50 lines
3.3 KiB
Markdown
50 lines
3.3 KiB
Markdown
# Phase 1.0B device risk assessment
|
|
|
|
Overall classification:
|
|
`RETROARCH_PS5_DEVICE_SMOKE_CANDIDATE_BUILT_WITH_DECLARED_RISKS`.
|
|
|
|
## Hard boundaries satisfied offline
|
|
|
|
- no PS5 connection, request, transfer or execution occurred;
|
|
- no installation, autoload, live replacement, sender or retry exists;
|
|
- no content/config file is required;
|
|
- persistent write attempts fail closed;
|
|
- the run requests shutdown at 60 seconds or 3,600 frames;
|
|
- Options held for two seconds provides an additional shutdown;
|
|
- the final ELF contains no SceNet, GNM, module-loader, installer, mount,
|
|
reboot, console-shutdown or other-payload launch import;
|
|
- SDL's dynamic API and runtime assertion-exit path are disabled, leaving one
|
|
smoke-owned post-teardown `_Exit` callsite;
|
|
- the primary ELF contains no permanent W+X load segment.
|
|
|
|
The strings audit still sees shared RetroArch localization text for disabled
|
|
network, autoload and reboot menu entries, plus the generic
|
|
`udp://127.0.0.1:` template. These are inert data findings, not hidden
|
|
functionality: the complete undefined-symbol inventory has no networking
|
|
primitive, and no RetroArch network callgraph is linked. SDK runtime-loader
|
|
symbol-name strings remain separately because the pinned CRT resolves its
|
|
own loader at runtime.
|
|
|
|
## Declared device-test risks
|
|
|
|
| Risk | Class | Bounded mitigation | Residual |
|
|
|---|---|---|---|
|
|
| SDK CRT temporary kernel/process patches before `main` | session/integrity | exact SDK v0.41 source and controlled runtime identity | firmware-9.60 effect unobserved |
|
|
| SDK CRT runtime loader | session/initialization | exact source and DT_NEEDED inventory; no RetroArch dynamic-core path | CRT resolves `sceKernelLoadStartModule` at runtime and can conditionally load `libSceSysmodule`; this is not visible as an ELF import |
|
|
| `sceAudioOutOutput` is blocking | session hang | SDL worker, error counters, outer 60 s policy | no public timeout ABI; thread/join can still block |
|
|
| VideoOut/Pad/AudioOut open calls lack an evidenced timeout variant | session hang | single attempt, no retry, partial cleanup | underlying call can outlive outer policy |
|
|
| direct-memory mapping has no separately evidenced unmap in pinned SDL headers | cleanup | release direct memory and process exit | mapping cleanup before exit is incomplete/unproven |
|
|
| new RX/R/RW layout | child/session crash | source-bound loader flag handling and relocation audit | device behavior unobserved |
|
|
| `_Exit` in injected child | session termination | one smoke-owned call after teardown; SDL secondary exit paths compiled out | exact firmware behavior unobserved; SDK init-failure fallback still owns its separate `exit` path |
|
|
| write firewall relies partly on link wrapping | integrity | VFS guard plus import/disassembly/callgraph audit | libc-internal behavior is not intercepted |
|
|
| controller mapping differs from label conventions | operability | source-bound Options-to-SDL-Back-to-RetroArch-Select chain | on-device button observation absent |
|
|
|
|
These are not brick-safety guarantees. A later operator must explicitly
|
|
accept possible black screen, missing audio/input, process crash, lost
|
|
jailbreak/host session, forced manual reboot after a hang, and no diagnostic
|
|
after video teardown.
|
|
|
|
The missing byte-exact Payload Manager backup remains a separate installation
|
|
blocker. This candidate does not alter that gate because it is not an
|
|
installation proposal.
|