# SDK v0.41 startup call graph

This is an offline source, relocation, and disassembly audit of the installed
SDK v0.41 `target/lib/crt1.o`. It describes the unsafe stock startup, not a new
Chimera GFX artifact. The complete machine-readable reachable graph contains
31 functions and 182 call or tail-call edges in
`manifests/runtime/phase-0.5-startup-audit.json`.

## Transitive startup objects

`crt/Makefile` compiles and partially links exactly these objects into one
relocatable `crt1.o` with `prospero-lld -r`:

| Object | Public source | Role |
|---|---|---|
| `crt.o` | `crt/crt.c` | entry, BSS, init/run/terminate |
| `syscall.o` | `crt/syscall.c` | syscall bootstrap |
| `klog.o` | `crt/klog.c` | kernel log helpers |
| `nid.o` | `crt/nid.c` | symbol-name encoding |
| `kernel.o` | `crt/kernel.c` | kernel transport and process helpers |
| `rtld.o` | `crt/rtld.c` | runtime-loader core |
| `rtld_so.o` | `crt/rtld_so.c` | shared-object mapping and relocation |
| `rtld_sprx.o` | `crt/rtld_sprx.c` | Sce module load/start/stop/unload |
| `rtld_payload.o` | `crt/rtld_payload.c` | payload relocation and arrays |
| `rtld_dlfcn.o` | `crt/rtld_dlfcn.c` | `dlopen`/`dlsym` facade |
| `mdbg.o` | `crt/mdbg.c` | memory-debug transport helpers |
| `patch.o` | `crt/patch.c` | credentials and syscall-bound patches |

The files named `crti.o`, `crtn.o`, `crtbegin.o`, `crtend.o`, `crtbeginS.o`,
and `crtendS.o` are empty `ar` archives at the installed release. The audit
enumerates them rather than assuming their filename implies contents.

## Reachable startup paths

The important conservative paths from source, relocations, and disassembly are:

```text
_start
|- zero [__bss_start, __bss_end)
|- __crt_syscall_init
|- __kernel_init
|  `- kernel_copyout (reachable in compiled object)
|- __klog_init
|- kernel_dynlib_dlsym -> set __isthreaded = 1
|- __patch_init                                      UNSAFE
|  |- kernel_get_ucred_caps -> kernel_copyout
|  |- kernel_get_ucred_attrs -> kernel_copyout
|  |- kernel_set_ucred_caps -> kernel_copyin         KERNEL WRITE
|  |- kernel_set_ucred_attrs -> kernel_copyin        KERNEL WRITE
|  `- kernel_copyin at process offsets 0xf0/0xf8     KERNEL WRITE
|- __rtld_init                                       UNSAFE
|  |- __rtld_sprx_init -> sceKernelLoadStartModule
|  |- __rtld_so_init
|  |- __rtld_payload_init
|  `- __rtld_dlfcn_init
|- __rtld_payload_new/open/init
|  `- constructors
|- main
|- __rtld_lib_fini/close/destroy
|  `- destructors
`- payload_terminate
   |- ret for the CRT's detected hijacked-process case
   |- resolved exit for another case
   `- trap when exit cannot be resolved
```

Indirect calls are retained as `INDIRECT:<operand>` in the JSON graph rather
than guessed. A relocation to the `sceKernelLoadStartModule` function-pointer
slot is retained explicitly. This makes the graph conservative without
inventing a firmware ABI.

## Linked but not startup-reachable

The monolithic `crt1.o` also contains `__dlopen`, `__dlsym`,
`kernel_mprotect`, `kernel_overlap_sockets`, and
`kernel_set_vmem_protection`, although the disassembly graph did not find them
reachable from the stock `_start`. Their presence demonstrates why an import
inventory alone would be insufficient: prohibited-capability code can be
statically linked without appearing as an undefined symbol.

## Driver and linker behavior

The `prospero-clang` wrapper normally adds `crt1.o`, `libc`, `libkernel_web`,
`libSceLibcInternal`, and `libSceNet`. A no-output `-###` trace with both
`-nostartfiles` and `-nodefaultlibs` adds none of them. The linker wrapper still
selects the public `elf_x86_64.x` script, PIE mode, an ELF x86-64 emulation,
0x4000 maximum page size, emulated TLS support, and GNU hashing unless the
caller overrides applicable options.

The linker script retains preinit/init/fini arrays and a dynamic segment. It
also declares the text load segment with flags `0x7`; that is a source fact,
not a claim about final loader-enforced permissions.

## Why there is no custom linker map

The loader return contract failed before the build gate. In accordance with
the task rule, no custom `_start` source or PS5 ELF was created. Therefore a
custom linker map, imports, `DT_NEEDED`, relocations, arrays, TLS inventory,
double-build hash, and artifact disassembly are all explicitly recorded as
`NOT_PERFORMED_BLOCKED_BEFORE_BUILD`, not silently treated as passing.

## Phase 0.6 exact runtime chain

This addendum is the reviewed source call graph for the installed chain. No new
probe artifact exists, so there is no probe disassembly call graph to report.

```text
Payload Manager /loadpayload:<path>
`- ps5_launch_elf(path)
   |- open(path, O_RDONLY)
   |- connect(127.0.0.1:9021)
   `- send(ELF bytes)

elfldr serve_elfldr
`- elfldr_spawn
   |- rfork_thread
   |  `- child: elfldr_rfork_entry
   |     |- sys_budget_set(0)
   |     |- open(/dev/deci_{stdin,stdout,stderr})
   |     |- ptrace(PT_TRACE_ME)
   |     `- execve(SceSpZeroConf)
   |- parent: pt_syscall(599)
   |  `- pt_syscall -> unbounded pt_step loop
   |- elfldr_set_heap_size(-1)
   |- kernel_mprotect(eboot entry page, RWX)
   |- install INT3 -> continue -> wait -> restore byte
   `- elfldr_exec
      |- backup jaildir/rootdir/caps/authid
      |- elfldr_raise_privileges
      |  `- set rootdir/jaildir/UID/caps
      |- elfldr_prepare_exec
      |  |- elfldr_load
      |  |  |- mmap/copy/RELATIVE relocations
      |  |  `- per-segment mprotect + msync
      |  |- elfldr_payload_args
      |  |  |- mmap page
      |  |  |- two IPv6 sockets + overlap
      |  |  `- pipe + six payload_args_t fields
      |  `- [RSP-8]=old RIP; RIP=entry; RDI=args
      |- restore jaildir/rootdir/caps/authid (not UID)
      `- ptrace(PT_DETACH)

SDK v0.41 payload _start
|- clear BSS
|- initialize syscall/kernel/klog
|- __patch_init
|- initialize rtld and constructors
|- main
|- destructors and rtld cleanup
`- payload_terminate
   `- return OR exit OR trap (exact child branch unproven)
```

The exact elfldr release binary is stripped, so the source graph is bound to
the release by source commit and release-asset SHA-256. Static binary evidence
records entry `0x4700`, 164 relocations, 24 undefined dynamic symbols, three
`DT_NEEDED` modules, zero-byte init/fini arrays, no TLS, and hashes of the
complete readelf report and disassembly in
`manifests/runtime/phase-0.6-loader-runtime-audit.json`.

## Phase 0.7 hardened callgraph addendum

Phase 0.7 uses new hardened elfldr and controlled Payload Manager binaries;
the graph above remains the historical stock Phase-0.6 chain.

The lifecycle source-level action is deliberately narrow:

```text
SDK _start
|- BSS and stock SDK v0.41 runtime initialization
|- __patch_init
|- main
|  |- sceKernelSendNotificationRequest
|  `- _exit
`- payload_terminate [not reached from main]
```

The hardened loader retains its required first-stage and ptrace operations,
but each single-step operation now has both a one-second monotonic deadline
and a 65,536-step ceiling. Cleanup tracks the child, breakpoint, mappings, and
descriptors in one state. The success and failure paths restore all five
credential fields and verify every restoration. The runtime supervisor waits
at most 2000 ms, then uses a bounded SIGTERM/SIGKILL/reap sequence.

The controlled manager opens, hashes, rewinds, and streams one no-follow file
descriptor. The hardened receiver independently rehashes the received bytes
and checks the exact versioned header and permanent denylist.

The committed machine audit contains every extracted call edge, not a sample:

- lifecycle: 499 edges;
- hardened elfldr: 1032 edges;
- controlled manager: 478 edges.

Full disassembly, normalized linker maps, symbol/relocation/section reports,
and text callgraphs are in the ignored `outputs/phase07/audit/` package. Their
hashes and the complete edge arrays are committed in
`manifests/runtime/phase-0.7-offline-audit.json`.