// <summary>Queues an end-of-stream drain: flush FFmpeg and emit one more buffered picture, if any.</summary>
-    public bool RequestDrain()
+    public void RequestDrain()
     {
-        return _workChannel.Writer.TryWrite(null);
+        _workChannel.Writer.TryWrite(null);
     }
 
-    public bool DecodeAccessUnit(
-        byte[] accessUnit,
-        ulong pts,
-        ulong dts,
-        ulong attachedData,
-        out Videodec2DecodedFrame? decodedFrame)
-    {
-        decodedFrame = null;
-        lock (_gate)
-        {
-            if (_disposed || accessUnit.Length == 0)
-            {
-                return false;
-            }
-
-            ffmpeg.av_packet_unref(_packet);
-            ffmpeg.av_frame_unref(_frame);
-            var packetResult = ffmpeg.av_new_packet(_packet, accessUnit.Length);
-            if (packetResult < 0)
-            {
-                Trace($"decode failed: av_new_packet={packetResult}");
-                return false;
-            }
-
-            try
-            {
-                fixed (byte* source = accessUnit)
-                {
-                    Buffer.MemoryCopy(source, _packet->data, accessUnit.Length, accessUnit.Length);
-                }
-
-                _packet->pts = ToAvTimestamp(pts);
-                _packet->dts = ToAvTimestamp(dts);
-
-                var havePendingFrame = false;
-                var sendResult = ffmpeg.avcodec_send_packet(_codecContext, _packet);
-                if (sendResult == ffmpeg.AVERROR(ffmpeg.EAGAIN))
-                {
-                    var pendingResult = ffmpeg.avcodec_receive_frame(_codecContext, _frame);
-                    if (pendingResult < 0)
-                    {
-                        Trace($"decode failed: receive-before-resend={pendingResult}");
-                        return false;
-                    }
-
-                    havePendingFrame = true;
-                    sendResult = ffmpeg.avcodec_send_packet(_codecContext, _packet);
-                }
-
-                if (sendResult < 0)
-                {
-                    Trace($"decode failed: avcodec_send_packet={sendResult}");
-                    return false;
-                }
-
-                if (!havePendingFrame)
-                {
-                    var receiveResult = ffmpeg.avcodec_receive_frame(_codecContext, _frame);
-                    if (receiveResult == ffmpeg.AVERROR(ffmpeg.EAGAIN) ||
-                        receiveResult == ffmpeg.AVERROR_EOF)
-                    {
-                        return true;
-                    }
-
-                    if (receiveResult < 0)
-                    {
-                        Trace($"decode failed: avcodec_receive_frame={receiveResult}");
-                        return false;
-                    }
-                }
-
-                decodedFrame = ConvertFrameToNv12Locked(pts, dts, attachedData);
-                return decodedFrame is not null;
-            }
-            finally
-            {
-                ffmpeg.av_frame_unref(_frame);
-                ffmpeg.av_packet_unref(_packet);
-            }
-        }
-    }
-
-    public bool FlushOutput(out Videodec2DecodedFrame? decodedFrame)
-    {
-        decodedFrame = null;
-        lock (_gate)
-        {
-            if (_disposed)
-            {
-                return false;
-            }
-
-            ffmpeg.av_frame_unref(_frame);
-            var receiveResult = ffmpeg.avcodec_receive_frame(_codecContext, _frame);
-            if (receiveResult == ffmpeg.AVERROR(ffmpeg.EAGAIN) ||
-                receiveResult == ffmpeg.AVERROR_EOF)
-            {
-                return true;
-            }
-
-            if (receiveResult < 0)
-            {
-                Trace($"flush failed: avcodec_receive_frame={receiveResult}");
-                return false;
-            }
-
-            try
-            {
-                decodedFrame = ConvertFrameToNv12Locked();
-                return decodedFrame is not null;
-            }
-            finally
-            {
-                ffmpeg.av_frame_unref(_frame);
-            }
-        }
-    }
-
-    public void Reset()
-    {
-        lock (_gate)
-        {
-            if (_disposed)
-            {
-                return;
-            }
-
-            ffmpeg.avcodec_flush_buffers(_codecContext);
-            ffmpeg.av_packet_unref(_packet);
-            ffmpeg.av_frame_unref(_frame);
-        }
-    }
-
-    private Videodec2DecodedFrame? ConvertFrameToNv12Locked(
-        ulong fallbackPts = ulong.MaxValue,
-        ulong fallbackDts = ulong.MaxValue,
-        ulong attachedData = 0)
-    {
-        if (_frame->width <= 0 || _frame->height <= 0)
-        {
-            return null;
-        }
-
-        var width = checked((uint)_frame->width);
-        var height = checked((uint)_frame->height);
-        uint pitch;
-        ulong lumaBytes;
-        ulong requiredBytes;
-        try
-        {
-            pitch = checked((width + 255u) & ~255u);
-            lumaBytes = checked((ulong)pitch * height);
-            var chromaRows = ((ulong)height + 1UL) / 2UL;
-            requiredBytes = checked(lumaBytes + ((ulong)pitch * chromaRows));
-        }
-        catch (OverflowException)
-        {
-            return null;
-        }
-
-        if (requiredBytes > int.MaxValue)
-        {
-            return null;
-        }
-
-        _swsContext = ffmpeg.sws_getCachedContext(
-            _swsContext,
-            _frame->width,
-            _frame->height,
-            (AVPixelFormat)_frame->format,
-            _frame->width,
-            _frame->height,
-            AVPixelFormat.AV_PIX_FMT_NV12,
-            ffmpeg.SWS_FAST_BILINEAR,
-            null,
-            null,
-            null);
-        if (_swsContext == null)
-        {
-            return null;
-        }
-
-        var nv12 = new byte[(int)requiredBytes];
-        fixed (byte* destination = nv12)
-        {
-            var destinationPlanes = new byte*[4]
-            {
-                destination,
-                destination + checked((int)lumaBytes),
-                null,
-                null,
-            };
-            var destinationStrides = new int[4]
-            {
-                checked((int)pitch),
-                checked((int)pitch),
-                0,
-                0,
-            };
-            var rows = ffmpeg.sws_scale(
-                _swsContext,
-                _frame->data,
-                _frame->linesize,
-                0,
-                _frame->height,
-                destinationPlanes,
-                destinationStrides);
-            if (rows != _frame->height)
-            {
-                return null;
-            }
-        }
-
-        return new Videodec2DecodedFrame(
-            nv12,
-            width,
-            height,
-            pitch,
-            (_frame->flags & ffmpeg.AV_FRAME_FLAG_CORRUPT) != 0)
-        {
-            Pts = FromAvTimestamp(_frame->pts, fallbackPts),
-            Dts = FromAvTimestamp(_frame->pkt_dts, fallbackDts),
-            AttachedData = attachedData,
-            KeyFrame = (_frame->flags & ffmpeg.AV_FRAME_FLAG_KEY) != 0,
-            Profile = _codecContext->profile > 0 ? (uint)_codecContext->profile : 0,
-            Level = _codecContext->level > 0 ? (uint)_codecContext->level : 0,
-        };
-    }
-
-    private static long ToAvTimestamp(ulong timestamp) =>
-        timestamp <= long.MaxValue ? (long)timestamp : ffmpeg.AV_NOPTS_VALUE;
-
-    private static ulong FromAvTimestamp(long timestamp, ulong fallback) =>
-        timestamp == ffmpeg.AV_NOPTS_VALUE || timestamp < 0 ? fallback : (ulong)timestamp;
-
     /// <summary>Non-blocking: true exactly once per frame the worker has produced, in order.</summary>
     public bool TryConsumeProtocolReadySignal(out uint width, out uint height)
     {
@@ -496,28 +233,15 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
                 return;
             }
 
-            var inputOrdinal = Interlocked.Increment(ref _workerInputCount);
             var decodedOk = item is null
                 ? DrainCoreLocked(out var bgraFrame, out var hasPicture, out var width, out var height)
                 : DecodeCoreLocked(item, out bgraFrame, out hasPicture, out width, out height);
-            if (ShouldTrace(inputOrdinal))
-            {
-                Trace(
-                    $"worker input={inputOrdinal} kind={(item is null ? "drain" : "au")} " +
-                    $"bytes={item?.Length ?? 0} ok={decodedOk} picture={hasPicture} size={width}x{height}");
-            }
 
             if (!decodedOk || !hasPicture || bgraFrame is null)
             {
                 continue;
             }
 
-            var frameOrdinal = Interlocked.Increment(ref _workerFrameCount);
-            if (ShouldTrace(frameOrdinal))
-            {
-                Trace($"worker frame={frameOrdinal} produced size={width}x{height} bytes={bgraFrame.Length}");
-            }
-
             try
             {
                 // Blocks if the scheduler hasn't kept up; deliberate backpressure.
@@ -840,22 +564,4 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
             }
         }
     }
-
-    private static bool IsTraceEnabled()
-    {
-        var value = Environment.GetEnvironmentVariable("SHARPEMU_LOG_VIDEODEC2");
-        return string.Equals(value, "1", StringComparison.Ordinal) ||
-               string.Equals(value, "true", StringComparison.OrdinalIgnoreCase);
-    }
-
-    private static bool ShouldTrace(long ordinal) =>
-        TraceEnabled && (ordinal <= 16 || ordinal % 120 == 0);
-
-    private static void Trace(string message)
-    {
-        if (TraceEnabled)
-        {
-            Console.Error.WriteLine($"[VIDEODEC2][TRACE] {message}");
-        }
-    }
 }

src/SharpEmu.Libs/Codec/Videodec2Exports.cs

@@ -1,7 +1,6 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-using System.Buffers.Binary;
 using System.Collections.Concurrent;
 using SharpEmu.HLE;
 
@@ -16,18 +15,10 @@ public static class Videodec2Exports
 {
     private const int Ok = 0;
 
-    private const ulong MinimumMemoryBytes = 16UL * 1024 * 1024;
-    private const uint FrameBufferAlignment = 0x100;
-
     // Null entry = TryCreate() failed; every export falls back to the stub for that handle.
     private static readonly ConcurrentDictionary<ulong, Videodec2Decoder?> Decoders = new();
-    private static readonly ConcurrentDictionary<ulong, Videodec2DecodedFrame> PictureInfos = new();
     private static long _nextDecoderHandle = unchecked((long)DecoderToken);
 
-    private static readonly bool TraceEnabled = IsTraceEnabled();
-    private static long _decodeCallCount;
-    private static long _decodedPictureCount;
-
     [SysAbiExport(
         Nid = "RnDibcGCPKw",
         ExportName = "sceVideodec2QueryComputeMemoryInfo",
@@ -36,25 +27,24 @@ public static class Videodec2Exports
     public static int Videodec2QueryComputeMemoryInfo(CpuContext ctx)
     {
         var paramAddress = ctx[CpuRegister.Rdi];
-        if (paramAddress == 0 ||
-            !ctx.TryWriteUInt64(paramAddress + 0x08, MinimumMemoryBytes) ||
-            !ctx.TryWriteUInt64(paramAddress + 0x10, 0))
+        if (paramAddress == 0)
         {
             return SetReturn(ctx, VideodecErrorInvalidArg);
         }
 
+        // Success needs no memory writes; the game initializes from its own fields.
         return SetReturn(ctx, Ok);
     }
 
     private const int VideodecErrorInvalidArg = unchecked((int)0x80620801);
-    private const int VideodecErrorStructSize = unchecked((int)0x811D0101);
-    private const int VideodecErrorOutputInfo = unchecked((int)0x811D010F);
-    private const int VideodecErrorComputeQueueId = unchecked((int)0x811D0202);
 
     // Reject garbage/not-yet-primed struct reads before they reach `new byte[...]`.
     private const ulong MaxPlausibleAuBytes = 32UL * 1024 * 1024;
     private const ulong MaxPlausibleSlotBytes = 64UL * 1024 * 1024;
 
+    // Opaque token the game hands back unmodified to later Videodec2 calls.
+    private const ulong ComputeQueueToken = 0x56D2_C0DE_0001UL;
+
     [SysAbiExport(
         Nid = "eD+X2SmxUt4",
         ExportName = "sceVideodec2AllocateComputeQueue",
@@ -62,14 +52,8 @@ public static class Videodec2Exports
         LibraryName = "libSceVideodec2")]
     public static int Videodec2AllocateComputeQueue(CpuContext ctx)
     {
-        var configAddress = ctx[CpuRegister.Rdi];
-        var memoryInfoAddress = ctx[CpuRegister.Rsi];
-        var queueAddress = ctx[CpuRegister.Rdx];
-        if (configAddress == 0 || memoryInfoAddress == 0 || queueAddress == 0 ||
-            !ctx.TryReadUInt64(memoryInfoAddress + 0x10, out var computeMemoryAddress) ||
-            computeMemoryAddress == 0 ||
-            !ctx.TryWriteUInt64(
-                queueAddress, computeMemoryAddress))
+        var queueAddress = ctx[CpuRegister.Rdi];
+        if (queueAddress == 0 || !ctx.TryWriteUInt64(queueAddress, ComputeQueueToken))
         {
             return SetReturn(ctx, VideodecErrorInvalidArg);
         }
@@ -77,18 +61,7 @@ public static class Videodec2Exports
         return SetReturn(ctx, Ok);
     }
 
-    [SysAbiExport(
-        Nid = "UvtA3FAiF4Y",
-        ExportName = "sceVideodec2ReleaseComputeQueue",
-        Target = Generation.Gen5,
-        LibraryName = "libSceVideodec2")]
-    public static int Videodec2ReleaseComputeQueue(CpuContext ctx)
-    {
-        return SetReturn(
-            ctx,
-            ctx[CpuRegister.Rdi] != 0 ? Ok : VideodecErrorComputeQueueId);
-    }
-
+    // A zero size at +0x08/+0x28 makes the game skip its own arena allocation cleanly.
     [SysAbiExport(
         Nid = "qqMCwlULR+E",
         ExportName = "sceVideodec2QueryDecoderMemoryInfo",
@@ -96,18 +69,12 @@ public static class Videodec2Exports
         LibraryName = "libSceVideodec2")]
     public static int Videodec2QueryDecoderMemoryInfo(CpuContext ctx)
     {
-        var configAddress = ctx[CpuRegister.Rdi];
         var memoryInfoAddress = ctx[CpuRegister.Rsi];
-        if (configAddress == 0 || memoryInfoAddress == 0 ||
-            !ctx.TryWriteUInt64(memoryInfoAddress + 0x08, MinimumMemoryBytes) ||
-            !ctx.TryWriteUInt64(memoryInfoAddress + 0x10, 0) ||
-            !ctx.TryWriteUInt64(memoryInfoAddress + 0x18, MinimumMemoryBytes) ||
-            !ctx.TryWriteUInt64(memoryInfoAddress + 0x20, 0) ||
-            !ctx.TryWriteUInt64(memoryInfoAddress + 0x28, MinimumMemoryBytes) ||
-            !ctx.TryWriteUInt64(memoryInfoAddress + 0x30, 0) ||
-            !ctx.TryWriteUInt64(memoryInfoAddress + 0x38, MinimumMemoryBytes) ||
-            !ctx.TryWriteUInt32(memoryInfoAddress + 0x40, FrameBufferAlignment) ||
-            !ctx.TryWriteUInt32(memoryInfoAddress + 0x44, 0))
+        if (memoryInfoAddress == 0 ||
+            !ctx.TryWriteUInt64(memoryInfoAddress + 0x08, 0) ||
+            !ctx.TryWriteUInt64(memoryInfoAddress + 0x28, 0) ||
+            // Frame-slot size: must be nonzero or the game divides its arena by zero.
+            !ctx.TryWriteUInt64(memoryInfoAddress + 0x38, 0x1000))
         {
             return SetReturn(ctx, VideodecErrorInvalidArg);
         }
@@ -132,9 +99,7 @@ public static class Videodec2Exports
         }
 
         var handle = unchecked((ulong)Interlocked.Increment(ref _nextDecoderHandle));
-        var decoder = Videodec2Decoder.TryCreate();
-        Decoders[handle] = decoder;
-        Trace($"create handle=0x{handle:X16} real_decoder={decoder is not null}");
+        Decoders[handle] = Videodec2Decoder.TryCreate();
 
         if (!ctx.TryWriteUInt64(decoderAddress, handle))
         {
@@ -146,6 +111,7 @@ public static class Videodec2Exports
         return SetReturn(ctx, Ok);
     }
 
+    // Clearing the picture-ready byte at [rdx] tells the player "no buffered pictures remain".
     [SysAbiExport(
         Nid = "l1hXwscLuCY",
         ExportName = "sceVideodec2Flush",
@@ -154,25 +120,33 @@ public static class Videodec2Exports
     public static int Videodec2Flush(CpuContext ctx)
     {
         var handle = ctx[CpuRegister.Rdi];
-        var outputSlotObj = ctx[CpuRegister.Rsi];
         var outputInfoAddress = ctx[CpuRegister.Rdx];
-        if (!TryInitializeNoPicture(ctx, outputSlotObj, outputInfoAddress))
+        if (outputInfoAddress == 0 || !ctx.Memory.TryWrite(outputInfoAddress, NoPicture))
         {
             return SetReturn(ctx, VideodecErrorInvalidArg);
         }
 
-        if (Decoders.TryGetValue(handle, out var decoder) &&
-            decoder is not null &&
-            decoder.FlushOutput(out var decodedFrame) &&
-            decodedFrame is not null)
+        if (Decoders.TryGetValue(handle, out var decoder) && decoder is not null)
         {
-            _ = TryWriteDecodedFrame(
-                ctx, outputSlotObj, outputInfoAddress, decodedFrame);
+            // Drain in order: report an already-finished frame before queuing a new drain request.
+            if (decoder.TryConsumeProtocolReadySignal(out var width, out var height))
+            {
+                if (ctx.TryWriteUInt64(outputInfoAddress + 0x08, width) &&
+                    ctx.TryWriteUInt64(outputInfoAddress + 0x10, height))
+                {
+                    _ = ctx.Memory.TryWrite(outputInfoAddress, PictureReady);
+                }
+            }
+            else
+            {
+                decoder.RequestDrain();
+            }
         }
 
         return SetReturn(ctx, Ok);
     }
 
+    // No state to reset.
     [SysAbiExport(
         Nid = "wJXikG6QFN8",
         ExportName = "sceVideodec2Reset",
@@ -180,12 +154,6 @@ public static class Videodec2Exports
         LibraryName = "libSceVideodec2")]
     public static int Videodec2Reset(CpuContext ctx)
     {
-        var handle = ctx[CpuRegister.Rdi];
-        if (Decoders.TryGetValue(handle, out var decoder) && decoder is not null)
-        {
-            decoder.Reset();
-        }
-
         return SetReturn(ctx, Ok);
     }
 
@@ -205,6 +173,8 @@ public static class Videodec2Exports
         return SetReturn(ctx, Ok);
     }
 
+    // rcx[0] is the picture-ready flag (1 = frame published); it lives in
+    // uninitialized stack and must always be written explicitly.
     [SysAbiExport(
         Nid = "852F5+q6+iM",
         ExportName = "sceVideodec2Decode",
@@ -216,9 +186,8 @@ public static class Videodec2Exports
         var inputAuStruct = ctx[CpuRegister.Rsi];
         var outputSlotObj = ctx[CpuRegister.Rdx];
         var outputInfoAddress = ctx[CpuRegister.Rcx];
-        var callOrdinal = Interlocked.Increment(ref _decodeCallCount);
 
-        if (!TryInitializeNoPicture(ctx, outputSlotObj, outputInfoAddress))
+        if (outputInfoAddress == 0 || !ctx.Memory.TryWrite(outputInfoAddress, NoPicture))
         {
             return SetReturn(ctx, VideodecErrorInvalidArg);
         }
@@ -226,7 +195,6 @@ public static class Videodec2Exports
         if (!Decoders.TryGetValue(handle, out var decoder) || decoder is null)
         {
             // No real decoder for this handle: stub behavior, "fed the AU, no picture".
-            TraceDecode(callOrdinal, $"stub handle=0x{handle:X16}");
             return SetReturn(ctx, Ok);
         }
 
@@ -240,235 +208,35 @@ public static class Videodec2Exports
             slotPtr == 0 || slotSize == 0 || slotSize > MaxPlausibleSlotBytes)
         {
             // Nothing sane to feed/fill this call; not an error.
-            TraceDecode(callOrdinal, "invalid access-unit or output-slot descriptor");
             return SetReturn(ctx, Ok);
         }
 
-        _ = ctx.TryReadUInt64(inputAuStruct + 0x18, out var pts);
-        _ = ctx.TryReadUInt64(inputAuStruct + 0x20, out var dts);
-        _ = ctx.TryReadUInt64(inputAuStruct + 0x28, out var attachedData);
-
         var auBuffer = new byte[auDataSize];
         if (!ctx.Memory.TryRead(auDataPtr, auBuffer))
         {
-            TraceDecode(callOrdinal, $"AU read failed ptr=0x{auDataPtr:X16} bytes=0x{auDataSize:X}");
             return SetReturn(ctx, Ok);
         }
 
-        var decodeOk = decoder.DecodeAccessUnit(
-            auBuffer, pts, dts, attachedData, out var decodedFrame);
-        if (ShouldTrace(callOrdinal))
-        {
-            var prefixBytes = Math.Min(auBuffer.Length, 8);
-            Trace(
-                $"decode call={callOrdinal} au=0x{auDataPtr:X16}+0x{auDataSize:X} " +
-                $"head={Convert.ToHexString(auBuffer.AsSpan(0, prefixBytes))} " +
-                $"slot=0x{slotPtr:X16}+0x{slotSize:X} ok={decodeOk} " +
-                $"picture={decodedFrame is not null}");
-        }
+        // Queues the AU and returns immediately; decode/present happen on Videodec2Decoder's own threads.
+        decoder.EnqueueAccessUnit(auBuffer);
 
-        if (!decodeOk || decodedFrame is null)
+        if (!decoder.TryConsumeProtocolReadySignal(out var width, out var height))
         {
             return SetReturn(ctx, Ok);
         }
 
-        var copied = TryWriteDecodedFrame(
-            ctx, outputSlotObj, outputInfoAddress, decodedFrame);
-        if (copied)
+        if (!ctx.TryWriteUInt64(outputInfoAddress + 0x08, width) ||
+            !ctx.TryWriteUInt64(outputInfoAddress + 0x10, height) ||
+            !ctx.Memory.TryWrite(outputInfoAddress, PictureReady))
         {
-            Interlocked.Increment(ref _decodedPictureCount);
+            return SetReturn(ctx, Ok);
         }
-        TraceDecode(callOrdinal, $"guest_copy={copied} size={decodedFrame.Width}x{decodedFrame.Height} pitch={decodedFrame.Pitch}");
 
         return SetReturn(ctx, Ok);
     }
 
-    [SysAbiExport(
-        Nid = "NtXRa3dRzU0",
-        ExportName = "sceVideodec2GetPictureInfo",
-        Target = Generation.Gen5,
-        LibraryName = "libSceVideodec2")]
-    public static int Videodec2GetPictureInfo(CpuContext ctx)
-    {
-        var outputInfoAddress = ctx[CpuRegister.Rdi];
-        var firstPictureInfoAddress = ctx[CpuRegister.Rsi];
-        var secondPictureInfoAddress = ctx[CpuRegister.Rdx];
-        if (outputInfoAddress == 0 || firstPictureInfoAddress == 0)
-        {
-            return SetReturn(ctx, VideodecErrorInvalidArg);
-        }
-
-        if (!ctx.TryReadUInt64(outputInfoAddress, out var outputInfoSize) ||
-            (outputInfoSize != 0x30 && outputInfoSize != 0x38))
-        {
-            return SetReturn(ctx, VideodecErrorStructSize);
-        }
-
-        if (!TryReadByte(ctx, outputInfoAddress + 0x08, out var isValid) ||
-            !TryReadByte(ctx, outputInfoAddress + 0x0A, out var pictureCount) ||
-            !ctx.TryReadUInt32(outputInfoAddress + 0x0C, out var codecType) ||
-            !ctx.TryReadUInt64(outputInfoAddress + 0x20, out var pixelsAddress) ||
-            isValid == 0 || pictureCount == 0 || pixelsAddress == 0 || codecType != 1 ||
-            !PictureInfos.TryGetValue(pixelsAddress, out var decodedFrame))
-        {
-            return SetReturn(ctx, VideodecErrorOutputInfo);
-        }
-
-        if (!ctx.TryReadUInt64(firstPictureInfoAddress, out var requestedSize) ||
-            (requestedSize != 104 && requestedSize != 120))
-        {
-            return SetReturn(ctx, VideodecErrorStructSize);
-        }
-
-        var picture = new byte[(int)requestedSize];
-        BinaryPrimitives.WriteUInt64LittleEndian(picture, requestedSize);
-        picture[0x08] = 1;
-        BinaryPrimitives.WriteUInt64LittleEndian(picture.AsSpan(0x10), decodedFrame.Pts);
-        BinaryPrimitives.WriteUInt64LittleEndian(picture.AsSpan(0x18), decodedFrame.Dts);
-        BinaryPrimitives.WriteUInt64LittleEndian(picture.AsSpan(0x20), decodedFrame.AttachedData);
-        picture[0x28] = decodedFrame.KeyFrame ? (byte)1 : (byte)0;
-        picture[0x29] = (byte)Math.Min(decodedFrame.Profile, byte.MaxValue);
-        picture[0x2A] = (byte)Math.Min(decodedFrame.Level, byte.MaxValue);
-        BinaryPrimitives.WriteUInt32LittleEndian(
-            picture.AsSpan(0x2C), (decodedFrame.Width + 15u) / 16u - 1u);
-        BinaryPrimitives.WriteUInt32LittleEndian(
-            picture.AsSpan(0x30), (decodedFrame.Height + 15u) / 16u - 1u);
-        picture[0x34] = 1;
-        picture[0x4E] = 1;
-        picture[0x4F] = 5;
-        if (!ctx.Memory.TryWrite(firstPictureInfoAddress, picture))
-        {
-            return SetReturn(ctx, VideodecErrorInvalidArg);
-        }
-
-        if (secondPictureInfoAddress != 0 &&
-            !TryWriteEmptyPictureInfo(ctx, secondPictureInfoAddress))
-        {
-            return SetReturn(ctx, VideodecErrorStructSize);
-        }
-
-        Trace(
-            $"picture_info buffer=0x{pixelsAddress:X16} " +
-            $"pts=0x{decodedFrame.Pts:X16} size={requestedSize}");
-        return SetReturn(ctx, Ok);
-    }
-
-    private static readonly byte[] NotAccepted = [0];
-    private static readonly byte[] Accepted = [1];
-    private static readonly byte[] NoPicture = [0, 0, 0, 0];
-    private static readonly byte[] PictureReady = [1, 0, 1, 0];
-    private static readonly byte[] ErrorPictureReady = [1, 1, 1, 0];
-
-    private static bool TryInitializeNoPicture(
-        CpuContext ctx,
-        ulong frameBufferAddress,
-        ulong outputInfoAddress)
-    {
-        return frameBufferAddress != 0 &&
-               outputInfoAddress != 0 &&
-               ctx.Memory.TryWrite(frameBufferAddress + 0x18, NotAccepted) &&
-               ctx.Memory.TryWrite(outputInfoAddress + 0x08, NoPicture);
-    }
-
-    internal static bool TryWriteDecodedFrame(
-        CpuContext ctx,
-        ulong frameBufferAddress,
-        ulong outputInfoAddress,
-        Videodec2DecodedFrame decodedFrame)
-    {
-        if (!ctx.TryReadUInt64(frameBufferAddress + 0x08, out var pixelsAddress) ||
-            !ctx.TryReadUInt64(frameBufferAddress + 0x10, out var slotBytes) ||
-            !ctx.TryReadUInt64(outputInfoAddress, out var outputInfoBytes) ||
-            pixelsAddress == 0)
-        {
-            return false;
-        }
-
-        if ((ulong)decodedFrame.Nv12.Length > slotBytes ||
-            !ctx.Memory.TryWrite(pixelsAddress, decodedFrame.Nv12))
-        {
-            return false;
-        }
-
-        if (!ctx.TryWriteUInt32(outputInfoAddress + 0x0C, 1) ||
-            !ctx.TryWriteUInt32(outputInfoAddress + 0x10, decodedFrame.Width) ||
-            !ctx.TryWriteUInt32(outputInfoAddress + 0x14, decodedFrame.Pitch) ||
-            !ctx.TryWriteUInt32(outputInfoAddress + 0x18, decodedFrame.Height) ||
-            !ctx.TryWriteUInt64(outputInfoAddress + 0x20, pixelsAddress) ||
-            !ctx.TryWriteUInt64(outputInfoAddress + 0x28, slotBytes))
-        {
-            return false;
-        }
-
-        if (outputInfoBytes >= 0x38 &&
-            (!ctx.TryWriteUInt32(outputInfoAddress + 0x30, 0) ||
-             !ctx.TryWriteUInt32(outputInfoAddress + 0x34, decodedFrame.Pitch)))
-        {
-            return false;
-        }
-
-        if (!ctx.Memory.TryWrite(frameBufferAddress + 0x18, Accepted) ||
-            !ctx.Memory.TryWrite(
-                outputInfoAddress + 0x08,
-                decodedFrame.ErrorFrame ? ErrorPictureReady : PictureReady))
-        {
-            return false;
-        }
-
-        PictureInfos[pixelsAddress] = decodedFrame;
-        return true;
-    }
-
-    private static bool TryWriteEmptyPictureInfo(CpuContext ctx, ulong address)
-    {
-        if (!ctx.TryReadUInt64(address, out var size) || size < 40 || size > 256)
-        {
-            return false;
-        }
-
-        var output = new byte[(int)size];
-        BinaryPrimitives.WriteUInt64LittleEndian(output, size);
-        return ctx.Memory.TryWrite(address, output);
-    }
-
-    private static bool TryReadByte(CpuContext ctx, ulong address, out byte value)
-    {
-        Span<byte> buffer = stackalloc byte[1];
-        if (!ctx.Memory.TryRead(address, buffer))
-        {
-            value = 0;
-            return false;
-        }
-
-        value = buffer[0];
-        return true;
-    }
-
-    private static bool IsTraceEnabled()
-    {
-        var value = Environment.GetEnvironmentVariable("SHARPEMU_LOG_VIDEODEC2");
-        return string.Equals(value, "1", StringComparison.Ordinal) ||
-               string.Equals(value, "true", StringComparison.OrdinalIgnoreCase);
-    }
-
-    private static bool ShouldTrace(long ordinal) =>
-        TraceEnabled && (ordinal <= 16 || ordinal % 120 == 0);
-
-    private static void TraceDecode(long ordinal, string message)
-    {
-        if (ShouldTrace(ordinal))
-        {
-            Trace($"decode call={ordinal} {message}");
-        }
-    }
-
-    private static void Trace(string message)
-    {
-        if (TraceEnabled)
-        {
-            Console.Error.WriteLine($"[VIDEODEC2][TRACE] {message}");
-        }
-    }
+    private static readonly byte[] NoPicture = [0];
+    private static readonly byte[] PictureReady = [1];
 
     private static int SetReturn(CpuContext ctx, int result)
     {

src/SharpEmu.Libs/CommonDialog/WebBrowserDialogExports.cs

@@ -1,171 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Threading;
-using SharpEmu.HLE;
-
-namespace SharpEmu.Libs.CommonDialog;
-
-/// <summary>
-/// Headless lifecycle for the system web-browser dialog. SharpEmu does not yet
-/// provide a host browser, so an opened dialog completes on its first status
-/// poll instead of leaving games in an infinite RUNNING loop.
-/// </summary>
-public static class WebBrowserDialogExports
-{
-    internal const int StatusNone = 0;
-    internal const int StatusInitialized = 1;
-    internal const int StatusRunning = 2;
-    internal const int StatusFinished = 3;
-
-    private const int ErrorOk = 0;
-    private const int ErrorNotInitialized = unchecked((int)0x80B80003);
-    private const int ErrorNotFinished = unchecked((int)0x80B80005);
-    private const int ErrorNotRunning = unchecked((int)0x80B8000B);
-    private const int ErrorArgNull = unchecked((int)0x80B8000D);
-
-    private static int _status;
-
-    [SysAbiExport(
-        Nid = "jqb7HntFQFc",
-        ExportName = "sceWebBrowserDialogInitialize",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogInitialize(CpuContext ctx)
-    {
-        Interlocked.CompareExchange(ref _status, StatusInitialized, StatusNone);
-        return ctx.SetReturn(ErrorOk);
-    }
-
-    [SysAbiExport(
-        Nid = "FraP7debcdg",
-        ExportName = "sceWebBrowserDialogOpen",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogOpen(CpuContext ctx) => Open(ctx);
-
-    [SysAbiExport(
-        Nid = "O7dIZQrwVFY",
-        ExportName = "sceWebBrowserDialogOpenForPredeterminedContent",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogOpenForPredeterminedContent(CpuContext ctx) => Open(ctx);
-
-    private static int Open(CpuContext ctx)
-    {
-        if (ctx[CpuRegister.Rdi] == 0)
-        {
-            return ctx.SetReturn(ErrorArgNull);
-        }
-
-        if (Volatile.Read(ref _status) == StatusNone)
-        {
-            return ctx.SetReturn(ErrorNotInitialized);
-        }
-
-        Interlocked.Exchange(ref _status, StatusRunning);
-        return ctx.SetReturn(ErrorOk);
-    }
-
-    [SysAbiExport(
-        Nid = "CFTG6a8TjOU",
-        ExportName = "sceWebBrowserDialogGetStatus",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogGetStatus(CpuContext ctx) => ctx.SetReturn(PollStatus());
-
-    [SysAbiExport(
-        Nid = "h1dR-t5ISgg",
-        ExportName = "sceWebBrowserDialogUpdateStatus",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogUpdateStatus(CpuContext ctx) => ctx.SetReturn(PollStatus());
-
-    private static int PollStatus()
-    {
-        Interlocked.CompareExchange(ref _status, StatusFinished, StatusRunning);
-        return Volatile.Read(ref _status);
-    }
-
-    [SysAbiExport(
-        Nid = "PSK+Eik919Q",
-        ExportName = "sceWebBrowserDialogClose",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogClose(CpuContext ctx)
-    {
-        if (Interlocked.CompareExchange(ref _status, StatusFinished, StatusRunning) != StatusRunning)
-        {
-            return ctx.SetReturn(ErrorNotRunning);
-        }
-
-        return ctx.SetReturn(ErrorOk);
-    }
-
-    [SysAbiExport(
-        Nid = "vCaW0fgVQmc",
-        ExportName = "sceWebBrowserDialogGetResult",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogGetResult(CpuContext ctx)
-    {
-        if (ctx[CpuRegister.Rdi] == 0)
-        {
-            return ctx.SetReturn(ErrorArgNull);
-        }
-
-        if (Volatile.Read(ref _status) != StatusFinished)
-        {
-            return ctx.SetReturn(ErrorNotFinished);
-        }
-
-        Span<byte> result = stackalloc byte[sizeof(int)];
-        result.Clear();
-        if (!ctx.Memory.TryWrite(ctx[CpuRegister.Rdi], result))
-        {
-            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-        }
-
-        return ctx.SetReturn(ErrorOk);
-    }
-
-    [SysAbiExport(
-        Nid = "Wit4LjeoeX4",
-        ExportName = "sceWebBrowserDialogGetEvent",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogGetEvent(CpuContext ctx) => ctx.SetReturn(ErrorOk);
-
-    [SysAbiExport(
-        Nid = "uYELOMVnmNQ",
-        ExportName = "sceWebBrowserDialogNavigate",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogNavigate(CpuContext ctx) => ctx.SetReturn(ErrorOk);
-
-    [SysAbiExport(
-        Nid = "RLhKBOoNyXY",
-        ExportName = "sceWebBrowserDialogSetZoom",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogSetZoom(CpuContext ctx) => ctx.SetReturn(ErrorOk);
-
-    [SysAbiExport(
-        Nid = "ocHtyBwHfys",
-        ExportName = "sceWebBrowserDialogTerminate",
-        Target = Generation.Gen4 | Generation.Gen5,
-        LibraryName = "libSceWebBrowserDialog")]
-    public static int WebBrowserDialogTerminate(CpuContext ctx)
-    {
-        if (Interlocked.Exchange(ref _status, StatusNone) == StatusNone)
-        {
-            return ctx.SetReturn(ErrorNotInitialized);
-        }
-
-        return ctx.SetReturn(ErrorOk);
-    }
-
-    internal static int StatusForTests => Volatile.Read(ref _status);
-
-    internal static void ResetForTests() => Interlocked.Exchange(ref _status, StatusNone);
-}

src/SharpEmu.Libs/Diagnostics/DccWriterTrace.cs

@@ -1,74 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Diagnostics;
-using System.Globalization;
-using SharpEmu.Libs.Gpu.Buffers;
-
-namespace SharpEmu.Libs.Diagnostics;
-
-internal static class DccWriterTrace
-{
-    private const int MaxReports = 256;
-    private const int MaxFrames = 12;
-
-    private static readonly bool DccEnabled =
-        Environment.GetEnvironmentVariable("SHARPEMU_TRACE_DCC_WRITERS") == "1";
-
-    private static readonly ulong[] TargetAddresses = (Environment.GetEnvironmentVariable("SHARPEMU_TRACE_WRITER_ADDRESS") ?? string.Empty)
-        .Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
-        .Select(ParseAddress)
-        .Where(address => address != 0)
-        .ToArray();
-
-    public static readonly bool Enabled = DccEnabled || TargetAddresses.Length != 0;
-
-    [ThreadStatic]
-    public static ulong CurrentProgram;
-
-    private static readonly HashSet<(ulong Address, ulong Size, ulong Program)> _reported = new();
-    private static readonly HashSet<(ulong Hash, string Reason)> _refusals = new();
-
-    private static ulong ParseAddress(string? value)
-    {
-        if (string.IsNullOrWhiteSpace(value))
-        {
-            return 0;
-        }
-
-        var text = value.Trim();
-        if (text.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
-        {
-            text = text[2..];
-        }
-
-        return ulong.TryParse(text, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out var parsed) ? parsed : 0;
-    }
-
-    public static void Record(IGuestImageCache images, ulong address, ulong size)
-    {
-        var targeted = TargetAddresses.Any(target => target >= address && target - address < size);
-        if (_reported.Count >= MaxReports || (!targeted && !(DccEnabled && images.OverlapsDccMetadata(address, size))) ||
-            !_reported.Add((address, size, CurrentProgram)))
-        {
-            return;
-        }
-
-        var frames = new StackTrace(1, false).GetFrames();
-        var names = frames.Take(MaxFrames).Select(frame => frame.GetMethod() is { } method
-            ? $"{method.DeclaringType?.Name}.{method.Name}"
-            : "?");
-        Console.Error.WriteLine(
-            $"[GPU][{(targeted ? "TARGET_WRITER" : "DCC_WRITER")}] address=0x{address:X16} size=0x{size:X} program=0x{CurrentProgram:X16} stack={string.Join(" < ", names)}");
-    }
-
-    public static void Refuse(ulong hash, string reason)
-    {
-        if (!Enabled || _refusals.Count >= MaxReports || !_refusals.Add((hash, reason)))
-        {
-            return;
-        }
-
-        Console.Error.WriteLine($"[GPU][BOUNDED_FILL_REFUSED] program=0x{hash:X16} reason={reason}");
-    }
-}

src/SharpEmu.Libs/Diagnostics/GpuReadTrace.cs

@@ -1,59 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-namespace SharpEmu.Libs.Diagnostics;
-
-internal static class GpuReadTrace
-{
-    private const int MaxReports = 64;
-
-    public static readonly bool Enabled =
-        Environment.GetEnvironmentVariable("SHARPEMU_TRACE_GPU_READS") == "1";
-
-    [ThreadStatic]
-    public static ulong CurrentShader;
-
-    [ThreadStatic]
-    public static string? CurrentStage;
-
-    private static readonly HashSet<(ulong Shader, ulong Page, bool Table)> _reported = new();
-    private static readonly Dictionary<ulong, (long Reads, long Changes, uint Last, uint First, ulong Shader)> _values = new();
-    private static long _nextValueReport = System.Diagnostics.Stopwatch.GetTimestamp();
-
-    public static void RecordValue(ulong address, uint word)
-    {
-        lock (_values)
-        {
-            _values[address] = _values.TryGetValue(address, out var entry)
-                ? (entry.Reads + 1, entry.Changes + (entry.Last != word ? 1 : 0), word, entry.First, entry.Shader)
-                : (1, 0, word, word, CurrentShader);
-            var now = System.Diagnostics.Stopwatch.GetTimestamp();
-            if (now < _nextValueReport)
-            {
-                return;
-            }
-
-            _nextValueReport = now + System.Diagnostics.Stopwatch.Frequency * 5;
-            foreach (var (key, value) in _values.OrderByDescending(pair => pair.Value.Reads).Take(16))
-            {
-                Console.Error.WriteLine(
-                    $"[GPU][SYNC_READ_VALUE] address=0x{key:X16} reads={value.Reads} changes={value.Changes} first=0x{value.First:X8} last=0x{value.Last:X8} shader=0x{value.Shader:X16}");
-            }
-        }
-    }
-
-    public static void Record(ulong address, bool table)
-    {
-        var key = (CurrentShader, address & ~0xFFFUL, table);
-        lock (_reported)
-        {
-            if (_reported.Count >= MaxReports || !_reported.Add(key))
-            {
-                return;
-            }
-        }
-
-        Console.Error.WriteLine(
-            $"[GPU][SYNC_READ] shader=0x{CurrentShader:X16} stage={CurrentStage} address=0x{address:X16} table={table}");
-    }
-}

src/SharpEmu.Libs/Diagnostics/RazorCpuExports.cs

@@ -1,17 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using SharpEmu.HLE;
-
-namespace SharpEmu.Libs.Diagnostics;
-
-public static class RazorCpuExports
-{
-    [SysAbiExport(Nid = "zw+celG7zSI", ExportName = "sceRazorCpuPushMarker",
-        Target = Generation.Gen5, LibraryName = "libSceRazorCpu")]
-    public static int PushMarker(CpuContext ctx) => ctx.SetReturn(0);
-
-    [SysAbiExport(Nid = "YpkGsMXP3ew", ExportName = "sceRazorCpuPopMarker",
-        Target = Generation.Gen5, LibraryName = "libSceRazorCpu")]
-    public static int PopMarker(CpuContext ctx) => ctx.SetReturn(0);
-}

src/SharpEmu.Libs/Fiber/FiberExports.cs

@@ -49,7 +49,6 @@ public static class FiberExports
     private const int FiberMagicEndOffset = 104;
 
     private static int _contextSizeCheck;
-    private static readonly bool TraceEnabled = Environment.GetEnvironmentVariable("SHARPEMU_LOG_FIBER") == "1";
 
     private static readonly object _fiberGate = new();
     private static readonly ConcurrentDictionary<ulong, FiberContinuation> _continuations = new();
@@ -288,10 +287,9 @@ public static class FiberExports
 
         _ = GuestThreadExecution.EnterFiber(0);
         GuestThreadExecution.RequestCurrentContextTransfer(transferTarget);
-        if (TraceEnabled)
-            TraceFiber(
-                $"return-to-thread fiber=0x{fiberAddress:X16} " +
-                $"resume=0x{transferTarget.Rip:X16} rsp=0x{transferTarget.Rsp:X16} arg=0x{returnArgument:X16}");
+        TraceFiber(
+            $"return-to-thread fiber=0x{fiberAddress:X16} " +
+            $"resume=0x{transferTarget.Rip:X16} rsp=0x{transferTarget.Rsp:X16} arg=0x{returnArgument:X16}");
         return SetReturn(ctx, 0);
     }
 
@@ -308,7 +306,13 @@ public static class FiberExports
             return SetReturn(ctx, FiberErrorNull);
         }
 
-        return TryWriteUInt64(ctx, outAddress, ResolveCurrentFiberAddress(ctx))
+        var fiberAddress = ResolveCurrentFiberAddress(ctx);
+        if (fiberAddress == 0)
+        {
+            return SetReturn(ctx, FiberErrorPermission);
+        }
+
+        return TryWriteUInt64(ctx, outAddress, fiberAddress)
             ? SetReturn(ctx, 0)
             : SetReturn(ctx, FiberErrorInvalid);
     }
@@ -337,7 +341,7 @@ public static class FiberExports
             return SetReturn(ctx, FiberErrorInvalid);
         }
 
-        if (!TryReadFiberFields(ctx, fiber, out var fields, readName: true))
+        if (!TryReadFiberFields(ctx, fiber, out var fields))
         {
             return SetReturn(ctx, FiberErrorInvalid);
         }
@@ -523,10 +527,9 @@ public static class FiberExports
             _stackRanges[fiber] = new FiberStackRange(contextAddress, contextSize);
         }
 
-        if (TraceEnabled)
-            TraceFiber(
-                $"init fiber=0x{fiber:X16} entry=0x{entry:X16} ctx=0x{contextAddress:X16} " +
-                $"size=0x{contextSize:X} flags=0x{flags:X} build=0x{buildVersion:X8} name='{name}'");
+        TraceFiber(
+            $"init fiber=0x{fiber:X16} entry=0x{entry:X16} ctx=0x{contextAddress:X16} " +
+            $"size=0x{contextSize:X} flags=0x{flags:X} build=0x{buildVersion:X8} name='{name}'");
         return SetReturn(ctx, 0);
     }
 
@@ -586,8 +589,7 @@ public static class FiberExports
             }
             if (fields.State != FiberStateIdle)
             {
-                if (TraceEnabled)
-                    TraceFiber($"run-state-error reason={reason} fiber=0x{fiber:X16} state=0x{fields.State:X8}");
+                TraceFiber($"run-state-error reason={reason} fiber=0x{fiber:X16} state=0x{fields.State:X8}");
                 return SetReturn(ctx, FiberErrorState);
             }
 
@@ -674,10 +676,9 @@ public static class FiberExports
 
         _ = GuestThreadExecution.EnterFiber(fiber);
         GuestThreadExecution.RequestCurrentContextTransfer(transferTarget);
-        if (TraceEnabled)
-            TraceFiber(
-                $"transfer reason={reason} from=0x{previousFiber:X16} to=0x{fiber:X16} resume={resumed} " +
-                $"rip=0x{transferTarget.Rip:X16} rsp=0x{transferTarget.Rsp:X16} arg=0x{argOnRun:X16}");
+        TraceFiber(
+            $"transfer reason={reason} from=0x{previousFiber:X16} to=0x{fiber:X16} resume={resumed} " +
+            $"rip=0x{transferTarget.Rip:X16} rsp=0x{transferTarget.Rsp:X16} arg=0x{argOnRun:X16}");
         return SetReturn(ctx, 0);
     }
 
@@ -976,7 +977,7 @@ public static class FiberExports
         return true;
     }
 
-    private static bool TryReadFiberFields(CpuContext ctx, ulong fiber, out FiberFields fields, bool readName = false)
+    private static bool TryReadFiberFields(CpuContext ctx, ulong fiber, out FiberFields fields)
     {
         fields = default;
         if (!TryReadUInt32(ctx, fiber + FiberStateOffset, out var state) ||
@@ -985,7 +986,7 @@ public static class FiberExports
             !TryReadUInt64(ctx, fiber + FiberContextAddressOffset, out var contextAddress) ||
             !TryReadUInt64(ctx, fiber + FiberContextSizeOffset, out var contextSize) ||
             !TryReadUInt32(ctx, fiber + FiberFlagsOffset, out var flags) ||
-            !TryReadInlineName(ctx, fiber + FiberNameOffset, out var name, decode: readName))
+            !TryReadInlineName(ctx, fiber + FiberNameOffset, out var name))
         {
             return false;
         }
@@ -1070,7 +1071,7 @@ public static class FiberExports
         return ctx.Memory.TryWrite(address, buffer);
     }
 
-    private static bool TryReadInlineName(CpuContext ctx, ulong address, out string value, bool decode)
+    private static bool TryReadInlineName(CpuContext ctx, ulong address, out string value)
     {
         Span<byte> buffer = stackalloc byte[MaxNameLength + 1];
         if (!ctx.Memory.TryRead(address, buffer))
@@ -1085,9 +1086,7 @@ public static class FiberExports
             length = buffer.Length;
         }
 
-        // A switch validates the same bytes but does not need a managed name.
-        // Only sceFiberGetInfo exposes the decoded name to its caller.
-        value = decode ? Encoding.UTF8.GetString(buffer[..length]) : string.Empty;
+        value = Encoding.UTF8.GetString(buffer[..length]);
         return true;
     }
 
@@ -1124,7 +1123,10 @@ public static class FiberExports
 
     private static void TraceFiber(string message)
     {
-        Console.Error.WriteLine($"[LOADER][TRACE] fiber.{message}");
+        if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_FIBER"), "1", StringComparison.Ordinal))
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] fiber.{message}");
+        }
     }
 
     private readonly record struct FiberFields(

src/SharpEmu.Libs/Font/FontExports.cs

@@ -2,10 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using System.Buffers.Binary;
-using System.Collections.Concurrent;
-using System.Text;
 using SharpEmu.HLE;
-using SkiaSharp;
 
 namespace SharpEmu.Libs.Font;
 
@@ -19,38 +16,6 @@ public static class FontExports
     private static readonly Stack<ulong> FreeGlyphs = new();
     private static ulong _librarySelectionAddress;
     private static ulong _rendererSelectionAddress;
-    private static readonly ConcurrentDictionary<ulong, (float Width, float Height)> FontScales = new();
-    private static readonly ConcurrentDictionary<ulong, FontFace> FontFaces = new();
-    private static readonly Lazy<FontFace> DefaultFont = new(() => new(SKTypeface.FromFamilyName(null)));
-
-    [SysAbiExport(
-        Nid = "oaJ1BpN2FQk",
-        ExportName = "sceFontTextSourceInit",
-        Target = Generation.Gen5,
-        LibraryName = "libSceFont")]
-    public static int TextSourceInit(CpuContext ctx)
-    {
-        var sourceAddress = ctx[CpuRegister.Rdi];
-        var textAddress = ctx[CpuRegister.Rsi];
-        var textSize = (uint)ctx[CpuRegister.Rdx];
-        if (sourceAddress == 0 || textAddress > ulong.MaxValue - textSize)
-        {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
-        }
-
-        Span<byte> source = stackalloc byte[0x60];
-        source.Clear();
-        BinaryPrimitives.WriteUInt64LittleEndian(source[0x08..], textAddress);
-        BinaryPrimitives.WriteUInt64LittleEndian(source[0x10..], textAddress == 0 ? 0 : textAddress + textSize);
-        BinaryPrimitives.WriteUInt64LittleEndian(source[0x18..], textAddress);
-        BinaryPrimitives.WriteUInt64LittleEndian(source[0x20..], ctx[CpuRegister.Rcx]);
-        BinaryPrimitives.WriteUInt64LittleEndian(source[0x28..], ctx[CpuRegister.R8]);
-        BinaryPrimitives.WriteUInt64LittleEndian(source[0x38..], 0x10);
-        BinaryPrimitives.WriteUInt64LittleEndian(source[0x40..], textSize);
-        return ctx.Memory.TryWrite(sourceAddress, source)
-            ? SetSuccess(ctx)
-            : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-    }
 
     [SysAbiExport(
         Nid = "whrS4oksXc4",
@@ -133,7 +98,7 @@ public static class FontExports
         ExportName = "sceFontSetScalePixel",
         Target = Generation.Gen5,
         LibraryName = "libSceFont")]
-    public static int SetScalePixel(CpuContext ctx) => SetFontHeight(ctx);
+    public static int SetScalePixel(CpuContext ctx) => SetSuccess(ctx);
 
     [SysAbiExport(
         Nid = "TMtqoFQjjbA",
@@ -154,7 +119,7 @@ public static class FontExports
         ExportName = "sceFontSetupRenderScalePixel",
         Target = Generation.Gen5,
         LibraryName = "libSceFont")]
-    public static int SetupRenderScalePixel(CpuContext ctx) => SetFontHeight(ctx);
+    public static int SetupRenderScalePixel(CpuContext ctx) => SetSuccess(ctx);
 
     [SysAbiExport(
         Nid = "lz9y9UFO2UU",
@@ -179,22 +144,13 @@ public static class FontExports
     {
         var layoutAddress = ctx[CpuRegister.Rsi];
         if (layoutAddress == 0)
-        {
-            layoutAddress = ctx[CpuRegister.Rdx];
-        }
-        if (layoutAddress == 0)
         {
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
-        var fontHandle = ctx[CpuRegister.Rdi];
-        var scale = GetFontScale(fontHandle);
-        float[] values = [scale.Height * 0.75f, scale.Height, 0];
-        if (FontFaces.TryGetValue(fontHandle, out var face))
-        {
-            var metrics = face.GetMetrics(scale.Width, scale.Height);
-            values = [-metrics.Ascent, metrics.Descent - metrics.Ascent + metrics.Leading, 0];
-        }
+        // Baseline, line advance, decoration extent: the same invented geometry
+        // as GetRenderCharGlyphMetrics.
+        var values = new[] { 12.0f, 16.0f, 0.0f };
         for (var index = 0; index < values.Length; index++)
         {
             if (!TryWriteUInt32(
@@ -218,10 +174,6 @@ public static class FontExports
     {
         var layoutAddress = ctx[CpuRegister.Rsi];
         if (layoutAddress == 0)
-        {
-            layoutAddress = ctx[CpuRegister.Rdx];
-        }
-        if (layoutAddress == 0)
         {
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
@@ -229,10 +181,7 @@ public static class FontExports
         // Baseline (horizontal offset), line advance, decoration extent.
         // Mirrors the same three-float layout as GetHorizontalLayout, but
         // interpreted for vertical writing (e.g. CJK text rendered top-to-bottom).
-        // Scaled to the font's current pixel height; the default height of 16
-        // reproduces the original fixed geometry.
-        var scale = GetFontScale(ctx[CpuRegister.Rdi]);
-        var values = new[] { scale.Width * 0.5f, scale.Width, 0.0f };
+        var values = new[] { 8.0f, 16.0f, 0.0f };
         for (var index = 0; index < values.Length; index++)
         {
             if (!TryWriteUInt32(
@@ -252,64 +201,16 @@ public static class FontExports
         ExportName = "sceFontOpenFontSet",
         Target = Generation.Gen5,
         LibraryName = "libSceFont")]
-    public static int OpenFontSet(CpuContext ctx)
-    {
-        var fontSet = (uint)ctx[CpuRegister.Rsi];
-        var bold = (fontSet & 0xf) >= 7;
-        var italic = ((fontSet >> 20) & 0xf) == 1;
-        var style = bold ? (italic ? SKFontStyle.BoldItalic : SKFontStyle.Bold) :
-            (italic ? SKFontStyle.Italic : SKFontStyle.Normal);
-        return OpenFace(ctx, new(SKTypeface.FromFamilyName(null, style)));
-    }
+    public static int OpenFontSet(CpuContext ctx) =>
+        CreateOpaqueHandle(ctx, ctx[CpuRegister.R8], 0x100, magic: 0x0F02);
 
     [SysAbiExport(
         Nid = "KXUpebrFk1U",
         ExportName = "sceFontOpenFontMemory",
         Target = Generation.Gen5,
         LibraryName = "libSceFont")]
-    public static int OpenFontMemory(CpuContext ctx)
-    {
-        var address = ctx[CpuRegister.Rsi];
-        var size = (uint)ctx[CpuRegister.Rdx];
-        if (address == 0 || size is < 12 or > 64 * 1024 * 1024 || ctx[CpuRegister.R8] == 0)
-        {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
-        }
-        if (!ctx.Memory.CanRead(address, size))
-        {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-        }
-        var bytes = new byte[(int)size];
-        if (!ctx.Memory.TryRead(address, bytes))
-        {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-        }
-        uint index = 0;
-        if (ctx[CpuRegister.Rcx] != 0 && !ctx.TryReadUInt32(ctx[CpuRegister.Rcx] + 8, out index))
-        {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-        }
-        if (index > int.MaxValue)
-        {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
-        }
-        using var data = SKData.CreateCopy(bytes);
-        var typeface = SKTypeface.FromData(data, (int)index);
-        return typeface is null
-            ? SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT)
-            : OpenFace(ctx, new(typeface));
-    }
-
-    private static int OpenFace(CpuContext ctx, FontFace face)
-    {
-        var result = CreateOpaqueHandle(ctx, ctx[CpuRegister.R8], 0x100, magic: 0x0F02);
-        if (result == 0 && ctx.TryReadUInt64(ctx[CpuRegister.R8], out var handle))
-        {
-            FontFaces[handle] = face;
-            FontScales.TryRemove(handle, out _);
-        }
-        return result;
-    }
+    public static int OpenFontMemory(CpuContext ctx) =>
+        CreateOpaqueHandle(ctx, ctx[CpuRegister.R8], 0x100, magic: 0x0F02);
 
     [SysAbiExport(
         Nid = "JzCH3SCFnAU",
@@ -328,8 +229,6 @@ public static class FontExports
 
         if (setupHandle != 0)
         {
-            if (FontFaces.TryGetValue(sourceHandle, out var face)) FontFaces[setupHandle] = face;
-            FontScales[setupHandle] = GetFontScale(sourceHandle);
             return ctx.TryWriteUInt64(outputAddress, setupHandle)
                 ? SetSuccess(ctx)
                 : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
@@ -350,8 +249,6 @@ public static class FontExports
         }
 
         _ = TryWriteUInt16(ctx, handle, 0x0F02);
-        if (FontFaces.TryGetValue(sourceHandle, out var sourceFace)) FontFaces[handle] = sourceFace;
-        FontScales[handle] = GetFontScale(sourceHandle);
         return ctx.TryWriteUInt64(outputAddress, handle)
             ? SetSuccess(ctx)
             : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
@@ -391,11 +288,19 @@ public static class FontExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
-        var code = (uint)ctx[CpuRegister.Rsi];
-        if (!IsValidCode(code)) return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
-        return WriteGlyphMetrics(ctx, metricsAddress, GetGlyph(ctx[CpuRegister.Rdi], code), GetFontScale(ctx[CpuRegister.Rdi]).Height)
-            ? SetSuccess(ctx)
-            : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        var values = new[] { 8.0f, 16.0f, 0.0f, 12.0f, 8.0f, 0.0f, 0.0f, 16.0f };
+        for (var index = 0; index < values.Length; index++)
+        {
+            if (!TryWriteUInt32(
+                    ctx,
+                    metricsAddress + (ulong)(index * sizeof(float)),
+                    BitConverter.SingleToUInt32Bits(values[index])))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+        }
+
+        return SetSuccess(ctx);
     }
 
     [SysAbiExport(
@@ -462,26 +367,6 @@ public static class FontExports
         return SetSuccess(ctx);
     }
 
-    [SysAbiExport(
-        Nid = "vRxf4d0ulPs",
-        ExportName = "sceFontRenderSurfaceSetScissor",
-        Target = Generation.Gen5, LibraryName = "libSceFont")]
-    public static int RenderSurfaceSetScissor(CpuContext ctx)
-    {
-        var surfaceAddress = ctx[CpuRegister.Rdi];
-        if (surfaceAddress == 0)
-        {
-            return SetSuccess(ctx);
-        }
-
-        return TryWriteUInt32(ctx, surfaceAddress + 0x18, (uint)ctx[CpuRegister.Rsi]) &&
-            TryWriteUInt32(ctx, surfaceAddress + 0x1C, (uint)ctx[CpuRegister.Rdx]) &&
-            TryWriteUInt32(ctx, surfaceAddress + 0x20, (uint)ctx[CpuRegister.Rcx]) &&
-            TryWriteUInt32(ctx, surfaceAddress + 0x24, (uint)ctx[CpuRegister.R8])
-                ? SetSuccess(ctx)
-                : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-    }
-
     [SysAbiExport(
         Nid = "C-4Qw5Srlyw",
         ExportName = "sceFontGenerateCharGlyph",
@@ -549,171 +434,43 @@ public static class FontExports
         LibraryName = "libSceFont")]
     public static int RenderCharGlyphImageHorizontal(CpuContext ctx)
     {
-        var surfaceAddress = ctx[CpuRegister.Rdx];
         var metricsAddress = ctx[CpuRegister.Rcx];
         var resultAddress = ctx[CpuRegister.R8];
-        var font = ctx[CpuRegister.Rdi];
-        var code = (uint)ctx[CpuRegister.Rsi];
-        if (!IsValidCode(code)) return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
-        var glyph = GetGlyph(font, code);
-        var width = glyph.Width;
-        var height = glyph.Height;
 
-        if (metricsAddress != 0 && !WriteGlyphMetrics(ctx, metricsAddress, glyph, GetFontScale(font).Height))
+        if (metricsAddress != 0)
         {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            var values = new[] { 8.0f, 16.0f, 0.0f, 12.0f, 8.0f, 0.0f, 0.0f, 16.0f };
+            for (var index = 0; index < values.Length; index++)
+            {
+                if (!TryWriteUInt32(
+                        ctx,
+                        metricsAddress + (ulong)(index * sizeof(float)),
+                        BitConverter.SingleToUInt32Bits(values[index])))
+                {
+                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+            }
         }
 
-        ctx.GetXmmRegister(0, out var xBits, out _);
-        ctx.GetXmmRegister(1, out var yBits, out _);
-        var x = BitConverter.UInt32BitsToSingle((uint)xBits);
-        var y = BitConverter.UInt32BitsToSingle((uint)yBits);
-        var left = float.IsFinite(x) ? (int)MathF.Floor(x + glyph.BearingX) : 0;
-        var top = float.IsFinite(y) ? (int)MathF.Floor(y - glyph.BearingY) : 0;
-
-        ulong buffer = 0;
-        uint pitch = 0;
-        uint pixelSize = 0;
         if (resultAddress != 0)
         {
-            Span<byte> result = stackalloc byte[RenderOutputSize];
-            result.Clear();
-            if (surfaceAddress != 0 && ctx.TryReadUInt64(surfaceAddress, out buffer) &&
-                ctx.TryReadUInt32(surfaceAddress + 8, out pitch) &&
-                ctx.TryReadUInt32(surfaceAddress + 12, out pixelSize))
-            {
-                BinaryPrimitives.WriteUInt64LittleEndian(result[8..], buffer);
-                BinaryPrimitives.WriteUInt32LittleEndian(result[16..], pitch);
-                result[20] = (byte)pixelSize;
-            }
-            BinaryPrimitives.WriteUInt32LittleEndian(result[24..], (uint)Math.Max(left, 0));
-            BinaryPrimitives.WriteUInt32LittleEndian(result[28..], (uint)Math.Max(top, 0));
-            BinaryPrimitives.WriteUInt32LittleEndian(result[32..], (uint)Math.Max(width + Math.Min(left, 0), 0));
-            BinaryPrimitives.WriteUInt32LittleEndian(result[36..], (uint)Math.Max(height + Math.Min(top, 0), 0));
-            BinaryPrimitives.WriteSingleLittleEndian(result[40..], glyph.BearingX);
-            BinaryPrimitives.WriteSingleLittleEndian(result[44..], glyph.BearingY);
-            BinaryPrimitives.WriteSingleLittleEndian(result[48..], glyph.Advance);
-            BinaryPrimitives.WriteSingleLittleEndian(result[52..], glyph.Advance);
-            BinaryPrimitives.WriteUInt32LittleEndian(result[56..], (uint)width);
-            BinaryPrimitives.WriteUInt32LittleEndian(result[60..], (uint)height);
-            if (!ctx.Memory.TryWrite(resultAddress, result))
+            Span<byte> cleared = stackalloc byte[RenderOutputSize];
+            cleared.Clear();
+            if (!ctx.Memory.TryWrite(resultAddress, cleared))
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
         }
 
-        if (surfaceAddress != 0 && !DrawGlyph(ctx, surfaceAddress, left, top, width, height, glyph.Coverage))
-        {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-        }
-
         return SetSuccess(ctx);
     }
 
-    private static int SetFontHeight(CpuContext ctx)
-    {
-        ctx.GetXmmRegister(0, out var widthBits, out _);
-        ctx.GetXmmRegister(1, out var heightBits, out _);
-        var width = BitConverter.UInt32BitsToSingle((uint)widthBits);
-        var height = BitConverter.UInt32BitsToSingle((uint)heightBits);
-        if (float.IsFinite(height) && height > 1)
-        {
-            FontScales[ctx[CpuRegister.Rdi]] = (
-                float.IsFinite(width) && width > 1 ? Math.Clamp(width, 8, 128) : Math.Clamp(height, 8, 128),
-                Math.Clamp(height, 8, 128));
-        }
-        return SetSuccess(ctx);
-    }
-
-    private static (float Width, float Height) GetFontScale(ulong font) =>
-        FontScales.TryGetValue(font, out var scale) ? scale : (16, 16);
-
-    private static bool IsValidCode(uint code) => (code & 0xffff0000) == 0x80000000 || Rune.IsValid((int)code);
-
-    private static FontGlyph GetGlyph(ulong font, uint code)
-    {
-        var scale = GetFontScale(font);
-        return (FontFaces.TryGetValue(font, out var face) ? face : DefaultFont.Value).GetGlyph(code, scale.Width, scale.Height);
-    }
-
-    private static bool WriteGlyphMetrics(CpuContext ctx, ulong address, FontGlyph glyph, float height)
-    {
-        Span<byte> metrics = stackalloc byte[32];
-        float[] values = [glyph.Width, glyph.Height, glyph.BearingX, glyph.BearingY, glyph.Advance, 0, 0, height];
-        for (var index = 0; index < values.Length; index++)
-        {
-            BinaryPrimitives.WriteSingleLittleEndian(metrics[(index * 4)..], values[index]);
-        }
-        return ctx.Memory.TryWrite(address, metrics);
-    }
-
-    internal static bool DrawGlyph(CpuContext ctx, ulong surface, int left, int top,
-        int glyphWidth, int glyphHeight, byte[] coverage)
-    {
-        if (!ctx.TryReadUInt64(surface, out var buffer) ||
-            !ctx.TryReadUInt32(surface + 8, out var pitch) ||
-            !ctx.TryReadUInt32(surface + 12, out var pixelSize) ||
-            !ctx.TryReadUInt32(surface + 16, out var width) ||
-            !ctx.TryReadUInt32(surface + 20, out var height) ||
-            !ctx.TryReadUInt32(surface + 24, out var sx0) ||
-            !ctx.TryReadUInt32(surface + 28, out var sy0) ||
-            !ctx.TryReadUInt32(surface + 32, out var sx1) ||
-            !ctx.TryReadUInt32(surface + 36, out var sy1))
-        {
-            return false;
-        }
-        pixelSize &= 0xff;
-        if (buffer == 0 || pixelSize is < 1 or > 4 || pitch == 0 || width == 0 || height == 0)
-        {
-            return true;
-        }
-
-        var x0 = Math.Max(left, (int)Math.Min(sx0, width));
-        var y0 = Math.Max(top, (int)Math.Min(sy0, height));
-        var x1 = Math.Min(left + glyphWidth, (int)Math.Min(sx1, width));
-        var y1 = Math.Min(top + glyphHeight, (int)Math.Min(sy1, height));
-        if (x0 >= x1 || y0 >= y1 || (ulong)x1 * pixelSize > pitch)
-        {
-            return true;
-        }
-
-        var line = new byte[(x1 - x0) * pixelSize];
-        for (var yy = y0; yy < y1; yy++)
-        {
-            var address = buffer + (ulong)yy * pitch + (ulong)x0 * pixelSize;
-            if (!ctx.Memory.TryRead(address, line))
-            {
-                return false;
-            }
-            for (var xx = x0; xx < x1; xx++)
-            {
-                var alpha = coverage[(yy - top) * glyphWidth + xx - left];
-                if (alpha != 0)
-                {
-                    var pixel = line.AsSpan((xx - x0) * (int)pixelSize, (int)pixelSize);
-                    for (var component = 0; component < pixel.Length; component++)
-                        pixel[component] = (byte)(alpha + (pixel[component] * (255 - alpha) + 127) / 255);
-                }
-            }
-            if (!ctx.Memory.TryWrite(address, line))
-            {
-                return false;
-            }
-        }
-        return true;
-    }
-
     [SysAbiExport(
         Nid = "vzHs3C8lWJk",
         ExportName = "sceFontCloseFont",
         Target = Generation.Gen5,
         LibraryName = "libSceFont")]
-    public static int CloseFont(CpuContext ctx)
-    {
-        FontFaces.TryRemove(ctx[CpuRegister.Rdi], out _);
-        FontScales.TryRemove(ctx[CpuRegister.Rdi], out _);
-        return SetSuccess(ctx);
-    }
+    public static int CloseFont(CpuContext ctx) => SetSuccess(ctx);
 
     [SysAbiExport(
         Nid = "1QjhKxrsOB8",

src/SharpEmu.Libs/Font/FontFace.cs

@@ -1,74 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Collections.Concurrent;
-using System.Runtime.InteropServices;
-using SkiaSharp;
-
-namespace SharpEmu.Libs.Font;
-
-internal sealed class FontFace(SKTypeface typeface)
-{
-    private readonly ConcurrentDictionary<(uint Code, float Width, float Height), FontGlyph> _glyphs = new();
-
-    public SKFontMetrics GetMetrics(float width, float height)
-    {
-        using var font = CreateFont(width, height);
-        return font.Metrics;
-    }
-
-    public FontGlyph GetGlyph(uint code, float width, float height)
-    {
-        // ponytail: bounded working set; clearing avoids retaining every glyph at every scale.
-        if (_glyphs.Count >= 1024) _glyphs.Clear();
-        return _glyphs.GetOrAdd((code, width, height), key => Rasterize(key.Code, key.Width, key.Height));
-    }
-
-    private SKFont CreateFont(float width, float height) => new(typeface, height, width / height)
-    {
-        Edging = SKFontEdging.Antialias,
-        Subpixel = false,
-    };
-
-    private FontGlyph Rasterize(uint code, float width, float height)
-    {
-        using var font = CreateFont(width, height);
-        var glyph = (code & 0x80000000) != 0 ? (ushort)code : font.GetGlyph((int)code);
-        if (glyph == 0 && (code & 0x80000000) == 0)
-        {
-            // System font sets span multiple faces. Resolve by Unicode coverage, not language.
-            var fallback = SKFontManager.Default.MatchCharacter(typeface.FamilyName, typeface.FontStyle, null, (int)code);
-            if (fallback is not null)
-            {
-                font.Typeface = fallback;
-                glyph = font.GetGlyph((int)code);
-            }
-        }
-
-        ReadOnlySpan<ushort> glyphs = [glyph];
-        var advance = font.MeasureText(glyphs, out var bounds);
-        var left = (int)MathF.Floor(bounds.Left);
-        var top = (int)MathF.Floor(bounds.Top);
-        var bitmapWidth = (int)MathF.Ceiling(bounds.Right) - left;
-        var bitmapHeight = (int)MathF.Ceiling(bounds.Bottom) - top;
-        if (bitmapWidth <= 0 || bitmapHeight <= 0)
-        {
-            return new(0, 0, left, -top, advance, []);
-        }
-
-        using var bitmap = new SKBitmap(bitmapWidth, bitmapHeight, SKColorType.Alpha8, SKAlphaType.Premul);
-        using var canvas = new SKCanvas(bitmap);
-        using var paint = new SKPaint { Color = SKColors.White, IsAntialias = true };
-        using var blob = SKTextBlob.Create(MemoryMarshal.AsBytes(glyphs), SKTextEncoding.GlyphId, font);
-        canvas.Clear(SKColors.Transparent);
-        canvas.DrawText(blob!, -left, -top, paint);
-        var coverage = new byte[bitmapWidth * bitmapHeight];
-        for (var row = 0; row < bitmapHeight; row++)
-        {
-            Marshal.Copy(bitmap.GetPixels() + row * bitmap.RowBytes, coverage, row * bitmapWidth, bitmapWidth);
-        }
-        return new(bitmapWidth, bitmapHeight, left, -top, advance, coverage);
-    }
-}
-
-internal sealed record FontGlyph(int Width, int Height, float BearingX, float BearingY, float Advance, byte[] Coverage);

src/SharpEmu.Libs/Gpu/Buffers/BdaFaultProcessor.cs

@@ -17,7 +17,6 @@ public sealed unsafe class BdaFaultProcessor : IDisposable
     private const uint MaxPageFaults = 1024;
     private const ulong PageFaultAreaSize = MaxPageFaults * sizeof(ulong);
 
-    private static long _reportedFaults;
     private readonly GpuDeviceInfo _device;
     private readonly SubmissionScheduler _scheduler;
     private readonly GuestBufferCache _cache;
@@ -250,11 +249,7 @@ public sealed unsafe class BdaFaultProcessor : IDisposable
                 if (SharpEmu.HLE.GpuMemory.GuestGpuMemoryHook.Traces(faults[index], _pageSize))
                     SharpEmu.HLE.GpuMemory.GuestGpuMemoryHook.Trace(faults[index], _pageSize,
                         $"device-address-fault scan_tick={scanTick} callback_tick={_scheduler.CurrentTick} registered={_cache.IsRegionRegistered(faults[index], _pageSize)} reported_count={(uint)faults[0]} retained_count={count}");
-                var reported = Interlocked.Increment(ref _reportedFaults);
-                if (reported <= 16 || (reported & (reported - 1)) == 0)
-                {
-                    Console.Error.WriteLine($"[GPU][INFO] Accessed non-GPU cached memory at 0x{faults[index]:X16} count={reported}");
-                }
+                Console.Error.WriteLine($"[GPU][INFO] Accessed non-GPU cached memory at 0x{faults[index]:X16}");
             }
 
             _faultRanges.ForEach((start, size) =>

src/SharpEmu.Libs/Gpu/Buffers/GpuBuffer.cs

@@ -9,8 +9,7 @@ using VkBuffer = Silk.NET.Vulkan.Buffer;
 
 namespace SharpEmu.Libs.Gpu.Buffers;
 
-// One Vulkan buffer, mapped when host-visible. Small buffers share slab chunks (GpuMemorySlabs);
-// larger ones get a dedicated allocation.
+// One Vulkan buffer with its own dedicated allocation, mapped when host-visible.
 public unsafe class GpuBuffer : IDisposable
 {
     public const BufferUsageFlags ReadFlags =
@@ -29,12 +28,8 @@ public unsafe class GpuBuffer : IDisposable
     private readonly ulong _deviceAddress;
     private VkBuffer _handle;
     private DeviceMemory _memory;
-    private readonly ulong _memoryOffset;
-    private readonly GpuMemorySlabs.Block? _slab;
 
-    // allowSlab: the caller records on the scheduler's current command buffer, which clears a recycled slab block.
-    public GpuBuffer(GpuDeviceInfo device, SubmissionScheduler scheduler, GpuBufferUsage usage, ulong cpuAddress, BufferUsageFlags flags, ulong size,
-        bool allowSlab = false)
+    public GpuBuffer(GpuDeviceInfo device, SubmissionScheduler scheduler, GpuBufferUsage usage, ulong cpuAddress, BufferUsageFlags flags, ulong size)
     {
         if (size == 0)
         {
@@ -48,23 +43,14 @@ public unsafe class GpuBuffer : IDisposable
         Size = size;
 
         var vk = device.Vk;
-        var sharedFamilies = device.SharedQueueFamilies;
-        fixed (uint* families = sharedFamilies)
+        var bufferInfo = new BufferCreateInfo
         {
-            // Buffers carry no layout, so concurrent sharing lets the readback queue copy
-            // them without queue-family ownership transfers at no cost to other queues.
-            var bufferInfo = new BufferCreateInfo
-            {
-                SType = StructureType.BufferCreateInfo,
-                Size = size,
-                Usage = flags,
-                SharingMode = sharedFamilies is { Length: > 1 } ? SharingMode.Concurrent : SharingMode.Exclusive,
-                QueueFamilyIndexCount = sharedFamilies is { Length: > 1 } ? (uint)sharedFamilies.Length : 0,
-                PQueueFamilyIndices = sharedFamilies is { Length: > 1 } ? families : null,
-            };
-            RequireSuccess(vk.CreateBuffer(device.Device, &bufferInfo, null, out _handle), "vkCreateBuffer");
-        }
-
+            SType = StructureType.BufferCreateInfo,
+            Size = size,
+            Usage = flags,
+            SharingMode = SharingMode.Exclusive,
+        };
+        RequireSuccess(vk.CreateBuffer(device.Device, &bufferInfo, null, out _handle), "vkCreateBuffer");
         vk.GetBufferMemoryRequirements(device.Device, _handle, out var requirements);
         var withAddress = (flags & BufferUsageFlags.ShaderDeviceAddressBit) != 0;
         var flagsInfo = new MemoryAllocateFlagsInfo
@@ -81,43 +67,23 @@ public unsafe class GpuBuffer : IDisposable
 
         // The best-scored type first; a full heap falls through to the next candidate.
         var result = Result.ErrorOutOfDeviceMemory;
-        var candidates = RankMemoryTypes(device, requirements.MemoryTypeBits, usage).ToArray();
-        if (allowSlab && GpuMemorySlabs.Fits(requirements))
+        foreach (var candidate in RankMemoryTypes(device, requirements.MemoryTypeBits, usage))
         {
-            foreach (var candidate in candidates)
+            allocateInfo.MemoryTypeIndex = candidate;
+            result = device.AllocateMemory(allocateInfo, out _memory);
+            if (result == Result.Success)
             {
-                if (device.Slabs.TryAllocate(candidate, withAddress, requirements, out var block))
-                {
-                    _slab = block;
-                    _memory = block.Memory;
-                    _memoryOffset = block.Offset;
-                    _mapped = block.Mapped;
-                    allocateInfo.MemoryTypeIndex = candidate;
-                    result = Result.Success;
-                    break;
-                }
-            }
-        }
-
-        if (_slab is null)
-        {
-            foreach (var candidate in candidates)
-            {
-                allocateInfo.MemoryTypeIndex = candidate;
-                result = device.AllocateMemory(allocateInfo, out _memory);
-                if (result == Result.Success)
-                {
-                    break;
-                }
+                break;
             }
         }
 
         RequireSuccess(result, $"vkAllocateMemory({usage}, 0x{size:X} bytes)");
-        RequireSuccess(vk.BindBufferMemory(device.Device, _handle, _memory, _memoryOffset), "vkBindBufferMemory");
-        _allocationSize = _slab?.Size ?? requirements.Size;
+        RequireSuccess(vk.BindBufferMemory(device.Device, _handle, _memory, 0), "vkBindBufferMemory");
+        _allocationSize = requirements.Size;
+
         var properties = device.GetMemoryTypeFlags(allocateInfo.MemoryTypeIndex);
         IsCoherent = (properties & MemoryPropertyFlags.HostCoherentBit) != 0;
-        if (_slab is null && (properties & MemoryPropertyFlags.HostVisibleBit) != 0)
+        if ((properties & MemoryPropertyFlags.HostVisibleBit) != 0)
         {
             void* pointer;
             RequireSuccess(vk.MapMemory(device.Device, _memory, 0, Vk.WholeSize, 0, &pointer), "vkMapMemory");
@@ -133,12 +99,6 @@ public unsafe class GpuBuffer : IDisposable
                 throw SubmissionScheduler.Fatal("The buffer device address is unavailable.");
             }
         }
-
-        // A dedicated allocation arrives zeroed; keep that for a block another buffer used.
-        if (_slab is { Recycled: true } && (Size & ~3UL) != 0)
-        {
-            Fill(0, Size & ~3UL, 0);
-        }
     }
 
     public VkBuffer Handle => _handle;
@@ -168,20 +128,6 @@ public unsafe class GpuBuffer : IDisposable
 
     public void AddStreamScore(int score) => StreamScore += score;
 
-    // The highest scheduler tick whose command buffer may write this buffer on the GPU.
-    // A readback of it only has to wait for that tick, not for all queued work.
-    public ulong LastGpuWriteTick { get; private set; }
-
-    // Called by every path that records a GPU write into this buffer.
-    public void NoteGpuWrite()
-    {
-        var tick = _scheduler.CurrentTick;
-        if (tick > LastGpuWriteTick)
-        {
-            LastGpuWriteTick = tick;
-        }
-    }
-
     public void Write(ulong offset, ReadOnlySpan<byte> source)
     {
         if (_mapped == null || offset > Size || (ulong)source.Length > Size - offset)
@@ -243,7 +189,6 @@ public unsafe class GpuBuffer : IDisposable
         }
 
         command.EndRendering();
-        NoteGpuWrite();
         var vk = _device.Vk;
         var native = new CommandBuffer(command.Handle);
         var before = stackalloc BufferMemoryBarrier2[2];
@@ -271,7 +216,6 @@ public unsafe class GpuBuffer : IDisposable
 
         var command = _scheduler.Current;
         command.EndRendering();
-        NoteGpuWrite();
         var vk = _device.Vk;
         var native = new CommandBuffer(command.Handle);
         var before = CreateBarrier(offset, size, MemoryAccess, AccessFlags.TransferWriteBit);
@@ -285,19 +229,6 @@ public unsafe class GpuBuffer : IDisposable
             0, null, 1, &after, 0, null);
     }
 
-    private int _foreignReads;
-    private int _disposeDeferred;
-
-    public void RetainForeignRead() => Interlocked.Increment(ref _foreignReads);
-
-    public void ReleaseForeignRead()
-    {
-        if (Interlocked.Decrement(ref _foreignReads) == 0 && Interlocked.Exchange(ref _disposeDeferred, 0) != 0)
-        {
-            Dispose();
-        }
-    }
-
     public void Dispose()
     {
         if (_handle.Handle == 0)
@@ -305,25 +236,8 @@ public unsafe class GpuBuffer : IDisposable
             return;
         }
 
-        if (Volatile.Read(ref _foreignReads) != 0)
-        {
-            Volatile.Write(ref _disposeDeferred, 1);
-            if (Volatile.Read(ref _foreignReads) != 0 || Interlocked.Exchange(ref _disposeDeferred, 0) == 0)
-            {
-                return;
-            }
-        }
-
         _device.Vk.DestroyBuffer(_device.Device, _handle, null);
-        if (_slab is { } slab)
-        {
-            _device.Slabs.Release(slab);
-        }
-        else
-        {
-            _device.FreeMemory(_memory);
-        }
-
+        _device.FreeMemory(_memory);
         _handle = default;
         _memory = default;
     }
@@ -366,7 +280,7 @@ public unsafe class GpuBuffer : IDisposable
         {
             SType = StructureType.MappedMemoryRange,
             Memory = _memory,
-            Offset = _memoryOffset + begin,
+            Offset = begin,
             Size = end - begin,
         };
     }

src/SharpEmu.Libs/Gpu/Buffers/GpuDeviceInfo.cs

@@ -10,16 +10,12 @@ namespace SharpEmu.Libs.Gpu.Buffers;
 public sealed unsafe class GpuDeviceInfo : IImageFormatSupport
 {
     private PhysicalDeviceMemoryProperties _memoryProperties;
-    // Queried for every draw target from the render thread and from other threads; a hit takes no lock.
-    // Two threads may query the same missing key once each; the driver answers identically.
-    private readonly System.Collections.Concurrent.ConcurrentDictionary<Format, FormatProperties> _formatProperties = new();
-    private readonly System.Collections.Concurrent.ConcurrentDictionary<(Format, ImageType, ImageTiling, ImageUsageFlags, ImageCreateFlags), (Result Result, ImageFormatProperties Properties)> _imageFormatProperties = new();
+    private readonly Dictionary<Format, FormatProperties> _formatProperties = new();
+    private readonly Dictionary<(Format, ImageType, ImageTiling, ImageUsageFlags, ImageCreateFlags), (Result Result, ImageFormatProperties Properties)> _imageFormatProperties = new();
+    private readonly object _gate = new();
     private int _liveAllocations;
     private int _peakAllocations;
 
-    // VK_EXT_image_view_min_lod is enabled, so a view can clamp to a texture descriptor's MIN_LOD.
-    public bool ImageViewMinLodSupported { get; init; }
-
     public GpuDeviceInfo(Vk vk, PhysicalDevice physicalDevice, Device device)
     {
         Vk = vk;
@@ -33,18 +29,10 @@ public sealed unsafe class GpuDeviceInfo : IImageFormatSupport
         MaxStorageBufferRange = properties.Limits.MaxStorageBufferRange;
         MaxMemoryAllocationCount = properties.Limits.MaxMemoryAllocationCount;
         MaxComputeWorkGroupCount = (properties.Limits.MaxComputeWorkGroupCount[0], properties.Limits.MaxComputeWorkGroupCount[1], properties.Limits.MaxComputeWorkGroupCount[2]);
-        Slabs = new GpuMemorySlabs(this);
     }
 
-    // Shared chunks the small buffers are carved from; freed at device teardown.
-    internal GpuMemorySlabs Slabs { get; }
-
     public Vk Vk { get; }
 
-    // Queue families that may access every buffer; set before the first buffer is
-    // created when a second queue family (the async readback queue) reads them.
-    public uint[]? SharedQueueFamilies { get; set; }
-
     public PhysicalDevice PhysicalDevice { get; }
 
     public Device Device { get; }
@@ -77,27 +65,33 @@ public sealed unsafe class GpuDeviceInfo : IImageFormatSupport
 
     public FormatProperties GetFormatProperties(Format format)
     {
-        if (!_formatProperties.TryGetValue(format, out var properties))
+        lock (_gate)
         {
-            Vk.GetPhysicalDeviceFormatProperties(PhysicalDevice, format, out properties);
-            _formatProperties[format] = properties;
-        }
+            if (!_formatProperties.TryGetValue(format, out var properties))
+            {
+                Vk.GetPhysicalDeviceFormatProperties(PhysicalDevice, format, out properties);
+                _formatProperties[format] = properties;
+            }
 
-        return properties;
+            return properties;
+        }
     }
 
     public bool TryGetImageFormatProperties(Format format, ImageType type, ImageTiling tiling, ImageUsageFlags usage, ImageCreateFlags flags, out ImageFormatProperties properties)
     {
-        var key = (format, type, tiling, usage, flags);
-        if (!_imageFormatProperties.TryGetValue(key, out var entry))
+        lock (_gate)
         {
-            var result = Vk.GetPhysicalDeviceImageFormatProperties(PhysicalDevice, format, type, tiling, usage, flags, out var found);
-            entry = (result, found);
-            _imageFormatProperties[key] = entry;
-        }
+            var key = (format, type, tiling, usage, flags);
+            if (!_imageFormatProperties.TryGetValue(key, out var entry))
+            {
+                var result = Vk.GetPhysicalDeviceImageFormatProperties(PhysicalDevice, format, type, tiling, usage, flags, out var found);
+                entry = (result, found);
+                _imageFormatProperties[key] = entry;
+            }
 
-        properties = entry.Properties;
-        return entry.Result == Result.Success;
+            properties = entry.Properties;
+            return entry.Result == Result.Success;
+        }
     }
 
     // Every device-memory allocation goes through here so the live count stays exact.

src/SharpEmu.Libs/Gpu/Buffers/GpuMemorySlabs.cs

@@ -1,171 +0,0 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-using System.Numerics;
-using Silk.NET.Vulkan;
-
-namespace SharpEmu.Libs.Gpu.Buffers;
-
-// Small buffers take a power-of-two block out of a shared, persistently mapped chunk
-// instead of a dedicated allocation. Games stream constants through fresh ranges every
-// frame, and the buffer cache created and freed a device allocation for each of them;
-// vkAllocateMemory/vkMapMemory/vkFreeMemory then cost ~15% of the render thread in busy
-// Astro Bot scenes, and every live allocation counts against maxMemoryAllocationCount.
-internal sealed unsafe class GpuMemorySlabs
-{
-    public const ulong MinBlockSize = 4096;
-    public const ulong MaxBlockSize = 1024 * 1024;
-    private const ulong ChunkSize = 8 * 1024 * 1024;
-    private static readonly int ClassCount = BitOperations.Log2(MaxBlockSize) - BitOperations.Log2(MinBlockSize) + 1;
-
-    private readonly GpuDeviceInfo _device;
-    private readonly object _gate = new();
-    private readonly Dictionary<(uint MemoryType, bool DeviceAddress), Pool> _pools = [];
-    private readonly List<DeviceMemory> _chunks = [];
-    private readonly List<Block> _quarantine = [];
-    private int _foreignReaders;
-
-    public GpuMemorySlabs(GpuDeviceInfo device) => _device = device;
-
-    // Recycled blocks still hold their previous buffer's bytes; fresh ones come zeroed with their chunk.
-    public readonly record struct Block(DeviceMemory Memory, ulong Offset, ulong Size, nint MappedAddress, uint MemoryType, bool DeviceAddress, bool Recycled)
-    {
-        public byte* Mapped => (byte*)MappedAddress;
-    }
-
-    private sealed class Pool
-    {
-        public readonly Stack<(DeviceMemory Memory, ulong Offset, nint Mapped, bool Recycled)>[] Free =
-            Enumerable.Range(0, ClassCount).Select(_ => new Stack<(DeviceMemory, ulong, nint, bool)>()).ToArray();
-    }
-
-    // A readback on the second queue copies from buffers the render thread may retire (and
-    // recycle) while the copy is still pending. A dedicated allocation kept its old bytes
-    // after vkFreeMemory, which hid that race; a recycled block does not. Released blocks
-    // therefore wait until no readback that might have picked their buffer is running.
-    public ForeignReadScope BeginForeignRead()
-    {
-        Interlocked.Increment(ref _foreignReaders);
-        return new ForeignReadScope(this);
-    }
-
-    public readonly struct ForeignReadScope(GpuMemorySlabs owner) : IDisposable
-    {
-        public void Dispose() => Interlocked.Decrement(ref owner._foreignReaders);
-    }
-
-    public static bool Fits(in MemoryRequirements requirements) =>
-        requirements.Size <= MaxBlockSize && requirements.Alignment <= MaxBlockSize;
-
-    public bool TryAllocate(uint memoryType, bool deviceAddress, in MemoryRequirements requirements, out Block block)
-    {
-        block = default;
-        var blockSize = Math.Max(MinBlockSize, BitOperations.RoundUpToPowerOf2(Math.Max(requirements.Size, requirements.Alignment)));
-        if (blockSize > MaxBlockSize)
-        {
-            return false;
-        }
-
-        var sizeClass = BitOperations.Log2(blockSize) - BitOperations.Log2(MinBlockSize);
-        lock (_gate)
-        {
-            if (_quarantine.Count != 0 && Volatile.Read(ref _foreignReaders) == 0)
-            {
-                foreach (var released in _quarantine)
-                {
-                    var releasedClass = BitOperations.Log2(released.Size) - BitOperations.Log2(MinBlockSize);
-                    _pools[(released.MemoryType, released.DeviceAddress)].Free[releasedClass]
-                        .Push((released.Memory, released.Offset, released.MappedAddress, true));
-                }
-
-                _quarantine.Clear();
-            }
-
-            if (!_pools.TryGetValue((memoryType, deviceAddress), out var pool))
-            {
-                pool = new Pool();
-                _pools.Add((memoryType, deviceAddress), pool);
-            }
-
-            var free = pool.Free[sizeClass];
-            if (free.Count == 0 && !TryAddChunk(memoryType, deviceAddress, blockSize, free))
-            {
-                return false;
-            }
-
-            var (memory, offset, mapped, recycled) = free.Pop();
-            block = new Block(memory, offset, blockSize, mapped, memoryType, deviceAddress, recycled);
-            return true;
-        }
-    }
-
-    public void Release(in Block block)
-    {
-        lock (_gate)
-        {
-            _quarantine.Add(block);
-        }
-    }
-
-    // Frees every chunk; only valid once no buffer still uses one (device teardown).
-    public void Destroy()
-    {
-        lock (_gate)
-        {
-            foreach (var chunk in _chunks)
-            {
-                _device.FreeMemory(chunk);
-            }
-
-            _chunks.Clear();
-            _pools.Clear();
-            _quarantine.Clear();
-        }
-    }
-
-    private bool TryAddChunk(uint memoryType, bool deviceAddress, ulong blockSize, Stack<(DeviceMemory, ulong, nint, bool)> free)
-    {
-        var flagsInfo = new MemoryAllocateFlagsInfo
-        {
-            SType = StructureType.MemoryAllocateFlagsInfo,
-            Flags = MemoryAllocateFlags.DeviceAddressBit,
-        };
-        var allocateInfo = new MemoryAllocateInfo
-        {
-            SType = StructureType.MemoryAllocateInfo,
-            PNext = deviceAddress ? &flagsInfo : null,
-            AllocationSize = ChunkSize,
-            MemoryTypeIndex = memoryType,
-        };
-        if (_device.AllocateMemory(allocateInfo, out var memory) != Result.Success)
-        {
-            return false;
-        }
-
-        byte* mapped = null;
-        if ((_device.GetMemoryTypeFlags(memoryType) & MemoryPropertyFlags.HostVisibleBit) != 0)
-        {
-            void* pointer;
-            if (_device.Vk.MapMemory(_device.Device, memory, 0, Vk.WholeSize, 0, &pointer) != Result.Success)
-            {
-                _device.FreeMemory(memory);
-                return false;
-            }
-
-            mapped = (byte*)pointer;
-        }
-
-        _chunks.Add(memory);
-        // Push in reverse so blocks come out in address order.
-        for (var offset = ChunkSize - blockSize; ; offset -= blockSize)
-        {
-            free.Push((memory, offset, mapped == null ? 0 : (nint)(mapped + offset), false));
-            if (offset == 0)
-            {
-                break;
-            }
-        }
-
-        return true;
-    }
-}

src/SharpEmu.Libs/Gpu/Buffers/IGuestImageCache.cs

@@ -13,8 +13,6 @@ public interface IGuestImageCache
 
     bool ClearMetadata(ulong address);
 
-    bool OverlapsDccMetadata(ulong address, ulong size);
-
     void InvalidateMemory(ulong address, ulong size);
 
     void InvalidateMemoryFromGpu(ulong address, ulong size);

src/SharpEmu.Libs/Gpu/GpuCommands/CommandStreamQueue.cs

@@ -26,23 +26,16 @@ public enum SliceResult
 // Submissions of every queue; one thread runs the slices, other threads enqueue and wait.
 public sealed class CommandStreamQueue
 {
-    private sealed record ControlBarrier(ulong CutoffOrdinal, Action Work, Action Cancel);
-
     public const int ComputeQueueCount = 56;
     public const int QueueCount = 1 + ComputeQueueCount;
     public const int AllBlockedRetryMilliseconds = 100;
-    // One boundary may run ahead; explicit zero keeps the synchronous diagnostic mode.
-    public static readonly int DefaultBoundariesInFlight =
-        Environment.GetEnvironmentVariable("SHARPEMU_SUSPEND_POINTS_IN_FLIGHT") == "0" ? 0 : 1;
 
     private readonly ICommandStreamHost _host;
     private readonly object _gate = new();
     private readonly LinkedList<CommandSubmission>[] _queues = new LinkedList<CommandSubmission>[QueueCount];
     private readonly GpuCommandInterpreter?[] _interpreters = new GpuCommandInterpreter?[QueueCount];
-    private readonly Queue<ControlBarrier> _controlBarriers = new();
     private int _nextQueue;
     private int _submissionCount;
-    private ulong _admissionOrdinal;
     private bool _accepting = true;
     private bool _stopping;
     private bool _processing;
@@ -50,20 +43,12 @@ public sealed class CommandStreamQueue
     private ulong _submitId;
     private ulong _lastCompletedGpuTick;
     private int _doneCount;
-    private int _pendingBoundaries;
     private IdleOutcome _outcome = IdleOutcome.Completed;
     private Thread? _processingThread;
 
-    private readonly int _boundariesInFlight;
-
-    public CommandStreamQueue(ICommandStreamHost host) : this(host, DefaultBoundariesInFlight)
-    {
-    }
-
-    public CommandStreamQueue(ICommandStreamHost host, int boundariesInFlight)
+    public CommandStreamQueue(ICommandStreamHost host)
     {
         _host = host;
-        _boundariesInFlight = Math.Max(0, boundariesInFlight);
         for (var index = 0; index < QueueCount; index++)
         {
             _queues[index] = new LinkedList<CommandSubmission>();
@@ -95,7 +80,7 @@ public sealed class CommandStreamQueue
         {
             lock (_gate)
             {
-                return _submissionCount != 0 || _controlBarriers.Count != 0;
+                return _submissionCount != 0;
             }
         }
     }
@@ -117,7 +102,7 @@ public sealed class CommandStreamQueue
         {
             lock (_gate)
             {
-                return HasRunnableWorkLocked();
+                return SelectQueueLocked() >= 0;
             }
         }
     }
@@ -204,74 +189,30 @@ public sealed class CommandStreamQueue
             throw _host.Fatal($"The command stream no longer accepts submissions: queue={submission.QueueId} address=0x{submission.Address:X16}.");
         }
 
-        submission.AdmissionOrdinal = ++_admissionOrdinal;
         _queues[submission.QueueId].AddLast(submission);
         _submissionCount++;
-        if (submission.Kind is not (CommandSubmissionKind.FlipPreparation or CommandSubmissionKind.FrameBoundary))
+        if (submission.Kind != CommandSubmissionKind.FlipPreparation)
             SubmissionFlowProfile.Record(SubmissionFlowProfile.EventKind.Enqueued, submission.QueueId,
                 submission.SubmissionId, submission.Address, submission.DwordCount, _submissionCount);
         Monitor.PulseAll(_gate);
     }
 
-    public bool TryEnqueueControlBarrier(Action work, Action cancel)
-    {
-        ArgumentNullException.ThrowIfNull(work);
-        ArgumentNullException.ThrowIfNull(cancel);
-        lock (_gate)
-        {
-            if (!_accepting)
-            {
-                return false;
-            }
-
-            _controlBarriers.Enqueue(new ControlBarrier(_admissionOrdinal, work, cancel));
-            Monitor.PulseAll(_gate);
-            return true;
-        }
-    }
-
+    // Marks the frame boundary; from another thread it first waits for the queue to drain.
     public IdleOutcome Done()
     {
-        if (_processingThread == Thread.CurrentThread)
+        var outcome = IdleOutcome.Completed;
+        if (_processingThread != Thread.CurrentThread)
         {
-            lock (_gate)
-            {
-                _graphicsDone = true;
-                _doneCount++;
-            }
-
-            return IdleOutcome.Completed;
+            outcome = WaitForIdle();
         }
 
         lock (_gate)
         {
-            if (_outcome != IdleOutcome.Completed)
-            {
-                return _outcome;
-            }
-
             _graphicsDone = true;
-            if (!_accepting)
-            {
-                // Shutdown: no slice will run a queued boundary, so drain as before.
-                while (_outcome == IdleOutcome.Completed && (_processing || _submissionCount != 0))
-                {
-                    Monitor.Wait(_gate);
-                }
-
-                _doneCount++;
-                return _outcome;
-            }
-
-            _pendingBoundaries++;
-            EnqueueLocked(new CommandSubmission(CommandSubmissionKind.FrameBoundary, 0, 0, 0, 0, null));
-            while (_outcome == IdleOutcome.Completed && _pendingBoundaries > _boundariesInFlight)
-            {
-                Monitor.Wait(_gate);
-            }
-
-            return _outcome;
+            _doneCount++;
         }
+
+        return outcome;
     }
 
     // Returns once nothing is pending; a cancelled or failed queue reports that instead.
@@ -279,8 +220,7 @@ public sealed class CommandStreamQueue
     {
         lock (_gate)
         {
-            while (_outcome == IdleOutcome.Completed &&
-                   (_processing || _submissionCount != 0 || _controlBarriers.Count != 0))
+            while (_outcome == IdleOutcome.Completed && (_processing || _submissionCount != 0))
             {
                 Monitor.Wait(_gate);
             }
@@ -302,13 +242,13 @@ public sealed class CommandStreamQueue
     {
         lock (_gate)
         {
-            if (HasRunnableWorkLocked() || _stopping)
+            if (SelectQueueLocked() >= 0 || _stopping)
             {
-                return HasRunnableWorkLocked();
+                return SelectQueueLocked() >= 0;
             }
 
             Monitor.Wait(_gate, timeoutMilliseconds);
-            return HasRunnableWorkLocked();
+            return SelectQueueLocked() >= 0;
         }
     }
 
@@ -318,7 +258,7 @@ public sealed class CommandStreamQueue
         lock (_gate)
         {
             var deadline = Environment.TickCount64 + intervalMilliseconds;
-            while (!HasRunnableWorkLocked())
+            while (SelectQueueLocked() < 0)
             {
                 var remaining = deadline - Environment.TickCount64;
                 if (remaining <= 0)
@@ -336,15 +276,10 @@ public sealed class CommandStreamQueue
     // Publishes a failure: nothing runs any more and every waiter is released with Failed.
     public void Fail()
     {
-        Action[] cancellations;
         lock (_gate)
         {
             FailLocked();
-            cancellations = CancelControlBarriersLocked();
         }
-
-        foreach (var cancel in cancellations)
-            cancel();
     }
 
     private void FailLocked()
@@ -392,8 +327,7 @@ public sealed class CommandStreamQueue
     // Runs one slice of the next unblocked submission on the calling thread.
     public SliceResult ProcessOne()
     {
-        CommandSubmission? submission = null;
-        ControlBarrier? control = null;
+        CommandSubmission submission;
         lock (_gate)
         {
             if (_processing)
@@ -401,73 +335,35 @@ public sealed class CommandStreamQueue
                 throw _host.Fatal("The command stream queue is already processing a slice.");
             }
 
-            if (IsControlBarrierReadyLocked())
+            var selected = SelectQueueLocked();
+            if (selected < 0)
             {
-                control = _controlBarriers.Dequeue();
-            }
-            else
-            {
-                var selected = SelectQueueLocked();
-                if (selected < 0)
-                {
-                    return _submissionCount != 0 ? SliceResult.AllBlocked : SliceResult.NoWork;
-                }
-
-                var queue = _queues[selected];
-                submission = queue.First!.Value;
-                queue.RemoveFirst();
-                _submissionCount--;
-                _nextQueue = (selected + 1) % QueueCount;
+                return _submissionCount != 0 ? SliceResult.AllBlocked : SliceResult.NoWork;
             }
 
+            var queue = _queues[selected];
+            submission = queue.First!.Value;
+            queue.RemoveFirst();
+            _submissionCount--;
+            _nextQueue = (selected + 1) % QueueCount;
             _processing = true;
             _processingThread = Thread.CurrentThread;
-            if (submission is { Started: false } &&
-                submission.Kind is not (CommandSubmissionKind.FlipPreparation or CommandSubmissionKind.FrameBoundary))
+            if (!submission.Started && submission.Kind != CommandSubmissionKind.FlipPreparation)
                 SubmissionFlowProfile.Record(SubmissionFlowProfile.EventKind.ProcessingStarted, submission.QueueId,
                     submission.SubmissionId, submission.Address, submission.DwordCount, _submissionCount);
         }
 
-        if (control is not null)
-        {
-            try
-            {
-                control.Work();
-            }
-            catch (Exception exception)
-            {
-                try
-                {
-                    Console.Error.WriteLine($"[GPU][ERROR] Command stream control barrier failed. {exception}");
-                }
-                catch (Exception)
-                {
-                }
-
-                Fail();
-                throw;
-            }
-
-            lock (_gate)
-            {
-                _processing = false;
-                Monitor.PulseAll(_gate);
-            }
-
-            return SliceResult.Completed;
-        }
-
         bool complete;
         try
         {
-            complete = RunSlice(submission!);
+            complete = RunSlice(submission);
         }
         catch (Exception exception)
         {
             try
             {
                 // Report the cause before another submitting thread observes the failed queue.
-                Console.Error.WriteLine($"[GPU][ERROR] Command stream slice failed: queue={submission!.QueueId} address=0x{submission.Address:X16}. {exception}");
+                Console.Error.WriteLine($"[GPU][ERROR] Command stream slice failed: queue={submission.QueueId} address=0x{submission.Address:X16}. {exception}");
             }
             catch (Exception)
             {
@@ -483,7 +379,7 @@ public sealed class CommandStreamQueue
             SliceResult result;
             if (!complete)
             {
-                submission!.Blocked = true;
+                submission.Blocked = true;
                 submission.BlockedSinceTicks = System.Diagnostics.Stopwatch.GetTimestamp();
                 submission.BlockedPacketAddress = submission.Commands.CurrentPacketAddress;
                 _queues[submission.QueueId].AddFirst(submission);
@@ -492,12 +388,6 @@ public sealed class CommandStreamQueue
             }
             else
             {
-                if (submission.Kind == CommandSubmissionKind.FrameBoundary)
-                {
-                    _pendingBoundaries--;
-                    _doneCount++;
-                }
-
                 foreach (var queue in _queues)
                 {
                     if (queue.First is { } head)
@@ -525,14 +415,6 @@ public sealed class CommandStreamQueue
             return true;
         }
 
-        // A suspend point drains the graphics pipe: submit what the frame recorded.
-        if (submission.Kind == CommandSubmissionKind.FrameBoundary)
-        {
-            SlicesRun++;
-            _host.Flush();
-            return true;
-        }
-
         var firstSlice = !submission.Started;
         var processor = GetInterpreter(submission.QueueId);
         if (firstSlice && submission.ResetInterpreter)
@@ -644,14 +526,6 @@ public sealed class CommandStreamQueue
                 if (queue.First is { } head && head.Value.Blocked)
                 {
                     _submissionCount -= queue.Count;
-                    foreach (var dropped in queue)
-                    {
-                        if (dropped.Kind == CommandSubmissionKind.FrameBoundary)
-                        {
-                            _pendingBoundaries--;
-                        }
-                    }
-
                     queue.Clear();
                     _outcome = IdleOutcome.Cancelled;
                 }
@@ -664,17 +538,12 @@ public sealed class CommandStreamQueue
     // Drops every submission without stopping admission; the presenter uses it after device loss.
     public void DiscardAll()
     {
-        Action[] cancellations;
         lock (_gate)
         {
             _outcome = IdleOutcome.Failed;
             DropAllLocked();
-            cancellations = CancelControlBarriersLocked();
             Monitor.PulseAll(_gate);
         }
-
-        foreach (var cancel in cancellations)
-            cancel();
     }
 
     // A diagnostic view of the blocked heads: their count, the oldest age and one sample.
@@ -741,20 +610,6 @@ public sealed class CommandStreamQueue
 
     private int SelectQueueLocked()
     {
-        if (_controlBarriers.TryPeek(out var control))
-        {
-            for (var offset = 0; offset < QueueCount; offset++)
-            {
-                var queueId = (_nextQueue + offset) % QueueCount;
-                if (_queues[queueId].First is { } head &&
-                    head.Value.AdmissionOrdinal <= control.CutoffOrdinal &&
-                    !head.Value.Blocked)
-                {
-                    return queueId;
-                }
-            }
-        }
-
         for (var offset = 0; offset < QueueCount; offset++)
         {
             var queueId = (_nextQueue + offset) % QueueCount;
@@ -767,42 +622,6 @@ public sealed class CommandStreamQueue
         return -1;
     }
 
-    private bool HasRunnableWorkLocked() => IsControlBarrierReadyLocked() || SelectQueueLocked() >= 0;
-
-    private bool IsControlBarrierReadyLocked()
-    {
-        if (!_controlBarriers.TryPeek(out var control))
-        {
-            return false;
-        }
-
-        foreach (var queue in _queues)
-        {
-            if (queue.First is { } head && head.Value.AdmissionOrdinal <= control.CutoffOrdinal)
-            {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
-    private Action[] CancelControlBarriersLocked()
-    {
-        if (_controlBarriers.Count == 0)
-        {
-            return [];
-        }
-
-        var cancellations = new Action[_controlBarriers.Count];
-        for (var index = 0; index < cancellations.Length; index++)
-        {
-            cancellations[index] = _controlBarriers.Dequeue().Cancel;
-        }
-
-        return cancellations;
-    }
-
     private void DropAllLocked()
     {
         foreach (var queue in _queues)
@@ -811,6 +630,5 @@ public sealed class CommandStreamQueue
         }
 
         _submissionCount = 0;
-        _pendingBoundaries = 0;
     }
 }

src/SharpEmu.Libs/Gpu/GpuCommands/CommandSubmission.cs

@@ -9,8 +9,6 @@ public enum CommandSubmissionKind
     Compute,
     // A video-out export flip queued behind the graphics submissions before it.
     FlipPreparation,
-    // A suspend point queued behind the graphics submissions of the frame it ends.
-    FrameBoundary,
 }
 
 public enum SubmissionProgress
@@ -101,8 +99,6 @@ public sealed class CommandSubmission
     // The submitter's own sequence number, kept for diagnostics and the translation state.
     public ulong SubmissionId { get; }
 
-    internal ulong AdmissionOrdinal { get; set; }
-
     // Snapshots captured at submit time; the processor never reads them.
     public object? GeometrySnapshots { get; }
 
@@ -114,8 +110,6 @@ public sealed class CommandSubmission
 
     public PacketCursorStack Commands { get; } = new();
 
-    // Its place in the order every queue was fed; the frame run-ahead waits by it.
-
     public bool ResetInterpreter { get; internal set; }
 
     public bool Started { get; internal set; }

src/SharpEmu.Libs/Gpu/GpuCommands/GpuCommandInterpreter.Draws.cs

@@ -114,18 +114,6 @@ public sealed partial class GpuCommandInterpreter
             return;
         }
 
-        if (_host.ResolvesIndirectDrawOnGpu && IndexTypeAndSize is 0 or 1 && TryGetGpuIndexRange(out var gpuIndexCount))
-        {
-            // The host reads the five arguments on the GPU. It draws from the whole index
-            // range; the arguments pick the indices. The host falls back to reading them
-            // itself when the draw needs the counts.
-            _deferredInstanceCountAddress = argumentsAddress + 4;
-            _host.DrawIndexed(SubmitId, new DrawIndexedArguments(
-                packetAddress, opcode, gpuIndexCount, IndexBaseAddress, IndexTypeAndSize, 1, 0, 0,
-                DrawOffsetSource.IndirectArguments, argumentsAddress, UnboundedIndexBuffer: IndexBufferSize == 0));
-            return;
-        }
-
         var indexCountPerInstance = ReadDword(argumentsAddress);
         var indexedInstanceCount = ReadDword(argumentsAddress + 4);
         var startIndex = ReadDword(argumentsAddress + 8);
@@ -134,71 +122,9 @@ public sealed partial class GpuCommandInterpreter
         var indexAddress = IndexBaseAddress + (startIndex * IndexElementSize);
         var indexCount = IndexBufferSize != 0 ? Math.Min(indexCountPerInstance, IndexBufferSize) : indexCountPerInstance;
         InstanceCount = indexedInstanceCount;
-        if (IndexBufferSize == 0 && IndexTypeAndSize is 0 or 1)
-        {
-            LearnIndexExtent(startIndex, indexCountPerInstance);
-        }
-
         DrawIndexed(packetAddress, opcode, indexCount, indexAddress, indexedInstanceCount, unchecked((int)baseVertex), indexedStartInstance, DrawOffsetSource.IndirectArguments);
     }
 
-    // An index buffer without a size (INDEX_BUFFER_SIZE never set) has no bound the GPU
-    // path could bind. The extent the draws from an index base have used so far, rounded
-    // up to the end of its 16 KiB page, stands in for it; every 1024th such draw reads its
-    // arguments on the CPU again so the extent can grow.
-    private const ulong IndexExtentPageSize = 0x4000;
-    private const ulong MaxIndexExtentBytes = 64ul << 20;
-    private const int MaxIndexExtents = 4096;
-    private readonly Dictionary<ulong, ulong> _indexExtents = new();
-    private uint _indexExtentDraws;
-
-    private bool TryGetGpuIndexRange(out uint indexCount)
-    {
-        if (IndexBufferSize != 0)
-        {
-            indexCount = IndexBufferSize;
-            return true;
-        }
-
-        indexCount = 0;
-        if ((++_indexExtentDraws & 1023) == 0 || !_indexExtents.TryGetValue(IndexBaseAddress, out var extentBytes))
-        {
-            return false;
-        }
-
-        indexCount = (uint)(extentBytes / IndexElementSize);
-        return indexCount != 0;
-    }
-
-    private void LearnIndexExtent(uint startIndex, uint indexCount)
-    {
-        if (indexCount == 0 || IndexBaseAddress == 0)
-        {
-            return;
-        }
-
-        var end = IndexBaseAddress + (((ulong)startIndex + indexCount) * IndexElementSize);
-        var extentBytes = ((end + IndexExtentPageSize - 1) & ~(IndexExtentPageSize - 1)) - IndexBaseAddress;
-        if (extentBytes > MaxIndexExtentBytes)
-        {
-            return;
-        }
-
-        if (_indexExtents.TryGetValue(IndexBaseAddress, out var known))
-        {
-            if (known >= extentBytes)
-            {
-                return;
-            }
-        }
-        else if (_indexExtents.Count >= MaxIndexExtents)
-        {
-            _indexExtents.Clear();
-        }
-
-        _indexExtents[IndexBaseAddress] = extentBytes;
-    }
-
     internal void DispatchDirect(uint groupsX, uint groupsY, uint groupsZ, uint dispatchInitiator, ulong indirectArgumentsAddress = 0) =>
         _host.DispatchDirect(SubmitId, groupsX, groupsY, groupsZ, dispatchInitiator, indirectArgumentsAddress);
 
@@ -209,22 +135,7 @@ public sealed partial class GpuCommandInterpreter
             throw _host.Fatal($"The indirect dispatch arguments base is zero: offset=0x{dataOffset:X}.");
         }
 
-        DispatchIndirectAt(DispatchIndirectArgumentsBase + dataOffset, dispatchInitiator);
-    }
-
-    private const uint DispatchInitiatorUseThreadDimensions = 1u << 5;
-
-    // Group counts written by an earlier shader are only in GPU memory; reading them
-    // here waits for the GPU. When the host dispatches indirectly they stay there.
-    // Thread-unit dispatches still need the counts to convert them to groups.
-    private void DispatchIndirectAt(ulong argumentsAddress, uint dispatchInitiator)
-    {
-        if (_host.ResolvesIndirectDispatchOnGpu && (dispatchInitiator & DispatchInitiatorUseThreadDimensions) == 0)
-        {
-            DispatchDirect(0, 0, 0, dispatchInitiator, argumentsAddress);
-            return;
-        }
-
+        var argumentsAddress = DispatchIndirectArgumentsBase + dataOffset;
         DispatchDirect(ReadDword(argumentsAddress), ReadDword(argumentsAddress + 4), ReadDword(argumentsAddress + 8), dispatchInitiator, argumentsAddress);
     }
 
@@ -360,7 +271,7 @@ public sealed partial class GpuCommandInterpreter
                 throw _host.Fatal($"The indirect dispatch arguments address is zero: address=0x{packet.PacketAddress:X16}.");
             }
 
-            DispatchIndirectAt(argumentsAddress, payload[2]);
+            DispatchDirect(ReadDword(argumentsAddress), ReadDword(argumentsAddress + 4), ReadDword(argumentsAddress + 8), payload[2], argumentsAddress);
             return 3;
         }
 

src/SharpEmu.Libs/Gpu/GpuCommands/GpuCommandInterpreter.Labels.cs

@@ -118,7 +118,6 @@ public sealed partial class GpuCommandInterpreter
                                     break;
                                 case 0x14:
                                 case 0x28:
-                                case 0x2F:
                                     if (eventIndex == 0x00)
                                     {
                                         Write64(destination, value, withWriteBack: false, withInterrupt, eventId, interruptContextId);
@@ -128,6 +127,7 @@ public sealed partial class GpuCommandInterpreter
                                     break;
                                 case 0x2B:
                                 case 0x2D:
+                                case 0x2F:
                                 case 0x30:
                                     if (eventIndex == 0x00 && !withInterrupt)
                                     {
@@ -260,23 +260,6 @@ public sealed partial class GpuCommandInterpreter
         }
     }
 
-    // Release-memory completions stay in the recording command buffer instead of
-    // submitting it at every packet: labels are already written to guest memory,
-    // only the interrupt waits for the GPU, and RunSlice submits the buffer when
-    // the slice ends or blocks, so every deferred interrupt still reaches the GPU.
-    // Submitting per packet produced ~430 tiny submissions per Astro Bot frame.
-    // SHARPEMU_DEFER_RELEASE_FLUSH=0 restores the per-packet submit.
-    private static readonly bool DeferReleaseFlush = !string.Equals(
-        Environment.GetEnvironmentVariable("SHARPEMU_DEFER_RELEASE_FLUSH"), "0", StringComparison.Ordinal);
-
-    private void FlushReleaseMemory()
-    {
-        if (!DeferReleaseFlush)
-        {
-            _host.Flush();
-        }
-    }
-
     internal void QueueInterrupt(uint interruptContextId) =>
         _host.RecordEndOfPipe(new EndOfPipeWrite(EndOfPipeWriteKind.InterruptOnly, SubmitId, EventId: InterruptEventId, ContextId: interruptContextId));
 
@@ -344,7 +327,7 @@ public sealed partial class GpuCommandInterpreter
         if (dataSelection == 1)
         {
             WriteEndOfPipe(false, cachePolicy, 0, 0x2F, cacheAction, 6, 2, destination, (uint)value, interruptSelector, interruptContextId);
-            FlushReleaseMemory();
+            _host.Flush();
             return;
         }
 
@@ -358,7 +341,7 @@ public sealed partial class GpuCommandInterpreter
             WriteEndOfPipe(false, cachePolicy, 0, 0x2F, cacheAction, 6, 1, destination, (uint)value, interruptSelector, interruptContextId);
             if (interruptSelector == 1)
             {
-                FlushReleaseMemory();
+                _host.Flush();
             }
 
             return;
@@ -388,7 +371,7 @@ public sealed partial class GpuCommandInterpreter
             case 2:
             case 4:
                 QueueInterrupt(interruptContextId);
-                FlushReleaseMemory();
+                _host.Flush();
                 return;
             default:
                 throw _host.Fatal($"The release-memory interrupt selector is unknown: selector={interruptSelector}.");

src/SharpEmu.Libs/Gpu/GpuCommands/GpuCommandInterpreter.Memory.cs

@@ -3,7 +3,6 @@
 
 using System.Runtime.InteropServices;
 using SharpEmu.Libs.Gpu.GpuCommands.Packets;
-using SharpEmu.Libs.Gpu.Images;
 using SharpEmu.Libs.Gpu.Scheduling;
 
 namespace SharpEmu.Libs.Gpu.GpuCommands;
@@ -11,7 +10,6 @@ namespace SharpEmu.Libs.Gpu.GpuCommands;
 public sealed partial class GpuCommandInterpreter
 {
     private const uint DmaSkippedDestination = 0x3022C;
-    private const uint LodStatsWithoutCounters = 1;
 
     // Destination selectors 1, 2, 4 and 5 are memory; registers and GDS are not supported.
     internal void WriteData(ulong destination, ReadOnlySpan<uint> source, uint writeControl)
@@ -369,12 +367,12 @@ public sealed partial class GpuCommandInterpreter
         var destination = (payload[1] & 0xFFFF_FFC0u) | ((ulong)payload[2] << 32);
         if (destination != 0 && bufferSize != 0)
         {
-            var report = new byte[bufferSize];
-            var hasCounters = MipStatistics.Shared.TryWriteReport(report);
-            WriteBytes(destination, report);
+            // The statistics buffer is zeroed and its first dword marks it as valid.
+            var zeros = new byte[bufferSize];
+            WriteBytes(destination, zeros);
             if (bufferSize >= sizeof(uint))
             {
-                WriteDword(destination, hasCounters ? MipStatistics.FirstCounterOffset : LodStatsWithoutCounters);
+                WriteDword(destination, 1);
             }
         }
 

src/SharpEmu.Libs/Gpu/GpuCommands/GpuCommandInterpreter.Waits.cs

@@ -34,26 +34,22 @@ public sealed partial class GpuCommandInterpreter
             throw _host.Fatal($"The wait compare function is unknown: function={compareFunction} address=0x{address:X16}.");
         }
 
-        if (!satisfied && TryReadOwnWrite(address, is64Bit, out var ownValue))
-        {
-            _ = WaitOperation.TryCompare(ownValue, reference, mask, compareFunction, out satisfied);
-        }
-
         if (!satisfied)
         {
             Suspend();
         }
     }
 
-    // The wait bit is PredicationZPassWaitOp: 0 (kWaitForQueryResults) stalls the command
-    // processor until the results arrive, 1 (kDoNotPredicateIfQueryResultsNotReady) never
-    // stalls and leaves the tagged packets unpredicated while the results are outstanding.
     internal void SetPredication(uint condition, uint operation, uint waitOperation, ulong address)
     {
+        if (waitOperation != 0)
+        {
+            _host.FlushAndWait();
+        }
+
         switch (operation)
         {
             case 0:
-                // Clearing predication reads no memory, so no GPU result can be outstanding.
                 PredicateSkip = false;
                 break;
             case 3:
@@ -63,15 +59,6 @@ public sealed partial class GpuCommandInterpreter
                     throw _host.Fatal("The predication address is zero.");
                 }
 
-                if (waitOperation != 0)
-                {
-                    // The results are outstanding while work is queued behind this packet, and
-                    // the game asked for the packets to run unpredicated in that case.
-                    PredicateSkip = false;
-                    break;
-                }
-
-                _host.FlushAndWait();
                 var value = ReadQword(address);
                 PredicateSkip = condition switch
                 {

src/SharpEmu.Libs/Gpu/GpuCommands/GpuCommandInterpreter.cs

@@ -32,11 +32,6 @@ public sealed partial class GpuCommandInterpreter
     private readonly uint[] _constantRam = new uint[ConstantRamDwords];
     private PacketCursorStack? _execution;
     private bool _chainRequested;
-    private ulong _packetSerial;
-    private ulong _lastWriteAddress;
-    private ulong _lastWriteValue;
-    private int _lastWriteLength;
-    private ulong _lastWritePacket;
 
     public GpuCommandInterpreter(ICommandStreamHost host, int queueId, int interruptEventId)
     {
@@ -69,30 +64,8 @@ public sealed partial class GpuCommandInterpreter
 
     public ulong DispatchIndirectArgumentsBase { get; private set; }
 
-    // Persistent draw state: indirect draws update it for later draws. An indirect draw
-    // resolved on the GPU leaves the count in guest memory; it is read only if a later
-    // draw needs it.
-    public uint InstanceCount
-    {
-        get
-        {
-            if (_deferredInstanceCountAddress != 0)
-            {
-                _instanceCount = ReadDword(_deferredInstanceCountAddress);
-                _deferredInstanceCountAddress = 0;
-            }
-
-            return _instanceCount;
-        }
-        private set
-        {
-            _instanceCount = value;
-            _deferredInstanceCountAddress = 0;
-        }
-    }
-
-    private uint _instanceCount = 1;
-    private ulong _deferredInstanceCountAddress;
+    // Persistent draw state: indirect draws update it for later draws.
+    public uint InstanceCount { get; private set; } = 1;
 
     public uint DrawIndexOffset { get; private set; }
 
@@ -124,7 +97,6 @@ public sealed partial class GpuCommandInterpreter
 
     public void Reset()
     {
-        _lastWriteLength = 0;
         Registers.Reset();
         TypedRegisters.Reset();
         IndexTypeAndSize = 0;
@@ -169,8 +141,6 @@ public sealed partial class GpuCommandInterpreter
 
         execution.Suspended = false;
         execution.MadeProgress = false;
-        // Forwarding is local to this slice, never a cached signal from an older submission.
-        _lastWriteLength = 0;
         _execution = execution;
         try
         {
@@ -214,20 +184,6 @@ public sealed partial class GpuCommandInterpreter
 
     public void Suspend() => RequireExecution().Suspended = true;
 
-    // A paired wait must still observe this queue's immediate label store when the CPU
-    // resets the live address for the next frame between the two packets (Dead Cells).
-    private bool TryReadOwnWrite(ulong address, bool is64Bit, out ulong value)
-    {
-        value = 0;
-        if (address != _lastWriteAddress || _packetSerial - _lastWritePacket > 2 ||
-            _lastWriteLength < (is64Bit ? sizeof(ulong) : sizeof(uint)))
-        {
-            return false;
-        }
-        value = is64Bit ? _lastWriteValue : (uint)_lastWriteValue;
-        return true;
-    }
-
     private PacketCursorStack RequireExecution() =>
         _execution ?? throw _host.Fatal($"No command stream is running: queue={QueueId}.");
 
@@ -264,7 +220,6 @@ public sealed partial class GpuCommandInterpreter
 
             var packetAddress = cursor.Address + ((ulong)cursor.Offset * sizeof(uint));
             var header = ReadDword(packetAddress, RenderPhaseProfile.CommandReadKind.Header);
-            _packetSerial++;
             var total = cursor.DwordCount;
             var remaining = cursor.Remaining;
             var offset = cursor.Offset;
@@ -302,15 +257,6 @@ public sealed partial class GpuCommandInterpreter
             }
 
             var opcode = PacketHeader.Opcode(header);
-            // Only a wait or an inert NOP/marker may separate the store and its paired wait.
-            // Draws, dispatches and transfers may produce a newer GPU value at the same address.
-            if (opcode is not (PacketOpcode.WaitRegisterMemory or PacketOpcode.WaitRegisterMemory64) &&
-                !(opcode == PacketOpcode.Nop && PacketHeader.CustomCode(header) is
-                    0 or PacketCustomCode.PushMarker or PacketCustomCode.PopMarker or
-                    PacketCustomCode.WaitMemory32 or PacketCustomCode.WaitMemory64))
-            {
-                _lastWriteLength = 0;
-            }
             var handler = PacketDispatchTable.Opcodes[opcode];
             if (handler is null)
             {
@@ -443,16 +389,6 @@ public sealed partial class GpuCommandInterpreter
         {
             throw _host.Fatal($"The command stream cannot write guest memory: address=0x{address:X16} size={source.Length}.");
         }
-        _lastWriteLength = 0;
-        if (source.Length is sizeof(uint) or sizeof(ulong))
-        {
-            _lastWriteAddress = address;
-            _lastWriteValue = source.Length == sizeof(uint)
-                ? BinaryPrimitives.ReadUInt32LittleEndian(source)
-                : BinaryPrimitives.ReadUInt64LittleEndian(source);
-            _lastWriteLength = source.Length;
-            _lastWritePacket = _packetSerial;
-        }
     }
 
     private static ulong Address(uint low, uint high) => low | ((ulong)high << 32);

src/SharpEmu.Libs/Gpu/GpuCommands/ICommandStreamHost.cs

@@ -21,14 +21,7 @@ public readonly record struct DrawIndexedArguments(
     uint InstanceCount,
     int BaseVertex,
     uint FirstInstance,
-    DrawOffsetSource OffsetSource,
-    // Nonzero when the counts are still in guest memory at this address, laid out as
-    // (indexCount, instanceCount, firstIndex, vertexOffset, firstInstance). IndexCount is
-    // then the index buffer size and IndexAddress its base.
-    ulong IndirectArgumentsAddress = 0,
-    // The guest set no index buffer size: IndexCount is only the range seen so far and
-    // must not clamp the count read from the arguments.
-    bool UnboundedIndexBuffer = false);
+    DrawOffsetSource OffsetSource);
 
 // Arguments of a non-indexed draw as the packet stream describes them.
 public readonly record struct DrawAutoArguments(
@@ -128,14 +121,6 @@ public interface ICommandStreamHost
 
     void DispatchDirect(ulong submitId, uint groupsX, uint groupsY, uint groupsZ, uint dispatchInitiator, ulong indirectArgumentsAddress = 0);
 
-    // True when an indirect dispatch in workgroup units reads its group counts on the
-    // GPU, so the interpreter need not wait for the GPU to read them back first.
-    bool ResolvesIndirectDispatchOnGpu => false;
-
-    // True when an indexed indirect draw may be handed over with its arguments still in
-    // guest memory (DrawIndexedArguments.IndirectArgumentsAddress).
-    bool ResolvesIndirectDrawOnGpu => false;
-
     // Called when a queue reset packet clears the processor.
     void OnQueueReset(int queueId);