[Tests] Cover backward red-zone spans, direct memory no-space results and the mount info size

Co-authored-by: Sekai <140012992+SekaixX@users.noreply.github.com>

Directory.Build.props

@@ -9,7 +9,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <SharpEmuVersion>0.0.4-release.2</SharpEmuVersion>
+    <SharpEmuVersion>0.0.5-nexus</SharpEmuVersion>
     <Version>$(SharpEmuVersion)</Version>
 
     <RepoRoot>$([MSBuild]::NormalizeDirectory('$(MSBuildThisFileDirectory)'))</RepoRoot>

Directory.Packages.props

@@ -22,6 +22,9 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.EXT" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.KHR" Version="2.23.0" />
+    <!-- Reuse the font rasterizer already shipped with Avalonia.Skia. -->
+    <PackageVersion Include="SkiaSharp" Version="3.119.4" />
+    <PackageVersion Include="SkiaSharp.NativeAssets.Linux" Version="3.119.4" />
     <PackageVersion Include="System.IO.Hashing" Version="10.0.0" />
     <!-- Transitive of Avalonia.Desktop; pinned. Avalonia 12 requires 0.94.1+. -->
     <PackageVersion Include="Tmds.DBus.Protocol" Version="0.94.1" />

README.md

@@ -35,6 +35,9 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
 ---
 
+> [!IMPORTANT]
+> **Official channels:** Only **sharpemu.app** and the links listed in this GitHub repository are affiliated with SharpEmu. Any other websites, accounts, or donation pages are unofficial and unauthorized.
+
 > [!NOTE]  
 > SharpEmu supports Windows x64, Linux x64, and macOS x64. Apple Silicon Macs
 > can run the macOS x64 build through Rosetta 2, and Windows on ARM devices
@@ -55,17 +58,17 @@ Our goal is **not** to emulate PS4 games, as there is already an excellent emula
 
 ## Games Tested
 
-|               Demons Souls Remake                   |                     Tomb Raider V Remastered                        |
+|               Demon's Souls Remake                   |                     ASTRO BOT                        |
 | :-----------------------------------------------------------: | :--------------------------------------------------------------------------------------------: |
-| ![DeS screenshot](./.github/images/demons-souls.jpg) | ![Tomb Raider V](./.github/images/tomb-raider-v-remastered.jpg) |
+| ![DeS screenshot](./.github/images/demons-souls.jpg) | ![Astro Bot](./.github/images/astro-bot.jpg) |
 
-|                  Hades                    |                 Dead Cells                    |
+|                  ASTRO's PLAYROOM                    |                 Dead Cells                    |
 | :------------------------------------------------------------------------: | :------------------------------------------------------------------: |
-| ![Hades](./.github/images/hades.jpg) | ![Dead Cells](./.github/images/dead-cells.jpg) |
+| ![Astro's Playroom](./.github/images/astros-playroom.jpg) | ![Dead Cells](./.github/images/dead-cells.jpg) |
 
-|                  PAC-MAN World Re-PAC                    |                 Astro Bot                    |
+|                  God of War: Sons of Sparta                    |                 Tomb Raider V Remastered                    |
 | :------------------------------------------------------------------------: | :------------------------------------------------------------------: |
-| ![Pac-Man](./.github/images/pac-man-world-re-pac.jpg) | ![Astro Bot](./.github/images/astro-bot.jpg) |
+| ![GoW SOS](./.github/images/gow-sos.jpg) | ![Tomb Raider V](./.github/images/tomb-raider-v-remastered.jpg) |
 
 ## Status
 

docs/bink2-bridge.md

@@ -9,12 +9,12 @@ Demon's Souls plays Bink 2 (.bk2) files through a Bink implementation linked
 directly into eboot.bin. It does not use libSceVideodec, therefore an HLE video
 decoder cannot observe or replace those frames.
 
-SharpEmu observes successful guest .bk2 opens and, when a Bink decoder is
-available, presents its decoded BGRA frames at the normal guest-flip boundary.
-This preserves the game's own timing and lets the host Vulkan presenter display
-the movie without trying to execute the PS5-specific Bink GPU decode path.
+By default, SharpEmu leaves Bink decoding to the implementation linked into
+the game (`SHARPEMU_BINK_MODE=guest`).
 
-The default path decodes by calling FFmpeg's own C API directly from managed
+Set `SHARPEMU_BINK_MODE=native` to use the optional host bridge. It observes
+guest .bk2 opens and presents decoded frames at the guest-flip boundary. The
+host path decodes by calling FFmpeg's C API directly from managed
 code (`src/SharpEmu.Libs/Bink/FfmpegNativeBinkFrameSource.cs`, via the
 [FFmpeg.AutoGen](https://github.com/Ruslan-B/FFmpeg.AutoGen) P/Invoke
 bindings) against a custom FFmpeg build
@@ -24,26 +24,13 @@ libraries come from. No proprietary RAD SDK is needed to build or run
 SharpEmu, and there is no C/C++ code of SharpEmu's own involved in decoding
 -- SharpEmu.CLI.csproj only downloads a prebuilt release archive.
 
-Set `SHARPEMU_BINK_MODE=guest` to leave decoding to the Bink implementation
-statically linked into the game instead. Set `skip` only when explicitly
-testing a title whose cinematics are optional.
+Set `SHARPEMU_BINK_MODE=skip` only when explicitly testing a title whose
+cinematics are optional.
 
 Set SHARPEMU_BINK_MODE=dummy to retain the open and show a built-in,
 non-decoded placeholder frame. This requires no SDK, but is a visual diagnostic
 only; it does not decode the movie or alter its game logic.
-SHARPEMU_BINK_MODE=native is equivalent to the default and mainly useful for
-being explicit about it.
-
-The experimental `SHARPEMU_BINK_MODE=ffmpeg` override is unrelated to the
-default path above: instead of calling into FFmpeg in-process, it spawns a
-standalone `ffmpeg` executable and reads raw frames from its stdout
-(`src/SharpEmu.Libs/Bink/FfmpegBinkFrameSource.cs`). SharpEmu searches
-`SHARPEMU_FFMPEG_PATH`, the executable directory, its `ffmpeg` subdirectory,
-and then `PATH` (plus a couple of common Homebrew paths on macOS). That
-`ffmpeg` build must contain a Bink 2 decoder itself; a stock FFmpeg build that
-only recognizes the Bink container is not sufficient. Most users want the
-default `native` mode instead, which always has Bink 2 support since it's
-built against `ffmpeg-core` specifically.
+`SHARPEMU_BINK_MODE=ffmpeg` is an alias for `native`.
 
 ## Supplying the FFmpeg libraries
 

docs/sharpemu-gui-undocumented-env-vars.md

@@ -14,7 +14,7 @@ The GUI shows 14 variables on its **Options** and **Game options** pages. This l
 `SHARPEMU_LOG_NP`, `SHARPEMU_PROFILE_PERFORMANCE`, `SHARPEMU_PROFILE_PERFORMANCE_FRAME_TRACE`,
 `SHARPEMU_RENDERDOC`, `SHARPEMU_VK_DISABLE_IMPLICITS`, `SHARPEMU_STRICT_COMPUTE`, `SHARPEMU_VK_VALIDATION`, `SHARPEMU_WRITABLE_APP0`.
 
-The list contains 252 variables. The source was examined on 2026-09-19, branch `dev`.
+The list contains 269 variables. The source was examined on 2026-09-19, branch `dev`.
 The descriptions come from the code that reads each variable. The emulator was not started for this list.
 
 ## How to use a variable
@@ -29,18 +29,18 @@ The descriptions come from the code that reads each variable. The emulator was n
 
 | Group | Variables |
 | --- | --- |
-| Behavior switches | 16 |
-| GPU and Vulkan | 50 |
+| Behavior switches | 19 |
+| GPU and Vulkan | 59 |
 | Metal | 10 |
-| Audio and video | 7 |
+| Audio and video | 6 |
 | Input | 5 |
-| Memory and CPU | 17 |
+| Memory and CPU | 19 |
 | Loader | 11 |
 | Debugger | 1 |
 | Log channels | 72 |
-| Traces | 22 |
+| Traces | 25 |
 | Data dumps | 12 |
-| Performance measurement | 16 |
+| Performance measurement | 17 |
 | Internal | 1 |
 | Tests and tools | 12 |
 
@@ -52,13 +52,16 @@ These variables change how the emulator operates.
 | --- | --- | --- | --- |
 | `SHARPEMU_AGC_VERSION13_DEFAULTS` | text (`legacy`, `generic` or `0`) | Selects the register defaults for AGC version 13 requests. The default uses the version 11 compact tables. The values `legacy`, `generic` and `0` use the older generic layout. | `AgcExports.Init.cs` |
 | `SHARPEMU_DISABLE_LLE_LIBC` | `1` | Stops the use of the guest libc module for libc exports. The emulator then uses its HLE handlers for these exports. | `DirectExecutionBackend.cs` |
+| `SHARPEMU_HLE_FAST_MEMCPY` | `0` | Set to `0` to stop the native fast-path stub for the guest libc `memcpy` and `memmove`, so those imports use the managed HLE gateway again. | `DirectExecutionBackend.FastPath.cs` |
+| `SHARPEMU_HLE_FAST_PATH` | `0` | Set to `0` to stop the native fast-path stubs for `pthread_self` and `pthread_getspecific`, so those imports use the managed HLE gateway again. The stubs are on by default on macOS x64 and are off on any run that traces imports or pthreads. | `DirectExecutionBackend.FastPath.cs` |
 | `SHARPEMU_HOLD_FIRST_FLIP_MS` | number | Stops the thread that submits the flip for this number of milliseconds on one guest flip. The range is 0 to 60000 and the default is 0 (off). `SHARPEMU_HOLD_FLIP_NUMBER` selects the flip. | `VideoOutExports.cs` |
 | `SHARPEMU_HOLD_FLIP_NUMBER` | number | Selects the guest flip that `SHARPEMU_HOLD_FIRST_FLIP_MS` holds. The minimum is 1 and the default is 1 (the first flip). | `VideoOutExports.cs` |
 | `SHARPEMU_IGNORE_GUEST_EXCEPTIONS` | `1` | `sceKernelRaiseException` returns OK and does not call the installed guest exception handler. Default is off. | `KernelExceptionCompatExports.cs` |
-| `SHARPEMU_IMPORT_LOOP_GUARD_SECONDS` | number | Sets the time that an import call pattern can repeat before the import loop guard forces a guest exit. The default is 5 seconds. The value 0 turns the guard off. | `DirectExecutionBackend.Imports.cs`, `DirectExecutionBackend.cs` |
+| `SHARPEMU_IMPORT_LOOP_GUARD_SECONDS` | number | When `SHARPEMU_DISABLE_IMPORT_LOOP_GUARD=0` enables the guard, sets how long an import call pattern can repeat before a guest exit. The default is 5 seconds; 0 turns the guard off. | `DirectExecutionBackend.Imports.cs`, `DirectExecutionBackend.cs` |
 | `SHARPEMU_NET_REDIRECT` | IP address | Sends guest `connect` and `sendto` traffic to this host IP address. When unset, the emulator permits outbound guest traffic only to loopback addresses. If the value is not a valid IP address, the emulator keeps the original destination and permits the traffic. | `KernelSocketCompatExports.cs` |
 | `SHARPEMU_NO_FLIP_PACING` | `1` | Stops flip pacing. The emulator completes each flip immediately and does not wait for the display refresh time. The default is off. | `VideoOutExports.cs`, `VideoOutExports.FlipRequests.cs` |
 | `SHARPEMU_OVERLAY` | `0` | Hides the performance overlay at start, even when the video options have the overlay on. All other values use the video options. | `PerfOverlay.cs`, `PerformanceOverlayState.cs` |
+| `SHARPEMU_POSIX_GPU_FAULT_FAST_PATH` | `0` | Set to `0` to stop the POSIX fault bridge from offering GPU-tracked page faults to the GPU memory tracker before it builds the Win64 exception context. The fault then takes the full handler order again. | `DirectExecutionBackend.PosixSignals.cs` |
 | `SHARPEMU_RETAIN_SUBMITTED_INDEX_DATA` | `0` | The default is on. The emulator keeps a copy of submitted index data until the translated draws run. Set to `0` to stop this copy. Use `0` only for a comparison test. | `AgcExports.SubmittedGeometry.cs` |
 | `SHARPEMU_RETAIN_SUBMITTED_VERTEX_DATA` | `0` | The default is on. The emulator keeps a copy of submitted vertex data until the translated draws run. Set to `0` to stop this copy. Use `0` only for a comparison test. | `AgcExports.SubmittedGeometry.cs` |
 | `SHARPEMU_SAVEDATA_DIR` | path | Set the root directory for save data. The default is `user/savedata` next to the executable. When this variable is set, the emulator does not move save data from the old layout. | `SaveDataStorage.cs`, `SaveDataExports.cs` |
@@ -73,6 +76,7 @@ These variables change the GPU path or the Vulkan presenter.
 
 | Variable | Value | Function | Code that reads it |
 | --- | --- | --- | --- |
+| `SHARPEMU_ASYNC_GUEST_READBACK` | `0` | `0` makes a guest thread that reads GPU-written buffer memory wait until the render thread has copied the data back. The default starts the copy on the render thread and lets the guest thread wait for it on a separate readback slot, so the render thread continues. | `GuestBufferCache.cs` |
 | `SHARPEMU_CAPTURE_PIXEL_EXEC_PCS` | list (`pc:register` pairs) | At each given instruction PC, the pixel shader writes the execution flag to the given VGPR register. The value is 1.0 when the flag is set and 0.0 when it is not. `SHARPEMU_CAPTURE_PIXEL_VGPR_ADDRESS` must match the shader address. | `Gen5SpirvTranslator.cs` |
 | `SHARPEMU_CAPTURE_PIXEL_IMAGE_ADDRESS` | hex address | Selects the pixel shader for the image capture by its program address. The default is no capture. Use it with `SHARPEMU_CAPTURE_PIXEL_IMAGE_PC`. | `Gen5SpirvTranslator.cs` |
 | `SHARPEMU_CAPTURE_PIXEL_IMAGE_PC` | number (instruction PC) | Sets the image instruction whose result the SPIR-V translator copies to four VGPR registers. `SHARPEMU_CAPTURE_PIXEL_IMAGE_ADDRESS` must match the shader address. | `Gen5SpirvTranslator.cs` |
@@ -109,20 +113,28 @@ These variables change the GPU path or the Vulkan presenter.
 | `SHARPEMU_FORCE_TITLE_SOLID_FRAGMENT` | `1` | The Vulkan presenter reads the value into a field. No code uses the field, so the variable has no effect at this time. | `VulkanVideoPresenter.Draws.Recording.cs` |
 | `SHARPEMU_FORCE_TITLE_VERTEX_OUTPUTS_ONE` | `1` | Vertex export targets 32 to 35 write the vector (1, 1, 1, 1). This applies only to the vertex shader at guest address 0x0000000500780000. Default is off. | `Gen5SpirvTranslator.cs` |
 | `SHARPEMU_GPU_BACKEND` | `vulkan` or `metal` | Selects the guest GPU backend. The default is Vulkan. The value `metal` works only on macOS, and other hosts show a warning and use Vulkan. | `GuestGpu.cs` |
+| `SHARPEMU_GPU_WAIT_SPIN_US` | number (microseconds) | Sets how long a wait for GPU work polls before it blocks. A short poll saves the wake-up delay when the GPU finishes soon. `0` blocks at once. The default is 150. | `GpuWaitSpin.cs` |
 | `SHARPEMU_GRAPHICS_SUBGROUPS` | `0` or `1` | Set `1` to use native Vulkan subgroup operations in graphics shaders. Set `0` to use the fallback path. When unset, the presenter uses them only if the subgroup size is 32 and the vertex and fragment stages support subgroups. | `VulkanVideoPresenter.cs`, `VulkanVideoPresenter.Device.Setup.cs` |
+| `SHARPEMU_IMAGE_LOOKUP_MEMO` | `0` | `0` turns off the image lookup memo. The default keeps the result of each image lookup that found an image with the same backing, and gives it again for the same request until an image is registered or removed. | `GuestImageCache.Lookup.cs` |
 | `SHARPEMU_MARK_PIXEL_PCS` | list of `pc:register` pairs | Makes the SPIR-V pixel shader write the float value 1.0 to a shader register when execution reaches the given instruction PC. Use decimal numbers, a register below 256, and a comma between pairs. It has an effect only for the shader address in `SHARPEMU_CAPTURE_PIXEL_VGPR_ADDRESS`. | `Gen5SpirvTranslator.cs` |
 | `SHARPEMU_MAX_GUEST_WORK_PER_RENDER` | number | Sets the maximum number of guest command stream slices that the Vulkan presenter runs in one render pass. The default is 1024, or 256 on macOS. The value must be more than 0. | `VulkanVideoPresenter.cs`, `VulkanVideoPresenter.CommandStream.cs` |
 | `SHARPEMU_RENDERDOC_CAPTURE_TIMEOUT_SECONDS` | number (seconds) | Set the maximum time for a RenderDoc frame capture. The emulator discards a capture that does not end in this time. The range is 1 to 120. The default is 15. | `RenderDocCapture.cs` |
 | `SHARPEMU_RENDERDOC_DLL` | path | Set the path of the RenderDoc library file. The emulator tries this path first. When unset or when the load fails, it searches the default library name and the known install paths. | `RenderDocCapture.cs` |
 | `SHARPEMU_RENDERDOC_WAIT` | number (seconds) or `enter` | Set to make the emulator wait before it starts Vulkan, so that you can attach RenderDoc. `enter` waits until you press Enter. A number waits that many seconds, from 1 to 300. Other text waits 15 seconds. | `VulkanVideoPresenter.Device.Setup.cs` |
 | `SHARPEMU_RENDER_WORK_BUDGET_MS` | number (milliseconds) | Set the maximum time that one render call uses for queued guest work in the Vulkan presenter. Work that remains stays in the queue for the next frame. `0` removes the limit. The default is 12 on macOS and 0 on other hosts. | `VulkanVideoPresenter.cs`, `VulkanVideoPresenter.RenderLoop.cs` |
+| `SHARPEMU_RESOURCE_PREFETCH` | `0` | `0` makes the shader resource materialization read each guest word one at a time. The default reads adjacent words of descriptors and the flattened resource table in one read of resident guest memory. A range that the GPU may still own is read word by word as before. | `ShaderProgramCache.cs`, `RawReadPrefetch.cs` |
 | `SHARPEMU_SHADER_MAX_STEPS` | number | Set the maximum number of dispatcher loop steps in each translated shader invocation. The limit makes sure that an incorrect loop stops. `0` removes the limit. The default is 100000. | `Gen5SpirvTranslator.cs`, `Gen5MslTranslator.cs` |
+| `SHARPEMU_SHADER_PREWARM` | `0` | `0` turns off the shader prewarm list. By default, each compute program that a game compiles is added at once to `shader-prewarm.bin` in `user/pipeline_cache/<title id>/`, so a stopped game keeps the list. At the next launch after a change of the shader translator or of the GPU driver, background threads translate the listed programs again and create their pipelines, so that the driver compiles them before the game asks for them. The `shader-prewarm.stamp` file names the build and driver that last did this; with the same build and driver, the launch does no prewarm work. The log shows `Shader prewarm done` and `Shader prewarm hits`. On Windows it replaces the cache file by default; on Linux it works beside the cache file. It has no effect with the per-shader cache files of `SHARPEMU_VK_PIPELINE_CACHE_SHARDS`. | `VulkanVideoPresenter.ShaderPrewarm.cs`, `ShaderPrewarmList.cs`, `ShaderProgramCache.cs` |
 | `SHARPEMU_SKIP_ALL_COMPUTE` | `1` | Set to `1` to make the Metal presenter skip all compute dispatches. The Vulkan presenter reads the value but does not use it. The default is off. | `MetalVideoPresenter.Compute.cs`, `VulkanVideoPresenter.cs` |
 | `SHARPEMU_SKIP_TALL_COMPUTE_Z` | number | Effect not clear from the code. The Vulkan presenter reads the number into a field for a minimum Z group count. No code uses that field. The default is 0. | `VulkanVideoPresenter.cs` |
+| `SHARPEMU_SRT_NATIVE` | `0` | `0` turns off the compiled shader resource (SRT) evaluator. By default, the resource plan of each shader is compiled once to .NET code (`DynamicMethod`) on a low-priority background thread named `SRT compiler`; until it is ready, the plan is evaluated by the interpreter, so the first use of a new shader does not wait for the compilation. With `0`, every plan always uses the interpreter. The compiled path is also off when the runtime does not support dynamic code, for example in a Native AOT build. | `CompiledResourceEvaluator.cs`, `ShaderResourcePlan.cs`, `RuntimeValueEvaluator.cs` |
+| `SHARPEMU_SUSPEND_POINTS_IN_FLIGHT` | `0` | `0` makes `sceAgcSuspendPoint` wait until the frame boundary it queued is processed. The default lets one boundary wait behind the graphics commands, so the guest CPU can run one frame ahead. A wait that follows its own queue's store to the same label still sees that value when the title rewrites the label for the next frame (Dead Cells). | `CommandStreamQueue.cs`, `GpuCommandInterpreter.cs` |
 | `SHARPEMU_VK_DEBUG_LABELS` | `1` | Turns on Vulkan object names and command labels for capture tools. `SHARPEMU_VK_VALIDATION=1` also turns them on. Default is off because the labels add overhead to each draw. | `VulkanVideoPresenter.Draws.Recording.cs` |
 | `SHARPEMU_VK_DEVICE` | text (part of a device name) | Selects the Vulkan device whose name contains this text. The comparison ignores case. When unset, the presenter gives a score to each device and prefers a discrete GPU. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanVideoPresenter.cs` |
-| `SHARPEMU_VK_PIPELINE_CACHE_PATH` | path | Sets the path of the Vulkan pipeline cache file. The path can contain environment variables. Default is `user/pipeline_cache/<title id>/` below the application directory. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanPipelineCacheStorage.cs` |
-| `SHARPEMU_VK_PIPELINE_CACHE` | `0` | `0` stops the save and the load of the Vulkan pipeline cache file. The cache then stays in memory only. Default is a persistent cache file. | `VulkanVideoPresenter.Device.Setup.cs` |
+| `SHARPEMU_VK_PIPELINE_CACHE_PATH` | path | Sets the path of the Vulkan pipeline cache file. The path can contain environment variables. Default is `user/pipeline_cache/<title id>/` below the application directory. The shader prewarm list goes to the same directory. With the per-shader cache, the files go to a `.shards` directory next to this path. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanPipelineCacheStorage.cs` |
+| `SHARPEMU_VK_PIPELINE_CACHE` | `0`, `1` or `file` | Selects the Vulkan pipeline cache file, which keeps the driver's compiled pipelines. `1` or `file` saves and loads one cache file. `0` keeps the cache in memory only on every system. The default is memory only on Windows: the GPU driver keeps its own shader cache on disk, and the shader prewarm list (`SHARPEMU_SHADER_PREWARM`) rebuilds it after an update. Linux keeps a cache file by default, and macOS keeps per-shader files. | `VulkanVideoPresenter.Device.Setup.cs` |
+| `SHARPEMU_VK_PIPELINE_CACHE_SHARDS` | `1` or `0` | `1` keeps one Vulkan pipeline cache file for each compute shader and for each vertex and pixel shader pair, in `vulkan-pipeline-cache.bin.shards`, also on Windows. `0` keeps the whole cache in one file. The default is `1` on macOS and `0` on other systems: NVIDIA adds about 2 MB of driver data to every cache file, so a file for each shader uses much more disk. A shard file loads when its pipeline is first created, and a save writes only the files that got new pipelines. The shard mode removes the old single file when `SHARPEMU_VK_PIPELINE_CACHE_PATH` is not set. A cache file that grows over 256 MiB is emptied, so the next launch starts it again. | `VulkanVideoPresenter.Device.Setup.cs`, `VulkanVideoPresenter.PipelineCacheShards.cs` |
+| `SHARPEMU_VK_PIPELINE_CACHE_LEGACY_SHARDS` | `1` | `1` names the per-shader cache files by the guest shader hash. The default names them by a hash of the translated SPIR-V, so a translator change does not load records that no longer match. | `VulkanVideoPresenter.PipelineCacheShards.cs` |
 
 ## Metal
 
@@ -149,7 +161,6 @@ These variables apply to audio output and video playback.
 | --- | --- | --- | --- |
 | `SHARPEMU_ALSA_DEVICE` | text (ALSA device name) | Sets the ALSA playback device on Linux. The default is `default`. | `PosixAlsaAudioStream.cs` |
 | `SHARPEMU_AUDIO_LATENCY_MS` | number (milliseconds) | Sets the target depth of the SDL audio queue, which is the playback latency. The default is 60. Values of zero or less use the default. | `SdlHostAudio.cs` |
-| `SHARPEMU_AUDIO_OUT2_STACK_WRITES` | `1` or list (`portstate`, `systemstate`, `speaker`) | Controls writes of AudioOut2 results to output buffers on the guest stack. The default `1` permits all writes. A list permits only the named outputs and the other calls return success without a write. | `AudioOut2Exports.cs` |
 | `SHARPEMU_BINK_MODE` | text (`native`, `ffmpeg`, `dummy`, `skip`, `guest`) | Selects how the emulator handles Bink movies. `native` or `ffmpeg` decodes on the host and is the default. `dummy` shows a placeholder frame, `skip` skips the movie, and `guest` lets the guest decode. | `HostMovieBridge.cs` |
 | `SHARPEMU_LOG_MOVIE_SYNC` | `1` | Records the difference between the movie clock and the guest audio position during movie playback. The emulator reads the value one time at start. | `MediaFramePlayback.cs` |
 | `SHARPEMU_MOVIE_CLOCK` | `wall` | Sets the time base for host-decoded movie playback. By default, playback follows the guest audio clock and uses the wall clock when no guest audio flows. `wall` makes playback always use the wall clock. | `MediaFramePlayback.cs` |
@@ -183,6 +194,7 @@ These variables apply to guest memory and guest code execution.
 | `SHARPEMU_LAZY_RESERVE_PRIME_MB` | number | Sets the number of megabytes that the emulator commits at the start of each reserve-only memory region. The default is 64 and the maximum is 4096. The value 0 turns the initial commit off. | `PhysicalVirtualMemory.cs` |
 | `SHARPEMU_NATIVE_WORKER_MAX_CONCURRENT` | number | Sets the maximum number of native guest worker runs that execute at the same time. The default is 2. The emulator limits the value to the range 1 to 64. | `DirectExecutionBackend.NativeWorker.cs`, `DirectExecutionBackend.cs` |
 | `SHARPEMU_GUEST_AFFINITY` | `1` | Applies the guest thread affinity to the host threads. The default leaves host threads unpinned, because pinning let spinning guest workers starve the render thread. | `DirectExecutionBackend.cs` |
+| `SHARPEMU_RENDER_CORE` | `0` | `0` turns off the render core reservation. On Windows hosts with 8 to 64 logical processors, the default gives the render thread the last physical core of the fastest efficiency class with a high priority, and keeps guest threads off that core. | `HostLaneReservation.cs`, `VulkanVideoPresenter.Present.cs`, `DirectExecutionBackend.cs` |
 | `SHARPEMU_RESERVED_HOST_LANES` | number | Set the number of host logical processors that guest thread affinity does not use. The emulator keeps these processors for its own threads. The default is three eighths of the processor count, with a minimum of 2. It has an effect only with `SHARPEMU_GUEST_AFFINITY=1`. | `DirectExecutionBackend.cs` |
 | `SHARPEMU_TSC_FREQ_HZ` | number (Hz, minimum 1000000) | Sets the TSC frequency that the kernel library reports to the guest. When unset, the emulator uses the calibrated RDTSC frequency, then the CPUID frequency, then the host stopwatch frequency. | `KernelRuntimeCompatExports.cs` |
 | `SHARPEMU_WATCH_BULK_DEST_HI` | hex number | Limits the `SHARPEMU_WATCH_BULK_TORN` scan to writes whose upper 32 address bits equal this value. When unset, the scan uses the direct-memory address band. | `GuestWriteWatch.cs` |
@@ -311,9 +323,11 @@ Each variable records a detailed sequence of events. Traces can be large.
 | `SHARPEMU_PROBE_IMPORT_RET` | text (NID or `*`) | Set an import NID, or `*` for all imports. For the first 8 applicable import calls, the emulator writes the bytes and the disassembly before the return address. The default is off. | `DirectExecutionBackend.cs`, `DirectExecutionBackend.Imports.cs`, `DirectExecutionBackend.Diagnostics.cs` |
 | `SHARPEMU_RTC_PROBE_RANGE` | hex address range (`start-end`) | Set a range of guest addresses. When a caller of `sceRtcGetCurrentTick` returns into this range, the emulator writes 0x100 bytes of code near that return address. It does this one time only. | `RtcExports.cs` |
 | `SHARPEMU_TRACE_AGC_EQ_ACCESSORS` | `1` | Set to `1` to write an `agc.eq_accessor` line for calls to the AGC event accessor functions. Each line shows the accessor, the event address, the result and the event bytes. After 64 lines, the emulator writes only at power-of-two counts. | `AgcExports.Events.cs` |
+| `SHARPEMU_TRACE_DCC_WRITERS` | `1` | Writes a `[GPU][DCC_WRITER]` line with the shader program and a call stack for each GPU buffer write that overlaps DCC metadata. It also writes `[GPU][BOUNDED_FILL_REFUSED]` lines when a fill shader is not changed into a buffer fill. Each kind writes a maximum of 64 lines. | `DccWriterTrace.cs` |
 | `SHARPEMU_TRACE_FOCUSED_CONTINUATION` | `1` | Set to `1` to write `focused_continuation` lines for guest thread continuations. The emulator writes a line only when the stack pointer is in the range 0x6FFFAC000000 to 0x6FFFAC200000. | `DirectExecutionBackend.cs` |
 | `SHARPEMU_TRACE_FRAME_PACKETS` | `1` | Writes a `[FRAMEPKT]` line at a flip with the draw count and the dispatch count of the frame. It shows the first 8 flips, each 60th flip, and each flip that has no draws. Default is off. | `AgcExports.CommandStream.cs` |
 | `SHARPEMU_TRACE_GPU_MEMORY_ADDRESS` | hex address or `auto` | Writes `[GPU][MEMORY_TRACE]` lines for GPU memory events that touch the page of the given address. The value `auto` selects the page of the first device-address fault. Default is off. | `GuestGpuMemoryHook.cs` |
+| `SHARPEMU_TRACE_GPU_READS` | `1` | Writes a `[GPU][SYNC_READ]` line with the shader hash, the stage and the address when a shader resource read must wait for GPU-written memory. It writes one line for each shader and page, and a maximum of 64 lines. | `GpuReadTrace.cs`, `VulkanVideoPresenter.Pipelines.cs` |
 | `SHARPEMU_TRACE_GUEST_IMAGES` | `1`, `present` or `every:N[@M]` | `1` and `present` write Vulkan present trace lines (`vk.present_taken`, `vk.present_dropped`, `vk.present_sample`) and up to 64 Metal `agc.texture_fallback` lines. The code reads the `every:N[@M]` form, but no code uses the result. Default is off. | `VulkanVideoPresenter.Draws.Recording.cs`, `VulkanVideoPresenter.Present.cs`, `MetalTextureSnapshots.cs` |
 | `SHARPEMU_TRACE_GUEST_IMAGE_ADDRS` | list of hex addresses or `*` | The guest image write tracker writes `[WT][LIFETIME]` lines for each tracked range that contains a listed address. `*` selects all ranges. The Vulkan presenter also reads the list, but no code uses that filter. | `GuestImageWriteTracker.cs`, `VulkanVideoPresenter.Draws.Recording.cs` |
 | `SHARPEMU_TRACE_GUEST_IMAGE_FORMAT` | text (Vulkan format name) | Effect not clear from the code. The Vulkan presenter keeps the name for an image filter that compares the image format, but no code calls the filter. | `VulkanVideoPresenter.Draws.Recording.cs` |
@@ -325,6 +339,7 @@ Each variable records a detailed sequence of events. Traces can be large.
 | `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_ADDRS` | list of hex addresses or `*` | Writes a `vk.present_sample` trace line when the presenter shows a guest image at a listed address. It records the first presentation of each address unless `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_OCCURRENCE` is set. | `VulkanVideoPresenter.Draws.Recording.cs`, `VulkanVideoPresenter.RenderLoop.cs` |
 | `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_OCCURRENCE` | number | Selects which presentation of an address in `SHARPEMU_TRACE_PRESENTED_GUEST_IMAGE_ADDRS` the presenter records. Default is 0, which selects the first presentation. | `VulkanVideoPresenter.Draws.Recording.cs` |
 | `SHARPEMU_TRACE_TITLE_INTERFACE` | `1` | The SPIR-V translator writes `[AGC][TITLE-INTERFACE]` lines with the export and interpolation instructions of a shader. It does this only for the programs at addresses 0x0000000500780000 and 0x0000000500781200. | `Gen5SpirvTranslator.cs` |
+| `SHARPEMU_TRACE_WRITER_ADDRESS` | hex address | Writes a `[GPU][TARGET_WRITER]` line with the shader program and a call stack for each GPU buffer write that covers this guest address. It writes a maximum of 64 lines. Default is off. | `DccWriterTrace.cs` |
 
 ## Data dumps
 
@@ -357,6 +372,7 @@ Each variable records timings or counts.
 | `SHARPEMU_PERF_MEM` | `1` | Set to `1` to count the POSIX fault signals that the signal handler receives. The emulator writes a `[PERF][MEM] posix_faults` line after each 100000 signals. This has an effect only on POSIX hosts. | `DirectExecutionBackend.PosixSignals.cs` |
 | `SHARPEMU_PROFILE_DCB_PARSE` | `1` | Set to `1` to measure the time to parse draw command buffers. The emulator writes `[PERF][DCB_PARSE]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `DcbParseProfile.cs` |
 | `SHARPEMU_PROFILE_DCB_SUBMISSION` | `1` | Set to `1` to measure command buffer submission and geometry snapshot work. The emulator writes `[PERF][DCB_SUBMIT]`, `[PERF][VERTEX_SNAPSHOT]` and `[PERF][SNAPSHOT_PREPASS]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `DcbSubmissionProfile.cs` |
+| `SHARPEMU_PROFILE_GPU_DRAWS` | `1` | Use with the render profile. Writes a GPU timestamp after each draw and dispatch, so that the `[PERF][GPU_INTERVAL]` lines give the GPU time of each pipeline. The default writes only two timestamps for each submission for the `[PERF][GPU_BUSY]` lines, because one timestamp for each draw can change the GPU time. | `VulkanCommandProfile.cs` |
 | `SHARPEMU_PROFILE_GUEST_IMAGE_TRACKER` | `1` | Set to `1` to record counters for the guest image write tracker. The emulator writes `[PERF][GUEST_IMAGE_TRACKER]` and `[PERF][GUEST_IMAGE_TRACKER_RANGE]` lines. `SHARPEMU_PROFILE_PERFORMANCE=1` also starts this profile. | `GuestImageWriteTracker.cs` |
 | `SHARPEMU_PROFILE_GUEST_RIP_INTERVAL_MS` | number (milliseconds) | Set the time between samples of the guest code profiler. The value must be more than 0. The default is 2. | `DirectExecutionBackend.GuestSampler.cs` |
 | `SHARPEMU_PROFILE_GUEST_RIP_REPORT_S` | number (seconds) | Set the time between reports of the guest code profiler. The value must be more than 0. The default is 15. | `DirectExecutionBackend.GuestSampler.cs` |

src/SharpEmu.CLI/Program.cs

@@ -323,6 +323,16 @@ internal static partial class Program
                     VideoOutExports.NotifyHostInterrupt();
                 };
                 Console.CancelKeyPress += cancelHandler;
+                // SIGTERM (launchd, process managers, `kill`) takes the same cooperative shutdown: the
+                // runtime's default exits with GPU work in flight, which leaves the host driver to reclaim
+                // resources the device still owns.
+                using var terminateRegistration = OperatingSystem.IsWindows()
+                    ? null
+                    : PosixSignalRegistration.Create(PosixSignal.SIGTERM, context =>
+                    {
+                        context.Cancel = true;
+                        VideoOutExports.NotifyHostInterrupt();
+                    });
 
                 Console.Error.WriteLine($"[DEBUG] Running: {ebootPath}");
                 result = runtime.Run(ebootPath);

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Diagnostics.cs

@@ -88,6 +88,14 @@ public sealed partial class DirectExecutionBackend
 					return $"{kvp.Key}: {cores:F2}cores {seconds:F1}s n={callCount} {perCallUs:F2}us/call";
 				});
 			System.Console.Error.WriteLine($"[PERF][HLE] cost: {string.Join(" | ", top)}");
+
+			if (SharpEmu.HLE.GuestFastPath.Enabled)
+			{
+				var fastPath = SharpEmu.HLE.GuestFastPath.SnapshotCounters();
+				System.Console.Error.WriteLine(
+					$"[PERF][HLE] fast_path: self_hits={fastPath.SelfHits} " +
+					$"getspecific_hits={fastPath.GetspecificHits} blocks={fastPath.Blocks}");
+			}
 		}
 	}
 

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.FastPath.cs

@@ -0,0 +1,286 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Collections.Generic;
+using System.Runtime.InteropServices;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Core.Cpu.Native;
+
+/// <summary>
+/// Native fast-path stubs for the trivial per-thread imports that dominate the
+/// HLE call count. Each stub answers from <see cref="GuestFastPath"/>'s
+/// per-host-thread block and jumps to the normal import trampoline whenever it
+/// cannot, so the managed implementation stays the single source of truth for
+/// every case the stub does not handle.
+/// </summary>
+public sealed unsafe partial class DirectExecutionBackend
+{
+	internal enum GuestFastPathStub
+	{
+		None,
+		PthreadSelf,
+		PthreadGetspecific,
+		MemoryCopy,
+	}
+
+	// scePthreadSelf / pthread_self.
+	private const string PthreadSelfNid = "aI+OeCz8xrQ";
+	private const string PosixPthreadSelfNid = "EotR8a3ASf4";
+
+	// scePthreadGetspecific / pthread_getspecific.
+	private const string PthreadGetspecificNid = "eoht7mQOCmo";
+	private const string PosixPthreadGetspecificNid = "0-KXaS70xy4";
+
+	// memcpy / memmove.
+	private const string MemcpyNid = "Q3VBxCXhUHs";
+	private const string MemmoveNid = "+P6FRGH4LfA";
+
+	// Guest memory is identity-mapped and every fault the copy can take (write tracking, lazy
+	// commit) is resolved from the fault address alone, so the copy may run as guest-side code.
+	// SHARPEMU_HLE_FAST_MEMCPY=0 keeps it on the managed export.
+	private static readonly bool GuestMemoryCopyStubEnabled =
+		!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_HLE_FAST_MEMCPY"), "0", StringComparison.Ordinal);
+
+	private uint _fastPathBlockTlsIndex = uint.MaxValue;
+	private bool _guestFastPathEnabled;
+	private int _guestFastPathStubCount;
+
+	/// <summary>
+	/// Decides whether native fast-path stubs may be installed for this run and
+	/// arms <see cref="GuestFastPath"/> if so. Any diagnostic mode that must
+	/// observe every import call keeps the fast path off, because a stub answers
+	/// without ever reaching the managed gateway that does the tracing.
+	/// </summary>
+	private void ConfigureGuestFastPath()
+	{
+		_guestFastPathEnabled = false;
+		_guestFastPathStubCount = 0;
+
+		// Emission uses the macOS pthread gs-indexed key array. Windows and
+		// Linux keep the managed gateway until their TLS read is emitted too.
+		if (!OperatingSystem.IsMacOS() ||
+			RuntimeInformation.ProcessArchitecture != Architecture.X64)
+		{
+			return;
+		}
+
+		if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_HLE_FAST_PATH"), "0", StringComparison.Ordinal))
+		{
+			Console.Error.WriteLine("[LOADER][INFO] HLE native fast path disabled by SHARPEMU_HLE_FAST_PATH=0.");
+			return;
+		}
+
+		if (_logAllImports ||
+			!string.IsNullOrEmpty(_importFilter) ||
+			string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_PTHREADS"), "1", StringComparison.Ordinal))
+		{
+			Console.Error.WriteLine(
+				"[LOADER][INFO] HLE native fast path disabled: import/pthread tracing needs every call in the gateway.");
+			return;
+		}
+
+		if (_fastPathBlockTlsIndex == uint.MaxValue)
+		{
+			_fastPathBlockTlsIndex = TlsAlloc();
+			if (_fastPathBlockTlsIndex == uint.MaxValue)
+			{
+				return;
+			}
+		}
+
+		var tlsIndex = _fastPathBlockTlsIndex;
+		GuestFastPath.Enable(block => TlsSetValue(tlsIndex, block));
+		_guestFastPathEnabled = true;
+	}
+
+	private static GuestFastPathStub ClassifyGuestFastPathStub(string nid) => nid switch
+	{
+		PthreadSelfNid or PosixPthreadSelfNid => GuestFastPathStub.PthreadSelf,
+		PthreadGetspecificNid or PosixPthreadGetspecificNid => GuestFastPathStub.PthreadGetspecific,
+		MemcpyNid or MemmoveNid => GuestFastPathStub.MemoryCopy,
+		_ => GuestFastPathStub.None,
+	};
+
+	/// <summary>
+	/// Builds the native stub for <paramref name="nid"/>, falling back to
+	/// <paramref name="fallbackTrampoline"/> (the import's managed gateway
+	/// trampoline) for every case the stub declines.
+	/// </summary>
+	private unsafe bool TryCreateGuestFastPathStub(string nid, nint fallbackTrampoline, out nint address)
+	{
+		address = 0;
+		if (!_guestFastPathEnabled || fallbackTrampoline == 0)
+		{
+			return false;
+		}
+
+		var kind = ClassifyGuestFastPathStub(nid);
+		if (kind == GuestFastPathStub.None ||
+			// The write watch inspects every managed guest write, which a native copy never reaches.
+			(kind == GuestFastPathStub.MemoryCopy && (!GuestMemoryCopyStubEnabled || GuestWriteWatch.Armed)))
+		{
+			return false;
+		}
+
+		var code = EmitGuestFastPathStub(kind, _fastPathBlockTlsIndex, fallbackTrampoline);
+		const uint stubAllocationSize = 128u;
+		if (code.Count > stubAllocationSize)
+		{
+			return false;
+		}
+
+		void* memory = VirtualAlloc(null, stubAllocationSize, 12288u, 64u);
+		if (memory == null)
+		{
+			return false;
+		}
+
+		for (var i = 0; i < code.Count; i++)
+		{
+			((byte*)memory)[i] = code[i];
+		}
+
+		uint oldProtect = 0;
+		if (!VirtualProtect(memory, stubAllocationSize, 32u, &oldProtect))
+		{
+			VirtualFree(memory, 0u, 32768u);
+			return false;
+		}
+
+		FlushInstructionCache(GetCurrentProcess(), memory, (nuint)code.Count);
+		address = (nint)memory;
+		_importHandlerTrampolines.Add(address);
+		_guestFastPathStubCount++;
+		return true;
+	}
+
+	/// <summary>
+	/// Emits one fast-path stub. The stubs obey the SysV ABI the guest calls
+	/// them with: the answer goes in RAX, only RAX and the arithmetic flags are
+	/// clobbered (both caller-saved across a call), and on the slow path every
+	/// register - including the incoming RAX that carries the variadic vector
+	/// count - is restored before jumping to the trampoline.
+	/// </summary>
+	internal static List<byte> EmitGuestFastPathStub(
+		GuestFastPathStub kind,
+		uint blockTlsIndex,
+		nint fallbackTrampoline)
+	{
+		if (kind == GuestFastPathStub.MemoryCopy)
+		{
+			return EmitGuestMemoryCopyStub(fallbackTrampoline);
+		}
+
+		var code = new List<byte>(48);
+		var slowPathFixups = new List<int>();
+
+		void Emit(params byte[] bytes) => code.AddRange(bytes);
+
+		// Emits a short conditional branch to the slow path; 0x74 is JE, 0x73 is JAE.
+		void EmitBranchToSlowPath(byte opcode)
+		{
+			Emit(opcode, 0x00); // rel8, patched once the slow-path offset is known
+			slowPathFixups.Add(code.Count - 1);
+		}
+
+		void EmitJumpToSlowPath() => EmitBranchToSlowPath(0x74);
+
+		// push rax: the guest's incoming RAX/AL must survive a slow-path bail.
+		Emit(0x50);
+
+		// mov rax, gs:[blockTlsIndex * 8] - the macOS pthread key array is the
+		// gs-based thread specific data array, so a key read is a single load.
+		Emit(0x65, 0x48, 0x8B, 0x04, 0x25);
+		code.AddRange(BitConverter.GetBytes(checked(blockTlsIndex * 8u)));
+
+		// test rax, rax / je slow: no block published on this host thread.
+		Emit(0x48, 0x85, 0xC0);
+		EmitJumpToSlowPath();
+
+		switch (kind)
+		{
+			case GuestFastPathStub.PthreadSelf:
+				// cmp qword [rax + SelfHandleOffset], 0 / je slow: no guest
+				// thread bound here, and a host thread's pthread_self has to
+				// reach the managed export for its scheduler registration.
+				Emit(0x48, 0x83, 0x78, checked((byte)GuestFastPath.BlockSelfHandleOffset), 0x00);
+				EmitJumpToSlowPath();
+				// inc qword [rax + SelfHitsOffset]
+				Emit(0x48, 0xFF, 0x40, checked((byte)GuestFastPath.BlockSelfHitsOffset));
+				// mov rax, [rax + SelfHandleOffset]
+				Emit(0x48, 0x8B, 0x40, checked((byte)GuestFastPath.BlockSelfHandleOffset));
+				break;
+
+			case GuestFastPathStub.PthreadGetspecific:
+				// cmp qword [rax + TlsValuesOffset], 0 / je slow: this thread
+				// has no value table published.
+				Emit(0x48, 0x83, 0x78, checked((byte)GuestFastPath.BlockTlsValuesOffset), 0x00);
+				EmitJumpToSlowPath();
+				// cmp rdi, TlsSlotCount / jae slow. An out-of-range or
+				// sign-extended negative key is answered by the managed path,
+				// which truncates it to int and consults the key registry.
+				Emit(0x48, 0x81, 0xFF);
+				code.AddRange(BitConverter.GetBytes(GuestFastPath.TlsSlotCount));
+				EmitBranchToSlowPath(0x73);
+				// inc qword [rax + GetspecificHitsOffset]
+				Emit(0x48, 0xFF, 0x40, checked((byte)GuestFastPath.BlockGetspecificHitsOffset));
+				// mov rax, [rax + TlsValuesOffset] / mov rax, [rax + rdi*8]
+				Emit(0x48, 0x8B, 0x40, checked((byte)GuestFastPath.BlockTlsValuesOffset));
+				Emit(0x48, 0x8B, 0x04, 0xF8);
+				break;
+
+			default:
+				throw new ArgumentOutOfRangeException(nameof(kind), kind, "Unknown fast-path stub kind.");
+		}
+
+		// add rsp, 8 (drop the saved RAX - the result replaces it) / ret
+		Emit(0x48, 0x83, 0xC4, 0x08);
+		Emit(0xC3);
+
+		var slowPathOffset = code.Count;
+
+		// pop rax / jmp qword [rip+0] - the absolute target follows the
+		// instruction, so nothing else is clobbered on the way out.
+		Emit(0x58);
+		Emit(0xFF, 0x25, 0x00, 0x00, 0x00, 0x00);
+		code.AddRange(BitConverter.GetBytes((long)fallbackTrampoline));
+
+		foreach (var fixup in slowPathFixups)
+		{
+			var delta = slowPathOffset - (fixup + 1);
+			if (delta is < 0 or > 127)
+			{
+				throw new InvalidOperationException("Fast-path stub slow-path branch is out of rel8 range.");
+			}
+
+			code[fixup] = (byte)delta;
+		}
+
+		return code;
+	}
+
+	/// <summary>
+	/// memcpy/memmove(dst, src, n) as a forward <c>rep movsb</c>, returning dst. The libc
+	/// export copies with memmove semantics, so a destination that starts inside the source
+	/// (where a forward copy would read bytes it already overwrote) takes the managed path.
+	/// Only RAX, RCX, RSI, RDI and the flags change - all caller-saved - and the direction
+	/// flag is clear on entry per the SysV ABI.
+	/// </summary>
+	internal static List<byte> EmitGuestMemoryCopyStub(nint fallbackTrampoline)
+	{
+		var code = new List<byte>(40);
+		// mov rcx, rdi / sub rcx, rsi / cmp rcx, rdx / jb slow: dst - src < n (unsigned) is
+		// exactly a destination in (src, src + n) or equal to src with a non-empty copy.
+		code.AddRange([0x48, 0x89, 0xF9, 0x48, 0x29, 0xF1, 0x48, 0x39, 0xD1, 0x72, 0x00]);
+		var slowPathFixup = code.Count - 1;
+		// mov rax, rdi / mov rcx, rdx / rep movsb / ret
+		code.AddRange([0x48, 0x89, 0xF8, 0x48, 0x89, 0xD1, 0xF3, 0xA4, 0xC3]);
+		code[slowPathFixup] = checked((byte)(code.Count - (slowPathFixup + 1)));
+		// jmp qword [rip+0] with the absolute trampoline address after it.
+		code.AddRange([0xFF, 0x25, 0x00, 0x00, 0x00, 0x00]);
+		code.AddRange(BitConverter.GetBytes((long)fallbackTrampoline));
+		return code;
+	}
+}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Imports.cs

@@ -345,6 +345,14 @@ public sealed partial class DirectExecutionBackend
 			Console.Error.WriteLine(
 				$"[LOADER][TRACE] bootstrap_call#{num}: op=0x{value:X16} sym_ptr=0x{value2:X16} sym='{symbolText}' out_ptr=0x{num3:X16} ret=0x{num7:X16}");
 		}
+		// Once the host is shutting down, a guest thread still running reaches no more HLE: the
+		// services behind the imports are being torn down, and a title that sees them fail (a null
+		// command buffer from the GPU library, say) crashes the process on its way out.
+		if (_forcedGuestExit && !ActiveForcedGuestExit && TryEndGuestSliceForShutdown(argPackPtr))
+		{
+			cpuContext[CpuRegister.Rax] = 1uL;
+			return 1uL;
+		}
 		if (!isGuestWorker &&
 			!ActiveForcedGuestExit &&
 			ShouldForceGuestExitOnImportLoop(in importStubEntry, num7, num, value, value2))
@@ -1236,6 +1244,17 @@ public sealed partial class DirectExecutionBackend
 			return TryReadHostQword(address, out value);
 		}
 
+		// Stack arguments sit on the calling guest thread's own stack, which the backend mapped read-write
+		// for the thread's lifetime and no tracker ever protects. Reading inside it needs no query: the
+		// cached range below is keyed by a mapping generation that every tracker protection change bumps,
+		// so falling through here cost a locked host region query per argument on nearly every import.
+		if (_activeGuestThreadState is { StackSize: > 0 } thread &&
+			address >= thread.StackBase && address <= thread.StackBase + thread.StackSize - sizeof(ulong))
+		{
+			value = *(ulong*)address;
+			return true;
+		}
+
 		var generation = HostMemory.MappingGeneration;
 		if (generation == _importReadableGeneration &&
 			address >= _importReadableStart && address <= _importReadableEnd - 8)
@@ -1618,6 +1637,19 @@ public sealed partial class DirectExecutionBackend
 		var expectedEqueueTimeout =
 			string.Equals(nid, "fzyMKs9kim0", StringComparison.Ordinal) &&
 			result == OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT;
+		// scePthreadCondTimedwait and sceKernelWaitEventFlag report an elapsed timeout.
+		var expectedWaitTimeout =
+			(nid is "BmMjYxmew1w" or "JTvBflhYazQ") &&
+			result == OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT;
+		// scePthreadMutexLock on an error-checking mutex the caller already owns; titles use it
+		// to build their own recursive locks.
+		var expectedErrorCheckRelock =
+			string.Equals(nid, "9UK1vLZQft4", StringComparison.Ordinal) &&
+			result == OrbisGen2Result.ORBIS_GEN2_ERROR_DEADLOCK;
+		// scePadReadState on a handle that is not open; titles poll every pad slot.
+		var expectedPadNotOpen =
+			string.Equals(nid, "YndgXqQVV7c", StringComparison.Ordinal) &&
+			resultValue == unchecked((int)0x80920003);
 		var expectedMutexTrylockBusy =
 			(nid is "K-jXhbt2gn4" or "upoVrzMHFeE") &&
 			result == OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY;
@@ -1642,6 +1674,9 @@ public sealed partial class DirectExecutionBackend
 		if (!expectedFileProbeMiss &&
 			!expectedTimedWaitTimeout &&
 			!expectedEqueueTimeout &&
+			!expectedWaitTimeout &&
+			!expectedErrorCheckRelock &&
+			!expectedPadNotOpen &&
 			!expectedMutexTrylockBusy &&
 			!expectedSemaphoreTrywaitAgain &&
 			!expectedPollSemaBusy &&
@@ -1834,6 +1869,20 @@ public sealed partial class DirectExecutionBackend
 		}
 	}
 
+	// Returns the import straight to the host entry stub, which ends this guest slice.
+	private unsafe bool TryEndGuestSliceForShutdown(nint argPackPtr)
+	{
+		ulong sentinel = ActiveEntryReturnSentinelRip;
+		if (sentinel < 65536 || !TryPatchActiveGuestReturnSlot(sentinel))
+		{
+			return false;
+		}
+
+		*(ulong*)(argPackPtr + 96) = sentinel;
+		ActiveForcedGuestExit = true;
+		return true;
+	}
+
 	private unsafe bool TryForceGuestExitToHostStub(nint argPackPtr, long dispatchIndex, ulong returnRip, string nid)
 	{
 		ulong num = ActiveEntryReturnSentinelRip;
@@ -1969,6 +2018,7 @@ public sealed partial class DirectExecutionBackend
 			"BmMjYxmew1w" or // scePthreadCondTimedwait
 			"Op8TBGY5KHg" or // pthread_cond_wait
 			"27bAgiJmOh0" or // pthread_cond_timedwait
+			"Zxa0VhQVTsk" or // sceKernelWaitSema
 			"n88vx3C5nW8" or // gettimeofday
 			"lLMT9vJAck0" or // clock_gettime
 			"-2IRUCO--PM" or // sceKernelReadTsc

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.MachExceptions.cs

@@ -0,0 +1,51 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.Core.Cpu.Native;
+
+// On macOS the runtime receives EXC_BAD_ACCESS on each of its threads through a Mach exception
+// port before the kernel raises SIGSEGV or SIGBUS. It calls any fault in the page holding RSP, or
+// the page below it, a stack overflow and aborts, assuming RSP is on a stack it owns. Guest code
+// runs on guest stacks, and those pages fault whenever GPU or image write tracking has protected
+// them, so a thread running guest code must leave its access faults to the signal handler. The
+// handler resolves guest faults and chains every other one to the runtime's own signal handler,
+// the same path the runtime uses on Linux.
+public sealed unsafe partial class DirectExecutionBackend
+{
+	private const uint ExceptionMaskBadAccess = 1u << 1;
+	private const int ExceptionDefault = 1;
+	private const int ThreadStateNone = 13;
+
+	[ThreadStatic]
+	private static bool _guestFaultsUseSignals;
+
+	private static int _machExceptionPortWarning;
+
+	[DllImport("libSystem.dylib", EntryPoint = "mach_thread_self")]
+	private static extern uint MachThreadSelf();
+
+	[DllImport("libSystem.dylib", EntryPoint = "thread_set_exception_ports")]
+	private static extern int ThreadSetExceptionPorts(uint thread, uint exceptionMask, uint newPort, int behavior, int newFlavor);
+
+	[DllImport("libSystem.dylib", EntryPoint = "mach_port_deallocate")]
+	private static extern int MachPortDeallocate(uint task, uint name);
+
+	private static readonly uint _machTaskSelf = OperatingSystem.IsMacOS()
+		? (uint)Marshal.ReadInt32(NativeLibrary.GetExport(NativeLibrary.Load("libSystem.dylib"), "mach_task_self_"))
+		: 0;
+
+	private static void RouteGuestAccessFaultsToSignals()
+	{
+		if (_guestFaultsUseSignals || !OperatingSystem.IsMacOS())
+			return;
+		_guestFaultsUseSignals = true;
+		var thread = MachThreadSelf();
+		var result = ThreadSetExceptionPorts(thread, ExceptionMaskBadAccess, 0, ExceptionDefault, ThreadStateNone);
+		_ = MachPortDeallocate(_machTaskSelf, thread);
+		if (result != 0 && System.Threading.Interlocked.Exchange(ref _machExceptionPortWarning, 1) == 0)
+			Console.Error.WriteLine($"[LOADER][WARN] Cannot hand guest access faults to the signal handler: thread_set_exception_ports={result}.");
+	}
+}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.NativeWorker.cs

@@ -134,7 +134,7 @@ public sealed partial class DirectExecutionBackend
 			try
 			{
 				var state = _activeGuestThreadState;
-				if (state is { Name: "tbb_thead" })
+				if (LogThreadMode && state is { Name: "tbb_thead" })
 				{
 					var n = Interlocked.Increment(ref _tbbNativeRunEnterCount);
 					if (n <= 12 || n % 64 == 0)
@@ -750,6 +750,7 @@ public sealed partial class DirectExecutionBackend
 			_activeGuestThreadYieldReason = null;
 			_activeGuestThreadState = _runState;
 			backend.BindTlsBase(_runContext!);
+			RouteGuestAccessFaultsToSignals();
 			TlsSetValue(backend._hostRspSlotTlsIndex, _runHostRspSlot);
 			if (backend._workerDoneEventTlsIndex != uint.MaxValue)
 			{

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.PosixSignalStack.cs

@@ -0,0 +1,140 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Runtime.InteropServices;
+using Iced.Intel;
+using SharpEmu.HLE;
+using static Iced.Intel.AssemblerRegisters;
+
+namespace SharpEmu.Core.Cpu.Native;
+
+// Guest faults are delivered on the guest stack. The runtime only knows the thread's own stack,
+// so managed code that runs on the guest stack can make a garbage collection misread the frames
+// of that thread. Windows swaps the stack bounds in the TEB while guest code runs; POSIX cannot,
+// so the signal handler moves to the host stack below the frames that entered guest code first.
+public sealed unsafe partial class DirectExecutionBackend
+{
+	// Host stack below the saved host RSP that is still treated as the host frames in use.
+	private const ulong HostStackSearchBytes = 0x100_0000;
+	private const int SignalStackGap = 0x1000;
+
+	// [0] the host RSP TLS slot (uint.MaxValue while unknown), [8] the Win64 TlsGetValue stub.
+	private static nint _signalStackCells;
+
+	private static unsafe nint CreatePosixSignalTrampoline()
+	{
+		_signalStackCells = (nint)NativeMemory.AllocZeroed(16);
+		*(uint*)_signalStackCells = uint.MaxValue;
+
+		var a = new Assembler(64);
+		var direct = a.CreateLabel();
+		var call = a.CreateLabel();
+		var done = a.CreateLabel();
+		a.push(rbx);
+		a.push(r12);
+		a.push(r13);
+		a.push(r14);
+		a.push(r15);
+		a.mov(r12d, edi);
+		a.mov(r13, rsi);
+		a.mov(r14, rdx);
+		a.mov(rbx, rsp);
+
+		// The saved host RSP of this thread, when it entered guest code.
+		a.mov(rax, (ulong)_signalStackCells);
+		a.mov(ecx, __dword_ptr[rax]);
+		a.cmp(ecx, -1);
+		a.je(direct);
+		a.mov(rax, __qword_ptr[rax + 8]);
+		a.test(rax, rax);
+		a.je(direct);
+		a.sub(rsp, 48);
+		a.call(rax);
+		a.add(rsp, 48);
+		a.test(rax, rax);
+		a.je(direct);
+		a.mov(r15, __qword_ptr[rax]);
+		a.test(r15, r15);
+		a.je(direct);
+
+		// Already on the host stack below the saved RSP: an import or host code faulted.
+		a.cmp(rbx, r15);
+		a.jae(call);
+		a.mov(rax, r15);
+		a.sub(rax, rbx);
+		a.cmp(rax, (int)HostStackSearchBytes);
+		a.jb(direct);
+
+		a.Label(ref call);
+		a.lea(rsp, __[r15 - SignalStackGap]);
+		a.and(rsp, -16);
+		a.Label(ref direct);
+		a.mov(edi, r12d);
+		a.mov(rsi, r13);
+		a.mov(rdx, r14);
+		a.mov(rax, (ulong)(nint)(delegate* unmanaged<int, nint, nint, void>)&HandlePosixSignal);
+		a.call(rax);
+		a.Label(ref done);
+		a.mov(rsp, rbx);
+		a.pop(r15);
+		a.pop(r14);
+		a.pop(r13);
+		a.pop(r12);
+		a.pop(rbx);
+		a.ret();
+
+		var page = (byte*)HostMemory.Alloc(null, 4096, HostMemory.MEM_COMMIT | HostMemory.MEM_RESERVE, HostMemory.PAGE_EXECUTE_READWRITE);
+		if (page == null)
+		{
+			throw new OutOfMemoryException("Failed to allocate the POSIX signal trampoline page");
+		}
+
+		var writer = new SpanCodeWriter(new Span<byte>(page, 4096));
+		a.Assemble(writer, (ulong)page);
+		if (!HostMemory.Protect(page, 4096, HostMemory.PAGE_EXECUTE_READ, out _))
+		{
+			throw new InvalidOperationException("Failed to protect the POSIX signal trampoline page");
+		}
+
+		return (nint)page;
+	}
+
+	private unsafe void PublishSignalStackState()
+	{
+		if (_signalStackCells == 0)
+		{
+			return;
+		}
+
+		*(nint*)(_signalStackCells + 8) = _tlsGetValueAddress;
+		*(uint*)_signalStackCells = _hostRspSlotTlsIndex;
+	}
+
+	private sealed unsafe class SpanCodeWriter : CodeWriter
+	{
+		private readonly byte* _start;
+		private readonly int _length;
+		private int _offset;
+
+		public SpanCodeWriter(Span<byte> destination)
+		{
+			fixed (byte* start = destination)
+			{
+				_start = start;
+			}
+
+			_length = destination.Length;
+		}
+
+		public override void WriteByte(byte value)
+		{
+			if (_offset >= _length)
+			{
+				throw new InvalidOperationException("The POSIX signal trampoline does not fit its page.");
+			}
+
+			_start[_offset++] = value;
+		}
+	}
+}

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.PosixSignals.cs

@@ -5,6 +5,7 @@ using System;
 using System.Runtime.InteropServices;
 using System.Threading;
 using SharpEmu.HLE;
+using SharpEmu.HLE.GpuMemory;
 
 namespace SharpEmu.Core.Cpu.Native;
 
@@ -23,6 +24,7 @@ public sealed unsafe partial class DirectExecutionBackend
 	private const int PosixSigIll = 4;
 	private const int PosixSigTrap = 5;
 	private const int PosixSigAbort = 6;
+	private const int PosixSigFpe = 8;
 	private const int PosixSigSegv = 11;
 	private static readonly int PosixSigBus = OperatingSystem.IsMacOS() ? 10 : 7;
 
@@ -77,6 +79,7 @@ public sealed unsafe partial class DirectExecutionBackend
 
 	private static DirectExecutionBackend? _posixSignalBackend;
 	private static bool _posixSignalHandlersInstalled;
+	private static nint _posixSignalTrampoline;
 	private static bool _posixRawRecoveryEnabled;
 	private static bool _posixSignalWarmup;
 	private static readonly nint[] _posixPreviousActions = new nint[32];
@@ -104,6 +107,7 @@ public sealed unsafe partial class DirectExecutionBackend
 		_posixSignalBackend = this;
 		if (_posixSignalHandlersInstalled)
 		{
+			PublishSignalStackState();
 			return;
 		}
 
@@ -117,17 +121,20 @@ public sealed unsafe partial class DirectExecutionBackend
 		WarmUpPosixSignalPath();
 		SharpEmu.HLE.GuestImageWriteTracker.WarmUp();
 
+		_posixSignalTrampoline = CreatePosixSignalTrampoline();
+		PublishSignalStackState();
 		if (!InstallPosixSignalHandler(PosixSigSegv) ||
 			!InstallPosixSignalHandler(PosixSigBus) ||
 			!InstallPosixSignalHandler(PosixSigIll) ||
 			!InstallPosixSignalHandler(PosixSigTrap) ||
-			!InstallPosixSignalHandler(PosixSigAbort))
+			!InstallPosixSignalHandler(PosixSigAbort) ||
+			!InstallPosixSignalHandler(PosixSigFpe))
 		{
 			throw new InvalidOperationException("Failed to install POSIX fault signal handlers");
 		}
 
 		_posixSignalHandlersInstalled = true;
-		Console.Error.WriteLine("[LOADER][INFO] POSIX signal exception bridge installed (SIGSEGV/SIGBUS/SIGILL)");
+		Console.Error.WriteLine("[LOADER][INFO] POSIX signal exception bridge installed (SIGSEGV/SIGBUS/SIGILL/SIGFPE)");
 	}
 
 	/// <summary>
@@ -191,7 +198,7 @@ public sealed unsafe partial class DirectExecutionBackend
 	{
 		byte* action = stackalloc byte[PosixSigactionSize];
 		new Span<byte>(action, PosixSigactionSize).Clear();
-		*(nint*)action = (nint)(delegate* unmanaged<int, nint, nint, void>)&HandlePosixSignal;
+		*(nint*)action = _posixSignalTrampoline;
 		// No SA_ONSTACK: the runtime's alternate stacks are far too small for
 		// the recovery/diagnostic path (JIT compilation of cold handler code
 		// can run inside the signal frame). Guest faults deliver onto the 2MB
@@ -238,6 +245,7 @@ public sealed unsafe partial class DirectExecutionBackend
 			// address (safe for host and guest threads alike) and must resume
 			// the faulting write immediately after restoring write access.
 			if (signal != PosixSigIll &&
+				signal != PosixSigFpe &&
 				siginfo != 0 &&
 				SharpEmu.HLE.GuestImageWriteTracker.TryHandleWriteFault(
 					*(ulong*)((byte*)siginfo + PosixSigInfoAddressOffset)))
@@ -245,6 +253,17 @@ public sealed unsafe partial class DirectExecutionBackend
 				return;
 			}
 
+			// GPU-tracked pages fault on every first CPU access after the GPU or an upload used them,
+			// thousands of times a second in a frame. Resolving them needs only the address and the
+			// access kind, so they skip the Win64 context conversion and the other handlers.
+			if (PosixGpuFaultFastPath && !_posixSignalWarmup &&
+				(signal == PosixSigSegv || signal == PosixSigBus) &&
+				siginfo != 0 &&
+				TryResolvePosixGpuFault(siginfo, ucontext))
+			{
+				return;
+			}
+
 			if (TryHandlePosixFault(signal, siginfo, ucontext))
 			{
 				return;
@@ -262,6 +281,28 @@ public sealed unsafe partial class DirectExecutionBackend
 		ChainPreviousPosixAction(signal, siginfo, ucontext);
 	}
 
+	private static readonly bool PosixGpuFaultFastPath =
+		Environment.GetEnvironmentVariable("SHARPEMU_POSIX_GPU_FAULT_FAST_PATH") != "0";
+
+	private static bool TryResolvePosixGpuFault(nint siginfo, nint ucontext)
+	{
+		byte* registers = GetPosixRegisterBase(ucontext);
+		if (registers == null)
+		{
+			return false;
+		}
+
+		ulong faultAddress = GetPosixFaultAddress(siginfo, registers);
+		ulong rip = *(ulong*)(registers + PosixRegisterOffsets[16]);
+		var kind = GetPosixAccessType(registers, faultAddress, rip) switch
+		{
+			0 => FaultKind.Read,
+			1 => FaultKind.Write,
+			_ => FaultKind.Unknown,
+		};
+		return kind != FaultKind.Unknown && GuestGpuMemoryHook.TryResolveFault(kind, faultAddress);
+	}
+
 	private static bool TryHandlePosixFault(int signal, nint siginfo, nint ucontext)
 	{
 		byte* registers = GetPosixRegisterBase(ucontext);
@@ -305,6 +346,11 @@ public sealed unsafe partial class DirectExecutionBackend
 		{
 			record.ExceptionCode = 1073741845u;
 		}
+		else if (signal == PosixSigFpe)
+		{
+			// STATUS_INTEGER_DIVIDE_BY_ZERO: #DE from div/idiv (zero divisor or quotient overflow).
+			record.ExceptionCode = 3221225620u;
+		}
 		else
 		{
 			ulong faultAddress = GetPosixFaultAddress(siginfo, registers);

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.StackBounds.cs

@@ -9,10 +9,23 @@ public sealed partial class DirectExecutionBackend
 {
     private const int HostStackStateBytes = 3 * sizeof(ulong);
 
-    private static unsafe bool TryGetGuestStackBounds(ulong stackPointer, out ulong bottom, out ulong top)
+    internal static unsafe bool TryGetGuestStackBounds(ulong stackPointer, out ulong bottom, out ulong top)
     {
+        if (OperatingSystem.IsWindows() &&
+            QueryVirtualMemoryInformation(-1, (void*)stackPointer, 0, out var allocation,
+                (nuint)sizeof(StackMemoryRegionInformation), null) != 0 &&
+            ((allocation.Flags & 1) == 0 || allocation.CommitSize == allocation.RegionSize) &&
+            allocation.RegionSize != 0 && allocation.RegionSize <= ulong.MaxValue - allocation.AllocationBase &&
+            stackPointer >= allocation.AllocationBase && stackPointer - allocation.AllocationBase < allocation.RegionSize)
+        {
+            bottom = allocation.AllocationBase;
+            top = bottom + allocation.RegionSize;
+            return true;
+        }
+
         bottom = top = 0;
-        if (VirtualQuery((void*)stackPointer, out var region, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0 ||
+        var queried = VirtualQuery((void*)stackPointer, out var region, (nuint)sizeof(MEMORY_BASIC_INFORMATION64));
+        if (queried == 0 ||
             region.State != 0x1000 || region.RegionSize == 0 || region.RegionSize > ulong.MaxValue - region.BaseAddress)
         {
             return false;
@@ -33,6 +46,36 @@ public sealed partial class DirectExecutionBackend
         EmitUInt32(code, ref offset, field);
     }
 
+    // Fiber switches replace the guest stack without passing through a guest-entry stub, so the
+    // context-transfer stub keeps the Windows TEB bounds in sync from the target state in R11
+    // (stack top at +160, bottom at +168). Only Windows keeps stack bounds at gs:[8]/gs:[16]: on
+    // macOS gs addresses the pthread TSD, where those slots hold errno's address and another key.
+    // Writing a fiber's bounds there nulled errno, and the next failed libc call on the thread
+    // crashed reading it (Demon's Souls, about 10 s into boot).
+    private static unsafe void EmitFiberStackBounds(byte* code, ref int offset)
+    {
+        if (!OperatingSystem.IsWindows()) return;
+        ReadOnlySpan<byte> loadTop = [0x4D, 0x8B, 0x93, 160, 0, 0, 0];     // mov r10, [r11+160]
+        foreach (var value in loadTop) EmitByte(code, ref offset, value);
+        EmitStackBound(code, ref offset, 10, 8, store: true);
+        ReadOnlySpan<byte> loadBottom = [0x4D, 0x8B, 0x93, 168, 0, 0, 0];  // mov r10, [r11+168]
+        foreach (var value in loadBottom) EmitByte(code, ref offset, value);
+        EmitStackBound(code, ref offset, 10, 16, store: true);
+    }
+
+    // Test hook: the bytes the fiber stack-bounds sync emits on this host.
+    internal static unsafe byte[] EmitFiberStackBoundsForTest()
+    {
+        var buffer = new byte[64];
+        var offset = 0;
+        fixed (byte* code = buffer)
+        {
+            EmitFiberStackBounds(code, ref offset);
+        }
+
+        return buffer[..offset];
+    }
+
     // R10 points to the entry state. R11 is scratch; RAX remains unchanged.
     private static unsafe void EmitHostStackBounds(byte* code, ref int offset, bool save)
     {
@@ -146,4 +189,18 @@ public sealed partial class DirectExecutionBackend
 
     [DllImport("kernel32.dll", ExactSpelling = true)]
     private static extern void GetCurrentThreadStackLimits(out ulong lowLimit, out ulong highLimit);
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct StackMemoryRegionInformation
+    {
+        public ulong AllocationBase;
+        public uint AllocationProtect;
+        public uint Flags;
+        public ulong RegionSize;
+        public ulong CommitSize;
+    }
+
+    [DllImport("api-ms-win-core-memory-l1-1-4.dll", ExactSpelling = true)]
+    private static extern unsafe int QueryVirtualMemoryInformation(nint process, void* address, int informationClass,
+        out StackMemoryRegionInformation information, nuint informationSize, nuint* returnSize);
 }

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.cs

@@ -613,9 +613,17 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		private Action? _work;
 		private volatile bool _stopping;
 
+		// Every guest call that blocks in an HLE import resumes through a managed
+		// continuation frame, so a guest thread that blocks deep inside its own call
+		// tree nests host frames rather than unwinding. Demon's Souls' render thread
+		// overflowed the default thread stack within a minute of reaching its main
+		// loop; the reservation is virtual, so a generous stack costs nothing until
+		// it is touched.
+		private const int GuestExecutionStackBytes = 64 * 1024 * 1024;
+
 		public GuestExecutionRunner(ulong guestThreadHandle, string name, ThreadPriority priority)
 		{
-			_thread = new Thread(() => ThreadMain(guestThreadHandle))
+			_thread = new Thread(() => ThreadMain(guestThreadHandle), GuestExecutionStackBytes)
 			{
 				IsBackground = true,
 				Name = $"SharpEmu-{name}",
@@ -1203,9 +1211,9 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			Environment.GetEnvironmentVariable("SHARPEMU_PROBE_IMPORT_RET_ADDRESS"));
 		_probeImportReturnAddressCount = 0;
 		_importFilter = Environment.GetEnvironmentVariable("SHARPEMU_LOG_IMPORT_FILTER");
-		_disableImportLoopGuard = string.Equals(
+		_disableImportLoopGuard = !string.Equals(
 			Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD"),
-			"1",
+			"0",
 			StringComparison.Ordinal);
 		_importLoopGuardSeconds = GetImportLoopGuardSeconds();
 		_entryReturnSentinelRip = 0uL;
@@ -1232,6 +1240,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		_patchedEa020eLookupCall = false;
 		MarkExecutionProgress();
 		BindTlsBase(context);
+		RouteGuestAccessFaultsToSignals();
 		var previousGuestThreadScheduler = GuestThreadExecution.Scheduler;
 		GuestThreadExecution.Scheduler = this;
 		try
@@ -1280,6 +1289,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 	{
 		Console.Error.WriteLine($"[LOADER][INFO] Setting up {importStubs.Count} import stubs...");
 		ClearImportHandlerTrampolines();
+		ConfigureGuestFastPath();
 		_importEntries = new ImportStubEntry[importStubs.Count];
 		HashSet<ulong> hashSet = new HashSet<ulong>(importStubs.Keys);
 		int num = 0;
@@ -1346,6 +1356,10 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 				LastError = "Failed to create import trampoline for NID " + text2;
 				return false;
 			}
+			if (TryCreateGuestFastPathStub(text2, num5, out var fastPathStub))
+			{
+				num5 = fastPathStub;
+			}
 			if (_logAllImports)
 			{
 				Console.Error.WriteLine($"[LOADER][DEBUG] SetupImportStubs: Trampoline for {text2} -> 0x{num5:X16}");
@@ -1358,7 +1372,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			num2++;
 			num++;
 		}
-		Console.Error.WriteLine($"[LOADER][INFO] Setup {num2}/{importStubs.Count} import stubs (direct bridge, lle_redirects={num3})");
+		Console.Error.WriteLine($"[LOADER][INFO] Setup {num2}/{importStubs.Count} import stubs (direct bridge, lle_redirects={num3}, fast_path_stubs={_guestFastPathStubCount})");
 		return num2 == importStubs.Count;
 	}
 
@@ -1442,6 +1456,11 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 				var importIndex = currentEntries.Length + i;
 				var trampoline = CreateImportHandlerTrampoline(importIndex);
+				if (trampoline != 0 &&
+					TryCreateGuestFastPathStub(nid, trampoline, out var runtimeFastPathStub))
+				{
+					trampoline = runtimeFastPathStub;
+				}
 				if (trampoline == 0 || !PatchImportStub((nint)(long)address, trampoline))
 				{
 					error = $"failed to install runtime import trampoline at 0x{address:X16}";
@@ -1906,6 +1925,10 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		{
 			return HasUsableLleLibcExport("tcVi5SivF7Q", "sprintf");
 		}
+		if (IsLibcFileObjectExport(exportName))
+		{
+			return HasUsableLleLibcExport(ComputePsNid(exportName), exportName);
+		}
 		if (string.Equals(value, "0", StringComparison.Ordinal))
 		{
 			return true;
@@ -2279,12 +2302,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			}
 
 			Emit(0x49); Emit(0x89); Emit(0xC3); // mov r11, rax
-			// Fiber switches replace the guest stack without passing through a
-			// guest-entry stub, so keep the Windows TEB bounds in sync here.
-			EmitLoadFromR11Disp32(10, 160);     // r10 = target stack top
-			EmitStackBound(code, ref offset, 10, 8, store: true);
-			EmitLoadFromR11Disp32(10, 168);     // r10 = target stack bottom
-			EmitStackBound(code, ref offset, 10, 16, store: true);
+			EmitFiberStackBounds(code, ref offset);
 			// A new >=3.50 fiber receives the SDK-defined MXCSR verbatim. A
 			// resumed fiber follows _sceFiberLongJmp: preserve status bits 0-5
 			// while restoring the saved control bits.
@@ -2347,7 +2365,31 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		}
 	}
 
+	// A trampoline only encodes its import index, so a runtime module load that sets up every
+	// module's stubs again reuses them: the stubs then keep their bytes and are not rewritten
+	// under guest threads that may be executing them.
+	private readonly Dictionary<int, nint> _importHandlerTrampolineByIndex = new();
+
 	private unsafe nint CreateImportHandlerTrampoline(int importIndex)
+	{
+		lock (ImportStubPatchGate)
+		{
+			if (_importHandlerTrampolineByIndex.TryGetValue(importIndex, out var existing))
+			{
+				return existing;
+			}
+
+			var created = CreateImportHandlerTrampolineCore(importIndex);
+			if (created != 0)
+			{
+				_importHandlerTrampolineByIndex[importIndex] = created;
+			}
+
+			return created;
+		}
+	}
+
+	private unsafe nint CreateImportHandlerTrampolineCore(int importIndex)
 	{
 		const uint stubSize = 1024u;
 		void* ptr = VirtualAlloc(null, stubSize, 12288u, 64u);
@@ -2523,8 +2565,35 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		}
 	}
 
+	// Patches unprotect and re-protect whole pages: two threads patching code that shares a page
+	// (runtime module loads, lazy TLS site patches on guest threads) would restore the other's page
+	// to read-execute while it is still writing, so every patch runs under one gate.
+	private static readonly object ImportStubPatchGate = new();
+
 	private unsafe bool PatchImportStub(nint address, nint trampoline)
 	{
+		lock (ImportStubPatchGate)
+		{
+			return PatchImportStubLocked(address, trampoline);
+		}
+	}
+
+	private unsafe bool PatchImportStubLocked(nint address, nint trampoline)
+	{
+		// Every runtime module load sets up the stubs of all loaded modules again; a stub that
+		// already jumps to this trampoline needs no unprotect/write/restore cycle.
+		Span<byte> patch = stackalloc byte[16];
+		patch[0] = 0x48;
+		patch[1] = 0xB8;
+		System.Buffers.Binary.BinaryPrimitives.WriteInt64LittleEndian(patch[2..], trampoline);
+		patch[10] = 0xFF;
+		patch[11] = 0xE0;
+		patch[12..].Fill(0x90);
+		if (new ReadOnlySpan<byte>((void*)address, 16).SequenceEqual(patch))
+		{
+			return true;
+		}
+
 		uint flNewProtect = default(uint);
 		if (!VirtualProtect((void*)address, 16u, 64u, &flNewProtect))
 		{
@@ -2561,6 +2630,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			}
 		}
 		_importHandlerTrampolines.Clear();
+		_importHandlerTrampolineByIndex.Clear();
 	}
 
 	private unsafe void CreateTlsHandler()
@@ -3713,6 +3783,16 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 	}
 
 	private static unsafe bool WriteTlsInstruction(nint address, ReadOnlySpan<byte> replacement)
+	{
+		// Guest threads patch their TLS sites as they first reach them; two sites on one page would
+		// otherwise race the unprotect/restore pair exactly like the import stubs.
+		lock (ImportStubPatchGate)
+		{
+			return WriteTlsInstructionLocked(address, replacement);
+		}
+	}
+
+	private static unsafe bool WriteTlsInstructionLocked(nint address, ReadOnlySpan<byte> replacement)
 	{
 		if (replacement.Length is < 1 or > 15 ||
 			VirtualQuery((void*)address, out var information, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0 ||
@@ -3902,6 +3982,33 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 	public bool SupportsGuestContextTransfer => true;
 
+	public bool TryGetGuestThreadStackBounds(
+		ulong threadHandle,
+		out ulong stackBase,
+		out ulong stackSize)
+	{
+		stackBase = 0;
+		stackSize = 0;
+		if (threadHandle == 0)
+		{
+			return false;
+		}
+
+		lock (_guestThreadGate)
+		{
+			if (!_guestThreads.TryGetValue(threadHandle, out var thread) ||
+				thread.StackBase == 0 ||
+				thread.StackSize == 0)
+			{
+				return false;
+			}
+
+			stackBase = thread.StackBase;
+			stackSize = thread.StackSize;
+			return true;
+		}
+	}
+
 	public void RegisterGuestThreadContext(ulong threadHandle, CpuContext context)
 	{
 		if (threadHandle == 0)
@@ -5268,7 +5375,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		return true;
 	}
 
-	private static bool TryWriteGuestExceptionContext(
+	internal static bool TryWriteGuestExceptionContext(
 		CpuContext context,
 		ulong address,
 		GuestCpuContinuation continuation,
@@ -5279,11 +5386,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			BinaryPrimitives.WriteUInt64LittleEndian(bytes.AsSpan(offset, sizeof(ulong)), value);
 
 		var hasContinuation = continuation.Rip >= 65536 && continuation.Rsp != 0;
-		// Orbis ucontext_t has a 0x10-byte signal mask and 0x30 bytes of
-		// private fields before its amd64 mcontext. These offsets match the
-		// platform ABI used by libScePs5Util and Unity's Boehm GC. Supplying a
-		// bare mcontext here makes the collector miss live register roots.
-		const int mcontext = 0x40;
+		const int mcontext = 0;
 		Write64(mcontext + 0x08, hasContinuation ? continuation.Rdi : context[CpuRegister.Rdi]);
 		Write64(mcontext + 0x10, hasContinuation ? continuation.Rsi : context[CpuRegister.Rsi]);
 		Write64(mcontext + 0x18, hasContinuation ? continuation.Rdx : context[CpuRegister.Rdx]);
@@ -5302,9 +5405,10 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		var rip = hasContinuation ? continuation.Rip : context.Rip;
 		var rsp = hasContinuation ? continuation.Rsp : context[CpuRegister.Rsp];
 		Write64(mcontext + 0xA0, rip);
-		Write64(mcontext + 0xB0, hasContinuation ? continuation.Rflags : 0);
+		Write64(mcontext + 0xB0, hasContinuation ? continuation.Rflags : context.Rflags);
 		Write64(mcontext + 0xB8, rsp);
 		Write64(mcontext + 0xC8, 0x480); // sizeof(Orbis mcontext_t)
+		Write64(mcontext + 0xF8, rsp);
 		Write64(mcontext + 0x440, hasContinuation ? continuation.FsBase : context.FsBase);
 		Write64(mcontext + 0x448, hasContinuation ? continuation.GsBase : context.GsBase);
 		return context.Memory.TryWrite(address, bytes);
@@ -5642,6 +5746,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		var hostAffinityMask = MapGuestThreadAffinity(guestAffinityMask);
 		if (hostAffinityMask == 0)
 		{
+			SharpEmu.HLE.Host.HostLaneReservation.ApplyToGuestThread();
 			return;
 		}
 
@@ -6082,6 +6187,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			_activeGuestThreadYieldRequested = false;
 			_activeGuestThreadYieldReason = null;
 			BindTlsBase(context);
+			RouteGuestAccessFaultsToSignals();
 			byte* ptr2 = (byte*)ptr;
 			// Rosetta does not reliably permit a generated x86 thunk to write data
 			// in the same page from which it is currently executing, even when the
@@ -6308,6 +6414,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			_activeGuestThreadYieldRequested = false;
 			_activeGuestThreadYieldReason = null;
 			BindTlsBase(context);
+			RouteGuestAccessFaultsToSignals();
 			byte* ptr2 = (byte*)ptr;
 			ulong hostRspSlot = (ulong)hostRspStorage;
 			var emitter = new NativeCodeEmitter(ptr2);
@@ -6538,6 +6645,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 	{
 		Console.Error.WriteLine($"[LOADER][INFO] ExecuteEntry starting at 0x{entryPoint:X16}");
 		Console.Error.WriteLine($"[LOADER][INFO] RSP=0x{context[CpuRegister.Rsp]:X16}, RDI=0x{context[CpuRegister.Rdi]:X16}");
+		SharpEmu.HLE.Host.HostLaneReservation.ApplyToGuestThread();
 		ulong num = context[CpuRegister.Rsp];
 		if (num == 0)
 		{
@@ -6580,6 +6688,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			_activeGuestThreadYieldRequested = false;
 			_activeGuestThreadYieldReason = null;
 			BindTlsBase(context);
+			RouteGuestAccessFaultsToSignals();
 			byte* ptr2 = (byte*)ptr;
 			ulong num2 = (ulong)hostRspStorage;
 			int num3 = 0;

src/SharpEmu.Core/Loader/GuestRedZonePatcher.cs

@@ -19,6 +19,44 @@ internal static class GuestRedZonePatcher
     private const ulong PageSize = 0x1000;
     private const ulong AllocationAlignment = 0x10000;
     private const ulong MaximumRelativeJumpDistance = 0x7FFF_FFFF;
+    private const int MaximumJumpTableEntries = 4096;
+    private const int MaximumJumpTableSetupInstructions = 6;
+    private const ulong LargeExecutableBytes = 32UL << 20;
+    private static readonly TimeSpan ProgressInterval = TimeSpan.FromSeconds(2);
+
+    private sealed class Progress(string hostName, string phase, int total)
+    {
+        private readonly long _started = System.Diagnostics.Stopwatch.GetTimestamp();
+        private long _lastReport = System.Diagnostics.Stopwatch.GetTimestamp();
+
+        public void Report(int done)
+        {
+            var now = System.Diagnostics.Stopwatch.GetTimestamp();
+            if (System.Diagnostics.Stopwatch.GetElapsedTime(_lastReport, now) < ProgressInterval)
+            {
+                return;
+            }
+
+            _lastReport = now;
+            Console.Error.WriteLine(
+                $"[LOADER] {hostName} red-zone {phase}: {done}/{total} ({(total == 0 ? 100 : done * 100L / total)}%) " +
+                $"after {System.Diagnostics.Stopwatch.GetElapsedTime(_started, now).TotalSeconds:F0} s");
+        }
+    }
+
+    private static ulong ExecutableBytes(IReadOnlyList<ProgramHeader> programHeaders)
+    {
+        var bytes = 0UL;
+        foreach (var header in programHeaders)
+        {
+            if (header.HeaderType == ProgramHeaderType.Load && (header.Flags & ProgramHeaderFlags.Execute) != 0)
+            {
+                bytes += header.FileSize;
+            }
+        }
+
+        return bytes;
+    }
 
     internal enum SpanRefusal
     {
@@ -27,6 +65,7 @@ internal static class GuestRedZonePatcher
         BranchTargetAfter,
         StackAfter,
         TooShort,
+        IndirectBranch,
     }
 
     public static PatchResult Patch(
@@ -62,8 +101,19 @@ internal static class GuestRedZonePatcher
             return default;
         }
 
+        var executableBytes = ExecutableBytes(programHeaders);
+        var large = executableBytes >= LargeExecutableBytes;
+        if (large)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER] {hostName} red-zone patch: scanning {functionStarts.Length} functions in {executableBytes >> 20} MB of code; " +
+                "a large executable takes a while before the game window opens.");
+        }
+
         var sites = CollectPatchSites(
-            memory, programHeaders, imageBase, functionStarts, protectRedZone, splitVectorStores, rewriteSha, out var scan);
+            memory, programHeaders, imageBase, functionStarts, protectRedZone, splitVectorStores, rewriteSha, out var scan,
+            large ? new Progress(hostName, "scan", functionStarts.Length) : null);
+        sites.Sort(static (left, right) => left.Address.CompareTo(right.Address));
         if (sites.Count == 0)
         {
             Console.Error.WriteLine(
@@ -94,8 +144,10 @@ internal static class GuestRedZonePatcher
         var patched = 0;
         var failed = 0;
         var previousEnd = 0UL;
+        var patchProgress = large ? new Progress(hostName, "patch", sites.Count) : null;
         foreach (var site in sites)
         {
+            patchProgress?.Report(patched + failed);
             // Sites are produced in increasing address order. Patching two that
             // overlap would write one jump over another and send the trampoline
             // into whatever follows, so refuse rather than corrupt guest code.
@@ -128,6 +180,7 @@ internal static class GuestRedZonePatcher
             BranchTargetRefusals = scan.BranchTargetRefusals,
             StackRefusals = scan.StackRefusals,
             TooShortRefusals = scan.TooShortRefusals,
+            IndirectBranchRefusals = scan.IndirectBranchRefusals,
             TrampolineBytes = trampolineCursor - trampolineBase,
         };
         Console.Error.WriteLine(
@@ -135,7 +188,8 @@ internal static class GuestRedZonePatcher
             $"sites={result.PatchedSites}/{result.CandidateSites} failed={result.FailedSites} " +
             $"unrelocatable={result.UnrelocatableSites} " +
             $"(control_flow={result.ControlFlowRefusals} branch_target_after={result.BranchTargetRefusals} " +
-            $"stack_after={result.StackRefusals} too_short={result.TooShortRefusals}) " +
+            $"stack_after={result.StackRefusals} too_short={result.TooShortRefusals} " +
+            $"indirect_branch={result.IndirectBranchRefusals}) " +
             $"rosetta_vector_stores={result.VectorStoreCount} sha_rewrites={result.ShaInstructionCount} " +
             $"trampolines=0x{trampolineBase:X16}+0x{result.TrampolineBytes:X}.");
         return result;
@@ -149,15 +203,17 @@ internal static class GuestRedZonePatcher
         bool protectRedZone,
         bool splitVectorStores,
         bool rewriteSha,
-        out PatchResult result)
+        out PatchResult result,
+        Progress? progress = null)
     {
         var sites = new List<PatchSite>();
+        var scannedFunctions = 0;
         var functionCount = 0;
         var redZoneFunctionCount = 0;
         var instructionCount = 0;
         var vectorStoreCount = 0;
         var unrelocatableSites = 0;
-        var refusalCounts = new int[5];
+        var refusalCounts = new int[6];
         var shaInstructionCount = 0;
 
         foreach (var header in programHeaders)
@@ -190,6 +246,7 @@ internal static class GuestRedZonePatcher
 
             for (var functionIndex = 0; functionIndex < segmentFunctions.Length; functionIndex++)
             {
+                progress?.Report(scannedFunctions++);
                 var functionStart = segmentFunctions[functionIndex];
                 var functionEnd = functionIndex + 1 < segmentFunctions.Length
                     ? segmentFunctions[functionIndex + 1]
@@ -207,7 +264,10 @@ internal static class GuestRedZonePatcher
 
                 functionCount++;
                 instructionCount += decoded.Count;
-                var usesRedZone = protectRedZone && decoded.Any(static entry => UsesRedZone(entry.Instruction));
+                var frameDelta = protectRedZone ? ComputeFramePointerDelta(decoded) : -1;
+                var usesRedZone = protectRedZone &&
+                    (decoded.Any(static entry => UsesRedZone(entry.Instruction)) ||
+                     decoded.Any(entry => UsesFramePointerRedZone(entry.Instruction, frameDelta)));
 
                 if (!usesRedZone && !splitVectorStores && !rewriteSha)
                 {
@@ -219,6 +279,14 @@ internal static class GuestRedZonePatcher
                     redZoneFunctionCount++;
                 }
                 var branchTargets = CollectBranchTargets(decoded);
+                var canBorrowFollowingInstructions = TryCollectJumpTableTargets(
+                    memory,
+                    programHeaders,
+                    imageBase,
+                    decoded,
+                    functionStart,
+                    functionEnd,
+                    branchTargets);
 
                 var lastSiteEnd = 0UL;
 
@@ -233,27 +301,32 @@ internal static class GuestRedZonePatcher
                         continue;
                     }
 
-                    // A backward span reaches instructions that an earlier site
-                    // may already have replaced with its own jump. Two jumps
-                    // written over each other corrupt control flow, so a span is
-                    // only usable when it starts at or after the end of the last
-                    // one. Forward spans cannot overlap by construction; the
-                    // check costs nothing and documents the invariant.
-                    var backward = false;
-                    if (!TryBuildPatchSpan(decoded, instructionIndex, branchTargets, out var span, out var refusal))
+                    var span = default(PatchSite);
+                    var refusal = SpanRefusal.TooShort;
+                    var forward = TryBuildPatchSpan(
+                        decoded,
+                        instructionIndex,
+                        branchTargets,
+                        canBorrowFollowingInstructions,
+                        out span,
+                        out refusal);
+                    var backward = !forward &&
+                        canBorrowFollowingInstructions &&
+                        TryBuildEnclosingPatchSpan(decoded, instructionIndex, branchTargets, out span);
+                    if (!forward && !backward)
                     {
-                        backward = TryBuildEnclosingPatchSpan(decoded, instructionIndex, branchTargets, out span);
-                    }
-
-                    if ((!backward && refusal != SpanRefusal.None) || span.Address < lastSiteEnd)
-                    {
-                        // Refused spans never enter the site list, so they are
-                        // invisible in FailedSites. Count them separately.
                         unrelocatableSites++;
                         refusalCounts[(int)refusal]++;
                         continue;
                     }
 
+                    if (span.Address < lastSiteEnd)
+                    {
+                        unrelocatableSites++;
+                        refusalCounts[(int)SpanRefusal.TooShort]++;
+                        continue;
+                    }
+
                     sites.Add(span);
                     lastSiteEnd = span.Address + (ulong)span.ByteLength;
                     if (splitVectorStores)
@@ -265,8 +338,6 @@ internal static class GuestRedZonePatcher
                         shaInstructionCount += span.Instructions.Count(static instruction => ShaInstructionRewrite.CanRewrite(instruction));
                     }
 
-                    // A backward span already ends at the current instruction, so
-                    // only a forward one consumes the instructions that follow.
                     if (!backward)
                     {
                         instructionIndex += span.Instructions.Count - 1;
@@ -287,6 +358,7 @@ internal static class GuestRedZonePatcher
             BranchTargetRefusals = refusalCounts[(int)SpanRefusal.BranchTargetAfter],
             StackRefusals = refusalCounts[(int)SpanRefusal.StackAfter],
             TooShortRefusals = refusalCounts[(int)SpanRefusal.TooShort],
+            IndirectBranchRefusals = refusalCounts[(int)SpanRefusal.IndirectBranch],
             ShaInstructionCount = shaInstructionCount,
         };
         return sites;
@@ -344,11 +416,361 @@ internal static class GuestRedZonePatcher
         return targets;
     }
 
+    private static bool TryCollectJumpTableTargets(
+        IVirtualMemory memory,
+        IReadOnlyList<ProgramHeader> programHeaders,
+        ulong imageBase,
+        IReadOnlyList<DecodedInstruction> decoded,
+        ulong functionStart,
+        ulong functionEnd,
+        HashSet<ulong> branchTargets)
+    {
+        List<ulong>? resolvedTargets = null;
+        HashSet<ulong>? instructionBoundaries = null;
+        for (var instructionIndex = 0; instructionIndex < decoded.Count; instructionIndex++)
+        {
+            if (decoded[instructionIndex].Instruction.FlowControl != FlowControl.IndirectBranch)
+            {
+                continue;
+            }
+
+            instructionBoundaries ??= decoded
+                .Select(static entry => entry.Instruction.IP)
+                .ToHashSet();
+            resolvedTargets ??= new List<ulong>();
+            if (!TryResolveJumpTable(
+                    memory,
+                    programHeaders,
+                    imageBase,
+                    decoded,
+                    instructionIndex,
+                    functionStart,
+                    functionEnd,
+                    instructionBoundaries,
+                    branchTargets,
+                    resolvedTargets))
+            {
+                return false;
+            }
+        }
+
+        if (resolvedTargets is not null)
+        {
+            branchTargets.UnionWith(resolvedTargets);
+        }
+
+        return true;
+    }
+
+    private static bool TryResolveJumpTable(
+        IVirtualMemory memory,
+        IReadOnlyList<ProgramHeader> programHeaders,
+        ulong imageBase,
+        IReadOnlyList<DecodedInstruction> decoded,
+        int jumpIndex,
+        ulong functionStart,
+        ulong functionEnd,
+        IReadOnlySet<ulong> instructionBoundaries,
+        IReadOnlySet<ulong> knownBranchTargets,
+        List<ulong> targets)
+    {
+        if (jumpIndex < 4)
+        {
+            return false;
+        }
+
+        var jump = decoded[jumpIndex].Instruction;
+        var add = decoded[jumpIndex - 1].Instruction;
+        var load = decoded[jumpIndex - 2].Instruction;
+        if (jump.OpCount != 1 || jump.GetOpKind(0) != OpKind.Register ||
+            add.Mnemonic != Mnemonic.Add || add.OpCount != 2 ||
+            add.GetOpKind(0) != OpKind.Register || add.GetOpKind(1) != OpKind.Register ||
+            load.Mnemonic != Mnemonic.Movsxd || load.OpCount != 2 ||
+            load.GetOpKind(0) != OpKind.Register || load.GetOpKind(1) != OpKind.Memory ||
+            load.MemorySize.GetSize() != sizeof(int) || load.MemoryIndexScale != sizeof(int) ||
+            load.MemoryBase == Register.None || load.MemoryIndex == Register.None ||
+            load.MemoryDisplacement64 != 0)
+        {
+            return false;
+        }
+
+        var targetRegister = jump.GetOpRegister(0).GetFullRegister();
+        var tableRegister = add.GetOpRegister(1).GetFullRegister();
+        var selectorRegister = load.MemoryIndex.GetFullRegister();
+        if (targetRegister != add.GetOpRegister(0).GetFullRegister() ||
+            targetRegister != load.GetOpRegister(0).GetFullRegister() ||
+            tableRegister != load.MemoryBase.GetFullRegister() ||
+            targetRegister.GetSize() != sizeof(ulong) ||
+            tableRegister.GetSize() != sizeof(ulong) ||
+            selectorRegister.GetSize() != sizeof(ulong) ||
+            tableRegister == selectorRegister)
+        {
+            return false;
+        }
+
+        var branchIndex = -1;
+        for (var index = jumpIndex - 3;
+             index >= 1 && index >= jumpIndex - MaximumJumpTableSetupInstructions;
+             index--)
+        {
+            var candidate = decoded[index].Instruction;
+            if (candidate.Mnemonic == Mnemonic.Ja)
+            {
+                branchIndex = index;
+                break;
+            }
+
+            if (candidate.Mnemonic != Mnemonic.Lea)
+            {
+                return false;
+            }
+        }
+
+        if (branchIndex < 1)
+        {
+            return false;
+        }
+
+        for (var index = branchIndex + 1; index <= jumpIndex; index++)
+        {
+            if (knownBranchTargets.Contains(decoded[index].Instruction.IP))
+            {
+                return false;
+            }
+        }
+
+        var boundsBranch = decoded[branchIndex].Instruction;
+        var boundsCompare = decoded[branchIndex - 1].Instruction;
+        if (boundsBranch.FlowControl != FlowControl.ConditionalBranch ||
+            !TryGetNearBranchTarget(boundsBranch, out var defaultTarget) ||
+            defaultTarget < functionStart || defaultTarget >= functionEnd ||
+            boundsCompare.Mnemonic != Mnemonic.Cmp || boundsCompare.OpCount != 2 ||
+            boundsCompare.GetOpKind(0) != OpKind.Register ||
+            boundsCompare.GetOpRegister(0).GetFullRegister() != selectorRegister ||
+            boundsCompare.GetOpRegister(0).GetSize() != sizeof(int) ||
+            !TryGetNonNegativeImmediate(boundsCompare, 1, out var maximumIndex) ||
+            maximumIndex >= MaximumJumpTableEntries)
+        {
+            return false;
+        }
+
+        var tableAddress = 0UL;
+        var tableDefinitionFound = false;
+        for (var index = branchIndex + 1; index <= jumpIndex - 3; index++)
+        {
+            var candidate = decoded[index].Instruction;
+            if (candidate.OpCount < 1 || candidate.GetOpKind(0) != OpKind.Register)
+            {
+                return false;
+            }
+
+            var writtenRegister = candidate.GetOpRegister(0).GetFullRegister();
+            if (writtenRegister == selectorRegister)
+            {
+                return false;
+            }
+
+            if (writtenRegister != tableRegister)
+            {
+                continue;
+            }
+
+            if (tableDefinitionFound || candidate.OpCount != 2 ||
+                candidate.GetOpKind(1) != OpKind.Memory || !candidate.IsIPRelativeMemoryOperand)
+            {
+                return false;
+            }
+
+            tableAddress = candidate.IPRelativeMemoryAddress;
+            tableDefinitionFound = true;
+        }
+
+        if (!tableDefinitionFound)
+        {
+            return false;
+        }
+
+        var entryCount = checked((int)maximumIndex + 1);
+        var tableBytes = checked(entryCount * sizeof(int));
+        if (!IsRangeInReadableLoad(programHeaders, imageBase, tableAddress, (ulong)tableBytes))
+        {
+            return false;
+        }
+
+        var entries = GC.AllocateUninitializedArray<byte>(tableBytes);
+        if (!memory.TryRead(tableAddress, entries))
+        {
+            return false;
+        }
+
+        var firstTarget = targets.Count;
+        for (var index = 0; index < entryCount; index++)
+        {
+            var relative = BinaryPrimitives.ReadInt32LittleEndian(entries.AsSpan(index * sizeof(int)));
+            if (!TryAddSignedOffset(tableAddress, relative, out var target) ||
+                target < functionStart || target >= functionEnd ||
+                !instructionBoundaries.Contains(target))
+            {
+                targets.RemoveRange(firstTarget, targets.Count - firstTarget);
+                return false;
+            }
+
+            targets.Add(target);
+        }
+
+        return true;
+    }
+
+    private static bool IsRangeInReadableLoad(
+        IReadOnlyList<ProgramHeader> programHeaders,
+        ulong imageBase,
+        ulong address,
+        ulong length)
+    {
+        foreach (var header in programHeaders)
+        {
+            if (header.HeaderType != ProgramHeaderType.Load ||
+                (header.Flags & ProgramHeaderFlags.Read) == 0 ||
+                header.FileSize == 0 ||
+                header.VirtualAddress > ulong.MaxValue - imageBase)
+            {
+                continue;
+            }
+
+            var start = imageBase + header.VirtualAddress;
+            if (address < start || address - start > header.FileSize ||
+                length > header.FileSize - (address - start))
+            {
+                continue;
+            }
+
+            return true;
+        }
+
+        return false;
+    }
+
+    private static bool TryAddSignedOffset(ulong address, int offset, out ulong result)
+    {
+        if (offset >= 0)
+        {
+            var positive = (ulong)offset;
+            if (positive <= ulong.MaxValue - address)
+            {
+                result = address + positive;
+                return true;
+            }
+        }
+        else
+        {
+            var negative = (ulong)-(long)offset;
+            if (negative <= address)
+            {
+                result = address - negative;
+                return true;
+            }
+        }
+
+        result = 0;
+        return false;
+    }
+
+    private static bool TryGetNearBranchTarget(in Instruction instruction, out ulong target)
+    {
+        for (var operand = 0; operand < instruction.OpCount; operand++)
+        {
+            switch (instruction.GetOpKind(operand))
+            {
+                case OpKind.NearBranch16:
+                    target = instruction.NearBranch16;
+                    return true;
+                case OpKind.NearBranch32:
+                    target = instruction.NearBranch32;
+                    return true;
+                case OpKind.NearBranch64:
+                    target = instruction.NearBranch64;
+                    return true;
+            }
+        }
+
+        target = 0;
+        return false;
+    }
+
+    private static bool TryGetNonNegativeImmediate(in Instruction instruction, int operand, out ulong value)
+    {
+        switch (instruction.GetOpKind(operand))
+        {
+            case OpKind.Immediate8:
+                value = instruction.Immediate8;
+                return true;
+            case OpKind.Immediate16:
+                value = instruction.Immediate16;
+                return true;
+            case OpKind.Immediate32:
+                value = instruction.Immediate32;
+                return true;
+            case OpKind.Immediate64:
+                value = instruction.Immediate64;
+                return true;
+            case OpKind.Immediate8to16 when instruction.Immediate8to16 >= 0:
+                value = (ulong)instruction.Immediate8to16;
+                return true;
+            case OpKind.Immediate8to32 when instruction.Immediate8to32 >= 0:
+                value = (ulong)instruction.Immediate8to32;
+                return true;
+            case OpKind.Immediate8to64 when instruction.Immediate8to64 >= 0:
+                value = (ulong)instruction.Immediate8to64;
+                return true;
+            case OpKind.Immediate32to64 when instruction.Immediate32to64 >= 0:
+                value = (ulong)instruction.Immediate32to64;
+                return true;
+            default:
+                value = 0;
+                return false;
+        }
+    }
+
     /// <summary>
     /// Runs the enclosing-span search over a raw instruction range, so the
     /// behaviour can be pinned on the byte sequences that occur in real guest
     /// code rather than on a mocked decode.
     /// </summary>
+    // Test hook: the forward span a site at siteAddress gets, as the patcher builds it.
+    internal static bool TryBuildForwardSpan(
+        byte[] code,
+        ulong baseAddress,
+        ulong siteAddress,
+        out int spanLength,
+        out int coreStart,
+        out int coreCount)
+    {
+        spanLength = 0;
+        coreStart = 0;
+        coreCount = 0;
+        var decoded = DecodeFunction(code, baseAddress, baseAddress, baseAddress + (ulong)code.Length);
+        var siteIndex = -1;
+        for (var index = 0; index < decoded.Count; index++)
+        {
+            if (decoded[index].Instruction.IP == siteAddress)
+            {
+                siteIndex = index;
+                break;
+            }
+        }
+
+        if (siteIndex < 0 ||
+            !TryBuildPatchSpan(decoded, siteIndex, CollectBranchTargets(decoded), true, out var site, out _))
+        {
+            return false;
+        }
+
+        spanLength = site.ByteLength;
+        coreStart = site.CoreStart;
+        coreCount = site.CoreCount;
+        return true;
+    }
+
     internal static bool TryBuildEnclosingSpan(
         byte[] code,
         ulong baseAddress,
@@ -379,7 +801,10 @@ internal static class GuestRedZonePatcher
             return false;
         }
 
-        if (!TryBuildEnclosingPatchSpan(decoded, faultIndex, CollectBranchTargets(decoded), out var site))
+        var hasIndirectBranch = decoded.Any(static entry =>
+            entry.Instruction.FlowControl == FlowControl.IndirectBranch);
+        if (hasIndirectBranch ||
+            !TryBuildEnclosingPatchSpan(decoded, faultIndex, CollectBranchTargets(decoded), out var site))
         {
             return false;
         }
@@ -417,8 +842,13 @@ internal static class GuestRedZonePatcher
 
         if (coreStart < 0)
         {
-            coreCount = 0;
-            return false;
+            // Nothing in the span touches guest memory: it is a SHA or vector-store rewrite over
+            // register-only instructions. The span builder already refused anything that touches
+            // RSP, so the whole span can run inside the shift. Refusing it here left every SHA
+            // instruction unrewritten, trapping on each execution on hosts without SHA.
+            coreStart = 0;
+            coreCount = instructions.Count;
+            return true;
         }
 
         for (var index = coreStart; index <= coreEnd; index++)
@@ -508,12 +938,13 @@ internal static class GuestRedZonePatcher
         int startIndex,
         IReadOnlySet<ulong> branchTargets,
         out PatchSite site) =>
-        TryBuildPatchSpan(decoded, startIndex, branchTargets, out site, out _);
+        TryBuildPatchSpan(decoded, startIndex, branchTargets, true, out site, out _);
 
     private static bool TryBuildPatchSpan(
         IReadOnlyList<DecodedInstruction> decoded,
         int startIndex,
         IReadOnlySet<ulong> branchTargets,
+        bool canBorrowFollowingInstructions,
         out PatchSite site,
         out SpanRefusal refusal)
     {
@@ -525,6 +956,7 @@ internal static class GuestRedZonePatcher
         {
             var instruction = decoded[index].Instruction;
             if (index != startIndex &&
+                canBorrowFollowingInstructions &&
                 !branchTargets.Contains(instruction.IP) &&
                 IsRelocatableDirectBranch(instruction))
             {
@@ -535,7 +967,11 @@ internal static class GuestRedZonePatcher
                 break;
             }
 
-            if (instruction.FlowControl != FlowControl.Next)
+            if (index != startIndex && !canBorrowFollowingInstructions)
+            {
+                refusal = SpanRefusal.IndirectBranch;
+            }
+            else if (instruction.FlowControl != FlowControl.Next)
             {
                 refusal = SpanRefusal.ControlFlow;
             }
@@ -592,6 +1028,84 @@ internal static class GuestRedZonePatcher
         return displacement < 0 && displacement >= -GuestRedZoneBytes;
     }
 
+    // Clang spills into the red zone through the frame pointer as often as through
+    // RSP: with a standard 'push rbp; mov rbp, rsp' frame plus N callee-saved
+    // pushes, RSP sits at RBP-N, so every [rbp-d] with d > N is below RSP and a
+    // host exception frame would overwrite it. Matching only RSP-relative use left
+    // those functions unprotected.
+    internal static bool UsesFramePointerRedZone(in Instruction instruction, int frameDelta)
+    {
+        if (frameDelta < 0 || !HasMemoryOperand(instruction) || instruction.MemoryBase != Register.RBP)
+        {
+            return false;
+        }
+
+        var displacement = unchecked((long)instruction.MemoryDisplacement64);
+        return displacement < -frameDelta && displacement >= -(frameDelta + (long)GuestRedZoneBytes);
+    }
+
+    // Distance from the frame pointer down to RSP for a standard prologue, or -1
+    // when the function does not establish one. Only the leading pushes and the
+    // first 'sub rsp, imm' count, which under-estimates frames that grow later:
+    // under-estimating only widens the guarded window, so it stays conservative.
+    private static int ComputeFramePointerDelta(List<DecodedInstruction> decoded)
+    {
+        if (decoded.Count < 2)
+        {
+            return -1;
+        }
+
+        var push = decoded[0].Instruction;
+        if (push.Mnemonic != Mnemonic.Push ||
+            push.OpCount != 1 ||
+            push.GetOpKind(0) != OpKind.Register ||
+            push.GetOpRegister(0) != Register.RBP)
+        {
+            return -1;
+        }
+
+        var move = decoded[1].Instruction;
+        if (move.Mnemonic != Mnemonic.Mov ||
+            move.OpCount != 2 ||
+            move.GetOpKind(0) != OpKind.Register ||
+            move.GetOpRegister(0) != Register.RBP ||
+            move.GetOpKind(1) != OpKind.Register ||
+            move.GetOpRegister(1) != Register.RSP)
+        {
+            return -1;
+        }
+
+        var delta = 0;
+        for (var index = 2; index < decoded.Count; index++)
+        {
+            var instruction = decoded[index].Instruction;
+            if (instruction.Mnemonic == Mnemonic.Push &&
+                instruction.OpCount == 1 &&
+                instruction.GetOpKind(0) == OpKind.Register)
+            {
+                delta += 8;
+                continue;
+            }
+
+            if (instruction.Mnemonic == Mnemonic.Sub &&
+                instruction.OpCount == 2 &&
+                instruction.GetOpKind(0) == OpKind.Register &&
+                instruction.GetOpRegister(0) == Register.RSP &&
+                instruction.GetOpKind(1) is OpKind.Immediate8 or OpKind.Immediate8to64 or OpKind.Immediate32to64 or OpKind.Immediate32)
+            {
+                var immediate = (long)instruction.GetImmediate(1);
+                if (immediate > 0 && immediate < int.MaxValue - delta)
+                {
+                    delta += (int)immediate;
+                }
+            }
+
+            break;
+        }
+
+        return delta;
+    }
+
     private static bool UsesStackMemory(in Instruction instruction)
     {
         if (!HasMemoryOperand(instruction))
@@ -968,6 +1482,8 @@ internal static class GuestRedZonePatcher
 
         public int TooShortRefusals { get; init; }
 
+        public int IndirectBranchRefusals { get; init; }
+
         public ulong TrampolineBytes { get; init; }
     }
 

src/SharpEmu.Core/Memory/PhysicalVirtualMemory.cs

@@ -1174,6 +1174,18 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         }
     }
 
+    public object? BackingAliasSnapshot => _backedSpace?.AliasSnapshot;
+
+    public bool TryEnterBackingAliasAccess() => !_disposed && _backedSpace is { } backed && backed.TryEnterAliasAccess();
+
+    public void ExitBackingAliasAccess() => _backedSpace?.ExitAliasAccess();
+
+    public bool TryResolveBackingAlias(ulong address, ulong size, out ulong alias)
+    {
+        alias = 0;
+        return !_disposed && _backedSpace is { } backed && backed.TryResolveAlias(address, size, out alias);
+    }
+
     private bool HasBackingOwner() => !_disposed && _backedSpace != null;
 
     // A span may cross adjacent view records; the owner validates full coverage.

src/SharpEmu.Core/Runtime/SharpEmuRuntime.cs

@@ -159,6 +159,7 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         FiberExports.ResetRuntimeState();
         Http2Exports.ResetRuntimeState();
         NpAuthExports.ResetRuntimeState();
+        NpUniversalDataSystemExports.ResetRuntimeState();
         KernelModuleRegistry.Reset();
         var image = LoadImage(normalizedEbootPath);
         VideoOutExports.ConfigureApplicationInfo(image.Title, image.TitleId, image.Version);

src/SharpEmu.GUI/GuiSettings.cs

@@ -82,12 +82,12 @@ public sealed class GuiSettings
 
     public bool OverlayEnabled { get; set; } = true;
     public string OverlayCorner { get; set; } = "TopRight";
-    public string OverlayMode { get; set; } = "Full";
+    public string OverlayMode { get; set; } = "TitleBar";
 
     /// <summary>Names of SHARPEMU_* switches set to "1" in the emulator's environment at launch.</summary>
-    public List<string> EnvironmentToggles { get; set; } = ["SHARPEMU_WRITABLE_APP0"];
+    public List<string> EnvironmentToggles { get; set; } = ["SHARPEMU_WRITABLE_APP0", "SHARPEMU_DISABLE_IMPORT_LOOP_GUARD"];
 
-    public string BinkPlaybackMode { get; set; } = "Host";
+    public string BinkPlaybackMode { get; set; } = "Guest";
 
     /// <summary>Internal render resolution scale (1.0 = native, 0.5 = half).</summary>
     public double RenderResolutionScale { get; set; } = 1.0;
@@ -131,7 +131,7 @@ public sealed class GuiSettings
 
         settings.GameFolders = FilterNullOrEmpty(settings.GameFolders);
         settings.ExcludedGames = FilterNullOrEmpty(settings.ExcludedGames);
-        settings.EnvironmentToggles = FilterNullOrEmpty(settings.EnvironmentToggles ?? ["SHARPEMU_WRITABLE_APP0"]);
+        settings.EnvironmentToggles = FilterNullOrEmpty(settings.EnvironmentToggles ?? ["SHARPEMU_WRITABLE_APP0", "SHARPEMU_DISABLE_IMPORT_LOOP_GUARD"]);
         settings.LogLevel ??= "Info";
         settings.Language ??= "en";
         var legacyProfile = settings.EnvironmentToggles
@@ -186,9 +186,9 @@ public sealed class GuiSettings
         settings.Resolution = NormalizeResolution(settings.Resolution);
         settings.ScalingMode = NormalizeChoice(settings.ScalingMode, "Fit", "Cover", "Stretch", "Integer");
         settings.HdrMode = NormalizeChoice(settings.HdrMode, "Auto", "On", "Off");
-        settings.BinkPlaybackMode = NormalizeChoice(settings.BinkPlaybackMode, "Host", "Guest", "Skip");
+        settings.BinkPlaybackMode = NormalizeChoice(settings.BinkPlaybackMode, "Guest", "Host", "Skip");
         settings.OverlayCorner = NormalizeChoice(settings.OverlayCorner, "TopRight", "TopLeft", "BottomRight", "BottomLeft");
-        settings.OverlayMode = NormalizeChoice(settings.OverlayMode, "Full", "Minimal", "TitleBar");
+        settings.OverlayMode = NormalizeChoice(settings.OverlayMode, "TitleBar", "Full", "Minimal");
         settings.DisplayIndex = Math.Max(0, settings.DisplayIndex);
         settings.RefreshRate = Math.Clamp(settings.RefreshRate, 0, 1000);
         settings.EmbeddedConsoleHeight = NormalizeConsoleSize(settings.EmbeddedConsoleHeight, 240, 120);

src/SharpEmu.GUI/Languages/ar.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "استخدام HDR عندما تدعمه الشاشة المحددة وواجهة الرسومات. يعود الوضع التلقائي إلى SDR.",
   "Options.Hdr.Auto": "تلقائي",
   "Options.Env.BinkPlayback.Label": "تشغيل فيديو Bink",
-  "Options.Env.BinkPlayback.Desc": "يقوم Host بتشغيل فيديوهات Bink عبر جسر FFmpeg، لكن قد تظهر مشكلات في بعض الألعاب.\nيستخدم Guest وحدة فك الترميز الخاصة بمحرك اللعبة، والتي يدعمها SharpEmu حاليًا بشكل جزئي فقط.\nيتخطى Skip فيديوهات Bink، مما قد يجعل التطوير أسهل.",
+  "Options.Env.BinkPlayback.Desc": "يقوم Host بتشغيل فيديوهات Bink عبر جسر FFmpeg، لكن قد تظهر مشكلات في بعض الألعاب.\nيستخدم Guest وحدة فك الترميز الخاصة بمحرك اللعبة.\nيتخطى Skip فيديوهات Bink، مما قد يجعل التطوير أسهل.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "تخطي"

src/SharpEmu.GUI/Languages/az.json

@@ -91,7 +91,7 @@
   "Options.Hdr.Desc": "Seçilmiş ekran və qrafik alt sistem dəstəklədikdə HDR istifadə edin. Avtomatik rejimdə dəstək yoxdursa, SDR istifadə olunur.",
   "Options.Hdr.Auto": "Avtomatik",
   "Options.Env.BinkPlayback.Label": "Bink video oynadılması",
-  "Options.Env.BinkPlayback.Desc": "Host Bink videolarını FFmpeg körpüsü vasitəsilə oynadır, lakin bəzi oyunlarda problemlər yarana bilər.\nGuest oyunun öz dekoderindən istifadə edir; SharpEmu hazırda bunu yalnız qismən dəstəkləyir.\nSkip Bink videolarını ötürür və bu, inkişaf prosesini asanlaşdıra bilər.",
+  "Options.Env.BinkPlayback.Desc": "Host Bink videolarını FFmpeg körpüsü vasitəsilə oynadır, lakin bəzi oyunlarda problemlər yarana bilər.\nGuest oyunun öz dekoderindən istifadə edir.\nSkip Bink videolarını ötürür və bu, inkişaf prosesini asanlaşdıra bilər.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Skip",

src/SharpEmu.GUI/Languages/br.json

@@ -237,7 +237,7 @@
   "Options.Hdr.Desc": "Usa HDR quando a tela selecionada e o backend gráfico oferecem suporte. O modo automático retorna ao SDR.",
   "Options.Hdr.Auto": "Automático",
   "Options.Env.BinkPlayback.Label": "Reprodução de vídeo Bink",
-  "Options.Env.BinkPlayback.Desc": "Host reproduz vídeos Bink pela ponte FFmpeg, mas alguns jogos podem apresentar problemas.\nGuest usa o decodificador do próprio motor do jogo, que o SharpEmu atualmente suporta apenas parcialmente.\nSkip ignora os vídeos Bink, o que pode facilitar o desenvolvimento.",
+  "Options.Env.BinkPlayback.Desc": "Host reproduz vídeos Bink pela ponte FFmpeg, mas alguns jogos podem apresentar problemas.\nGuest usa o decodificador do próprio motor do jogo.\nSkip ignora os vídeos Bink, o que pode facilitar o desenvolvimento.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Ignorar"

src/SharpEmu.GUI/Languages/de.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "HDR verwenden, wenn die ausgewählte Anzeige und das Grafik-Backend es unterstützen. Automatisch fällt auf SDR zurück.",
   "Options.Hdr.Auto": "Automatisch",
   "Options.Env.BinkPlayback.Label": "Bink-Videowiedergabe",
-  "Options.Env.BinkPlayback.Desc": "Host spielt Bink-Videos über die FFmpeg-Brücke ab, bei einigen Spielen können jedoch Probleme auftreten.\nGuest verwendet den spieleigenen Decoder, den SharpEmu derzeit nur teilweise unterstützt.\nSkip überspringt Bink-Videos, was die Entwicklung erleichtern kann.",
+  "Options.Env.BinkPlayback.Desc": "Host spielt Bink-Videos über die FFmpeg-Brücke ab, bei einigen Spielen können jedoch Probleme auftreten.\nGuest verwendet den spieleigenen Decoder.\nSkip überspringt Bink-Videos, was die Entwicklung erleichtern kann.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Überspringen"

src/SharpEmu.GUI/Languages/dk.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "Brug HDR, når den valgte skærm og grafik-backend understøtter det. Automatisk falder tilbage til SDR.",
   "Options.Hdr.Auto": "Automatisk",
   "Options.Env.BinkPlayback.Label": "Bink-videoafspilning",
-  "Options.Env.BinkPlayback.Desc": "Host afspiller Bink-videoer via FFmpeg-broen, men nogle spil kan opleve problemer.\nGuest bruger spilmotorens egen dekoder, som SharpEmu i øjeblikket kun understøtter delvist.\nSkip springer Bink-videoer over, hvilket kan gøre udviklingen nemmere.",
+  "Options.Env.BinkPlayback.Desc": "Host afspiller Bink-videoer via FFmpeg-broen, men nogle spil kan opleve problemer.\nGuest bruger spilmotorens egen dekoder.\nSkip springer Bink-videoer over, hvilket kan gøre udviklingen nemmere.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Spring over"

src/SharpEmu.GUI/Languages/ee.json

@@ -102,7 +102,7 @@
   "Options.Hdr.Desc": "Kasuta HDR-i, kui valitud kuvar ja graafikaliides seda toetavad. Automaatrežiim lülitub tagasi SDR-ile.",
   "Options.Hdr.Auto": "Automaatne",
   "Options.Env.BinkPlayback.Label": "Bink-video taasesitus",
-  "Options.Env.BinkPlayback.Desc": "Host esitab Bink-videoid FFmpegi silla kaudu, kuid mõnes mängus võib esineda probleeme.\nGuest kasutab mängumootori enda dekoodrit, mida SharpEmu praegu ainult osaliselt toetab.\nSkip jätab Bink-videod vahele, mis võib arendust lihtsustada.",
+  "Options.Env.BinkPlayback.Desc": "Host esitab Bink-videoid FFmpegi silla kaudu, kuid mõnes mängus võib esineda probleeme.\nGuest kasutab mängumootori enda dekoodrit.\nSkip jätab Bink-videod vahele, mis võib arendust lihtsustada.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Jäta vahele",

src/SharpEmu.GUI/Languages/en.json

@@ -102,7 +102,7 @@
   "Options.Hdr.Desc": "Use HDR when the selected display and graphics backend support it. Auto falls back to SDR.",
   "Options.Hdr.Auto": "Auto",
   "Options.Env.BinkPlayback.Label": "Bink video playback",
-  "Options.Env.BinkPlayback.Desc": "Host plays Bink videos through the FFmpeg bridge, but some games may have issues.\nGuest uses the game engine's own decoder, which SharpEmu currently supports only partially.\nSkip skips Bink videos, which can make development easier.",
+  "Options.Env.BinkPlayback.Desc": "Host plays Bink videos through the FFmpeg bridge, but some games may have issues.\nGuest uses the game engine's own decoder.\nSkip skips Bink videos, which can make development easier.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Skip",

src/SharpEmu.GUI/Languages/es.json

@@ -237,7 +237,7 @@
   "Options.Hdr.Desc": "Usa HDR cuando la pantalla seleccionada y el backend gráfico sean compatibles. El modo automático vuelve a SDR.",
   "Options.Hdr.Auto": "Automático",
   "Options.Env.BinkPlayback.Label": "Reproducción de vídeo Bink",
-  "Options.Env.BinkPlayback.Desc": "Host reproduce los vídeos Bink mediante el puente FFmpeg, aunque algunos juegos pueden presentar problemas.\nGuest usa el decodificador propio del motor del juego, que SharpEmu actualmente solo admite de forma parcial.\nSkip omite los vídeos Bink, lo que puede facilitar el desarrollo.",
+  "Options.Env.BinkPlayback.Desc": "Host reproduce los vídeos Bink mediante el puente FFmpeg, aunque algunos juegos pueden presentar problemas.\nGuest usa el decodificador propio del motor del juego.\nSkip omite los vídeos Bink, lo que puede facilitar el desarrollo.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Omitir"

src/SharpEmu.GUI/Languages/fr.json

@@ -237,7 +237,7 @@
   "Options.Hdr.Desc": "Utiliser le HDR lorsque l’écran sélectionné et le backend graphique le prennent en charge. Le mode automatique revient au SDR.",
   "Options.Hdr.Auto": "Automatique",
   "Options.Env.BinkPlayback.Label": "Lecture vidéo Bink",
-  "Options.Env.BinkPlayback.Desc": "Host lit les vidéos Bink via le pont FFmpeg, mais certains jeux peuvent rencontrer des problèmes.\nGuest utilise le décodeur propre au moteur du jeu, que SharpEmu ne prend actuellement en charge que partiellement.\nSkip ignore les vidéos Bink, ce qui peut faciliter le développement.",
+  "Options.Env.BinkPlayback.Desc": "Host lit les vidéos Bink via le pont FFmpeg, mais certains jeux peuvent rencontrer des problèmes.\nGuest utilise le décodeur propre au moteur du jeu.\nSkip ignore les vidéos Bink, ce qui peut faciliter le développement.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Ignorer"

src/SharpEmu.GUI/Languages/hu.json

@@ -237,7 +237,7 @@
   "Options.Hdr.Desc": "HDR használata, ha a kiválasztott kijelző és grafikus backend támogatja. Az automatikus mód SDR-re vált vissza.",
   "Options.Hdr.Auto": "Automatikus",
   "Options.Env.BinkPlayback.Label": "Bink videólejátszás",
-  "Options.Env.BinkPlayback.Desc": "A Host az FFmpeg hídon keresztül játssza le a Bink videókat, de egyes játékoknál problémák jelentkezhetnek.\nA Guest a játékmotor saját dekóderét használja, amelyet a SharpEmu jelenleg csak részben támogat.\nA Skip kihagyja a Bink videókat, ami megkönnyítheti a fejlesztést.",
+  "Options.Env.BinkPlayback.Desc": "A Host az FFmpeg hídon keresztül játssza le a Bink videókat, de egyes játékoknál problémák jelentkezhetnek.\nA Guest a játékmotor saját dekóderét használja.\nA Skip kihagyja a Bink videókat, ami megkönnyítheti a fejlesztést.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Kihagyás"

src/SharpEmu.GUI/Languages/it.json

@@ -241,7 +241,7 @@
   "Options.Hdr.Desc": "Usa HDR quando lo schermo selezionato e il backend grafico lo supportano. La modalità automatica torna a SDR.",
   "Options.Hdr.Auto": "Automatico",
   "Options.Env.BinkPlayback.Label": "Riproduzione video Bink",
-  "Options.Env.BinkPlayback.Desc": "Host riproduce i video Bink tramite il bridge FFmpeg, ma alcuni giochi potrebbero avere problemi.\nGuest usa il decoder del motore di gioco, che SharpEmu attualmente supporta solo in parte.\nSkip salta i video Bink, facilitando lo sviluppo.",
+  "Options.Env.BinkPlayback.Desc": "Host riproduce i video Bink tramite il bridge FFmpeg, ma alcuni giochi potrebbero avere problemi.\nGuest usa il decoder del motore di gioco.\nSkip salta i video Bink, facilitando lo sviluppo.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Salta"

src/SharpEmu.GUI/Languages/ja.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "選択したディスプレイとグラフィックスバックエンドが対応している場合にHDRを使用します。自動ではSDRにフォールバックします。",
   "Options.Hdr.Auto": "自動",
   "Options.Env.BinkPlayback.Label": "Bink 動画再生",
-  "Options.Env.BinkPlayback.Desc": "Host は FFmpeg ブリッジ経由で Bink 動画を再生しますが、一部のゲームで問題が発生する場合があります。\nGuest はゲームエンジン独自のデコーダーを使用しますが、SharpEmu は現在これを部分的にしかサポートしていません。\nSkip は Bink 動画をスキップし、開発を容易にする場合があります。",
+  "Options.Env.BinkPlayback.Desc": "Host は FFmpeg ブリッジ経由で Bink 動画を再生しますが、一部のゲームで問題が発生する場合があります。\nGuest はゲームエンジン独自のデコーダーを使用します。\nSkip は Bink 動画をスキップし、開発を容易にする場合があります。",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "スキップ"

src/SharpEmu.GUI/Languages/ko.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "선택한 디스플레이와 그래픽 백엔드가 지원하는 경우 HDR을 사용합니다. 자동 모드는 SDR로 대체됩니다.",
   "Options.Hdr.Auto": "자동",
   "Options.Env.BinkPlayback.Label": "Bink 비디오 재생",
-  "Options.Env.BinkPlayback.Desc": "Host는 FFmpeg 브리지를 통해 Bink 비디오를 재생하지만 일부 게임에서 문제가 발생할 수 있습니다.\nGuest는 게임 엔진 자체 디코더를 사용하며, SharpEmu는 현재 이를 부분적으로만 지원합니다.\nSkip은 Bink 비디오를 건너뛰어 개발을 더 쉽게 할 수 있습니다.",
+  "Options.Env.BinkPlayback.Desc": "Host는 FFmpeg 브리지를 통해 Bink 비디오를 재생하지만 일부 게임에서 문제가 발생할 수 있습니다.\nGuest는 게임 엔진 자체 디코더를 사용합니다.\nSkip은 Bink 비디오를 건너뛰어 개발을 더 쉽게 할 수 있습니다.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "건너뛰기"

src/SharpEmu.GUI/Languages/nl.json

@@ -236,7 +236,7 @@
   "Options.Hdr.Desc": "Gebruik HDR wanneer het geselecteerde beeldscherm en de grafische backend dit ondersteunen. Automatisch valt terug op SDR.",
   "Options.Hdr.Auto": "Automatisch",
   "Options.Env.BinkPlayback.Label": "Bink-video afspelen",
-  "Options.Env.BinkPlayback.Desc": "Host speelt Bink-video's af via de FFmpeg-brug, maar sommige games kunnen problemen hebben.\nGuest gebruikt de eigen decoder van de game-engine, die SharpEmu momenteel slechts gedeeltelijk ondersteunt.\nSkip slaat Bink-video's over, wat de ontwikkeling kan vergemakkelijken.",
+  "Options.Env.BinkPlayback.Desc": "Host speelt Bink-video's af via de FFmpeg-brug, maar sommige games kunnen problemen hebben.\nGuest gebruikt de eigen decoder van de game-engine.\nSkip slaat Bink-video's over, wat de ontwikkeling kan vergemakkelijken.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Overslaan"

src/SharpEmu.GUI/Languages/pl.json

@@ -102,7 +102,7 @@
   "Options.Hdr.Desc": "Używaj HDR, gdy wybrany wyświetlacz i backend graficzny to obsługują. Automatyczny przełącza na SDR.",
   "Options.Hdr.Auto": "Automatyczny",
   "Options.Env.BinkPlayback.Label": "Odtwarzanie wideo Bink",
-  "Options.Env.BinkPlayback.Desc": "Host odtwarza filmy Bink przez most FFmpeg, ale w niektórych grach mogą wystąpić problemy.\nGuest używa dekodera silnika gry, który SharpEmu obecnie obsługuje tylko częściowo.\nSkip pomija filmy Bink, co może ułatwić rozwój.",
+  "Options.Env.BinkPlayback.Desc": "Host odtwarza filmy Bink przez most FFmpeg, ale w niektórych grach mogą wystąpić problemy.\nGuest używa dekodera silnika gry.\nSkip pomija filmy Bink, co może ułatwić rozwój.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Pomiń",

src/SharpEmu.GUI/Languages/pt.json

@@ -237,7 +237,7 @@
   "Options.Hdr.Desc": "Utiliza HDR quando o ecrã selecionado e o backend gráfico o suportam. O modo automático regressa a SDR.",
   "Options.Hdr.Auto": "Automático",
   "Options.Env.BinkPlayback.Label": "Reprodução de vídeo Bink",
-  "Options.Env.BinkPlayback.Desc": "Host reproduz vídeos Bink pela ponte FFmpeg, mas alguns jogos podem apresentar problemas.\nGuest usa o descodificador do próprio motor do jogo, que o SharpEmu atualmente suporta apenas parcialmente.\nSkip ignora os vídeos Bink, o que pode facilitar o desenvolvimento.",
+  "Options.Env.BinkPlayback.Desc": "Host reproduz vídeos Bink pela ponte FFmpeg, mas alguns jogos podem apresentar problemas.\nGuest usa o descodificador do próprio motor do jogo.\nSkip ignora os vídeos Bink, o que pode facilitar o desenvolvimento.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Ignorar"

src/SharpEmu.GUI/Languages/ru.json

@@ -98,7 +98,7 @@
   "Options.Hdr.Desc": "Использовать HDR, если выбранный монитор и графический бэкенд его поддерживают. Автоматический режим при необходимости переключается на SDR.",
   "Options.Hdr.Auto": "Авто",
   "Options.Env.BinkPlayback.Label": "Воспроизведение видео Bink",
-  "Options.Env.BinkPlayback.Desc": "Host воспроизводит видео Bink через мост FFmpeg, однако в некоторых играх могут возникать проблемы.\nGuest использует собственный декодер игрового движка, который SharpEmu сейчас поддерживает лишь частично.\nSkip пропускает видео Bink, что может упростить разработку.",
+  "Options.Env.BinkPlayback.Desc": "Host воспроизводит видео Bink через мост FFmpeg, однако в некоторых играх могут возникать проблемы.\nGuest использует собственный декодер игрового движка.\nSkip пропускает видео Bink, что может упростить разработку.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Пропустить",

src/SharpEmu.GUI/Languages/tr.json

@@ -240,7 +240,7 @@
   "Options.Scaling.Integer": "Tam sayı",
   "Options.Hdr.Auto": "Otomatik",
   "Options.Env.BinkPlayback.Label": "Bink video oynatma",
-  "Options.Env.BinkPlayback.Desc": "Host, Bink videolarını FFmpeg köprüsüyle oynatır ancak bazı oyunlarda sorunlarla karşılaşabilir.\nGuest, oyun motorunun kendi kod çözücüsünü kullanır ancak SharpEmu bunu şu anda yalnızca kısmen desteklemektedir.\nSkip, Bink videolarını atlar; bu, geliştirmeyi kolaylaştırabilir.",
+  "Options.Env.BinkPlayback.Desc": "Host, Bink videolarını FFmpeg köprüsüyle oynatır ancak bazı oyunlarda sorunlarla karşılaşabilir.\nGuest, oyun motorunun kendi kod çözücüsünü kullanır.\nSkip, Bink videolarını atlar; bu, geliştirmeyi kolaylaştırabilir.",
   "Options.Env.BinkPlayback.Host": "Host (FFmpeg)",
   "Options.Env.BinkPlayback.Guest": "Guest",
   "Options.Env.BinkPlayback.Skip": "Atla"

src/SharpEmu.GUI/MainWindow.GameOptions.cs

@@ -218,7 +218,7 @@ public partial class MainWindow
                 "Fit");
             GameVSyncToggle.IsChecked = effective.VSync;
             GameOverlayEnabledToggle.IsChecked = effective.OverlayEnabled;
-            GameOverlayModeBox.SelectedItem = FindChoice(_overlayModeChoices, effective.OverlayMode, "Full");
+            GameOverlayModeBox.SelectedItem = FindChoice(_overlayModeChoices, effective.OverlayMode, "TitleBar");
             GameOverlayCornerBox.SelectedItem = FindChoice(_overlayCornerChoices, effective.OverlayCorner, "TopRight");
             GameHdrModeBox.SelectedItem = FindChoice(
                 _hdrModeChoices,
@@ -285,7 +285,7 @@ public partial class MainWindow
             VSync = GameVSyncToggle.IsChecked == true,
             HdrMode = SelectedComboText(GameHdrModeBox, "Auto"),
             OverlayEnabled = GameOverlayEnabledToggle.IsChecked == true,
-            OverlayMode = SelectedComboText(GameOverlayModeBox, "Full"),
+            OverlayMode = SelectedComboText(GameOverlayModeBox, "TitleBar"),
             OverlayCorner = SelectedComboText(GameOverlayCornerBox, "TopRight"),
             EnvironmentToggles = BuildGameEnvironmentEntries(),
             CustomEnvironmentVariables = PerGameSettings.Load(_gameSettingsTitleId)?.CustomEnvironmentVariables,

src/SharpEmu.GUI/MainWindow.axaml.cs

@@ -327,7 +327,7 @@ public partial class MainWindow : Window
         VSyncToggle.IsCheckedChanged += (_, _) => _settings.VSync = VSyncToggle.IsChecked == true;
         HdrModeBox.SelectionChanged += (_, _) => _settings.HdrMode = SelectedComboText(HdrModeBox, "Auto");
         OverlayEnabledToggle.IsCheckedChanged += (_, _) => _settings.OverlayEnabled = OverlayEnabledToggle.IsChecked == true;
-        OverlayModeBox.SelectionChanged += (_, _) => _settings.OverlayMode = SelectedComboText(OverlayModeBox, "Full");
+        OverlayModeBox.SelectionChanged += (_, _) => _settings.OverlayMode = SelectedComboText(OverlayModeBox, "TitleBar");
         OverlayCornerBox.SelectionChanged += (_, _) => _settings.OverlayCorner = SelectedComboText(OverlayCornerBox, "TopRight");
         UpdateButton.Click += async (_, _) => await OnUpdateButtonAsync();
         SelectLogFilePathButton.Click += async (_, _) => await SelectLogFilePathAsync();
@@ -344,7 +344,7 @@ public partial class MainWindow : Window
         EnvWritableApp0Toggle.IsCheckedChanged += (_, _) =>
             SetEnvironmentToggle("SHARPEMU_WRITABLE_APP0", EnvWritableApp0Toggle.IsChecked == true);
         BinkPlaybackBox.SelectionChanged += (_, _) =>
-            _settings.BinkPlaybackMode = SelectedComboText(BinkPlaybackBox, "Host");
+            _settings.BinkPlaybackMode = SelectedComboText(BinkPlaybackBox, "Guest");
         EnvVkValidationToggle.IsCheckedChanged += (_, _) =>
             SetEnvironmentToggle("SHARPEMU_VK_VALIDATION", EnvVkValidationToggle.IsChecked == true);
         EnvDumpSpirvToggle.IsCheckedChanged += (_, _) =>
@@ -2545,6 +2545,11 @@ public partial class MainWindow : Window
         _appliedEnvironmentVariables.Add(StrictComputeSettings.VariableName);
         _appliedEnvironmentVariables.Add(DefaultProfileEnvironmentName);
 
+        // An absent switch now enables the guard opt-out by default; send 0 for a disabled GUI toggle.
+        Environment.SetEnvironmentVariable("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD",
+            effective.EnvironmentToggles.Contains("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD") ? "1" : "0");
+        _appliedEnvironmentVariables.Add("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD");
+
         Environment.SetEnvironmentVariable(
             BinkModeEnvironmentName,
             _settings.BinkPlaybackMode switch

src/SharpEmu.HLE/GpuMemory/CpuDirtySummary.cs

@@ -12,6 +12,11 @@ public sealed class CpuDirtySummary
 {
     private const int WordBits = 64;
     private readonly long[] _words = new long[(TrackerLayout.BlockCount + WordBits - 1) / WordBits];
+    private long _epoch;
+
+    public long Epoch => Volatile.Read(ref _epoch);
+
+    public void NoteDirtied() => Interlocked.Increment(ref _epoch);
 
     public void Set(ulong block, bool dirty)
     {
@@ -28,4 +33,6 @@ public sealed class CpuDirtySummary
     }
 
     public bool IsDirty(ulong block) => (Volatile.Read(ref _words[block / WordBits]) & (1L << (int)(block % WordBits))) != 0;
+
+    public ulong Word(int index) => (ulong)Volatile.Read(ref _words[index]);
 }

src/SharpEmu.HLE/GpuMemory/GuestGpuMemory.cs

@@ -30,6 +30,9 @@ public sealed class GuestGpuMemory : IDisposable
     private readonly PageGuard _pages;
     private readonly ReaderWriterLockSlim _spansLock = new();
     private readonly SpanSet _spans = new();
+    private long _spanVersion;
+
+    public long SpanVersion => Interlocked.Read(ref _spanVersion);
     private sealed record GpuAttachment(IGpuQueueRelay? Gpu, IGpuTickScheduler? Scheduler);
 
     private readonly object _attachGate = new();
@@ -174,6 +177,26 @@ public sealed class GuestGpuMemory : IDisposable
         }
     }
 
+    // Whether any GPU-registered span intersects the range. Memory outside every span holds no GPU
+    // cache entries and no tracked pages, so mapping changes there need nothing from the GPU worker.
+    public bool OverlapsRegistered(ulong address, ulong size)
+    {
+        if (!new GuestSpan(address, size).IsValid)
+        {
+            return false;
+        }
+
+        _spansLock.EnterReadLock();
+        try
+        {
+            return _spans.Overlaps(address, size);
+        }
+        finally
+        {
+            _spansLock.ExitReadLock();
+        }
+    }
+
     // The host mapping takes the guest protection here; the views themselves are mapped read-write.
     public void Register(ulong address, ulong size, GuestPageProtection protection)
     {
@@ -184,6 +207,7 @@ public sealed class GuestGpuMemory : IDisposable
         try
         {
             _spans.Add(address, size);
+            Interlocked.Increment(ref _spanVersion);
         }
         finally
         {
@@ -256,6 +280,7 @@ public sealed class GuestGpuMemory : IDisposable
                 try
                 {
                     _spans.Remove(address, size);
+                    Interlocked.Increment(ref _spanVersion);
                 }
                 finally
                 {

src/SharpEmu.HLE/GpuMemory/GuestGpuMemoryHook.cs

@@ -102,6 +102,9 @@ public static class GuestGpuMemoryHook
     public static bool NoteProtected(ulong address, ulong size, GuestPageProtection protection) =>
         _current != null && IsWithinGpuAddressSpace(address, size) && _current.NoteProtected(address, size, protection);
 
+    public static bool OverlapsRegistered(ulong address, ulong size) =>
+        _current != null && IsWithinGpuAddressSpace(address, size) && _current.OverlapsRegistered(address, size);
+
     public static void NoteUnmapped(ulong address, ulong size)
     {
         if (_current == null || !IsWithinGpuAddressSpace(address, size))

src/SharpEmu.HLE/GpuMemory/GuestPageTracker.cs

@@ -15,6 +15,7 @@ public sealed class GuestPageTracker
 
     private readonly PageGuard _pages;
     private readonly TrackedRegion?[] _regions = new TrackedRegion?[TrackerLayout.BlockCount];
+    private readonly long[] _presentRegions = new long[(TrackerLayout.BlockCount + 63) / 64];
     private readonly object _regionGate = new();
     private readonly CpuDirtySummary _cpuDirtySummary = new();
 
@@ -35,6 +36,34 @@ public sealed class GuestPageTracker
         });
     }
 
+    public bool MayHaveCpuDirtyPages(ulong vaddr, ulong size)
+    {
+        if (IsKnownCpuClean(vaddr, size))
+        {
+            return false;
+        }
+
+        var remaining = size;
+        var index = vaddr / BlockBytes;
+        var offset = vaddr % BlockBytes;
+        while (remaining != 0)
+        {
+            var bytes = Math.Min(BlockBytes - offset, remaining);
+            if (Volatile.Read(ref _regions[index]) is not { } region || region.IsModified(WriteOrigin.Cpu, offset, bytes))
+            {
+                return true;
+            }
+
+            remaining -= bytes;
+            offset = 0;
+            index++;
+        }
+
+        return false;
+    }
+
+    public long CpuDirtyEpoch => _cpuDirtySummary.Epoch;
+
     public bool HasGpuDirtyPages(ulong vaddr, ulong size)
     {
         RejectUploadCallbackReentry();
@@ -420,19 +449,42 @@ public sealed class GuestPageTracker
         var last = (end - 1) / BlockBytes;
         var runStart = 0UL;
         var inRun = false;
-        for (var index = vaddr / BlockBytes; index <= last; index++)
+        var index = vaddr / BlockBytes;
+        var loadedWord = -1;
+        var possiblyDirty = 0UL;
+        while (index <= last)
         {
-            var possiblyDirty = Volatile.Read(ref _regions[index]) == null || _cpuDirtySummary.IsDirty(index);
-            if (possiblyDirty && !inRun)
+            var word = (int)(index / 64);
+            if (word != loadedWord)
             {
-                runStart = Math.Max(vaddr, index * BlockBytes);
-                inRun = true;
+                loadedWord = word;
+                possiblyDirty = ~(ulong)Volatile.Read(ref _presentRegions[word]) | _cpuDirtySummary.Word(word);
             }
-            else if (!possiblyDirty && inRun)
+
+            var shift = (int)(index % 64);
+            var pending = (inRun ? ~possiblyDirty : possiblyDirty) >> shift;
+            if (pending == 0)
+            {
+                index = ((ulong)word + 1) * 64;
+                continue;
+            }
+
+            index += (ulong)System.Numerics.BitOperations.TrailingZeroCount(pending);
+            if (index > last)
+            {
+                break;
+            }
+
+            if (inRun)
             {
                 visit(runStart, index * BlockBytes - runStart);
                 inRun = false;
             }
+            else
+            {
+                runStart = Math.Max(vaddr, index * BlockBytes);
+                inRun = true;
+            }
         }
 
         if (inRun)
@@ -496,6 +548,7 @@ public sealed class GuestPageTracker
 
             var created = new TrackedRegion(_pages, index * BlockBytes, _cpuDirtySummary);
             Volatile.Write(ref _regions[index], created);
+            Interlocked.Or(ref _presentRegions[index / 64], 1L << (int)(index % 64));
             return created;
         }
     }

src/SharpEmu.HLE/GpuMemory/TrackedRegion.cs

@@ -33,6 +33,7 @@ public sealed class TrackedRegion
         _writable.Fill();
         _readable.Fill();
         _summary?.Set(BaseAddress / BlockBytes, dirty: true);
+        _summary?.NoteDirtied();
     }
 
     public RegionLock Lock { get; } = new();
@@ -212,6 +213,11 @@ public sealed class TrackedRegion
     private void UpdateCpuProtection(bool track)
     {
         _summary?.Set(BaseAddress / BlockBytes, _cpuDirty.Any);
+        if (_summary is not null && (_cpuDirty & ~_writable).Any)
+        {
+            _summary.NoteDirtied();
+        }
+
         var mask = _cpuDirty ^ _writable;
         _writable = _cpuDirty;
         if (mask.None)

src/SharpEmu.HLE/GuestFastPath.cs

@@ -0,0 +1,414 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Collections.Concurrent;
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Per-host-thread state that emitted native x86-64 import stubs can read
+/// without entering managed code.
+///
+/// The hottest guest imports are trivial queries about the calling thread
+/// (pthread_self, pthread_getspecific). Routing them through the managed
+/// import gateway costs a guest-to-host stack switch, a full guest register
+/// pack, a GCHandle dereference and the whole dispatch bookkeeping - roughly
+/// three orders of magnitude more than the answer itself. This class publishes
+/// the few values those imports need into a flat native block whose address
+/// lives in a native TLS slot, so a stub can answer them in a handful of
+/// instructions and fall back to the managed gateway whenever the fast answer
+/// is not available.
+///
+/// The block is owned by the host thread; the values in it describe the guest
+/// thread currently bound to that host thread, and are republished by
+/// <see cref="GuestThreadExecution.EnterGuestThread"/> /
+/// <see cref="GuestThreadExecution.RestoreGuestThread"/>. A block whose
+/// ThreadHandle is zero means "no guest thread bound here": every stub then
+/// takes the managed path, which is also what happens before the fast path is
+/// enabled at all.
+/// </summary>
+public static unsafe class GuestFastPath
+{
+    /// <summary>
+    /// Byte offset of the guest thread handle pthread_self must answer with.
+    /// Only ever a real guest thread handle: for a host thread with no guest
+    /// thread bound, pthread_self has to reach the managed export (it registers
+    /// the thread's CPU context with the scheduler), so the slot stays zero.
+    /// </summary>
+    public const int BlockSelfHandleOffset = 0;
+
+    /// <summary>
+    /// Byte offset of the pointer to the pthread-specific value table of the
+    /// thread handle KernelPthreadState would report - the bound guest thread,
+    /// or the host thread's own synthetic handle when none is bound.
+    /// </summary>
+    public const int BlockTlsValuesOffset = 8;
+
+    /// <summary>Byte offset of the pthread_self fast-path hit counter.</summary>
+    public const int BlockSelfHitsOffset = 16;
+
+    /// <summary>Byte offset of the pthread_getspecific fast-path hit counter.</summary>
+    public const int BlockGetspecificHitsOffset = 32;
+
+    /// <summary>Size of the per-host-thread block. One cache line, room for future fast-path state.</summary>
+    public const int BlockSize = 64;
+
+    /// <summary>
+    /// pthread TLS keys the native table can answer. Keys are handed out
+    /// densely from 1 upwards by pthread_key_create, so a small dense table
+    /// covers every key a real title creates; anything at or above this limit
+    /// is answered by the managed dictionary through the slow path.
+    /// </summary>
+    public const int TlsSlotCount = 1024;
+
+    private static readonly ConcurrentDictionary<ulong, nint> TlsTables = new();
+
+    /// <summary>Values for keys at or above <see cref="TlsSlotCount"/>; effectively never used.</summary>
+    private static readonly ConcurrentDictionary<ulong, ConcurrentDictionary<int, ulong>> TlsOverflow = new();
+
+    private static readonly List<nint> Blocks = new();
+    private static readonly object BlocksGate = new();
+
+    private static Action<nint>? _publishBlock;
+    private static volatile bool _enabled;
+
+    [ThreadStatic]
+    private static nint _block;
+
+    [ThreadStatic]
+    private static ulong _hostThreadHandle;
+
+    [ThreadStatic]
+    private static ulong _cachedTableHandle;
+
+    [ThreadStatic]
+    private static nint _cachedTable;
+
+    /// <summary>True once a backend has installed native stubs that read the block.</summary>
+    public static bool Enabled => _enabled;
+
+    /// <summary>
+    /// Arms the fast path. <paramref name="publishBlock"/> stores a block
+    /// pointer in the native TLS slot the emitted stubs read, for the host
+    /// thread that calls it.
+    /// </summary>
+    public static void Enable(Action<nint> publishBlock)
+    {
+        _publishBlock = publishBlock ?? throw new ArgumentNullException(nameof(publishBlock));
+        _enabled = true;
+
+        // A block is published once per host thread, so a second backend (and
+        // therefore a second TLS slot) must be handed the block this thread
+        // already owns or its stubs would never see one.
+        if (_block != 0)
+        {
+            _publishBlock(_block);
+        }
+    }
+
+    /// <summary>Disarms every stub by clearing the calling thread's block; used by tests.</summary>
+    public static void Disable()
+    {
+        _enabled = false;
+        var block = _block;
+        if (block != 0)
+        {
+            *(ulong*)(block + BlockSelfHandleOffset) = 0;
+            *(nint*)(block + BlockTlsValuesOffset) = 0;
+        }
+    }
+
+    /// <summary>
+    /// Publishes <paramref name="guestThreadHandle"/> (and its pthread TLS
+    /// table) as the guest thread bound to the calling host thread. Pass 0 to
+    /// unbind, which leaves pthread_self on the managed gateway and falls the
+    /// value table back to the host thread's own pthread storage.
+    /// </summary>
+    public static void BindGuestThread(ulong guestThreadHandle)
+    {
+        if (!_enabled)
+        {
+            return;
+        }
+
+        var block = EnsureBlock();
+        if (block == 0)
+        {
+            return;
+        }
+
+        // Clear the self handle first so a stub can never answer with a handle
+        // that no longer owns this host thread.
+        *(ulong*)(block + BlockSelfHandleOffset) = 0;
+        var tlsHandle = guestThreadHandle != 0 ? guestThreadHandle : _hostThreadHandle;
+        *(nint*)(block + BlockTlsValuesOffset) = tlsHandle == 0 ? 0 : GetOrCreateTable(tlsHandle);
+        *(ulong*)(block + BlockSelfHandleOffset) = guestThreadHandle;
+    }
+
+    /// <summary>
+    /// Records the calling host thread's own pthread handle - the one
+    /// KernelPthreadState reports when no guest thread is bound - so
+    /// pthread_getspecific can be answered on threads the guest scheduler does
+    /// not own (the primary execution thread among them).
+    /// </summary>
+    public static void BindHostThread(ulong hostThreadHandle)
+    {
+        if (!_enabled || hostThreadHandle == 0)
+        {
+            return;
+        }
+
+        _hostThreadHandle = hostThreadHandle;
+        var block = EnsureBlock();
+        if (block == 0 || *(ulong*)(block + BlockSelfHandleOffset) != 0)
+        {
+            // A bound guest thread owns the value table while it runs.
+            return;
+        }
+
+        *(nint*)(block + BlockTlsValuesOffset) = GetOrCreateTable(hostThreadHandle);
+    }
+
+    /// <summary>
+    /// Drops every fast-path binding for the calling host thread, so each stub
+    /// falls back to the managed gateway until the thread is bound again.
+    /// </summary>
+    public static void UnbindCurrentThread()
+    {
+        _hostThreadHandle = 0;
+        var block = _block;
+        if (block != 0)
+        {
+            *(ulong*)(block + BlockSelfHandleOffset) = 0;
+            *(nint*)(block + BlockTlsValuesOffset) = 0;
+        }
+    }
+
+    /// <summary>Fast-path hit counts summed over every host thread, for diagnostics.</summary>
+    public static (long SelfHits, long GetspecificHits, int Blocks) SnapshotCounters()
+    {
+        long selfHits = 0;
+        long getspecificHits = 0;
+        int blocks;
+        lock (BlocksGate)
+        {
+            blocks = Blocks.Count;
+            foreach (var block in Blocks)
+            {
+                selfHits += *(long*)(block + BlockSelfHitsOffset);
+                getspecificHits += *(long*)(block + BlockGetspecificHitsOffset);
+            }
+        }
+
+        return (selfHits, getspecificHits, blocks);
+    }
+
+    /// <summary>Address of the calling host thread's block; allocates it on first use.</summary>
+    public static nint EnsureBlock()
+    {
+        var block = _block;
+        if (block != 0)
+        {
+            return block;
+        }
+
+        block = (nint)NativeMemory.AllocZeroed(BlockSize);
+        _block = block;
+        lock (BlocksGate)
+        {
+            Blocks.Add(block);
+        }
+
+        _publishBlock?.Invoke(block);
+        return block;
+    }
+
+    /// <summary>The pthread-specific value table for a guest (or host) thread handle.</summary>
+    public static nint GetOrCreateTable(ulong threadHandle)
+    {
+        if (threadHandle == 0)
+        {
+            return 0;
+        }
+
+        if (_cachedTableHandle == threadHandle && _cachedTable != 0)
+        {
+            return _cachedTable;
+        }
+
+        var table = TlsTables.GetOrAdd(
+            threadHandle,
+            static _ => (nint)NativeMemory.AllocZeroed((nuint)TlsSlotCount, sizeof(ulong)));
+        _cachedTableHandle = threadHandle;
+        _cachedTable = table;
+        return table;
+    }
+
+    /// <summary>pthread_getspecific, for the managed (slow) path and for keys the table cannot hold.</summary>
+    public static ulong GetSpecific(ulong threadHandle, int key)
+    {
+        if (threadHandle == 0 || key < 0)
+        {
+            return 0;
+        }
+
+        if ((uint)key < TlsSlotCount)
+        {
+            return TlsTables.TryGetValue(threadHandle, out var table) && table != 0
+                ? ((ulong*)table)[key]
+                : 0;
+        }
+
+        return TlsOverflow.TryGetValue(threadHandle, out var overflow) && overflow.TryGetValue(key, out var value)
+            ? value
+            : 0;
+    }
+
+    /// <summary>pthread_setspecific. Writes the same storage the native stubs read.</summary>
+    public static void SetSpecific(ulong threadHandle, int key, ulong value)
+    {
+        if (threadHandle == 0 || key < 0)
+        {
+            return;
+        }
+
+        if ((uint)key < TlsSlotCount)
+        {
+            ((ulong*)GetOrCreateTable(threadHandle))[key] = value;
+            return;
+        }
+
+        TlsOverflow
+            .GetOrAdd(threadHandle, static _ => new ConcurrentDictionary<int, ulong>())[key] = value;
+    }
+
+    /// <summary>
+    /// Compare-and-set used by the destructor loop: clears <paramref name="key"/>
+    /// only when it still holds <paramref name="expected"/>, so a destructor that
+    /// re-sets the key is handled on the next iteration instead of being lost.
+    /// </summary>
+    public static bool TryClearSpecific(ulong threadHandle, int key, ulong expected)
+    {
+        if (threadHandle == 0 || key < 0)
+        {
+            return false;
+        }
+
+        if ((uint)key < TlsSlotCount)
+        {
+            if (!TlsTables.TryGetValue(threadHandle, out var table) || table == 0)
+            {
+                return false;
+            }
+
+            return Interlocked.CompareExchange(ref ((ulong*)table)[key], 0, expected) == expected;
+        }
+
+        return TlsOverflow.TryGetValue(threadHandle, out var overflow) &&
+            overflow.TryUpdate(key, 0, expected);
+    }
+
+    /// <summary>pthread_key_delete: the key reads back as unset on every thread.</summary>
+    public static void ClearKeyEverywhere(int key)
+    {
+        if (key < 0)
+        {
+            return;
+        }
+
+        if ((uint)key < TlsSlotCount)
+        {
+            foreach (var table in TlsTables.Values)
+            {
+                if (table != 0)
+                {
+                    ((ulong*)table)[key] = 0;
+                }
+            }
+
+            return;
+        }
+
+        foreach (var overflow in TlsOverflow.Values)
+        {
+            overflow.TryRemove(key, out _);
+        }
+    }
+
+    /// <summary>Every non-zero (key, value) pair a thread currently holds, for the destructor loop.</summary>
+    public static List<KeyValuePair<int, ulong>> SnapshotThreadValues(ulong threadHandle)
+    {
+        var result = new List<KeyValuePair<int, ulong>>();
+        if (threadHandle == 0)
+        {
+            return result;
+        }
+
+        if (TlsTables.TryGetValue(threadHandle, out var table) && table != 0)
+        {
+            var values = (ulong*)table;
+            for (var key = 0; key < TlsSlotCount; key++)
+            {
+                if (values[key] != 0)
+                {
+                    result.Add(new KeyValuePair<int, ulong>(key, values[key]));
+                }
+            }
+        }
+
+        if (TlsOverflow.TryGetValue(threadHandle, out var overflow))
+        {
+            foreach (var entry in overflow)
+            {
+                if (entry.Value != 0)
+                {
+                    result.Add(entry);
+                }
+            }
+        }
+
+        return result;
+    }
+
+    /// <summary>True when the thread has ever stored a pthread-specific value.</summary>
+    public static bool HasThreadValues(ulong threadHandle) =>
+        threadHandle != 0 &&
+        (TlsTables.ContainsKey(threadHandle) || TlsOverflow.ContainsKey(threadHandle));
+
+    /// <summary>
+    /// Drops a thread's pthread-specific storage on thread exit. Called from
+    /// the exiting thread after its destructors have run, so no stub can still
+    /// be reading the table; the calling thread's block is disarmed first.
+    /// </summary>
+    public static void ReleaseThread(ulong threadHandle)
+    {
+        if (threadHandle == 0)
+        {
+            return;
+        }
+
+        var block = _block;
+        if (block != 0 && *(ulong*)(block + BlockSelfHandleOffset) == threadHandle)
+        {
+            *(ulong*)(block + BlockSelfHandleOffset) = 0;
+            *(nint*)(block + BlockTlsValuesOffset) = 0;
+        }
+        else if (block != 0 && _hostThreadHandle == threadHandle)
+        {
+            *(nint*)(block + BlockTlsValuesOffset) = 0;
+        }
+
+        if (_cachedTableHandle == threadHandle)
+        {
+            _cachedTableHandle = 0;
+            _cachedTable = 0;
+        }
+
+        TlsOverflow.TryRemove(threadHandle, out _);
+        if (TlsTables.TryRemove(threadHandle, out var table) && table != 0)
+        {
+            NativeMemory.Free((void*)table);
+        }
+    }
+}

src/SharpEmu.HLE/GuestMemory/GuestSpaceOwner.cs

@@ -67,6 +67,14 @@ public sealed class GuestSpaceOwner : IDisposable
     // Reads through a view that covers the whole range without any lock; false otherwise.
     public bool TryReadSingleView(ulong address, Span<byte> data) => _views.TryReadSingleView(address, data);
 
+    public object AliasSnapshot => _views.AliasSnapshot;
+
+    public bool TryEnterAliasAccess() => _views.TryEnterAliasAccess();
+
+    public void ExitAliasAccess() => _views.ExitAliasAccess();
+
+    public bool TryResolveAlias(ulong address, ulong size, out ulong alias) => _views.TryResolveAlias(address, size, out alias);
+
     public bool TryCopyBacking(ulong destination, ulong source, ulong size) => _views.TryCopyBacking(destination, source, size);
 
     public bool IsBacked(ulong address, ulong size) => _views.Contains(address, size);

src/SharpEmu.HLE/GuestMemory/SharedBackingViews.cs

@@ -623,7 +623,40 @@ public sealed unsafe class SharedBackingViews : IDisposable
         }
 
         Interlocked.Increment(ref _activeAccesses);
-        var snapshot = Volatile.Read(ref _snapshot);
+        if (TryFindAlias(Volatile.Read(ref _snapshot), address, size, out target))
+        {
+            return true;
+        }
+
+        Interlocked.Decrement(ref _activeAccesses);
+        return false;
+    }
+
+    public object AliasSnapshot => Volatile.Read(ref _snapshot);
+
+    public bool TryEnterAliasAccess()
+    {
+        Interlocked.Increment(ref _activeAccesses);
+        if (!Volatile.Read(ref _disposed) && _backing != null)
+        {
+            return true;
+        }
+
+        Interlocked.Decrement(ref _activeAccesses);
+        return false;
+    }
+
+    public void ExitAliasAccess() => Interlocked.Decrement(ref _activeAccesses);
+
+    public bool TryResolveAlias(ulong address, ulong size, out ulong target)
+    {
+        target = 0;
+        return size != 0 && ulong.MaxValue - address >= size && TryFindAlias(Volatile.Read(ref _snapshot), address, size, out target);
+    }
+
+    private bool TryFindAlias(ViewRecord[] snapshot, ulong address, ulong size, out ulong target)
+    {
+        target = 0;
         var low = 0;
         var high = snapshot.Length - 1;
         var found = -1;
@@ -655,7 +688,6 @@ public sealed unsafe class SharedBackingViews : IDisposable
             }
         }
 
-        Interlocked.Decrement(ref _activeAccesses);
         return false;
     }
 

src/SharpEmu.HLE/GuestThreadExecution.cs

@@ -50,6 +50,21 @@ public interface IGuestThreadScheduler
     /// </summary>
     void RegisterGuestThreadContext(ulong threadHandle, CpuContext context);
 
+    /// <summary>
+    /// Returns the exact mapped guest stack owned by a scheduler thread. The
+    /// default keeps alternate/test schedulers source-compatible when they do
+    /// not own guest stack mappings.
+    /// </summary>
+    bool TryGetGuestThreadStackBounds(
+        ulong threadHandle,
+        out ulong stackBase,
+        out ulong stackSize)
+    {
+        stackBase = 0;
+        stackSize = 0;
+        return false;
+    }
+
     bool TryStartThread(CpuContext creatorContext, GuestThreadStartRequest request, out string? error);
 
     bool TryJoinThread(
@@ -279,6 +294,7 @@ public static class GuestThreadExecution
         GpuMemory.GpuMemoryAccessProfile.InitializeCurrentThread();
         var previous = _currentGuestThreadHandle;
         _currentGuestThreadHandle = threadHandle;
+        GuestFastPath.BindGuestThread(threadHandle);
         _pendingBlockReason = null;
         _pendingBlockContinuationValid = false;
         _pendingBlockContinuation = default;
@@ -300,6 +316,7 @@ public static class GuestThreadExecution
     public static void RestoreGuestThread(ulong previousThreadHandle)
     {
         _currentGuestThreadHandle = previousThreadHandle;
+        GuestFastPath.BindGuestThread(previousThreadHandle);
         _pendingBlockReason = null;
         _pendingBlockContinuationValid = false;
         _pendingBlockContinuation = default;

src/SharpEmu.HLE/HleDataSymbols.cs

@@ -21,6 +21,7 @@ public static class HleDataSymbols
     private static readonly nint _stackChkGuardAddress = Allocate(sizeof(ulong) * 2);
     private static readonly nint _progNameBufferAddress = Allocate(ProgNameMaxBytes + 1);
     private static readonly nint _progNamePointerAddress = Allocate(nint.Size);
+    private static readonly nint _argumentVectorAddress = Allocate(nint.Size * 2);
     private static readonly nint _libcNeedFlagAddress = Allocate(sizeof(uint));
     private static readonly nint _libcInternalNeedFlagAddress = Allocate(sizeof(uint));
 
@@ -55,6 +56,12 @@ public static class HleDataSymbols
         yield return LibcInternalNeedFlagNid;
     }
 
+    public static int ProcessArgumentCount =>
+        _progNameBufferAddress != 0 && _argumentVectorAddress != 0 ? 1 : 0;
+
+    public static ulong ProcessArgumentVectorAddress =>
+        unchecked((ulong)_argumentVectorAddress);
+
     public static void ConfigureProcessImageName(string? processImageName)
     {
         var effectiveName = string.IsNullOrWhiteSpace(processImageName)
@@ -65,7 +72,9 @@ public static class HleDataSymbols
 
         lock (_gate)
         {
-            if (_progNameBufferAddress == 0 || _progNamePointerAddress == 0)
+            if (_progNameBufferAddress == 0 ||
+                _progNamePointerAddress == 0 ||
+                _argumentVectorAddress == 0)
             {
                 return;
             }
@@ -77,6 +86,8 @@ public static class HleDataSymbols
 
             Marshal.Copy(encodedName, 0, _progNameBufferAddress, byteCount);
             WritePointer(_progNamePointerAddress, _progNameBufferAddress);
+            WritePointer(_argumentVectorAddress, _progNameBufferAddress);
+            WritePointer(IntPtr.Add(_argumentVectorAddress, nint.Size), 0);
         }
     }
 

src/SharpEmu.HLE/Host/HostLaneReservation.cs

@@ -0,0 +1,121 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host;
+
+public static unsafe class HostLaneReservation
+{
+    private const int RelationProcessorCore = 0;
+    private const int ThreadPriorityHighest = 2;
+
+    public static readonly ulong ReservedMask;
+    public static readonly ulong GuestMask;
+
+    static HostLaneReservation()
+    {
+        if (!OperatingSystem.IsWindows() || Environment.GetEnvironmentVariable("SHARPEMU_RENDER_CORE") == "0")
+        {
+            return;
+        }
+
+        var lanes = Environment.ProcessorCount;
+        if (lanes < 8 || lanes > 64)
+        {
+            return;
+        }
+
+        var core = SelectCore();
+        var all = lanes == 64 ? ulong.MaxValue : (1UL << lanes) - 1;
+        if (core == 0 || (core & ~all) != 0 || (all & ~core) == 0)
+        {
+            return;
+        }
+
+        ReservedMask = core;
+        GuestMask = all & ~core;
+    }
+
+    public static bool Active => ReservedMask != 0;
+
+    public static void ApplyToRenderThread()
+    {
+        if (!Active)
+        {
+            return;
+        }
+
+        var thread = GetCurrentThread();
+        _ = SetThreadAffinityMask(thread, (nuint)ReservedMask);
+        _ = SetThreadPriority(thread, ThreadPriorityHighest);
+        Console.Error.WriteLine($"[LOADER][INFO] Render thread reserved host lanes 0x{ReservedMask:X}; guest threads use 0x{GuestMask:X}.");
+    }
+
+    public static void ApplyToGuestThread()
+    {
+        if (Active)
+        {
+            _ = SetThreadAffinityMask(GetCurrentThread(), (nuint)GuestMask);
+        }
+    }
+
+    private static ulong SelectCore()
+    {
+        uint length = 0;
+        _ = GetLogicalProcessorInformationEx(RelationProcessorCore, null, &length);
+        if (length == 0)
+        {
+            return 0;
+        }
+
+        var buffer = new byte[length];
+        fixed (byte* start = buffer)
+        {
+            if (!GetLogicalProcessorInformationEx(RelationProcessorCore, start, &length))
+            {
+                return 0;
+            }
+
+            ulong selected = 0;
+            var selectedClass = -1;
+            for (uint offset = 0; offset + 48 <= length;)
+            {
+                var entry = start + offset;
+                var size = *(uint*)(entry + 4);
+                if (size == 0)
+                {
+                    break;
+                }
+
+                var efficiencyClass = entry[9];
+                var groupCount = *(ushort*)(entry + 30);
+                var mask = *(ulong*)(entry + 32);
+                var group = *(ushort*)(entry + 40);
+                if (*(int*)entry == RelationProcessorCore && groupCount == 1 && group == 0 && mask != 0 && efficiencyClass >= selectedClass)
+                {
+                    selected = mask;
+                    selectedClass = efficiencyClass;
+                }
+
+                offset += size;
+            }
+
+            return selected;
+        }
+    }
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool GetLogicalProcessorInformationEx(int relationshipType, byte* buffer, uint* returnedLength);
+
+    [DllImport("kernel32.dll")]
+    private static extern nint GetCurrentThread();
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern nuint SetThreadAffinityMask(nint thread, nuint mask);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool SetThreadPriority(nint thread, int priority);
+}

src/SharpEmu.HLE/Host/Sdl/SdlHostAudio.cs

@@ -212,7 +212,15 @@ internal sealed unsafe class SdlHostAudio : IHostPcmAudioOutput
                         break;
                     }
 
-                    Thread.Sleep(1);
+                    // Sleep until the device should have drained to the cap rather than polling every
+                    // millisecond: this wait paces every audio grain, and 1 ms polls cost the audio
+                    // thread several wakeups per grain.
+                    var bytesPerMillisecond = _bytesPerFrame * (double)_sampleRate / 1_000;
+                    var drainMilliseconds = bytesPerMillisecond > 0
+                        ? (queued - _maximumQueuedBytes) / bytesPerMillisecond
+                        : 1;
+                    var remainingMilliseconds = (deadline - Stopwatch.GetTimestamp()) * 1_000.0 / Stopwatch.Frequency;
+                    Thread.Sleep((int)Math.Clamp(Math.Ceiling(Math.Min(drainMilliseconds, remainingMilliseconds)), 1, MaximumWaitMilliseconds));
                 }
 
                 RecordSubmission(queued, blockStart, dropped: overrun, bytes: pcm.Length);

src/SharpEmu.HLE/IGuestBackedSpace.cs

@@ -24,4 +24,18 @@ public interface IGuestBackedSpace
     // Copies through the backing alias only: no protection change, no store notification.
     bool TryWriteBacking(ulong address, ReadOnlySpan<byte> data);
     bool TryReadBacking(ulong address, Span<byte> data);
+
+    object? BackingAliasSnapshot => null;
+
+    bool TryEnterBackingAliasAccess() => false;
+
+    void ExitBackingAliasAccess()
+    {
+    }
+
+    bool TryResolveBackingAlias(ulong address, ulong size, out ulong alias)
+    {
+        alias = 0;
+        return false;
+    }
 }

src/SharpEmu.Libs/Agc/AgcExports.PacketPatching.cs

@@ -10,6 +10,36 @@ public static partial class AgcExports
 {
     // This partial patches previously constructed AGC command packets.
 
+    // Uncatalogued name; the NID and import library identify this AGC export.
+    // Observed ABI: packet, cache policy, next-buffer address, length in dwords.
+    // The caller patches the previous DcbJump after allocating its continuation.
+    #pragma warning disable SHEM006
+    [SysAbiExport(Nid = "Ikfdt-rIqCE", ExportName = "sceAgcUnknownIkfdt",
+        Target = Generation.Gen5, LibraryName = "libSceAgc")]
+    public static int UnknownIkfdt(CpuContext ctx)
+    {
+        var packet = ctx[CpuRegister.Rdi];
+        var cachePolicy = (uint)ctx[CpuRegister.Rsi];
+        var target = ctx[CpuRegister.Rdx];
+        var dwords = (uint)ctx[CpuRegister.Rcx];
+        if (cachePolicy > 3 || dwords > 0xFFFFFu ||
+            !TryGetPacketIdentity(ctx, packet, out var opcode, out _) ||
+            opcode != ItIndirectBuffer ||
+            !TryReadUInt32(ctx, packet, out var header) ||
+            ((header >> 16) & 0x3FFFu) != 2 ||
+            !TryReadUInt32(ctx, packet + 12, out var control))
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+
+        // Preserve call/chain mode and every other control bit.
+        control = (control & ~0x300F_FFFFu) | (cachePolicy << 28) | dwords;
+        return TryWriteUInt32(ctx, packet + 4, (uint)target) &&
+               TryWriteUInt32(ctx, packet + 8, (uint)(target >> 32) & 0xFFFFu) &&
+               TryWriteUInt32(ctx, packet + 12, control)
+            ? SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK)
+            : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+    #pragma warning restore SHEM006
+
     [SysAbiExport(
         Nid = "vcmNN+AAXnY",
         ExportName = "sceAgcSetCxRegIndirectPatchSetAddress",

src/SharpEmu.Libs/Agc/AgcExports.ShaderState.cs

@@ -1,10 +1,12 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Buffers;
 using System.Buffers.Binary;
 using System.Collections.Concurrent;
 using System.Runtime.CompilerServices;
 using SharpEmu.HLE;
+using SharpEmu.Libs.Gpu.GpuCommands.Registers;
 using SharpEmu.Libs.Kernel;
 using SharpEmu.ShaderCompiler;
 
@@ -352,7 +354,17 @@ public static partial class AgcExports
         ExportName = "sceAgcFuseShaderHalves",
         Target = Generation.Gen5,
         LibraryName = "libSceAgc")]
-    public static int FuseShaderHalves(CpuContext ctx)
+    public static int FuseShaderHalves(CpuContext ctx) => FuseShaderHalvesCore(ctx, legacy: false);
+    #pragma warning restore SHEM004
+
+    [SysAbiExport(
+        Nid = "nApJjpKNBl4",
+        ExportName = "sceAgcFuseShaderHalves",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAgc")]
+    public static int FuseShaderHalvesLegacy(CpuContext ctx) => FuseShaderHalvesCore(ctx, legacy: true);
+
+    private static int FuseShaderHalvesCore(CpuContext ctx, bool legacy)
     {
         var fusedAddress = ctx[CpuRegister.Rdi];
         var frontAddress = ctx[CpuRegister.Rsi];
@@ -404,6 +416,12 @@ public static partial class AgcExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
+        ulong userDataAddress = 0;
+        if (legacy && !TryReadUInt64(ctx, frontAddress + ShaderUserDataOffset, out userDataAddress))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
         Span<byte> header = stackalloc byte[ShaderStructBytes];
         if (!ctx.Memory.TryRead(backAddress, header) ||
             !ctx.Memory.TryWrite(fusedAddress, header))
@@ -425,13 +443,13 @@ public static partial class AgcExports
         }
 
         if (!TryWriteByte(ctx, fusedAddress + ShaderTypeOffset, isGeometryPair ? GsShaderType : HsShaderType) ||
-            !ctx.TryWriteUInt64(fusedAddress + ShaderUserDataOffset, 0) ||
+            !ctx.TryWriteUInt64(fusedAddress + ShaderUserDataOffset, userDataAddress) ||
             !ctx.TryWriteUInt64(fusedAddress + ShaderShRegistersOffset, fusedRegistersAddress))
         {
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
-        if (isGeometryPair)
+        if (isGeometryPair || legacy)
         {
             if (!TryReadUInt64(ctx, frontAddress + ShaderShRegistersOffset, out var frontRegistersAddress) ||
                 !TryReadByte(ctx, frontAddress + ShaderNumShRegistersOffset, out var frontRegisterCount))
@@ -439,17 +457,19 @@ public static partial class AgcExports
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
 
-            // Both halves share one user-data block, so the fused USER_SGPR count is
-            // the larger of the two.
-            if (!MergeFusedUserScalarCount(ctx, frontRegistersAddress, frontRegisterCount, fusedRegistersAddress, registerCount))
+            var merged = legacy
+                ? MergeLegacyFusedShaderRegisters(ctx, frontRegistersAddress, frontRegisterCount, fusedRegistersAddress, registerCount, isGeometryPair)
+                : MergeFusedUserScalarCount(ctx, frontRegistersAddress, frontRegisterCount, fusedRegistersAddress, registerCount);
+            if (!merged)
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
 
+            var checksumOffset = isGeometryPair ? SpiShaderPgmChksumGs : ShaderRegisterOffset.SpiShaderPgmChksumHs;
             for (var occurrence = 0; occurrence < 2; occurrence++)
             {
-                if (!TryFindShaderRegister(ctx, fusedRegistersAddress, registerCount, SpiShaderPgmChksumGs, occurrence, out var fusedEntry) ||
-                    !TryFindShaderRegister(ctx, frontRegistersAddress, frontRegisterCount, SpiShaderPgmChksumGs, occurrence, out var frontEntry))
+                if (!TryFindShaderRegister(ctx, fusedRegistersAddress, registerCount, checksumOffset, occurrence, out var fusedEntry) ||
+                    !TryFindShaderRegister(ctx, frontRegistersAddress, frontRegisterCount, checksumOffset, occurrence, out var frontEntry))
                 {
                     continue;
                 }
@@ -487,7 +507,6 @@ public static partial class AgcExports
         ctx[CpuRegister.Rax] = 0;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
-    #pragma warning restore SHEM004
 
     [SysAbiExport(
         Nid = "D9sr1xGUriE",
@@ -587,9 +606,15 @@ public static partial class AgcExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
+        Span<byte> registers = stackalloc byte[InterpolantRegisterCount * InterpolantRegisterPairSize];
+        for (var i = 0; i < InterpolantRegisterCount; i++)
+        {
+            SetInterpolantRegister(registers, i, (uint)i);
+        }
+
         if (inputSemanticsCount == 0)
         {
-            if (!TryWriteIdentityInterpolantRegisters(ctx, registersAddress, 0))
+            if (!ctx.Memory.TryWrite(registersAddress, registers))
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
@@ -617,82 +642,74 @@ public static partial class AgcExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
-        for (uint inputIndex = 0; inputIndex < inputSemanticsCount; inputIndex++)
+        Span<byte> inputWords = stackalloc byte[(int)inputSemanticsCount * sizeof(uint)];
+        var outputBytes = outputSemanticsCount * sizeof(uint);
+        var rentedOutputWords = outputBytes > 1024 ? ArrayPool<byte>.Shared.Rent(outputBytes) : null;
+        try
         {
-            if (!TryReadUInt32(
-                    ctx,
-                    inputSemanticsAddress + (inputIndex * sizeof(uint)),
-                    out var source))
+            var outputWords = rentedOutputWords is null ? stackalloc byte[outputBytes] : rentedOutputWords.AsSpan(0, outputBytes);
+            if (!ctx.Memory.TryRead(inputSemanticsAddress, inputWords) ||
+                (outputBytes != 0 && !ctx.Memory.TryRead(outputSemanticsAddress, outputWords)))
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
 
-            var hasMask = false;
-            var mask = 0u;
-            for (uint outputIndex = 0; outputIndex < outputSemanticsCount; outputIndex++)
+            for (var inputIndex = 0; inputIndex < (int)inputSemanticsCount; inputIndex++)
             {
-                if (!TryReadUInt32(
-                        ctx,
-                        outputSemanticsAddress + (outputIndex * sizeof(uint)),
-                        out var candidate))
-                {
-                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-                }
+                var source = BinaryPrimitives.ReadUInt32LittleEndian(inputWords[(inputIndex * sizeof(uint))..]);
+                var hasMask = TryFindOutputSemantic(outputWords, source, out var mask);
 
-                if ((byte)candidate == (byte)source)
+                var mode = (source >> 20) & 0x3u;
+                uint flags;
+                if (mode == 0)
                 {
-                    hasMask = true;
-                    mask = candidate;
-                    break;
-                }
-            }
-
-            var mode = (source >> 20) & 0x3u;
-            uint flags;
-            if (mode == 0)
-            {
-                flags = (((source >> 24) & 0x1u) | (hasMask ? 0u : 1u)) << 5;
-                flags = ApplyInterpolantTwoBitField(flags, source >> 28, 8);
-            }
-            else
-            {
-                flags = ((source << 4) & 0x0300_0000u) + 0x0008_0000u;
-                if (mode == 2)
-                {
-                    flags &= 0xFFEF_FFDFu;
-                    flags |= hasMask ? ((~(mask & source) >> 16) & 0x20u) : 0x20u;
-                    flags = ApplyInterpolantTwoBitField(flags, source >> 30, 8);
-                    flags = ApplyInterpolantTwoBitField(flags, source >> 30, 21);
+                    flags = (((source >> 24) & 0x1u) | (hasMask ? 0u : 1u)) << 5;
+                    flags = ApplyInterpolantTwoBitField(flags, source >> 28, 8);
                 }
                 else
                 {
-                    if (hasMask)
+                    flags = ((source << 4) & 0x0300_0000u) + 0x0008_0000u;
+                    if (mode == 2)
                     {
-                        var masked = mask & source;
-                        flags = (flags & 0xFFFF_FFDFu) | ((masked >> 15) & 0x20u);
-                        flags ^= 0x20u;
-                        flags = (flags & 0xFFEF_FFFFu) | ((~masked >> 1) & 0x0010_0000u);
+                        flags &= 0xFFEF_FFDFu;
+                        flags |= hasMask ? ((~(mask & source) >> 16) & 0x20u) : 0x20u;
+                        flags = ApplyInterpolantTwoBitField(flags, source >> 30, 8);
+                        flags = ApplyInterpolantTwoBitField(flags, source >> 30, 21);
                     }
                     else
                     {
-                        flags |= 0x0010_0020u;
+                        if (hasMask)
+                        {
+                            var masked = mask & source;
+                            flags = (flags & 0xFFFF_FFDFu) | ((masked >> 15) & 0x20u);
+                            flags ^= 0x20u;
+                            flags = (flags & 0xFFEF_FFFFu) | ((~masked >> 1) & 0x0010_0000u);
+                        }
+                        else
+                        {
+                            flags |= 0x0010_0020u;
+                        }
+
+                        flags = ApplyInterpolantTwoBitField(flags, source >> 28, 8);
+                        flags = ApplyInterpolantTwoBitField(flags, source >> 30, 21);
                     }
-
-                    flags = ApplyInterpolantTwoBitField(flags, source >> 28, 8);
-                    flags = ApplyInterpolantTwoBitField(flags, source >> 30, 21);
                 }
-            }
 
-            flags = hasMask
-                ? ApplyInterpolantFinalMask(flags, source, mask)
-                : flags & 0xFFFF_FBE0u;
-            if (!TryWriteInterpolantRegister(ctx, registersAddress, inputIndex, flags))
+                flags = hasMask
+                    ? ApplyInterpolantFinalMask(flags, source, mask)
+                    : flags & 0xFFFF_FBE0u;
+                SetInterpolantRegister(registers, inputIndex, flags);
+            }
+        }
+        finally
+        {
+            if (rentedOutputWords is not null)
             {
-                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                ArrayPool<byte>.Shared.Return(rentedOutputWords);
             }
         }
 
-        if (!TryWriteIdentityInterpolantRegisters(ctx, registersAddress, inputSemanticsCount))
+        if (!ctx.Memory.TryWrite(registersAddress, registers))
         {
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
@@ -808,9 +825,17 @@ public static partial class AgcExports
             }
         }
 
+        // The 32 (register, value) pairs are built here and written with one guest write; titles
+        // call this per draw, and 64 separate 4-byte writes each paid the guest write path.
+        Span<byte> registers = stackalloc byte[InterpolantRegisterCount * InterpolantRegisterPairSize];
+        for (var i = 0; i < InterpolantRegisterCount; i++)
+        {
+            SetInterpolantRegister(registers, i, (uint)i);
+        }
+
         if (inputSemanticsCount == 0 || inputSemanticsAddress == 0)
         {
-            if (!TryWriteIdentityInterpolantRegisters(ctx, registersAddress, 0))
+            if (!ctx.Memory.TryWrite(registersAddress, registers))
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
@@ -834,53 +859,48 @@ public static partial class AgcExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
-        inputSemanticsCount = Math.Min(inputSemanticsCount, 32u);
-        for (uint psIndex = 0; psIndex < inputSemanticsCount; psIndex++)
+        inputSemanticsCount = Math.Min(inputSemanticsCount, (uint)InterpolantRegisterCount);
+        Span<byte> psWords = stackalloc byte[(int)inputSemanticsCount * sizeof(uint)];
+        if (!ctx.Memory.TryRead(inputSemanticsAddress, psWords))
         {
-            if (!TryReadUInt32(
-                    ctx,
-                    inputSemanticsAddress + (psIndex * sizeof(uint)),
-                    out var psWord))
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        var gsBytes = (outputSemanticsAddress != 0 ? outputSemanticsCount : 0) * sizeof(uint);
+        var rentedGsWords = gsBytes > 1024 ? ArrayPool<byte>.Shared.Rent(gsBytes) : null;
+        try
+        {
+            var gsWords = rentedGsWords is null ? stackalloc byte[gsBytes] : rentedGsWords.AsSpan(0, gsBytes);
+            if (gsBytes != 0 && !ctx.Memory.TryRead(outputSemanticsAddress, gsWords))
             {
                 return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
 
-            var psSemantic = psWord & 0xFFu;
-            uint? gsWord = null;
-            if (outputSemanticsAddress != 0)
+            for (var psIndex = 0; psIndex < (int)inputSemanticsCount; psIndex++)
             {
-                for (uint gsIndex = 0; gsIndex < outputSemanticsCount; gsIndex++)
-                {
-                    if (!TryReadUInt32(
-                            ctx,
-                            outputSemanticsAddress + (gsIndex * sizeof(uint)),
-                            out var candidate))
-                    {
-                        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-                    }
+                var psWord = BinaryPrimitives.ReadUInt32LittleEndian(psWords[(psIndex * sizeof(uint))..]);
+                uint? gsWord = TryFindOutputSemantic(gsWords, psWord, out var candidate) ? candidate : null;
 
-                    if ((candidate & 0xFFu) == psSemantic)
-                    {
-                        gsWord = candidate;
-                        break;
-                    }
-                }
+                var value = (psWord & 0x0030_0000u) != 0
+                    ? CreateInterpolantF16Value(psWord, gsWord)
+                    : CreateInterpolantNonF16Value(psWord, gsWord.HasValue);
+                SetInterpolantRegister(
+                    registers,
+                    psIndex,
+                    gsWord is { } matched
+                        ? CreateInterpolantMappingValue(value, psWord, matched)
+                        : CreateInterpolantDefaultParamValue(value, psWord));
             }
-
-            var value = (psWord & 0x0030_0000u) != 0
-                ? CreateInterpolantF16Value(psWord, gsWord)
-                : CreateInterpolantNonF16Value(psWord, gsWord.HasValue);
-            value = gsWord is { } matched
-                ? CreateInterpolantMappingValue(value, psWord, matched)
-                : CreateInterpolantDefaultParamValue(value, psWord);
-
-            if (!TryWriteInterpolantRegister(ctx, registersAddress, psIndex, value))
+        }
+        finally
+        {
+            if (rentedGsWords is not null)
             {
-                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                ArrayPool<byte>.Shared.Return(rentedGsWords);
             }
         }
 
-        if (!TryWriteIdentityInterpolantRegisters(ctx, registersAddress, inputSemanticsCount))
+        if (!ctx.Memory.TryWrite(registersAddress, registers))
         {
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
@@ -959,31 +979,31 @@ public static partial class AgcExports
         return value;
     }
 
-    private static bool TryWriteInterpolantRegister(
-        CpuContext ctx,
-        ulong registersAddress,
-        uint index,
-        uint value)
-    {
-        var destination = registersAddress + (index * 8);
-        return TryWriteUInt32(ctx, destination, SpiPsInputCntl0 + index) &&
-               TryWriteUInt32(ctx, destination + sizeof(uint), value);
-    }
+    private const int InterpolantRegisterCount = 32;
+    private const int InterpolantRegisterPairSize = 2 * sizeof(uint);
 
-    private static bool TryWriteIdentityInterpolantRegisters(
-        CpuContext ctx,
-        ulong registersAddress,
-        uint firstIndex)
+    // The output (GS/VS export) semantic word whose semantic id (low byte) matches an input's.
+    private static bool TryFindOutputSemantic(ReadOnlySpan<byte> outputWords, uint inputWord, out uint outputWord)
     {
-        for (uint i = firstIndex; i < 32u; i++)
+        for (var offset = 0; offset + sizeof(uint) <= outputWords.Length; offset += sizeof(uint))
         {
-            if (!TryWriteInterpolantRegister(ctx, registersAddress, i, i))
+            outputWord = BinaryPrimitives.ReadUInt32LittleEndian(outputWords[offset..]);
+            if ((byte)outputWord == (byte)inputWord)
             {
-                return false;
+                return true;
             }
         }
 
-        return true;
+        outputWord = 0;
+        return false;
+    }
+
+    // Slot i is the pair (SPI_PS_INPUT_CNTL_0 + i, value).
+    private static void SetInterpolantRegister(Span<byte> registers, int index, uint value)
+    {
+        var pair = registers[(index * InterpolantRegisterPairSize)..];
+        BinaryPrimitives.WriteUInt32LittleEndian(pair, SpiPsInputCntl0 + (uint)index);
+        BinaryPrimitives.WriteUInt32LittleEndian(pair[sizeof(uint)..], value);
     }
 
     private static OrbisGen2Result PatchShaderProgramRegisters(CpuContext context, ulong headerAddress, ulong codeAddress)
@@ -1261,6 +1281,46 @@ public static partial class AgcExports
         return merged == fused || TryWriteUInt32(ctx, fusedEntry + sizeof(uint), merged);
     }
 
+    private static bool MergeLegacyFusedShaderRegisters(
+        CpuContext ctx, ulong frontRegisters, int frontCount, ulong fusedRegisters, int fusedCount, bool geometry)
+    {
+        var rsrc1Offset = geometry ? SpiShaderPgmRsrc1Gs : SpiShaderPgmRsrc1Hs;
+        var rsrc2Offset = geometry ? SpiShaderPgmRsrc2Gs : ShaderRegisterOffset.SpiShaderPgmRsrc2Hs;
+        if (!TryFindShaderRegister(ctx, frontRegisters, frontCount, rsrc1Offset, 0, out var frontEntry1) ||
+            !TryFindShaderRegister(ctx, frontRegisters, frontCount, rsrc2Offset, 0, out var frontEntry2) ||
+            !TryFindShaderRegister(ctx, fusedRegisters, fusedCount, rsrc1Offset, 0, out var fusedEntry1) ||
+            !TryFindShaderRegister(ctx, fusedRegisters, fusedCount, rsrc2Offset, 0, out var fusedEntry2))
+        {
+            return true;
+        }
+
+        if (!TryReadUInt32(ctx, frontEntry1 + sizeof(uint), out var front1) ||
+            !TryReadUInt32(ctx, frontEntry2 + sizeof(uint), out var front2) ||
+            !TryReadUInt32(ctx, fusedEntry1 + sizeof(uint), out var fused1) ||
+            !TryReadUInt32(ctx, fusedEntry2 + sizeof(uint), out var fused2))
+        {
+            return false;
+        }
+
+        // The older export takes maximum allocations, but user SGPRs and the
+        // ES component flag belong to the front half, not the back half.
+        fused1 = MergeMaxField(fused1, front1, 0, 0x3Fu);
+        fused1 = MergeMaxField(fused1, front1, geometry ? 29 : 28, 3u);
+        fused2 = MergeMaxField(fused2, front2, 28, 0xFu);
+        if (geometry)
+        {
+            fused2 = MergeMaxField(fused2, front2, 16, 3u);
+            fused2 = (fused2 & ~0x0004_0000u) | (front2 & 0x0004_0000u);
+        }
+
+        fused2 = (fused2 & ~0x0800_003Eu) | (front2 & 0x0800_003Eu);
+        return TryWriteUInt32(ctx, fusedEntry1 + sizeof(uint), fused1) &&
+               TryWriteUInt32(ctx, fusedEntry2 + sizeof(uint), fused2);
+
+        static uint MergeMaxField(uint destination, uint source, int shift, uint mask) =>
+            (destination & ~(mask << shift)) | (Math.Max((destination >> shift) & mask, (source >> shift) & mask) << shift);
+    }
+
     private static bool TryFindShaderRegister(
         CpuContext ctx,
         ulong registersAddress,

src/SharpEmu.Libs/AppContent/AppContentExports.cs

@@ -12,6 +12,9 @@ namespace SharpEmu.Libs.AppContent;
 public static class AppContentExports
 {
     private const ulong FallbackAvailableSpaceKb = 1024UL * 1024UL; // 1 GiB
+    private const int AppContentErrorParameter = unchecked((int)0x80D90002);
+    private const int AppContentErrorDrmNoEntitlement = unchecked((int)0x80D90007);
+    private const int MountPointSize = 16;
     private const ulong BootParamAttrOffset = 4;
     private const string Temp0MountPoint = "/temp0";
     private const uint AppParamSkuFlag = 0;
@@ -99,6 +102,29 @@ public static class AppContentExports
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
+    [SysAbiExport(
+        Nid = "VANhIWcqYak",
+        ExportName = "sceAppContentAddcontMount",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAppContent")]
+    public static int AppContentAddcontMount(CpuContext ctx)
+    {
+        var entitlementLabelAddress = ctx[CpuRegister.Rsi];
+        var mountPointAddress = ctx[CpuRegister.Rdx];
+        if (entitlementLabelAddress == 0 || mountPointAddress == 0)
+        {
+            return ctx.SetReturn(AppContentErrorParameter);
+        }
+
+        Span<byte> emptyMountPoint = stackalloc byte[MountPointSize];
+        if (!ctx.Memory.TryWrite(mountPointAddress, emptyMountPoint))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        return ctx.SetReturn(AppContentErrorDrmNoEntitlement);
+    }
+
     [SysAbiExport(
         Nid = "buYbeLOGWmA",
         ExportName = "sceAppContentTemporaryDataMount2",

src/SharpEmu.Libs/Audio/AjmExports.cs

@@ -590,7 +590,16 @@ public static class AjmExports
             return ctx.SetReturn(OrbisAjmErrorJobCreation);
         }
 
-        var status = TryGetInstance(instanceId, out _) ? 0 : Atrac9DecodeState.ResultInvalidParameter;
+        var status = TryGetInstance(instanceId, out var instance) ? 0 : Atrac9DecodeState.ResultInvalidParameter;
+        Span<byte> gapless = stackalloc byte[AjmSidebandGaplessDecodeBytes];
+        if (status == 0 && gaplessAddress != 0 && ctx.Memory.TryRead(gaplessAddress, gapless))
+        {
+            instance!.Atrac9?.SetGapless(
+                BinaryPrimitives.ReadUInt32LittleEndian(gapless),
+                BinaryPrimitives.ReadUInt16LittleEndian(gapless[4..]),
+                reset != 0);
+        }
+
         WriteBasicResult(ctx, resultAddress, status);
         Trace(
             $"batch_job_set_gapless_decode instance=0x{instanceId:X8} " +
@@ -1163,6 +1172,10 @@ public static class AjmExports
 
         if ((flags & AjmJobSidebandFlagGaplessDecode) != 0 && (ulong)(offset + AjmSidebandGaplessDecodeBytes) <= size)
         {
+            var gapless = instance?.Atrac9?.Gapless ?? default;
+            BinaryPrimitives.WriteUInt32LittleEndian(sideband[offset..], gapless.TotalSamples);
+            BinaryPrimitives.WriteUInt16LittleEndian(sideband[(offset + 4)..], gapless.SkipSamples);
+            BinaryPrimitives.WriteUInt16LittleEndian(sideband[(offset + 6)..], gapless.SkippedSamples);
             offset += AjmSidebandGaplessDecodeBytes;
         }
 
@@ -1318,8 +1331,12 @@ public static class AjmExports
                TryWriteUInt64(ctx, infoAddress + AjmBatchInfoOffsetField, offset + jobSize);
     }
 
-    // AjmBatchError: int error_code; const void* job_addr; uint32_t cmd_offset; const void* job_ra;
-    private const int AjmBatchErrorBytes = 24;
+    // SceAjmBatchError { int iErrorCode; const void *pJobAddress;
+    // unsigned int uiCommandOffset; const void *pJobOriginRa; }. The two pointers
+    // force 8-byte alignment, so the struct is 0x20 bytes (4+4 pad, 8, 4+4 pad, 8)
+    // rather than the 24-byte naive field sum — pJobOriginRa lives at +0x18 and was
+    // left holding stale guest bytes.
+    private const int AjmBatchErrorBytes = 0x20;
 
     private static void ClearAjmBatchError(CpuContext ctx, ulong errorAddress)
     {

src/SharpEmu.Libs/Audio/Atrac9DecodeState.cs

@@ -20,6 +20,8 @@ internal readonly record struct Atrac9DecodeResult(
     ulong TotalDecodedSamples,
     uint Frames);
 
+internal readonly record struct Atrac9Gapless(uint TotalSamples, ushort SkipSamples, ushort SkippedSamples);
+
 internal sealed class Atrac9DecodeState
 {
     internal const int ResultNotInitialized = 0x00000001;
@@ -47,6 +49,33 @@ internal sealed class Atrac9DecodeState
     private int _containerHeaderLength;
     private int _compressedLength;
     private ulong _totalDecodedSamples;
+    private Atrac9Gapless _gaplessInit;
+    private Atrac9Gapless _gapless;
+
+    public Atrac9Gapless Gapless
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _gapless;
+            }
+        }
+    }
+
+    public void SetGapless(uint totalSamples, ushort skipSamples, bool reset)
+    {
+        lock (_gate)
+        {
+            _gaplessInit = new Atrac9Gapless(totalSamples, skipSamples, 0);
+            if (reset || _gapless == default)
+            {
+                _gapless = _gaplessInit;
+            }
+        }
+    }
+
+    private bool HasSampleLimit => _gaplessInit.TotalSamples is not 0 and not uint.MaxValue;
 
     public Atrac9Config? Config
     {
@@ -82,6 +111,7 @@ internal sealed class Atrac9DecodeState
                 _compressedLength = 0;
                 _totalDecodedSamples = 0;
                 _containerHeaderLength = 0;
+                _gapless = _gaplessInit;
                 Trace(
                     $"initialized config={Convert.ToHexString(normalizedConfig)} channels={config.ChannelCount} " +
                     $"rate={config.SampleRate} frame_samples={config.FrameSamples} " +
@@ -114,6 +144,7 @@ internal sealed class Atrac9DecodeState
             _compressedLength = 0;
             _totalDecodedSamples = 0;
             _containerHeaderLength = 0;
+            _gapless = _gaplessInit;
             if (_compressed is not null)
             {
                 Array.Clear(_compressed);
@@ -153,7 +184,6 @@ internal sealed class Atrac9DecodeState
             }
 
             var bytesPerSample = GetBytesPerSample(encoding);
-            var outputBytesPerSuperframe = checked(config.SuperframeSamples * channels * bytesPerSample);
             var consumed = 0;
             var written = 0;
             uint frames = 0;
@@ -162,6 +192,11 @@ internal sealed class Atrac9DecodeState
             while (_compressedLength == config.SuperframeBytes ||
                    consumed < input.Length)
             {
+                if (HasSampleLimit && _gapless.TotalSamples == 0)
+                {
+                    break;
+                }
+
                 // Titles that stream whole .at9 files hand AJM the RIFF/WAVE
                 // container rather than a pointer into its `data` chunk, so the
                 // stream has to be advanced past the header before the first
@@ -202,7 +237,15 @@ internal sealed class Atrac9DecodeState
                     break;
                 }
 
-                if (output.Length - written < outputBytesPerSuperframe)
+                var skip = Math.Min(config.SuperframeSamples, (int)_gapless.SkipSamples);
+                var samples = config.SuperframeSamples - skip;
+                if (HasSampleLimit)
+                {
+                    samples = (int)Math.Min((uint)samples, _gapless.TotalSamples);
+                }
+
+                var outputBytes = checked(samples * channels * bytesPerSample);
+                if (output.Length - written < outputBytes)
                 {
                     status |= ResultNotEnoughRoom;
                     break;
@@ -231,14 +274,19 @@ internal sealed class Atrac9DecodeState
 
                 WriteInterleaved(
                     _planarPcm,
-                    output.Slice(written, outputBytesPerSuperframe),
-                    config.SuperframeSamples,
+                    output.Slice(written, outputBytes),
+                    skip,
+                    samples,
                     channels,
                     encoding);
 
-                written += outputBytesPerSuperframe;
+                _gapless = new Atrac9Gapless(
+                    HasSampleLimit ? _gapless.TotalSamples - (uint)samples : _gapless.TotalSamples,
+                    (ushort)(_gapless.SkipSamples - skip),
+                    (ushort)Math.Min(ushort.MaxValue, _gapless.SkippedSamples + config.SuperframeSamples - samples));
+                written += outputBytes;
                 _compressedLength = 0;
-                _totalDecodedSamples += unchecked((uint)config.SuperframeSamples);
+                _totalDecodedSamples += unchecked((uint)samples);
                 frames += unchecked((uint)config.FramesPerSuperframe);
 
                 if (!multipleFrames)
@@ -353,12 +401,13 @@ internal sealed class Atrac9DecodeState
     private static void WriteInterleaved(
         short[][] source,
         Span<byte> destination,
+        int firstSample,
         int samples,
         int channels,
         Atrac9PcmEncoding encoding)
     {
         var offset = 0;
-        for (var sample = 0; sample < samples; sample++)
+        for (var sample = firstSample; sample < firstSample + samples; sample++)
         {
             for (var channel = 0; channel < channels; channel++)
             {

src/SharpEmu.Libs/Audio/AudioInExports.cs

@@ -0,0 +1,18 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Audio;
+
+public static class AudioInExports
+{
+    [SysAbiExport(
+        Nid = "BohEAQ7DlUE",
+        ExportName = "sceAudioInGetSilentState",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAudioIn")]
+    public static int GetSilentState(CpuContext ctx) =>
+        // No AudioIn ports can be opened until an input backend is implemented.
+        ctx.SetReturn(unchecked((int)0x80260101));
+}

src/SharpEmu.Libs/Audio/AudioOutExports.cs

@@ -12,8 +12,13 @@ namespace SharpEmu.Libs.Audio;
 
 public static class AudioOutExports
 {
+    // ABI: SceAudioOutOutputParam { int32_t handle; int32_t : 32; void *ptr; }.
     private const int AudioOutOutputParamSize = 16;
     private const int AudioOutMaximumOutputCount = 25;
+    // ABI: SceAudioOutPortState { u16 output; u8 channel; u8 reserved8_1[1];
+    // s16 volume; u16 rerouteCounter; u64 flag; u64 reserved64[2]; }.
+    private const int AudioOutPortStateSize = 0x20;
+    private const ushort AudioOutStateOutputConnectedPrimary = 1 << 0;
 
     internal const int AudioOutErrorInvalidPort = unchecked((int)0x80260003);
     internal const int AudioOutErrorInvalidPointer = unchecked((int)0x80260004);
@@ -229,34 +234,30 @@ public static class AudioOutExports
             return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
-        // Same rule as AudioOut2 PortGetState: never bulk-write onto the caller
-        // stack. Some titles place small locals next to the canary; a full
-        // SceAudioOutPortState write smashes it.
-        if (IsGuestStackAddress(stateAddress))
-        {
-            return ctx.SetReturn(0);
-        }
-
-        // SceAudioOutPortState: report a connected primary output at full volume
-        // so pacing/mixing code sees a live port. We do no host rerouting, so
-        // rerouteCounter and flag stay zero.
-        Span<byte> state = stackalloc byte[16];
+        // ABI: int32_t sceAudioOutGetPortState(int32_t handle,
+        // SceAudioOutPortState *state) — rsi is the only out pointer and the write
+        // is exactly sizeof(SceAudioOutPortState):
+        //   +0x00 u16 output          = STATE_OUTPUT_CONNECTED_PRIMARY
+        //   +0x02 u8  channel         = SceAudioOutStateChannel
+        //   +0x03 u8  reserved8_1[1]
+        //   +0x04 s16 volume          = -1 (invalid outside PADSPK)
+        //   +0x06 u16 rerouteCounter  = 0 (the host mixer never reroutes)
+        //   +0x08 u64 flag            = SCE_AUDIO_OUT_STATE_FLAG_NONE
+        //   +0x10 u64 reserved64[2]
+        Span<byte> state = stackalloc byte[AudioOutPortStateSize];
         state.Clear();
-        System.Buffers.Binary.BinaryPrimitives.WriteUInt16LittleEndian(state, 1);
         System.Buffers.Binary.BinaryPrimitives.WriteUInt16LittleEndian(
-            state[2..], (ushort)port.Channels);
-        state[7] = 127;
+            state, AudioOutStateOutputConnectedPrimary);
+        state[2] = (byte)Math.Clamp(port.Channels, 0, 8);
+        System.Buffers.Binary.BinaryPrimitives.WriteInt16LittleEndian(state[4..], -1);
         if (!ctx.Memory.TryWrite(stateAddress, state))
         {
-            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            return ctx.SetReturn(AudioOutErrorInvalidPointer);
         }
 
         return ctx.SetReturn(0);
     }
 
-    private static bool IsGuestStackAddress(ulong value) =>
-        value >= 0x0000_7FF0_0000_0000UL && value <= 0x0000_7FFF_FFFF_FFFFUL;
-
     [SysAbiExport(
         Nid = "w3PdaSTSwGE",
         ExportName = "sceAudioOutOutputs",

src/SharpEmu.Libs/Audio/AudioPropagationExports.cs

@@ -17,9 +17,21 @@ public static class AudioPropagationExports
 {
     private const int Ok = 0;
 
-    // QueryMemory reports the working-set size the caller must allocate before
-    // SystemCreate. rsi points at the out size/alignment; write a modest,
-    // aligned block so the caller's allocation succeeds.
+    // ABI: int32_t sceAudioPropagationSystemQueryMemory(
+    //   const SceAudioPropagationSystemOption *pOptions,
+    //   SceAudioPropagationSystemMemory *pOutMemorySize).
+    // SceAudioPropagationSystemMemory is NOT a {size, alignment} pair: it is
+    //   +0x00 SceAudioPropagationStructDescriptor desc { uint32 id; size_t size; }
+    //   +0x10 void  *pCpuMem      (the caller allocates and fills this)
+    //   +0x18 size_t sizeCpuMem
+    //   +0x20 void  *pGpuMem      (the caller allocates and fills this)
+    //   +0x28 size_t sizeGpuMem
+    // so only the two size fields belong to this call. Writing {size, alignment}
+    // at +0x00/+0x08 overwrote the descriptor the caller had already initialized.
+    private const int SystemMemoryCpuSizeOffset = 0x18;
+    private const int SystemMemoryGpuSizeOffset = 0x28;
+    private const ulong SystemMemoryCpuBytes = 0x10_0000;
+
     [SysAbiExport(
         Nid = "7xyAxrusLko",
         ExportName = "sceAudioPropagationSystemQueryMemory",
@@ -28,13 +40,15 @@ public static class AudioPropagationExports
     public static int SystemQueryMemory(CpuContext ctx)
     {
         var outAddress = ctx[CpuRegister.Rsi];
-        if (outAddress != 0)
+        if (outAddress == 0)
         {
-            // {size, alignment} — 1 MiB / 256 B covers the caller's allocation.
-            ctx.TryWriteUInt64(outAddress, 0x10_0000);
-            ctx.TryWriteUInt64(outAddress + sizeof(ulong), 0x100);
+            // SCE_AUDIO_PROPAGATION_ERROR_INVALID_POINTER.
+            return ctx.SetReturn(unchecked((int)0x8A70_0003));
         }
 
+        // No GPU (Acm) propagation path exists here, so the GPU working set is 0.
+        ctx.TryWriteUInt64(outAddress + SystemMemoryCpuSizeOffset, SystemMemoryCpuBytes);
+        ctx.TryWriteUInt64(outAddress + SystemMemoryGpuSizeOffset, 0);
         return ctx.SetReturn(Ok);
     }
 

src/SharpEmu.Libs/AvPlayer/AvPlayerExports.cs

@@ -439,6 +439,7 @@ public static class AvPlayerExports
         public uint AvSyncMode { get; set; } = AvSyncModeDefault;
         public bool IsGen5 { get; init; }
         public bool Started { get; set; }
+        public bool Stopped { get; set; }
         public bool Paused { get; set; }
         public bool Looping { get; set; }
         public bool EndOfStream { get; set; }
@@ -554,7 +555,9 @@ public static class AvPlayerExports
             {
                 Handle = handle,
                 IsGen5 = IsGen5Target(ctx.TargetGeneration),
-                AutoStart = TryReadByte(ctx, initDataAddress + autoStartOffset, out var autoStart) && autoStart != 0,
+                AutoStart = StartsAutomatically(
+                    TryReadByte(ctx, initDataAddress + autoStartOffset, out var autoStart) && autoStart != 0,
+                    TryReadUInt64(ctx, initDataAddress + 88, out var eventCallbackForStart) ? eventCallbackForStart : 0),
                 GuestBuffers = new ulong[ReadOutputVideoFrameBufferCount(
                     ctx,
                     initDataAddress,
@@ -628,7 +631,9 @@ public static class AvPlayerExports
             {
                 Handle = handle,
                 IsGen5 = IsGen5Target(ctx.TargetGeneration),
-                AutoStart = TryReadByte(ctx, initDataAddress + autoStartOffset, out var autoStart) && autoStart != 0,
+                AutoStart = StartsAutomatically(
+                    TryReadByte(ctx, initDataAddress + autoStartOffset, out var autoStart) && autoStart != 0,
+                    TryReadUInt64(ctx, initDataAddress + 96, out var eventCallbackForStart) ? eventCallbackForStart : 0),
                 GuestBuffers = new ulong[ReadOutputVideoFrameBufferCount(
                     ctx,
                     initDataAddress,
@@ -738,6 +743,7 @@ public static class AvPlayerExports
             player = foundPlayer;
 
             player.Started = true;
+            player.Stopped = false;
             player.Paused = false;
             player.EndOfStream = false;
             Trace($"start handle=0x{player.Handle:X16}");
@@ -781,6 +787,7 @@ public static class AvPlayerExports
 
             player.ResetPlayback();
             player.Started = false;
+            player.Stopped = true;
         }
 
         NotifyEvent(ctx, player, 1); // StateStop
@@ -874,6 +881,32 @@ public static class AvPlayerExports
         }
     }
 
+    [SysAbiExport(
+        Nid = "N6Oy-EjduiY",
+        ExportName = "sceAvPlayerSetAvailableBandwidth",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAvPlayer")]
+    [SysAbiExport(
+        Nid = "+7xJ+lFxmkQ",
+        ExportName = "sceAvPlayerSetAvailableBW",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAvPlayer")]
+    public static int AvPlayerSetAvailableBandwidth(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var availableBandwidth = ctx[CpuRegister.Rsi];
+        lock (StateGate)
+        {
+            if (!Players.ContainsKey(handle))
+            {
+                return SetReturn(ctx, InvalidParameters);
+            }
+
+            Trace($"set_available_bandwidth handle=0x{handle:X16} bandwidth={availableBandwidth}");
+            return SetReturn(ctx, 0);
+        }
+    }
+
     [SysAbiExport(
         Nid = "ODJK2sn9w4A",
         ExportName = "sceAvPlayerEnableStream",
@@ -1016,7 +1049,9 @@ public static class AvPlayerExports
         lock (StateGate)
         {
             var found = Players.TryGetValue(ctx[CpuRegister.Rdi], out var player);
-            var active = found && player!.Started && !player.EndOfStream;
+            // Active from the moment a source is ready until it stops, fails or reaches its end,
+            // whether or not playback has started (titles poll it before calling sceAvPlayerStart).
+            var active = found && player!.SourcePath is not null && !player.Stopped && !player.EndOfStream;
             TraceOnce(
                 "is_active",
                 $"is_active found={found} started={(found && player!.Started)} " +
@@ -1403,6 +1438,7 @@ public static class AvPlayerExports
             player.DurationMilliseconds = duration;
             player.HasAudio = hasAudio;
             player.Started = player.AutoStart;
+            player.Stopped = false;
             autoStart = player.AutoStart;
             Trace(
                 $"source guest='{guestPath}' host='{hostPath}' {width}x{height} " +
@@ -2643,6 +2679,13 @@ public static class AvPlayerExports
     internal static bool IsGen5Target(Generation generation) =>
         (generation & Generation.Gen5) != 0;
 
+    // A player plays on its own once its source is ready when the title asks for autoStart or
+    // registers no event callback: without one nothing could observe the ready state and start
+    // it. Such a title never calls sceAvPlayerStart and waits for the player to go inactive at the
+    // end of the stream, so leaving it unstarted kept it active forever.
+    internal static bool StartsAutomatically(bool autoStartRequested, ulong eventCallback) =>
+        autoStartRequested || eventCallback == 0;
+
     internal static ulong GetAutoStartOffset(Generation generation, bool extended) =>
         IsGen5Target(generation)
             ? extended ? 116UL : 108UL

src/SharpEmu.Libs/Codec/Videodec2Decoder.cs

@@ -7,6 +7,21 @@ using SharpEmu.Libs.VideoOut;
 
 namespace SharpEmu.Libs.Codec;
 
+internal sealed record Videodec2DecodedFrame(
+    byte[] Nv12,
+    uint Width,
+    uint Height,
+    uint Pitch,
+    bool ErrorFrame)
+{
+    public ulong Pts { get; init; } = ulong.MaxValue;
+    public ulong Dts { get; init; } = ulong.MaxValue;
+    public ulong AttachedData { get; init; }
+    public bool KeyFrame { get; init; }
+    public uint Profile { get; init; }
+    public uint Level { get; init; }
+}
+
 /// <summary>
 /// Owns one FFmpeg H.264 decode session for a single sceVideodec2 decoder
 /// handle, feeding it pre-demuxed Annex-B access units from guest memory.
@@ -29,6 +44,8 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
     // Enough lookahead to absorb decode jitter without adding visible latency.
     private const int FrameQueueCapacity = 4;
 
+    private const int WorkQueueCapacity = 64;
+
     // Fallback when the stream doesn't declare a usable framerate.
     private const double FallbackFps = 30.0;
 
@@ -45,12 +62,12 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
     private AVPixelFormat _swsSourceFormat = AVPixelFormat.AV_PIX_FMT_NONE;
     private bool _disposed;
 
-    // Unbounded: access units are small, backpressure lives on the frame queue below.
     private readonly Channel<byte[]?> _workChannel =
-        Channel.CreateUnbounded<byte[]?>(new UnboundedChannelOptions
+        Channel.CreateBounded<byte[]?>(new BoundedChannelOptions(WorkQueueCapacity)
         {
+            FullMode = BoundedChannelFullMode.Wait,
             SingleReader = true,
-            SingleWriter = true,
+            SingleWriter = false,
         });
 
     // Bounded and blocking-on-full: the backpressure that keeps decode paced to playback.
@@ -74,6 +91,10 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
     private uint _lastWidth;
     private uint _lastHeight;
 
+    private long _workerInputCount;
+    private long _workerFrameCount;
+    private static readonly bool TraceEnabled = IsTraceEnabled();
+
     private Videodec2Decoder(AVCodecContext* codecContext, AVFrame* frame, AVPacket* packet)
     {
         _codecContext = codecContext;
@@ -106,18 +127,22 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
             var codec = ffmpeg.avcodec_find_decoder(AVCodecID.AV_CODEC_ID_H264);
             if (codec == null)
             {
+                Trace("create failed: H.264 decoder not found");
                 return null;
             }
 
             codecContext = ffmpeg.avcodec_alloc_context3(codec);
             if (codecContext == null)
             {
+                Trace("create failed: avcodec_alloc_context3 returned null");
                 return null;
             }
 
+            codecContext->flags |= ffmpeg.AV_CODEC_FLAG_COPY_OPAQUE;
             if (ffmpeg.avcodec_open2(codecContext, codec, null) < 0)
             {
                 ffmpeg.avcodec_free_context(&codecContext);
+                Trace("create failed: avcodec_open2 rejected H.264 decoder");
                 return null;
             }
 
@@ -136,14 +161,18 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
                 }
 
                 ffmpeg.avcodec_free_context(&codecContext);
+                Trace("create failed: frame or packet allocation returned null");
                 return null;
             }
 
-            return new Videodec2Decoder(codecContext, frame, packet);
+            var decoder = new Videodec2Decoder(codecContext, frame, packet);
+            Trace("create succeeded: FFmpeg H.264 worker and scheduler started");
+            return decoder;
         }
         catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException or TypeInitializationException)
         {
             // FFmpeg's native libraries are optional; missing ones degrade to the stub, not a crash.
+            Trace($"create failed: {ex.GetType().Name}: {ex.Message}");
             if (codecContext != null)
             {
                 ffmpeg.avcodec_free_context(&codecContext);
@@ -174,18 +203,252 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
         }
     }
 
-    /// <summary>Hands one Annex-B access unit to the decode worker and returns immediately.</summary>
-    public void EnqueueAccessUnit(byte[] accessUnit)
+    public bool EnqueueAccessUnit(byte[] accessUnit)
     {
-        _workChannel.Writer.TryWrite(accessUnit);
+        return _workChannel.Writer.TryWrite(accessUnit);
     }
 
     /// <summary>Queues an end-of-stream drain: flush FFmpeg and emit one more buffered picture, if any.</summary>
-    public void RequestDrain()
+    public bool RequestDrain()
     {
-        _workChannel.Writer.TryWrite(null);
+        return _workChannel.Writer.TryWrite(null);
     }
 
+    public bool DecodeAccessUnit(
+        byte[] accessUnit,
+        ulong pts,
+        ulong dts,
+        ulong attachedData,
+        out Videodec2DecodedFrame? decodedFrame)
+    {
+        decodedFrame = null;
+        lock (_gate)
+        {
+            if (_disposed || accessUnit.Length == 0)
+            {
+                return false;
+            }
+
+            ffmpeg.av_packet_unref(_packet);
+            ffmpeg.av_frame_unref(_frame);
+            var packetResult = ffmpeg.av_new_packet(_packet, accessUnit.Length);
+            if (packetResult < 0)
+            {
+                Trace($"decode failed: av_new_packet={packetResult}");
+                return false;
+            }
+
+            try
+            {
+                fixed (byte* source = accessUnit)
+                {
+                    Buffer.MemoryCopy(source, _packet->data, accessUnit.Length, accessUnit.Length);
+                }
+
+                _packet->pts = ToAvTimestamp(pts);
+                _packet->dts = ToAvTimestamp(dts);
+
+                var havePendingFrame = false;
+                var sendResult = ffmpeg.avcodec_send_packet(_codecContext, _packet);
+                if (sendResult == ffmpeg.AVERROR(ffmpeg.EAGAIN))
+                {
+                    var pendingResult = ffmpeg.avcodec_receive_frame(_codecContext, _frame);
+                    if (pendingResult < 0)
+                    {
+                        Trace($"decode failed: receive-before-resend={pendingResult}");
+                        return false;
+                    }
+
+                    havePendingFrame = true;
+                    sendResult = ffmpeg.avcodec_send_packet(_codecContext, _packet);
+                }
+
+                if (sendResult < 0)
+                {
+                    Trace($"decode failed: avcodec_send_packet={sendResult}");
+                    return false;
+                }
+
+                if (!havePendingFrame)
+                {
+                    var receiveResult = ffmpeg.avcodec_receive_frame(_codecContext, _frame);
+                    if (receiveResult == ffmpeg.AVERROR(ffmpeg.EAGAIN) ||
+                        receiveResult == ffmpeg.AVERROR_EOF)
+                    {
+                        return true;
+                    }
+
+                    if (receiveResult < 0)
+                    {
+                        Trace($"decode failed: avcodec_receive_frame={receiveResult}");
+                        return false;
+                    }
+                }
+
+                decodedFrame = ConvertFrameToNv12Locked(pts, dts, attachedData);
+                return decodedFrame is not null;
+            }
+            finally
+            {
+                ffmpeg.av_frame_unref(_frame);
+                ffmpeg.av_packet_unref(_packet);
+            }
+        }
+    }
+
+    public bool FlushOutput(out Videodec2DecodedFrame? decodedFrame)
+    {
+        decodedFrame = null;
+        lock (_gate)
+        {
+            if (_disposed)
+            {
+                return false;
+            }
+
+            ffmpeg.av_frame_unref(_frame);
+            var receiveResult = ffmpeg.avcodec_receive_frame(_codecContext, _frame);
+            if (receiveResult == ffmpeg.AVERROR(ffmpeg.EAGAIN) ||
+                receiveResult == ffmpeg.AVERROR_EOF)
+            {
+                return true;
+            }
+
+            if (receiveResult < 0)
+            {
+                Trace($"flush failed: avcodec_receive_frame={receiveResult}");
+                return false;
+            }
+
+            try
+            {
+                decodedFrame = ConvertFrameToNv12Locked();
+                return decodedFrame is not null;
+            }
+            finally
+            {
+                ffmpeg.av_frame_unref(_frame);
+            }
+        }
+    }
+
+    public void Reset()
+    {
+        lock (_gate)
+        {
+            if (_disposed)
+            {
+                return;
+            }
+
+            ffmpeg.avcodec_flush_buffers(_codecContext);
+            ffmpeg.av_packet_unref(_packet);
+            ffmpeg.av_frame_unref(_frame);
+        }
+    }
+
+    private Videodec2DecodedFrame? ConvertFrameToNv12Locked(
+        ulong fallbackPts = ulong.MaxValue,
+        ulong fallbackDts = ulong.MaxValue,
+        ulong attachedData = 0)
+    {
+        if (_frame->width <= 0 || _frame->height <= 0)
+        {
+            return null;
+        }
+
+        var width = checked((uint)_frame->width);
+        var height = checked((uint)_frame->height);
+        uint pitch;
+        ulong lumaBytes;
+        ulong requiredBytes;
+        try
+        {
+            pitch = checked((width + 255u) & ~255u);
+            lumaBytes = checked((ulong)pitch * height);
+            var chromaRows = ((ulong)height + 1UL) / 2UL;
+            requiredBytes = checked(lumaBytes + ((ulong)pitch * chromaRows));
+        }
+        catch (OverflowException)
+        {
+            return null;
+        }
+
+        if (requiredBytes > int.MaxValue)
+        {
+            return null;
+        }
+
+        _swsContext = ffmpeg.sws_getCachedContext(
+            _swsContext,
+            _frame->width,
+            _frame->height,
+            (AVPixelFormat)_frame->format,
+            _frame->width,
+            _frame->height,
+            AVPixelFormat.AV_PIX_FMT_NV12,
+            ffmpeg.SWS_FAST_BILINEAR,
+            null,
+            null,
+            null);
+        if (_swsContext == null)
+        {
+            return null;
+        }
+
+        var nv12 = new byte[(int)requiredBytes];
+        fixed (byte* destination = nv12)
+        {
+            var destinationPlanes = new byte*[4]
+            {
+                destination,
+                destination + checked((int)lumaBytes),
+                null,
+                null,
+            };
+            var destinationStrides = new int[4]
+            {
+                checked((int)pitch),
+                checked((int)pitch),
+                0,
+                0,
+            };
+            var rows = ffmpeg.sws_scale(
+                _swsContext,
+                _frame->data,
+                _frame->linesize,
+                0,
+                _frame->height,
+                destinationPlanes,
+                destinationStrides);
+            if (rows != _frame->height)
+            {
+                return null;
+            }
+        }
+
+        return new Videodec2DecodedFrame(
+            nv12,
+            width,
+            height,
+            pitch,
+            (_frame->flags & ffmpeg.AV_FRAME_FLAG_CORRUPT) != 0)
+        {
+            Pts = FromAvTimestamp(_frame->pts, fallbackPts),
+            Dts = FromAvTimestamp(_frame->pkt_dts, fallbackDts),
+            AttachedData = attachedData,
+            KeyFrame = (_frame->flags & ffmpeg.AV_FRAME_FLAG_KEY) != 0,
+            Profile = _codecContext->profile > 0 ? (uint)_codecContext->profile : 0,
+            Level = _codecContext->level > 0 ? (uint)_codecContext->level : 0,
+        };
+    }
+
+    private static long ToAvTimestamp(ulong timestamp) =>
+        timestamp <= long.MaxValue ? (long)timestamp : ffmpeg.AV_NOPTS_VALUE;
+
+    private static ulong FromAvTimestamp(long timestamp, ulong fallback) =>
+        timestamp == ffmpeg.AV_NOPTS_VALUE || timestamp < 0 ? fallback : (ulong)timestamp;
+
     /// <summary>Non-blocking: true exactly once per frame the worker has produced, in order.</summary>
     public bool TryConsumeProtocolReadySignal(out uint width, out uint height)
     {
@@ -233,15 +496,28 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
                 return;
             }
 
+            var inputOrdinal = Interlocked.Increment(ref _workerInputCount);
             var decodedOk = item is null
                 ? DrainCoreLocked(out var bgraFrame, out var hasPicture, out var width, out var height)
                 : DecodeCoreLocked(item, out bgraFrame, out hasPicture, out width, out height);
+            if (ShouldTrace(inputOrdinal))
+            {
+                Trace(
+                    $"worker input={inputOrdinal} kind={(item is null ? "drain" : "au")} " +
+                    $"bytes={item?.Length ?? 0} ok={decodedOk} picture={hasPicture} size={width}x{height}");
+            }
 
             if (!decodedOk || !hasPicture || bgraFrame is null)
             {
                 continue;
             }
 
+            var frameOrdinal = Interlocked.Increment(ref _workerFrameCount);
+            if (ShouldTrace(frameOrdinal))
+            {
+                Trace($"worker frame={frameOrdinal} produced size={width}x{height} bytes={bgraFrame.Length}");
+            }
+
             try
             {
                 // Blocks if the scheduler hasn't kept up; deliberate backpressure.
@@ -564,4 +840,22 @@ internal sealed unsafe class Videodec2Decoder : IDisposable
             }
         }
     }
+
+    private static bool IsTraceEnabled()
+    {
+        var value = Environment.GetEnvironmentVariable("SHARPEMU_LOG_VIDEODEC2");
+        return string.Equals(value, "1", StringComparison.Ordinal) ||
+               string.Equals(value, "true", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static bool ShouldTrace(long ordinal) =>
+        TraceEnabled && (ordinal <= 16 || ordinal % 120 == 0);
+
+    private static void Trace(string message)
+    {
+        if (TraceEnabled)
+        {
+            Console.Error.WriteLine($"[VIDEODEC2][TRACE] {message}");
+        }
+    }
 }

src/SharpEmu.Libs/Codec/Videodec2Exports.cs

@@ -1,6 +1,7 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Buffers.Binary;
 using System.Collections.Concurrent;
 using SharpEmu.HLE;
 
@@ -15,10 +16,18 @@ public static class Videodec2Exports
 {
     private const int Ok = 0;
 
+    private const ulong MinimumMemoryBytes = 16UL * 1024 * 1024;
+    private const uint FrameBufferAlignment = 0x100;
+
     // Null entry = TryCreate() failed; every export falls back to the stub for that handle.
     private static readonly ConcurrentDictionary<ulong, Videodec2Decoder?> Decoders = new();
+    private static readonly ConcurrentDictionary<ulong, Videodec2DecodedFrame> PictureInfos = new();
     private static long _nextDecoderHandle = unchecked((long)DecoderToken);
 
+    private static readonly bool TraceEnabled = IsTraceEnabled();
+    private static long _decodeCallCount;
+    private static long _decodedPictureCount;
+
     [SysAbiExport(
         Nid = "RnDibcGCPKw",
         ExportName = "sceVideodec2QueryComputeMemoryInfo",
@@ -27,24 +36,25 @@ public static class Videodec2Exports
     public static int Videodec2QueryComputeMemoryInfo(CpuContext ctx)
     {
         var paramAddress = ctx[CpuRegister.Rdi];
-        if (paramAddress == 0)
+        if (paramAddress == 0 ||
+            !ctx.TryWriteUInt64(paramAddress + 0x08, MinimumMemoryBytes) ||
+            !ctx.TryWriteUInt64(paramAddress + 0x10, 0))
         {
             return SetReturn(ctx, VideodecErrorInvalidArg);
         }
 
-        // Success needs no memory writes; the game initializes from its own fields.
         return SetReturn(ctx, Ok);
     }
 
     private const int VideodecErrorInvalidArg = unchecked((int)0x80620801);
+    private const int VideodecErrorStructSize = unchecked((int)0x811D0101);
+    private const int VideodecErrorOutputInfo = unchecked((int)0x811D010F);
+    private const int VideodecErrorComputeQueueId = unchecked((int)0x811D0202);
 
     // Reject garbage/not-yet-primed struct reads before they reach `new byte[...]`.
     private const ulong MaxPlausibleAuBytes = 32UL * 1024 * 1024;
     private const ulong MaxPlausibleSlotBytes = 64UL * 1024 * 1024;
 
-    // Opaque token the game hands back unmodified to later Videodec2 calls.
-    private const ulong ComputeQueueToken = 0x56D2_C0DE_0001UL;
-
     [SysAbiExport(
         Nid = "eD+X2SmxUt4",
         ExportName = "sceVideodec2AllocateComputeQueue",
@@ -52,8 +62,14 @@ public static class Videodec2Exports
         LibraryName = "libSceVideodec2")]
     public static int Videodec2AllocateComputeQueue(CpuContext ctx)
     {
-        var queueAddress = ctx[CpuRegister.Rdi];
-        if (queueAddress == 0 || !ctx.TryWriteUInt64(queueAddress, ComputeQueueToken))
+        var configAddress = ctx[CpuRegister.Rdi];
+        var memoryInfoAddress = ctx[CpuRegister.Rsi];
+        var queueAddress = ctx[CpuRegister.Rdx];
+        if (configAddress == 0 || memoryInfoAddress == 0 || queueAddress == 0 ||
+            !ctx.TryReadUInt64(memoryInfoAddress + 0x10, out var computeMemoryAddress) ||
+            computeMemoryAddress == 0 ||
+            !ctx.TryWriteUInt64(
+                queueAddress, computeMemoryAddress))
         {
             return SetReturn(ctx, VideodecErrorInvalidArg);
         }
@@ -61,7 +77,18 @@ public static class Videodec2Exports
         return SetReturn(ctx, Ok);
     }
 
-    // A zero size at +0x08/+0x28 makes the game skip its own arena allocation cleanly.
+    [SysAbiExport(
+        Nid = "UvtA3FAiF4Y",
+        ExportName = "sceVideodec2ReleaseComputeQueue",
+        Target = Generation.Gen5,
+        LibraryName = "libSceVideodec2")]
+    public static int Videodec2ReleaseComputeQueue(CpuContext ctx)
+    {
+        return SetReturn(
+            ctx,
+            ctx[CpuRegister.Rdi] != 0 ? Ok : VideodecErrorComputeQueueId);
+    }
+
     [SysAbiExport(
         Nid = "qqMCwlULR+E",
         ExportName = "sceVideodec2QueryDecoderMemoryInfo",
@@ -69,12 +96,18 @@ public static class Videodec2Exports
         LibraryName = "libSceVideodec2")]
     public static int Videodec2QueryDecoderMemoryInfo(CpuContext ctx)
     {
+        var configAddress = ctx[CpuRegister.Rdi];
         var memoryInfoAddress = ctx[CpuRegister.Rsi];
-        if (memoryInfoAddress == 0 ||
-            !ctx.TryWriteUInt64(memoryInfoAddress + 0x08, 0) ||
-            !ctx.TryWriteUInt64(memoryInfoAddress + 0x28, 0) ||
-            // Frame-slot size: must be nonzero or the game divides its arena by zero.
-            !ctx.TryWriteUInt64(memoryInfoAddress + 0x38, 0x1000))
+        if (configAddress == 0 || memoryInfoAddress == 0 ||
+            !ctx.TryWriteUInt64(memoryInfoAddress + 0x08, MinimumMemoryBytes) ||
+            !ctx.TryWriteUInt64(memoryInfoAddress + 0x10, 0) ||
+            !ctx.TryWriteUInt64(memoryInfoAddress + 0x18, MinimumMemoryBytes) ||
+            !ctx.TryWriteUInt64(memoryInfoAddress + 0x20, 0) ||
+            !ctx.TryWriteUInt64(memoryInfoAddress + 0x28, MinimumMemoryBytes) ||
+            !ctx.TryWriteUInt64(memoryInfoAddress + 0x30, 0) ||
+            !ctx.TryWriteUInt64(memoryInfoAddress + 0x38, MinimumMemoryBytes) ||
+            !ctx.TryWriteUInt32(memoryInfoAddress + 0x40, FrameBufferAlignment) ||
+            !ctx.TryWriteUInt32(memoryInfoAddress + 0x44, 0))
         {
             return SetReturn(ctx, VideodecErrorInvalidArg);
         }
@@ -99,7 +132,9 @@ public static class Videodec2Exports
         }
 
         var handle = unchecked((ulong)Interlocked.Increment(ref _nextDecoderHandle));
-        Decoders[handle] = Videodec2Decoder.TryCreate();
+        var decoder = Videodec2Decoder.TryCreate();
+        Decoders[handle] = decoder;
+        Trace($"create handle=0x{handle:X16} real_decoder={decoder is not null}");
 
         if (!ctx.TryWriteUInt64(decoderAddress, handle))
         {
@@ -111,7 +146,6 @@ public static class Videodec2Exports
         return SetReturn(ctx, Ok);
     }
 
-    // Clearing the picture-ready byte at [rdx] tells the player "no buffered pictures remain".
     [SysAbiExport(
         Nid = "l1hXwscLuCY",
         ExportName = "sceVideodec2Flush",
@@ -120,33 +154,25 @@ public static class Videodec2Exports
     public static int Videodec2Flush(CpuContext ctx)
     {
         var handle = ctx[CpuRegister.Rdi];
+        var outputSlotObj = ctx[CpuRegister.Rsi];
         var outputInfoAddress = ctx[CpuRegister.Rdx];
-        if (outputInfoAddress == 0 || !ctx.Memory.TryWrite(outputInfoAddress, NoPicture))
+        if (!TryInitializeNoPicture(ctx, outputSlotObj, outputInfoAddress))
         {
             return SetReturn(ctx, VideodecErrorInvalidArg);
         }
 
-        if (Decoders.TryGetValue(handle, out var decoder) && decoder is not null)
+        if (Decoders.TryGetValue(handle, out var decoder) &&
+            decoder is not null &&
+            decoder.FlushOutput(out var decodedFrame) &&
+            decodedFrame is not null)
         {
-            // Drain in order: report an already-finished frame before queuing a new drain request.
-            if (decoder.TryConsumeProtocolReadySignal(out var width, out var height))
-            {
-                if (ctx.TryWriteUInt64(outputInfoAddress + 0x08, width) &&
-                    ctx.TryWriteUInt64(outputInfoAddress + 0x10, height))
-                {
-                    _ = ctx.Memory.TryWrite(outputInfoAddress, PictureReady);
-                }
-            }
-            else
-            {
-                decoder.RequestDrain();
-            }
+            _ = TryWriteDecodedFrame(
+                ctx, outputSlotObj, outputInfoAddress, decodedFrame);
         }
 
         return SetReturn(ctx, Ok);
     }
 
-    // No state to reset.
     [SysAbiExport(
         Nid = "wJXikG6QFN8",
         ExportName = "sceVideodec2Reset",
@@ -154,6 +180,12 @@ public static class Videodec2Exports
         LibraryName = "libSceVideodec2")]
     public static int Videodec2Reset(CpuContext ctx)
     {
+        var handle = ctx[CpuRegister.Rdi];
+        if (Decoders.TryGetValue(handle, out var decoder) && decoder is not null)
+        {
+            decoder.Reset();
+        }
+
         return SetReturn(ctx, Ok);
     }
 
@@ -173,8 +205,6 @@ public static class Videodec2Exports
         return SetReturn(ctx, Ok);
     }
 
-    // rcx[0] is the picture-ready flag (1 = frame published); it lives in
-    // uninitialized stack and must always be written explicitly.
     [SysAbiExport(
         Nid = "852F5+q6+iM",
         ExportName = "sceVideodec2Decode",
@@ -186,8 +216,9 @@ public static class Videodec2Exports
         var inputAuStruct = ctx[CpuRegister.Rsi];
         var outputSlotObj = ctx[CpuRegister.Rdx];
         var outputInfoAddress = ctx[CpuRegister.Rcx];
+        var callOrdinal = Interlocked.Increment(ref _decodeCallCount);
 
-        if (outputInfoAddress == 0 || !ctx.Memory.TryWrite(outputInfoAddress, NoPicture))
+        if (!TryInitializeNoPicture(ctx, outputSlotObj, outputInfoAddress))
         {
             return SetReturn(ctx, VideodecErrorInvalidArg);
         }
@@ -195,6 +226,7 @@ public static class Videodec2Exports
         if (!Decoders.TryGetValue(handle, out var decoder) || decoder is null)
         {
             // No real decoder for this handle: stub behavior, "fed the AU, no picture".
+            TraceDecode(callOrdinal, $"stub handle=0x{handle:X16}");
             return SetReturn(ctx, Ok);
         }
 
@@ -208,35 +240,235 @@ public static class Videodec2Exports
             slotPtr == 0 || slotSize == 0 || slotSize > MaxPlausibleSlotBytes)
         {
             // Nothing sane to feed/fill this call; not an error.
+            TraceDecode(callOrdinal, "invalid access-unit or output-slot descriptor");
             return SetReturn(ctx, Ok);
         }
 
+        _ = ctx.TryReadUInt64(inputAuStruct + 0x18, out var pts);
+        _ = ctx.TryReadUInt64(inputAuStruct + 0x20, out var dts);
+        _ = ctx.TryReadUInt64(inputAuStruct + 0x28, out var attachedData);
+
         var auBuffer = new byte[auDataSize];
         if (!ctx.Memory.TryRead(auDataPtr, auBuffer))
         {
+            TraceDecode(callOrdinal, $"AU read failed ptr=0x{auDataPtr:X16} bytes=0x{auDataSize:X}");
             return SetReturn(ctx, Ok);
         }
 
-        // Queues the AU and returns immediately; decode/present happen on Videodec2Decoder's own threads.
-        decoder.EnqueueAccessUnit(auBuffer);
+        var decodeOk = decoder.DecodeAccessUnit(
+            auBuffer, pts, dts, attachedData, out var decodedFrame);
+        if (ShouldTrace(callOrdinal))
+        {
+            var prefixBytes = Math.Min(auBuffer.Length, 8);
+            Trace(
+                $"decode call={callOrdinal} au=0x{auDataPtr:X16}+0x{auDataSize:X} " +
+                $"head={Convert.ToHexString(auBuffer.AsSpan(0, prefixBytes))} " +
+                $"slot=0x{slotPtr:X16}+0x{slotSize:X} ok={decodeOk} " +
+                $"picture={decodedFrame is not null}");
+        }
 
-        if (!decoder.TryConsumeProtocolReadySignal(out var width, out var height))
+        if (!decodeOk || decodedFrame is null)
         {
             return SetReturn(ctx, Ok);
         }
 
-        if (!ctx.TryWriteUInt64(outputInfoAddress + 0x08, width) ||
-            !ctx.TryWriteUInt64(outputInfoAddress + 0x10, height) ||
-            !ctx.Memory.TryWrite(outputInfoAddress, PictureReady))
+        var copied = TryWriteDecodedFrame(
+            ctx, outputSlotObj, outputInfoAddress, decodedFrame);
+        if (copied)
         {
-            return SetReturn(ctx, Ok);
+            Interlocked.Increment(ref _decodedPictureCount);
         }
+        TraceDecode(callOrdinal, $"guest_copy={copied} size={decodedFrame.Width}x{decodedFrame.Height} pitch={decodedFrame.Pitch}");
 
         return SetReturn(ctx, Ok);
     }
 
-    private static readonly byte[] NoPicture = [0];
-    private static readonly byte[] PictureReady = [1];
+    [SysAbiExport(
+        Nid = "NtXRa3dRzU0",
+        ExportName = "sceVideodec2GetPictureInfo",
+        Target = Generation.Gen5,
+        LibraryName = "libSceVideodec2")]
+    public static int Videodec2GetPictureInfo(CpuContext ctx)
+    {
+        var outputInfoAddress = ctx[CpuRegister.Rdi];
+        var firstPictureInfoAddress = ctx[CpuRegister.Rsi];
+        var secondPictureInfoAddress = ctx[CpuRegister.Rdx];
+        if (outputInfoAddress == 0 || firstPictureInfoAddress == 0)
+        {
+            return SetReturn(ctx, VideodecErrorInvalidArg);
+        }
+
+        if (!ctx.TryReadUInt64(outputInfoAddress, out var outputInfoSize) ||
+            (outputInfoSize != 0x30 && outputInfoSize != 0x38))
+        {
+            return SetReturn(ctx, VideodecErrorStructSize);
+        }
+
+        if (!TryReadByte(ctx, outputInfoAddress + 0x08, out var isValid) ||
+            !TryReadByte(ctx, outputInfoAddress + 0x0A, out var pictureCount) ||
+            !ctx.TryReadUInt32(outputInfoAddress + 0x0C, out var codecType) ||
+            !ctx.TryReadUInt64(outputInfoAddress + 0x20, out var pixelsAddress) ||
+            isValid == 0 || pictureCount == 0 || pixelsAddress == 0 || codecType != 1 ||
+            !PictureInfos.TryGetValue(pixelsAddress, out var decodedFrame))
+        {
+            return SetReturn(ctx, VideodecErrorOutputInfo);
+        }
+
+        if (!ctx.TryReadUInt64(firstPictureInfoAddress, out var requestedSize) ||
+            (requestedSize != 104 && requestedSize != 120))
+        {
+            return SetReturn(ctx, VideodecErrorStructSize);
+        }
+
+        var picture = new byte[(int)requestedSize];
+        BinaryPrimitives.WriteUInt64LittleEndian(picture, requestedSize);
+        picture[0x08] = 1;
+        BinaryPrimitives.WriteUInt64LittleEndian(picture.AsSpan(0x10), decodedFrame.Pts);
+        BinaryPrimitives.WriteUInt64LittleEndian(picture.AsSpan(0x18), decodedFrame.Dts);
+        BinaryPrimitives.WriteUInt64LittleEndian(picture.AsSpan(0x20), decodedFrame.AttachedData);
+        picture[0x28] = decodedFrame.KeyFrame ? (byte)1 : (byte)0;
+        picture[0x29] = (byte)Math.Min(decodedFrame.Profile, byte.MaxValue);
+        picture[0x2A] = (byte)Math.Min(decodedFrame.Level, byte.MaxValue);
+        BinaryPrimitives.WriteUInt32LittleEndian(
+            picture.AsSpan(0x2C), (decodedFrame.Width + 15u) / 16u - 1u);
+        BinaryPrimitives.WriteUInt32LittleEndian(
+            picture.AsSpan(0x30), (decodedFrame.Height + 15u) / 16u - 1u);
+        picture[0x34] = 1;
+        picture[0x4E] = 1;
+        picture[0x4F] = 5;
+        if (!ctx.Memory.TryWrite(firstPictureInfoAddress, picture))
+        {
+            return SetReturn(ctx, VideodecErrorInvalidArg);
+        }
+
+        if (secondPictureInfoAddress != 0 &&
+            !TryWriteEmptyPictureInfo(ctx, secondPictureInfoAddress))
+        {
+            return SetReturn(ctx, VideodecErrorStructSize);
+        }
+
+        Trace(
+            $"picture_info buffer=0x{pixelsAddress:X16} " +
+            $"pts=0x{decodedFrame.Pts:X16} size={requestedSize}");
+        return SetReturn(ctx, Ok);
+    }
+
+    private static readonly byte[] NotAccepted = [0];
+    private static readonly byte[] Accepted = [1];
+    private static readonly byte[] NoPicture = [0, 0, 0, 0];
+    private static readonly byte[] PictureReady = [1, 0, 1, 0];
+    private static readonly byte[] ErrorPictureReady = [1, 1, 1, 0];
+
+    private static bool TryInitializeNoPicture(
+        CpuContext ctx,
+        ulong frameBufferAddress,
+        ulong outputInfoAddress)
+    {
+        return frameBufferAddress != 0 &&
+               outputInfoAddress != 0 &&
+               ctx.Memory.TryWrite(frameBufferAddress + 0x18, NotAccepted) &&
+               ctx.Memory.TryWrite(outputInfoAddress + 0x08, NoPicture);
+    }
+
+    internal static bool TryWriteDecodedFrame(
+        CpuContext ctx,
+        ulong frameBufferAddress,
+        ulong outputInfoAddress,
+        Videodec2DecodedFrame decodedFrame)
+    {
+        if (!ctx.TryReadUInt64(frameBufferAddress + 0x08, out var pixelsAddress) ||
+            !ctx.TryReadUInt64(frameBufferAddress + 0x10, out var slotBytes) ||
+            !ctx.TryReadUInt64(outputInfoAddress, out var outputInfoBytes) ||
+            pixelsAddress == 0)
+        {
+            return false;
+        }
+
+        if ((ulong)decodedFrame.Nv12.Length > slotBytes ||
+            !ctx.Memory.TryWrite(pixelsAddress, decodedFrame.Nv12))
+        {
+            return false;
+        }
+
+        if (!ctx.TryWriteUInt32(outputInfoAddress + 0x0C, 1) ||
+            !ctx.TryWriteUInt32(outputInfoAddress + 0x10, decodedFrame.Width) ||
+            !ctx.TryWriteUInt32(outputInfoAddress + 0x14, decodedFrame.Pitch) ||
+            !ctx.TryWriteUInt32(outputInfoAddress + 0x18, decodedFrame.Height) ||
+            !ctx.TryWriteUInt64(outputInfoAddress + 0x20, pixelsAddress) ||
+            !ctx.TryWriteUInt64(outputInfoAddress + 0x28, slotBytes))
+        {
+            return false;
+        }
+
+        if (outputInfoBytes >= 0x38 &&
+            (!ctx.TryWriteUInt32(outputInfoAddress + 0x30, 0) ||
+             !ctx.TryWriteUInt32(outputInfoAddress + 0x34, decodedFrame.Pitch)))
+        {
+            return false;
+        }
+
+        if (!ctx.Memory.TryWrite(frameBufferAddress + 0x18, Accepted) ||
+            !ctx.Memory.TryWrite(
+                outputInfoAddress + 0x08,
+                decodedFrame.ErrorFrame ? ErrorPictureReady : PictureReady))
+        {
+            return false;
+        }
+
+        PictureInfos[pixelsAddress] = decodedFrame;
+        return true;
+    }
+
+    private static bool TryWriteEmptyPictureInfo(CpuContext ctx, ulong address)
+    {
+        if (!ctx.TryReadUInt64(address, out var size) || size < 40 || size > 256)
+        {
+            return false;
+        }
+
+        var output = new byte[(int)size];
+        BinaryPrimitives.WriteUInt64LittleEndian(output, size);
+        return ctx.Memory.TryWrite(address, output);
+    }
+
+    private static bool TryReadByte(CpuContext ctx, ulong address, out byte value)
+    {
+        Span<byte> buffer = stackalloc byte[1];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = buffer[0];
+        return true;
+    }
+
+    private static bool IsTraceEnabled()
+    {
+        var value = Environment.GetEnvironmentVariable("SHARPEMU_LOG_VIDEODEC2");
+        return string.Equals(value, "1", StringComparison.Ordinal) ||
+               string.Equals(value, "true", StringComparison.OrdinalIgnoreCase);
+    }
+
+    private static bool ShouldTrace(long ordinal) =>
+        TraceEnabled && (ordinal <= 16 || ordinal % 120 == 0);
+
+    private static void TraceDecode(long ordinal, string message)
+    {
+        if (ShouldTrace(ordinal))
+        {
+            Trace($"decode call={ordinal} {message}");
+        }
+    }
+
+    private static void Trace(string message)
+    {
+        if (TraceEnabled)
+        {
+            Console.Error.WriteLine($"[VIDEODEC2][TRACE] {message}");
+        }
+    }
 
     private static int SetReturn(CpuContext ctx, int result)
     {

src/SharpEmu.Libs/CommonDialog/WebBrowserDialogExports.cs

@@ -0,0 +1,171 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.CommonDialog;
+
+/// <summary>
+/// Headless lifecycle for the system web-browser dialog. SharpEmu does not yet
+/// provide a host browser, so an opened dialog completes on its first status
+/// poll instead of leaving games in an infinite RUNNING loop.
+/// </summary>
+public static class WebBrowserDialogExports
+{
+    internal const int StatusNone = 0;
+    internal const int StatusInitialized = 1;
+    internal const int StatusRunning = 2;
+    internal const int StatusFinished = 3;
+
+    private const int ErrorOk = 0;
+    private const int ErrorNotInitialized = unchecked((int)0x80B80003);
+    private const int ErrorNotFinished = unchecked((int)0x80B80005);
+    private const int ErrorNotRunning = unchecked((int)0x80B8000B);
+    private const int ErrorArgNull = unchecked((int)0x80B8000D);
+
+    private static int _status;
+
+    [SysAbiExport(
+        Nid = "jqb7HntFQFc",
+        ExportName = "sceWebBrowserDialogInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogInitialize(CpuContext ctx)
+    {
+        Interlocked.CompareExchange(ref _status, StatusInitialized, StatusNone);
+        return ctx.SetReturn(ErrorOk);
+    }
+
+    [SysAbiExport(
+        Nid = "FraP7debcdg",
+        ExportName = "sceWebBrowserDialogOpen",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogOpen(CpuContext ctx) => Open(ctx);
+
+    [SysAbiExport(
+        Nid = "O7dIZQrwVFY",
+        ExportName = "sceWebBrowserDialogOpenForPredeterminedContent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogOpenForPredeterminedContent(CpuContext ctx) => Open(ctx);
+
+    private static int Open(CpuContext ctx)
+    {
+        if (ctx[CpuRegister.Rdi] == 0)
+        {
+            return ctx.SetReturn(ErrorArgNull);
+        }
+
+        if (Volatile.Read(ref _status) == StatusNone)
+        {
+            return ctx.SetReturn(ErrorNotInitialized);
+        }
+
+        Interlocked.Exchange(ref _status, StatusRunning);
+        return ctx.SetReturn(ErrorOk);
+    }
+
+    [SysAbiExport(
+        Nid = "CFTG6a8TjOU",
+        ExportName = "sceWebBrowserDialogGetStatus",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogGetStatus(CpuContext ctx) => ctx.SetReturn(PollStatus());
+
+    [SysAbiExport(
+        Nid = "h1dR-t5ISgg",
+        ExportName = "sceWebBrowserDialogUpdateStatus",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogUpdateStatus(CpuContext ctx) => ctx.SetReturn(PollStatus());
+
+    private static int PollStatus()
+    {
+        Interlocked.CompareExchange(ref _status, StatusFinished, StatusRunning);
+        return Volatile.Read(ref _status);
+    }
+
+    [SysAbiExport(
+        Nid = "PSK+Eik919Q",
+        ExportName = "sceWebBrowserDialogClose",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogClose(CpuContext ctx)
+    {
+        if (Interlocked.CompareExchange(ref _status, StatusFinished, StatusRunning) != StatusRunning)
+        {
+            return ctx.SetReturn(ErrorNotRunning);
+        }
+
+        return ctx.SetReturn(ErrorOk);
+    }
+
+    [SysAbiExport(
+        Nid = "vCaW0fgVQmc",
+        ExportName = "sceWebBrowserDialogGetResult",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogGetResult(CpuContext ctx)
+    {
+        if (ctx[CpuRegister.Rdi] == 0)
+        {
+            return ctx.SetReturn(ErrorArgNull);
+        }
+
+        if (Volatile.Read(ref _status) != StatusFinished)
+        {
+            return ctx.SetReturn(ErrorNotFinished);
+        }
+
+        Span<byte> result = stackalloc byte[sizeof(int)];
+        result.Clear();
+        if (!ctx.Memory.TryWrite(ctx[CpuRegister.Rdi], result))
+        {
+            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        return ctx.SetReturn(ErrorOk);
+    }
+
+    [SysAbiExport(
+        Nid = "Wit4LjeoeX4",
+        ExportName = "sceWebBrowserDialogGetEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogGetEvent(CpuContext ctx) => ctx.SetReturn(ErrorOk);
+
+    [SysAbiExport(
+        Nid = "uYELOMVnmNQ",
+        ExportName = "sceWebBrowserDialogNavigate",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogNavigate(CpuContext ctx) => ctx.SetReturn(ErrorOk);
+
+    [SysAbiExport(
+        Nid = "RLhKBOoNyXY",
+        ExportName = "sceWebBrowserDialogSetZoom",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogSetZoom(CpuContext ctx) => ctx.SetReturn(ErrorOk);
+
+    [SysAbiExport(
+        Nid = "ocHtyBwHfys",
+        ExportName = "sceWebBrowserDialogTerminate",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogTerminate(CpuContext ctx)
+    {
+        if (Interlocked.Exchange(ref _status, StatusNone) == StatusNone)
+        {
+            return ctx.SetReturn(ErrorNotInitialized);
+        }
+
+        return ctx.SetReturn(ErrorOk);
+    }
+
+    internal static int StatusForTests => Volatile.Read(ref _status);
+
+    internal static void ResetForTests() => Interlocked.Exchange(ref _status, StatusNone);
+}

src/SharpEmu.Libs/Diagnostics/DccWriterTrace.cs

@@ -0,0 +1,74 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Diagnostics;
+using System.Globalization;
+using SharpEmu.Libs.Gpu.Buffers;
+
+namespace SharpEmu.Libs.Diagnostics;
+
+internal static class DccWriterTrace
+{
+    private const int MaxReports = 256;
+    private const int MaxFrames = 12;
+
+    private static readonly bool DccEnabled =
+        Environment.GetEnvironmentVariable("SHARPEMU_TRACE_DCC_WRITERS") == "1";
+
+    private static readonly ulong[] TargetAddresses = (Environment.GetEnvironmentVariable("SHARPEMU_TRACE_WRITER_ADDRESS") ?? string.Empty)
+        .Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
+        .Select(ParseAddress)
+        .Where(address => address != 0)
+        .ToArray();
+
+    public static readonly bool Enabled = DccEnabled || TargetAddresses.Length != 0;
+
+    [ThreadStatic]
+    public static ulong CurrentProgram;
+
+    private static readonly HashSet<(ulong Address, ulong Size, ulong Program)> _reported = new();
+    private static readonly HashSet<(ulong Hash, string Reason)> _refusals = new();
+
+    private static ulong ParseAddress(string? value)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+        {
+            return 0;
+        }
+
+        var text = value.Trim();
+        if (text.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+        {
+            text = text[2..];
+        }
+
+        return ulong.TryParse(text, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out var parsed) ? parsed : 0;
+    }
+
+    public static void Record(IGuestImageCache images, ulong address, ulong size)
+    {
+        var targeted = TargetAddresses.Any(target => target >= address && target - address < size);
+        if (_reported.Count >= MaxReports || (!targeted && !(DccEnabled && images.OverlapsDccMetadata(address, size))) ||
+            !_reported.Add((address, size, CurrentProgram)))
+        {
+            return;
+        }
+
+        var frames = new StackTrace(1, false).GetFrames();
+        var names = frames.Take(MaxFrames).Select(frame => frame.GetMethod() is { } method
+            ? $"{method.DeclaringType?.Name}.{method.Name}"
+            : "?");
+        Console.Error.WriteLine(
+            $"[GPU][{(targeted ? "TARGET_WRITER" : "DCC_WRITER")}] address=0x{address:X16} size=0x{size:X} program=0x{CurrentProgram:X16} stack={string.Join(" < ", names)}");
+    }
+
+    public static void Refuse(ulong hash, string reason)
+    {
+        if (!Enabled || _refusals.Count >= MaxReports || !_refusals.Add((hash, reason)))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine($"[GPU][BOUNDED_FILL_REFUSED] program=0x{hash:X16} reason={reason}");
+    }
+}

src/SharpEmu.Libs/Diagnostics/GpuReadTrace.cs

@@ -0,0 +1,59 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.Libs.Diagnostics;
+
+internal static class GpuReadTrace
+{
+    private const int MaxReports = 64;
+
+    public static readonly bool Enabled =
+        Environment.GetEnvironmentVariable("SHARPEMU_TRACE_GPU_READS") == "1";
+
+    [ThreadStatic]
+    public static ulong CurrentShader;
+
+    [ThreadStatic]
+    public static string? CurrentStage;
+
+    private static readonly HashSet<(ulong Shader, ulong Page, bool Table)> _reported = new();
+    private static readonly Dictionary<ulong, (long Reads, long Changes, uint Last, uint First, ulong Shader)> _values = new();
+    private static long _nextValueReport = System.Diagnostics.Stopwatch.GetTimestamp();
+
+    public static void RecordValue(ulong address, uint word)
+    {
+        lock (_values)
+        {
+            _values[address] = _values.TryGetValue(address, out var entry)
+                ? (entry.Reads + 1, entry.Changes + (entry.Last != word ? 1 : 0), word, entry.First, entry.Shader)
+                : (1, 0, word, word, CurrentShader);
+            var now = System.Diagnostics.Stopwatch.GetTimestamp();
+            if (now < _nextValueReport)
+            {
+                return;
+            }
+
+            _nextValueReport = now + System.Diagnostics.Stopwatch.Frequency * 5;
+            foreach (var (key, value) in _values.OrderByDescending(pair => pair.Value.Reads).Take(16))
+            {
+                Console.Error.WriteLine(
+                    $"[GPU][SYNC_READ_VALUE] address=0x{key:X16} reads={value.Reads} changes={value.Changes} first=0x{value.First:X8} last=0x{value.Last:X8} shader=0x{value.Shader:X16}");
+            }
+        }
+    }
+
+    public static void Record(ulong address, bool table)
+    {
+        var key = (CurrentShader, address & ~0xFFFUL, table);
+        lock (_reported)
+        {
+            if (_reported.Count >= MaxReports || !_reported.Add(key))
+            {
+                return;
+            }
+        }
+
+        Console.Error.WriteLine(
+            $"[GPU][SYNC_READ] shader=0x{CurrentShader:X16} stage={CurrentStage} address=0x{address:X16} table={table}");
+    }
+}

src/SharpEmu.Libs/Fiber/FiberExports.cs

@@ -49,6 +49,7 @@ public static class FiberExports
     private const int FiberMagicEndOffset = 104;
 
     private static int _contextSizeCheck;
+    private static readonly bool TraceEnabled = Environment.GetEnvironmentVariable("SHARPEMU_LOG_FIBER") == "1";
 
     private static readonly object _fiberGate = new();
     private static readonly ConcurrentDictionary<ulong, FiberContinuation> _continuations = new();
@@ -287,9 +288,10 @@ public static class FiberExports
 
         _ = GuestThreadExecution.EnterFiber(0);
         GuestThreadExecution.RequestCurrentContextTransfer(transferTarget);
-        TraceFiber(
-            $"return-to-thread fiber=0x{fiberAddress:X16} " +
-            $"resume=0x{transferTarget.Rip:X16} rsp=0x{transferTarget.Rsp:X16} arg=0x{returnArgument:X16}");
+        if (TraceEnabled)
+            TraceFiber(
+                $"return-to-thread fiber=0x{fiberAddress:X16} " +
+                $"resume=0x{transferTarget.Rip:X16} rsp=0x{transferTarget.Rsp:X16} arg=0x{returnArgument:X16}");
         return SetReturn(ctx, 0);
     }
 
@@ -335,7 +337,7 @@ public static class FiberExports
             return SetReturn(ctx, FiberErrorInvalid);
         }
 
-        if (!TryReadFiberFields(ctx, fiber, out var fields))
+        if (!TryReadFiberFields(ctx, fiber, out var fields, readName: true))
         {
             return SetReturn(ctx, FiberErrorInvalid);
         }
@@ -521,9 +523,10 @@ public static class FiberExports
             _stackRanges[fiber] = new FiberStackRange(contextAddress, contextSize);
         }
 
-        TraceFiber(
-            $"init fiber=0x{fiber:X16} entry=0x{entry:X16} ctx=0x{contextAddress:X16} " +
-            $"size=0x{contextSize:X} flags=0x{flags:X} build=0x{buildVersion:X8} name='{name}'");
+        if (TraceEnabled)
+            TraceFiber(
+                $"init fiber=0x{fiber:X16} entry=0x{entry:X16} ctx=0x{contextAddress:X16} " +
+                $"size=0x{contextSize:X} flags=0x{flags:X} build=0x{buildVersion:X8} name='{name}'");
         return SetReturn(ctx, 0);
     }
 
@@ -583,7 +586,8 @@ public static class FiberExports
             }
             if (fields.State != FiberStateIdle)
             {
-                TraceFiber($"run-state-error reason={reason} fiber=0x{fiber:X16} state=0x{fields.State:X8}");
+                if (TraceEnabled)
+                    TraceFiber($"run-state-error reason={reason} fiber=0x{fiber:X16} state=0x{fields.State:X8}");
                 return SetReturn(ctx, FiberErrorState);
             }
 
@@ -670,9 +674,10 @@ public static class FiberExports
 
         _ = GuestThreadExecution.EnterFiber(fiber);
         GuestThreadExecution.RequestCurrentContextTransfer(transferTarget);
-        TraceFiber(
-            $"transfer reason={reason} from=0x{previousFiber:X16} to=0x{fiber:X16} resume={resumed} " +
-            $"rip=0x{transferTarget.Rip:X16} rsp=0x{transferTarget.Rsp:X16} arg=0x{argOnRun:X16}");
+        if (TraceEnabled)
+            TraceFiber(
+                $"transfer reason={reason} from=0x{previousFiber:X16} to=0x{fiber:X16} resume={resumed} " +
+                $"rip=0x{transferTarget.Rip:X16} rsp=0x{transferTarget.Rsp:X16} arg=0x{argOnRun:X16}");
         return SetReturn(ctx, 0);
     }
 
@@ -971,7 +976,7 @@ public static class FiberExports
         return true;
     }
 
-    private static bool TryReadFiberFields(CpuContext ctx, ulong fiber, out FiberFields fields)
+    private static bool TryReadFiberFields(CpuContext ctx, ulong fiber, out FiberFields fields, bool readName = false)
     {
         fields = default;
         if (!TryReadUInt32(ctx, fiber + FiberStateOffset, out var state) ||
@@ -980,7 +985,7 @@ public static class FiberExports
             !TryReadUInt64(ctx, fiber + FiberContextAddressOffset, out var contextAddress) ||
             !TryReadUInt64(ctx, fiber + FiberContextSizeOffset, out var contextSize) ||
             !TryReadUInt32(ctx, fiber + FiberFlagsOffset, out var flags) ||
-            !TryReadInlineName(ctx, fiber + FiberNameOffset, out var name))
+            !TryReadInlineName(ctx, fiber + FiberNameOffset, out var name, decode: readName))
         {
             return false;
         }
@@ -1065,7 +1070,7 @@ public static class FiberExports
         return ctx.Memory.TryWrite(address, buffer);
     }
 
-    private static bool TryReadInlineName(CpuContext ctx, ulong address, out string value)
+    private static bool TryReadInlineName(CpuContext ctx, ulong address, out string value, bool decode)
     {
         Span<byte> buffer = stackalloc byte[MaxNameLength + 1];
         if (!ctx.Memory.TryRead(address, buffer))
@@ -1080,7 +1085,9 @@ public static class FiberExports
             length = buffer.Length;
         }
 
-        value = Encoding.UTF8.GetString(buffer[..length]);
+        // A switch validates the same bytes but does not need a managed name.
+        // Only sceFiberGetInfo exposes the decoded name to its caller.
+        value = decode ? Encoding.UTF8.GetString(buffer[..length]) : string.Empty;
         return true;
     }
 
@@ -1117,10 +1124,7 @@ public static class FiberExports
 
     private static void TraceFiber(string message)
     {
-        if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_FIBER"), "1", StringComparison.Ordinal))
-        {
-            Console.Error.WriteLine($"[LOADER][TRACE] fiber.{message}");
-        }
+        Console.Error.WriteLine($"[LOADER][TRACE] fiber.{message}");
     }
 
     private readonly record struct FiberFields(

src/SharpEmu.Libs/Font/FontExports.cs

@@ -3,8 +3,9 @@
 
 using System.Buffers.Binary;
 using System.Collections.Concurrent;
-using System.Runtime.InteropServices;
+using System.Text;
 using SharpEmu.HLE;
+using SkiaSharp;
 
 namespace SharpEmu.Libs.Font;
 
@@ -18,8 +19,38 @@ public static class FontExports
     private static readonly Stack<ulong> FreeGlyphs = new();
     private static ulong _librarySelectionAddress;
     private static ulong _rendererSelectionAddress;
-    private static readonly ConcurrentDictionary<ulong, float> FontHeights = new();
-    private static readonly Lazy<byte[]?> BitmapFont = new(LoadBitmapFont);
+    private static readonly ConcurrentDictionary<ulong, (float Width, float Height)> FontScales = new();
+    private static readonly ConcurrentDictionary<ulong, FontFace> FontFaces = new();
+    private static readonly Lazy<FontFace> DefaultFont = new(() => new(SKTypeface.FromFamilyName(null)));
+
+    [SysAbiExport(
+        Nid = "oaJ1BpN2FQk",
+        ExportName = "sceFontTextSourceInit",
+        Target = Generation.Gen5,
+        LibraryName = "libSceFont")]
+    public static int TextSourceInit(CpuContext ctx)
+    {
+        var sourceAddress = ctx[CpuRegister.Rdi];
+        var textAddress = ctx[CpuRegister.Rsi];
+        var textSize = (uint)ctx[CpuRegister.Rdx];
+        if (sourceAddress == 0 || textAddress > ulong.MaxValue - textSize)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Span<byte> source = stackalloc byte[0x60];
+        source.Clear();
+        BinaryPrimitives.WriteUInt64LittleEndian(source[0x08..], textAddress);
+        BinaryPrimitives.WriteUInt64LittleEndian(source[0x10..], textAddress == 0 ? 0 : textAddress + textSize);
+        BinaryPrimitives.WriteUInt64LittleEndian(source[0x18..], textAddress);
+        BinaryPrimitives.WriteUInt64LittleEndian(source[0x20..], ctx[CpuRegister.Rcx]);
+        BinaryPrimitives.WriteUInt64LittleEndian(source[0x28..], ctx[CpuRegister.R8]);
+        BinaryPrimitives.WriteUInt64LittleEndian(source[0x38..], 0x10);
+        BinaryPrimitives.WriteUInt64LittleEndian(source[0x40..], textSize);
+        return ctx.Memory.TryWrite(sourceAddress, source)
+            ? SetSuccess(ctx)
+            : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
 
     [SysAbiExport(
         Nid = "whrS4oksXc4",
@@ -156,13 +187,14 @@ public static class FontExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
-        // Baseline, line advance, decoration extent: scaled to the font's
-        // current pixel height, matching the ascent convention (height * 0.75)
-        // used by glyph metrics and the rasterizer. A font never given a
-        // scale falls back to the default height of 16, reproducing the
-        // original fixed geometry.
-        var fontHeight = GetFontHeight(ctx[CpuRegister.Rdi]);
-        var values = new[] { fontHeight * 0.75f, (float)fontHeight, 0.0f };
+        var fontHandle = ctx[CpuRegister.Rdi];
+        var scale = GetFontScale(fontHandle);
+        float[] values = [scale.Height * 0.75f, scale.Height, 0];
+        if (FontFaces.TryGetValue(fontHandle, out var face))
+        {
+            var metrics = face.GetMetrics(scale.Width, scale.Height);
+            values = [-metrics.Ascent, metrics.Descent - metrics.Ascent + metrics.Leading, 0];
+        }
         for (var index = 0; index < values.Length; index++)
         {
             if (!TryWriteUInt32(
@@ -199,8 +231,8 @@ public static class FontExports
         // interpreted for vertical writing (e.g. CJK text rendered top-to-bottom).
         // Scaled to the font's current pixel height; the default height of 16
         // reproduces the original fixed geometry.
-        var fontHeight = GetFontHeight(ctx[CpuRegister.Rdi]);
-        var values = new[] { fontHeight * 0.5f, (float)fontHeight, 0.0f };
+        var scale = GetFontScale(ctx[CpuRegister.Rdi]);
+        var values = new[] { scale.Width * 0.5f, scale.Width, 0.0f };
         for (var index = 0; index < values.Length; index++)
         {
             if (!TryWriteUInt32(
@@ -220,16 +252,64 @@ public static class FontExports
         ExportName = "sceFontOpenFontSet",
         Target = Generation.Gen5,
         LibraryName = "libSceFont")]
-    public static int OpenFontSet(CpuContext ctx) =>
-        CreateOpaqueHandle(ctx, ctx[CpuRegister.R8], 0x100, magic: 0x0F02);
+    public static int OpenFontSet(CpuContext ctx)
+    {
+        var fontSet = (uint)ctx[CpuRegister.Rsi];
+        var bold = (fontSet & 0xf) >= 7;
+        var italic = ((fontSet >> 20) & 0xf) == 1;
+        var style = bold ? (italic ? SKFontStyle.BoldItalic : SKFontStyle.Bold) :
+            (italic ? SKFontStyle.Italic : SKFontStyle.Normal);
+        return OpenFace(ctx, new(SKTypeface.FromFamilyName(null, style)));
+    }
 
     [SysAbiExport(
         Nid = "KXUpebrFk1U",
         ExportName = "sceFontOpenFontMemory",
         Target = Generation.Gen5,
         LibraryName = "libSceFont")]
-    public static int OpenFontMemory(CpuContext ctx) =>
-        CreateOpaqueHandle(ctx, ctx[CpuRegister.R8], 0x100, magic: 0x0F02);
+    public static int OpenFontMemory(CpuContext ctx)
+    {
+        var address = ctx[CpuRegister.Rsi];
+        var size = (uint)ctx[CpuRegister.Rdx];
+        if (address == 0 || size is < 12 or > 64 * 1024 * 1024 || ctx[CpuRegister.R8] == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+        if (!ctx.Memory.CanRead(address, size))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+        var bytes = new byte[(int)size];
+        if (!ctx.Memory.TryRead(address, bytes))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+        uint index = 0;
+        if (ctx[CpuRegister.Rcx] != 0 && !ctx.TryReadUInt32(ctx[CpuRegister.Rcx] + 8, out index))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+        if (index > int.MaxValue)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+        using var data = SKData.CreateCopy(bytes);
+        var typeface = SKTypeface.FromData(data, (int)index);
+        return typeface is null
+            ? SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT)
+            : OpenFace(ctx, new(typeface));
+    }
+
+    private static int OpenFace(CpuContext ctx, FontFace face)
+    {
+        var result = CreateOpaqueHandle(ctx, ctx[CpuRegister.R8], 0x100, magic: 0x0F02);
+        if (result == 0 && ctx.TryReadUInt64(ctx[CpuRegister.R8], out var handle))
+        {
+            FontFaces[handle] = face;
+            FontScales.TryRemove(handle, out _);
+        }
+        return result;
+    }
 
     [SysAbiExport(
         Nid = "JzCH3SCFnAU",
@@ -248,6 +328,8 @@ public static class FontExports
 
         if (setupHandle != 0)
         {
+            if (FontFaces.TryGetValue(sourceHandle, out var face)) FontFaces[setupHandle] = face;
+            FontScales[setupHandle] = GetFontScale(sourceHandle);
             return ctx.TryWriteUInt64(outputAddress, setupHandle)
                 ? SetSuccess(ctx)
                 : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
@@ -268,6 +350,8 @@ public static class FontExports
         }
 
         _ = TryWriteUInt16(ctx, handle, 0x0F02);
+        if (FontFaces.TryGetValue(sourceHandle, out var sourceFace)) FontFaces[handle] = sourceFace;
+        FontScales[handle] = GetFontScale(sourceHandle);
         return ctx.TryWriteUInt64(outputAddress, handle)
             ? SetSuccess(ctx)
             : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
@@ -307,7 +391,9 @@ public static class FontExports
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
-        return WriteGlyphMetrics(ctx, metricsAddress, GetFontHeight(ctx[CpuRegister.Rdi]))
+        var code = (uint)ctx[CpuRegister.Rsi];
+        if (!IsValidCode(code)) return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        return WriteGlyphMetrics(ctx, metricsAddress, GetGlyph(ctx[CpuRegister.Rdi], code), GetFontScale(ctx[CpuRegister.Rdi]).Height)
             ? SetSuccess(ctx)
             : SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
     }
@@ -466,15 +552,14 @@ public static class FontExports
         var surfaceAddress = ctx[CpuRegister.Rdx];
         var metricsAddress = ctx[CpuRegister.Rcx];
         var resultAddress = ctx[CpuRegister.R8];
-        var height = GetFontHeight(ctx[CpuRegister.Rdi]);
-        var width = Math.Clamp((height + 1) / 2, 4, 128);
-        var rows = BitmapFont.Value;
-        if (rows is null)
-        {
-            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
-        }
+        var font = ctx[CpuRegister.Rdi];
+        var code = (uint)ctx[CpuRegister.Rsi];
+        if (!IsValidCode(code)) return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        var glyph = GetGlyph(font, code);
+        var width = glyph.Width;
+        var height = glyph.Height;
 
-        if (metricsAddress != 0 && !WriteGlyphMetrics(ctx, metricsAddress, height))
+        if (metricsAddress != 0 && !WriteGlyphMetrics(ctx, metricsAddress, glyph, GetFontScale(font).Height))
         {
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
@@ -483,8 +568,8 @@ public static class FontExports
         ctx.GetXmmRegister(1, out var yBits, out _);
         var x = BitConverter.UInt32BitsToSingle((uint)xBits);
         var y = BitConverter.UInt32BitsToSingle((uint)yBits);
-        var left = float.IsFinite(x) ? Math.Max((int)x, 0) : 0;
-        var top = float.IsFinite(y) ? Math.Max((int)(y - height * 0.75f), 0) : 0;
+        var left = float.IsFinite(x) ? (int)MathF.Floor(x + glyph.BearingX) : 0;
+        var top = float.IsFinite(y) ? (int)MathF.Floor(y - glyph.BearingY) : 0;
 
         ulong buffer = 0;
         uint pitch = 0;
@@ -501,13 +586,14 @@ public static class FontExports
                 BinaryPrimitives.WriteUInt32LittleEndian(result[16..], pitch);
                 result[20] = (byte)pixelSize;
             }
-            BinaryPrimitives.WriteUInt32LittleEndian(result[24..], (uint)left);
-            BinaryPrimitives.WriteUInt32LittleEndian(result[28..], (uint)top);
-            BinaryPrimitives.WriteUInt32LittleEndian(result[32..], (uint)width);
-            BinaryPrimitives.WriteUInt32LittleEndian(result[36..], (uint)height);
-            BinaryPrimitives.WriteSingleLittleEndian(result[44..], height * 0.75f);
-            BinaryPrimitives.WriteSingleLittleEndian(result[48..], width);
-            BinaryPrimitives.WriteSingleLittleEndian(result[52..], width);
+            BinaryPrimitives.WriteUInt32LittleEndian(result[24..], (uint)Math.Max(left, 0));
+            BinaryPrimitives.WriteUInt32LittleEndian(result[28..], (uint)Math.Max(top, 0));
+            BinaryPrimitives.WriteUInt32LittleEndian(result[32..], (uint)Math.Max(width + Math.Min(left, 0), 0));
+            BinaryPrimitives.WriteUInt32LittleEndian(result[36..], (uint)Math.Max(height + Math.Min(top, 0), 0));
+            BinaryPrimitives.WriteSingleLittleEndian(result[40..], glyph.BearingX);
+            BinaryPrimitives.WriteSingleLittleEndian(result[44..], glyph.BearingY);
+            BinaryPrimitives.WriteSingleLittleEndian(result[48..], glyph.Advance);
+            BinaryPrimitives.WriteSingleLittleEndian(result[52..], glyph.Advance);
             BinaryPrimitives.WriteUInt32LittleEndian(result[56..], (uint)width);
             BinaryPrimitives.WriteUInt32LittleEndian(result[60..], (uint)height);
             if (!ctx.Memory.TryWrite(resultAddress, result))
@@ -516,7 +602,7 @@ public static class FontExports
             }
         }
 
-        if (surfaceAddress != 0 && !DrawGlyph(ctx, surfaceAddress, (uint)ctx[CpuRegister.Rsi], left, top, width, height, rows))
+        if (surfaceAddress != 0 && !DrawGlyph(ctx, surfaceAddress, left, top, width, height, glyph.Coverage))
         {
             return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
@@ -526,23 +612,34 @@ public static class FontExports
 
     private static int SetFontHeight(CpuContext ctx)
     {
+        ctx.GetXmmRegister(0, out var widthBits, out _);
         ctx.GetXmmRegister(1, out var heightBits, out _);
+        var width = BitConverter.UInt32BitsToSingle((uint)widthBits);
         var height = BitConverter.UInt32BitsToSingle((uint)heightBits);
         if (float.IsFinite(height) && height > 1)
         {
-            FontHeights[ctx[CpuRegister.Rdi]] = Math.Clamp((int)(height + 0.5f), 8, 128);
+            FontScales[ctx[CpuRegister.Rdi]] = (
+                float.IsFinite(width) && width > 1 ? Math.Clamp(width, 8, 128) : Math.Clamp(height, 8, 128),
+                Math.Clamp(height, 8, 128));
         }
         return SetSuccess(ctx);
     }
 
-    private static int GetFontHeight(ulong font) =>
-        FontHeights.TryGetValue(font, out var height) ? (int)height : 16;
+    private static (float Width, float Height) GetFontScale(ulong font) =>
+        FontScales.TryGetValue(font, out var scale) ? scale : (16, 16);
 
-    private static bool WriteGlyphMetrics(CpuContext ctx, ulong address, int height)
+    private static bool IsValidCode(uint code) => (code & 0xffff0000) == 0x80000000 || Rune.IsValid((int)code);
+
+    private static FontGlyph GetGlyph(ulong font, uint code)
+    {
+        var scale = GetFontScale(font);
+        return (FontFaces.TryGetValue(font, out var face) ? face : DefaultFont.Value).GetGlyph(code, scale.Width, scale.Height);
+    }
+
+    private static bool WriteGlyphMetrics(CpuContext ctx, ulong address, FontGlyph glyph, float height)
     {
-        var width = Math.Clamp((height + 1) / 2, 4, 128);
         Span<byte> metrics = stackalloc byte[32];
-        float[] values = [width, height, 0, height * 0.75f, width, 0, 0, height];
+        float[] values = [glyph.Width, glyph.Height, glyph.BearingX, glyph.BearingY, glyph.Advance, 0, 0, height];
         for (var index = 0; index < values.Length; index++)
         {
             BinaryPrimitives.WriteSingleLittleEndian(metrics[(index * 4)..], values[index]);
@@ -550,8 +647,8 @@ public static class FontExports
         return ctx.Memory.TryWrite(address, metrics);
     }
 
-    internal static bool DrawGlyph(CpuContext ctx, ulong surface, uint code, int left, int top,
-        int glyphWidth, int glyphHeight, byte[] font)
+    internal static bool DrawGlyph(CpuContext ctx, ulong surface, int left, int top,
+        int glyphWidth, int glyphHeight, byte[] coverage)
     {
         if (!ctx.TryReadUInt64(surface, out var buffer) ||
             !ctx.TryReadUInt32(surface + 8, out var pitch) ||
@@ -571,7 +668,6 @@ public static class FontExports
             return true;
         }
 
-        code = code < 256 ? code : (uint)'?';
         var x0 = Math.Max(left, (int)Math.Min(sx0, width));
         var y0 = Math.Max(top, (int)Math.Min(sy0, height));
         var x1 = Math.Min(left + glyphWidth, (int)Math.Min(sx1, width));
@@ -591,11 +687,12 @@ public static class FontExports
             }
             for (var xx = x0; xx < x1; xx++)
             {
-                var sourceY = (yy - top) * 16 / glyphHeight;
-                var sourceX = (xx - left) * 8 / glyphWidth;
-                if ((font[code * 16 + sourceY] & (0x80 >> sourceX)) != 0)
+                var alpha = coverage[(yy - top) * glyphWidth + xx - left];
+                if (alpha != 0)
                 {
-                    line.AsSpan((xx - x0) * (int)pixelSize, (int)pixelSize).Fill(0xff);
+                    var pixel = line.AsSpan((xx - x0) * (int)pixelSize, (int)pixelSize);
+                    for (var component = 0; component < pixel.Length; component++)
+                        pixel[component] = (byte)(alpha + (pixel[component] * (255 - alpha) + 127) / 255);
                 }
             }
             if (!ctx.Memory.TryWrite(address, line))
@@ -606,25 +703,17 @@ public static class FontExports
         return true;
     }
 
-    private static byte[]? LoadBitmapFont()
-    {
-        var library = Path.Combine(AppContext.BaseDirectory, "plugins", "avutil-59.dll");
-        if (!NativeLibrary.TryLoad(library, out var handle) ||
-            !NativeLibrary.TryGetExport(handle, "avpriv_vga16_font", out var data))
-        {
-            return null;
-        }
-        var font = new byte[4096];
-        Marshal.Copy(data, font, 0, font.Length);
-        return font;
-    }
-
     [SysAbiExport(
         Nid = "vzHs3C8lWJk",
         ExportName = "sceFontCloseFont",
         Target = Generation.Gen5,
         LibraryName = "libSceFont")]
-    public static int CloseFont(CpuContext ctx) => SetSuccess(ctx);
+    public static int CloseFont(CpuContext ctx)
+    {
+        FontFaces.TryRemove(ctx[CpuRegister.Rdi], out _);
+        FontScales.TryRemove(ctx[CpuRegister.Rdi], out _);
+        return SetSuccess(ctx);
+    }
 
     [SysAbiExport(
         Nid = "1QjhKxrsOB8",

src/SharpEmu.Libs/Font/FontFace.cs

@@ -0,0 +1,74 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Collections.Concurrent;
+using System.Runtime.InteropServices;
+using SkiaSharp;
+
+namespace SharpEmu.Libs.Font;
+
+internal sealed class FontFace(SKTypeface typeface)
+{
+    private readonly ConcurrentDictionary<(uint Code, float Width, float Height), FontGlyph> _glyphs = new();
+
+    public SKFontMetrics GetMetrics(float width, float height)
+    {
+        using var font = CreateFont(width, height);
+        return font.Metrics;
+    }
+
+    public FontGlyph GetGlyph(uint code, float width, float height)
+    {
+        // ponytail: bounded working set; clearing avoids retaining every glyph at every scale.
+        if (_glyphs.Count >= 1024) _glyphs.Clear();
+        return _glyphs.GetOrAdd((code, width, height), key => Rasterize(key.Code, key.Width, key.Height));
+    }
+
+    private SKFont CreateFont(float width, float height) => new(typeface, height, width / height)
+    {
+        Edging = SKFontEdging.Antialias,
+        Subpixel = false,
+    };
+
+    private FontGlyph Rasterize(uint code, float width, float height)
+    {
+        using var font = CreateFont(width, height);
+        var glyph = (code & 0x80000000) != 0 ? (ushort)code : font.GetGlyph((int)code);
+        if (glyph == 0 && (code & 0x80000000) == 0)
+        {
+            // System font sets span multiple faces. Resolve by Unicode coverage, not language.
+            var fallback = SKFontManager.Default.MatchCharacter(typeface.FamilyName, typeface.FontStyle, null, (int)code);
+            if (fallback is not null)
+            {
+                font.Typeface = fallback;
+                glyph = font.GetGlyph((int)code);
+            }
+        }
+
+        ReadOnlySpan<ushort> glyphs = [glyph];
+        var advance = font.MeasureText(glyphs, out var bounds);
+        var left = (int)MathF.Floor(bounds.Left);
+        var top = (int)MathF.Floor(bounds.Top);
+        var bitmapWidth = (int)MathF.Ceiling(bounds.Right) - left;
+        var bitmapHeight = (int)MathF.Ceiling(bounds.Bottom) - top;
+        if (bitmapWidth <= 0 || bitmapHeight <= 0)
+        {
+            return new(0, 0, left, -top, advance, []);
+        }
+
+        using var bitmap = new SKBitmap(bitmapWidth, bitmapHeight, SKColorType.Alpha8, SKAlphaType.Premul);
+        using var canvas = new SKCanvas(bitmap);
+        using var paint = new SKPaint { Color = SKColors.White, IsAntialias = true };
+        using var blob = SKTextBlob.Create(MemoryMarshal.AsBytes(glyphs), SKTextEncoding.GlyphId, font);
+        canvas.Clear(SKColors.Transparent);
+        canvas.DrawText(blob!, -left, -top, paint);
+        var coverage = new byte[bitmapWidth * bitmapHeight];
+        for (var row = 0; row < bitmapHeight; row++)
+        {
+            Marshal.Copy(bitmap.GetPixels() + row * bitmap.RowBytes, coverage, row * bitmapWidth, bitmapWidth);
+        }
+        return new(bitmapWidth, bitmapHeight, left, -top, advance, coverage);
+    }
+}
+
+internal sealed record FontGlyph(int Width, int Height, float BearingX, float BearingY, float Advance, byte[] Coverage);

src/SharpEmu.Libs/Gpu/Buffers/BdaFaultProcessor.cs

@@ -17,6 +17,7 @@ public sealed unsafe class BdaFaultProcessor : IDisposable
     private const uint MaxPageFaults = 1024;
     private const ulong PageFaultAreaSize = MaxPageFaults * sizeof(ulong);
 
+    private static long _reportedFaults;
     private readonly GpuDeviceInfo _device;
     private readonly SubmissionScheduler _scheduler;
     private readonly GuestBufferCache _cache;
@@ -249,7 +250,11 @@ public sealed unsafe class BdaFaultProcessor : IDisposable
                 if (SharpEmu.HLE.GpuMemory.GuestGpuMemoryHook.Traces(faults[index], _pageSize))
                     SharpEmu.HLE.GpuMemory.GuestGpuMemoryHook.Trace(faults[index], _pageSize,
                         $"device-address-fault scan_tick={scanTick} callback_tick={_scheduler.CurrentTick} registered={_cache.IsRegionRegistered(faults[index], _pageSize)} reported_count={(uint)faults[0]} retained_count={count}");
-                Console.Error.WriteLine($"[GPU][INFO] Accessed non-GPU cached memory at 0x{faults[index]:X16}");
+                var reported = Interlocked.Increment(ref _reportedFaults);
+                if (reported <= 16 || (reported & (reported - 1)) == 0)
+                {
+                    Console.Error.WriteLine($"[GPU][INFO] Accessed non-GPU cached memory at 0x{faults[index]:X16} count={reported}");
+                }
             }
 
             _faultRanges.ForEach((start, size) =>

src/SharpEmu.Libs/Gpu/Buffers/GpuBuffer.cs

@@ -285,6 +285,19 @@ public unsafe class GpuBuffer : IDisposable
             0, null, 1, &after, 0, null);
     }
 
+    private int _foreignReads;
+    private int _disposeDeferred;
+
+    public void RetainForeignRead() => Interlocked.Increment(ref _foreignReads);
+
+    public void ReleaseForeignRead()
+    {
+        if (Interlocked.Decrement(ref _foreignReads) == 0 && Interlocked.Exchange(ref _disposeDeferred, 0) != 0)
+        {
+            Dispose();
+        }
+    }
+
     public void Dispose()
     {
         if (_handle.Handle == 0)
@@ -292,6 +305,15 @@ public unsafe class GpuBuffer : IDisposable
             return;
         }
 
+        if (Volatile.Read(ref _foreignReads) != 0)
+        {
+            Volatile.Write(ref _disposeDeferred, 1);
+            if (Volatile.Read(ref _foreignReads) != 0 || Interlocked.Exchange(ref _disposeDeferred, 0) == 0)
+            {
+                return;
+            }
+        }
+
         _device.Vk.DestroyBuffer(_device.Device, _handle, null);
         if (_slab is { } slab)
         {

src/SharpEmu.Libs/Gpu/Buffers/GuestBufferCache.cs

@@ -47,6 +47,7 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
     private readonly GpuBuffer _bdaPageTable;
     private readonly GuestBufferRegistry<GpuBuffer> _registry = new(CachingPageSize, PageOwnerTable.AddressSpaceSize);
     private readonly SpanSet _gpuModifiedRanges = new();
+    private long _gpuModifiedVersion;
     private readonly GuestPageTracker _tracker;
     private readonly GpuRingBuffer _staging;
     private readonly GpuRingBuffer _stream;
@@ -240,7 +241,18 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
         if (isWritten)
         {
             buffer.NoteGpuWrite();
-            _gpuModifiedRanges.Add(guestAddress, size);
+            if (Diagnostics.DccWriterTrace.Enabled)
+            {
+                Diagnostics.DccWriterTrace.Record(RequireImageCache(), guestAddress, size);
+            }
+
+            if (!_gpuModifiedRanges.Contains(guestAddress, size))
+            {
+                _gpuModifiedRanges.Add(guestAddress, size);
+                Interlocked.Increment(ref _gpuModifiedVersion);
+            }
+
+            NoteHotWindowWrite(guestAddress, size);
         }
 
         return (buffer, buffer.Offset(guestAddress));
@@ -307,14 +319,10 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
         }
 
         TouchBuffer(owner);
-        var uploads = new List<(ulong Address, ulong Size)>();
-        _tracker.ForEachUploadRange(guestAddress, size, false, (address, uploadSize) => uploads.Add((address, uploadSize)), () =>
-        {
-            foreach (var (address, uploadSize) in uploads)
-            {
-                owner.CopyFrom(_scheduler.Current, _staging, stageOffset + address - guestAddress, owner.Offset(address), uploadSize, AccessFlags.HostWriteBit);
-            }
-        });
+        // Tracking reports whole dirty pages, which can extend beyond the image's
+        // staging slice. Upload those pages through the normal buffer uploader so
+        // every byte marked clean is copied from its actual guest backing.
+        _ = SynchronizeBuffer(owner, guestAddress, size, false, false);
         return (owner, owner.Offset(guestAddress));
     }
 
@@ -330,8 +338,11 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
             throw SubmissionScheduler.Fatal($"Could not write the required direct backing: addr=0x{guestAddress:X16} size=0x{data.Length:X16}");
         }
 
+        // Registered buffers are ordered and disjoint: walk only the ones the write overlaps.
         var end = guestAddress + (ulong)data.Length;
-        for (var index = 0; index < _registry.RegisteredCount; index++)
+        for (var index = _registry.FindFirstOverlappingIndex(guestAddress);
+             index < _registry.RegisteredCount && _registry.GetRegisteredAddress(index) < end;
+             index++)
         {
             var address = _registry.GetRegisteredAddress(index);
             var bufferIdentifier = _registry.GetRegisteredIdentifier(index);
@@ -381,9 +392,10 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
                 images.InvalidateMemory(guestAddress, size);
             }
 
-            var values = new uint[4096];
-            Array.Fill(values, value);
-            var bytes = MemoryMarshal.AsBytes<uint>(values);
+            // Labels and small clears dominate; fill a stack chunk once and repeat it.
+            Span<uint> values = stackalloc uint[(int)Math.Min(size / sizeof(uint), 1024UL)];
+            values.Fill(value);
+            var bytes = MemoryMarshal.AsBytes(values);
             for (ulong offset = 0; offset < size;)
             {
                 var chunk = (int)Math.Min(size - offset, (ulong)bytes.Length);
@@ -398,6 +410,120 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
         var bufferIdentifier = FindBuffer(guestAddress, size);
         var (destination, destinationOffset) = ObtainBuffer(guestAddress, size, true, true, bufferIdentifier);
         destination.Fill(destinationOffset, size, value);
+        if (images.OverlapsDccMetadata(guestAddress, size) && TryWriteFillToBacking(guestAddress, size, value))
+        {
+            _gpuModifiedRanges.Remove(guestAddress, size);
+            var firstPage = guestAddress & ~(TrackerLayout.PageBytes - 1);
+            for (var page = firstPage; page < guestAddress + size; page += TrackerLayout.PageBytes)
+            {
+                if (!_gpuModifiedRanges.Overlaps(page, TrackerLayout.PageBytes))
+                {
+                    _tracker.ClearGpuDirtyPages(page, TrackerLayout.PageBytes);
+                }
+            }
+        }
+    }
+
+    public void FillDccMetadata(ulong guestAddress, ulong size, uint value)
+    {
+        if (guestAddress == 0 || (guestAddress & 3) != 0 || size == 0 || (size & 3) != 0 || size > ulong.MaxValue - guestAddress ||
+            HasGpuDirtyBytes(guestAddress, size) || RequireImageCache().QueryRegion(guestAddress, size).ImageBytes)
+        {
+            FillBuffer(guestAddress, size, value, false);
+            return;
+        }
+
+        var (destination, destinationOffset) = ObtainBuffer(guestAddress, size, false, false, FindBuffer(guestAddress, size));
+        destination.Fill(destinationOffset, size, value);
+        if (!TryWriteFillToBacking(guestAddress, size, value))
+        {
+            FillBuffer(guestAddress, size, value, false);
+        }
+    }
+
+    private bool TryWriteFillToBacking(ulong guestAddress, ulong size, uint value)
+    {
+        var values = new uint[(int)Math.Min(size / sizeof(uint), 4096)];
+        Array.Fill(values, value);
+        var bytes = MemoryMarshal.AsBytes<uint>(values);
+        for (ulong offset = 0; offset < size;)
+        {
+            var chunk = (int)Math.Min(size - offset, (ulong)bytes.Length);
+            if (!_backing.TryWriteBacking(guestAddress + offset, bytes[..chunk]))
+            {
+                return false;
+            }
+
+            offset += (ulong)chunk;
+        }
+
+        return true;
+    }
+
+    public const ulong MaxHostCopyWords = 64 * 1024;
+
+    public bool TryCopyWordsOnHost(ulong destination, ulong source, ulong sourceWords, ulong words)
+    {
+        if (destination == 0 || source == 0 || sourceWords == 0 || words == 0 || ((destination | source) & 3) != 0 ||
+            words > MaxHostCopyWords || sourceWords > MaxHostCopyWords)
+        {
+            return false;
+        }
+
+        var size = words * sizeof(uint);
+        var sourceSize = Math.Min(sourceWords, words) * sizeof(uint);
+        if (size > ulong.MaxValue - destination || sourceSize > ulong.MaxValue - source ||
+            (source < destination + size && destination < source + sourceSize))
+        {
+            return false;
+        }
+
+        var images = RequireImageCache();
+        var sourceRegion = images.QueryRegion(source, sourceSize);
+        var destinationRegion = images.QueryRegion(destination, size);
+        if (HasGpuDirtyBytes(source, sourceSize) || HasGpuDirtyBytes(destination, size) ||
+            sourceRegion.GpuImageBytes || destinationRegion.GpuImageBytes)
+        {
+            return false;
+        }
+
+        var pattern = System.Buffers.ArrayPool<byte>.Shared.Rent((int)sourceSize);
+        var chunk = System.Buffers.ArrayPool<byte>.Shared.Rent((int)Math.Min(size, 64UL * 1024));
+        try
+        {
+            if (!_backing.TryReadBacking(source, pattern.AsSpan(0, (int)sourceSize)))
+            {
+                return false;
+            }
+
+            if (destinationRegion.ImageBytes)
+            {
+                images.InvalidateMemory(destination, size);
+            }
+
+            var chunkLength = (ulong)(chunk.Length - chunk.Length % sizeof(uint));
+            for (ulong offset = 0; offset < size;)
+            {
+                var length = (int)Math.Min(size - offset, chunkLength);
+                for (var filled = 0; filled < length;)
+                {
+                    var patternOffset = (int)((offset + (ulong)filled) % sourceSize);
+                    var copied = Math.Min(length - filled, (int)sourceSize - patternOffset);
+                    pattern.AsSpan(patternOffset, copied).CopyTo(chunk.AsSpan(filled, copied));
+                    filled += copied;
+                }
+
+                WriteHostMemory(destination + offset, chunk.AsSpan(0, length));
+                offset += (ulong)length;
+            }
+
+            return true;
+        }
+        finally
+        {
+            System.Buffers.ArrayPool<byte>.Shared.Return(pattern);
+            System.Buffers.ArrayPool<byte>.Shared.Return(chunk);
+        }
     }
 
     public void CopyBuffer(ulong dstVaddr, ulong srcVaddr, ulong size, bool dstGds, bool srcGds)
@@ -425,17 +551,24 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
                 images.InvalidateMemory(dstVaddr, size);
             }
 
-            var bytes = new byte[64 * 1024];
-            for (ulong offset = 0; offset < size;)
+            var bytes = System.Buffers.ArrayPool<byte>.Shared.Rent((int)Math.Min(size, 64UL * 1024));
+            try
             {
-                var chunk = (int)Math.Min(size - offset, (ulong)bytes.Length);
-                if (!_backing.TryReadBacking(srcVaddr + offset, bytes.AsSpan(0, chunk)))
+                for (ulong offset = 0; offset < size;)
                 {
-                    throw SubmissionScheduler.Fatal("The host DMA source has no direct backing.");
-                }
+                    var chunk = (int)Math.Min(size - offset, (ulong)bytes.Length);
+                    if (!_backing.TryReadBacking(srcVaddr + offset, bytes.AsSpan(0, chunk)))
+                    {
+                        throw SubmissionScheduler.Fatal("The host DMA source has no direct backing.");
+                    }
 
-                WriteHostMemory(dstVaddr + offset, bytes.AsSpan(0, chunk));
-                offset += (ulong)chunk;
+                    WriteHostMemory(dstVaddr + offset, bytes.AsSpan(0, chunk));
+                    offset += (ulong)chunk;
+                }
+            }
+            finally
+            {
+                System.Buffers.ArrayPool<byte>.Shared.Return(bytes);
             }
 
             return;
@@ -474,6 +607,8 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
 
     public bool HasGpuDirtyBytes(ulong guestAddress, ulong size) => _gpuModifiedRanges.Overlaps(guestAddress, size);
 
+    public long GpuModifiedVersion => Volatile.Read(ref _gpuModifiedVersion);
+
     public bool HasCpuDirtyPages(ulong guestAddress, ulong size) => _tracker.HasCpuDirtyPages(guestAddress, size);
 
     public void ProcessFaultBuffer() => _faults.ProcessFaultBuffer();
@@ -488,7 +623,21 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
     private ulong _bdaTouchTick = ulong.MaxValue;
     private ulong _bdaTouchMapping;
 
+    public static ulong MappingKey(IReadOnlyCollection<GuestSpan> spans)
+    {
+        var mapping = (ulong)spans.Count;
+        foreach (var span in spans)
+            mapping = (mapping ^ span.Address ^ (span.Size << 17)) * 0x100000001B3UL;
+        return mapping;
+    }
+
     public void PrepareBda(IEnumerable<GuestSpan> mapped)
+    {
+        var spans = mapped as IReadOnlyCollection<GuestSpan> ?? mapped.ToList();
+        PrepareBda(spans, MappingKey(spans));
+    }
+
+    public void PrepareBda(IReadOnlyCollection<GuestSpan> mapped, ulong mapping)
     {
         var traceAddress = GuestGpuMemoryHook.TraceAddress;
         var traceCovered = false;
@@ -503,10 +652,7 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
         }
         else
         {
-            var spans = mapped as IReadOnlyCollection<GuestSpan> ?? mapped.ToList();
-            var mapping = (ulong)spans.Count;
-            foreach (var span in spans)
-                mapping = (mapping ^ span.Address ^ (span.Size << 17)) * 0x100000001B3UL;
+            var spans = mapped;
             if (_retirementPolicy.CurrentTick != _bdaTouchTick || mapping != _bdaTouchMapping)
             {
                 foreach (var span in spans)
@@ -515,8 +661,14 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
                 _bdaTouchMapping = mapping;
             }
 
-            foreach (var span in spans)
-                _tracker.ForEachPossiblyCpuDirtyRange(span.Address, span.Size, _uploadDirtyBuffersInRange ??= UploadDirtyBuffersInRange);
+            var epoch = _tracker.CpuDirtyEpoch;
+            if (epoch != _bdaSweepEpoch || mapping != _bdaSweepMapping)
+            {
+                foreach (var span in spans)
+                    _tracker.ForEachPossiblyCpuDirtyRange(span.Address, span.Size, _uploadDirtyBuffersInRange ??= UploadDirtyBuffersInRange);
+                _bdaSweepEpoch = epoch;
+                _bdaSweepMapping = mapping;
+            }
         }
 
         if (traceAddress != 0)
@@ -526,6 +678,8 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
     }
 
     private Action<ulong, ulong>? _uploadDirtyBuffersInRange;
+    private long _bdaSweepEpoch = -1;
+    private ulong _bdaSweepMapping;
 
     private void TouchBuffersInRange(ulong guestAddress, ulong size)
     {
@@ -545,7 +699,7 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
             var buffer = _registry.GetBuffer(_registry.GetRegisteredIdentifier(index));
             var start = Math.Max(buffer.CpuAddress, guestAddress);
             var finish = Math.Min(buffer.CpuAddress + buffer.Size, end);
-            if (start < finish && _tracker.HasCpuDirtyPages(start, finish - start))
+            if (start < finish && _tracker.MayHaveCpuDirtyPages(start, finish - start))
                 _ = SynchronizeBuffer(buffer, start, finish - start, false, false, preserveCpuWriteHotPages: false);
         }
     }
@@ -659,6 +813,7 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
         var drained = false;
         try
         {
+            AbandonEagerReadbacks();
             if (_scheduler.Active)
             {
                 _scheduler.Finish();
@@ -741,11 +896,230 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
                 $"unsupported buffer readback from an asynchronous GPU completion, addr=0x{guestAddress:X16} size=0x{size:X16}");
         }
 
-        if (_relay.TryRunOnGpuQueue(() => ReadMemoryOnGpu(guestAddress, size, isWrite, source)))
+        if (!_relay.IsGpuQueueThread && AsyncReadback is { } readback && GuestReadsAwaitOffQueue)
+        {
+            PendingDownload? pending = null;
+            if (_relay.TryRunOnGpuQueue(() => pending = BeginReadMemoryOnGpu(guestAddress, size, isWrite, source, allowPending: true)))
+            {
+                if (pending is null)
+                {
+                    return true;
+                }
+
+                readback.Wait(pending.Ticket);
+                if (_relay.TryRunOnGpuQueue(() => CompleteReadMemoryOnGpu(pending, retrySynchronously: true)))
+                {
+                    return true;
+                }
+            }
+
+            return AwaitShutdown();
+        }
+
+        var onQueue = _relay.IsGpuQueueThread;
+        if (_relay.TryRunOnGpuQueue(() =>
+            {
+                if (!onQueue || isWrite || !TryUseEagerReadback(guestAddress, size))
+                {
+                    _ = BeginReadMemoryOnGpu(guestAddress, size, isWrite, source, allowPending: false, markHot: onQueue);
+                }
+            }))
         {
             return true;
         }
 
+        return AwaitShutdown();
+    }
+
+    private const ulong ReadbackWindowBytes = 512 * 1024;
+    private const long HotWindowLifetime = 512;
+    private const int MaxEagerReadbacks = 4;
+    private readonly Dictionary<ulong, HotWindow> _hotWindows = new();
+    private readonly HashSet<ulong> _eagerCandidates = new();
+    private readonly List<PendingDownload> _eagerDownloads = new();
+    private long _batchSerial;
+    private static long _reportedEagerStarted;
+    private static long _reportedEagerUsed;
+    private static long _reportedEagerStale;
+
+    private readonly record struct HotWindow(ulong Address, ulong Size, long LastHit);
+
+    internal long EagerReadbacksStarted { get; private set; }
+
+    internal long EagerReadbacksUsed { get; private set; }
+
+    private void NoteHotReadback(ulong guestAddress, ulong size)
+    {
+        _hotWindows[guestAddress & ~(ReadbackWindowBytes - 1)] = new HotWindow(guestAddress, size, _batchSerial);
+    }
+
+    private void NoteHotWindowWrite(ulong guestAddress, ulong size)
+    {
+        if (_hotWindows.Count == 0 || size == 0)
+        {
+            return;
+        }
+
+        var last = (guestAddress + size - 1) & ~(ReadbackWindowBytes - 1);
+        for (var key = guestAddress & ~(ReadbackWindowBytes - 1); key <= last; key += ReadbackWindowBytes)
+        {
+            if (_hotWindows.TryGetValue(key, out var hot) && _batchSerial - hot.LastHit <= HotWindowLifetime)
+            {
+                _eagerCandidates.Add(key);
+                HotWritePending = true;
+            }
+        }
+    }
+
+    public bool HotWritePending { get; private set; }
+
+    public void OnBatchSubmitted()
+    {
+        _batchSerial++;
+        HotWritePending = false;
+        if (AsyncReadback is not { } readback)
+        {
+            return;
+        }
+
+        for (var index = _eagerDownloads.Count - 1; index >= 0; index--)
+        {
+            var pending = _eagerDownloads[index];
+            if (readback.IsComplete(pending.Ticket))
+            {
+                _eagerDownloads.RemoveAt(index);
+                if (!CompleteReadMemoryOnGpu(pending, retrySynchronously: false))
+                {
+                    Interlocked.Increment(ref _reportedEagerStale);
+                }
+            }
+        }
+
+        if ((_batchSerial & 1023) == 0)
+        {
+            foreach (var key in _hotWindows.Where(pair => _batchSerial - pair.Value.LastHit > HotWindowLifetime).Select(pair => pair.Key).ToList())
+            {
+                _hotWindows.Remove(key);
+            }
+        }
+
+        if (_eagerCandidates.Count == 0)
+        {
+            return;
+        }
+
+        foreach (var key in _eagerCandidates)
+        {
+            if (_eagerDownloads.Count >= MaxEagerReadbacks)
+            {
+                break;
+            }
+
+            if (_hotWindows.TryGetValue(key, out var hot))
+            {
+                StartEagerReadback(hot);
+            }
+        }
+
+        _eagerCandidates.Clear();
+    }
+
+    private void StartEagerReadback(HotWindow hot)
+    {
+        if (FindOwner(hot.Address, hot.Size) is not { } buffer)
+        {
+            return;
+        }
+
+        var copies = CollectReadbackWindow(buffer, hot.Address, hot.Size, out var windowBegin, out var windowEnd);
+        if (copies.Count == 0 || !TryBeginDownloadAsync(copies, out var ticket, out var writeTicks))
+        {
+            return;
+        }
+
+        foreach (var copy in copies)
+        {
+            copy.Buffer.RetainForeignRead();
+        }
+
+        _eagerDownloads.Add(new PendingDownload
+        {
+            Ticket = ticket,
+            Copies = copies,
+            WriteTicks = writeTicks,
+            WindowBegin = windowBegin,
+            WindowEnd = windowEnd,
+            GuestAddress = hot.Address,
+            Size = hot.Size,
+            IsWrite = false,
+            Source = GuestMemoryProfile.ReadbackSource.ShaderResourceRead,
+            Started = System.Diagnostics.Stopwatch.GetTimestamp(),
+        });
+        EagerReadbacksStarted++;
+        Interlocked.Increment(ref _reportedEagerStarted);
+    }
+
+    private PendingDownload? TakeEagerReadback(ulong guestAddress, ulong size)
+    {
+        for (var index = _eagerDownloads.Count - 1; index >= 0; index--)
+        {
+            var pending = _eagerDownloads[index];
+            if (guestAddress >= pending.WindowBegin && size <= pending.WindowEnd - pending.WindowBegin &&
+                guestAddress - pending.WindowBegin <= pending.WindowEnd - pending.WindowBegin - size)
+            {
+                _eagerDownloads.RemoveAt(index);
+                return pending;
+            }
+        }
+
+        return null;
+    }
+
+    private bool TryUseEagerReadback(ulong guestAddress, ulong size)
+    {
+        if (AsyncReadback is not { } readback || TakeEagerReadback(guestAddress, size) is not { } pending)
+        {
+            return false;
+        }
+
+        readback.Wait(pending.Ticket);
+        if (!CompleteReadMemoryOnGpu(pending, retrySynchronously: false))
+        {
+            Interlocked.Increment(ref _reportedEagerStale);
+            return false;
+        }
+
+        EagerReadbacksUsed++;
+        Interlocked.Increment(ref _reportedEagerUsed);
+        return !HasGpuDirtyBytes(guestAddress, size);
+    }
+
+    private void AbandonEagerReadbacks()
+    {
+        if (AsyncReadback is not { } readback)
+        {
+            return;
+        }
+
+        foreach (var pending in _eagerDownloads)
+        {
+            readback.Wait(pending.Ticket);
+            readback.Complete(pending.Ticket, null);
+            foreach (var copy in pending.Copies)
+            {
+                copy.Buffer.ReleaseForeignRead();
+            }
+        }
+
+        _eagerDownloads.Clear();
+        _eagerCandidates.Clear();
+    }
+
+    private static readonly bool GuestReadsAwaitOffQueue =
+        Environment.GetEnvironmentVariable("SHARPEMU_ASYNC_GUEST_READBACK") != "0";
+
+    private bool AwaitShutdown()
+    {
         lock (_shutdownGate)
         {
             while (_outcome == ShutdownOutcome.Pending)
@@ -757,17 +1131,76 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
         }
     }
 
-    private void ReadMemoryOnGpu(ulong guestAddress, ulong size, bool isWrite, GuestMemoryProfile.ReadbackSource source)
+    private void ReadMemoryOnGpu(ulong guestAddress, ulong size, bool isWrite, GuestMemoryProfile.ReadbackSource source) =>
+        _ = BeginReadMemoryOnGpu(guestAddress, size, isWrite, source, allowPending: false);
+
+    internal long PendingReadbacksApplied { get; private set; }
+
+    internal long PendingReadbacksRetried { get; private set; }
+
+    private static long _reportedApplied;
+    private static long _reportedRetried;
+
+    public static string TakeAsyncReadbackReport() => FormattableString.Invariant(
+        $"[PERF][ASYNC_READBACK] applied={Interlocked.Exchange(ref _reportedApplied, 0)} retried={Interlocked.Exchange(ref _reportedRetried, 0)} eager_started={Interlocked.Exchange(ref _reportedEagerStarted, 0)} eager_used={Interlocked.Exchange(ref _reportedEagerUsed, 0)} eager_stale={Interlocked.Exchange(ref _reportedEagerStale, 0)}");
+
+    private sealed record PendingDownload
+    {
+        public required VulkanAsyncReadback.Ticket Ticket { get; init; }
+        public required List<DownloadPiece> Copies { get; init; }
+        public required ulong[] WriteTicks { get; init; }
+        public required ulong WindowBegin { get; init; }
+        public required ulong WindowEnd { get; init; }
+        public required ulong GuestAddress { get; init; }
+        public required ulong Size { get; init; }
+        public required bool IsWrite { get; init; }
+        public required GuestMemoryProfile.ReadbackSource Source { get; init; }
+        public required long Started { get; init; }
+    }
+
+    private PendingDownload? BeginReadMemoryOnGpu(ulong guestAddress, ulong size, bool isWrite, GuestMemoryProfile.ReadbackSource source,
+        bool allowPending, bool markHot = false)
     {
         using var readbackScope = GuestMemoryProfile.Measure(GuestMemoryProfile.Operation.BufferReadback);
         using var foreignRead = _device.Slabs.BeginForeignRead();
         var readbackStarted = GuestMemoryProfile.ReadbackDetailsEnabled ? System.Diagnostics.Stopwatch.GetTimestamp() : 0;
         if (isWrite && !IsRegionRegistered(guestAddress, size))
         {
-            return;
+            return null;
+        }
+
+        if (allowPending && TakeEagerReadback(guestAddress, size) is { } eager)
+        {
+            return eager with { GuestAddress = guestAddress, Size = size, IsWrite = isWrite, Source = source };
         }
 
         var copies = CollectReadbackWindow(guestAddress, size, out var windowBegin, out var windowEnd);
+        if (markHot && copies.Count != 0)
+        {
+            NoteHotReadback(guestAddress, size);
+        }
+        if (copies.Count != 0 && allowPending && TryBeginDownloadAsync(copies, out var ticket, out var writeTicks))
+        {
+            foreach (var copy in copies)
+            {
+                copy.Buffer.RetainForeignRead();
+            }
+
+            return new PendingDownload
+            {
+                Ticket = ticket,
+                Copies = copies,
+                WriteTicks = writeTicks,
+                WindowBegin = windowBegin,
+                WindowEnd = windowEnd,
+                GuestAddress = guestAddress,
+                Size = size,
+                IsWrite = isWrite,
+                Source = source,
+                Started = readbackStarted,
+            };
+        }
+
         if (copies.Count != 0)
         {
             DownloadBufferMemory(copies);
@@ -778,22 +1211,112 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
         {
             _tracker.MarkCpuDirtyPages(guestAddress, size);
         }
-        if (GuestMemoryProfile.ReadbackDetailsEnabled)
+
+        RecordReadback(windowBegin, windowEnd, isWrite, copies, readbackStarted, source);
+        return null;
+    }
+
+    private bool CompleteReadMemoryOnGpu(PendingDownload pending, bool retrySynchronously)
+    {
+        using var readbackScope = GuestMemoryProfile.Measure(GuestMemoryProfile.Operation.BufferReadback);
+        var readback = AsyncReadback ?? throw SubmissionScheduler.Fatal("The pending readback lost its queue.");
+        try
         {
-            var downloadedBytes = 0UL;
+            if (!IsPendingDownloadCurrent(pending))
+            {
+                readback.Complete(pending.Ticket, null);
+                if (retrySynchronously)
+                {
+                    PendingReadbacksRetried++;
+                    Interlocked.Increment(ref _reportedRetried);
+                    ReadMemoryOnGpu(pending.GuestAddress, pending.Size, pending.IsWrite, pending.Source);
+                }
+
+                return false;
+            }
+
+            PendingReadbacksApplied++;
+            Interlocked.Increment(ref _reportedApplied);
+
+            var copies = pending.Copies;
+            readback.Complete(pending.Ticket, (index, bytes) =>
+            {
+                if (!_backing.TryWriteBacking(copies[index].Address, bytes))
+                {
+                    throw SubmissionScheduler.Fatal($"Could not write the required direct backing: addr=0x{copies[index].Address:X16} size=0x{(ulong)bytes.Length:X16}");
+                }
+            });
             foreach (var copy in copies)
-                downloadedBytes += copy.Size;
-            GuestMemoryProfile.RecordBufferReadback(windowBegin, windowEnd - windowBegin, isWrite, downloadedBytes,
-                System.Diagnostics.Stopwatch.GetTimestamp() - readbackStarted, source);
+            {
+                _gpuModifiedRanges.Remove(copy.Address, copy.Size);
+            }
+
+            _tracker.ClearGpuDirtyPages(pending.WindowBegin, pending.WindowEnd - pending.WindowBegin);
+            if (pending.IsWrite)
+            {
+                _tracker.MarkCpuDirtyPages(pending.GuestAddress, pending.Size);
+            }
+
+            RecordReadback(pending.WindowBegin, pending.WindowEnd, pending.IsWrite, copies, pending.Started, pending.Source);
+            return true;
         }
+        finally
+        {
+            foreach (var copy in pending.Copies)
+            {
+                copy.Buffer.ReleaseForeignRead();
+            }
+        }
+    }
+
+    private bool IsPendingDownloadCurrent(PendingDownload pending)
+    {
+        var total = 0UL;
+        for (var index = 0; index < pending.Copies.Count; index++)
+        {
+            var copy = pending.Copies[index];
+            if (copy.Buffer.LastGpuWriteTick != pending.WriteTicks[index] ||
+                !_gpuModifiedRanges.Contains(copy.Address, copy.Size) ||
+                !ReferenceEquals(FindOwner(copy.Address, copy.Size), copy.Buffer))
+            {
+                return false;
+            }
+
+            total += copy.Size;
+        }
+
+        var current = 0UL;
+        foreach (var range in _gpuModifiedRanges.GetOverlappingRanges(pending.WindowBegin, pending.WindowEnd - pending.WindowBegin))
+        {
+            current += range.Size;
+        }
+
+        return current == total;
+    }
+
+    private static void RecordReadback(ulong windowBegin, ulong windowEnd, bool isWrite, List<DownloadPiece> copies, long started,
+        GuestMemoryProfile.ReadbackSource source)
+    {
+        if (!GuestMemoryProfile.ReadbackDetailsEnabled)
+        {
+            return;
+        }
+
+        var downloadedBytes = 0UL;
+        foreach (var copy in copies)
+            downloadedBytes += copy.Size;
+        GuestMemoryProfile.RecordBufferReadback(windowBegin, windowEnd - windowBegin, isWrite, downloadedBytes,
+            System.Diagnostics.Stopwatch.GetTimestamp() - started, source);
     }
 
     // The GPU-modified ranges to download for a read of the range, widened to a window so
     // nearby CPU reads share one GPU drain.
-    private List<DownloadPiece> CollectReadbackWindow(ulong guestAddress, ulong size, out ulong windowBegin, out ulong windowEnd)
+    private List<DownloadPiece> CollectReadbackWindow(ulong guestAddress, ulong size, out ulong windowBegin, out ulong windowEnd) =>
+        CollectReadbackWindow(_registry.GetBuffer(FindBuffer(guestAddress, size)), guestAddress, size, out windowBegin, out windowEnd);
+
+    private List<DownloadPiece> CollectReadbackWindow(GpuBuffer buffer, ulong guestAddress, ulong size, out ulong windowBegin, out ulong windowEnd)
     {
-        var buffer = _registry.GetBuffer(FindBuffer(guestAddress, size));
-        const ulong windowSize = 512 * 1024;
+        const ulong windowSize = ReadbackWindowBytes;
         var bufferEnd = buffer.CpuAddress + buffer.Size;
         windowBegin = Math.Max(guestAddress & ~(windowSize - 1), buffer.CpuAddress);
         windowEnd = Math.Min(Math.Max(windowBegin + windowSize, guestAddress + size), bufferEnd);
@@ -972,6 +1495,57 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
         }
     }
 
+    private bool TryBeginDownloadAsync(List<DownloadPiece> copies, out VulkanAsyncReadback.Ticket ticket, out ulong[] writeTicks)
+    {
+        ticket = null!;
+        writeTicks = [];
+        if (AsyncReadback is not { } readback || copies.Count == 0)
+        {
+            return false;
+        }
+
+        var waitTick = 0UL;
+        var total = 0UL;
+        var ticks = new ulong[copies.Count];
+        for (var index = 0; index < copies.Count; index++)
+        {
+            var written = copies[index].Buffer.LastGpuWriteTick;
+            if (written == 0)
+            {
+                return false;
+            }
+
+            ticks[index] = written;
+            waitTick = Math.Max(waitTick, written);
+            total += copies[index].Size;
+        }
+
+        if (total > AsyncReadbackLimit)
+        {
+            return false;
+        }
+
+        if (waitTick >= _scheduler.CurrentTick)
+        {
+            _scheduler.Flush();
+        }
+
+        var pieces = new ReadbackPiece[copies.Count];
+        for (var index = 0; index < pieces.Length; index++)
+        {
+            pieces[index] = new ReadbackPiece(copies[index].Buffer, copies[index].SourceOffset, copies[index].Size);
+        }
+
+        if (!readback.TryBegin(pieces, waitTick, out var started) || started is null)
+        {
+            return false;
+        }
+
+        ticket = started;
+        writeTicks = ticks;
+        return true;
+    }
+
     // Copies the pieces on the readback queue after only the tick that last wrote their
     // buffers, instead of appending the copy to the main queue and draining all of it.
     private bool TryDownloadAsync(List<DownloadPiece> copies)
@@ -1128,13 +1702,17 @@ public sealed unsafe class GuestBufferCache : IGuestBufferStore, IDisposable
     {
         using var profileScope = RenderPhaseProfile.MeasureDetail(RenderPhaseProfile.Phase.BufferDirtySynchronization);
         var startedAt = BufferUploadProfile.Enabled ? System.Diagnostics.Stopwatch.GetTimestamp() : 0;
-        // The locked query observes completed writes; a later write remains dirty for the next obtain.
-        if (!preserveCpuWriteHotPages && !isWritten && !isTexelBuffer && !_tracker.HasCpuDirtyPages(guestAddress, size))
+        if ((!preserveCpuWriteHotPages && !isWritten && !isTexelBuffer && !_tracker.MayHaveCpuDirtyPages(guestAddress, size)) ||
+            (isWritten && !isTexelBuffer && _gpuModifiedRanges.Contains(guestAddress, size)))
         {
             if (BufferUploadProfile.Enabled)
                 BufferUploadProfile.Record(guestAddress, size, 0, 0, 0, System.Diagnostics.Stopwatch.GetTimestamp() - startedAt);
             return false;
         }
+
+        profileScope.SwitchPhase(isWritten
+            ? RenderPhaseProfile.Phase.BufferDirtySyncWritten
+            : isTexelBuffer ? RenderPhaseProfile.Phase.BufferDirtySyncTexel : RenderPhaseProfile.Phase.BufferDirtySyncUpload);
         var copies = new List<BufferCopy>();
         var totalSize = 0UL;
         GpuBuffer? source = null;

src/SharpEmu.Libs/Gpu/Buffers/IGuestImageCache.cs

@@ -13,6 +13,8 @@ public interface IGuestImageCache
 
     bool ClearMetadata(ulong address);
 
+    bool OverlapsDccMetadata(ulong address, ulong size);
+
     void InvalidateMemory(ulong address, ulong size);
 
     void InvalidateMemoryFromGpu(ulong address, ulong size);

src/SharpEmu.Libs/Gpu/GpuCommands/CommandStreamQueue.cs

@@ -26,16 +26,23 @@ public enum SliceResult
 // Submissions of every queue; one thread runs the slices, other threads enqueue and wait.
 public sealed class CommandStreamQueue
 {
+    private sealed record ControlBarrier(ulong CutoffOrdinal, Action Work, Action Cancel);
+
     public const int ComputeQueueCount = 56;
     public const int QueueCount = 1 + ComputeQueueCount;
     public const int AllBlockedRetryMilliseconds = 100;
+    // One boundary may run ahead; explicit zero keeps the synchronous diagnostic mode.
+    public static readonly int DefaultBoundariesInFlight =
+        Environment.GetEnvironmentVariable("SHARPEMU_SUSPEND_POINTS_IN_FLIGHT") == "0" ? 0 : 1;
 
     private readonly ICommandStreamHost _host;
     private readonly object _gate = new();
     private readonly LinkedList<CommandSubmission>[] _queues = new LinkedList<CommandSubmission>[QueueCount];
     private readonly GpuCommandInterpreter?[] _interpreters = new GpuCommandInterpreter?[QueueCount];
+    private readonly Queue<ControlBarrier> _controlBarriers = new();
     private int _nextQueue;
     private int _submissionCount;
+    private ulong _admissionOrdinal;
     private bool _accepting = true;
     private bool _stopping;
     private bool _processing;
@@ -43,12 +50,20 @@ public sealed class CommandStreamQueue
     private ulong _submitId;
     private ulong _lastCompletedGpuTick;
     private int _doneCount;
+    private int _pendingBoundaries;
     private IdleOutcome _outcome = IdleOutcome.Completed;
     private Thread? _processingThread;
 
-    public CommandStreamQueue(ICommandStreamHost host)
+    private readonly int _boundariesInFlight;
+
+    public CommandStreamQueue(ICommandStreamHost host) : this(host, DefaultBoundariesInFlight)
+    {
+    }
+
+    public CommandStreamQueue(ICommandStreamHost host, int boundariesInFlight)
     {
         _host = host;
+        _boundariesInFlight = Math.Max(0, boundariesInFlight);
         for (var index = 0; index < QueueCount; index++)
         {
             _queues[index] = new LinkedList<CommandSubmission>();
@@ -80,7 +95,7 @@ public sealed class CommandStreamQueue
         {
             lock (_gate)
             {
-                return _submissionCount != 0;
+                return _submissionCount != 0 || _controlBarriers.Count != 0;
             }
         }
     }
@@ -102,7 +117,7 @@ public sealed class CommandStreamQueue
         {
             lock (_gate)
             {
-                return SelectQueueLocked() >= 0;
+                return HasRunnableWorkLocked();
             }
         }
     }
@@ -189,26 +204,74 @@ public sealed class CommandStreamQueue
             throw _host.Fatal($"The command stream no longer accepts submissions: queue={submission.QueueId} address=0x{submission.Address:X16}.");
         }
 
+        submission.AdmissionOrdinal = ++_admissionOrdinal;
         _queues[submission.QueueId].AddLast(submission);
         _submissionCount++;
-        if (submission.Kind != CommandSubmissionKind.FlipPreparation)
+        if (submission.Kind is not (CommandSubmissionKind.FlipPreparation or CommandSubmissionKind.FrameBoundary))
             SubmissionFlowProfile.Record(SubmissionFlowProfile.EventKind.Enqueued, submission.QueueId,
                 submission.SubmissionId, submission.Address, submission.DwordCount, _submissionCount);
         Monitor.PulseAll(_gate);
     }
 
-    // Marks the frame boundary and drains all pending GPU work before returning.
+    public bool TryEnqueueControlBarrier(Action work, Action cancel)
+    {
+        ArgumentNullException.ThrowIfNull(work);
+        ArgumentNullException.ThrowIfNull(cancel);
+        lock (_gate)
+        {
+            if (!_accepting)
+            {
+                return false;
+            }
+
+            _controlBarriers.Enqueue(new ControlBarrier(_admissionOrdinal, work, cancel));
+            Monitor.PulseAll(_gate);
+            return true;
+        }
+    }
+
     public IdleOutcome Done()
     {
-        var outcome = _processingThread == Thread.CurrentThread ? IdleOutcome.Completed : WaitForIdle();
+        if (_processingThread == Thread.CurrentThread)
+        {
+            lock (_gate)
+            {
+                _graphicsDone = true;
+                _doneCount++;
+            }
+
+            return IdleOutcome.Completed;
+        }
 
         lock (_gate)
         {
-            _graphicsDone = true;
-            _doneCount++;
-        }
+            if (_outcome != IdleOutcome.Completed)
+            {
+                return _outcome;
+            }
 
-        return outcome;
+            _graphicsDone = true;
+            if (!_accepting)
+            {
+                // Shutdown: no slice will run a queued boundary, so drain as before.
+                while (_outcome == IdleOutcome.Completed && (_processing || _submissionCount != 0))
+                {
+                    Monitor.Wait(_gate);
+                }
+
+                _doneCount++;
+                return _outcome;
+            }
+
+            _pendingBoundaries++;
+            EnqueueLocked(new CommandSubmission(CommandSubmissionKind.FrameBoundary, 0, 0, 0, 0, null));
+            while (_outcome == IdleOutcome.Completed && _pendingBoundaries > _boundariesInFlight)
+            {
+                Monitor.Wait(_gate);
+            }
+
+            return _outcome;
+        }
     }
 
     // Returns once nothing is pending; a cancelled or failed queue reports that instead.
@@ -216,7 +279,8 @@ public sealed class CommandStreamQueue
     {
         lock (_gate)
         {
-            while (_outcome == IdleOutcome.Completed && (_processing || _submissionCount != 0))
+            while (_outcome == IdleOutcome.Completed &&
+                   (_processing || _submissionCount != 0 || _controlBarriers.Count != 0))
             {
                 Monitor.Wait(_gate);
             }
@@ -238,13 +302,13 @@ public sealed class CommandStreamQueue
     {
         lock (_gate)
         {
-            if (SelectQueueLocked() >= 0 || _stopping)
+            if (HasRunnableWorkLocked() || _stopping)
             {
-                return SelectQueueLocked() >= 0;
+                return HasRunnableWorkLocked();
             }
 
             Monitor.Wait(_gate, timeoutMilliseconds);
-            return SelectQueueLocked() >= 0;
+            return HasRunnableWorkLocked();
         }
     }
 
@@ -254,7 +318,7 @@ public sealed class CommandStreamQueue
         lock (_gate)
         {
             var deadline = Environment.TickCount64 + intervalMilliseconds;
-            while (SelectQueueLocked() < 0)
+            while (!HasRunnableWorkLocked())
             {
                 var remaining = deadline - Environment.TickCount64;
                 if (remaining <= 0)
@@ -272,10 +336,15 @@ public sealed class CommandStreamQueue
     // Publishes a failure: nothing runs any more and every waiter is released with Failed.
     public void Fail()
     {
+        Action[] cancellations;
         lock (_gate)
         {
             FailLocked();
+            cancellations = CancelControlBarriersLocked();
         }
+
+        foreach (var cancel in cancellations)
+            cancel();
     }
 
     private void FailLocked()
@@ -323,7 +392,8 @@ public sealed class CommandStreamQueue
     // Runs one slice of the next unblocked submission on the calling thread.
     public SliceResult ProcessOne()
     {
-        CommandSubmission submission;
+        CommandSubmission? submission = null;
+        ControlBarrier? control = null;
         lock (_gate)
         {
             if (_processing)
@@ -331,35 +401,73 @@ public sealed class CommandStreamQueue
                 throw _host.Fatal("The command stream queue is already processing a slice.");
             }
 
-            var selected = SelectQueueLocked();
-            if (selected < 0)
+            if (IsControlBarrierReadyLocked())
             {
-                return _submissionCount != 0 ? SliceResult.AllBlocked : SliceResult.NoWork;
+                control = _controlBarriers.Dequeue();
+            }
+            else
+            {
+                var selected = SelectQueueLocked();
+                if (selected < 0)
+                {
+                    return _submissionCount != 0 ? SliceResult.AllBlocked : SliceResult.NoWork;
+                }
+
+                var queue = _queues[selected];
+                submission = queue.First!.Value;
+                queue.RemoveFirst();
+                _submissionCount--;
+                _nextQueue = (selected + 1) % QueueCount;
             }
 
-            var queue = _queues[selected];
-            submission = queue.First!.Value;
-            queue.RemoveFirst();
-            _submissionCount--;
-            _nextQueue = (selected + 1) % QueueCount;
             _processing = true;
             _processingThread = Thread.CurrentThread;
-            if (!submission.Started && submission.Kind != CommandSubmissionKind.FlipPreparation)
+            if (submission is { Started: false } &&
+                submission.Kind is not (CommandSubmissionKind.FlipPreparation or CommandSubmissionKind.FrameBoundary))
                 SubmissionFlowProfile.Record(SubmissionFlowProfile.EventKind.ProcessingStarted, submission.QueueId,
                     submission.SubmissionId, submission.Address, submission.DwordCount, _submissionCount);
         }
 
+        if (control is not null)
+        {
+            try
+            {
+                control.Work();
+            }
+            catch (Exception exception)
+            {
+                try
+                {
+                    Console.Error.WriteLine($"[GPU][ERROR] Command stream control barrier failed. {exception}");
+                }
+                catch (Exception)
+                {
+                }
+
+                Fail();
+                throw;
+            }
+
+            lock (_gate)
+            {
+                _processing = false;
+                Monitor.PulseAll(_gate);
+            }
+
+            return SliceResult.Completed;
+        }
+
         bool complete;
         try
         {
-            complete = RunSlice(submission);
+            complete = RunSlice(submission!);
         }
         catch (Exception exception)
         {
             try
             {
                 // Report the cause before another submitting thread observes the failed queue.
-                Console.Error.WriteLine($"[GPU][ERROR] Command stream slice failed: queue={submission.QueueId} address=0x{submission.Address:X16}. {exception}");
+                Console.Error.WriteLine($"[GPU][ERROR] Command stream slice failed: queue={submission!.QueueId} address=0x{submission.Address:X16}. {exception}");
             }
             catch (Exception)
             {
@@ -375,7 +483,7 @@ public sealed class CommandStreamQueue
             SliceResult result;
             if (!complete)
             {
-                submission.Blocked = true;
+                submission!.Blocked = true;
                 submission.BlockedSinceTicks = System.Diagnostics.Stopwatch.GetTimestamp();
                 submission.BlockedPacketAddress = submission.Commands.CurrentPacketAddress;
                 _queues[submission.QueueId].AddFirst(submission);
@@ -384,6 +492,12 @@ public sealed class CommandStreamQueue
             }
             else
             {
+                if (submission.Kind == CommandSubmissionKind.FrameBoundary)
+                {
+                    _pendingBoundaries--;
+                    _doneCount++;
+                }
+
                 foreach (var queue in _queues)
                 {
                     if (queue.First is { } head)
@@ -411,6 +525,14 @@ public sealed class CommandStreamQueue
             return true;
         }
 
+        // A suspend point drains the graphics pipe: submit what the frame recorded.
+        if (submission.Kind == CommandSubmissionKind.FrameBoundary)
+        {
+            SlicesRun++;
+            _host.Flush();
+            return true;
+        }
+
         var firstSlice = !submission.Started;
         var processor = GetInterpreter(submission.QueueId);
         if (firstSlice && submission.ResetInterpreter)
@@ -522,6 +644,14 @@ public sealed class CommandStreamQueue
                 if (queue.First is { } head && head.Value.Blocked)
                 {
                     _submissionCount -= queue.Count;
+                    foreach (var dropped in queue)
+                    {
+                        if (dropped.Kind == CommandSubmissionKind.FrameBoundary)
+                        {
+                            _pendingBoundaries--;
+                        }
+                    }
+
                     queue.Clear();
                     _outcome = IdleOutcome.Cancelled;
                 }
@@ -534,12 +664,17 @@ public sealed class CommandStreamQueue
     // Drops every submission without stopping admission; the presenter uses it after device loss.
     public void DiscardAll()
     {
+        Action[] cancellations;
         lock (_gate)
         {
             _outcome = IdleOutcome.Failed;
             DropAllLocked();
+            cancellations = CancelControlBarriersLocked();
             Monitor.PulseAll(_gate);
         }
+
+        foreach (var cancel in cancellations)
+            cancel();
     }
 
     // A diagnostic view of the blocked heads: their count, the oldest age and one sample.
@@ -606,6 +741,20 @@ public sealed class CommandStreamQueue
 
     private int SelectQueueLocked()
     {
+        if (_controlBarriers.TryPeek(out var control))
+        {
+            for (var offset = 0; offset < QueueCount; offset++)
+            {
+                var queueId = (_nextQueue + offset) % QueueCount;
+                if (_queues[queueId].First is { } head &&
+                    head.Value.AdmissionOrdinal <= control.CutoffOrdinal &&
+                    !head.Value.Blocked)
+                {
+                    return queueId;
+                }
+            }
+        }
+
         for (var offset = 0; offset < QueueCount; offset++)
         {
             var queueId = (_nextQueue + offset) % QueueCount;
@@ -618,6 +767,42 @@ public sealed class CommandStreamQueue
         return -1;
     }
 
+    private bool HasRunnableWorkLocked() => IsControlBarrierReadyLocked() || SelectQueueLocked() >= 0;
+
+    private bool IsControlBarrierReadyLocked()
+    {
+        if (!_controlBarriers.TryPeek(out var control))
+        {
+            return false;
+        }
+
+        foreach (var queue in _queues)
+        {
+            if (queue.First is { } head && head.Value.AdmissionOrdinal <= control.CutoffOrdinal)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    private Action[] CancelControlBarriersLocked()
+    {
+        if (_controlBarriers.Count == 0)
+        {
+            return [];
+        }
+
+        var cancellations = new Action[_controlBarriers.Count];
+        for (var index = 0; index < cancellations.Length; index++)
+        {
+            cancellations[index] = _controlBarriers.Dequeue().Cancel;
+        }
+
+        return cancellations;
+    }
+
     private void DropAllLocked()
     {
         foreach (var queue in _queues)
@@ -626,5 +811,6 @@ public sealed class CommandStreamQueue
         }
 
         _submissionCount = 0;
+        _pendingBoundaries = 0;
     }
 }

src/SharpEmu.Libs/Gpu/GpuCommands/CommandSubmission.cs

@@ -9,6 +9,8 @@ public enum CommandSubmissionKind
     Compute,
     // A video-out export flip queued behind the graphics submissions before it.
     FlipPreparation,
+    // A suspend point queued behind the graphics submissions of the frame it ends.
+    FrameBoundary,
 }
 
 public enum SubmissionProgress
@@ -99,6 +101,8 @@ public sealed class CommandSubmission
     // The submitter's own sequence number, kept for diagnostics and the translation state.
     public ulong SubmissionId { get; }
 
+    internal ulong AdmissionOrdinal { get; set; }
+
     // Snapshots captured at submit time; the processor never reads them.
     public object? GeometrySnapshots { get; }
 

src/SharpEmu.Libs/Gpu/GpuCommands/GpuCommandInterpreter.Labels.cs

@@ -118,6 +118,7 @@ public sealed partial class GpuCommandInterpreter
                                     break;
                                 case 0x14:
                                 case 0x28:
+                                case 0x2F:
                                     if (eventIndex == 0x00)
                                     {
                                         Write64(destination, value, withWriteBack: false, withInterrupt, eventId, interruptContextId);
@@ -127,7 +128,6 @@ public sealed partial class GpuCommandInterpreter
                                     break;
                                 case 0x2B:
                                 case 0x2D:
-                                case 0x2F:
                                 case 0x30:
                                     if (eventIndex == 0x00 && !withInterrupt)
                                     {

src/SharpEmu.Libs/Gpu/GpuCommands/GpuCommandInterpreter.Memory.cs

@@ -3,6 +3,7 @@
 
 using System.Runtime.InteropServices;
 using SharpEmu.Libs.Gpu.GpuCommands.Packets;
+using SharpEmu.Libs.Gpu.Images;
 using SharpEmu.Libs.Gpu.Scheduling;
 
 namespace SharpEmu.Libs.Gpu.GpuCommands;
@@ -10,6 +11,7 @@ namespace SharpEmu.Libs.Gpu.GpuCommands;
 public sealed partial class GpuCommandInterpreter
 {
     private const uint DmaSkippedDestination = 0x3022C;
+    private const uint LodStatsWithoutCounters = 1;
 
     // Destination selectors 1, 2, 4 and 5 are memory; registers and GDS are not supported.
     internal void WriteData(ulong destination, ReadOnlySpan<uint> source, uint writeControl)
@@ -367,12 +369,12 @@ public sealed partial class GpuCommandInterpreter
         var destination = (payload[1] & 0xFFFF_FFC0u) | ((ulong)payload[2] << 32);
         if (destination != 0 && bufferSize != 0)
         {
-            // The statistics buffer is zeroed and its first dword marks it as valid.
-            var zeros = new byte[bufferSize];
-            WriteBytes(destination, zeros);
+            var report = new byte[bufferSize];
+            var hasCounters = MipStatistics.Shared.TryWriteReport(report);
+            WriteBytes(destination, report);
             if (bufferSize >= sizeof(uint))
             {
-                WriteDword(destination, 1);
+                WriteDword(destination, hasCounters ? MipStatistics.FirstCounterOffset : LodStatsWithoutCounters);
             }
         }
 

src/SharpEmu.Libs/Gpu/GpuCommands/GpuCommandInterpreter.Waits.cs

@@ -34,22 +34,26 @@ public sealed partial class GpuCommandInterpreter
             throw _host.Fatal($"The wait compare function is unknown: function={compareFunction} address=0x{address:X16}.");
         }
 
+        if (!satisfied && TryReadOwnWrite(address, is64Bit, out var ownValue))
+        {
+            _ = WaitOperation.TryCompare(ownValue, reference, mask, compareFunction, out satisfied);
+        }
+
         if (!satisfied)
         {
             Suspend();
         }
     }
 
+    // The wait bit is PredicationZPassWaitOp: 0 (kWaitForQueryResults) stalls the command
+    // processor until the results arrive, 1 (kDoNotPredicateIfQueryResultsNotReady) never
+    // stalls and leaves the tagged packets unpredicated while the results are outstanding.
     internal void SetPredication(uint condition, uint operation, uint waitOperation, ulong address)
     {
-        if (waitOperation != 0)
-        {
-            _host.FlushAndWait();
-        }
-
         switch (operation)
         {
             case 0:
+                // Clearing predication reads no memory, so no GPU result can be outstanding.
                 PredicateSkip = false;
                 break;
             case 3:
@@ -59,6 +63,15 @@ public sealed partial class GpuCommandInterpreter
                     throw _host.Fatal("The predication address is zero.");
                 }
 
+                if (waitOperation != 0)
+                {
+                    // The results are outstanding while work is queued behind this packet, and
+                    // the game asked for the packets to run unpredicated in that case.
+                    PredicateSkip = false;
+                    break;
+                }
+
+                _host.FlushAndWait();
                 var value = ReadQword(address);
                 PredicateSkip = condition switch
                 {

src/SharpEmu.Libs/Gpu/GpuCommands/GpuCommandInterpreter.cs

@@ -32,6 +32,11 @@ public sealed partial class GpuCommandInterpreter
     private readonly uint[] _constantRam = new uint[ConstantRamDwords];
     private PacketCursorStack? _execution;
     private bool _chainRequested;
+    private ulong _packetSerial;
+    private ulong _lastWriteAddress;
+    private ulong _lastWriteValue;
+    private int _lastWriteLength;
+    private ulong _lastWritePacket;
 
     public GpuCommandInterpreter(ICommandStreamHost host, int queueId, int interruptEventId)
     {
@@ -119,6 +124,7 @@ public sealed partial class GpuCommandInterpreter
 
     public void Reset()
     {
+        _lastWriteLength = 0;
         Registers.Reset();
         TypedRegisters.Reset();
         IndexTypeAndSize = 0;
@@ -163,6 +169,8 @@ public sealed partial class GpuCommandInterpreter
 
         execution.Suspended = false;
         execution.MadeProgress = false;
+        // Forwarding is local to this slice, never a cached signal from an older submission.
+        _lastWriteLength = 0;
         _execution = execution;
         try
         {
@@ -206,6 +214,20 @@ public sealed partial class GpuCommandInterpreter
 
     public void Suspend() => RequireExecution().Suspended = true;
 
+    // A paired wait must still observe this queue's immediate label store when the CPU
+    // resets the live address for the next frame between the two packets (Dead Cells).
+    private bool TryReadOwnWrite(ulong address, bool is64Bit, out ulong value)
+    {
+        value = 0;
+        if (address != _lastWriteAddress || _packetSerial - _lastWritePacket > 2 ||
+            _lastWriteLength < (is64Bit ? sizeof(ulong) : sizeof(uint)))
+        {
+            return false;
+        }
+        value = is64Bit ? _lastWriteValue : (uint)_lastWriteValue;
+        return true;
+    }
+
     private PacketCursorStack RequireExecution() =>
         _execution ?? throw _host.Fatal($"No command stream is running: queue={QueueId}.");
 
@@ -242,6 +264,7 @@ public sealed partial class GpuCommandInterpreter
 
             var packetAddress = cursor.Address + ((ulong)cursor.Offset * sizeof(uint));
             var header = ReadDword(packetAddress, RenderPhaseProfile.CommandReadKind.Header);
+            _packetSerial++;
             var total = cursor.DwordCount;
             var remaining = cursor.Remaining;
             var offset = cursor.Offset;
@@ -279,6 +302,15 @@ public sealed partial class GpuCommandInterpreter
             }
 
             var opcode = PacketHeader.Opcode(header);
+            // Only a wait or an inert NOP/marker may separate the store and its paired wait.
+            // Draws, dispatches and transfers may produce a newer GPU value at the same address.
+            if (opcode is not (PacketOpcode.WaitRegisterMemory or PacketOpcode.WaitRegisterMemory64) &&
+                !(opcode == PacketOpcode.Nop && PacketHeader.CustomCode(header) is
+                    0 or PacketCustomCode.PushMarker or PacketCustomCode.PopMarker or
+                    PacketCustomCode.WaitMemory32 or PacketCustomCode.WaitMemory64))
+            {
+                _lastWriteLength = 0;
+            }
             var handler = PacketDispatchTable.Opcodes[opcode];
             if (handler is null)
             {
@@ -411,6 +443,16 @@ public sealed partial class GpuCommandInterpreter
         {
             throw _host.Fatal($"The command stream cannot write guest memory: address=0x{address:X16} size={source.Length}.");
         }
+        _lastWriteLength = 0;
+        if (source.Length is sizeof(uint) or sizeof(ulong))
+        {
+            _lastWriteAddress = address;
+            _lastWriteValue = source.Length == sizeof(uint)
+                ? BinaryPrimitives.ReadUInt32LittleEndian(source)
+                : BinaryPrimitives.ReadUInt64LittleEndian(source);
+            _lastWriteLength = source.Length;
+            _lastWritePacket = _packetSerial;
+        }
     }
 
     private static ulong Address(uint low, uint high) => low | ((ulong)high << 32);

src/SharpEmu.Libs/Gpu/IGuestGpuBackend.cs

@@ -57,6 +57,11 @@ internal interface IGuestGpuBackend
     // Marks the frame boundary; off the worker it first waits for the accepted submissions.
     IdleOutcome SubmitDone(ICpuMemory memory);
 
+    void RunAfterPendingCommandStreams(Action work)
+    {
+        work();
+    }
+
     /// <summary>Registers a display buffer with its guest texture format tag.</summary>
     void RegisterKnownDisplayBuffer(ulong address, uint guestFormat);
 

src/SharpEmu.Libs/Gpu/Images/CachedImage.Transfers.cs

@@ -131,10 +131,39 @@ public sealed unsafe partial class CachedImage
             return;
         }
 
+        // Attachment accesses inside one rendering scope are already ordered by rasterization
+        // order, so a barrier that only repeats an attachment write in the same layout matters
+        // only to what runs after the scope; it waits for the scope to end instead of ending it.
+        if (OnlyRepeatsAttachmentAccess(barriers) &&
+            _scheduler.TryDeferUntilRenderingEnds(sourceStages == 0 ? PipelineStageFlags.TopOfPipeBit : sourceStages, stage, barriers))
+        {
+            return;
+        }
+
         _scheduler.EndRendering();
         RecordBarriers(command, sourceStages, stage, null, barriers);
     }
 
+    private const AccessFlags2 AttachmentAccess =
+        AccessFlags2.ColorAttachmentReadBit | AccessFlags2.ColorAttachmentWriteBit |
+        AccessFlags2.DepthStencilAttachmentReadBit | AccessFlags2.DepthStencilAttachmentWriteBit;
+
+    private static bool OnlyRepeatsAttachmentAccess(List<ImageMemoryBarrier2> barriers)
+    {
+        foreach (var barrier in barriers)
+        {
+            if (barrier.OldLayout != barrier.NewLayout ||
+                barrier.SrcAccessMask == 0 ||
+                (barrier.SrcAccessMask & ~AttachmentAccess) != 0 ||
+                (barrier.DstAccessMask & ~AttachmentAccess) != 0)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
     private void RecordBarriers(CommandBuffer command, PipelineStageFlags sourceStages, PipelineStageFlags destinationStages, BufferMemoryBarrier2* bufferBarrier, List<ImageMemoryBarrier2> imageBarriers)
     {
         var images = imageBarriers.ToArray();
@@ -594,4 +623,30 @@ public sealed unsafe partial class CachedImage
         _device.Vk.CmdCopyImage(command, source.Backing.Handle, ImageLayout.TransferSrcOptimal, Backing.Handle, ImageLayout.TransferDstOptimal, copyCount, copies);
         Transition(ReadyLayout, ReadyAccess, null, command);
     }
+
+    // Copies a rectangle of the source's first mip into one mip of this image, at its origin.
+    public void CopyRegionFrom(CachedImage source, uint sourceX, uint sourceY, uint mip, uint width, uint height)
+    {
+        if (mip >= Backing.MipLevels || sourceX + width > source.Backing.Extent.Width || sourceY + height > source.Backing.Extent.Height)
+        {
+            throw SubmissionScheduler.Fatal(
+                $"The region copy is out of range: mip={mip} levels={Backing.MipLevels} region={sourceX},{sourceY} {width}x{height} " +
+                $"source={source.Backing.Extent.Width}x{source.Backing.Extent.Height}.");
+        }
+
+        _scheduler.EndRendering();
+        var copy = new ImageCopy
+        {
+            SrcSubresource = new ImageSubresourceLayers(ImageAspectFlags.ColorBit, 0, 0, 1),
+            SrcOffset = new Offset3D((int)sourceX, (int)sourceY, 0),
+            DstSubresource = new ImageSubresourceLayers(ImageAspectFlags.ColorBit, mip, 0, 1),
+            Extent = new Extent3D(width, height, 1),
+        };
+        var command = new CommandBuffer(_scheduler.Current.Handle);
+        Transition(ImageLayout.TransferDstOptimal, AccessFlags.TransferWriteBit, null, command);
+        source.Transition(ImageLayout.TransferSrcOptimal, AccessFlags.TransferReadBit, null, command);
+        _device.Vk.CmdCopyImage(command, source.Backing.Handle, ImageLayout.TransferSrcOptimal, Backing.Handle, ImageLayout.TransferDstOptimal, 1, &copy);
+        Transition(ReadyLayout, ReadyAccess, null, command);
+        source.Transition(ReadyLayout, ReadyAccess, null, command);
+    }
 }

src/SharpEmu.Libs/Gpu/Images/CachedImage.cs

@@ -414,10 +414,19 @@ public sealed unsafe partial class CachedImage : IDisposable
 
     public bool IsGpuModified => _gpuModified;
 
+    private static long _gpuWriteCounter;
+
+    // Orders GPU writes between images; bumped whenever an acquire lets the GPU write this image.
+    public long GpuWriteSequence { get; private set; }
+
+    // The write sequence of the mip tail block image last copied into this chain's tail mips.
+    public long MergedTailSequence;
+
     public void MarkGpuModified()
     {
         _gpuModified = true;
         _bufferHoldsGpuContents = false;
+        GpuWriteSequence = Interlocked.Increment(ref _gpuWriteCounter);
         _guestPieceHashes = null;
     }
 

src/SharpEmu.Libs/Gpu/Images/GpuTiler.cs

@@ -63,7 +63,7 @@ public struct TileTransferArguments
 // Runs the tiling, detiling, depth conversion and channel swap compute passes.
 public sealed unsafe class GpuTiler : IDisposable
 {
-    private const uint KindCount = 9;
+    private const uint KindCount = 10;
     private const uint ElementSizeCount = 5;
     private const uint DirectionCount = 2;
     private const uint PipelineCount = KindCount * ElementSizeCount * DirectionCount;

src/SharpEmu.Libs/Gpu/Images/GuestImageCache.Collection.cs

@@ -8,10 +8,16 @@ namespace SharpEmu.Libs.Gpu.Images;
 // Garbage collection by recency and memory pressure, and the scheduled readback flush.
 public sealed partial class GuestImageCache
 {
-    public void RunGarbageCollector()
+    public void RunGarbageCollector() => RunGarbageCollector(endsFrame: true);
+
+    // Image ages are counted in frames. Collection also runs after guest submissions, so memory
+    // pressure is relieved during long stretches without a flip, but only a frame advances the
+    // age: a title submits dozens of command buffers per frame, and counting those made every
+    // texture it samples once per frame look stale, so it was deleted and uploaded again.
+    public void RunGarbageCollector(bool endsFrame)
     {
         using var held = _lock.Hold();
-        var tick = _collectionTick++;
+        var tick = endsFrame ? _collectionTick++ : _collectionTick;
         if (_totalUsedMemory < _collectionStartBytes)
         {
             return;
@@ -28,7 +34,13 @@ public sealed partial class GuestImageCache
     {
         var pressured = _totalUsedMemory >= _memoryPressureBytes;
         var aggressive = allowAggressive && _totalUsedMemory >= _criticalMemoryBytes;
-        var age = Math.Min(aggressive ? 160UL : pressured ? 80UL : 16UL, tick);
+        var age = aggressive ? 160UL : pressured ? 80UL : 16UL;
+        if (tick < age && !pressured && !aggressive)
+        {
+            return;
+        }
+
+        age = Math.Min(age, tick);
         var deletions = aggressive ? 40 : pressured ? 20 : 10;
         var candidates = new List<ResourceSlotIdentifier>(deletions);
         // Deleting a depth image also deletes its stencil association, so the recency walk ends first.
@@ -187,12 +199,14 @@ public sealed partial class GuestImageCache
     internal void AddPageOwner(ulong address, ResourceSlotIdentifier imageIdentifier)
     {
         using var held = _lock.Hold();
+        InvalidateLookups();
         _pageOwners.GetOrCreate(address >> ImagePageOwnerTable.PageBits).Add(imageIdentifier);
     }
 
     internal bool RemovePageOwner(ulong address, ResourceSlotIdentifier imageIdentifier)
     {
         using var held = _lock.Hold();
+        InvalidateLookups();
         return _pageOwners.Find(address >> ImagePageOwnerTable.PageBits)?.Remove(imageIdentifier) == true;
     }
 
@@ -251,6 +265,12 @@ public sealed partial class GuestImageCache
         metadata.ClearMask = 0;
     }
 
+    internal void RegisterDccMetadataForTest(ulong address, ulong size)
+    {
+        using var held = _lock.Hold();
+        _surfaceMetadata[address] = new SurfaceMetadata { Kind = SurfaceMetadataKind.Dcc, Size = size };
+    }
+
     internal RegionLockScope HoldLockForTest() => new(_lock);
 
     internal readonly struct RegionLockScope : IDisposable

src/SharpEmu.Libs/Gpu/Images/GuestImageCache.Lookup.cs

@@ -0,0 +1,90 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+using SharpEmu.Libs.Gpu.Buffers;
+
+namespace SharpEmu.Libs.Gpu.Images;
+
+public sealed partial class GuestImageCache
+{
+    private const int LookupSlots = 256;
+
+    private static readonly bool LookupMemoEnabled = Environment.GetEnvironmentVariable("SHARPEMU_IMAGE_LOOKUP_MEMO") != "0";
+
+    private struct LookupMemo
+    {
+        public ImageRequest Request;
+        public ImageViewDescription View;
+        public ResourceSlotIdentifier Result;
+        public ulong Generation;
+        public bool ExactFormat;
+    }
+
+    private LookupMemo[]? _lookups;
+    private ulong _lookupGeneration = 1;
+    private long _lookupHits;
+    private long _lookupMisses;
+    private static long _totalLookupHits;
+    private static long _totalLookupMisses;
+
+    public (long Hits, long Misses) LookupMemoCounters => (_lookupHits, _lookupMisses);
+
+    public static string TakeLookupReport() => FormattableString.Invariant(
+        $"[PERF][IMAGE_LOOKUP] memo_hits={Interlocked.Exchange(ref _totalLookupHits, 0)} memo_misses={Interlocked.Exchange(ref _totalLookupMisses, 0)}");
+
+    private void InvalidateLookups() => _lookupGeneration++;
+
+    private static int LookupSlot(in ImageRequest request, bool exactFormat)
+    {
+        var hash = HashCode.Combine(request.Description.Data.Address, request.Description.Data.Size, request.Description.PixelFormat,
+            request.Description.Extent.Width, request.View.Format, request.View.BaseLevel, request.View.BaseLayer,
+            HashCode.Combine(request.Role, exactFormat, request.View.Type, request.Description.Resources));
+        return hash & (LookupSlots - 1);
+    }
+
+    private static bool SameRequest(in ImageRequest left, in ImageRequest right) =>
+        MemoryMarshal.AsBytes(new ReadOnlySpan<ImageRequest>(in left)).SequenceEqual(MemoryMarshal.AsBytes(new ReadOnlySpan<ImageRequest>(in right)));
+
+    private bool TryReuseLookup(ref ImageRequest request, bool exactFormat, out ResourceSlotIdentifier result)
+    {
+        result = ResourceSlotIdentifier.Invalid;
+        if (!LookupMemoEnabled || _lookups is not { } lookups || request.Role == ImageRole.DisplaySurface)
+        {
+            return false;
+        }
+
+        ref var memo = ref lookups[LookupSlot(request, exactFormat)];
+        if (memo.Generation != _lookupGeneration || memo.ExactFormat != exactFormat || !SameRequest(memo.Request, request) ||
+            _slots.TryGet(memo.Result) is not { Registered: true } image)
+        {
+            _lookupMisses++;
+            Interlocked.Increment(ref _totalLookupMisses);
+            return false;
+        }
+
+        _lookupHits++;
+        Interlocked.Increment(ref _totalLookupHits);
+        request.View = memo.View;
+        image.LastAccessTick = _scheduler.CurrentTick;
+        TouchImage(image);
+        result = memo.Result;
+        return true;
+    }
+
+    private void RememberLookup(in ImageRequest original, bool exactFormat, in ImageViewDescription view, ResourceSlotIdentifier result)
+    {
+        if (!LookupMemoEnabled || original.Role == ImageRole.DisplaySurface)
+        {
+            return;
+        }
+
+        var lookups = _lookups ??= new LookupMemo[LookupSlots];
+        ref var memo = ref lookups[LookupSlot(original, exactFormat)];
+        memo.Request = original;
+        memo.View = view;
+        memo.Result = result;
+        memo.ExactFormat = exactFormat;
+        memo.Generation = _lookupGeneration;
+    }
+}

src/SharpEmu.Libs/Gpu/Images/GuestImageCache.Metadata.cs

@@ -1,13 +1,271 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using SharpEmu.HLE.GpuMemory;
+using SharpEmu.Libs.Gpu.Buffers;
 using SharpEmu.Libs.Gpu.Scheduling;
+using Silk.NET.Vulkan;
 
 namespace SharpEmu.Libs.Gpu.Images;
 
 // Surface metadata (HTile, DCC, CMask, FMask) keyed by its guest address.
 public sealed partial class GuestImageCache
 {
+    private unsafe void MaterializeDccClear(
+        ResourceSlotIdentifier imageIdentifier,
+        in ImageRequest request,
+        uint metadataBaseLayer)
+    {
+        if (request.Description.Metadata.Kind != MetadataKind.Dcc)
+        {
+            return;
+        }
+
+        var description = request.Description;
+        var range = description.Metadata.Range;
+        using (var held = _lock.Hold())
+        {
+            var image = _slots.TryGet(imageIdentifier);
+            if (image == null)
+            {
+                return;
+            }
+
+            image.Description.Metadata = description.Metadata;
+            if (range.Size == 0 || description.Resources.Levels != 1 ||
+                image.Description.Resources.Levels != 1)
+            {
+                return;
+            }
+
+            _surfaceMetadata.Remove(range.Address);
+        }
+
+        var layers = description.TransferLayers;
+        const ulong metadataBlockSize = 0x1000;
+        if (!ImageDescription.IsValidRange(range) ||
+            range.Address % metadataBlockSize != 0 ||
+            layers == 0 ||
+            range.Size % layers != 0 ||
+            (range.Size / layers) % metadataBlockSize != 0)
+        {
+            throw SubmissionScheduler.Fatal(
+                $"DCC slices must contain aligned 4 KiB blocks: address=0x{range.Address:X16} size=0x{range.Size:X} layers={layers}.");
+        }
+
+        var view = request.View;
+        var volume = description.IsVolume && view.Type == ImageViewType.Type3D;
+        var first = volume ? 0u : metadataBaseLayer;
+        var imageFirst = volume ? 0u : view.BaseLayer;
+        var count = volume ? description.Extent.Depth : view.LayerCount;
+        if (first >= layers || count == 0 || count > layers - first)
+        {
+            throw SubmissionScheduler.Fatal(
+                $"The DCC view exceeds its metadata slices: first={first} count={count} layers={layers}.");
+        }
+
+        var sliceSize = range.Size / layers;
+        var synchronizedAddress = range.Address + sliceSize * first;
+        var synchronizedSize = sliceSize * count;
+
+        if (_bufferCache.HasGpuDirtyBytes(synchronizedAddress, synchronizedSize))
+        {
+            _bufferCache.ReadMemory(synchronizedAddress, synchronizedSize, isWrite: false);
+        }
+
+        const int metadataScanChunkSize = 64 * 1024;
+        var bytes = System.Buffers.ArrayPool<byte>.Shared.Rent(
+            checked((int)Math.Min(sliceSize, (ulong)metadataScanChunkSize)));
+        try
+        {
+            Span<byte> firstByte = stackalloc byte[1];
+            for (uint slice = 0; slice < count; slice++)
+            {
+                var address = range.Address + sliceSize * (first + slice);
+                if (!_backing.TryReadBacking(address, firstByte))
+                {
+                    throw SubmissionScheduler.Fatal(
+                        $"Could not read DCC metadata key: address=0x{address:X16}.");
+                }
+
+                var code = firstByte[0];
+                if (!PackedClearValue.TryDecodeDccColor(
+                        request.View.Format,
+                        code * 0x01010101u,
+                        description.Metadata,
+                        allowClearToRegister: request.Role == ImageRole.ColorTarget,
+                        out var clear))
+                {
+                    continue;
+                }
+
+                var uniform = true;
+                for (ulong position = 0; position < sliceSize && uniform;)
+                {
+                    var length = checked((int)Math.Min(
+                        sliceSize - position,
+                        (ulong)Math.Min(bytes.Length, metadataScanChunkSize)));
+                    var chunk = bytes.AsSpan(0, length);
+                    if (!_backing.TryReadBacking(address + position, chunk))
+                    {
+                        throw SubmissionScheduler.Fatal(
+                            $"Could not read DCC metadata backing: address=0x{address + position:X16} size=0x{length:X}.");
+                    }
+
+                    for (var index = 0; index < chunk.Length; index++)
+                    {
+                        if (chunk[index] != code)
+                        {
+                            uniform = false;
+                            break;
+                        }
+                    }
+
+                    position += (ulong)length;
+                }
+
+                if (!uniform)
+                {
+                    continue;
+                }
+
+                using (var held = _lock.Hold())
+                {
+                    if (_slots.TryGet(imageIdentifier) == null)
+                    {
+                        return;
+                    }
+
+                    ClearDccImage(
+                        imageIdentifier,
+                        request,
+                        new SubresourceRange(view.BaseLevel, view.LevelCount, imageFirst + slice, 1),
+                        clear);
+                }
+
+                if (request.Role != ImageRole.DisplaySurface)
+                {
+                    _bufferCache.FillBuffer(address, sliceSize, uint.MaxValue, isGds: false);
+                }
+            }
+        }
+        finally
+        {
+            System.Buffers.ArrayPool<byte>.Shared.Return(bytes);
+        }
+    }
+
+    private unsafe void ClearDccImage(
+        ResourceSlotIdentifier imageIdentifier,
+        in ImageRequest request,
+        in SubresourceRange range,
+        in ClearColorValue clear)
+    {
+        var image = _slots[imageIdentifier];
+        ref readonly var description = ref image.Description;
+        if (range.BaseLevel >= description.Resources.Levels || range.LevelCount == 0 ||
+            range.LevelCount > description.Resources.Levels - range.BaseLevel)
+        {
+            throw SubmissionScheduler.Fatal(
+                $"The DCC clear mip range is invalid: base={range.BaseLevel} count={range.LevelCount} levels={description.Resources.Levels}.");
+        }
+
+        var layers = description.IsVolume
+            ? Math.Max(description.Extent.Depth >> (int)range.BaseLevel, 1)
+            : image.Backing.Layers;
+        if (range.LayerCount == 0 || range.BaseLayer >= layers || range.LayerCount > layers - range.BaseLayer)
+        {
+            throw SubmissionScheduler.Fatal(
+                $"The DCC clear layer range is invalid: base={range.BaseLayer} count={range.LayerCount} layers={layers}.");
+        }
+
+        var fullImage = range.BaseLevel == 0 && range.LevelCount == description.Resources.Levels &&
+                        range.BaseLayer == 0 && range.LayerCount == layers;
+        WatchImage(imageIdentifier);
+        if (!fullImage && (image.IsBufferModified || image.IsCpuDirty))
+        {
+            PopulateFromGuest(imageIdentifier, RefreshRequest(image), "before-dcc-clear");
+            if (image.Description.Samples == 1 && (image.IsBufferModified || image.IsCpuDirty))
+            {
+                throw SubmissionScheduler.Fatal(
+                    $"The DCC clear left guest ownership in place: address=0x{description.Data.Address:X16} bufferModified={image.IsBufferModified} cpuDirty={image.IsCpuDirty}.");
+            }
+        }
+
+        var scheduled = _scheduler.Current;
+        if (scheduled.IsInvalid)
+        {
+            throw SubmissionScheduler.Fatal("A DCC clear needs a command buffer that is recording.");
+        }
+
+        scheduled.EndRendering();
+        var command = new CommandBuffer(scheduled.Handle);
+        var needsAttachmentClear = request.View.Format != image.Backing.Format ||
+                                   (description.IsVolume && !fullImage);
+        if (needsAttachmentClear)
+        {
+            var viewDescription = new ImageViewDescription(
+                request.View.Format,
+                range.LayerCount == 1 ? ImageViewType.Type2D : ImageViewType.Type2DArray,
+                ImageAspectFlags.ColorBit,
+                range.BaseLevel,
+                range.LevelCount,
+                range.BaseLayer,
+                range.LayerCount,
+                default,
+                ImageUsageFlags.ColorAttachmentBit);
+            var view = image.GetOrCreateView(viewDescription);
+            image.Transition(
+                ImageLayout.ColorAttachmentOptimal,
+                AccessFlags.ColorAttachmentWriteBit,
+                range,
+                command);
+            var attachment = new RenderingAttachmentInfo
+            {
+                SType = StructureType.RenderingAttachmentInfo,
+                ImageView = view,
+                ImageLayout = ImageLayout.ColorAttachmentOptimal,
+                LoadOp = AttachmentLoadOp.Clear,
+                StoreOp = AttachmentStoreOp.Store,
+                ClearValue = new ClearValue { Color = clear },
+            };
+            var rendering = new RenderingInfo
+            {
+                SType = StructureType.RenderingInfo,
+                RenderArea = new Rect2D(
+                    new Offset2D(0, 0),
+                    new Extent2D(
+                        Math.Max(description.Extent.Width >> (int)range.BaseLevel, 1),
+                        Math.Max(description.Extent.Height >> (int)range.BaseLevel, 1))),
+                LayerCount = range.LayerCount,
+                ColorAttachmentCount = 1,
+                PColorAttachments = &attachment,
+            };
+            _device.Vk.CmdBeginRendering(command, &rendering);
+            _device.Vk.CmdEndRendering(command);
+        }
+        else
+        {
+            image.Transition(ImageLayout.TransferDstOptimal, AccessFlags.TransferWriteBit, range, command);
+            var nativeRange = new ImageSubresourceRange(
+                ImageAspectFlags.ColorBit,
+                range.BaseLevel,
+                range.LevelCount,
+                description.IsVolume ? 0u : range.BaseLayer,
+                description.IsVolume ? 1u : range.LayerCount);
+            var nativeClear = clear;
+            _device.Vk.CmdClearColorImage(
+                command,
+                image.Backing.Handle,
+                ImageLayout.TransferDstOptimal,
+                &nativeClear,
+                1,
+                &nativeRange);
+        }
+
+        TakeGpuOwnership(image);
+    }
+
     public bool IsMetadata(ulong address)
     {
         using var held = _lock.Hold();
@@ -29,6 +287,21 @@ public sealed partial class GuestImageCache
 
     public bool IsMetadataCleared(ulong address, uint slice) => IsMetadataCleared(address, slice, out _);
 
+    public bool OverlapsDccMetadata(ulong address, ulong size)
+    {
+        using var held = _lock.Hold();
+        foreach (var (start, metadata) in _surfaceMetadata)
+        {
+            if (metadata.Kind == SurfaceMetadataKind.Dcc && metadata.Size != 0 &&
+                address < start + metadata.Size && start < address + size)
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     // A broad clear applies to CMask, FMask and HTile; DCC needs a validated fill value.
     public bool ClearMetadata(ulong address)
     {
@@ -42,7 +315,6 @@ public sealed partial class GuestImageCache
         return true;
     }
 
-    // True when registered DCC absorbed the fill and the guest dispatch can be skipped.
     public bool TryAbsorbDccFill(ulong address, ulong size, uint fillValue)
     {
         if (!IsValidRange(address, size))

src/SharpEmu.Libs/Gpu/Images/GuestImageCache.PieceUpload.cs

@@ -25,7 +25,7 @@ public sealed partial class GuestImageCache
     private static ColorTransferPlan? PieceHashPlan(CachedImage image, in ImageRequest request)
     {
         ref readonly var info = ref image.Description;
-        if (request.Role is not (ImageRole.Texture or ImageRole.StorageImage) || info.IsVolume || info.IsDepth ||
+        if (request.Role is not (ImageRole.Texture or ImageRole.StorageImage) || image.DepthOwner.IsValid || info.IsVolume || info.IsDepth ||
             info.Data.Size < PieceHashMinimumImageSize)
         {
             return null;

src/SharpEmu.Libs/Gpu/Images/GuestImageCache.Tracking.cs

@@ -31,6 +31,7 @@ public sealed partial class GuestImageCache
         }
 
         image.Registered = true;
+        InvalidateLookups();
         image.RecencyEntryIndex = _recencyQueue.Insert(imageIdentifier, _collectionTick);
         _totalUsedMemory += image.AccountedSize;
     }
@@ -67,6 +68,7 @@ public sealed partial class GuestImageCache
 
         _totalUsedMemory -= accounted;
         image.Registered = false;
+        InvalidateLookups();
     }
 
     // Removes the image and its stencil associations; the slot is freed after the current tick.

src/SharpEmu.Libs/Gpu/Images/GuestImageCache.Transfers.cs

@@ -725,15 +725,20 @@ public sealed unsafe partial class GuestImageCache
         }
 
         var range = image.Description.Data;
-        var download = _bufferCache.GetUtilityBuffer(GpuBufferUsage.Download);
-        if (!download.TryMap(range.Size, out var offset, Math.Max(image.Description.BytesPerBlock, 4u)))
+        var ring = _bufferCache.GetUtilityBuffer(GpuBufferUsage.Download);
+        GpuBuffer download = ring;
+        if (ring.TryMap(range.Size, out var offset, Math.Max(image.Description.BytesPerBlock, 4u)))
         {
-            throw SubmissionScheduler.Fatal($"The reusable download ring cannot map the image: address=0x{range.Address:X16} size=0x{range.Size:X}.");
+            ring.Commit();
+        }
+        else
+        {
+            download = new GpuBuffer(_device, _scheduler, GpuBufferUsage.Download, 0, GpuBuffer.AllFlags, range.Size);
         }
 
-        download.Commit();
         if (!_backing.TryReadBacking(range.Address, download.Mapped.Slice((int)offset, (int)range.Size)))
         {
+            if (download != ring) download.Dispose();
             return false;
         }
 
@@ -761,6 +766,8 @@ public sealed unsafe partial class GuestImageCache
                 throw SubmissionScheduler.Fatal($"The image readback could not be written to guest memory: address=0x{range.Address:X16} size=0x{range.Size:X}.");
             }
         });
+        // Completion actions wait for the priority readback before freeing spill buffers.
+        if (download != ring) _scheduler.QueueCompletionAction(download.Dispose);
         return true;
     }
 

src/SharpEmu.Libs/Gpu/Images/GuestImageCache.cs

@@ -123,7 +123,60 @@ public sealed unsafe partial class GuestImageCache : IGuestImageCache, IGuestIma
             return GetNullImage(request);
         }
 
+        var metadataBaseLayer = request.View.BaseLayer;
+        var result = LookUpImage(ref request, exactFormat);
+
+        if (request.Role is ImageRole.Texture or ImageRole.StorageImage)
+        {
+            ulong metadataAddress;
+            ulong sliceSize;
+            using (var held = _lock.Hold())
+            {
+                var image = _slots[result];
+                if (request.Description.Metadata.Kind == MetadataKind.Dcc && request.Description.Metadata.Range.Size == 0 &&
+                    image.Description.Metadata.Kind == MetadataKind.None)
+                {
+                    image.Description.Metadata = request.Description.Metadata;
+                }
+
+                ref readonly var description = ref image.Description;
+                metadataAddress = description.Metadata.Range.Address;
+                sliceSize = description.DccSliceSize;
+            }
+
+            if (sliceSize != 0)
+            {
+                SynchronizeGuestDccMetadata(metadataAddress, sliceSize, request.View.BaseLayer, request.View.LayerCount);
+            }
+        }
+
+        MaterializeDccClear(result, request, metadataBaseLayer);
+        if (request.Role == ImageRole.DisplaySurface && request.Description.Metadata.Compression != DisplayCompression.Uncompressed)
+        {
+            using var held = _lock.Hold();
+            var image = _slots[result];
+            var guestDirty = image.IsBufferModified || image.IsCpuDirty;
+            var nativeCurrent = (image.Uses.RenderTarget || image.IsGpuModified) && !guestDirty;
+            if (!nativeCurrent)
+            {
+                throw SubmissionScheduler.Fatal(
+                    $"A compressed display surface can only be read from clean native GPU contents: address=0x{image.Description.Data.Address:X16} bufferModified={image.IsBufferModified} cpuDirty={image.IsCpuDirty} gpuModified={image.IsGpuModified}.");
+            }
+        }
+
+        return result;
+    }
+
+    private ResourceSlotIdentifier LookUpImage(ref ImageRequest request, bool exactFormat)
+    {
         using var held = _lock.Hold();
+        if (TryReuseLookup(ref request, exactFormat, out var reused))
+        {
+            return reused;
+        }
+
+        var original = request;
+        var generation = _lookupGeneration;
         var result = ResourceSlotIdentifier.Invalid;
         var candidates = FindImagesInRange(request.Description.Data.Address, request.Description.Data.Size, pageOverlap: false);
         foreach (var imageIdentifier in candidates)
@@ -134,6 +187,7 @@ public sealed unsafe partial class GuestImageCache : IGuestImageCache, IGuestIma
             }
         }
 
+        var sameBacking = result.IsValid;
         var viewMip = -1;
         var viewLayer = -1;
         if (!result.IsValid)
@@ -197,17 +251,6 @@ public sealed unsafe partial class GuestImageCache : IGuestImageCache, IGuestIma
         }
 
         var image = _slots[result];
-        if (request.Role == ImageRole.DisplaySurface && request.Description.Metadata.Compression != DisplayCompression.Uncompressed)
-        {
-            var guestDirty = image.IsBufferModified || image.IsCpuDirty;
-            var nativeCurrent = (image.Uses.RenderTarget || image.IsGpuModified) && !guestDirty;
-            if (!nativeCurrent)
-            {
-                throw SubmissionScheduler.Fatal(
-                    $"A compressed display surface can only be read from clean native GPU contents: address=0x{image.Description.Data.Address:X16} bufferModified={image.IsBufferModified} cpuDirty={image.IsCpuDirty} gpuModified={image.IsGpuModified}.");
-            }
-        }
-
         if (viewMip >= 0)
         {
             request.View = request.View with { BaseLevel = (uint)viewMip };
@@ -220,6 +263,11 @@ public sealed unsafe partial class GuestImageCache : IGuestImageCache, IGuestIma
 
         image.LastAccessTick = _scheduler.CurrentTick;
         TouchImage(image);
+        if (sameBacking && generation == _lookupGeneration)
+        {
+            RememberLookup(original, exactFormat, request.View, result);
+        }
+
         return result;
     }
 
@@ -268,6 +316,7 @@ public sealed unsafe partial class GuestImageCache : IGuestImageCache, IGuestIma
         if (hasData)
         {
             RefreshFromGuest(imageIdentifier, request);
+            MergeMipTailBlock(image);
         }
 
         switch (request.Role)
@@ -313,14 +362,14 @@ public sealed unsafe partial class GuestImageCache : IGuestImageCache, IGuestIma
         image.MarkGpuModified();
         image.Uses.RenderTarget = true;
         RefreshFromGuest(imageIdentifier, request);
-        // DCC lives in its own allocation; it is registered at bind time, keeping a pending fill.
-        if (request.Description.Metadata.Kind == MetadataKind.Dcc)
+        if (request.Description.Metadata.Kind == MetadataKind.Dcc && request.Description.Metadata.Range.Size == 0)
         {
             image.Description.Metadata = request.Description.Metadata;
             var address = request.Description.Metadata.Range.Address;
             if (!_surfaceMetadata.TryGetValue(address, out var metadata))
             {
-                _surfaceMetadata.Add(address, new SurfaceMetadata { Kind = SurfaceMetadataKind.Dcc });
+                metadata = new SurfaceMetadata { Kind = SurfaceMetadataKind.Dcc };
+                _surfaceMetadata.Add(address, metadata);
             }
             else if (metadata.Kind == SurfaceMetadataKind.PendingDcc)
             {
@@ -330,6 +379,8 @@ public sealed unsafe partial class GuestImageCache : IGuestImageCache, IGuestIma
             {
                 throw SubmissionScheduler.Fatal($"A color target reuses metadata that is not DCC: address=0x{address:X16} kind={metadata.Kind}.");
             }
+
+            metadata.Size = Math.Max(metadata.Size, request.Description.DccSliceSize * request.Description.TransferLayers);
         }
 
         TakeGpuOwnership(image);
@@ -388,6 +439,69 @@ public sealed unsafe partial class GuestImageCache : IGuestImageCache, IGuestIma
         return image.GetOrCreateView(request.View);
     }
 
+    // GFX10 packs the mips smaller than half a swizzle block into one block at the start of the chain.
+    // A title can write that block through a single-level view the size of the block (Unity's
+    // screen-space reflection blur writes mips 3 and up that way), which the cache keeps as its own
+    // image; copy each tail mip out of it before the chain is read.
+    private void MergeMipTailBlock(CachedImage chain)
+    {
+        ref var description = ref chain.Description;
+        if (description.Resources.Levels <= 1 || description.IsBlock || description.IsDepth || description.Samples > 1 ||
+            description.Resources.Layers != 1 || description.IsVolume ||
+            !Agc.GnmTiling.TryGetBlockElementDimensions((uint)description.TileMode, (int)description.BytesPerBlock, out var blockWidth, out var blockHeight))
+        {
+            return;
+        }
+
+        foreach (var candidateIdentifier in FindImagesInRange(description.Data.Address, 1, pageOverlap: false))
+        {
+            var block = _slots[candidateIdentifier];
+            ref var blockDescription = ref block.Description;
+            if (ReferenceEquals(block, chain) || blockDescription.Data.Address != description.Data.Address ||
+                blockDescription.Resources.Levels != 1 || blockDescription.Resources.Layers != 1 ||
+                blockDescription.Extent.Width != (uint)blockWidth || blockDescription.Extent.Height != (uint)blockHeight ||
+                blockDescription.BytesPerBlock != description.BytesPerBlock || blockDescription.TileMode != description.TileMode ||
+                !block.IsGpuModified || !block.Backing.Exists || block.GpuWriteSequence <= chain.MergedTailSequence)
+            {
+                continue;
+            }
+
+            if (!Agc.GnmTiling.TryGetMipChainPlacement(
+                    (uint)description.TileMode,
+                    (int)description.Extent.Width,
+                    (int)description.Extent.Height,
+                    (int)description.BytesPerBlock,
+                    description.Resources.Levels,
+                    out var placements,
+                    out _))
+            {
+                return;
+            }
+
+            for (var mip = 0; mip < placements.Length && mip < chain.Backing.MipLevels; mip++)
+            {
+                var placement = placements[mip];
+                if (!placement.InMipTail ||
+                    placement.TailElementX + placement.ElementsWide > blockWidth ||
+                    placement.TailElementY + placement.ElementsHigh > blockHeight)
+                {
+                    continue;
+                }
+
+                chain.CopyRegionFrom(
+                    block,
+                    (uint)placement.TailElementX,
+                    (uint)placement.TailElementY,
+                    (uint)mip,
+                    (uint)placement.ElementsWide,
+                    (uint)placement.ElementsHigh);
+            }
+
+            chain.MergedTailSequence = block.GpuWriteSequence;
+            return;
+        }
+    }
+
     private void RefreshStencilPlane(ResourceSlotIdentifier depthIdentifier, CachedImage depth, bool stencilCompressed)
     {
         var association = AssociateStencilRange(depthIdentifier, depth.Description.Stencil);

src/SharpEmu.Libs/Gpu/Images/ImageDescription.cs

@@ -28,8 +28,11 @@ public struct MetadataDescription
     public GuestSpan Range;
     public MetadataKind Kind;
     public uint Control;
+    public uint DccClearWord;
     public DisplayCompression Compression;
     public bool StencilCompressed;
+    public bool DccClearRegisterValid;
+    public bool DccAlphaMsb;
 }
 
 public readonly record struct SubresourceCount(uint Levels, uint Layers) : IComparable<SubresourceCount>
@@ -366,7 +369,8 @@ public struct ImageDescription
         {
             case MetadataKind.None:
                 if (!IsEmptyRange(Metadata.Range) || Metadata.Control != 0 ||
-                    Metadata.Compression != DisplayCompression.Uncompressed || Metadata.StencilCompressed)
+                    Metadata.DccClearWord != 0 || Metadata.Compression != DisplayCompression.Uncompressed || Metadata.StencilCompressed ||
+                    Metadata.DccClearRegisterValid || Metadata.DccAlphaMsb)
                 {
                     throw SubmissionScheduler.Fatal("An image without metadata carries metadata state.");
                 }
@@ -378,6 +382,11 @@ public struct ImageDescription
                     throw SubmissionScheduler.Fatal($"The HTile metadata is invalid: address=0x{Metadata.Range.Address:X16} size=0x{Metadata.Range.Size:X16}.");
                 }
 
+                if (Metadata.DccClearWord != 0 || Metadata.DccClearRegisterValid || Metadata.DccAlphaMsb)
+                {
+                    throw SubmissionScheduler.Fatal("HTile metadata carries DCC clear state.");
+                }
+
                 break;
             case MetadataKind.Dcc:
                 if (Metadata.Range.Address == 0 || Metadata.Range.Address >= TrackerLayout.SpaceBytes ||
@@ -457,7 +466,7 @@ public sealed record DepthFormatRule(GuestDepthFormat DepthFormat, GuestPixelFor
 
 public readonly record struct DisplayPixelFormat(Format HostFormat, GuestPixelFormat GuestFormat, uint BytesPerElement, bool Bgra16);
 
-// The six display surface pixel formats the store accepts.
+// Display formats retain their encoded values; presentation applies the transfer function.
 public static class DisplayFormatRule
 {
     public static readonly (ulong PixelFormat, DisplayPixelFormat Info)[] Table =
@@ -466,6 +475,10 @@ public static class DisplayFormatRule
         (0x8000000000000000, new DisplayPixelFormat(Format.B8G8R8A8Srgb, GuestPixelFormat.Bits8_8_8_8Srgb, 4, false)),
         (0x8100000022000000, new DisplayPixelFormat(Format.A2B10G10R10UnormPack32, GuestPixelFormat.Bits10_10_10_2UNorm, 4, false)),
         (0x8100000000000000, new DisplayPixelFormat(Format.A2R10G10B10UnormPack32, GuestPixelFormat.Bits10_10_10_2UNorm, 4, false)),
+        (0x8100000622000000, new DisplayPixelFormat(Format.A2B10G10R10UnormPack32, GuestPixelFormat.Bits10_10_10_2UNorm, 4, false)),
+        (0x8100000600000000, new DisplayPixelFormat(Format.A2R10G10B10UnormPack32, GuestPixelFormat.Bits10_10_10_2UNorm, 4, false)),
+        (0x8100070422000000, new DisplayPixelFormat(Format.A2B10G10R10UnormPack32, GuestPixelFormat.Bits10_10_10_2UNorm, 4, false)),
+        (0x8100070400000000, new DisplayPixelFormat(Format.A2R10G10B10UnormPack32, GuestPixelFormat.Bits10_10_10_2UNorm, 4, false)),
         (0xc001000622000000, new DisplayPixelFormat(Format.R16G16B16A16Sfloat, GuestPixelFormat.Bits16_16_16_16Float, 8, false)),
         (0xc001000600000000, new DisplayPixelFormat(Format.R16G16B16A16Sfloat, GuestPixelFormat.Bits16_16_16_16Float, 8, true)),
     ];
@@ -503,6 +516,87 @@ public static class DisplayFormatRule
 // Decoders for the packed 32-bit clear values guest compute fills carry.
 public static class PackedClearValue
 {
+    public static bool SupportsDccFixedColor(Format format) => DccComponentCount(format) != 0;
+
+    public static bool TryDecodeDccColor(
+        Format format,
+        uint metadataFill,
+        in MetadataDescription metadata,
+        bool allowClearToRegister,
+        out ClearColorValue clear)
+    {
+        clear = default;
+        var code = (byte)metadataFill;
+        if (metadataFill != code * 0x01010101u)
+        {
+            return false;
+        }
+
+        if (code == 0x20)
+        {
+            return allowClearToRegister && metadata.DccClearRegisterValid &&
+                   TryDecodeColor(format, metadata.DccClearWord, out clear);
+        }
+
+        if (code == 0x00)
+        {
+            return true;
+        }
+
+        var components = DccComponentCount(format);
+        if (components == 0 || code is not (0x40 or 0x80 or 0xc0))
+        {
+            return false;
+        }
+
+        var rgb = (code & 0x80) != 0 ? 1.0f : 0.0f;
+        var alpha = (code & 0x40) != 0 ? 1.0f : 0.0f;
+        Span<float> channels = stackalloc float[4] { rgb, rgb, rgb, alpha };
+        if (!metadata.DccAlphaMsb)
+        {
+            (channels[0], channels[3]) = (channels[3], channels[0]);
+        }
+
+        if (components == 1)
+        {
+            channels[0] = channels[3];
+        }
+        else if (components == 2)
+        {
+            channels[1] = channels[3];
+        }
+
+        switch (format)
+        {
+            case Format.B8G8R8A8Unorm:
+            case Format.B8G8R8A8Srgb:
+            case Format.A2R10G10B10UnormPack32:
+            case Format.A1R5G5B5UnormPack16:
+            case Format.R5G6B5UnormPack16:
+                (channels[0], channels[2]) = (channels[2], channels[0]);
+                break;
+            case Format.R4G4B4A4UnormPack16:
+                (channels[0], channels[3]) = (channels[3], channels[0]);
+                (channels[1], channels[2]) = (channels[2], channels[1]);
+                break;
+        }
+
+        clear = new ClearColorValue(channels[0], channels[1], channels[2], channels[3]);
+        return true;
+    }
+
+    private static uint DccComponentCount(Format format) => format switch
+    {
+        Format.R8Unorm or Format.R16Unorm or Format.R16Sfloat or Format.R32Sfloat => 1,
+        Format.R8G8Unorm or Format.R16G16Unorm or Format.R16G16Sfloat or Format.R32G32Sfloat => 2,
+        Format.R5G6B5UnormPack16 or Format.B10G11R11UfloatPack32 => 3,
+        Format.R8G8B8A8Unorm or Format.R8G8B8A8Srgb or Format.B8G8R8A8Unorm or Format.B8G8R8A8Srgb or
+        Format.A2B10G10R10UnormPack32 or Format.A2R10G10B10UnormPack32 or Format.A1R5G5B5UnormPack16 or
+        Format.R4G4B4A4UnormPack16 or Format.R16G16B16A16Unorm or Format.R16G16B16A16Sfloat or
+        Format.R32G32B32A32Sfloat => 4,
+        _ => 0,
+    };
+
     public static bool TryDecodeColor(Format format, uint packed, out ClearColorValue clear)
     {
         static float Unorm8(uint value) => (value & 0xff) / 255.0f;

src/SharpEmu.Libs/Gpu/Images/ImageRequestBuilders.ColorTarget.cs

@@ -39,26 +39,42 @@ public readonly record struct TargetViewRange(uint BaseLayer, uint LayerCount, u
 
 public static partial class ImageRequestBuilders
 {
+    private static long _normalizedSliceRanges;
+
     public static uint SampleCount(uint encodedLog2) => encodedLog2 <= 3 ? 1u << (int)encodedLog2 : 0;
 
+    private static bool DccAlphaOnMsb(in ColorTargetWords words)
+    {
+        switch (words.Layout)
+        {
+            case ChannelLayout.Bits10_10_10_2:
+            case ChannelLayout.Bits10_10_10_2Float:
+            case ChannelLayout.Bits5_5_5_1:
+                return true;
+            case ChannelLayout.Bits2_10_10_10:
+            case ChannelLayout.Bits1_5_5_5:
+                return false;
+        }
+
+        var components = GuestPixelFormats.ResolveRenderTargetEncoding(words.Layout, words.NumberType).Components;
+        if (components == 1)
+        {
+            return words.Order != ChannelOrder.Standard;
+        }
+
+        return components == 3 || words.Order is ChannelOrder.Standard or ChannelOrder.Alternate;
+    }
+
     // DCC clears use the target's packed clear word; the fixed-clear set is a format allow-list.
     private static (bool Supported, bool FixedSupported, ClearColorValue Value) DccClearInfo(Format format, bool hasDcc, uint packedClear)
     {
         ClearColorValue value = default;
         var supported = hasDcc && PackedClearValue.TryDecodeColor(format, packedClear, out value);
-        var fixedSupported = hasDcc && SupportsDccFixedClear(format);
+        var fixedSupported = hasDcc && PackedClearValue.SupportsDccFixedColor(format);
         return (supported, fixedSupported, supported ? value : default);
     }
 
-    public static bool SupportsDccFixedClear(Format format) => format switch
-    {
-        Format.R8Unorm or Format.R8G8Unorm or Format.R8G8B8A8Unorm or Format.R8G8B8A8Srgb or Format.B8G8R8A8Unorm or Format.B8G8R8A8Srgb or
-        Format.A2B10G10R10UnormPack32 or Format.A2R10G10B10UnormPack32 or Format.R5G6B5UnormPack16 or Format.A1R5G5B5UnormPack16 or
-        Format.R4G4B4A4UnormPack16 or Format.R16Unorm or Format.R16G16Unorm or Format.R16G16B16A16Unorm or Format.R16Sfloat or
-        Format.R16G16Sfloat or Format.R16G16B16A16Sfloat or Format.R32Sfloat or Format.R32G32Sfloat or Format.R32G32B32A32Sfloat or
-        Format.B10G11R11UfloatPack32 => true,
-        _ => false,
-    };
+    public static bool SupportsDccFixedClear(Format format) => PackedClearValue.SupportsDccFixedColor(format);
 
     // Builds the request for a bound color target. Null when the slot carries no target.
     public static ColorTargetResolution? ColorTarget(in ColorTargetWords words, uint targetMask, uint drawLayerOffset, bool ignoreTargetMask)
@@ -132,8 +148,12 @@ public static partial class ImageRequestBuilders
         if (volume && view.BaseLayer == 0 && view.LayerCount == depth + 1)
         {
             view = new TargetViewRange(0, depth, depth);
-            Console.Error.WriteLine(
-                $"[LOADER][INFO] normalized an exclusive 3D color-target slice range to depth={depth}");
+            var normalized = Interlocked.Increment(ref _normalizedSliceRanges);
+            if (normalized <= 8 || (normalized & (normalized - 1)) == 0)
+            {
+                Console.Error.WriteLine(
+                    $"[LOADER][INFO] normalized an exclusive 3D color-target slice range to depth={depth} count={normalized}");
+            }
         }
         var tileMode = words.TileMode;
         var standard4 = tileMode == GuestTileMode.Standard4KB;
@@ -291,9 +311,16 @@ public static partial class ImageRequestBuilders
 
         var viewExtent = new Extent2D(Math.Max(width >> (int)words.MipLevel, 1), Math.Max(height >> (int)words.MipLevel, 1));
         var viewDepth = Math.Max(depth >> (int)words.MipLevel, 1);
-        if (volume && (view.BaseLayer >= viewDepth || view.LayerCount > viewDepth - view.BaseLayer))
+        if (volume && view.BaseLayer < viewDepth && view.LayerCount > viewDepth - view.BaseLayer)
         {
-            throw SubmissionScheduler.Fatal($"The 3D render-target view exceeds the mip depth: base={view.BaseLayer} count={view.LayerCount} depth={viewDepth} mip={words.MipLevel}.");
+            // Titles bind a whole volume with the last slice set to its depth, one past the end;
+            // the color block stops at the last slice of the mip.
+            view = view with { LayerCount = viewDepth - view.BaseLayer, ImageLayers = viewDepth };
+        }
+
+        if (volume && view.BaseLayer >= viewDepth)
+        {
+            throw SubmissionScheduler.Fatal($"The 3D render-target view starts past the mip depth: base={view.BaseLayer} count={view.LayerCount} depth={viewDepth} mip={words.MipLevel}.");
         }
 
         var description = ImageDescription.Create();
@@ -311,8 +338,14 @@ public static partial class ImageRequestBuilders
         if (hasDcc)
         {
             // DCC lives in its own allocation; the address lets the cache match fills seen before the target.
+            _ = TileGeometry.TryGetDccSize(
+                width, height, volume ? depth : view.ImageLayers, bytesPerElement, levels, tileMode,
+                out var metadataSize, words.FragmentsLog2);
             description.Metadata.Kind = MetadataKind.Dcc;
-            description.Metadata.Range = new GuestSpan(words.DccAddress, 0);
+            description.Metadata.Range = new GuestSpan(words.DccAddress, metadataSize.Size);
+            description.Metadata.DccClearWord = words.ClearWord0;
+            description.Metadata.DccClearRegisterValid = true;
+            description.Metadata.DccAlphaMsb = DccAlphaOnMsb(words);
         }
 
         for (var level = 0; level < levels; level++)

src/SharpEmu.Libs/Gpu/Images/ImageRequestBuilders.DepthTarget.cs

@@ -58,8 +58,6 @@ public static partial class ImageRequestBuilders
         return Format.Undefined;
     }
 
-    private static bool HtileStencilCompatible(bool hasStencil, bool hasHtile, bool htileStencilDisabled) => !hasStencil || !hasHtile || htileStencilDisabled;
-
     // Builds the request for the bound depth target. Null when no depth or stencil state is active.
     public static DepthTargetResolution? DepthTarget(in DepthTargetWords depthWords, IImageFormatSupport device) =>
         DepthTargetCore(in depthWords, device, copyMode: false, writeBuffer: false);
@@ -127,7 +125,7 @@ public static partial class ImageRequestBuilders
 
         if (hasStencil)
         {
-            if (depthWords.StencilFormat != GuestStencilFormat.Stencil8UInt || !HtileStencilCompatible(hasStencil, hasHtile, depthWords.HtileStencilDisabled) ||
+            if (depthWords.StencilFormat != GuestStencilFormat.Stencil8UInt ||
                 stencilAddress == 0 || (!copyMode && !depthWords.StencilWriteDisabled && depthWords.StencilWriteBase != depthWords.StencilReadBase) || (stencilAddress & 0xFFFF) != 0)
             {
                 throw SubmissionScheduler.Fatal(
@@ -231,10 +229,10 @@ public static partial class ImageRequestBuilders
     // Builds the request for a video-out surface registered by the guest.
     public static ImageRequest DisplaySurface(in DisplaySurfaceWords surface)
     {
-        const ulong StrictColorimetryOption = 1;
+        const ulong SupportedOptions = (1UL << 3) | (1UL << 5); // Strict colorimetry and premultiplied alpha.
         var compression = ImageDescription.ClassifyDisplayCompression(surface.Compressed, surface.MetadataAddress, surface.DccControl, surface.DccClearColor);
         if (surface.Width == 0 || surface.Height == 0 || surface.Width > 16384 || surface.Height > 16384 ||
-            (surface.Option != 0 && surface.Option != StrictColorimetryOption) || surface.TilingMode != 0 || surface.DataAddress == 0 ||
+            (surface.Option & ~SupportedOptions) != 0 || surface.TilingMode != 0 || surface.DataAddress == 0 ||
             compression == DisplayCompression.Unsupported)
         {
             throw SubmissionScheduler.Fatal(

src/SharpEmu.Libs/Gpu/Images/ImageRequestBuilders.Texture.cs

@@ -300,6 +300,17 @@ public static partial class ImageRequestBuilders
         description.BytesPerBlock = blockBytes != 0 ? blockBytes : GuestPixelFormats.BytesPerElement(format);
         description.Samples = samples;
         description.TileMode = tile;
+        if (!shape.R128 && words.Length >= 8 && descriptor.MetadataCompress &&
+            tile != GuestTileMode.Depth && !description.IsDepth)
+        {
+            _ = TileGeometry.TryGetDccSize(
+                width, height, volume ? depth : imageLayers, description.BytesPerBlock, levels, tile,
+                out var metadataSize, (uint)System.Numerics.BitOperations.TrailingZeroCount(samples));
+            description.Metadata.Kind = MetadataKind.Dcc;
+            description.Metadata.Range = new GuestSpan(descriptor.MetadataAddress << 8, metadataSize.Size);
+            description.Metadata.DccAlphaMsb = descriptor.DccAlphaMsb;
+        }
+
         if (samples > 1)
         {
             description.MipLayout[0] = new MipLevelLayout { Offset = 0, Size = size.Size, Pitch = pitch, Height = height };

src/SharpEmu.Libs/Gpu/Images/MipStatistics.cs

@@ -0,0 +1,53 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.Gpu.Images;
+
+public sealed class MipStatistics
+{
+    public const int SlotCount = 256;
+    public const uint FirstCounterOffset = 64;
+    public const int ReportBytes = (int)FirstCounterOffset + SlotCount * CounterBytes;
+    public const uint NoMipSampled = 15;
+
+    private const int CounterBytes = 2 * sizeof(uint);
+    private const uint FinestMip = 0;
+    private const uint SamplesPerBinding = 0x10000;
+    private const uint MaxSamples = 0xFFFFFF;
+
+    public static MipStatistics Shared { get; } = new();
+
+    private readonly uint[] _bindingsBySlot = new uint[SlotCount];
+
+    public void NoteSampled(in TextureDescriptorWords texture)
+    {
+        if (texture.MipStatsEnabled && !texture.IsNull)
+        {
+            _bindingsBySlot[texture.MipStatsSlot]++;
+        }
+    }
+
+    public bool TryWriteReport(Span<byte> report)
+    {
+        if (report.Length < ReportBytes)
+        {
+            return false;
+        }
+
+        for (var slot = 0; slot < SlotCount; slot++)
+        {
+            var samples = (uint)Math.Min((ulong)_bindingsBySlot[slot] * SamplesPerBinding, MaxSamples);
+            var finestMipSampled = samples == 0 ? NoMipSampled : FinestMip;
+            var clampedSamplesAndSlot = samples | ((uint)slot << 24);
+            var unclampedSamplesAndFinestMip = samples | (finestMipSampled << 24);
+            var counter = report.Slice((int)FirstCounterOffset + slot * CounterBytes, CounterBytes);
+            BinaryPrimitives.WriteUInt32LittleEndian(counter, clampedSamplesAndSlot);
+            BinaryPrimitives.WriteUInt32LittleEndian(counter[sizeof(uint)..], unclampedSamplesAndFinestMip);
+        }
+
+        Array.Clear(_bindingsBySlot);
+        return true;
+    }
+}