# Phase 1.0B device risk assessment

Overall classification:
`RETROARCH_PS5_DEVICE_SMOKE_CANDIDATE_BUILT_WITH_DECLARED_RISKS`.

## Hard boundaries satisfied offline

- no PS5 connection, request, transfer or execution occurred;
- no installation, autoload, live replacement, sender or retry exists;
- no content/config file is required;
- persistent write attempts fail closed;
- the run requests shutdown at 60 seconds or 3,600 frames;
- Options held for two seconds provides an additional shutdown;
- the final ELF contains no SceNet, GNM, module-loader, installer, mount,
  reboot, console-shutdown or other-payload launch import;
- SDL's dynamic API and runtime assertion-exit path are disabled, leaving one
  smoke-owned post-teardown `_Exit` callsite;
- the primary ELF contains no permanent W+X load segment.

The strings audit still sees shared RetroArch localization text for disabled
network, autoload and reboot menu entries, plus the generic
`udp://127.0.0.1:` template. These are inert data findings, not hidden
functionality: the complete undefined-symbol inventory has no networking
primitive, and no RetroArch network callgraph is linked. SDK runtime-loader
symbol-name strings remain separately because the pinned CRT resolves its
own loader at runtime.

## Declared device-test risks

| Risk | Class | Bounded mitigation | Residual |
|---|---|---|---|
| SDK CRT temporary kernel/process patches before `main` | session/integrity | exact SDK v0.41 source and controlled runtime identity | firmware-9.60 effect unobserved |
| SDK CRT runtime loader | session/initialization | exact source and DT_NEEDED inventory; no RetroArch dynamic-core path | CRT resolves `sceKernelLoadStartModule` at runtime and can conditionally load `libSceSysmodule`; this is not visible as an ELF import |
| `sceAudioOutOutput` is blocking | session hang | SDL worker, error counters, outer 60 s policy | no public timeout ABI; thread/join can still block |
| VideoOut/Pad/AudioOut open calls lack an evidenced timeout variant | session hang | single attempt, no retry, partial cleanup | underlying call can outlive outer policy |
| direct-memory mapping has no separately evidenced unmap in pinned SDL headers | cleanup | release direct memory and process exit | mapping cleanup before exit is incomplete/unproven |
| new RX/R/RW layout | child/session crash | source-bound loader flag handling and relocation audit | device behavior unobserved |
| `_Exit` in injected child | session termination | one smoke-owned call after teardown; SDL secondary exit paths compiled out | exact firmware behavior unobserved; SDK init-failure fallback still owns its separate `exit` path |
| write firewall relies partly on link wrapping | integrity | VFS guard plus import/disassembly/callgraph audit | libc-internal behavior is not intercepted |
| controller mapping differs from label conventions | operability | source-bound Options-to-SDL-Back-to-RetroArch-Select chain | on-device button observation absent |

These are not brick-safety guarantees. A later operator must explicitly
accept possible black screen, missing audio/input, process crash, lost
jailbreak/host session, forced manual reboot after a hang, and no diagnostic
after video teardown.

The missing byte-exact Payload Manager backup remains a separate installation
blocker. This candidate does not alter that gate because it is not an
installation proposal.