# Phase 1.0J offline write-firewall diagnostic

Status: **OFFLINE ARTIFACT AUDITED; DEVICE ACTION BLOCKED**.

Phase 1.0J implements the bounded offline follow-up required by Phase 1.0I.
It does not connect to a PS5, transfer an ELF, receive a device result or run
target code. The built ELF and map stay in ignored local build storage and are
not committed.

## Exact source and artifact binding

| Object | Identity |
|---|---|
| RetroArch source | `2e385265ab893dbba5898178dde5e108d3dbfa19` |
| Chimera GFX baseline | `2bee49e5e8f1ee6faa0589d2d74de5ba0d809293` |
| Public PS5 SDL source | `0baf4ac49382b537ba449901b5b6d0d189bb1fbb` |
| Public PS5 Payload SDK v0.41 | `d2e2e585740362976a39fdd5ccf390f199a7bc37` |
| SDL diagnostic patch | SHA-256 `aa1d3ebc6043d6051938cee1dbffecb80729b3b6595eef964915e93f1570c193` |
| Materialized SDL video source | SHA-256 `9949a280fed40241746788a8c001280455bc629e0566a88f82f16a8634d43025` |
| J ELF | 1,845,208 bytes; SHA-256 `6ff0f7ea391da5f15ea43512a871078133e896a6900ae9f8f3fa75711abb8009` |
| Linker map | 637,728 bytes; SHA-256 `19f1cf851ad8f99d31d5de3a14591f81faa83589c18e93cd60be96ebef5d7719` |
| Normalized disassembly | SHA-256 `45dc4e0233b3770add430aaa6bb23a60210b50744effb76b515fca4b9e6e310f` |

Two clean `PS5_PROFILE=write-diag` builds produced byte-identical ELFs and
maps. The raw audit disassembly hashes differ because `objdump` includes each
input pathname; replacing only the `write-diag-a`/`write-diag-b` path component
produces the identical normalized hash above.

## Bounded diagnostic behavior

The protocol uses distinct magic `CHD10J01`. Existing stage numbers and wire
values are preserved; D13 is appended and carries exactly:

```text
value_a = first_blocked_write
value_b = write_block_count
```

The first write-firewall rejection emits one inherited-stdout, nonblocking,
signal-suppressed D13 frame immediately before terminal D12. No target socket
is created and the existing live runner has no J selector. Immediately after
argument/config parsing, `retroarch_main_init()` observes
`shutdown_requested` and returns false before I04 and all SDL/VideoOut driver
lookup. Thus the first unresolved E118 operation can be identified without
continuing into graphics initialization.

The SDL helper separately copies `errno` immediately after its single
`sceVideoOutSubmitFlip()` call and before notification or stream output. Under
J, D07 would carry `(submit_result, saved_errno)`. That branch is deliberately
unreachable after an earlier firewall shutdown; it is retained for a later,
separately reviewed phase only.

ADR-0012 fixes one `CHIMERA_PS5_FIRST_FRAME_INDEX` value of zero for the early
copy, early submit and normal initial counter. This removes an internal source
inconsistency. It is not firmware proof or a root-cause claim.

## Static and transitive audit

The ELF is a PIE with entry point `0xff210`, 20 sections and four program
headers. Three LOAD segments are `R E`, `R` and `RW`; no segment is RWX.
`.init_array` and `.fini_array` both have size zero, and there is no TLS
section. `.bss` is `0xaa520` bytes. The dynamic closure has 142 undefined
symbols and 1,055 relocations: 142 `R_X86_64_GLOB_DAT` and 913
`R_X86_64_RELATIVE`.

The exact DT_NEEDED set is:

- `libSceAudioOut.sprx`
- `libSceLibcInternal.sprx`
- `libScePad.sprx`
- `libSceSystemService.sprx`
- `libSceUserService.sprx`
- `libSceVideoOut.sprx`
- `libkernel_web.sprx`

The import set contains `send` for the already-audited inherited stdout
descriptor. It contains no `socket`, `connect`, `bind`, `listen`, `accept` or
`recv`, and no GNM symbol. The linker map binds the firewall entry at
`0x466d0`, its surviving wrappers at `0x475a0`, `0x47610` and `0x476a0`,
`retroarch_main_init` at `0x3dc0`, and the dormant early VideoOut helper at
`0xfe550`.

String scanning still finds dormant generic RetroArch text mentioning
networking, installation, credentials, autoload and writes. Absence of a
string is not used as safety proof. Safety rests on the source profile,
write-wrapper closure, linker map and disassembly; the scan findings remain
recorded as dormant linked data rather than declared reachable behavior.

## Review matrix

| Property | Result |
|---|---|
| Exact E118 operation reporting | PROVEN_OFFLINE_FROM_SOURCE_AND_TESTS |
| Stop before I04 after E118 | PROVEN_OFFLINE_FROM_SOURCE_AND_DISASSEMBLY |
| Submit errno capture ordering | PROVEN_OFFLINE_FROM_SOURCE |
| Unified first-frame value | PROVEN_OFFLINE_FROM_SOURCE |
| Byte-reproducible ELF and map | PROVEN_OFFLINE |
| Firmware-9.60 runtime behavior | UNPROVEN |
| Exact blocked operation for the consumed H run | UNPROVEN |
| Submit errno on firmware 9.60 | UNPROVEN |
| Visible presentation | UNPROVEN |
| Complete target cleanup and safe exit | UNPROVEN |

The normal SDK CRT and its documented runtime effects remain inherited. The
early fail-closed return occurs before driver initialization, but the complete
loader/process cleanup path is still not firmware-proven. Every artifact and
authorization gate remains false. No device action is authorized.