PS5 kernel research

The canonical local checkout is /mnt/data/projects/PS5/ps5-kernel-research (renamed on 2026-10-28). The research remains primarily firmware 10.01, with separately qualified inputs for other versions. See workspace relocation for current paths, historical-path compatibility, and evidence-preservation details.

Current direction: broad system contracts and homebrew correctness; see the 2026-10-27 cycle. It also records the user-reported successful 10.01 bare-metal Linux boot and separates it from historical local-design limits. kstuff-lite is comparative evidence, not the required independent-HEN architecture.

New to this repository? Start with START_HERE.md for the artifact map and research workflow. Use the research index to find a topic, unresolved questions to choose work, and the evidence ledger to verify a claim. Titania, stored firmware, and PUP update boundaries have a focused subsystem guide.

Minimal-HEN architecture decision (2026-10-19): the pinned kstuff-lite/Raring comparison identifies the public KELF/UELF data-and-stock-gadget trap path as the only reviewed independent architecture that avoids the rejected fixed adjacent mapping and AuthHeader text retarget. It is not an installable shortcut: shared IDT/TSS/syscall-vector publication, private-CR3 execution, original-handler continuation, failure unwind, callback drain and initializer-exit lifetime remain unqualified. Raring's one-shot Byep, XO and stock SMP receipts cover different prerequisites. No current source or live result establishes a one-shot static authorization patch. If a separately working FW10.01 kstuff-lite boot exists, the same hash-bound controlled SELF could isolate fixture and later-loader behavior, but that would not qualify independent Raring-HEN. No console action is proposed by this report.

Retained HEN entry decision (2026-10-19): the kernel-map reservation handoff finds no reviewed owner-safe, nonfatal exact-VA kernel_map reserve/release pair for the verifier bridge. The option-zero insertion core can coalesce entries or reach a fatal allocation branch; numeric removal can split a coalesced entry or delete a replacement. Allocator-owned backing uses allocator-selected RW addresses. A subsequent constrained-arena audit finds that its numeric free path selects the current record by address and has no recoverable missing-record result. A live vacancy result cannot repair those contracts, and the read-only occupancy seam is itself unqualified from the reviewed post-S3 callback. Keep AuthHeader ingress disabled and seek a different ownership strategy. The broader retained-entry analysis also leaves execsw, #DB, one-shot XO and data-only alternatives unqualified.

Verifier #DB alternative (2026-10-19): the focused gate/source audit shows why neither the selected stock trap path nor the public kstuff hardware-breakpoint route qualifies a minimal retained AuthHeader entry. Stock #DB trap number 10 calls a fixed DR classifier; the adjacent indirect callback is gated on trap number 3 (INT3). The captured vector-1 gate uses IST4; stock setidt writes descriptor halves separately. Pinned public v1.11 source installs its shared #DB handler in three separate gate writes, then writes per-CPU IST pointers before syscall-scoped debug-register arming. The released-core audit supports the shared IDT/indexed TSS route, but no write-time exclusion, all-core completion, stock-exception delegation receipt or retirement drain is established. Live HEN ingress remains disabled.

Verifier reservation/lock boundary (2026-10-19): the original-image audit places AuthHeader verification after a table-slot flag-1 reservation and bounded copy but before ready flag 3. The selected record kind is 2 for SELF (1 for raw ELF); reviewed normal AuthMgr active operations reject the reserved slot state. The contained mailbox call holds a separate service lock, released before stock response interpretation and record +0x1c success publication; it does not exclude other cores at the text callsite or all aliases of the slot buffer. The one-byte retarget remains a geometry result, with executable ownership, text-write authority, publication and rollback unqualified.

Verifier-call ingress geometry (2026-10-19): the fixed-image byte audit finds that AuthHeader's +0x2df69c and verifyHeader's +0x37f1b4 direct calls can each be redirected to one sparse address inside the captured declared kernel_map range by changing only their high displacement byte from 00 to 08. The E8 opcode, instruction boundaries and return RIP remain intact. This is a conditional single-store candidate, not a qualified patch: neither exact target page is owned/executable, and text-write authority, cross-core completion and in-flight rollback remain unproved.

Verifier exact-VA map candidate (2026-10-19): the fixed-mode audit finds a stock vm_map_find path for source-named VMFS_NO_SPACE=0 that skips placement search and forwards a given range to checked insertion under selected flags. The coalescence follow-up shows a success path that extends a compatible predecessor and allocates no separate map entry, so zero return alone is not a distinct-entry ownership token. The first verifier bridge's required 16 KiB base is ktext+0x89c0000. This static path is not a qualified reserve/back/XO transaction; executable ownership, authorized text writing, all-core publication and drain remain open.

Verifier map-owner decision (2026-10-19): the narrow insertion/release audit confirms same-lock map insertion/removal wrappers but finds that a fresh entry allocation has a fatal null path, coalesced-range release can allocate again to split an entry, and vm_map_remove has no caller-owner check. A zero return reserves a range only at the instant of insertion; it is not a retained ownership or rollback contract. The subsequent interface decision rejects the reviewed exact-VA installer pair and explains why a vacancy observation cannot revive it.

Live AuthHeader rejection (2026-10-19): the two-route ordering audit joins the approved CRT-routed syscall-607 query and a separate standard-CRT stock execve witness to original-image branches. Both runs logged verifyHeader -37 and translated pager error 46; the exec run additionally returned ENOEXEC (8) and logged pid-101 _exec_self_imgact res 46. The fixed loader normalizes nonzero pager activation to 8 before its IsLoadable adapter. The first useful semantic seam for this controlled SELF is AuthHeader verification after its bounded slot-buffer copy; neither that call nor its contained mailbox return has qualified live ingress or rollback. The earlier no-patch execve EPERM remains separately unattributed.

CRT syscall-origin check (2026-10-19): the fixed-image and exact-library audit finds that the SDK CRT's getpid+0xa route enters SYSCALL inside each matching 10.01 libkernel variant's exported sysc_s00..sysc_e00 range. Dev 5fd6ac1 then observed this corrected CRT-routed process reach syscall 607/AuthHeader, so handler admission is established for that invocation. The CRT's actual initialization branch, live stub address and installed process bounds remain unobserved; the static getpid match is a possible mechanism, not a measured live join.

Stock execve EPERM baseline (2026-10-19): the fixed-image pre-auth audit establishes two direct sys_execve integer-1 returns before pathname lookup or SELF activation. The first checks bit 62 of the calling thread's credential +0x60; the second checks a decoded process metadata word. Thus errno 1 alone does not prove IsLoadable ran or that secure authorization denied the SELF. Neither gate is attributed to a particular live run without correlated field or stage evidence.

Live pre-path credential delta (2026-10-19): dev b93bd33 observed bit 62 clear in its no-patch probe's calling-thread credential and a category value that would pass the next gate; it did not call execve. The updated gate report joins the SDK's process-ucred in-place caps[7]=0x40 write to the stock syscall-entry credential-COW refresh. A successful same-thread standard CRT patch without concurrent replacement should set the bit seen by sys_execve, but the prepared standard-CRT witness has no live post-patch thread-bit receipt. The earlier witness launcher remains unattributed.

Retained AuthMgr handler decision (2026-10-19): the original October 13 kernel uses direct E8/E9 branches from the shared exec and syscall-607 lanes through the pager adapter, IsLoadable and helper to SmIsLoadable2; a whole-image scan finds no simple literal pointer for those exact entries. A data-slot swap at this selected chain is therefore unsupported. Stock backed kernel allocation is RW+wired/NX, the audited protection callers do not authorize kernel executable conversion, and stock SMP rendezvous checks callback pointers against its fixed CFI bank. See the minimal-handler ingress and ownership audit; all live retained-code, all-core visibility and rollback gates remain open.

execsw registration follow-up (2026-10-19): the stock register and unregister bodies pass the old activator array to free before publishing a replacement global, while sys_execve loads and dereferences that array without a local lifetime acquisition in its dispatch window. No reader or callback drain is visible in those writer bodies. The focused registration audit excludes naive concurrent register-and-exit as a qualified retained AuthMgr route; external serialization and live behavior remain unproved.

Cross-core publication candidate (2026-10-19): the original stock cache-flush producer executes local WBINVD, issues vector 0xfa to the selected remote CPUs, and acknowledges only after remote WBINVD; AMD classifies that instruction as serializing. The focused path audit identifies a conditional post-write all-core serialization step using an existing interface. It does not make concurrent text writes, executable mapping, live delivery or rollback safe; the sender wait is unbounded.

Whole-adapter stop gate (2026-10-19): the original cpustop_handler parks CPUs without inspecting their interrupted address. Six valid interior boundaries in the stock 32-byte pager adapter are absent from the pinned HEN far replacement, so stop/write/restart alone cannot safely establish the replacement. The exact boundary and protocol audit records the original-image and source bytes; no live patch or CPU stop occurred.

Near-bridge and tail-word gate (2026-10-19): the fixed-image transaction audit corrects the captured kernel_map range arithmetic: its entire declared range is rel32-reachable from the adapter jump in that boot. Neither a free backed executable bridge there nor an authorized single-word text writer is verified. AMD's narrow asynchronous branch-offset rule matches the aligned word's geometry, but no bounded all-core adoption/rollback receipt or live text authority is established.

IsLoadable output check (2026-10-19): a fixed-image zero-return and ownership audit finds no adapter-route zero return that skips the 0x88-byte output copy. Two callers keep output in suspended stack frames; the SELF loader uses the sys_execve image object, freed after activator return. This supports an immediate post-original snapshot on those fixed routes. Arbitrary pointers, concurrent mutation and live hook behavior remain unproved.

AuthMgr slot-buffer lifetime (2026-10-19): the adapter-tail audit shows all three fixed adapter callers hold a pager reference through the call, but stock IsLoadable acquires its slot pin only after adapter entry. Independent Finalize can clear and recycle a ready slot without consulting the pager reference. Three adjacent AuthMgr block/segment operations pin only for their own synchronous bodies and do not return a borrowed header-buffer lease. The code-permitted independent-Finalize interleaving is not an observed stock race or live hook result.

AuthMgr inner-pin byte stability (2026-10-19): the selected-record audit shows a second IsLoadable can raise the same slot from flag 4 to 5 and its secure helper clears 0x88 bytes at its caller-supplied output pointer. An overlapping output alias could therefore mutate the selected header buffer during the first pin; no fixed adapter caller is shown doing so. A same-table-mutex snapshot with exact flag 4 is a concrete candidate for the decoded stock state machine, but complete writer coverage, live lock/copy safety and a before-pin pager-generation match remain unverified. Live AuthMgr ingress stays disabled.

Current public kstuff-lite source check (2026-10-18): EchoStretch 48cd2c4 keeps the selected 10.01 loader, fSELF, fPKG, NPDRM, offset and ShellCore implementation files identical to the earlier drakmor e3cca8d reference, apart from a core version banner. Eleven source-declared mailbox returns resolve to exact calls in the original October 13 dump. Its loader uses an exploit-provided kernel primitive without a Byepervisor invocation in the selected entry path, but this does not prove installation, PS4/PS5 package execution or rest-mode stability on this console. See the bounded source and binary audit and capability matrix.

Current-public rest-mode source boundary (2026-10-19): the loader starts a detached watcher that retries two ShellUI trophy-function patches on a new or restarted NPXS40087 process. Its thread-start result is ignored; the two writes retain no original bytes. The reviewed watcher does not reinstall the core's per-CPU or ShellCore fPKG hooks. The watcher's {1,14,8} process-lookup OIDs match the original October 13 kernel's kern.proc.proc tree, but its record layout, event delivery and post-resume operation remain unobserved. See the focused lifecycle audit.

Released v1.11 startup check (2026-10-19): the hash-pinned public kstuff.elf calls its SDK patch routine before loader main. Its binary path changes credential bytes and sequentially widens the process's syscall-origin interval without a rollback path on later failure. The v1.11 source tag also retains a retail-only ShellCore fPKG hook condition that later public main changed. See the shipped-ELF and source-epoch audit; no live 10.01 installation or feature receipt is implied.

The embedded-core byte audit closes the released asset's local fPKG hook predicate: it uses a non-null patch-table check, matching later public main, although the v1.11 tag is retail-gated. GitHub records the asset upload after the tag. This is a static binary finding, not a reproducible-build or live installation result.

The released-core FW10.01 mailbox audit traces the exact 0x1001 firmware branch into eleven compiled offset-table slots and matches every resulting CALL+5 return to an E8 call in the original October 13 kernel. The capability matrix now separates public source, original kernel, released ELF and missing live results.

The current-public fSELF carrier audit joins four handler context expressions to retained first arguments in complete original-kernel mailbox callers: RBX, [RBP-232], R12 and [RBP-208]. An adjacent-wrapper audit traces three forwarding paths and two load parents, and matches the source cache's +0x08/+0x38 offsets to original reads. These are local static joins, with no proof of one object across stages, the argument's Sony type, hook delivery, authorization or first fetch.

The released v1.11 fSELF handler audit now finds the four selected carriers in the exact shipped nested UELF as well. Named return-address and fwver relocations, raw instructions and branch targets show RBX, [RBP-232], R12 and [RBP-208] for an imported firmware value of 0x1001. Runtime import binding, trap delivery, context continuity, secure acceptance and first fetch remain Unknown.

The released fwver binding audit traces the core's firmware getter, .fwver name/value slot 13 and dotted-name relocation resolver into that UELF import. A getter return of 0x10010000 would write 0x1001 to the UELF GOT slot. The actual getter value, loader completion and console outcomes remain unobserved.

The released fSELF cache audit shows verify-header seeding the same one-entry UELF context cache that later single-block, multi-block and segment paths query. Verify seeds size from request+0x10; a later cache miss uses low 32 bits of snapshot ctx+0x08, and a hit reuses the cached value. The valid flag is set before a later checked header backup read, so it does not prove full emulation. Cross-stage object continuity and live results remain Unknown.

The released per-index UELF audit traces sixteen compiled core iterations, each loading a new nested UELF image and mapping its own base through a newly allocated CR3. The fSELF cache lies in that image's zero-filled writable tail. If installation completes, cache state is local to the selected CPU image; cross-core routing and live cache hits remain unobserved.

The released KELF routing audit connects each loop iteration's physical UELF CR3 and mapped entry to KELF relocations, then connects each indexed KELF entry to two TSS interrupt-stack values. The IDT handler bytes come from KELF0, while each TSS receives its own KELF stack values. These are compiled setup joins; live trap delivery and UELF execution remain Unknown.

The released IsLoadable2 audit finds the nested UELF's named trap import, dispatcher and conditional fSELF emulation branch. On successful context parsing and checked copies, that branch writes 136 authinfo bytes and 0xdeb7 to the context before returning saved RAX zero. The authinfo write precedes the context write without rollback; both success and checked-failure paths return the same compiled handled bit. Secure authorization, trap delivery and first fetch remain unobserved.

The FW10.01 IsLoadable2 binding audit traces the released setter's kdata_base-0x941160 value through name/value slot 41 into both UELF relocations. With the original October 13 kernel layout, it addresses the independently recovered ktext+0x37eea0 AuthMgr candidate. This closes a selected static import route; live relocation and trap delivery remain Unknown.

The post-IsLoadable lookup audit joins the released UELF's four fallback authinfo first words to the original 10.01 adapter's output-pointer ABI and subsequent 128-entry association lookup. A matching key can lead to 136-byte output erasure when the lookup value is at or above 0x12090002. A separate original function passes the table's translated address in a secure mailbox request; this does not prove that the service populates it. The October 13 capture has no match for any fallback template, but that table is mutable boot state; live association and SELF execution remain Unknown.

The fSELF pointer-marker audit shows that the released 0xdeb7 context +0x3e write changes the high 16 bits of the +0x38 qword. Two original load parents immediately dereference that field, and a released UELF register-frame block can restore a 0xdeb7 high half to 0xffff. The same-image UELF cache would miss a changed pre-marker snapshot; its checked copy walks page tables using low-48-bit indices for the marked header candidate. This is a conditional static join; same-context ordering, mapping, trap delivery and loader outcome remain Unknown.

The released PS4 NPDRM debug-RIF audit joins the two named UELF imports to exact original 10.01 mailbox returns. The complete handler selects its cmd-6 branch by return address, with no visible read of the copied request command word. It writes a DMEM output before the checked mailbox-result write and advances the saved frame only after that write succeeds. On the selected kernel trap path, the UELF sets saved EFLAGS bit 0x10000 and attempts trap-frame writeback even after a handled failure; saved RIP remains the mailbox entry. That conditional frame is not a live fallback, license or title-launch receipt.

The released native PPR verifyImage audit traces the shipped FW0x1001 profile and complete UELF handler through request shape, DMEM geometry, same-thread latch, staged output, packed stack value, checked response and no-key saved-frame continuation. Late failure rolls back pair ownership but can leave direct DMEM output. This closes a static implementation gap, not a live PPR mount or native executable result.

The released PPR continuation audit binds that named no-key UELF import through the FW0x1001 core symbol/value slot to the original October 13 kernel's ktext+0x2d420b continuation. Its conditional common tail publishes the private FD/FC pair and completed sizes while bypassing the ordinary post-mailbox helper path. Live binding, trap delivery, same-object buffer continuity and downstream package/SELF results remain Unknown.

The released PPR getter audit then binds four FW0x1001 UELF imports to the original XTS/CMAC getter entries and exact caller returns. Its guarded handler can turn private FD/FC into transient FF/FE for an active same-thread session; a cross-page checked-write failure can leave partial output without saved-return advance. Neither getter execution nor A53/mount acceptance is observed live.

The released PS4 verifySuperBlock audit byte-checks the legacy FW0x1001 return import, original mailbox call, EEKPFS/crypt-seed reads, two fake-key registrations and synthetic handle response. A separate clear-key branch zeroes the response and unregisters a handle. Several matched failure paths return handled without advancing the saved frame, so this is an implementation result rather than PS4 package acceptance or execution.

The original PS4 superblock response-consumer audit joins the released 16-byte fake response to the October 13 caller at ktext+0x2d56e0. That caller requires zero transport and response status, passes both synthetic handles through two local registration calls and a pair registry, and writes them to output pointers only on its zero-result path. The complete +0x415000 registration helper stores handle, length and selector in a kernel tree; it does not itself publish a secure key index. Failure arms attempt to clear the handles through command-3 mailbox requests. Actual async interception, ICV behavior and any live PS4 package result remain Unknown.

The PS4 async crypto classifier audit matches the released trap import to the original ktext+0x335aaa instruction. The original function holds its message-list head in RBX, which the released FW10.01 walker reads from its saved frame. The walker checks the 0x133741xx handle prefix in XTS and HMAC message shapes and requires an active fake key.

The original PS4 crypto-message producer audit now joins the standard-PFS owner's conditional +0x474/+0x478 superblock outputs to a paired original builder that reads those same fields, writes XTS qword 5 and HMAC qword 20, links both messages and calls async dispatch. A direct builder call exists in a callback referenced by the standard writer through a CFI thunk, but the callback's request-linked pointer is not proved identical to the writer's owner. Successful ICV, live mount and first fetch remain Unknown.

The type-1 request-owner audit closes the narrower queue identity: one producer derives owner from input+0x18, stores that input in a node and appends it to the owner's queue; the callback reads the same field from that node's input before calling the paired builder. The input's provenance from the exact mount owner, callback execution, ICV and live package outcome remain Unknown.

The standard mount-to-read owner audit shows the writer putting its handle-bearing owner at mount+0x298 and the new-vnode VGET branch copying it to receiver+0x18. VGET installs one of two VOP vectors whose read path resolves to the cataloged complete standard read method; that method can pass the vnode's +0x10 receiver to the type-1 crypto producer. The same-owner route requires a later read on that exact VGET vnode and unchanged links. Live classifier/ICV result, mount and first fetch remain Unknown.

The PS4 asynchronous ICV completion audit follows the paired builder through dispatch acceptance, a CFI crypto callback, a 32-byte digest comparison and the request-node completion callback. Dispatch return zero only means submission was accepted; the later comparison maps equality to status 0 and mismatch to 96, stores status at node+0x14, and queues the node on the owner's completed list. Actual digest and standard-PFS mount verdict remain Unknown.

The completed-node consumer audit now identifies the consumer at ktext+0x949160. For a matching current-identity node, it unlinks the completed entry, skips zero-status ICV cache work when node+0x14 is nonzero, and preserves the first nonzero status for its caller. One pfs_icv_bawrite caller propagates such a result. Actual consumption of the PS4 read's node, successful cache work and the mount decision remain Unknown.

The zero-status ICV audit finds a second result boundary: selected set_icv and cache-helper failures are logged, then the consumer reloads its pre-node accumulator. With that accumulator and node+0x14 both still zero, it can return zero despite a nonzero helper result. The two wrappers read owner handles +0x478/+0x474 and can wait for crypto completion. This is static return-value dataflow, not a live bypass or successful mount.

The PFS commit return audit finds another conditional status boundary above the consumer. pfs_tmem_commit logs earlier ICV write or consumer errors, then its pending-work drain replaces the saved status with each wait-1 consumer result. A later zero followed by a zero finalizer can produce a zero commit return despite an earlier logged error. pfs_sync_cow checks that returned value. No actual PS4 package, ICV acceptance or mount outcome is established.

The released PPR breakpoint-arm audit traces the selected PPR nmount scope and pending latch through FW0x1001 to a DR0–DR3 vector passed to the checked installer. It separates vector construction, installer failure effects and unobserved live debug-register delivery.

The released PPR debug-dispatch audit follows the selected kernel trap through the UELF RIP classifier to the two getter handler calls. Its outer handled bit can be set even when inner index translation declines; saved RF and frame writeback remain conditional rather than a live fallback receipt.

The released PPR unmount-arm audit traces a separate FW0x1001 vector to the original cleanup CMAC/XTS call instructions when the shared outstanding-pair counter is nonzero. The selected block tests the computed callsite addresses but does not visibly recheck the clear-key-missing import; the counter does not identify the unmounting object. Breakpoint installation, cleanup traps and key release remain unobserved.

The released PPR cleanup-dispatch audit follows the corresponding conditional #DB handler. It skips each cleanup E8 only for the exact FE/FF index, and its private-pair clear path decrements the shared count before latch disown and saved-frame writeback. The audited original continuation retains resource release, unlock and return. Runtime delivery, same-object ownership and completed teardown remain Unknown.

OBS1 preflight status (2026-10-19): the sealed carrier host prototype and independent audit pass. The first CRT-free target PIE was reproducible but failed the protected HVE loader's copy-only relocation contract. A new self-relocating target PIE now passes that copy-only contract under host execution: two builds match, the entry binds six relocations before invoking the exact carrier, and six host cases per build include OBS1 and fail-closed negatives. This remains offline evidence. The protected HVE route still changes syscall-origin bounds before entry and owns no stage cleanup; no nonmutating target launch, durable receipt or cold-boot result exists. Integrated hardware remains NO-GO.

The local ELF ingress audit excludes one tempting route for this image: local elfldr supplies a getpid-shaped first argument where OBS1 expects a symbol resolver. Both pinned target builds return -2101 with six GOT words unchanged in the host shape test. That loader also writes process policy before entry, leaves UID restoration absent in its reviewed path, and does not expose an OBS1 completion receipt. The payload manager only transfers bytes to it. This is source and host evidence, not a FW10.01 console result.

The resolver-route census checks three other local ingress sources at exact revisions. Prospero Menu derives an opcode-checked dlsym callee; its real host parser/materializer accepts the exact OBS1 ELF, and the image's actual _start returns OBS1 under a mock resolver after one preapplied relative relocation. etaHEN bootstrapper derives a callee without an opcode check, and HEN-V passes an exported dlsym pointer. Each route changes kernel or process state before payload entry and lacks an owned OBS1 completion/cleanup record. Resolver-shaped arguments therefore leave the nonmutating launch gate open; FW10.01 callback behavior remains Unknown.

A FW10.01 Poops ingress audit binds the BD-J JAR to its exact embedded elfldr_1001.elf. Shipped bytecode passes a getpid pointer to the loader, and linked ELF bytes call credential/syscall-policy patch initialization before its main. Three selected profile offsets join the original 10.01 catalog, but the direct route cannot carry OBS1 unchanged or meet the nonmutating gate. A nested-child audit now traces the exact embedded bootstrap and port-9021 server: its raw-ELF child repeats the getpid-shaped argument contract, changes child policy before entry, and has no structured OBS1 result. The console outcome remains Unknown. The cross-artifact ABI audit shows this child envelope matches the released kstuff v1.11 CRT at the static input boundary, without proving a live primitive or feature.

The Poops Stage-7 primitive-lineage audit traces the shipped JAR's pipe/socket setup into that six-word argument block. The compiled carrier discards two IPv6 setter results, has no readback after linking the socket options, and prints readiness without reading payloadout. Live descriptor validity, option state and primitive operation remain Unknown.

An original-kernel layout join now matches 29 exact instructions and the option-46 dispatch table to the Poops descriptor stride, file reference field, socket/PCB/options chain and conditional option-46 copy. It narrows the static field ambiguity while leaving live admission, object state, primitive operation and cleanup unproved.

The selector-0x58 copy-order correction retracts two earlier PFS buffer-flow interpretations: +0x28db50 copies from its first argument to its second. Selector 0x58 reads 32 bytes from caller material; three shared/native PFS paths copy owner bytes into a returned buffer before the later secure transaction. The record-effects audit identifies the selector's inner calls as local AES routines and shows no selector-owned protected-record write before an ordinary nonzero return. The returned-buffer audit joins all three buffers to one provider and traces their requested size to an owner header. The mount-header audit shows both reviewed standard and native mount constructors reject header lengths below 0x1000 before mount publication; their unchanged headers therefore put the selector record beyond the 0x5a0 prefix. A cross-audit size join narrows the ordinary getblk read path to five mount-size candidates, 0x1000..0x10000; larger admitted power-of-two sizes take its oversized diagnostic if they reach that read unchanged. Later header mutation, other mount gates, command meaning and FW10.01 package/SELF outcomes remain Unknown. The older reports are visibly marked retracted.

A direct-call audit of the later command-0x12 transaction finds six fixed-image calls: the five selector routes plus a separate PFS format-ICV path that passes 0x5a0, checks the result and records failure. This does not identify the secure command as a package or SELF verdict.

A preselector header census cross-decodes the three complete PFS consumers: their seventeen direct +0x20 references are reads/tests, while COW sync and unmount mutate nearby header flags. Shared/native unmount also invoke a CFI-guarded callback through [[receiver+0x18]+0x8d8], where receiver=[[owner+0xd8]+0x10]; that census alone does not join its target to the private owner. Header aliases, deeper helper effects and runtime L remain Unknown.

A VGET owner-alias audit now joins the newly allocated standard/native root-vnode path to receiver+0x18=owner, followed by mount publication at owner+0xd8. For unchanged links, the unmount callback reads owner+0x8d8; static constructor values narrow its target to two standard bodies or one native body. Cached vnode paths, live table selection, later mutation and callback effects remain Unknown.

The conditional callback-effects audit cross-decodes those three complete callback bodies and their standard I/O/native gate helpers. Their direct +0x20 writes target the receiver or computed data, while owner-header pointers are used for comparison; none directly stores L=[owner+0x30]+0x20. Transitive calls, other aliases, concurrency and live selection remain open, with no package/SELF readiness change.

The owner-aware helper audit follows the standard shim through its command body and the native command through its owner leaf. On a successful standard owner-preparation mode-0 path, eight four-byte copies update header+0x380..+0x39f; callback call sites supply stack output slots. The five reviewed helper/preparation bodies have no literal +0x20 memory reference. Secure-side effects and runtime header stability remain Unknown.

Current objective audit: OBJECTIVE-COMPLETION-AUDIT-1001-001 classifies the investigation as Partial but already reusable. All nineteen requested deliverable paths exist; its 32-row matrix contains 18 Complete and 14 Partial dispositions. Since that dated audit, the CFI and credential-COW promotions moved the live cumulative catalogs to 19,229 functions, 1,539 symbols and 84,036 edges and the exact RX partition to 152,830 confirmed-function/structural bytes, 8,327,946 probable-function bytes, 72 confirmed-rodata bytes, 1,857,465 padding/trap/cave-candidate bytes, 3,031,031 unresolved bytes and zero conflicts. The largest remaining gap is still semantic, and no HEN feature, PS4/PS5 package launch or Linux handoff has an end-to-end FW10.01 runtime receipt. See the completion audit, objective matrix, ranked next tranches, CFI promotion, and credential-COW promotion.

The socket CFI poll audit qualifies the previously absent +0x533220 body as a sopoll_generic candidate using 113 instruction agreements and a pinned FreeBSD 11.4 comparator. It remains outside the cumulative catalogs pending protocol-table ownership and a separate promotion; the totals above are unchanged.

Integration checkpoint: FINAL-INTEGRATION-CONSISTENCY-AUDIT-1001-001 records a PASS for the 09:43 pre-incident central snapshot, including unique ledger IDs, exact catalog/GraphML agreement, contiguous RX coverage, required deliverables, conservative readiness wording and stale-carrier exclusion. Its HEN-manifest verification is explicitly historical; the later derived-file integrity incident and terminal supersession handling are tracked separately rather than rewriting that snapshot. See the consistency report and machine audit.

Final preservation checkpoint: FINAL-PRESERVATION-VALIDATION-AUDIT-20261015-001 records an offline PASS for the immutable kernel/ranges, both canonical IDBs, exact hypervisor ELF, corrected 24 MiB capture, five designated protected repositories, pLinux and ppr-patch. Catalogs remained 19,224 functions / 1,531 symbols / 84,019 edges with exact CSV/GraphML equivalence; all 25 corrected-derived capture entries verify and stale carrier artifacts remain excluded. The separately classified external ps5-hen checkout moved from 268 to 286 Git status records during the sample and is recorded as unattributed external drift, not folded into the frozen HEN epoch. The 10-entry self-excluding preservation bundle passes; no console, network, IDB, HEN-validator, build or runtime action occurred. See the preservation report, final state, and snapshot comparison.

HEN evidence-integrity update: HEN-PREFLIGHT-BUNDLE-INTEGRITY-SUPERSESSION-1001-001 records that the unchanged 1,453-entry HEN manifest now has exactly one post-seal mismatch: final-preservation.json expected 6c24a7b... and is bc5cf4d...; the other 1,452 entries still verify. The original seal is not described as passing. A new successor covers 10 artifacts with a separate self-excluding manifest; the central gate pins that manifest digest as its trust root. It accepts only byte-exact state A restoration or this exact registered state B, verifies immutable firmware/IDA identities, and fails on any additional or different mismatch. Its read-only validator passes in state B; no technical HEN readiness conclusion is reversed, but the dynamic preservation record's chain-of-custody limitation remains explicit. See the supersession report, incident record, and sealed validation transcript.

Exact-recovery disposition: HEN-PRESERVATION-EXACT-RECOVERY-AUDIT-1001-001 reconstructs every content-bearing field, proves the original JSON serialization, and exhaustively hashes 1,876,896 combinations drawn from retained timestamps. None equals the manifest target. Five historical nanosecond ctime/mtime pairs remain Unknown; the strongest 10,452-byte candidate hashes to 5dfa8983..., is explicitly rejected, and was not installed. State B therefore remains the only evidence-preserving current state unless an independent source supplies bytes hashing exactly to 6c24a7b.... See the recovery report, unknown-field ledger, and machine result.

Newest HEN/fPKG implementation result: HEN-PREFLIGHT-OFFLINE-QUALIFICATION-1001-001 and PPR-FPKG-CONTRACT-AUDIT-1001-001 close two important offline qualification questions. Two reproducible HEN diagnostics have bounded observation-only main routes, but both mandatory CRT paths execute __patch_init first and change credential capability/attribute state plus syscall-origin bounds; they are therefore fail-closed and not live-ready as strictly read-only. Separately, clean ppr-patch commit fd4c822... exactly matches the retail-10.01 A53 sites and full-width FF/FE selector, but it is only a native-PPR read-transform component. It has no direct PS4 fPKG role and cannot supply native AppInst, DriveAuth, licensing, AuthMgr/SELF, mapping or first-instruction proof. Its --status avoids A53 code writes but still initializes a mutating AuthID/device/mailbox/MMIO/SDBGP transport. See the HEN preflight qualification, PPR/fPKG contract audit, HEN porting reference, and package/SELF investigation.

Newest live-readiness result: LIVE-RUN-READINESS-MATRIX-1001-001 evaluated 20 exact candidates across HVE/S3/AP, HEN, fPKG/fSELF and Linux. At that checkpoint only two exact replays were ready. The subsequent PLINUX-OBSERVER-OFFLINE-QUALIFICATION-1001-001 now clears the closest novel candidate's bounded offline prerequisite: two safe deterministic builds produce the same 530,920-byte ELF (2777b085...), all 168 compared outputs and fourteen embedded blobs match, focused tests and final-linked negative audits pass, and a linker-flag build that silently zeroed four blobs is rejected. This does not authorize deployment: exact target binding, runbook/risk acceptance, telemetry, stop/rollback, cold-boot recovery and hardware observation remain required. No HEN feature, fPKG execution or Linux takeover is qualified. See live-run readiness, the observer qualification, and the ranked checkpoint matrix.

Current live-readiness delta: LIVE-READINESS-DELTA-AUDIT-1001-001 retains the old 2/5/13 split only as a dated checkpoint. Later evidence moved pLinux to offline-qualified/not-authorized, moved both HEN “read-only” candidates backward to fail-closed, established that PPR --status uses an active transport, and left AP2 with eight blocked target/hardware gates even after its host reference model passed. The exact corrected capture remains the safest ready replay; Attempt 21 is a state-mutating replay; the pLinux terminal observer is the closest novel diagnostic but still lacks deployment binding, runbook, telemetry, recovery/risk acceptance and its first hardware receipt. No novel AP2, HEN, fPKG or Linux-boot capability is live-ready or authorized. See the delta report, 24-gate ledger, AP2 gate split, and exact artifact identities.

Newest HEN startup result: HEN-OBSERVER-CRT-PROTOTYPE-1001-001 removes the two proven pre-main kernel-policy mutation routes from dedicated post-exploit and native-entry observer builds. The follow-up HEN-OBSERVER-INDIRECT-CLOSURE-1001-001 corrects the earlier parser totals: GNU and LLVM agree on 125/142 genuine indirect calls, not 147/164, with 22 non-call artifacts in each predecessor list; including indirect jumps yields 145/162 classified transfers. Both root images have zero constructor/destructor-array entries and all four fixed dependencies are SPRX. This tighter closure still returns NO-GO: kernel_copyout mutates inherited socket/pipe transport without restoration, the SPRX bootstrap can load an unowned module, recursive __rtld_lib_close contains a compiled use-after-free at post +0x804f / native +0xb14f, and multiple cleanup paths leak state. All six HEN feature groups remain ready=0; the current hashes must not be deployed. See the CRT report, indirect/cleanup closure, and cleanup ledger.

Earlier minimal-observer result: OBSERVER-MINIMAL-REBUILD-1001-001 replaces that complex payload with one reproducible 0x188-byte RX-only segment. GNU and LLVM agree on all 88 instructions; it has no dynamic state, imports, relocations, constructors, calls, computed jumps, syscalls, privileged instructions, kernel access or inherited transport. It checks the ABI before dereference and performs one explicit OBS1 write; seven exact-byte host fixtures pass, so the artifact gate is PASS. The integrated live gate remains NO-GO because the pinned HVE carrier widens syscall-origin bounds before entry, leaves the staged mapping allocated, lacks an owned/versioned argument contract and has no dedicated receipt/cleanup witness. This narrows the next step to a carrier refactor but authorizes no deployment. See the minimal report and safety gate.

Earlier observer-carrier qualification: OBSERVER-CARRIER-TARGET-QUALIFICATION-1001-001 qualifies the exact carrier DSO for the minimal observer without target execution. Two retained builds are byte-identical across all five artifacts; libobs1-carrier-target.so (68,088 bytes) imports exactly memcpy, mmap, mprotect, munmap and sysconf, has no entry point or constructor/destructor arrays, and embeds the 16,992-byte observer b14d7111… exactly once. All three objects and the DSO reproduce byte-for-byte with the hash-matching compiler from an independent SDK copy, but the 126,984-byte link-probe does not because it consumes the absent pinned crt1.o/libc.a epoch (ps5-payload-sdk has no target/ directory). Both artifacts grant their first PT_LOAD W+X at the ELF level. The integrated hardware gate stays NO-GO and deployment is forbidden. The independent OBSERVER-CARRIER-TARGET-QUALIFICATION-AUDIT-1001-001 re-verifies the manifest, the run-a/run-b byte identity, the DSO/link-probe ELF facts and the unique embedded observer (0 High/1 Medium/3 Low/7 Info; the medium is that the rebuild was not re-executed under the read-only audit). Evidence: OBSERVER-CARRIER-TARGET-QUALIFICATION-1001-001, OBSERVER-CARRIER-TARGET-QUALIFICATION-AUDIT-1001-001; see the qualification report, ELF facts, and independent audit.

Newest HEN credential-lifecycle result: HCRED-1001-20261015-001 recovers a high-confidence complete thread_cow_update candidate at ktext+0xb88b00..+0xb88bbf. Under proc+0x148 it reconciles separately held process/thread credentials and limits, copies p_cowgen+0x20c to td_cowgen+0x418, then releases displaced references after unlocking; native syscall entry calls it on a generation mismatch. THREAD-COW-CATALOG-PROMOTION-1001-001 now makes that exact 191-byte body searchable in the central catalog, adds one semantic symbol and reconciles all three incoming/six outgoing edge labels; no unresolved or adjacent byte changed. Stock setuid demonstrates clone, uidinfo accounting, locked install, generation bump and deferred release. In contrast, reviewed SDK/current-HEN setters are unlocked in-place writes without COW convergence or rollback; OnionHEN/etaHEN copy 0x200 bytes across a FW10.01 0x168 allocation, and OnionHEN targets +0x0c rather than cr_ngroups +0x10. The syscall-origin reader at +0x42bf26..+0x42bf9b is exact; the separate ownership audit below now identifies its object, lifecycle and stock initialization but still finds no safe reversible runtime writer. This rejects unsafe recipes and defines a candidate transaction; it does not qualify live elevation or make any HEN group ready. See the audit, catalog promotion, and missing gates.

Newest process-hold result: HPHOLD-1001-20261015-001 recovers complete pfind +0x5612c0, pget +0x5613b0, exit1 +0xbd7b70, sys_execve +0x6fcfb0 and nine inline PRELE-equivalent releases. PGET_HOLD|PGET_NOTWEXIT increments proc+0x358 under p_mtx and binds the exact process object against exit teardown/PID replacement until exactly one balanced release; exit sets P_WEXIT and waits for that counter before active-to-zombie removal. This closes the held-object-lifetime subgate. It does not exclude exec: PGET_NOTINEXEC is only a lock-time snapshot, sys_execve sets/clears P_INEXEC without consulting the hold, and no generation token or standalone callable PRELE ABI is qualified. Credential mutation therefore remains blocked. See the process-hold report, state machine, and unresolved gates.

Newest syscall-origin ownership result: proc+0x3e8 is now high-confidence p_dynlib. Constructor +0xb1b590 allocates a 0x158-byte dynlib object, initializes its bind rwlock and publishes the root under proc+0x148; +0xf0/+0xf8 are the half-open saved-user-RIP interval consumed by native syscall entry, and +0x14c controls the observed out-of-range rejection behavior. Exec-time +0xb1e8d0 resolves sysc_s00/sysc_e00 and stores the two bounds sequentially; the reader loads them separately with no process/bind lock. Fork zeroes the child root, while exit clears the root under p_mtx before subordinate destruction/free. No fixed-image reversible runtime setter or reader-compatible pair transaction was found. The current SDK widening patch lacks identity/hold/quiescence, snapshot, verification and rollback, so the result is NO-GO for live authorization. See the ownership report, object layout, and rollback gates.

Newest Linux diagnostic result: LINUX-UART-LIVE-GATE-1001-001 joins the immutable kernel descriptor, hypervisor mapping and local EDM-010 board research at Titania UART PA 0xc1010100. The captured descriptor encodes 230400 baud, 8 data bits, 1 stop, parity code 0 and a 433 MHz reference-clock field; its frontend backlink and nonzero kernel lock show initialized kernel software state. Local ps5-uart independently maps the EDM-010 APU route to header pins 13 RX / 14 TX / 15 GND. The live gate remains BLOCK / NO-GO: neither writer establishes current clock/divider/pinmux, both stock polls are unbounded, the hypervisor path does not join the kernel lock, and no passive receiver captured a byte. A strict one-store TX-only receipt contract now forbids RX/configuration/FIFO reset and treats the byte as irreversible, but it is a design contract—not run authorization. See the UART gate report, receipt contract, and gate ledger.

Newest fPKG live-evidence preparation: FPKG-FIRST-FETCH-RECEIPT-1001-001 supplies a host-only, privacy-preserving contract for a future known-signed control receipt from vnode/object commitment through AuthMgr function 22, PS4/native mode, vmspace/entry, setregs, architectural return, qualified first-user-RIP evidence and preservation. It keeps PS4 selector 1 / ABI 0-or-1 distinct from native selector 2 / ABI 2, rejects cross-object/mode/entry mixing, and fails closed into abort or quarantine. Ten unit tests, six valid fixtures, thirty adversarial mutations and deterministic regeneration pass. This closes offline receipt logic only: no collector or target artifact exists, and authorization provenance, live secure result, mappings/frame, first-RIP, restoration and independent cold boots remain open, so console status is NO-GO. See the receipt report, 14-gate ledger, and prototype contract.

Newest fPKG receipt-v2 result: FPKG-FIRST-FETCH-RECEIPT-V2-1001-001 renders the first-fetch observation contract as a real Draft 2020-12 instance schema and adds an authenticated terminal commitment. It repairs the four receipt-contract defects AUD-SOC-003/004/005/006 and records the AUD-SOC-007/009 wording corrections: image-relative offsets and keyed commitments only, a typed per-stage event union with an exact eleven-event success sequence, enumerated abort prefixes ending in mandatory preservation, and a keyed HMAC terminal commitment bound to a pre-run key commitment. The dependency-free evaluator accepts all 18 valid receipts (2 modes × 3 fetch methods × 3 return routes) and all 40 abort receipts; all 31 single-mutation adversarial cases are rejected by their expected detector (20 by the schema, 10 by cross-field checks, 1 by the keyed MAC), and cross-mode mixing is rejected. The work is host-only: there is no collector, payload, target binary or policy change, and the terminal key holder remains a procedural gate. Package acceptance, secure-side allow, mapping/return realization, first RIP and independent cold boots remain unobserved, so live status is NO_GO_NO_COLLECTOR. Evidence: FPKG-FIRST-FETCH-RECEIPT-V2-1001-001; see the v2 report, defect corrections, and gate ledger.

Newest SELF authentication-boundary result: native and PS4 syscall 607 share thunk ktext+0x2b97f8 and body +0xaba160..+0xaba44d, forming a no-exec pathname→vnode→SELF pager→AuthMgr function-22→sanitizer→136-byte copyout query. Function-22 transport, echoed-function, mailbox, secure-result, response-copy and later threshold outcomes are separately observable. The previously untyped sole-caller helper +0x627540..+0x627639 is a credential-dependent disclosure sanitizer, not credential equality: it erases most of the result and admits limited fields only for specific current AuthIDs or auth-block bit 0. Because syscall 607 does not select PS4/native exec wrappers, map segments or fetch code, success is not fSELF/fPKG, licensing or package acceptance. The smallest proposed runtime observation is a known-signed PS4/native control pair with sanitized stage classes and keyed commitments only; it remains unimplemented and unauthorized. Evidence: AUTH-BOUNDARY-GAP-1001-001; see the report, boundary map, and live receipt contract.

Newest fPKG/fSELF post-auth result: after shared AuthMgr function 22 returns zero, both fixed SELF wrappers first reach structural e_type rejection at ktext+0x3cf824, then split at EI_ABIVERSION +0x3cf9cf (PS4 ABI 0/1 with selector 1; native ABI 2 with selector 2). The first recovered Sony caller-context policy follows at +0x3cfa14 -> +0x3d0790, matching application-category family to published proc+0xc79, with an unknown proc+0x5c8 early permit and QA-bit-2 fallback. Native alone then rejects R+X PT_LOAD at +0x3cfb22..+0x3cfb7b. These are structural/launch-policy gates after authorization, not the secure signature/license decision; heap execsw, modules, concrete responses, realized mappings and first fetch remain absent. Evidence: FPKG-POST-AUTH-EXECUTION-GAP-1001-001; see the report, boundary chain, and PS4/native comparison.

Newest debug/dump result: native syscalls 720 and 731 are metadata exporters, not dump or panic initiators. acinfo_get_all_for_coredump at ktext+0x9fe020 accepts caller AuthID ...0006 or ...0007, scans at most 64 process ACInfo records and can emit 0x3400 bytes; fgcinfo_get_all_for_coredump at +0x9fe740 accepts only ...0006, checks two FGCInfo records and can emit 0x1a0 bytes. Both select the target through the separate Sony 16-bit process-index helper +0x3da1a0, pack zero-initialized 0xd0 records, and copy out a final count. The complete bodies have no capacity argument or visible target candebug helper, but strict AuthID admission and missing runtime/service context prevent an ordinary-user reachability or exploitability claim. Six functions / 2,491 bytes agree across repeated disposable IDA exports, Rizin and GNU objdump. Evidence: COREDUMP-INFO-SYSCALLS-1001-001; see the report, syscall surface, and record layout.

Newest crypto/random result: CRYPTO-RANDOM-DEEPENING-1001-001 qualifies 52 complete functions / 15,490 bytes with full IDA, GNU objdump and Rizin agreement. It reconstructs shared /dev/random/urandom, the six-callback Yarrow adapter at ktext+0x2ac78a0, a fixed 1,024-entry harvest queue, Sony /dev/rng and its two 64-byte ioctls, Sony RNG sysctls/core, SHA-1-family state generation, ARC4 compatibility and direct RDRAND consumers. CRYPTO-RANDOM-CATALOG-COVERAGE-PROMOTION-1001-001 has now applied and independently validated 32 new function starts, 20 reviewed rows, one static descriptor, 113 exact graph edges and 15,474 newly confirmed bytes while preserving the two established cdev helpers. Locally unbounded RDRAND retries, dynamic-source lifetime and index contracts remain bounded audit leads; no memory-corruption primitive or exploitability is established. See crypto/random subsystem, the focused report, and the promotion report.

Newest RX/device-surface result: RX-RODATA-TABLE-RECOVERY-1001-001 proves a 72-byte OpenSSL/CRYPTOGAMS Montgomery attribution string at ktext+0x29513a followed by a 14-byte NOP, while rejecting bounded pointer, rel32-table and CIE false positives; RX-RODATA-COVERAGE-PROMOTION-1001-001 has applied the exact +72 rodata/+14 padding overlay. CDEV-ATTACK-SURFACE-TRANCHE2-1001-001 qualifies generic ioctl staging, all 26 auditpipe commands and ffs_susp; the follow-up FFS-SUSPEND-DOWNSTREAM-CONTRACT-1001-001 cross-decodes 43 functions / 17,617 bytes and shows that negative aligned VCHR offsets survive through ffs_susp, getblk and breadn_flags to the dynamic provider boundary. Every forced ffs_reload nonzero result reaches panic/UD2, and descriptor inheritance/SCM_RIGHTS can preserve the same passable file object. Actual provider range enforcement, initial descriptor authority, MAC/service policy, runtime consequence and exploitability remain Unknown.

Newest network result: native and PS4 syscall 105 now join sys_setsockopt +0x557910, the socket-option core, UDP6 pr_ctloutput, ip6_ctloutput +0x652ba0 and the old parallel-array IPv6 multicast owners. Exact FW10.01 option-74 bytes reject the earlier saved-filter-across-copy lock-drop hypothesis: the source vector is copied at +0x904dbf before lock/get at +0x904df2, and the current filter is resolved under the lock. A distinct defect is independently confirmed in im6o_grow +0x9050f0: two M_NOWAIT reallocations commit only together, so exactly one success is freed while its unchanged published field becomes dangling. The caller leaves the container attached; later teardown dereferences the stale filter at +0x90353e or membership array at +0x9035e1 and frees it again, while a retry sends the stale field back to realloc. The completed offline allocator model maps first-growth 0x1f8 to class 512 and 0x5e8 to class 2048, proves both successes must move, and finds distinct normal class-vector roots plus explicit selected-zone NULL paths; a one-sided outcome is therefore structurally feasible. One prior live control corroborates only the ordinary successful 31-to-63 growth path. Runtime occurrence, probability, selective failure control, stale access, reclaim, consequence and exploitability remain Unknown; no live pressure test is authorized by this result. Evidence: IPV6-SOCKET-SURFACE-1001-001, IPV6-IM6O-CORROBORATION-1001-001, IPV6-IM6O-OFFLINE-MODEL-1001-001; see IPv6 report, independent corroboration, offline allocator model, outcome matrix, and state transitions.

Newest IPv6 gap result: NETWORK-IPV6-GAP-AUDIT-1001-001 independently recovers eleven output packet-option/raw-output functions / 5,924 bytes. Legacy type-23 destination-option replacement passes privilege 505, selects ip6_pktopts+0x68 or +0xb8, calls a selector-23 cleanup entry that returns without freeing, then unconditionally overwrites the pointer. A prior non-null allocation therefore becomes unreachable; duplicate accepted records provide one static route. Separately, the ancillary parser omits cmsg_len >= 16, so lengths 1..15 reach the option dispatcher with a wrapped payload length, but no read beyond the backing mbuf, disclosure, corruption or exploitability is established. Runtime admission, allocator impact and DoS remain Unknown. See the gap report, findings, and exact checks.

Newest IPv6 option-admission correction: IPV6-OPTION-ADMISSION-CORRECTIONS-1001-001 supersedes wording in IPV6-OPTION-ADMISSION-1001-001. Independent byte re-derivation shows each affected branch performs exactly one one-byte load: data[0] for types 21/48 and data[1] for types 22/49, 23/35/50 and 24/51, so "at most one byte beyond the declared logical end" is rejected as a description and replaced by explicit access-width, displacement and excess fields. It also corrects privilege 505 to a captured-state statement: in the captured boot the prison filter admits 505 and the ucred+0x60 bit-62 helper gates it, while static code can bypass the bit-62 test when ktext+0x3b5cbb0 is nonzero and ucred+0x4 is zero. The short-cmsg_len result stays P3/low with no value escape, and privilege-505 live reachability stays a P1 gap. The independent IPV6-OPTION-ADMISSION-CORRECTIONS-AUDIT-1001-001 reproduces the manifest and the eight pinned facts, resolves the privilege-505→bit-62 jump-table linkage and confirms the prison-filter admission (0 High/0 Medium/4 Low/6 Info). Evidence: IPV6-OPTION-ADMISSION-CORRECTIONS-1001-001, IPV6-OPTION-ADMISSION-CORRECTIONS-AUDIT-1001-001; see the correction overlay, displacement table, and independent audit.

Newest secure-service refinement: sbl_encdec is a locked service-80021001, command-0x0601 transform with a mixed caller population. The complete wrapper census has 12 calls in six owners: MDBG coredump selector 0x44, HID/bond-auth 0x48, PPR/PFS key material 0x54, PPR/PFS protected records plus save-data 0x58, and IPMI coredump 0x50; NCDT calls the core directly with 0x4c. This corrects +0x6da9e7/+0x6daa0c to the SceHidAuth owner at +0x6d9330, not PFSMGR, and rejects the PFS-only wrapper label. Ten direct users of the service request wrapper carry commands 0x0101/0102/0103/0105/0106/0401/0501/0502/0601/0701, establishing broad key/transform/index infrastructure. PPR selectors 0x54/0x58 and command 0x0701 are package/app-mount adjacent, but no reviewed branch accepts a package, license, signature or SELF. The inferred /dev/encdec node remains root:wheel mode 0600 plus caps0-bit-62 open policy; complete sys_ioctl staging rejects the earlier null-status-store lead for its ordinary path, and ktext+0x8e2030 is corrected to high-confidence pmap_kextract. Error paths retain residual shared-buffer bytes, but every bounded fixed-image outward consumer is success-gated, so no disclosure sink is evidenced. The secure endpoint remains outside the dump. Evidence: ENCDEV-BOUNDARY-1001-001, SECURE-SERVICE-80021001-1001-001; see encdev report, complete secure-service census, selector owners, and command users.

Newest fPKG decision-gap result: FPKG-SECURE-DECISION-GAP-1001-001 closes the direct fixed-image response-consumer census below those selectors and commands. Thirty-one complete functions, 66 reviewed E8/E9 rel32 edges to nineteen targets, and 56 Rizin/objdump-agreed ranges show that both mount callers suppress selector-0x54 context failure, all five selector-0x58 callers discard its return before testing a later ktext+0x2d5520 result, and all fourteen direct unregisterMountKey +0x415310 calls are lifecycle/rollback edges rather than the primary verify verdict. Command 0x0701 and its clear path are fatal AppSwap lifecycle invariants; 0x0106 republishes mount-key/AppSwap state, including after sceSblSecRegResume. Inferred, high confidence: none of these reviewed branches is the final package/license/signature/SELF decision. Secure firmware, indirect/module callers, runtime values and the actual acceptance point remain Unknown. Evidence and the safe next boundary are in the decision-gap report, complete caller census, and decision ledger.

Newest offset/signature result: OFFSET-SIGNATURE-DATABASE-GAP-1001-001 turns the generated header into a normalized, searchable companion database without changing it. All 530 definition occurrences (529 unique names) are accounted for, including the one retained duplicate. Of 467 address-like records, 378 immutable RX addresses carry bounded exact-build bytes/signatures and 89 RW records are structural/redacted; all 155 rows imported from 21 retained signature CSVs match the immutable FW10.01 text under their masks. Four hundred address records join at least one catalog, containing-function, gadget, prior-signature or ledger relation, while 262 occurrence records deliberately retain ambiguity. No pattern is promoted as cross-firmware portable, and candidate names remain candidates. See the normalization report, CSV database, macro audit, and ambiguous-record ledger.

Newest source-lineage result: SOURCE-LINEAGE-SIGNATURE-CORPUS-1001-001 locks the clean local SDK comparator at commit f5d40f02770e9b0001dd9e18056eca70b3da8b40 and finds 1,394 releng/11.4 provenance tags, versus 1,219 release/9.0.0 tags in the local kstuff header corpus. Twenty-six source correlations make releng/11.4 the strongest available ABI comparator across syscall, usercopy, pmap, credentials, VFS, IPv6 and SMP, while Sony credential, usercopy, syscall/context and XOTEXT changes rule out an unmodified-FreeBSD conclusion. Sixteen complete-body-qualified signatures are instruction-aligned and unique across FW10.01 RX; two weaker/colliding candidates are rejected. Exact fork point, implementation commit, compiler/linker version and cross-firmware signature portability remain Unknown. See the lineage/signature report, source matches, signature corpus, and collision audit.

Newest function/string result: FUNCTION-STRING-ENRICHMENT-1001-001 joins all 35,666 explicit direct string-xref records without revealing mutable contents. Exactly 35,650 records lie inside their claimed function extents; sixteen are withheld as boundary conflicts rather than reassigned. The valid set covers 6,719 functions, 17,693 of 17,703 source string rows and 25,517 unique function/string pairs. FUNCTION-STRING-PROMOTION-1001-001 has applied the fail-closed structured overlay while preserving every curated annotation and unrelated field; 6,767 function rows now have nonblank machine-readable string-reference provenance. See the enrichment report, join ledger, and promotion state.

Newest syscall/sysctl result: native and PS4-compat syscall 202 converge through CFI thunk ktext+0x2ba220 on the complete 971-byte candidate_sys_sysctl_1001 body at +0x57d460. The wrapper, root traversal and handler invoker recover the 24-component MIB bound, user-buffer preflights, copyin/copyout contract, write/secure/prison policy, CFI callback constraint and lock handoff. The captured fixed-image tree has 1,124 linked OIDs, 998 handlers and 13 WR|ANYBODY entries. The focused FSST deepening resolves kern.fsst_param as a bounded native/PS4 storage-worker priority/affinity controller, while its outer sandbox/MAC policy remains Unknown. The separate kern.proc.callrec pass now closes its fixed-image lifecycle and direct producer census: process_exec_end allocates the zero-filled 136-byte proc+0x548 record, process_dtor frees it, local sysctl writes own events 0..2, graphics command 0xc0048116 owns event 8, an unidentified type-0x48 ioctl subcommand owns event 9, and event 10 has no direct/tail/absolute producer in the captured image. PID mode still lacks a visible target-visibility helper, so the surviving question is cross-PID timing policy—not a demonstrated pointer leak or memory-corruption primitive. Evidence: SYSCTL-SURFACE-1001-001, FSST-CPUMODE-DEEPENING-1001-001, CALLREC-TELEMETRY-DEEPENING-1001-001; see the sysctl report, FSST deepening, call-record deepening, and producer census.

Newest FSST caller/policy result: all three captured FW10.01 libkernel profiles export the same NID-backed sceKernelSetFsstParam wrapper. The common body at VA 0x15c30 constructs {u64 affinity,u32 priority,u32 padding}, calls sysctlbyname("kern.fsst_param",...,16), and routes non-CTL_USER work to syscall 202 with no FSST-specific userland credential helper. A bounded 645-file / 742,966,724-byte corpus has no static importer of that NID; all 54 direct imported-sysctl calls were checked and ShellCore's apparent leads were rejected as MIB {1,14,8} or unrelated data. The production caller and outer syscall/sandbox/MAC decision therefore remain Unknown. See FSST-CALLER-POLICY-1001-001, the caller report, wrapper variants, and direct-call census.

Newest AuthID/capability-policy result: ktext+0x626930..+0x6272b5 contains a dense 60-function / 2,028-byte credential-policy family. Forty-four predicates test ucred+0x58 AuthID; the remainder test capability, attribute, mixed or global-role state. The original complete census found 1,158 effective caller sites with 610 deliberately unowned. Two focused ownership passes now prove exact instruction membership for 33 of those sites: the earlier twelve-owner tranche recovered 22 and the latest six-owner gap pass recovered eleven more, leaving 577 unowned in the current overlay. The new exact owners are pfsmgr.d_open +0x2d5ee0, authmgr.d_open +0x2e0570, kern.ddr5_prxcfg +0x3d08f0, encdev.d_open +0x6c3b90, encdev.d_ioctl +0x6c3bc0, and icc_sc_config.d_open +0x9714e0. This corrects +0x9714eb from an NPDRM-adjacent guess to an instruction inside icc_sc_config.d_open. encdev command 0xc0284501 has a bounded 0x28-byte nested-copy contract and selector-specific credential gates, but neither it nor any other recovered caller-role check proves package, license, signature, PFS/PPR, SELF, PS4 fPKG or native PS5 fPKG acceptance or exploitability. Evidence: IDA-KERNEL-AUTHID-POLICY-1001-001, AUTHID-POLICY-CONSUMERS-1001-001, AUTHID-OWNED-TRANCHE-1001-001, FPKG-AUTHID-OWNER-GAPS-1001-001; see policy report, current consumer overlay, first ownership report, and latest owner-gap report.

Newest CFI semantic result: the bounded seven-target tranche has now passed a separate fail-closed catalog/coverage promotion. Two normalized-identical disposable-IDB exports and exact IDA/Rizin agreement cover 476 instructions / 1,734 bytes, with GNU objdump retained. Five absent complete functions were added—ACM indexed dispatch +0x3eddd0, mtx_sysinit +0x4eedf0, tunable_int_init +0x4baa60, sysctl_kern_proc +0x564680 with 19 OID routes, and older-ABI rw_sysinit_flags +0xc44e80—and existing rw_destroy +0xc44fc0 plus sysctl_handle_long +0x57c860 were classified. Exactly 1,360 unresolved bytes and 374 probable bytes moved to confirmed; no adjacent bytes changed. The +0xc44e80 calling-convention correction remains important: it consumes one SYSINIT argument record and is not the adjacent direct rw_init_flags API. Evidence: CFI-SEMANTIC-TRANCHE-1001-000, CFI-SEMANTIC-PROMOTION-1001-001; see the source tranche, promotion report, and independent validation.

Catalog reconciliation remains conservative. After the AuthID/IOMMU, IPv6/secure-service, string, RX-rodata, crypto/random, CFI-semantic and credential-COW promotions, current exact totals are 19,229 functions, 1,539 symbols and 84,036 edges, with matching GraphML. The RX partition is 152,830 confirmed-function, 8,327,946 probable-function, 72 confirmed-rodata, 1,857,465 padding/trap/cave-candidate and 3,031,031 unresolved bytes; the unresolved ledger has 17,541 ranges, 1,338 at least 0x100 bytes. The reviewed manifest now contains 186 extents / 65,936 bytes. Independent validation checks every promoted range, callsite, graph endpoint and interval against immutable bytes. Gadget qualifications, canonical IDBs and the ktext+0x51f7b0 boundary conflict remain unchanged. Evidence: FUNCTION-STRING-PROMOTION-1001-001, RX-RODATA-COVERAGE-PROMOTION-1001-001, CRYPTO-RANDOM-CATALOG-COVERAGE-PROMOTION-1001-001, CFI-SEMANTIC-PROMOTION-1001-001, THREAD-COW-CATALOG-PROMOTION-1001-001; see the credential-COW promotion report and independent validation.

REA/IDA exact-input status has advanced from target binding to two retained function dossiers. A narrow workspace-only IDAPython loader admits the original Sony e_type=0xfe10 hypervisor ELF without patching it or changing the installed IDA tree. REA emitted shipped-artifact Evidence for khv_iommu_set_guest_buffers at hv+0xd500..+0xdcbb (0x7bb bytes) and the governing hv_handle_exit dispatcher at hv+0x14d20..+0x176d3 (0x29b3 bytes), both bound to original SHA-256 7cccd72f...9110c. The second record's 32 direct callees exactly match LLVM immediate-call targets and independently corroborate the privileged VMMCALL gate plus command 0x06 IOMMU, 0x0e closure and 0x0f AP-start routing; three register-indirect calls remain unresolved. The former provider unknown is formally resolved, while missing normalized callers/types/strings/basic blocks/byte reads and cross-boot coverage remain explicit. Evidence: REA-HYPERVISOR-PROVIDER-1001-002, REA-HV-HANDLE-EXIT-1001-001; see provider resolution and dispatcher dossier.

Newest Linux-handoff result: command 0x0e makes hv_handle_exit return internal status 2 and virtualmachine_loop return zero; it is not a complete handoff. Two fixed return contexts now resolve. The direct reset/relaunch hv_main branch logs and self-jumps at hv+0x1085. Separately, captured BSP slots 33/34 and AP slots 5/6 place launch/ap_launch before last/ap_last; exact zero-return iteration therefore infers transition to last_loop and eb fe at hv+0xe70, but this composed transition was not runtime-traced and the mutable ordering is not promoted cross-boot. pcpu.cur_vm is narrowed to the secondary/IVM run marker, status 2 bypasses vcore.stop, and neither is a closure receipt. No fixed completion bitmap, callback, recovery edge, staged Linux entry, SVM teardown or device/IOMMU handoff exists in either successor. STARTUP_MP cannot revive an already-returned loop through fixed code because its consumer runs inside active VM-exit handling. The bounded negative excludes the unread reserved 8 MiB tail, modules, heap/generated code, generic register-driven calls, external loader, PSP/SMU, reset microcode and power behavior. No live command is authorized. Evidence: LINUX-HANDOFF-OBSERVER-1001-001, LINUX-HANDOFF-OBSERVER-AUDIT-1001-001; see focused report, independent audit, and observer ledger.

Newest AP2 live-readiness result: the bounded integration audit is an explicit console NO-GO. Attempts 20/21 qualify only the legacy 1,280-byte owner-strike/re-entry path. The installed hv_mp_startup hook is one-shot; merely making it persistent would replay one fixed handler and zero/overwrite AP1 evidence rather than route (hit,core)=(1,1) then (2,2). Four ABI-v2 records fit disjointly at cave +0x3200..+0x3600 with an 8-byte route witness at +0x3600, but no target AP1 receipt adapter, BSP two-hit/disarm router, AP2 observation image, or durable ABI-v2 persistence exists. The minimum next profile must end in a sealed AP2_OBSERVED handoff with an all-zero result and forbid alias publication, witness transfer, AP2 VMMCALL/VMRUN, CR3 writes, and NPT/page-table mapping writes. Evidence: AP2-OBSERVATION-INTEGRATION-1001-001; see integration audit, gate checklist, and state graph.

The eight blocked AP2 components now have an exact, non-deployable implementation and verification design. It specifies the direct BSP two-hit finite-state router and atomic disarm sequence, AP1 v2 receipt, separately staged observation-only AP2 image, durable output transaction, final-linked negative audit, deterministic build manifest and a 32-case fail-closed fault matrix. This closes design ambiguity only: all eight implementation gates remain blocked, no target artifact was created, and the console verdict remains NO-GO. Evidence: AP2-ROUTER-DESIGN-1001-001; see router design, implementation gates, fault matrix, and control/evidence graph.

Newest AP2 implementation result: a deliberately non-deployable Python reference prototype now executes the two-hit router, full 16-byte atomic gate restoration, AP1/AP2 commit-last records, disjoint writers, NX staging/copy analogue and durable output transaction. Seventeen unit tests, all 32 authoritative fault cases, sixteen persistence fault injections, a negative audit, four validator adversarial cases and two isolated byte-identical generations pass. This closes six gates and partially closes two only at the offline host-model boundary. No target ELF/bin exists, so all eight target/hardware gates remain blocked and console status remains NO-GO. Evidence: AP2-ROUTER-PROTOTYPE-1001-001; see the prototype report, gate split, and host-only source.

Independent readiness composition: 19/19 cross-artifact checks pass with no semantic contradiction, but the verdict remains console NO-GO. The near-term live lane is only AP2 observation after its eight blocked offline gates are closed, followed by a separate cold-boot repeat. All six HEN feature groups remain ready=0; neither PS4 nor PS5 package work has an owned package→AuthMgr/SELF→first-instruction receipt; Linux has no staged image or entry, and both recovered command-0x0e return contexts end in local busy-spins without a receipt or continuation. Evidence: READINESS-GAP-AUDIT-1001-001, LINUX-HANDOFF-OBSERVER-1001-001; see ranked audit and observer report.

Newest IOMMU global-control result: the primary AMD-IOMMU MMIO base is 0xfdd80000; Control is +0x18 and Status is +0x2020. Hypervisor init conditionally clears CMD bit 12 and ORs 0x11c01; resume clears CMD state and ORs 0x11c0d, while CB2 and CB3 receive 0x1000. The masks request EN/COH/ISOC/CMD/GTE, with resume additionally requesting ELOG/ELOGINT; GAE bit 17 is not explicitly requested. All 65,536 captured DTEs remain V=1, IV=0, IntCtl=1 with no interrupt table, while thirteen independently carry DMA translation. Because the primary writes are OR-RMW and MMIO was outside the capture, the final live raw Control value and inherited bits remain Unknown. This narrows—but does not clear—the Linux IRQ/DMA ownership gate. Evidence: IOMMU-GLOBAL-INTR-1001-001; see focused report, control ledger, and safe observation points.

Newest PS4 mount/exec provenance result: ShellCore import NID FtGP5aXKFQU resolves to libSceFsInternalForVsh sceFsMountGamePkg at module +0xae60. Its successful result is an LVD unit produced by /dev/lvdctl ioctl 0xc0286d00 (or 09 for the alternate layer), retained through PFS mount and returned after commit. At the reviewed ShellCore route, r8d=4 selects helper +0x758720; the optional second result is published at application-state +0x74b8, while adjacent +0x753c comes from distinct export-argument-four storage and is not another proven mount result. The same application object carries its eboot path through application+0x10 into Spawn2 and the previously recovered SysCore→execve path. Full-package RIF/PlayGo/LVD/PFS orchestration and loose nullfs/fake-SELF staging are structurally separate, but both still require execve and SELF/AuthMgr success. Evidence: IDA-PS4-MOUNT-EXEC-1001-001, PS4-MOUNT-EXEC-PROVENANCE-1001-001; see focused report, provenance ledger, and route comparison.

Newest kernel-text permission-caller result: an exhaustive immutable-text target scan and eighteen-function / 37,759-byte cross-decoded pass classify all twelve direct calls to vm_map_protect +0x317b30 and all six to pmap_protect +0x8e5510. Every direct VM caller passes set_max=0 and selects a process or loader-carried process map; none loads kernel_map +0x3400ab8. The pmap callers cover ordinary VM protection, COW write removal, process typed/batch routes and a read-only pmap_store zero-region transition; none adds execute permission to kernel text. Permission changes are incremental, use per-entry CAS, and join the no-timeout all-core TLB protocol. A follow-up bytewise census finds no other signed-relative RX reference or literal whole-image offset/canonical pointer to either entry. This is bounded fixed-image negative evidence, not proof against computed/module/runtime callers and not a live RW→RX recipe. Evidence: IDA-KERNEL-TEXT-PROTECT-CALLERS-1001-001, KERNEL-TEXT-PROTECT-CALLERS-1001-001, HEN-TEXT-OWNER-REFERENCES-1001-20261019-001; see reference census, direct callers, map selection, and locks/coherency.

Newest credential correction: proc0 is the fixed object at ktext+0x3424de8; +0x3424e28 is its p_ucred field storage, not a standalone rootcred. initproc is the pointer at +0x3424620, with thread0 a medium-high-confidence candidate at +0x3424750. Boot dynamically allocates proc0's 0x168-byte root-like credential, while initproc receives a separate clone; no fixed standalone rootcred was found. More importantly, the old ucred+0xe8 “Sony-private/MAC” label is rejected: +0xe8..+0x117 is the 0x30-byte FreeBSD-derived cr_audit / auditinfo_addr, and +0xe0 is the high-confidence cr_label slot. Sony authorization state is instead +0x58..+0xdf: AuthID at +0x58, capability qword at +0x60, and privilege-686 get_authinfo +0x507c60 controls full 0x88-byte disclosure. Evidence: IDA-KERNEL-ROOTCRED-PRIVATE-1001-001, ROOTCRED-PRIVATE-1001-001; see focused report and field ledger.

Newest SELF authorization/mapping result: 30 complete functions / 30,666 bytes / 7,127 instructions now join native selector 2 and PS4 selector 1 through the shared loader, pager/AuthHeader context, secure function-22 IsLoadable exchange, VM construction, section mappings, process commit, copyout and amd64 register handoff. Both modes require the same four secure-success gates before the 136-byte authorization state is retained; PS4 wrapper selection is therefore not an authorization bypass. AuthHeader +0x2df1b0 is a four-slot bounded format/context materializer, not the secure verdict. The compare at +0x9c2fa4 rejects values >=0x12090002, erases the output and becomes internal -46 / public 75; it is not qualified as a minimum-version check. Native additionally rejects PT_LOAD with PF_R|PF_X. The resolved entry reaches image-state +0x30 and then trapframe RIP +0xe8 through setregs +0xa07890; final return-to-user and first fetch remain Unknown. Evidence: IDA-KERNEL-SELF-AUTH-MAPPING-1001-001, SELF-AUTH-MAPPING-1001-001; see focused report, result ledger, and call graph.

Newest native-PPR execution result: the successful PPR path is joined through ShellCore/SysCore to execve(path,argv,NULL), and the fixed kernel mechanics are now bounded through candidate_sys_execve_1001 ktext+0x6fcfb0, nameidata construction, namei, vnode execute/open checks, first-page header materialization and the activator loop. The common SELF format gate accepts raw ELF plus two container magics, while the decisive native-versus-PS4 split reads embedded ELF EI_ABIVERSION byte 8 at ktext+0x3cf9cf and combines it with wrapper selector 2 or 1. PPR/PFS origin, path and mount unit do not feed that branch; they still gate generic vnode reachability and may affect pager/AuthMgr behavior. The two remaining runtime discontinuities are the exact namei vnode/header and the heap-resident execsw order/chosen entry. AuthMgr success, mapping and first instruction remain Unknown. Evidence: PPR-EXEC-OBJECT-CONTINUITY-1001-001, IDA-KERNEL-EXECVE-ACTIVATOR-1001-001, EXECVE-ACTIVATOR-1001-001; see kernel path ledger and focused graph.

Newest SELF-to-first-fetch result: one image_params object now statically joins the resolved vnode at +0x10, first-page/header state at +0x50/+0x28, AuthMgr function-22 output at +0xc8, selected sysentvec/mode, inner ELF entry at +0x30, and the setregs trapframe RIP at +0xe8. sys_execve preserves and copies the complete 136-byte AuthMgr result into committed image/process state. Both PS4 selector 1 and native selector 2 traverse shared pager/AuthMgr work before the EI_ABIVERSION split; wrapper choice is not the trust decision. The fixed return assembly then consumes trapframe RIP through conditional SYSRETQ or IRETQ. Remaining gaps are precisely runtime-only: PPR pathname→live vnode, heap execsw order, concrete secure decision, realized mappings/PTEs, post-AST RIP/return route and actual first instruction fetch. Evidence: FPKG-FIRST-FETCH-CHAIN-1001-001; see the continuity report, machine chain, and discontinuity ledger.

Newest Linux device/IRQ-ownership result: the lifecycle pass and a second 20-function / 12,777-byte IRQ pass reproduce across fresh disposable IDBs, IDA, Rizin and GNU objdump. xHCI detach ktext+0x6d38f0 is a coherent child/callout/halt/reset/busmaster/IRQ/resource/uninit sequence, but normal S3 does not use it. Its live attach preference is MSI-X→MSI→legacy; the handler is +0x897fa0, and softc IRQ/MSI-X/cookie fields at +0x18e300/+0x18e308/+0x18e310 plus RID form a sanitized observation tuple. Aeolia DMAC still has no detach and no-op suspend; it optionally requests MSI, installs handler +0x7598e0, and retains resource/cookie/active state. PCI busmaster helpers are exact at +0x352910/+0x352a20. Across all 65,536 captured DTEs, interrupt-map valid/base/length/pass-through fields are zero. The later global-control pass recovers the exact requested Control masks but not the final OR-RMW value; it therefore narrows global routing state without proving safe IRQ transfer. CPU parking is not DMA or IRQ ownership transfer. The safe next rung is observation-only owner-callback plus hypervisor-owned pre/post Control/Status telemetry, not reset/unbind/arbitrary guest MMIO. Evidence: DEVICE-HANDOFF-1001-001, DEVICE-IRQ-HANDOFF-1001-001, IOMMU-GLOBAL-INTR-1001-001; see IRQ paths, telemetry, and global-control observations.

Newest Linux memory-ownership result: current pLinux memory-layout ABI4 fixes the older optional-TMR, role/cardinality and unbounded-lookup gaps and links a five-page identity/transition map; six current-epoch host tests, including the Fedora bzImage case, pass. The PS5 allocation/map/page-walk/hash/S3-revalidation backend nevertheless has no non-test caller, default handoff still publishes integration_hardware_gates=0 and memory_layout_validation=0, and the staging lease explicitly does not prove exclusive ownership or DMA/IOMMU quiescence. The Fedora workspace and inherited high-staging test window avoid known captured TMR/hypervisor exclusions but remain blocked because exclusion-complement is not complete e820 or ownership proof. Only 3/15 gates pass; live readiness does not change. Evidence: LINUX-MEMORY-OWNERSHIP-GATE-1001-001; see the report, gate evaluation, and range decisions.

Latest focused passes: the core pmap, all-core shootdown and VM/JIT/direct-memory clusters are now independently bounded without promoting speculative catalog coverage. Twenty pmap ranges cover 15,138 bytes / 3,564 instructions, including vtopte, bootstrap, PAT/init, local invalidators, extraction, mapdev/attribute and large-page-demotion paths. A separate 26-range / 6,556-byte pass recovers the normal f7..fa full/page/range/cache remote protocol, three full-flush variants, shared request lock and global acknowledgement counter. The sender requires interrupts enabled and has no visible timeout, so this is a safety contract—not a ready-made carrier primitive. Twenty-two VM/JIT/dmem bodies cover another 18,065 exact bytes, ten native/PS4 sysent routes and 28 dmem commands. That pass corrects the direct-memory selector (+0x4023e0 is value < 21), proves the virtual-query walk is locked, rejects a bulk batch-copy interpretation, and identifies a high-confidence JIT error-propagation anomaly whose consequence remains a hypothesis. Evidence: PMAP-CORE-1001-001, PMAP-SHOOTDOWN-1001-001, VM-JIT-DMEM-1001-001; see pmap report, shootdown protocol, VM/JIT contracts, and security hypotheses.

Newest XOTEXT/NX result: thirteen complete functions / 30,383 bytes distinguish actual permission writers from nearby consumers. CPU pmap writers +0x8e5510/+0x8e64d0/+0x8e7a80/+0x8e9000/+0x8f1960/+0x8f7900 set NX when execute is absent and bit 58 only for exact execute-only protection. +0x8e9d80 is an invariant auditor, not a writer. The different +0x8f3f70 policy sets bit 58 whenever execute is present and its sole selected caller +0x522bd0 establishes IOMMU/device-domain context, rejecting the earlier boot-mapper interpretation. vm_map_protect +0x317b30 is an upstream dispatcher, but no audited fixed-image chain authorizes a kernel_map/kernel-text RW→RX transition; the all-core acknowledgement path still requires IF=1 and has no timeout. Evidence: IDA-KERNEL-XOTEXT-NX-1001-001, XOTEXT-NX-1001-001; see bit-site inventory, policy paths, and writer/consumer ledger.

Recent native-PPR mount-boundary result: sceFsMountPprPkg initializes both outputs to -1, mounts outer then inner, and publishes both unit ids only when both succeed; a second-mount failure rolls back the first while preserving the original negative result. ShellCore and kernel ppr_pfs likewise commit mount state only after success and preserve errors through cleanup. Native PS5 PPR and PS4 standard-PFS package routes remain distinct even though their selector-2/selector-1 SELF wrappers later converge on the shared loader and AuthHeader/IsLoadable machinery. The execution passes close the mount-object/path-to-execve request edge and recover the fixed namei/vnode/header/activator mechanics. Missing runtime objects now prevent provenance-binding the exact path to its vnode/header and heap execsw choice. Evidence: PPR-MOUNT-AUTH-BOUNDARY-1001-001, PPR-EXEC-OBJECT-CONTINUITY-1001-001, EXECVE-ACTIVATOR-1001-001; see stage ledger and kernel exec ledger. Mount success plus activator reachability is not executable authorization or first-instruction proof.

Newest allocator result: 24 exact ranges / 16,673 bytes recover kernel_map +0x3400ab8, kernel_arena +0x1ac2b60, kmem_arena +0x1ac2b68, kva_alloc/free, backed kmem alloc/free symmetry, VM-map helpers, pmap_enter +0x8e64d0 and native/PS4 sys_mprotect. All three audited backed allocators pass prot=3, flags 0x203, psind 0 to pmap_enter: RW+wired, not executable. The separate SELF loader has an executable+wired process-map route, but it is not a generic kernel allocator. Evidence: IDA-KERNEL-MAP-KMEM-1001-001, KERNEL-MAP-KMEM-1001-001; see contracts and findings.

Newest SMP/S3 result: 19 stop/suspend ranges / 4,062 bytes recover vectors fb/fc/fd, the ff hard-stop NMI selector, producer/acknowledgement masks, stop and suspend pens, savectx, FPU/PAT restoration and the AP restart join. The producer wait is bounded at 100,000,000 PAUSE iterations and returns 1 after a timeout warning; that return is not proof every target parked. restart_cpus/resume_cpus publish a shared release mask and wait without timeout. Normal stop can quiesce APs but exposes no Linux AP-entry callback. Evidence: IDA-KERNEL-CPU-STOP-SUSPEND-1001-001, CPU-STOP-SUSPEND-1001-001; see protocol and S3 report.

Newest saved-context refinement: fifteen ranges / 2,515 bytes prove that 0x1c0 is the high-confidence PCB extent, not the amount explicitly saved. savectx/resumectx preserves a sparse kernel callee-saved continuation contract; two regions remain untouched, RFLAGS and arbitrary caller-saved registers are not restored, and the mechanism is not a Linux entry frame. The AP path loads temporary and per-core GDT state before resumectx. On return, the suspend handler clears its acknowledgement bit before FPU, PAT, TSC_AUX/P-state, CR4/EFER/CPU-feature, PCE, GS and DEBUGCTL reinitialization completes. Evidence: IDA-KERNEL-CONTEXT-RESUME-1001-001, CONTEXT-RESUME-1001-001; see layout, state order, and call graph.

Recent focused pass: the canonical usercopy and scalar-access family is recovered rather than inferred from wrappers. Fifteen semantic candidates plus one shared fault tail cover ktext+0x28d220..+0x28d9ba; two fresh disposable-IDB exports are byte-identical, and IDA, Rizin and GNU objdump agree across 18 ranges / 416 instructions. Static mechanics establish the 0x800000000000 user bound, pointer masking, STAC/CLAC, GS:+0x20 -> pcb_onfault +0x108, and trap-frame RIP repair at +0xe8. A later exhaustive 4,521,870-instruction operand census resolves the former unknown proc+0x589 gate: thirteen user-access readers reject while it is nonzero; app save/swapout sets it to 1 under the process lock before VM-map transition work, and app restore clears it to 0 before restore work. This is a high-confidence transient per-process usercopy-quiescing state, not a generic privilege bit or patch target. The two copyin overlap/overflow diagnostics are independent six-byte UD2 fail-stop bodies. The callerless suword16 still uniquely omits STAC/CLAC; reachability, CR4.SMAP/AC state and consequence remain unobserved. Evidence: IDA-KERNEL-USERCOPY-1001-001, USERCOPY-1001-001, USERCOPY-COVERAGE-1001-001, IDA-KERNEL-USERCOPY-GATE-1001-001, USERCOPY-GATE-1001-001; see usercopy report and gate lifecycle.

Previous focused pass: live-run status is now bound to exact artifacts instead of a prose-only readiness claim. Attempt 21 hardware-qualified the former owner-reentry candidate: the owner-derived sixteen-VMCB transaction completed, one NOP VMMCALL command 0x17 crossed VMEXIT/VMRUN, RAX returned zero in the same logical-CPU/CR3 context, the alias slot stayed zero, and all eight run records match two independent reads. The deployed 706,784-byte ELF retains SHA-256 caf380a7aa659b3526d290214470a727b96e4cfc75d1bd48a00c9ec84929fa2b; its linked audit covers 620 instructions and exactly five authorized VMCB-store sites. This proves the control-flow boundary, not functional NPT disable: the common handler may overwrite CLEAN=0, and no post-handler VMCB recheck exists. The active ABI-v2 AP1-strike/AP2-software-reset record contract is now internally coherent and host-qualified at exact source hashes: normal and ASan/UBSan behavioral tests pass, both C11 headers compile, the combined freestanding object has zero undefined symbols, and all 19 record functions use at most 56 bytes of stack. A new source-level owner/VMCB identity validator binds its lineage into an unsealed ABI-v2 request and passes normal/sanitizer tests, but it has no bounded caller or target-build wiring and performs no target memory access, VMCB mutation, or carrier invocation. No AP1/AP2 hook adapter, separately placed witness, durable result path, or integrated console artifact exists. HEN, fSELF/fPKG, resident runtime and Linux remain blocked. Evidence: LIVE-RUN-READINESS-1001-001, OWNED-ALIAS-SOURCE-STATE-1001-001, OWNED-ALIAS-ABI2-HOST-1001-001; see live-run-readiness.md, current gate export and current Linux/HVE delta.

Previous focused pass: the FW10.01 credential/prison foundation is recovered instead of inferred from getuid alone. candidate_prison0_1001 is ktext+0x2acf4e0 (kdata+0x1e0f4e0), with 20 direct static xrefs, an exact jailed comparison against ucred+0x30, and a boot store to the same field. Fourteen complete credential/prison functions recover allocation, copy, groups, process installation, hold/free, jailed, prison_allow, and prison reference mechanics. Public fields include proc.p_ucred +0x40, thread.td_ucred +0x140, ucred.cr_prison +0x30, group storage at +0x118/+0x120/+0x124, and allocation size 0x168. The later root/private pass corrects the former +0xe8 label to cr_audit, locates Sony auth state at +0x58..+0xdf, and bounds proc0/initproc. The original pass promotes 1,511 probable bytes, bringing the reviewed manifest to 162 functions / 62,165 bytes and the symbol catalog to 1,381 entries. This improves HEN porting but does not bypass AuthMgr, NPDRM/RIF, PFS/PPR, DriveAuth, A53, application-category, or SELF policy. Evidence: CREDENTIALS-PRISON-1001-001, CREDENTIALS-PRISON-COVERAGE-1001-001, and ROOTCRED-PRIVATE-1001-001; see credentials/prisons and root/private ucred.

Previous focused pass: process targeting, filesystem-root handling and the local HEN implementation landscape were joined into one FW10.01 porting contract. Complete pfind +0x5612c0, pget +0x5613b0, vmspace_acquire_ref +0x3121c0 and vmspace_free +0x311f80 bodies validate allproc +0x3425d70, allproc_lock +0x3425d50 and the held-process/VM-space lease model. Independently, 31 exact xrefs through sandbox, chroot and mount-directory maintenance validate rootvnode +0x3c63510 and the filedesc directory fields. A hash-locked comparison selects local ps5-hen as the fail-closed FW10.01 prerequisite contract, kstuff-lite as the closest PS4 fPKG/fSELF implementation reference and ppr-patch as native PPR selector research only. The last promoted inventory is bound to requirements SHA-256 743181f5...87b6 and passes 106 static anchors; all six feature groups remain ready=0. The latest point-in-time audit at HEAD 3a80f8b...f1e2, requirements 33284e51...ba9ef, passes 108 anchors with identical readiness counts and gates, but does not silently replace the promoted tables. Evidence: PROCESS-LIFETIME-1001-001, ROOTVNODE-FILEDESC-1001-001, HEN-IMPLEMENTATION-COMPARISON-1001-001, HEN-CURRENT-EPOCH-AUDIT-1001-001; see process-and-thread-lifecycle.md, PS5-HEN porting, and implementation comparison.

Previous focused pass: the captured IDT and first-level interrupt architecture were recovered end to end. All 256 gates at ktext+0x3a1c300 are present selector-0x20 interrupt gates and resolve through 46 exact E9 rel32 + INT3 CFI slots. Only vectors 03,43,44,45,92 are DPL3; Sony vectors 44/45 map to SDK Debug stop/request to dynamic linker, while trap 36 behind vector 43 remains Unknown. The complete 21,152-byte exception/APIC/IPI/common-return bank is independently decoded; doreti is +0x2512d0, exact IRETQ is +0x2514ed, and six selector/base repair entries follow. The actual Sony IPI block is f6..fd; the captured f7 full-TLB route is boot-selected from three variants. Six complete trap/APIC/IPI C functions add 5,594 reviewed bytes, and #DB/NMI/#DF/security-exception route through IST4/2/1/5. Eight accepted ranges total 26,852 bytes / 5,207 instructions and agree across two disposable-IDB exports, Rizin, GNU objdump and raw bytes. No exploitability is claimed from the five user-callable gates. Evidence: IDA-KERNEL-IDT-INTERRUPTS-1001-001, IDT-INTERRUPT-DISPATCH-1001-001, and IDT-INTERRUPT-COVERAGE-1001-001; see interrupts-traps-and-context.md, gate inventory, path ledger, and focused graph.

Previous focused pass: the native amd64 SYSCALL route is now recovered end to end. BSP and AP initialization both set EFER.SCE, install LSTAR=ktext+0x2afb50 and CSTAR=ktext+0x2afdc8, and use STAR=0x0033002000000000; LSTAR reaches the complete swapgs entry at +0x251710, while CSTAR reaches a two-byte SYSRETL stub. The entry builds a 0x110-byte Sony-extended trapframe, dispatches through amd64_syscall +0x42bdc0, sysentvec+0xb0, sysent+0x08, and sysentvec+0xa8, then returns through syscallret, userret, AST, the unique SYSRETQ, or shared IRET machinery. Seven complete functions total 9,854 bytes / 2,132 instructions; IDA, Rizin and GNU objdump agree, and two fresh disposable-IDB exports are byte-identical. Sony-only observations include a three-syscall debughandler allowlist, direct-SYSCALL diagnostics/policy, ten extended saved MSRs whose meanings remain Unknown, and an AP/BSP SF_MASK difference (0x4701 versus 0x44701). No memory-safety defect or exploitability is established. Evidence: IDA-KERNEL-SYSCALL-ENTRY-1001-001, SYSCALL-ENTRY-DISPATCH-1001-001, and SYSCALL-ENTRY-COVERAGE-1001-001; see syscall-dispatch.md, path ledger, and focused graph.

Previous focused pass: thirteen complete process/application functions add 3,639 newly confirmed bytes (3,682 reviewed bytes including the previously confirmed getter) and recover the exact meaning of the former “extended metadata” chain. proc+0x570 is p_application; application+0x118 is category; exec-pre copies app->container, derives p_ps4_memory_type, links p_app_siblings, and increments application counters under the capture-exact application lock/AppmgrLock. The complete category mapper returns 28 exact names. Most importantly for PS4 fPKG work, ShellCore patch value 0x0001f100 is independently named by this kernel as ps4_nongame_mini and flows through application attach into the SELF category/ABI gate at ktext+0x3d0790. This closes the category side of the launch chain, but it does not authorize a RIF, package, PFS/PPR image, NPDRM request, or unsigned SELF. Two disposable-IDB runs and two full analyzer runs are byte-identical; IDA, Rizin and GNU objdump agree over all thirteen bodies. Evidence: IDA-KERNEL-PROCESS-METADATA-1001-001, PROCESS-APPLICATION-METADATA-1001-001, and PROCESS-APPLICATION-COVERAGE-1001-001; see process-application-metadata.md, category map, and focused graph.

Previous focused pass: eight complete SELF policy, ASLR, per-process random-state, and unwind-metadata helpers add 1,572 independently decoded bytes / 426 instructions. The post-ABI predicate at ktext+0x3d0790 is now corrected to an application-category/executable-ABI check: non-PS4 category families pair with native process mode 1, while (category&0xf000)==0xf000 pairs with PS4 mode 0. Mismatches and category-read failure fall back to the exact bit-2 predicate (security_flags & 4) && (qa_flags[0] & 4). Ordinary failure returns Sony-only literal 106; the local FreeBSD catalog ends at 96, so its symbolic name remains Unknown. SELF placement uses fixed 0x400000..0x80000000 bounds, 16-KiB/2-MiB granularity, and a per-process SHA-1-family-mixed 32-bit source. The complete late unwind parser accepts absolute udata4 and PC-relative sdata4; extended length 0xfffffffffffffff4 wraps length+12 to zero and statically yields a no-progress loop if attacker-controlled data reaches it. That is a bounded denial-of-service hypothesis, not an exploit claim. Evidence: IDA-KERNEL-SELF-POLICY-1001-001, SELF-POLICY-HELPERS-1001-001, and SELF-POLICY-COVERAGE-1001-001; see self-image-activators.md, decision ledger, and audit ledger.

Previous focused pass: the Native SELF and PS4 SELF entries are exact 15-byte selector wrappers over one 4,497-byte common loader. Native sets selector 2; PS4 sets selector 1. The common body uses ELF e_ident[EI_ABIVERSION] to choose Native versus PS4 sysentvecs, writes the process compatibility byte, and applies an extra native-only PT_LOAD PF_R|PF_X rejection. It contains no mode-local allow-unsigned branch: both tracks retain the common header/pager/process-policy/mapping/dynlib path. Evidence: IDA-KERNEL-SELF-ACTIVATORS-1001-001, SELF-ACTIVATORS-1001-001, SELF-ACTIVATORS-COVERAGE-1001-001; see mode comparison and focused graph.

Previous focused pass: eleven complete package/security module functions (5,247 bytes / 1,205 instructions) are byte-locked across disposable IDA, Rizin, GNU objdump and the immutable image. The pass recovers pfsmgr, AuthMgr, native/PS4 SELF, A53 controller/A53IO, platform-auth, generic VFS, driveauth and NPDRM lifecycles. It corrects PPR registration: moduledata ktext+0x2441f18 points to vfsconf +0x2441f30; captured 0x43 is assigned vfc_typenum=67, while vfc_flags=0; the 24-slot vfsops at +0x2441f78 has fourteen exact CFI routes. Three bounded lifecycle leads are retained without exploit claims: platform-auth registers a suspend callback after its load-failure cleanup path, AuthMgr discards two callback tags without visible unload deregistration, and pfsmgr lacks visible partial-load rollback after contiguous-allocation failure. A53IO adds teardown ownership but no safe Linux handoff. Evidence: IDA-KERNEL-PACKAGE-MODULE-PROBE-1001-001, PACKAGE-MODULE-LIFECYCLE-1001-001, PACKAGE-MODULE-COVERAGE-1001-001; see package-module-lifecycle.md and focused graph.

Previous focused pass: the complete fixed-image static-module registry is now reconstructed rather than inferred from isolated strings. Exactly 328 unique module_register_init pairs resolve to 141 handler values; 309 carry exact MDT_MODULE v1 metadata and 19 form a correlated zeroed/dormant cluster. The 156 records routed through the generic driver handler expand into 22 buses, 141 kobj classes, 1,017 method entries, 123 descriptors, five chain-event handlers and four direct fixed-RX methods. Complete IDA/Hex-Rays, Rizin and GNU-objdump review identifies driver_module_handler at ktext+0x303520..+0x3038dd and module_register_init at +0x5a7c90..+0x5a7f5f; two fresh disposable-IDB exports and repeated full analyzer runs reproduce byte-for-byte. Package/trust anchors include pfsmgr, ppr_pfs, npdrm, self, ps4_self, authmgr, driveauth, pltauth2 and a53io; Linux/ownership anchors include PCI/ACPI, IOMMU, NVMe, xHCI, UART and Aeolia DMA families. This is a robust initialization/subsystem map, not a package bypass, attached-device result or Linux handoff. Evidence: IDA-KERNEL-DRIVER-MODULES-1001-001, DRIVER-MODULE-REGISTRY-1001-001, DRIVER-MODULE-COVERAGE-1001-001; see device-driver-registration.md and kernel-module-registry.graphml.

Previous focused pass: the local exact retail FW10.01 A53 ELF is now qualified directly against ppr-patch profile 48. The image has SHA-256 27113107188d28b972e7e54d21c49624032af3c2e8783566f74e408a64cdd329, build ID ede1bdf9fc725f5e67f499cb5f396e13, and an embedded 10.01 release banner. All ten helper-call words, three internal stock words and two retired guard words match; every branch destination is exact; and a raw scan of every executable ELF segment agrees with REA/IDA on the complete ten-xref helper set. The proposed 0xf0-byte allocation is raw zero fill with 0x10 bytes remaining before its page end. Although it lies beyond the IO segment's ELF p_filesz/p_memsz, the exact loader log maps its containing 0x04e30000..0x04e60000 range R-X/R-X. Static original-image compatibility is therefore high confidence. Live deployment identity, cache maintenance, atomic installation, FD/FC-to-FF/FE translation, selector choice, AuthMgr/SELF acceptance and intended-code execution remain Unknown; no full PS5 fPKG result is claimed. The same image also exposes table-reachable SDBGP read/write-memory handlers and a host-sized command walk lacking an input-end comparison; reachability and consequence remain Unknown. At that checkpoint the gate validated 183 JSON, 178 CSV / 653,828 rows, ten GraphML and 47 Markdown / 635 links, required 36 focused artifacts/seven Evidence IDs, and regenerated 31 outputs from five analyzers twice without drift. Evidence: PPR-PATCH-ORIGINAL-IMAGE-1001-001, A53-SDBGP-PROVENANCE-1001-001, FPKG-END-TO-END-1001-001, WORKSPACE-VALIDATION-1001-002; see package-self-and-fpkg.md, original-image validation, and interesting-findings.md.

Previous focused pass: the common ShellCore process owner is now joined from PlayGo startup through factory/request execution to the concrete PS4 actor and onward to the previously recovered hybrid-merge/pfsmgr slice, while the same owner selects legacy mount_game or native PPR mount. A separate entitlement pass reconstructs disc/HDD EEKc register/stat selectors, exact invalid-key translation, EEKc-version and non-production mismatch flags, and their later EICV specialization. The two immediate mismatch helpers do return zero through shared 31 c0 c3, but the independently stored flags later map shared error 0x80020060 to 0x80a40058 or 0x80a4006b; helper success is therefore not package acceptance. The bridge covers 26 functions / 59,423 interval bytes / 12,251 instructions, and the RIF slice covers 10 functions / 18,405 interval bytes / 3,734 primary instructions, with independent IDA/Rizin/GNU-objdump agreement and byte-identical repeated runs. No PS4/PS5 fPKG bypass or Linux handoff is claimed. Evidence: IDA-SHELLCORE-PS4-MOUNT-BRIDGE-1001-001, SHELLCORE-PS4-MOUNT-BRIDGE-1001-001, IDA-SHELLCORE-RIF-ENTITLEMENT-1001-001, SHELLCORE-RIF-ENTITLEMENT-1001-001; see package-userland-clients.md, package-self-and-fpkg.md, and interesting-findings.md.

Previous focused pass: the three pfsmgr context-transform commands are now traced upward through retail ShellCore rather than stopping at their wrappers. A single PlayGo controller runs setup and then repeated chunk transfer; exact mode-one and mode-zero wrappers converge on the same merge core, correcting the tempting but false PS4-versus-PS5 branch interpretation. The concrete ScePlayGoCorePlayGoActor constructs a +0x340 subobject with vtable 0x1e70768; wrapper +0x1323c10 calls slot +0x38, whose original-ELF R_X86_64_RELATIVE relocation resolves to +0x1323c60, which calls exact PS4PlayGoToDoList validator +0x1323ca0. Eighty-one selected functions cover 82,297 exact interval bytes / 17,537 instructions, with full IDA/Rizin/GNU-objdump agreement and byte-identical results from two fresh disposable IDB runs. Inferred with high confidence: the reviewed transform consumer is PS4-compatibility PlayGo hybrid patch/merge content maintenance. Observed negative: this is not an fPKG trust bypass, does not collapse the native PS5 PPR/A53 route into PS4 machinery, and contributes no native-Linux handoff primitive. Evidence: IDA-SHELLCORE-PFSMGR-CONSUMERS-1001-001, SHELLCORE-PFSMGR-CONSUMERS-1001-001; see package-userland-clients.md and package-self-and-fpkg.md.

Previous focused pass: all four formerly opaque pfsmgr delegates are complete. Both roots enforce the shell-process predicate at ktext+0x2ab208. Commands 0xc1185001..03 manage ten three-handle secure contexts and implement a fixed 0x20000 input → XTS decrypt → bounded 64-KiB selection → XTS encrypt → 32-byte block signature → 64-KiB output pipeline. Command 0xc4085004 is exact sceSblPfsSaveDataUpdateAuthCode, which validates and rewrites a 112-byte save-data auth record at file offset 0x7f90. Twelve kernel functions / 5,639 bytes / 1,278 instructions and three ShellCore ranges / 126 bytes / 40 instructions agree across raw bytes, IDA, Rizin and GNU objdump. This strengthens the fPKG/PFS map but yields no bypass. Evidence: IDA-KERNEL-PFSMGR-DELEGATES-1001-001, PFSMGR-DELEGATES-1001-001, PFSMGR-DELEGATES-COVERAGE-1001-001; see package-security-ioctl.md.

Previous focused pass: the PS4/PPR driveauth join is now typed through the kernel rather than stopping at a common ioctl immediate. Top-level 0xc0285301 carries an exact 0x28-byte nested-command request. PS4 selects record word 0x8004 and nested opcodes 14/15; native PPR selects 0x8005 and 16/17. The explicit shared-core call at ShellCore +0x165e911 is opcode 13 on the exact clearSessionKey cleanup path, not the discriminator. Completion opcodes 15/17 obtain 48 backend bytes, retain the first 16 as mode 1/2, and return the final 32. Kernel module/open/destructor/suspend/resume recovery also establishes an exclusive 0/1/2/3 session state machine: process suspend moves an active owner 2→3 and finalizes, the cdevpriv destructor preserves state 3, and process resume releases 3→0. Twenty-two kernel functions (7,627 bytes / 1,851 instructions) and the selected ShellCore path (3,163 instruction bytes / 713 instructions) agree across IDA, Rizin, GNU objdump and raw artifacts. This improves fPKG tracing and supplies a nonsecret S3/process-lifecycle anchor; it proves no trust bypass or race. Evidence: IDA-KERNEL-DRIVEAUTH-PROTOCOL-1001-001, IDA-KERNEL-DRIVEAUTH-GLOBAL-XREFS-1001-001, DRIVEAUTH-PROTOCOL-1001-001; see driveauth-protocol.md.

Previous focused pass: a deterministic scan of all 332 local retail firmware-10.01 modules finds 82 raw accepted-command byte patterns, validates 79 as executable immediate carriers with Rizin and GNU objdump, and explicitly rejects three coincidences. ShellCore owns 41 sites covering all 13 pfsmgr and all four pltauth commands; shipped unwind FDEs recover the 18 initially missing command/string owners in disposable IDA copies, and every command site reaches the ioctl import. Exact thunks at ShellCore module +0x165e1d0 and +0x165ead0 distinguish PS4 (EDI=1) from native PPR (EDI=0) before one shared core. Evidence: PACKAGE-USERLAND-CLIENTS-1001-001, IDA-SHELLCORE-PACKAGE-CLIENTS-1001-001, SHELLCORE-PACKAGE-CLIENTS-1001-001; see package-userland-clients.md.

This workspace is the persistent, offline analysis of the fixed-kernel RAM snapshot captured on 2026-10-13. The original dump and all PS5 source repositories are read-only inputs; every database, script, export, and report produced by this investigation lives here.

Status: active and incomplete. The immutable kernel identity gate passed and the captured layout is reproduced in IDA. Current catalogs contain 19,229 functions, 1,539 evidence-qualified symbols and 84,036 call edges; the reviewed manifest contains 186 extents / 65,936 bytes. The exact RX partition is 152,830 confirmed-function, 8,327,946 probable-function, 72 confirmed-rodata, 1,857,465 padding/trap/cave-candidate and 3,031,031 unresolved bytes. Process, rootvnode, prison0, proc0/initproc, public credential lifetimes, Sony AuthID/capability anchors, canonical usercopy/fault recovery, kernel_map plus kva/kmem allocation/free, focused pmap mechanics, the CPU execute-only writer family, stock all-core shootdown, core VM/JIT/dmem and the fixed crypto/random tranche are statically recovered. Audited kmem allocations are RW+wired rather than executable; exact Sony-private subfields, active MAC-label policy, target-safe credential replacement, any indirect/module/runtime kernel-text permission owner and rollback lifecycle, runtime SMAP behavior and all six deployable HEN feature groups remain fail-closed or unresolved. Live work has qualified the Attempt 20 bounded VMCB transaction/rung-1 return and the Attempt 21 owner-reentry control-flow boundary. The terminal pLinux observer has an exact reproducible offline-qualified ELF, but no hardware run is authorized. The separate G-LIVE-004/AP2 lane still needs target-safe snapshots, target router/build integration, durable receipts and cold-boot observation. The corrected companion capture supplies the symbolized hypervisor, 16 typed CPUs / 32 vcores, three NPT trees, two IOMMU views and bounded S3/AP/hypercall work. PS4 fPKG/fSELF has a strong static implementation and launch-policy foundation plus a host-qualified receipt contract, but no collector or provenance-bound end-to-end launch receipt; native PS5 PPR remains a separate incomplete trust path. Linux has reusable AP/SVM/memory/UART/device anchors, but the two fixed command-0x0e return contexts are terminal busy loops with no qualified ownership handoff or Linux entry. No exploitability, package acceptance, serial output or Linux boot is claimed.

Newest focused kernel result: PAGE-FAULT-SMAP-1001-001 joins vector 0x0e through Xpage +0x24dee0, trap +0x42a9d0 and trap_pfault +0x42b8e0. Twelve selected ranges / 6,950 bytes agree across two byte-identical disposable-IDB exports, raw bytes, Rizin and GNU objdump. The exact policy distinguishes kernel/process maps and read/write/execute faults, makes a present supervisor-read fault with saved AC clear fatal before pcb_onfault when SMAP is active, clears saved AC on the recoverable path, and routes [8 TiB,15 TiB) through a Sony read/write-only existing-mapping validator. Runtime CR4/AC/PKRU and actual fault behavior remain Unknown; this is not authorization for live fault injection.

Validation status: the current normal non-regenerating consistency gate is a PASS. It parses 912 JSON files, 1,057 CSV files / 2,660,121 data rows, 109 GraphML files and 213 Markdown files / 2,641 local links; verifies exact contiguous RX accounting, immutable identity, generated-header syntax, 19,229-function / 1,539-symbol / 84,036-edge catalog agreement, 1,136 required artifacts / 183 Evidence IDs and all 235 entries in eighteen compatible ledgers. The HEN state-B successor/recovery, current live-readiness delta and final-preservation gates all pass from pinned manifests under isolated read-only execution. The old generated-header pin remains intact through exact manifest-bound supersessions; three archival logical-base mappings are explicit, and eleven incompatible historical ledger schemas remain inventoried rather than silently accepted. Full mutation-capable regeneration is intentionally NOT_RUN against epoch-sensitive external HEN/AP2 inputs, so C-1001-341 remains the last complete pre-Attempt-21 deterministic pipeline checkpoint. Evidence: WORKSPACE-VALIDATION-1001-002, HEN-PREFLIGHT-BUNDLE-INTEGRITY-SUPERSESSION-1001-001, HEN-PRESERVATION-EXACT-RECOVERY-AUDIT-1001-001, LIVE-READINESS-DELTA-AUDIT-1001-001, FINAL-PRESERVATION-VALIDATION-AUDIT-20261015-001; see current validation and supersession record.

Preservation status: the independent final audit is a PASS. The immutable whole/text/data images retain every required size and SHA-256; the canonical IDB remains exactly 462,112,027 bytes / da710953...8cfc and was not opened. The corrected capture manifest, all five regions, all 25 derived-ledger files, the contiguous 24 MiB/6,144-page mapped hypervisor run and all 16 ASID-1 VMCB extraction relationships revalidate. The carrier remains raw-only, and the uncaptured final 8 MiB remains qualified by the authoritative capture narrative rather than re-read. All five privacy-preserving repository records exactly match checkpoint 028; paths and diff bodies remain suppressed. Evidence: FINAL-PRESERVATION-AUDIT-1001-001, REPOSITORY-PRESERVATION-1001-028, IDA-DATABASE-RESTORATION-1001-002; see final preservation audit.

Newest focused results: Sony's NPXS40091 executable is now identified by exact strings as SceUpdatePupUtil; 31 driveauth-related functions independently reproduce ShellCore's typed PS4/PPR protocol, including exact selector thunks and the 0x8004 + 14/15 versus 0x8005 + 16/17 split. Separately, complete IDA/Hex-Rays and independent-decoder evidence proves that hypervisor command 0x0e closes only the current vCPU loop. Its direct reset/relaunch context leaves hv_main at hv+0x1085; the capture-exact initial init-list context is inferred to advance to last_loop at hv+0xe70. Both end in eb fe and perform none of the SVM, CR3, descriptor-table, interrupt, IOMMU, device, boot-parameter or Linux-entry transition. These results strengthen porting and narrow the Linux design, but establish neither fPKG acceptance nor a Linux handoff.

Previous focused pass: eight package/security ioctl handlers and eleven directly relevant KDF/AuthID/user-copy helpers are now complete and byte-locked across disposable IDA/Hex-Rays, Rizin, GNU objdump, and raw bytes. The handlers accept 60 commands: pfsmgr 13, manuauth 12, driveauth 15, pfsctldev 15, pltauth 4, and sbl_srv 1; authmgr and sbl_secreg are constant -3 rejectors. The pass corrects three pfsmgr comparison pivots plus one explicit hole, proves an unconditional privilege-683 gate around pfsctldev, a four-layer session gate around driveauth, a shell gate and exact 0x58..0x4000 bound around the variable pltauth path, and a two-AuthID/fixed-16-byte KDF contract using mailbox message 0x501. pfsmgr and pfsctldev are the strongest newly bounded fPKG-adjacent surfaces, but neither is a package bypass. Evidence: IDA-KERNEL-PACKAGE-IOCTL-1001-001, PACKAGE-IOCTL-SURFACE-1001-001, PACKAGE-IOCTL-COVERAGE-1001-001; see package-security-ioctl.md.

Previous focused pass: a whole-capture scan recovers exactly 147 unique Sony-extended, 0xc0-byte cdevsw records. Their 146 non-null ioctl routes resolve to 129 unique targets: 126 unique custom handlers plus generic default/Giant/dead cases. Thirty-seven complete dead/default/Giant/lifecycle bodies at ktext+0x6faa00..+0x6fbbee are byte-locked across disposable IDA/Hex-Rays, Rizin, GNU objdump, and raw bytes. Sony's active callback at cdevsw +0x78 shifts the standard FreeBSD-derived housekeeping tail by eight bytes; its semantic identity remains Unknown. Package-related driver classes include pfsmgr, authmgr, pfsctldev, npdrm, pltauth0/1, and SBL services; Linux-relevant classes include dmem, usb, usbdev, xpt, pass, a53io, gic, hdmi, and sdma. These are precise recovery seeds, not proof of a /dev path, permission, successful ioctl, fPKG bypass, or Linux compatibility. Evidence: IDA-KERNEL-CDEVSW-1001-001, CDEVSW-SURFACE-1001-001, CDEVSW-COVERAGE-1001-001; see devices-and-ioctl.md.

Previous focused pass: the NPDRM service boundary is joined to the exact retail ShellCore client. Module load constructs a UID-0/GID-0 mode-0600 device; ShellCore lazily opens literal /dev/npdrm with O_RDWR, and 24 direct wrappers cover exactly all 19 kernel-handled commands. Special command 0xc0344e18, the only command available to AuthID ...000f, is resolved as a four-operation debug clock used by patch-applicability callers: the getter has 27 direct xrefs across installer/promoter/process-start owners, while set/clear synchronizes a kernel delta, platform clock and secure request 10. Exact year-1/2012 arithmetic supports an SceRtcTick-like ABI; the boolean wrapper is a high-confidence sceSblNpDrmCheckDebugClock match. Adjacent 0xc00c4e0f has four callers and is tied directly to an exact sceSblNpDrmGetInitStatus caller string plus act.dat/VTRM-read-error context. This is a useful fPKG policy boundary, not a license/signature/entitlement bypass. Evidence: NPDRM-DEVICE-BOUNDARY-1001-001, SHELLCORE-NPDRM-CLIENT-1001-001, IDA-SHELLCORE-NPDRM-STATUS-CALLERS-1001-001, NPDRM-CLOCK-CONTROL-1001-001; see package-self-and-fpkg.md.

Earlier focused pass: regmgr_call at ktext+0xaec490 is mapped across all 69 commands, exact policy/length masks, seven nested-descriptor families, 85 protected retail-10.01 libSceRegMgr exports and 82 direct wrappers. Command 47 sceRegMgrLogPull is admitted after privilege-682 failure and uses an uncapped caller length for a nonblocking zeroed allocation, explicit clear, copyout and immediate free. This is an allocation/CPU-pressure hypothesis with runtime reachability and consequence Unknown—not an overflow or fPKG/Linux primitive. Seventeen registry functions plus three table/branch anchors are persisted idempotently in symbols.csv without changing text coverage. Evidence: REGMGR-1001-001; see registry-manager.md.

Immutable artifact identity

Property	Verified value
Firmware	10.01
Architecture	x86-64, little-endian
Total size	0x03cc0000 / 63,700,992 bytes
Whole SHA-256	e4af8fa6e46e152797a9633071d5bf96a19a97c66252d5703381732f91fa9a1f
Text/rodata size	0x00cc0000
Text/rodata SHA-256	e694ea39aa8cbd2267949cb529823cfbc1c91811a6fade74b406d6125652b6f3
Live-data size	0x03000000
Live-data SHA-256	ac70c8bb110e34c3967b00502a18936b3940cddc8385e9208ecfb4c92f5fccbb
FNV-1a64	0xbaa9299ba3e3e2a2
Identity result	PASS

Evidence: ARTIFACT-IDENTITY-1001-001, artifact-identity.json. No analysis is valid if this gate changes.

Captured address map

File range	Captured virtual range	Initial IDA permissions	Role
0x0000000..0x0cc0000	0xffffffffdbb50000..0xffffffffdc810000	RX	Mixed kernel code, rodata, tables, strings, alignment and padding
0x0cc0000..0x3cc0000	0xffffffffdc810000..0xffffffffdf810000	RW-NX	Captured live kernel data

Stable results are written as ktext+offset; captured virtual addresses belong only to this KASLR boot. See kernel-layout.md.

The corrected post-resume companion capture is deliberately separate from this immutable baseline. Its kernel text has the same SHA-256, but a different KASLR base; its authoritative hypervisor evidence covers only mapped PA 0x62800000..0x64000000. The reserved tail 0x64000000..0x64800000 was unmapped and was not read. The AP carrier was repurposed before capture, so +0xf00..+0xf30 is never decoded as retained Byepervisor parameters. See hypervisor-runtime.md.

Current quantitative coverage

The current conservative accounting covers exactly 0x00cc0000 bytes and is mutually exclusive:

Class	Bytes	Percent
Confirmed function/structural-thunk code bytes	152,830	1.143138%
Probable IDA function bytes	8,327,946	62.291358%
Confirmed rodata/table bytes	72	0.000539%
Padding/trap/cave candidates	1,857,465	13.893464%
Unresolved	3,031,031	22.671501%
Conflicting analysis	0	0.000000%

These numbers do not mean that 62.5% of the image has semantic names. “Probable” means only an IDA-recognized function range after recursive seeding. Confirmed structural-thunk code means the five-byte branch instruction in an exact CFI slot, not a claimed source-level function. Trap/NOP bytes are not qualified caves. See text-coverage.md, functions.csv, and unresolved-ranges.csv.

Highest-value results so far

• Observed/inferred: process targeting now has a lock/reference contract rather than a naked allproc offset. Complete pfind +0x5612c0, pget +0x5613b0, vmspace_acquire_ref +0x3121c0 and vmspace_free +0x311f80 bodies validate the global topology and release obligations. Process lifetime report.
• Observed/inferred: rootvnode +0x3c63510 is validated by 31 exact xrefs through sandbox, chroot and mount-directory maintenance; filedesc cdir/rdir/jdir and locking are bounded. The adjacent VFS global remains Unknown and mutable pointer values are suppressed. Rootvnode xrefs.
• Observed: the promoted HEN comparison passes 106 static anchors at its pinned source epoch; a later hash-bound point-in-time audit passes 108. Both report all six feature groups ready=0 with the same readiness counts and missing gates. ps5-hen is the selected fail-closed contract, kstuff-lite the PS4 fPKG/fSELF implementation reference, and ppr-patch a narrower native PPR selector experiment. Implementation comparison.
• Observed/corrected: all eleven active HEN mailbox_lr_* values are exact E8 callsite addresses, while the corresponding implementation consumes the architectural return at CALL+5. The checker already decodes each call correctly; a future runtime adapter must keep callsite and return roles separate. Native PPR's eight trap/resume rows are likewise typed rather than flattened into “LR” offsets. Evidence: MAILBOX-ADDRESS-ROLES-1001-001; mailbox role ledger.
• Observed/corrected: native-PPR FE/FF are algorithm indices, not outer/inner markers. The typed chain is disk marker PPRPLAIN-NOAUTH! → private FD/FC XTS/CMAC handles → transient full-width FF/FE indices → A53 post-match 7FF/7FE; outer/inner topology remains separately 0x02/0x82. Raw FW10.01 closes the static producer join and failure teardown. The next pass proves atomic outer/inner mount-result publication and preservation through FS, ShellCore and kernel cleanup, then keeps native PPR and PS4 standard-PFS routes distinct until their later shared SELF-loader boundary. Same-thread/LR behavior remains source-backed inference; the exact mount-object→native-exec join and live AuthMgr/SELF/first-instruction result remain absent. Evidence: PPR-FEFF-VISIBILITY-1001-001, PPR-PAIR-LIFECYCLE-1001-001, PPR-PRODUCER-JOIN-1001-001, PPR-MOUNT-AUTH-BOUNDARY-1001-001; producer join, mount/auth boundary.
• Observed/inferred: focused pmap/XOTEXT work establishes bootstrap/direct-map/recursive-map setup, PAT restore, local and all-core invalidation, the CPU execute-only writer policy, the distinct IOMMU writer, and invariant/cache consumers. pmap_protect +0x8e5510 is the existing-mapping permission owner; +0x8e9d80 is not. The whole fixed-image direct-caller census and subsequent exact-entry reference pass find no kernel-text RW→RX authorization owner in their covered encodings. Any remaining route is indirect/module/runtime; context-safe invocation, instruction visibility, rollback and live hypervisor acceptance remain unproved. Evidence: PMAP-CORE-1001-001, PMAP-SHOOTDOWN-1001-001, XOTEXT-NX-1001-001, KERNEL-TEXT-PROTECT-CALLERS-1001-001, HEN-TEXT-OWNER-REFERENCES-1001-20261019-001; reference census, direct callers, protocol.
• Observed/Hypothesis: the fixed JIT f_mmap route applies process/class/descriptor protection policy, then appears to clear its visible return value before testing a mapping-core error. This is a static anomaly pending a bounded owned-failure test, not an exploit claim. The same pass corrects mmap_dmem, batch_map and virtual_query_all semantics. Evidence: VM-JIT-DMEM-1001-001; contract ledger.
• Observed: the companion capture contains a complete 641,184-byte hypervisor ELF with symtab, DWARF5, 52 compilation units, and exact type layouts. All 264 relative relocations are explained by one captured runtime base; a separate IDA database preserves the kernel database unchanged.
• Observed: hypercall 0x0f is directly named STARTUP_MP. The kernel wrapper passes (RDX=core, RCX=entry, RBX=CR3); the symbolized khv_startup_mp reads precisely those typed guest-register fields, stores the entry/CR3 in 16-element arrays, and issues an APIC INIT-style command. The previous register ambiguity is resolved from both sides.
• Observed: the hypervisor's software-reset path writes the selected CR3 and RIP to typed VMCB fields and supplies the core id in guest RDI before the kernel trampoline. Hypercall 0x10, DISABLE_STARTUP_MP, closes the startup bitmap by writing 0xffffffff.
• Observed: exactly 16 structural ASID-1 VMCBs were found. NESTED_CTRL=0x8 has nested paging disabled in all 16, and VMCB +0x100 is compiler-typed RESERVED0x100[8], independently rejecting the stale carrier-parameter interpretation.
• Observed: pcpus[16] and two vcore_t objects per core now explain every ASID-1 VMCB plus a second 16-record ASID-2 secondary/IVM set. The primary set has NPT disabled; the secondary set has NPT enabled and shares one nested root.
• Observed: a unique captured root at PA 0x628d7000 maps the runtime text, relocated BSS and direct-mapped pcpu_t run. Sixteen host VMSAVE records contain this CR3 and saved RIP at hv_world_switch's post-VMRUN vmsave, providing captured execution-state corroboration.
• Observed: all 25 hypervisor text pages are byte-identical to the ELF, read-only, executable, and compiler-typed XO (PTE bit 58). Every non-text ELF page is NX and non-XO.
• Observed: the BIOS, GameOS, and active IVM nested page tables are fully walked: 46 table pages, 17,449 identity leaves, and 259 compressed permission runs. GameOS kernel text is R/O executable/XO, its following RO range is NX, and its complete 0x62800000..0x64800000 hypervisor reserve is unmapped.
• Observed: typed PSP shared memory contains nine active TMRs. TMR 7 exactly covers kernel text, TMR 33 the captured 24 MiB hypervisor run, and TMR 11 the uncaptured 8 MiB tail.
• Observed/inferred: TMR 24 exactly equals the 4 MiB boot IOMMU allocation and contains the command buffer, 65,536-entry DTE table, sixteen GCR3 tables, and both host DMA trees. The hv_iommu_softc object is separately located in TMR 33, outside TMR 24.
• Observed: exactly 13 DTEs are translation-valid. AMD Ariel ZCN/MP4 at BDF 20:00.3 alone uses a special host DMA root; the remaining twelve use the default root. Both roots are fully walked and reproduce different TMR-correlated protection holes.
• Observed/inferred: hypercalls 0x06..0x0c are now audited through exact handler bytes, typed state and live structures. Six privileged candidates cover alignment mismatches, device scope, PASID replacement, a disabled-gate crash/event path and possible cross-VM singleton access; none is an exploitability claim.
• Observed/inferred: hypercalls 0x14/0x15 now have exact register schemas and mutation order. The bounded review found an unaligned-input path into hv_abort, an IOMMU error overwritten by the common return path, asymmetric no-rollback updates, and address-zero/quiescence/null-object candidates. These are privileged static audit findings, not exploitability claims.
• Observed: hypercall 0x0e, VMCLOSURE_INVOCATION, is not a message parser or Linux handoff in this build. Complete IDA/Hex-Rays and two independent decoders show that its six-instruction case consumes no guest argument GPRs, writes guest RAX=0, returns internal status 2, leaves the current virtualmachine_loop, and terminates the corresponding hv_main path at exact busy loop eb fe. pcpu_t.cur_vm is cleared before dispatch. The executed path has no all-core barrier, continuation or architectural/device transition; privileged reachability, external coordination and recovery remain Unknown.
• Observed/inferred: kernel NMI IPIs now have an end-to-end path. Captured apic_ops.ipi_raw at ktext+0x1ab4d00 points through CFI thunk +0x2a9c70 to a high-confidence APIC body at +0x59ba00; only delivery mode 0x400 calls the 18-byte hypercall-0x13 wrapper at +0xc12da0. DWARF-named send_ipi_nmi_internal marks the target vcore pending, sends a physical xAPIC NMI, and the target loop injects VMCB EVENTINJ=0x80000200 before clearing the primary pending byte. All 32 captured vcores had zero NMI state in this snapshot.
• Observed/Hypothesis: the complete hypervisor text has two literal primary pcpu+0x19c pending consumers and no literal or raw disp32 encoding for secondary pcpu+0x2ac. This creates a high-priority secondary-lifecycle question, not proof that ASID-2 can reach the command. Duplicate pending requests also retry without timeout, and the APIC-disabled failure path returns -22 after setting pending without local rollback; both are privileged availability candidates, not exploit claims.
• Observed: CPUID presentation is now reconstructed across the kernel/hypervisor boundary. Kernel modes 0/1/2 select PS5/PS4/native behavior through wrappers at ktext+0xc12840, +0xc12830, and +0xc12850, update per-CPU GS:0x878, and write a mode-dependent logical CPU id to MSR_TSC_AUX. The hypervisor uses mode 1/2 to select exact 40-record PS4/PS5 CPUID maps, then applies leaf-1 and leaf-0x8000001e topology hooks.
• Observed/Hypothesis: all 16 captured primary vcores have the GameOS hook table, while all 16 secondary vcores have cpuid_hooks=NULL; every captured CPUID intercept is clear and every mode is zero. Because the common VMMCALL gate structurally admits ASID 2 and the CPUID emulator dereferences the hook list without a null guard, SET-then-CPUID on a reachable secondary vcore is a P1 privileged availability candidate for emulation, not an exploitability claim.
• Observed: nine PMU-related hypercalls and seven native/PS4 OPMC syscalls are reconstructed end to end. The name-table entry SET_HOST_PERFCTL (0x18) actually reaches a fatal unknown/default path, while opmc_set_hw/get_hw lack the local credential-helper calls used by the five neighboring OPMC syscalls. Both are policy/porting findings, not reachability or exploit claims. See performance-monitoring.md.
• Observed: native rendezvous is recovered at ktext+0xaff860, with CPU-mask body +0xaff630, action +0xaff480, IPI vector 0xf6, and captured mp_maxid/mp_ncpus/all_cpus = 15/16/0xffff. A 2,186-slot CFI bank and stock TSC setup/action/teardown callbacks support a returning 16-CPU witness; no hardware result proves it ran. See smp-rendezvous.md.
• Observed/corrected: the SMP bank is one subrange of a complete RX CFI slot region at ktext+0x2a9a10..+0x2be7b0. All 10,676 eight-byte slots match exactly one of three templates: 10,060 E9 rel32; INT3×3 thunks, 405 UD2; NOP×6 traps, and 211 NOP-only alignment slots. GNU objdump validates every slot start; rizin validates every unique jump target against raw bytes with zero invalid decodes. Only 1,188 targets are baseline IDA function starts; the current cumulative catalog adds 139 non-baseline starts, leaving 8,733 targets with no function row. The 211 NOP slots are each structurally tied to the CFI grammar and are not cave candidates. Evidence: KERNEL-CFI-BANK-1001-001, CFI-TARGET-OWNERSHIP-1001-001, CATALOG-PROMOTION-IPV6-SECURE-1001-001.
• Observed: the ownership follow-up partitions all 10,060 destinations into 1,188 baseline starts, six accepted interiors, 1,872 rejected-fill interiors, and 6,994 targets outside every IDA chunk. A whole-capture aligned scan finds 15,875 RW-NX pointers to 7,266 thunks, 1,103 strict runs and 251 constant-stride series. The first-ranked lead is an ACM-tagged, two-object callback family with two 1,024-record arrays and encoded dispatcher ktext+0x3eddd0; it is not an fPKG path. Evidence: CFI-TARGET-OWNERSHIP-1001-001, ACM-CFI-DISPATCH-1001-001.
• Observed negative: IDA records 1,293 switch dispatches, but every jump table lies in captured RW-NX data, not RX. The syscall/name/IDT/TSS tables previously queued for “RX table promotion” are also outside the RX accounting range. Confirmed RX table/rodata coverage therefore remains zero for an evidence-backed reason rather than a missing arithmetic step.
• Observed: PS5-native PPR PFS and standard/PS4-compatible PFS each contain a signed-mode test that warns and then continues to the same object callback. The two exact sites are ktext+0x4a6298 and ktext+0xa24f57; they are strong structural anchors, not proof of unsigned package acceptance.
• Observed: exact 10.01 implementation correlation recovers PPR key-index bodies at ktext+0xb8b7e0/+0xb8b940, their return sites +0x3b8979/+0x3b89c4, cleanup at +0x3b0650, image-verification anchors +0x2d3eb0/+0x2d420b, key installation +0x2d4790, and async crypt +0x335a70. The common target at +0x5c74f0 has 185 IDA incoming xrefs and is a generic SBL secure-service mailbox transport, correcting the earlier NPDRM-specific label.
• Observed/inferred: the complete captured allocator registry has 459 active M_MAGIC types and exactly matching list/count/generation invariants. Its live descriptions independently separate twelve standard pfs_* domains from seven ps5_pfs_* domains and include pfsmgr, ps5_pfs_naps, pfs_vncache, pfs_sbl, and npdrm_cdev. Twenty-seven additional callback-shaped records are zeroed/dormant, including six devpfs_* names that must not be treated as an enabled developer-package route. Exact loops also prove a 128-entry private statistics ABI despite the generic SDK's MAXCPU=256. Evidence: IDA-KERNEL-MALLOC-1001-001, MALLOC-TYPES-1001-001; see malloc-and-uma.md.
• Observed/corrected: the complete PPR and standard-PFS vop_vector objects begin at ktext+0x1aa0ce0 and +0x2441300 and contain 74 slots / 0x250 bytes, not 66 slots / 0x210. All 66 ordinary vop_* descriptors at +0x1ab5bb8..+0x1abfec8 have generated dispatchers that independently encode their true field offsets, eliminating the earlier unsafe descriptor-order assumption. There are 29 paired operation bodies; PPR alone explicitly populates full slot 70 (vop_gather) with a ten-byte forwarder at +0x4a95b0. Full slot 17 reaches the respective ioctls. Eight special field names remain high-confidence structural inferences.
• Observed: the PPFS predispatcher at ktext+0x3adf50 handles exactly ten group-0xbd commands. Three nearby command-looking constants are range pivots only and return unhandled. Together with eight PPR-generic and eight standard-PFS commands, pfs-ioctl-commands.csv preserves the exact surface without inflating it from comparison immediates.
• Observed/inferred, security impact Unknown: standard PFS command 0x80209168 calls the thread privilege wrapper with privilege 0x2ab at ktext+0xa24b4b; the parallel PPR branch at +0x4a5fe6 does not. Stock mount creation and vnode acquisition are gated, but descriptor receipt is no longer wholly unresolved: the vnode fileops table at +0x20d0120 has fo_flags=3 (DFLAG_PASSABLE|DFLAG_SEEKABLE under the locked local ABI); AF_LOCAL SCM_RIGHTS send code at +0x98ef00 enforces that passable bit; and unp_externalize at +0x98d260 reserves and installs the same file reference in the receiver without a direct vaccess or Sony privilege call. vn_ioctl later forwards the receiver's active credential, and 0x80209168 follows its default VOP path rather than either special 0x2ab-gated command. This establishes a real capability-delegation and potential broker/confused-deputy boundary, not evidence that AppInst/ShellCore sends such a descriptor, that an unprivileged peer can reach a broker, or that any package/cache operation succeeds. Native and PS4-compatible syscall tables share the sendmsg/recvmsg plumbing, but that does not make their package trust policy identical. The remaining fixed-kernel duplication routes are now closed as unrestricted alternatives: every duplicate-producing fcntl branch is outside its failed-0x2ab allow-list, and Sony rdup(603) returns a failed 0x2ab gate before pid/fd lookup. Privileged rdup remains useful to payload/HEN/debug tooling. PPR and standard PFS each have captured empty, on-demand compressed-offset pools capped at 37.5 MiB and full-ICV pools capped at 131,071,232 bytes; reviewed allocator failures roll back and normal reclaim clears both owner types. Evidence: PFS-AUTHORIZATION-1001-001, IDA-KERNEL-PFS-DESCRIPTOR-1001-001, PFS-DESCRIPTOR-TRANSFER-1001-001, IDA-KERNEL-FD-DUPLICATION-1001-001, and FD-DUPLICATION-POLICY-1001-001.
• Observed/inferred: both PFS ioctl paths constrain their object-+0x880 indirect callback to six contiguous CFI thunks at ktext+0x2ab3b0; the exact standard/PPR/PPFS block-number translation bodies total 12,517 bytes. Mount-time construction is now mapped: standard PFS selects only slots 0/3 from ktext+0xe76c00, while accepted PPR/PPFS/NAPS paths select only slots 1/2/4/5 through +0x18ab928 and helper +0xa3eb20. All 59 recovered vector-reachable operation bodies contain twelve direct field reads and no direct writes; the seven recovered direct writers are confined to mount/setup. Computed/aliased or omitted-helper writes, live selector state and abnormal teardown remain Unknown.
• Observed/inferred: 147 unique fixed-image Sony-extended cdevsw records expose 126 unique custom ioctl targets. The standard local 0xb8-byte FreeBSD-derived structure is extended to 0xc0 by an active callback at +0x78; 37 complete dead/default/Giant/lifecycle bodies are now reviewed. pfsmgr, authmgr, pfsctldev, NPDRM and SBL classes provide focused package/security leads; dmem, usb, usbdev, storage pass-through, A53IO, GIC, HDMI and SDMA classes provide Linux ownership leads. Driver-class names and captured D_INIT state do not establish node paths, permissions, command reachability, or safe hardware handoff. See devices-and-ioctl.md.
• Observed/corrected: the package/security follow-up completely bounds eight dispatchers plus eleven first-layer helpers (12,051 bytes / 2,595 instructions) and twelve pfsmgr delegated functions (5,639 bytes / 1,278 instructions), all with exact IDA, Rizin, GNU objdump and raw-byte agreement. Six active handlers accept 60 commands, while authmgr and sbl_secreg are constant rejectors. pfsmgr accepts 13—not the provisional 16 comparison-derived values—and its four dispatcher-local predicate omissions are all shell-gated in the delegates. Three commands form a ten-slot XTS/sign service; the fourth is save-data auth-code maintenance. pfsctldev checks privilege 683 before all 15 commands; driveauth combines cdev-private, credential, session and mode gates; pltauth bounds its variable copy to 0x58..0x4000; SBL KDF admits exactly two AuthIDs for fixed 16-byte message 0x501. These are trust-boundary mechanics, not fPKG acceptance or exploitability. See package-security-ioctl.md.
• Observed/inferred: the complete 332-file retail corpus supplies 79 independently decoded executable carriers for those accepted commands and three explicitly rejected raw coincidences. ShellCore alone owns 41 sites / 28 unique commands, including every accepted pfsmgr and pltauth value; 18 exact FDE-backed functions were recovered only in disposable database copies. PS4 and native-PPR disc registration use byte-exact selector thunks at module +0x165e1d0/+0x165ead0, then share the same core and guarded kernel command 0xc0285301. The distinction is a userland selector (0x8004 versus 0x8005), not a separate kernel opcode or bypass. See package-userland-clients.md.
• Observed/inferred: the npdrm module creates a UID-0/GID-0 mode-0600 device and its cdevsw resolves ioctl to ktext+0x971840. Exact retail ShellCore lazily opens literal /dev/npdrm O_RDWR; 24 direct wrappers cover exactly all 19 kernel-handled commands. The ioctl admits AuthID 0x4800000000000010 to the general set, AuthID ...000f only to 0xc0344e18, and rejects other credentials. The special command is now resolved as four debug-tick operations used by ShellCore patch-applicability paths: 27 direct getter xrefs span installer/promoter/process-start owners, while set/clear synchronizes a kernel delta, platform clock and secure request 10. This is not evidence of a license or fPKG bypass. General entitlement work remains separately tied to secure module 80021006, request IDs 1..11 and /user/license/act.dat; the clock base uses module 8002100D. See package-self-and-fpkg.md.
• Observed: the exact local retail-10.01 SceShellCore.elf has SHA-256 d8f7d7360fed8e348d7f65e583b5f3e1a0b14689ca828d04d9d031b65d21dd49; all eleven proposed installer windows match at valid boundaries. Ten edits preserve their encoded branch target while forcing the non-error path, and the shared edit changes original prologue 55 48 89 e5 to xor rax,rax; ret. Three additional PS4 launch-policy sites at module +0x607d2a/+0x607f92/+0x608259 are exact JNE→JMP edits: the first two affect only category 0x1f100, while the workspace site affects the broader 0x0001xxxx family reaching that block and leaves earlier workspace rejections intact. Twenty-five clean local 9.00–13.60 tables preserve the ordered trio, giving a useful relationship anchor, but only 10.01 bytes are validated here. Distinct legacy and PPR mount imports corroborate separate PS4-compatible/PS5-native tracks. Two late source labels conflict with the version API used by their owner functions; the reviewed older installer patch loop lacks pre-write original-byte comparison, so shellcore-all-kstuff-patch-windows.csv records exact rollback/identity windows for all 34 writes. These are static porting/hardening findings; the later runtime evidence does not prove that this exact module identity or all fourteen policy writes were active. Evidence: SHELLCORE-IDA-INPUT-1001-001, IDA-SHELLCORE-FPKG-1001-001, SHELLCORE-FPKG-1001-001, IDA-SHELLCORE-LAUNCH-POLICY-1001-001, SHELLCORE-LAUNCH-POLICY-1001-001.
• Observed: ShellCore's native PPR wrapper at module +0x759f10..+0x75a5d5 and all six immediate direct callers are now bounded. The wrapper maps content types to eight recovered image-type cases, rejects non-nested input with 0x80a40056, obtains NPDRM fixed information, appends /pfs_image.dat, and calls the exact mount_ppr import. Three caller-side policy families remain distinct: two post-mount state-byte gates log “PPR Patch Installation is not yet supported,” while the decision route separately rejects finalized packages (0x80a40038), a /sce_sys/keystone fingerprint mismatch (0x80a40041), or an unresolved patch-state predicate. Evidence: IDA-SHELLCORE-MOUNT-ROUTES-1001-001, SHELLCORE-MOUNT-ROUTES-1001-001, IDA-SHELLCORE-PPR-CALLERS-1001-001, SHELLCORE-PPR-CALLERS-1001-001.
• Observed across independent local repositories and the exact original A53 image: the PS5 builder writes PPRPLAIN-NOAUTH! at outer-superblock +0x370 and container +0x4a0; the ShellCore wrapper and kernel revalidate it under a one-shot same-thread CHECK/ARM scope; the kernel maps accepted private handles to 0xff/0xfe; and A53 profile 48 selects plaintext/no-auth only when both full-width values match, relabeling them 0x7ff/0x7fe. The A53 layer does not parse the marker. All fifteen declared stock/guard sites, branch destinations and the complete ten-xref helper set match the retail FW10.01 ELF. Live selector activation remains Unknown. Evidence: PPR-PATCH-1001-001, PPR-PATCH-ORIGINAL-IMAGE-1001-001, FPKG-END-TO-END-1001-001.
• Observed/inferred with a strict boundary: a hash-locked, fail-closed sanitized extraction of a pre-existing FW 0x10010000 log records initial STOCK/NATIVE state, dynamic Native/PLAINTEXT_NOAUTH install/readback, and two later big-app sequences that each reach PPR preparation, two successful PPR mount messages, PrepareProcessLaunchDir return, sandbox type 2, spawnApp, LNC update, and later unmount. This proves PPR-backed process launch was operational after patching in that session. It does not bind a package or deployment revision, show disk-marker validation, FD/FC publication, both FF/FE getter results or the A53 branch, prove verifyImage emulation/SELF authorization, or establish application functionality; it must not be reported as full PS5 fPKG success. Evidence: RUNTIME-FPKG-PPR-1001-001, FPKG-END-TO-END-1001-001, PPR-FEFF-VISIBILITY-1001-001; see package-self-and-fpkg.md.
• Observed local tooling boundary: seven .pkg paths were classified by magic. Six are PS5 FIH console packages (five unique hashes), zero are PS4/legacy CNT packages, and one FIH has the exact plaintext marker in both required slots. The local reader/installer handles PS4 and PS5 classes, but the qualified writer emits PS5 FIH; recognizing PS4 SELF input is not PS4 package output. No checked-out PS4 writer was found in the explicit bounded survey. Evidence: FPKG-LOCAL-TOOLING-1001-001, fpkg-local-tooling.csv, fpkg-local-package-samples.csv.
• Observed negative: the local 10.01 pLinux integration is disarmed by default, skips Linux image staging, and returns after diagnostics. Its 182-byte SMP and 28-byte HV-entry probe blobs rebuild byte-identically and host validators pass; neither has a preserved console result. The optional stage invokes hypercall 0x17 (NOP) per CPU through a transient CFI thunk and a bounded ktext+0xcb8000 diagnostic cave, then restores and quiesces. This is not Linux takeover or general cave ownership. See linux-viability.md.
• Observed host-only: a later frozen Linux memory module passes its normal tests, imports all nine captured TMR ranges exactly as an exclusion floor, and parses a real Fedora boot-protocol-0x020f bzImage. That kernel requires workspace 0x100000..0x5af8000, proving that compressed payload size alone is insufficient. The module has no runtime caller or memory-write path. Adversarial tests also show optional forbidden ranges, missing schema/cardinality enforcement, and an uncapped lookup count; these must be fixed before integration and are not current console vulnerabilities. Evidence: LOCAL-LINUX-MEMORY-LAYOUT-1001-001.
• Observed/inferred: kernel PA getter ktext+0x6f4410, resource builder +0xaa30f0, Titania operation vectors, captured descriptor and hypervisor page-table walk converge on UART PA 0xc1010100; the descriptor supplies 230400/8-N-1-like geometry and local EDM-010 research supplies a board-limited passive route. The bounded one-store contract is stronger than the stock unbounded writers, but current clock/pinmux, writer quiescence, visible output and cross-hardware stability remain unproven. Evidence: IDA-KERNEL-LINUX-UART-1001-001, LINUX-UART-1001-001, LINUX-UART-LIVE-GATE-1001-001.
• Observed/inferred: Sony xHCI PCI ID 104d:9108, its method table, probe/attach/detach, attach-sub, firmware-ownership handoff, PHY initialization, Aeolia ACPI glue, and ten CFI-backed DMAC functions are now bounded. A static PCI-record/DTE join makes 40:00.6 the best current-boot xHCI BDF candidate, not a direct PCI-config observation. DMAC allocates IRQ/DMA resources and a 64-KiB descriptor region, so xHCI/DMAC/IOMMU quiescence is a required Linux handoff gate. Twenty exact function starts plus 183 bytes of inter-function NOP padding reduce unresolved RX by 9,047 bytes. Evidence: IDA-KERNEL-AEOLIA-XHCI-1001-001, AEOLIA-XHCI-1001-001; see usb-xhci-and-aeolia.md.
• Observed: the complete immutable RX range contains exactly 30 instruction-boundary VMMCALL sites, all in ktext+0xc12830..+0xc1300f. They statically select 21 named commands and none selects 0x0e. The complete corrected 24 MiB capture has only two additional VMMCALL opcodes, both in the active 8 KiB IVM execute window with static RAX values 0 and 0xffffffff; neither is assigned an ABI meaning or claimed to have executed.
• Observed: the supplied ktext+0x3d1630 “acpi_sleep_machdep hook” seed is too specific and is behaviorally wrong as a function identity. The reviewed sleep entry is ktext+0x3d1180; +0x3d1630 is the AP wake loop. See hve-s3-resume.md.
• Observed: ktext+0xc12d30 is the complete hypercall-0x0f wrapper, not its call site. The S3 call is ktext+0x3d1a88, after the stock AP RIP is selected at +0x3d1a7e.
• Observed: the wrapper maps C ABI (RDI=core, RSI=entry, RDX=cr3) to hypercall registers (RDX=core, RCX=entry, RBX=cr3), with RAX=0x0f.
• Observed/inferred: native and PS4 sysent tables, three sysentvec records, both syscall-name arrays, all 1,411 entries, and 460 unique handler targets are recovered without assuming their supplied offsets. See sysent-entries.csv.
• Observed: syscall index 531 is rejection-backed in both tables, while index 532 is Sony regmgr_call; this differs from the local FreeBSD numbering and matters to the HVE armer.
• Observed: all 69 regmgr_call commands, switch targets and immediate policy/length classes are exported. The exact 10.01 module maps every command through 82 direct syscall calls; regmgr-policy-matrix.csv and registry-manager.md preserve the result.
• Observed: the supplied or [rcx],eax; ret bytes at ktext+0x125095f lie in RW-NX live data and are rejected as a stable executable gadget.
• Observed: no exact aligned pop r8; ret exists in the RX range. A newly recovered aligned tail at ktext+0x4b0dad is exactly mov [rcx],r8; ret, but remains a non-hardware-qualified candidate and has not replaced any project offset. See gadgets-10.01.json.
• Observed: the nominal ktext+0x2df3000 data cave is captured RW-NX and live-modified/staged; it is not evidence of a pristine reusable cave.

Workspace map

• START_HERE.md: short navigation guide, artifact identity boundaries, and route from question to evidence.
• AGENTS.md: concise artifact, evidence, and target-work rules for AI-assisted research.
• research-index.md: searchable entry point organized around fPKG/fSELF, PS5-HEN, Linux/HVE and general kernel research.
• executive-summary.md: practical implications and priority conclusions.
• ps5-hen-porting.md: current 10.01 HEN integration anchors, unsafe assumptions, missing privilege/pmap work and staged porting sequence.
• unresolved-questions.md: ranked questions, required evidence and safest next validation step for each major project track.
• kernel-layout.md: raw mapping, snapshot limits, compiler/linker idioms, and derived maps.
• text-coverage.md: exact coverage accounting and unresolved policy.
• hve-s3-resume.md: reviewed S3, AP startup, context restore, IDT/debug-register, CR3, and hypercall chain.
• hypervisor-runtime.md: corrected runtime capture, embedded hypervisor ELF/DWARF, VMCBs, host/NPT/IOMMU mappings, PSP/TMR state, audited IOMMU/TMR/VM-closure/NMI hypercalls, complete kernel VMMCALL-site inventory, and cross-layer AP reset/NMI delivery.
• subsystems/cpu-identity-and-cpuid.md: kernel mode selection, TSC_AUX, hypervisor CPUID maps/hooks, captured per-vcore state, and bounded CPUID audit.
• subsystems/performance-monitoring.md: OPMC syscalls, PMU hypercalls, suspend/resume state, captured per-core state, and bounded policy/robustness candidates.
• subsystems/smp-rendezvous.md: native rendezvous bodies, IPI/IDT chain, CFI bank, 16-CPU globals and returning TSC witness.
• subsystems/control-flow-integrity.md: complete RX CFI slot grammar, target ownership/pointer census, ACM callback lead, coverage policy, porting signatures, and cave-safety implications.
• subsystems/malloc-and-uma.md: complete captured malloc-type registry, lifecycle/statistics functions, private ABI, fPKG/PFS allocation domains and dormant-record caveats.
• subsystems/package-self-and-fpkg.md: PS4 loose fake-SELF versus full-package distinction; PS4/PS5 route comparison; exact retail-10.01 ShellCore installer, mount, image-type and caller-policy gates; PlayGo factory/request/actor orchestration; disc/HDD RIF/EEKc/EICV policy; PS5 builder marker→kernel handle→A53 selector contract; sanitized PPR runtime correlation; PFS authorization/capability/cache/callback surfaces; NPDRM, AuthMgr, entitlement and exec trust chain.
• subsystems/package-module-lifecycle.md: complete package/security module handlers, corrected PPR vfsconf/vfsops, native-versus-PS4 SELF activators, suspend/resume callback ownership, bounded lifecycle audit leads, and A53IO/Linux ownership limits.
• subsystems/package-userland-clients.md: complete retail command-carrier census, ShellCore FDE/owner recovery, exact pfsmgr/pltauth callers, PS4-versus-PPR driveauth discriminator/lifecycle, PlayGo-to-mount factory bridge, and the pre-mount RIF/EEKc mismatch path.
• subsystems/driveauth-protocol.md: typed 0x28-byte nested request, exact PS4/PPR opcode flows, retained-state behavior, secure-wrapper family, and exclusive open/suspend/destructor/resume state machine.
• subsystems/registry-manager.md: complete syscall-532 ABI, 69-command policy matrix, exact userland wrappers/NIDs, cross-firmware export boundaries, nested parser checks and bounded pressure candidates.
• subsystems/vfs-filesystems-and-storage.md: the complete 74-field PPR/standard-PFS vnode-operation map, all 66 descriptor-backed field offsets, exact mount/descriptor/ioctl policy chain, vnode fileops and receive-side descriptor installation, alternate descriptor-duplication routes, cache pools and reclaim paths, six-member block-map callback selector family, registration/mount anchors, broader filesystem audit surface, and storage-controller boundaries.
• subsystems/linux-viability.md: exact 10.01 integration boundary, returning witnesses, host-only image/memory planning, recovered Titania UART, Sony xHCI/Aeolia/DMAC contracts, fixed-kernel teardown asymmetries, staged boot feasibility and blockers.
• subsystems/titania-and-update-boundaries.md: Titania UART/PCI/FCRAM and NAND-image leads, with PUP header service and key provenance kept as separate questions.
• subsystems/usb-xhci-and-aeolia.md: Sony 104d:9108 xHCI methods, inferred 40:00.6 join, Aeolia glue, exact xHCI detach versus S3 routing, DMAC no-detach/no-op-suspend behavior, PCI-IOMMU lifecycle boundaries, quiescence requirements, and porting signatures.
• security-review.md: bounded static attack-surface review and ranked validation queue.
• interesting-findings.md: unusual discoveries and corrected seeds.
• evidence-ledger.md: claim-to-evidence index and confidence/limitation record.
• functions.csv, symbols.csv, strings-xrefs.csv: machine-readable exports. The string-xref table contains 17,703 direct code-referenced strings; all lie in captured RW-NX data, so contents are hash-preserved and redacted.
• callgraph.graphml, call-edges.csv: call graph.
• gadgets-10.01.json, offsets-10.01.h: generated, review-required payload-development proposals.
• subsystems/: focused subsystem reports; these are being expanded iteratively.
• scripts/: reproducible raw-image and IDAPython analysis.
• ida/kernel-10.01.i64: current IDA 9.1 database.
• evidence/: byte-locked dossiers, structured evidence, and tool logs.

Git tracks the reports, scripts, exports, evidence bundles, canonical IDA databases, and a separate root kernel_1001.bin capture through Git LFS. Verify that root capture's current worktree state before using it. The tracked dumps/kernel_1001.bin and dumps/kernel_1360.bin are distinct inputs. The established 10.01 analysis uses the October 13 Byepervisor-Reborn/runs/fw-10.01-e2e-20261013/attempt01/kernel-static-10.01.bin snapshot; neither dumps/ file has been substituted for it. See START_HERE.md before cross-capture comparisons.

Reproduction

Run raw-image passes from this workspace:

python3 scripts/verify_identity.py
python3 scripts/characterize_image.py
python3 scripts/extract_strings.py
python3 scripts/build_string_xrefs.py
python3 scripts/seed_probe.py
python3 scripts/seed_crosscheck_objdump.py
python3 scripts/recover_sysent.py
python3 scripts/recover_sysctl_surface.py
python3 scripts/recover_regmgr_surface.py
python3 scripts/search_r8_gadgets.py
python3 scripts/build_reviewed_functions.py
python3 scripts/import_runtime_capture.py
python3 scripts/export_hypervisor_dwarf.py
python3 scripts/recover_hypervisor_hypercalls.py
python3 scripts/recover_hypervisor_runtime_layout.py
python3 scripts/recover_hypervisor_runtime_ownership.py
python3 scripts/recover_hypervisor_npt.py
python3 scripts/export_hypervisor_npt_disassembly.py
python3 scripts/recover_hypervisor_iommu.py
python3 scripts/export_hypervisor_iommu_disassembly.py
python3 scripts/recover_vmclosure_and_kernel_hypercalls.py
python3 scripts/export_vmclosure_disassembly.py
python3 scripts/analyze_linux_vmclosure_readiness.py
python3 scripts/recover_hypervisor_nmi.py
python3 scripts/export_hypervisor_nmi_disassembly.py
python3 scripts/recover_hypervisor_cpuid.py
python3 scripts/export_hypervisor_cpuid_disassembly.py
python3 scripts/recover_hypervisor_pmu.py
python3 scripts/export_hypervisor_pmu_disassembly.py
python3 scripts/recover_kernel_smp_rendezvous.py
python3 scripts/recover_fpkg_ppr_surface.py
python3 scripts/audit_ppr_mount_auth_boundary.py
python3 scripts/audit_ppr_exec_object_continuity.py
python3 scripts/recover_pfs_ioctl_surface.py
# Historical frozen pass; source drift is expected to fail its hash gate.
python3 scripts/validate_linux_smp_probe_context.py
python3 scripts/validate_linux_memory_layout_context.py
python3 scripts/recover_pfs_cache_lifecycle.py
python3 scripts/recover_pfs_authorization_chain.py
python3 scripts/recover_pfs_descriptor_transfer.py
python3 scripts/prepare_npxs40091_ida_input.py
python3 scripts/recover_npxs40091_driveauth.py
python3 scripts/recover_fd_duplication_policy.py
python3 scripts/recover_fpkg_linux_surface.py
python3 scripts/recover_package_userland_clients.py
# Requires a disposable exact ShellCore IDB copy; see scripts/README.md.
python3 scripts/recover_shellcore_package_clients.py
python3 scripts/recover_pfsmgr_delegates.py
python3 scripts/recover_shellcore_pfsmgr_consumers.py
python3 scripts/recover_shellcore_ps4_mount_bridge.py
python3 scripts/recover_shellcore_rif_entitlement.py
python3 scripts/recover_rx_cfi_bank_and_coverage.py
python3 scripts/recover_linux_uart.py
python3 scripts/recover_malloc_types.py
python3 scripts/recover_cfi_target_ownership.py
python3 scripts/recover_driver_module_registry.py
python3 scripts/recover_device_handoff.py
python3 scripts/build_seed_deliverables.py
python3 scripts/validate_workspace.py --regenerate
python3 scripts/hash_artifacts.py .

The RX inventory exporter must be run against a disposable exact copy, never the preserved database:

work=$(mktemp -d /tmp/ida-rx-table-1001.XXXXXX)
cp --reflink=auto ida/kernel-10.01.i64 "$work/kernel-10.01-rx-tables.i64"
/home/miles/Documents/ida-pro-9.1/idat -A \
  -Levidence/rx-table-coverage/ida-rx-table-export.log \
  -Sscripts/ida_export_rx_table_inventory.py \
  "$work/kernel-10.01-rx-tables.i64"

ida_export_malloc_types.py likewise requires a disposable exact copy before recover_malloc_types.py; its successful log and output are under evidence/malloc-types/. It refuses the preserved baseline path.

IDAPython scripts are intended for IDA 9.1. Kernel scripts use disposable copies of ida/kernel-10.01.i64; ida_import_hypervisor_elf.py creates the independent ida/hypervisor-embedded-1001.i64; the NPXS pass uses isolated ida/NPXS40091-10.01.i64 after changing only loader-copy e_type. They validate authoritative raw bytes before mutating names or boundaries. The original dump, retail modules and capture inputs are never patched.

Tooling and limitations

• IDA Pro/Hex-Rays 9.1 (9.1.0.250226) with local IDAPython. Disposable copies additionally recovered 59 PPR/standard-PFS operation bodies (65,854 non-overlapping bytes), six block-map callbacks (12,517 bytes), six ioctl/cache/privilege helpers (9,878 bytes), nine descriptor-transfer functions (5,766 bytes), complete metadata for all 10,060 CFI targets, 18 Titania UART functions/two vectors, nine malloc-type lifecycle/statistics functions plus five globals, 20 accepted xHCI/Aeolia/DMAC starts, 37 complete cdev dispatch/lifecycle bodies, 19 package/security ioctl/helper functions (12,051 bytes), and the complete 328-registration static-module/156-driver registry with 1,017 kobj methods. Separately qualified disposable copies of the preserved current kernel-database epoch exported the registry-manager, cdevsw, package-ioctl and module-registry focused evidence; every body was checked against immutable bytes and no source database was intentionally saved. A separate exact ShellCore database recovers installer-policy and NPDRM client owners. The RX inventory pass exported all 19,118 baseline function chunks, 43,636 IDA data items, and 1,293 switch records; it found zero switch jump tables wholly inside RX. Every historical evidence object remains bound to its recorded database hash.
• GNU objdump 2.46.1 as an independent exact-offset decoder, including all 10,676 CFI slot starts from a bounded slice.
• NDISASM 3.02 as the third complete-byte decoder for the nine-range independent IPv6 im6o_grow corroboration bundle and as an instruction-boundary check for the sixteen-source-lineage signature corpus.
• Python 3.14.8 for hashing, page maps, string extraction, syscall recovery, graph/export processing, and signature generation.
• LLVM 22.1.8 (llvm-dwarfdump, llvm-readelf, llvm-objdump) and pahole 1.32 for independent ELF/DWARF verification and type-layout recovery.
• Rizin 0.7.4 was used successfully as a bounded independent decoder for the hypercall, NPT/TMR, IOMMU, VM-closure, NMI, CPUID, kernel VMMCALL-bank, IVM-code blocks, all 10,060 unique CFI targets, the ACM constructor/dispatcher, kernel/hypervisor UART paths, xHCI/Aeolia/DMAC, cdevsw and package/security ioctl ranges, and exact ShellCore installer windows; no conclusion rests on Rizin alone.
• Historical kernel IDA exports are bound to baseline SHA-256 1e0ec4aa75a071ff273c6bdf02d2378efda76d91d16edecbebdcc6badf338bba. The preserved current ida/kernel-10.01.i64 is SHA-256 da7109539fba1df2c1d798e7cf65b479a4da9808784f0cd896ec2af94d93c8fc, size 462,112,027. IDALib has twice demonstrated that a direct canonical open can repack the container even when closed with save=false; each changed identity was rejected, preserved separately, and restored atomically from independently matching pre-session copies. No claim uses either transient file. Canonical IDA/IDALib/REA opens are prohibited for every agent: automated consumers must use a fresh disposable exact copy and verify canonical/input hashes before and after. The full semantic delta from the historical baseline remains Unknown, so current-epoch passes independently qualify only named ranges through exact database/input/segment checks and raw-byte equality. The ShellCore IDB remains SHA-256 c6121aea96fdfc0a4ebc8cfff417b0795d23b6f3abe2247ea29c75ebecb1a37c. See IDA-DATABASE-STATE-1001-002, IDA-DATABASE-RESTORATION-1001-001, IDA-DATABASE-RESTORATION-1001-002, first restoration, and second restoration.
• REA 6.4.0 now analyzes the unmodified capture-derived hypervisor ELF (7cccd72...9110c) through a narrow workspace-only IDAPython loader for Sony e_type=0xfe10; neither the artifact nor the installed IDA tree is rewritten. Two retained shipped-artifact dossiers cover khv_iommu_set_guest_buffers at hv+0xd500..+0xdcbb (ev_475c059928ea7e507cde39acf6d9b5acd09abd9614613e76c6041e34cdf82d28) and hv_handle_exit at hv+0x14d20..+0x176d3 (ev_f4dd4c9047ecf5152feb7b976c466b57c89cc649292df70e625c0a223bee35f8). REA's normalized caller/type/string/basic-block fields and byte-read operation remain incomplete, so every important claim is still cross-checked against exact bytes, IDA/Hex-Rays, Rizin, GNU/LLVM objdump and DWARF. The original headerless 63.7 MiB raw kernel remains unsupported as a direct REA binary target. Evidence: REA-HYPERVISOR-PROVIDER-1001-002, REA-HV-HANDLE-EXIT-1001-001; see provider resolution, first REA bundle, and dispatcher dossier.
• No cloud analysis service was used, and the dump/function information was not uploaded.
• The PS5 builder could not complete cargo test --locked --offline because the workspace-locked blake2 0.11 dependency is absent from the local cache; only 0.10.6 is available. No network fetch was attempted. Source/layout correlation remains valid, but builder tests are not claimed.
• The exact retail firmware-10.01 A53 ELF is now present and profile 48's original words, destinations, helper-xref set and zero-filled cave are independently qualified. What remains unavailable is live binding of that image and deployed patch to a controlled package run, including cache/atomic-install evidence and the complete FD/FC → FF/FE → 7FF/7FE selector telemetry.
• The five read-only context repositories have privacy-preserving initial, prior-final, post-CFI, post-UART/fPKG, post-malloc/PFS/Linux, post-builder/PPR/runtime, post-local-fPKG-tooling, post-regmgr, post-NPDRM-clock, post-cdevsw/fPKG/Linux, post-package-ioctl, post-retail-package-client, post-driveauth-protocol, post-module-registry, post-package-module, post-SELF-loader, post-SELF-policy, post-application-metadata, and post-syscall-entry HEAD/status/diff checkpoints. The newest checkpoint exactly matches its prior checkpoint in HEAD, status fingerprints/counts, and tracked staged/unstaged diff byte streams. Earlier porcelain changes came from external/untracked status only and their paths remain suppressed. No git mutation command is used by the analysis scripts.
• Preservation checkpoint 026 exactly matches checkpoint 025 for all five designated read-only repositories, and re-verifies the immutable kernel plus canonical IDB hashes.
• Preservation checkpoint 028 exactly matches the preceding live-readiness checkpoint for all five designated read-only repositories and again verifies the immutable kernel plus canonical IDB hashes.
• The snapshot omits loadable modules and heap allocations. Mutable data reflects one captured boot; live pointers are structural clues, never identity proof by themselves.
• Runtime behavior cited as observed comes only from preserved qualification notes or the separately hash-locked, sanitized local 10.01 log. Static IDA/source analysis is never presented as runtime execution, and the runtime log is never used to infer hidden package identity or selector state.
• Public-facing exports redact or suppress console-specific mutable values. Structural addresses and offsets are retained.

Investigation status by requested phase

Phase	Status
Artifact characterization	Substantial; identity and page maps complete, semantic table promotion incomplete
Seed validation	Substantial; all supplied symbols/gadgets byte-checked, several identities corrected/rejected
Function recovery	Partial; recursive syscall roots plus credential/prison, usercopy, cdev, package/security, SELF, process, interrupt, VM/pmap and crypto/random families are recorded. The CFI transaction promotes five absent complete functions and classifies two existing rows; the later credential-COW transaction promotes one exact existing 191-byte body. The reviewed manifest is now 186 extents / 65,936 bytes. The separate 21,152-byte interrupt entry/common-return bank remains structural assembly, and CFI targets are ownership-ranked without unsafe bulk promotion. Semantic completion remains sparse: 18,707/19,229 rows are subsystem-unclassified, 18,524 lack prototypes and 18,268 retain autogenerated-style names; broad sysinit/table typing and source naming remain
Source/cross-firmware matching	Partial; 26 hash-locked correlations now establish releng/11.4 as the strongest available local ABI comparator and sixteen collision-tested FW10.01-local signatures provide reusable anchors. Exact local SDK/Aerolib/retail-module, kstuff, PPR, package-builder, ShellCore, DWARF and frozen pLinux comparisons cover focused families, but Sony's exact fork/implementation commit, compiler/linker build, body-level equivalence and cross-firmware signature portability remain unknown
HVE/S3/Byepervisor	Substantial cross-layer reconstruction through kernel wrappers, hypervisor dispatcher, APIC start/NMI delivery, native rendezvous/IPI/CFI/TSC paths, CPUID mode/TSC_AUX, PMU synchronization, focused pmap/PAT, exact CPU execute-only writers, the distinct IOMMU writer, normal all-core f7..fa shootdown, shared kernel/HV UART, and fixed xHCI/DMAC/PCI-IOMMU lifecycle boundaries; hypervisor ownership, host/NPT/IOMMU mappings, live state, the complete captured IDT, active IST routing and common IRET path are recovered, while final Linux handoff, complete device/IRQ/DMA transfer, hardware serial qualification, full saved-frame typing and an authorized kernel-text permission-changing caller/rollback lifecycle remain incomplete
Kernel subsystem map	Partial; package builder/ShellCore/SELF/PFS/NPDRM/PPR/A53 chain, complete Native/PS4 SELF selector/common-loader plus metadata-policy/ASLR/unwind helpers, eleven package/security module lifecycles, eight package/security ioctl dispatchers, complete registry-manager and 328-record static-module/156-driver registries, malloc-type registry, SMP, CPUID, PMU, CFI/ACM, Titania UART, xHCI/Aeolia/DMAC, the 147-record fixed-image cdevsw layer, and the 1,124-node captured fixed-image sysctl tree now have focused reports/evidence; many custom handlers, drivers, filesystems, policies and deeper UMA internals remain
Attack-surface review	Partial; complete syscall/hypercall inventories and the complete captured 256-gate IDT topology exist, including five DPL3 gates ranked for deeper review; the fixed-image device pass maps 146 ioctl routes to 129 unique targets, including 126 unique custom handlers. Sixty commands across six active package/security handlers now have exact dispatcher, gate and user-copy maps; all four pfsmgr delegates have downstream gates and request layouts; encdev now has a complete secure-service, ioctl-staging and alternative-caller boundary. The selected UDP6/IPv6 multicast family has ten complete owners, rejects the prior option-74 lock-drop model, and contains an independently confirmed conditional im6o_grow dangling-field defect with exact later stale-use paths but no demonstrated hardware failure/exploit. Syscall 202, sysctl traversal/policy, all 13 captured `WR
Offset/signature database	Partial; the generated header remains review-required, but its companion database now accounts for all 530 definition occurrences, validates all 155 retained local signature rows against immutable FW10.01 text, redacts mutable RW bytes, and preserves 262 ambiguous records. Cross-firmware portability, many semantic identities, hardware safety and additional globals/structures remain unresolved

The analysis is intentionally not described as complete while 3,031,031 RX-range bytes remain unresolved and major subsystem/source-matching objectives are still open.