# ADR-0008: Firmware 9.60 is build-allowlisted; SDK-CRT execution is blocked

- Status: accepted
- Date: 2026-07-17

## Context

Jens reported exact PS5 firmware `9.60` and authorized an offline-only,
non-rendering capability-probe build and audit. Transfer, connection, execution,
VideoOut, framebuffer/GPU/GNM mutation, draw, dispatch, submit, flip, MMIO,
register writes, and kernel/firmware changes remain prohibited.

The pinned public SDK v0.41 source was audited beyond project `main`. Its
payload startup calls `__patch_init` before `main`. That function changes the
current process's kernel credential fields and syscall-address bounds using the
SDK kernel read/write path. The SDK rtld also ensures `libSceSysmodule.sprx` is
available during startup. A later project `dlopen` can load/start
`libSceGnmDriver.sprx`; `dlclose` can stop/unload it.

## Decision

The discovery manifest and probe configure gate accept exactly `9.60`; the
default remains `NONE`. This allowlist entry authorizes only a reproducible
offline build. Phase-1 VideoOut rejects every non-`NONE` firmware gate.

The resulting 9.60 ELF is named `offline-audit-only`, records zero transfer and
execution, and is not execution-eligible. No literal execution approval is
offered while the linked SDK CRT performs kernel writes before the project gate.

## Consequences

- Project code still invokes no resolved GNM pointer and contains no rendering,
  submit, draw, dispatch, flip, or GPU-memory operation.
- The artifact is useful for deterministic compilation, import/disassembly
  review, hashing, and future startup research only.
- A new ADR and a new hash-bound build are required after a public,
  kernelwrite-free startup/loader route is proven.
- Transfer or execution of this artifact would violate the current safety
  policy even if Jens later supplied a generic execution approval.