Phase 1.0C PS5 device smoke result

Date: 2026-07-19

Local window: 16:19–16:31 CEST

Classification: DEVICE_SMOKE_PARTIAL

Result

The exact Phase-1.0B candidate was rebuilt, reopened, and verified before device contact:

artifact: retroarch_ps5_software_smoke.elf;
size: 1,826,216 bytes;
SHA-256: 16c04afe26c490b5071388dc9a32524d09d50d181b1baffbbc54bd96f0c2c688;
linker-map SHA-256: 21dfdaa44261f8d546fa9ea71102162dc880a8ca8037526019a04fece5b21313;
Phase-1.0B build-manifest SHA-256: 8ee4305bc2d7e5d75d3f7a4b0b335de39c68932ca49c199310cda9f2279dd69f.

The complete offline preflight passed: both repositories and pinned upstreams were clean and exact, the clean target rebuild reproduced the authorized identity, the artifact remained stable across reopen and rehash, all 30 Chimera GFX CTest cases passed, all 26 Phase-1.0B Python guardrails passed, and the RetroArch host smoke, fault, sanitizer, import, relocation, segment, exit-path, and persistent-write checks passed.

No Phase-1.0C target, sender, installation, autoload, or device-management code was created.

Authorization and attempts

The operator confirmed all twelve device-preflight statements immediately before the first connection. The first artifact-specific authorization permitted one connection, transfer, execution attempt, and 75-second observation. That transfer completed locally, but the operator's display was off, so no screen evidence was obtained. The operator reported that the console had not hung and still functioned normally.

The operator then explicitly overrode the no-later-action boundary and issued a new manual authorization for one additional run of the same hash-bound artifact to the same session address. This was a separately initiated manual action, not an automatic retry. The artifact and sender were reopened and rehashed before the second connection. The second transfer also completed locally. During the second 75-second window the operator observed no visible change and reported that the console continued to respond normally.

Counter	Result
TCP connections opened by the selected sender	2
complete local `sendall` operations	2
bytes offered per operation	1,826,216
loader execution attempts requested	2
executions independently observed	0
automatic retries	0
further attempts	0

The second action is recorded because it occurred, but it does not retroactively change the scope of the first authorization. No third attempt is authorized or performed.

Transport evidence

The selected client was the existing official Y2JB source-controlled sender:

source: Gezine/Y2JB@0dbbf4e7e0203af7e5d101a3256c634edf4e3ba2:payload_sender.py;
sender SHA-256: 8c87920c41dbdbd66b9f36ca9509f0d6bef9170f351dd97ff831cfb98e642ec6;
transport: one IPv4 TCP connection per invocation, explicit port 9021;
local input: binary read of the selected ELF;
send behavior: CPython sendall, which completes all local sends or raises;
retry/resume: absent;
response/acknowledgement: absent;
close: after successful sendall.

The audited hardened elfldr source at 197623058f509eddde18868dafcb92fdcac66464 recognizes raw ELF magic, receives the complete ELF extent into memory, and makes one spawn attempt without filesystem staging, installation, rename, deletion, or live-file replacement. That local source identity is transport evidence, not byte-exact proof of the currently running device listener.

Both sender invocations exited successfully and reported 1,826,216 locally sent bytes. Because the raw route has no peer acknowledgement, remote receipt, parse completion, child creation, entry, and exit are not independently proven.

Device observations

Observation	Result
anonymized device ID	`PS5-FW960-SESSION-A`
firmware source	operator confirmation from PS5 UI
raw firmware value	`9.60`
first visible phase	`UNOBSERVED`
last visible phase	`UNOBSERVED`
first error code	`UNOBSERVED`
write-firewall status	`UNOBSERVED`
video/title/frame/flip	no visible change observed
controller/digital/sticks	not observed
audio/submits	not observed
Options shutdown	not observed
automatic deadline	not observed
process exit	not observed
host observation windows	75,235 ms and 75,405 ms
console response after attempts	normal according to operator
jailbreak/elfldr session	not independently tested after the attempts
reboot needed	no
unexpected persistent effect	none reported; not independently inspected
photo/video evidence	none

The first window supplied no visual evidence because the display was off. The second window supplied a direct negative observation: no visible change occurred while the console remained responsive.

Classification and remaining risk

This result is DEVICE_SMOKE_PARTIAL, specifically:

NO_VISIBLE_OUTPUT; REMOTE_EXECUTION_AND_ENTRY_UNCONFIRMED; CONSOLE_RESPONSIVE

It is not a pass. The evidence does not prove S00, S07, any error code, VideoOut, Pad, AudioOut, the runtime deadline, teardown, or _Exit. It is not a session-recoverable failure because no crash, hang, lost session, or reboot need was observed. It is not a transfer failure because both host-side sendall operations completed, although the protocol cannot attest peer receipt or execution.

The remaining focused questions are:

whether the deployed port-9021 listener is byte-equivalent to the audited hardened source;
whether it accepted and parsed the complete ELF;
whether child creation or _start failed before the first visible frame;
whether VideoOut initialization failed without a visible reporting path;
whether the process ran and exited before the display showed a frame.

No installation, autoload change, persistent staging, Payload Manager request, live-file replacement, delete, cleanup write, automatic retry, or reboot command was performed.

Next phase

The exact proposed next implementation phase is:

PHASE 1.0D — OFFLINE LOADER-TO-ENTRY AND EARLIEST-VISIBLE-ERROR DIAGNOSIS

It must remain host/offline work until separately reviewed. It should focus only on distinguishing loader receipt, child entry, and pre-first-frame VideoOut failure using already public, bounded userland contracts. It must not introduce installation, autoload, dynamic cores, GNM, or another device run.

6.3 KiB Raw Blame History Unescape Escape