chimera-gfx-Public/docs/retroarch/phase-1.0b-device-risk-assessment.md

Phase 1.0B device risk assessment

Overall classification: RETROARCH_PS5_DEVICE_SMOKE_CANDIDATE_BUILT_WITH_DECLARED_RISKS.

Hard boundaries satisfied offline

• no PS5 connection, request, transfer or execution occurred;
• no installation, autoload, live replacement, sender or retry exists;
• no content/config file is required;
• persistent write attempts fail closed;
• the run requests shutdown at 60 seconds or 3,600 frames;
• Options held for two seconds provides an additional shutdown;
• the final ELF contains no SceNet, GNM, module-loader, installer, mount, reboot, console-shutdown or other-payload launch import;
• SDL's dynamic API and runtime assertion-exit path are disabled, leaving one smoke-owned post-teardown _Exit callsite;
• the primary ELF contains no permanent W+X load segment.

The strings audit still sees shared RetroArch localization text for disabled network, autoload and reboot menu entries, plus the generic udp://127.0.0.1: template. These are inert data findings, not hidden functionality: the complete undefined-symbol inventory has no networking primitive, and no RetroArch network callgraph is linked. SDK runtime-loader symbol-name strings remain separately because the pinned CRT resolves its own loader at runtime.

Declared device-test risks

Risk	Class	Bounded mitigation	Residual
SDK CRT temporary kernel/process patches before main	session/integrity	exact SDK v0.41 source and controlled runtime identity	firmware-9.60 effect unobserved
SDK CRT runtime loader	session/initialization	exact source and DT_NEEDED inventory; no RetroArch dynamic-core path	CRT resolves sceKernelLoadStartModule at runtime and can conditionally load libSceSysmodule; this is not visible as an ELF import
sceAudioOutOutput is blocking	session hang	SDL worker, error counters, outer 60 s policy	no public timeout ABI; thread/join can still block
VideoOut/Pad/AudioOut open calls lack an evidenced timeout variant	session hang	single attempt, no retry, partial cleanup	underlying call can outlive outer policy
direct-memory mapping has no separately evidenced unmap in pinned SDL headers	cleanup	release direct memory and process exit	mapping cleanup before exit is incomplete/unproven
new RX/R/RW layout	child/session crash	source-bound loader flag handling and relocation audit	device behavior unobserved
_Exit in injected child	session termination	one smoke-owned call after teardown; SDL secondary exit paths compiled out	exact firmware behavior unobserved; SDK init-failure fallback still owns its separate exit path
write firewall relies partly on link wrapping	integrity	VFS guard plus import/disassembly/callgraph audit	libc-internal behavior is not intercepted
controller mapping differs from label conventions	operability	source-bound Options-to-SDL-Back-to-RetroArch-Select chain	on-device button observation absent

These are not brick-safety guarantees. A later operator must explicitly accept possible black screen, missing audio/input, process crash, lost jailbreak/host session, forced manual reboot after a hang, and no diagnostic after video teardown.

The missing byte-exact Payload Manager backup remains a separate installation blocker. This candidate does not alter that gate because it is not an installation proposal.