{
  "artifact": {
    "built": false,
    "execution_eligible": false,
    "reason": "safe loader return and cleanup are not proven",
    "sha256": null
  },
  "audit_date": "2026-07-17",
  "crt1_static_evidence": {
    "disassembly_sha256": "7cb0035c8bb1ff534a8c406c92e18ecedf10882723a0e4a891f9675c903cb142",
    "elf_header_sha256": "8bd149e3bef18d6c4a37d6201c65036d2be0e054b0fed1c63f38f07375fc5c39",
    "linked_but_not_startup_reachable": [
      "__dlopen",
      "__dlsym",
      "kernel_mprotect",
      "kernel_overlap_sockets",
      "kernel_set_vmem_protection"
    ],
    "linked_prohibited_functions": [
      "__dlopen",
      "__dlsym",
      "__patch_init",
      "kernel_copyin",
      "kernel_copyout",
      "kernel_mprotect",
      "kernel_overlap_sockets",
      "kernel_set_ucred_attrs",
      "kernel_set_ucred_caps",
      "kernel_set_vmem_protection"
    ],
    "reachable_callgraph": [
      {
        "address": "17",
        "caller": "__crt_syscall",
        "kind": "call",
        "target": ".bss.ptr_syscall"
      },
      {
        "address": "21",
        "caller": "__crt_syscall_init",
        "kind": "call",
        "target": "INDIRECT:*(%rbx)"
      },
      {
        "address": "37",
        "caller": "__crt_syscall_init",
        "kind": "call",
        "target": "INDIRECT:*(%rbx)"
      },
      {
        "address": "5e",
        "caller": "__crt_syscall_init",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "77",
        "caller": "__crt_syscall_init",
        "kind": "call",
        "target": "INDIRECT:*(%rbx)"
      },
      {
        "address": "aa",
        "caller": "__kernel_init",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "af1",
        "caller": "__kernel_init",
        "kind": "call",
        "target": "kernel_get_proc"
      },
      {
        "address": "b0b",
        "caller": "__kernel_init",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "b31",
        "caller": "__kernel_init",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "b5a",
        "caller": "__kernel_init",
        "kind": "call",
        "target": "nid_encode"
      },
      {
        "address": "b6d",
        "caller": "__kernel_init",
        "kind": "call",
        "target": "kernel_dynlib_resolve"
      },
      {
        "address": "b88",
        "caller": "__kernel_init",
        "kind": "call",
        "target": "nid_encode"
      },
      {
        "address": "b9b",
        "caller": "__kernel_init",
        "kind": "call",
        "target": "kernel_dynlib_resolve"
      },
      {
        "address": "1c",
        "caller": "__klog_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "43",
        "caller": "__klog_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "66",
        "caller": "__klog_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "89",
        "caller": "__klog_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "ac",
        "caller": "__klog_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "100",
        "caller": "__patch_init",
        "kind": "call",
        "target": "kernel_copyin"
      },
      {
        "address": "12",
        "caller": "__patch_init",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "22",
        "caller": "__patch_init",
        "kind": "call",
        "target": "kernel_get_ucred_caps"
      },
      {
        "address": "38",
        "caller": "__patch_init",
        "kind": "call",
        "target": "kernel_get_ucred_attrs"
      },
      {
        "address": "59",
        "caller": "__patch_init",
        "kind": "call",
        "target": "kernel_set_ucred_caps"
      },
      {
        "address": "79",
        "caller": "__patch_init",
        "kind": "call",
        "target": "kernel_set_ucred_attrs"
      },
      {
        "address": "8e",
        "caller": "__patch_init",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "96",
        "caller": "__patch_init",
        "kind": "call",
        "target": "kernel_get_proc"
      },
      {
        "address": "b8",
        "caller": "__patch_init",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "dc",
        "caller": "__patch_init",
        "kind": "call",
        "target": "kernel_copyin"
      },
      {
        "address": "121",
        "caller": "__rtld_dlfcn_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "144",
        "caller": "__rtld_dlfcn_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "1c",
        "caller": "__rtld_dlfcn_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "43",
        "caller": "__rtld_dlfcn_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "6a",
        "caller": "__rtld_dlfcn_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "91",
        "caller": "__rtld_dlfcn_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "b4",
        "caller": "__rtld_dlfcn_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "db",
        "caller": "__rtld_dlfcn_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "fe",
        "caller": "__rtld_dlfcn_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "106",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "129",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "14c",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "15e",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "__rtld_sprx_init"
      },
      {
        "address": "16a",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "__rtld_so_init"
      },
      {
        "address": "176",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "__rtld_payload_init"
      },
      {
        "address": "191",
        "caller": "__rtld_init",
        "kind": "tail_call",
        "target": "__rtld_dlfcn_init"
      },
      {
        "address": "1c",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "43",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "6a",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "91",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "b8",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "df",
        "caller": "__rtld_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "43",
        "caller": "__rtld_lib_close",
        "kind": "call",
        "target": "__rtld_lib_close"
      },
      {
        "address": "69",
        "caller": "__rtld_lib_close",
        "kind": "call",
        "target": "INDIRECT:*0x28(%rbx)"
      },
      {
        "address": "c2",
        "caller": "__rtld_lib_close",
        "kind": "call",
        "target": ".bss.free"
      },
      {
        "address": "5",
        "caller": "__rtld_lib_destroy",
        "kind": "tail_call",
        "target": "INDIRECT:*0x30(%rdi)"
      },
      {
        "address": "33",
        "caller": "__rtld_lib_fini",
        "kind": "call",
        "target": "__rtld_lib_fini"
      },
      {
        "address": "e",
        "caller": "__rtld_lib_fini",
        "kind": "call",
        "target": "INDIRECT:*0x20(%rdi)"
      },
      {
        "address": "3d",
        "caller": "__rtld_lib_init",
        "kind": "call",
        "target": "__rtld_lib_init"
      },
      {
        "address": "86",
        "caller": "__rtld_lib_init",
        "kind": "tail_call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "21",
        "caller": "__rtld_lib_open",
        "kind": "tail_call",
        "target": "INDIRECT:*(%rdi)"
      },
      {
        "address": "1c",
        "caller": "__rtld_payload_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "43",
        "caller": "__rtld_payload_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "66",
        "caller": "__rtld_payload_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "89",
        "caller": "__rtld_payload_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "ac",
        "caller": "__rtld_payload_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "1b",
        "caller": "__rtld_payload_new",
        "kind": "call",
        "target": ".bss.calloc"
      },
      {
        "address": "32",
        "caller": "__rtld_payload_new",
        "kind": "call",
        "target": "INDIRECT:*%r13"
      },
      {
        "address": "b7",
        "caller": "__rtld_payload_new",
        "kind": "call",
        "target": ".bss.strcpy"
      },
      {
        "address": "cf",
        "caller": "__rtld_payload_new",
        "kind": "call",
        "target": "INDIRECT:*%r13"
      },
      {
        "address": "1c",
        "caller": "__rtld_so_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "43",
        "caller": "__rtld_so_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "6a",
        "caller": "__rtld_so_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "8d",
        "caller": "__rtld_so_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "b0",
        "caller": "__rtld_so_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "d3",
        "caller": "__rtld_so_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "109",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "130",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "153",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "175",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "kernel_dynlib_handle"
      },
      {
        "address": "192",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": ".bss.sceKernelLoadStartModule"
      },
      {
        "address": "1ae",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "27",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "INDIRECT:*%r15"
      },
      {
        "address": "4b",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "INDIRECT:*%r15"
      },
      {
        "address": "6d",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "94",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "bb",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "e2",
        "caller": "__rtld_sprx_init",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "122",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "141",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "160",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "17f",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "18d",
        "caller": "_start",
        "kind": "call",
        "target": "INDIRECT:*%rbx"
      },
      {
        "address": "192",
        "caller": "_start",
        "kind": "call",
        "target": "INDIRECT:*%r15"
      },
      {
        "address": "1b0",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "1cf",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "1ef",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "20b",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "225",
        "caller": "_start",
        "kind": "call",
        "target": "__rtld_payload_new"
      },
      {
        "address": "236",
        "caller": "_start",
        "kind": "call",
        "target": "__rtld_dlfcn_setroot"
      },
      {
        "address": "23f",
        "caller": "_start",
        "kind": "call",
        "target": "__rtld_lib_open"
      },
      {
        "address": "25a",
        "caller": "_start",
        "kind": "call",
        "target": "__rtld_lib_init"
      },
      {
        "address": "26a",
        "caller": "_start",
        "kind": "call",
        "target": "__rtld_lib_close"
      },
      {
        "address": "273",
        "caller": "_start",
        "kind": "call",
        "target": "__rtld_lib_destroy"
      },
      {
        "address": "29d",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "2c2",
        "caller": "_start",
        "kind": "call",
        "target": "main"
      },
      {
        "address": "2d8",
        "caller": "_start",
        "kind": "call",
        "target": "__rtld_lib_fini"
      },
      {
        "address": "2e3",
        "caller": "_start",
        "kind": "call",
        "target": "__rtld_lib_close"
      },
      {
        "address": "2ef",
        "caller": "_start",
        "kind": "call",
        "target": "__rtld_lib_destroy"
      },
      {
        "address": "31e",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "336",
        "caller": "_start",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "45",
        "caller": "_start",
        "kind": "call",
        "target": "__crt_syscall_init"
      },
      {
        "address": "52",
        "caller": "_start",
        "kind": "call",
        "target": "__kernel_init"
      },
      {
        "address": "5c",
        "caller": "_start",
        "kind": "call",
        "target": "__klog_init"
      },
      {
        "address": "7d",
        "caller": "_start",
        "kind": "call",
        "target": "kernel_dynlib_dlsym"
      },
      {
        "address": "8e",
        "caller": "_start",
        "kind": "call",
        "target": "__patch_init"
      },
      {
        "address": "ad",
        "caller": "_start",
        "kind": "call",
        "target": "__rtld_init"
      },
      {
        "address": "c5",
        "caller": "_start",
        "kind": "call",
        "target": "klog_puts"
      },
      {
        "address": "13b",
        "caller": "kernel_copyin",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "16f",
        "caller": "kernel_copyin",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "19f",
        "caller": "kernel_copyin",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "1c1",
        "caller": "kernel_copyin",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "58",
        "caller": "kernel_copyin",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "74",
        "caller": "kernel_copyin",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "b5",
        "caller": "kernel_copyin",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "f7",
        "caller": "kernel_copyin",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "13e",
        "caller": "kernel_copyout",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "172",
        "caller": "kernel_copyout",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "1a2",
        "caller": "kernel_copyout",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "1c4",
        "caller": "kernel_copyout",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "5b",
        "caller": "kernel_copyout",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "77",
        "caller": "kernel_copyout",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "b8",
        "caller": "kernel_copyout",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "fa",
        "caller": "kernel_copyout",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "1c",
        "caller": "kernel_dynlib_dlsym",
        "kind": "call",
        "target": "nid_encode"
      },
      {
        "address": "2a",
        "caller": "kernel_dynlib_dlsym",
        "kind": "call",
        "target": "kernel_dynlib_resolve"
      },
      {
        "address": "111",
        "caller": "kernel_dynlib_handle",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "1a",
        "caller": "kernel_dynlib_handle",
        "kind": "call",
        "target": "kernel_get_proc"
      },
      {
        "address": "1ab",
        "caller": "kernel_dynlib_handle",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "3f",
        "caller": "kernel_dynlib_handle",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "68",
        "caller": "kernel_dynlib_handle",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "af",
        "caller": "kernel_dynlib_handle",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "d6",
        "caller": "kernel_dynlib_handle",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "f3",
        "caller": "kernel_dynlib_handle",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "14",
        "caller": "kernel_dynlib_obj",
        "kind": "call",
        "target": "kernel_get_proc"
      },
      {
        "address": "39",
        "caller": "kernel_dynlib_obj",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "5c",
        "caller": "kernel_dynlib_obj",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "7a",
        "caller": "kernel_dynlib_obj",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "94",
        "caller": "kernel_dynlib_obj",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "ac",
        "caller": "kernel_dynlib_obj",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "109",
        "caller": "kernel_dynlib_resolve",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "1e",
        "caller": "kernel_dynlib_resolve",
        "kind": "call",
        "target": "kernel_dynlib_obj"
      },
      {
        "address": "52",
        "caller": "kernel_dynlib_resolve",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "91",
        "caller": "kernel_dynlib_resolve",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "b4",
        "caller": "kernel_dynlib_resolve",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "d4",
        "caller": "kernel_dynlib_resolve",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "109",
        "caller": "kernel_get_proc",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "16a",
        "caller": "kernel_get_proc",
        "kind": "call",
        "target": "INDIRECT:*%rax"
      },
      {
        "address": "3f",
        "caller": "kernel_get_proc",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "af",
        "caller": "kernel_get_proc",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "ef",
        "caller": "kernel_get_proc",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "11",
        "caller": "kernel_get_ucred_attrs",
        "kind": "call",
        "target": "kernel_get_proc"
      },
      {
        "address": "2b",
        "caller": "kernel_get_ucred_attrs",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "57",
        "caller": "kernel_get_ucred_attrs",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "11",
        "caller": "kernel_get_ucred_caps",
        "kind": "call",
        "target": "kernel_get_proc"
      },
      {
        "address": "2b",
        "caller": "kernel_get_ucred_caps",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "57",
        "caller": "kernel_get_ucred_caps",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "11",
        "caller": "kernel_set_ucred_attrs",
        "kind": "call",
        "target": "kernel_get_proc"
      },
      {
        "address": "2b",
        "caller": "kernel_set_ucred_attrs",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "57",
        "caller": "kernel_set_ucred_attrs",
        "kind": "call",
        "target": "kernel_copyin"
      },
      {
        "address": "11",
        "caller": "kernel_set_ucred_caps",
        "kind": "call",
        "target": "kernel_get_proc"
      },
      {
        "address": "2b",
        "caller": "kernel_set_ucred_caps",
        "kind": "call",
        "target": "kernel_copyout"
      },
      {
        "address": "57",
        "caller": "kernel_set_ucred_caps",
        "kind": "call",
        "target": "kernel_copyin"
      },
      {
        "address": "2a",
        "caller": "klog_puts",
        "kind": "call",
        "target": "INDIRECT:*%r12"
      },
      {
        "address": "47",
        "caller": "klog_puts",
        "kind": "call",
        "target": "INDIRECT:*%r12"
      },
      {
        "address": "65",
        "caller": "klog_puts",
        "kind": "call",
        "target": ".bss.snprintf"
      },
      {
        "address": "8a",
        "caller": "klog_puts",
        "kind": "call",
        "target": "INDIRECT:*%r15"
      },
      {
        "address": "9e",
        "caller": "klog_puts",
        "kind": "call",
        "target": "__crt_syscall"
      },
      {
        "address": "17b",
        "caller": "nid_encode",
        "kind": "call",
        "target": ".text.SHA1Transform"
      },
      {
        "address": "24d",
        "caller": "nid_encode",
        "kind": "call",
        "target": ".text.SHA1Transform"
      },
      {
        "address": "2e0",
        "caller": "nid_encode",
        "kind": "call",
        "target": ".text.SHA1Transform"
      },
      {
        "address": "447",
        "caller": "nid_encode",
        "kind": "call",
        "target": ".text.SHA1Transform"
      },
      {
        "address": "99",
        "caller": "nid_encode",
        "kind": "call",
        "target": ".text.SHA1Transform"
      },
      {
        "address": "ca",
        "caller": "nid_encode",
        "kind": "call",
        "target": ".text.SHA1Transform"
      }
    ],
    "reachable_functions": [
      "__crt_syscall",
      "__crt_syscall_init",
      "__kernel_init",
      "__klog_init",
      "__patch_init",
      "__rtld_dlfcn_init",
      "__rtld_dlfcn_setroot",
      "__rtld_init",
      "__rtld_lib_close",
      "__rtld_lib_destroy",
      "__rtld_lib_fini",
      "__rtld_lib_init",
      "__rtld_lib_open",
      "__rtld_payload_init",
      "__rtld_payload_new",
      "__rtld_so_init",
      "__rtld_sprx_init",
      "_start",
      "kernel_copyin",
      "kernel_copyout",
      "kernel_dynlib_dlsym",
      "kernel_dynlib_handle",
      "kernel_dynlib_obj",
      "kernel_dynlib_resolve",
      "kernel_get_proc",
      "kernel_get_ucred_attrs",
      "kernel_get_ucred_caps",
      "kernel_set_ucred_attrs",
      "kernel_set_ucred_caps",
      "klog_puts",
      "nid_encode"
    ],
    "reachable_prohibited_functions": [
      "__patch_init",
      "kernel_copyin",
      "kernel_copyout",
      "kernel_set_ucred_attrs",
      "kernel_set_ucred_caps"
    ],
    "relocation_count": 1033,
    "relocation_table_sha256": "8c4db854706e3ddd1f5b068f891a242c3917d13f39b1ea388242bdd65ca5fbce",
    "section_table_sha256": "65934dd9fcee1ea5333669ec2dd2204c6d0e7197e5f96a677d08c234f3b64c48",
    "source_token_inventory": {
      "GNM": false,
      "SDL": false,
      "VideoOut": false,
      "module_loading": true,
      "network_socket_helper": true
    },
    "tls_sections": []
  },
  "custom_artifact_verification": {
    "artifact_sha256": null,
    "disassembly": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
    "double_clean_build": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
    "dt_needed": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
    "init_fini_arrays": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
    "linker_map": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
    "relocations": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
    "tls": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD",
    "undefined_symbols": "NOT_PERFORMED_BLOCKED_BEFORE_BUILD"
  },
  "decision": "BLOCKED",
  "loader_evidence": {
    "callee_first_argument_register_rdi": "SAFE_DISASSEMBLY_FACT",
    "caller_source_present": false,
    "caller_stack_alignment": "UNPROVEN",
    "crash_cleanup": "UNPROVEN",
    "entry_argument_layout": "SAFE_SOURCE_FACT",
    "exact_loader_used_for_firmware_9_60_identified": false,
    "local_non_sdk_contract_hits": {
      "RetroArch": [],
      "SDL": [],
      "pacbrew-repo": [],
      "ps5-linux-loader": []
    },
    "payloadout_lifetime_and_writability": "UNPROVEN",
    "post_return_cleanup": "UNPROVEN",
    "pre_entry_loader_process_changes": "UNPROVEN",
    "return_address_and_return_consumption": "UNPROVEN",
    "sdk_readme_loader_candidates": [
      "ps5-payload-dev/elfldr",
      "cryonumb/elfloader via ps5-jar-loader",
      "shahrilnet/remote_lua_loader"
    ]
  },
  "minimal_missing_evidence": [
    "the exact loader and pinned source commit used on firmware 9.60",
    "the caller instruction sequence that establishes RDI, RSP alignment, and return address",
    "payload_args_t allocation, payloadout lifetime, writability, and ownership",
    "the caller path after _start returns, including restoration and cleanup",
    "crash/fault behavior before and during _start",
    "all process, credential, syscall, module, and memory changes made before entry"
  ],
  "review": [
    {
      "basis": "public SDK header plus _start payloadout access at offset 0x28",
      "component": "payload_args_t field order and 48-byte x86_64 layout",
      "status": "SAFE"
    },
    {
      "basis": "source, relocation, and reachable disassembly prove kernel-write paths",
      "component": "SDK v0.41 default crt1.o",
      "status": "UNSAFE"
    },
    {
      "basis": "compiler -### trace only; no output ELF was produced",
      "component": "-nostartfiles -nodefaultlibs removes SDK CRT/default libs",
      "status": "SAFE"
    },
    {
      "basis": "linker symbols and byte-zero loop can be freestanding",
      "component": "custom BSS zeroing implementation",
      "status": "SAFE"
    },
    {
      "basis": "callee disassembly does not prove caller behavior",
      "component": "loader entry stack and ABI preconditions",
      "status": "UNPROVEN"
    },
    {
      "basis": "no exact pinned public loader caller source is locally available",
      "component": "return, exit, crash, and cleanup behavior",
      "status": "UNPROVEN"
    },
    {
      "basis": "payload args expose pre-existing kernel access but not how it was established",
      "component": "loader changes before _start",
      "status": "UNPROVEN"
    }
  ],
  "safe_alternatives": [
    "continue libchimera-gfx through mock and software backends",
    "develop a separately scoped Linux-on-PS5 backend as a long-term track"
  ],
  "schema_version": 1,
  "scope": "phase-0.5-kernelwrite-free-startup-offline-only",
  "sdk": {
    "commit": "d2e2e585740362976a39fdd5ccf390f199a7bc37",
    "release": "v0.41",
    "source_hashes": {
      "Makefile.inc": "57a78c9d6d9cefa8e4da873e0c1be119ac8b255ad8d6823b42124310e15bf4f0",
      "crt/Makefile": "6a62f777f32ab05cbe7bff81c00cfd6639ba8bf440aba611a40ff0b62732568b",
      "crt/crt.c": "3875f4739ec40b33f1f4967a1acbb585a527d2c281a360153e1f69c8b945932a",
      "crt/elf.h": "fce18521dd93e6ca9dd9138cac56121918ec6d9d213fa7365b199248b145a83a",
      "crt/kernel.c": "ac1c375aae8d3cb1be5fb8bad2f4e6492b6ec1f1450977b534202f46b5b70321",
      "crt/kernel.h": "735b516fa580b48e7ee45d69f4ceef1485fc5a1b91d11611a742626cb3fa8c15",
      "crt/klog.c": "a74f262dcae14c0cfc7f8a4d9b7ee094a1148d13369286e3adaa698af64c31e5",
      "crt/klog.h": "0efd3ed80f35f1d142a885153fed296fc4905a385d1f96c95a4b811896246213",
      "crt/mdbg.c": "98add54968b138ca7fcf200e08587e0722e270960a637241bca841e75dfedc3c",
      "crt/mdbg.h": "04d6c9f4ab28814164d93945de8a729cfad785e4fb01f95765d95e60e159a81f",
      "crt/nid.c": "33c9318b89d223836108a27478691d49f107081170a42ff0392f6a029d486c8f",
      "crt/nid.h": "5997918a961b3b86011c2ef54e5988901fe98c51c6266ab3dc7de7b023d6d157",
      "crt/patch.c": "4f76a677bba54f4641e1cf2755768c29afb7464a35b2f21e85db2aa2785eceac",
      "crt/patch.h": "724eea4309d3948379a0f329f5275b37afe6c699ca4bee0a93f6b3e88852a7dc",
      "crt/payload.h": "9284a4448e1c6602297b7b46723580c6f62faeed0899dbd82c3da00ec7ddccbd",
      "crt/rtld.c": "f46d071528d13c9ca3e4ea27f6884e1a30456fd30dcd4218f7a8e7493b3244ff",
      "crt/rtld.h": "77cae43e1f0da581ce72bdbb9cb84ad9d06ef34635d4017b82d133e60c33ecf8",
      "crt/rtld_dlfcn.c": "bdb3a17aa88d1b4e4e303709fb39b72d03729a6de029b1791a1dc08a2b94637c",
      "crt/rtld_dlfcn.h": "a6706a1bbf79d3566a80daa4fe66614b4ab91107ee20140eacaca47f215f5271",
      "crt/rtld_payload.c": "5598ca0870c2c7a120507755897d76e5aad0d3a6846cee4482230650ed181f82",
      "crt/rtld_payload.h": "44cc522bb5979ead9b8f3cb576b8695ad8cfcdf45e244307667d722e3c326efd",
      "crt/rtld_so.c": "26f59cb8970001e4508a07abf4bf3507b6d58638f210c59839ac7344d3832399",
      "crt/rtld_so.h": "8c248e5993784449cab246dcf33637abcc20c7144c883583e71b95515b324621",
      "crt/rtld_sprx.c": "d9bbff93518e681cb468a7dc3aa0bb185a8071bf9bc04483081e4f8effd9e7ca",
      "crt/rtld_sprx.h": "ca4919450941be9f47a3797112255e4fbf8c4c578436b2ac2563c981d63a2209",
      "crt/syscall.c": "3482a5be32ed7f268d6db98f3b31c56156b16c634e1c63a12686e9bbc5e1b186",
      "crt/syscall.h": "66e8c3481fd5bf4828602e74d3f8acdd9ee778c2cd95793b19830b77bd963bab",
      "host/Makefile": "9b1d99324a8d4c283b9536d9a040f5b96528a5dd7cd1d8121decfe499053fb6a",
      "host/bin/prospero-clang": "0cf49ae43d6110a7606c0ee4d702fc4b5d5e1c3ae9a722945a48b80294e295ba",
      "host/bin/prospero-lld": "f48918af3717f142ea8cba89741a0eb161c43ad2db1c535b92fcae0ae899a445",
      "host/elf_x86_64.x": "169b80d01da601ef96bbc584986608dec1d9c01397eae81eccd4e1a66b0a6c6a",
      "host/toolchain/prospero.cmake": "78e376ca7d6128f97b763636a9a0283bfb5eaaadc158bb5b0a6f80969a694f74",
      "host/toolchain/prospero.mk": "214f4a39f5c14dd21a0360ac8d838be5a6d9a7ffe92962274ca84e6c0eb06f62",
      "host/toolchain/prospero.sh": "e503a8c8c78a0fb5b3c2f74963bbb8dc52303b9c7d57ca9fdc2c1ab3fb0354d9",
      "include/ps5/payload.h": "32f8808c1caddeb2bef367ce99b278b79ff70b883854262f0b287c3cc920593e"
    },
    "target": "x86_64-sie-ps5"
  },
  "startup_linkage": {
    "crt1_composition": [
      {
        "object": "crt.o",
        "source": "crt/crt.c"
      },
      {
        "object": "syscall.o",
        "source": "crt/syscall.c"
      },
      {
        "object": "klog.o",
        "source": "crt/klog.c"
      },
      {
        "object": "nid.o",
        "source": "crt/nid.c"
      },
      {
        "object": "kernel.o",
        "source": "crt/kernel.c"
      },
      {
        "object": "rtld.o",
        "source": "crt/rtld.c"
      },
      {
        "object": "rtld_so.o",
        "source": "crt/rtld_so.c"
      },
      {
        "object": "rtld_sprx.o",
        "source": "crt/rtld_sprx.c"
      },
      {
        "object": "rtld_payload.o",
        "source": "crt/rtld_payload.c"
      },
      {
        "object": "rtld_dlfcn.o",
        "source": "crt/rtld_dlfcn.c"
      },
      {
        "object": "mdbg.o",
        "source": "crt/mdbg.c"
      },
      {
        "object": "patch.o",
        "source": "crt/patch.c"
      }
    ],
    "crt1_sha256": "0e4c1e5e38f22026580e856238a53e75d9e112f99a34bfe5495a3a0ffac15238",
    "crt1_undefined_symbols": [
      "_DYNAMIC",
      "__bss_end",
      "__bss_start",
      "__fini_array_end",
      "__fini_array_start",
      "__image_end",
      "__image_start",
      "__init_array_end",
      "__init_array_start",
      "main"
    ],
    "default_driver_additions": [
      "target/lib/crt1.o",
      "libc",
      "libkernel_web",
      "libSceLibcInternal",
      "libSceNet"
    ],
    "default_driver_trace_sha256": "cd0d3b31ae97e78d6e7752ac096b1d56a516706705dfcd83c1aedc2e18e48fc2",
    "empty_startup_archives": {
      "crtbegin.o": [],
      "crtbeginS.o": [],
      "crtend.o": [],
      "crtendS.o": [],
      "crti.o": [],
      "crtn.o": []
    },
    "freestanding_driver_additions": [],
    "freestanding_driver_trace_sha256": "71023b3810af87380e9fc17ce76e9093b29636355c6265814d61e1aa75231929",
    "freestanding_flags": [
      "-nostartfiles",
      "-nodefaultlibs"
    ],
    "installed_linker_script_sha256": "3bacf56a21602a1298752023a4c5b0c305954ddf6cdbce1464476fc9da9d9093",
    "installed_main_script_sha256": "3bacf56a21602a1298752023a4c5b0c305954ddf6cdbce1464476fc9da9d9093",
    "installed_prx_script_sha256": "3bacf56a21602a1298752023a4c5b0c305954ddf6cdbce1464476fc9da9d9093"
  },
  "tool_versions": {
    "objdump": "Ubuntu LLVM version 18.1.8",
    "prospero_clang": "Ubuntu clang version 18.1.8 (20ubuntu8)",
    "prospero_lld": "Ubuntu LLD 18.1.8 (compatible with GNU linkers)",
    "readelf": "GNU readelf (GNU Binutils for Ubuntu) 2.46"
  }
}