fix(gta): restore wiped GTA foundation and gameplay path (PPSA04264) (#650)

* fix(kernel): implement APR ResolveFilepathsWithPrefixToIdsAndFileSizes

Resource streamers resolve relative paths against a shared prefix; without
this HLE every call returned NOT_FOUND and assets never got real ids/sizes.

* fix(remoteplay): stub Initialize and GetConnectionStatus as disconnected

Titles probe Remote Play during pad/network bring-up; unresolved imports
returned NOT_FOUND. Report initialized + disconnected so callers take the
normal offline path.

* fix(agc): accept Gen5 hull shaders that omit PGM_LO/HI in CreateShader

Type-5 headers can start with RSRC1/RSRC2; rejecting them left null handles
and Main Thread AVs. Scan the SH table and skip PGM patch when absent.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(kernel): reject getdents on file fds and emit . / .. for empty dirs

Returning rax=0 for non-directory or empty listings looked like EOF and
let GTA treat the fd as a pointer (fiWriteAsyncDataWorker AV at 0xB1).

* fix(hle): enable GuestImageWriteTracker CPU sync on Windows

Windows previously hard-disabled the tracker, so CPU-written guest
planes never marked dirty and host textures stayed empty. Arm pages
with VirtualProtect, handle write AVs in VEH, and warm/test on
VirtualAlloc memory so protect cannot poison the CRT heap.

* fix(agc): skip CB metadata draws for EliminateFastClear/Fmask/DCC

CB_COLOR_CONTROL modes 2/5/6 are colour-buffer metadata ops; applying
the bound shader as a normal colour draw corrupts subsequent composites.
Decode MODE from bits [6:4] and return before translate.

* fix(agc): merge Prospero attrib-table formats onto IR vertex inputs

IR-discovered BufferLoadFormat often keeps a stale float sharp format;
patch DataFormat/offset from the AGC attrib table (semantic index),
allow offen fetches, and map quirks 113/121 through NarrowVk for host
vertex input.

* fix(audio): harden AudioOut2 stack out-buffer writes against canary smash

Titles that stack-allocate AudioOut2 outs next to the frame canary were
corrupted by oversized or mistyped HLE writes; keep ContextPush pacing.

* Revert "fix(memory): reserve only large regions (#608)"

This reverts commit 8f9456229a.

* fix(gpu): decode Gen5 R16 and RG32 render-target formats

* fix(audio): AudioOut2 host beds, deeper waveOut queue, AJM MP3

GTA V Enhanced routes intro/menu audio through AudioOut2 and FMOD's AJM
MP3 path. Wire PortCreate/PortSetAttributes/ContextPush to dual host
stereo streams, deepen WinMM queue to 128KiB, and decode AJM codec 0
with a stateful NLayer helper so menu music is not silent.

* fix(agc): map PS interpolants via SPI_PS_INPUT_CNTL semantics

Identity ATTR→param wiring ignored hardware remapping, so UI draws
got wrong (or empty) interpolants. Pack CNTL from matched PS/GS
semantics, thread it into Vulkan/Metal as Location/Flat, and fingerprint
it in the graphics shader cache key.

* fix(agc): rect-list/NGG strips, Index8 expand, and GE_INDX_OFFSET

NGG single-rect UI needs triangle-strip expansion; Prospero Index8 must
expand to host u16; glyphs need base vertex from GE_INDX_OFFSET. Skip
param-less rect-lists instead of inventing colour draws.

* fix(np): report GTA Story Mode addcont entitlements as owned

NpEntitlementAccess was returning an empty add-on list, so GTA V Enhanced offered Buy Story Mode. Publish the installed license labels and stub premium-event registration so offline sessions take the owned path.

* fix(cpu): prefer native workers for all guest entry stubs

Route thread entry, continuation, and main entry through RunGuestEntryStub so guest stubs are not invoked above CLR-managed frames (UnmanagedCallersOnly FailFast). Keep requireNativeWorker for tbb_thead; other paths prefer workers with calli fallback.

* fix(agc): implement Rewind/Jump writers and IT_REWIND waits

GTA Subrender AVs came from AcbJumpGetSize / DcbRewind returning NOT_FOUND as packet sizes. Add IT_REWIND and INDIRECT_BUFFER writers, patch SetRewindState into the GPU wait registry, and nest-parse 4-dword jumps.

* fix(gpu): use AddrLib ExactXor for Gen5 Standard256B (mode 1)

Mode 5 already had Standard4K ExactXor; mode 1 still used the generic StandardSwizzle block table, which mis-detiles Gen5 UI atlases.

* Revert "fix(cpu): prefer native workers for all guest entry stubs"

This reverts commit 31c4db0d38.

* fix(memory): commit-first large maps; reserve only on failure

Replace the #608 always-reserve-only exact-map path with allocate-first and lazy reserve fallback when a huge non-exec commit cannot be satisfied. Prime and widen GetPointer commit so the fallback path is safer for native walkers. Drops the need for a hard #608 revert.

* [Agc] Implement fused shader half exports

* fix(agc): accept optional hull state in CreatePrimState

Port the CreatePrimState hull-optional path from #583 so fused HS pipelines (GTA) are not rejected with INVALID_ARGUMENT. Geometry-derived CX/UC writes are unchanged; hull is traced only.

* fix(videoout): restore thread-safe VulkanHostBufferPool (#564)

The 6db095e wipe dropped CasualcoderDev's lock-ordering-safe pool. Concurrent Return/TryTake without the gate races after the first present and can hang the submit path.

* Revert "fix(agc): implement Rewind/Jump writers and IT_REWIND waits"

This reverts commit bec77bf083.

* test(memory): align lazy-commit expectations with commit-first policy

Fake hosts must reject Allocate so reserve-only paths still run, and GetPointer asserts the 32 MiB prime range including AlignUp spill.

* diag(gpu): log guest-queue backlog breakdown under backpressure

Rate-limit top work types and ordered debugName prefixes when the Vulkan guest work queue stalls, so North Yankton logs show acquire/label vs draw traffic instead of only VulkanOrderedGuestAction.

* perf(agc): coalesce acquire flushes and batch non-DMA label wakes

Flush pending ACQUIRE_MEM invalidation at draw/dispatch/dma/flip boundaries instead of before every packet, and complete release/write-data producers in the same ordered action so load paths enqueue far fewer VulkanOrderedGuestAction items.

* perf(gpu): wait for ordered-action fences and keep draining sync

On Windows/Linux, block briefly for queue-visibility fences instead of deferring the whole logical queue for the tick. Prefer ordered sync/flip heads under backlog pressure, and keep macOS non-blocking defer behavior.

* perf(gpu): raise sync-item ceiling above payload guest-work cap

Apply SHARPEMU_PENDING_GUEST_WORK_ITEMS mainly to compute/draw/image payload work, and allow a higher SHARPEMU_PENDING_GUEST_SYNC_ITEMS ceiling for zero-payload ordered actions and flip markers. Keep the byte budget as the RAM safety valve.

* fix(gta): stub Voice ports and implement sceKernelCheckReachability

Resolve North Yankton-path Voice Create/Delete/Connect/Disconnect/End NIDs and EnumerationThread reachability checks so leftover unresolved imports are not on the critical path.

* diag(gta): arm flip/present/wait probes after North Audio

Rate-limited load_progress TRACE for flip submit, ordered flip enqueue, present taken/not-taken, and GPU wait backlog so North Yankton freezes can be classified without full AGC tracing.

* fix(ampr): restore sequential offset=-1 reads for streamer packs

Re-wire PakDirectoryTracker into sceAmprAprCommandBufferReadFile (dropped in #216) so RAGE sequential pack reads no longer fail while the North Yankton UI keeps flipping. Also rate-limit CheckReachability miss paths for EnumerationThread diagnosis.

* fix(hle/videoout): Windows GuestImage opt-in and keep GTA intro without sync

Default the tracker off on Windows to avoid VirtualProtect thrash, gate AGC
texel-copy skips on Enabled so guest Bink planes keep shipping pixels, and
drain CPU-written images on the present thread when sync is opted in.

* fix(videoout): probe guest content when tracker off so UI can skip copies

Restores upload-known/texture-cache skips for Dead Cells menus, and uses a
sparse guest-memory fingerprint when GuestImageWriteTracker is disabled so
CPU-updated Bink planes still force texel copies for GTA intro.

* fix(audio): keep 128KiB host queue AudioOut2-only

Restore the default 32 KiB (~171 ms) PCM bed for classic AudioOut so
titles like Dreaming Sarah stay in sync; only AudioOut2 opens the deeper
queue needed for bursty FMOD Push on GTA.

---------

Co-authored-by: samto6 <123419830+samto6@users.noreply.github.com>

Directory.Packages.props

@@ -17,6 +17,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="3.11.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.12.0" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageVersion Include="NLayer" Version="1.14.0" />
     <PackageVersion Include="Silk.NET.Input" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.EXT" Version="2.23.0" />

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Exceptions.cs

@@ -55,6 +55,7 @@ public sealed partial class DirectExecutionBackend
 		}
 		_exceptionHandler = (nint)AddVectoredExceptionHandler(1u, _exceptionHandlerStub);
 		Console.Error.WriteLine($"[LOADER][INFO] Exception handler installed: 0x{_exceptionHandler:X16}");
+		SharpEmu.HLE.GuestImageWriteTracker.WarmUp();
 
 		_unhandledFilterDelegate = UnhandledExceptionFilter;
 		_unhandledFilterHandle = GCHandle.Alloc(_unhandledFilterDelegate);
@@ -117,6 +118,13 @@ public sealed partial class DirectExecutionBackend
 			{
 				return -1;
 			}
+			if (exceptionCode == 3221225477u &&
+				exceptionRecord->NumberParameters >= 2 &&
+				SharpEmu.HLE.GuestImageWriteTracker.TryHandleWriteFault(
+					exceptionRecord->ExceptionInformation[1]))
+			{
+				return -1;
+			}
 			if (TryRecoverAuxiliaryThreadExecuteFault(exceptionRecord, contextRecord, rip))
 			{
 				return -1;

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Imports.cs

@@ -69,6 +69,15 @@ public sealed partial class DirectExecutionBackend
 
 	private unsafe static int RawVectoredHandlerManaged(void* exceptionInfo)
 	{
+		EXCEPTION_RECORD* exceptionRecord = ((EXCEPTION_POINTERS*)exceptionInfo)->ExceptionRecord;
+		if (exceptionRecord->ExceptionCode == 3221225477u &&
+			exceptionRecord->NumberParameters >= 2 &&
+			SharpEmu.HLE.GuestImageWriteTracker.TryHandleWriteFault(
+				exceptionRecord->ExceptionInformation[1]))
+		{
+			return -1;
+		}
+
 		return TryRecoverUnresolvedSentinel(exceptionInfo);
 	}
 

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.cs

@@ -13,6 +13,7 @@ using SharpEmu.Core.Cpu.Debugging;
 using SharpEmu.Core.Loader;
 using SharpEmu.Core.Memory;
 using SharpEmu.HLE;
+using SharpEmu.Libs.Diagnostics;
 
 namespace SharpEmu.Core.Cpu.Native;
 
@@ -3651,6 +3652,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			$"[LOADER][INFO] Scheduled guest thread '{thread.Name}' handle=0x{thread.ThreadHandle:X16} " +
 			$"entry=0x{thread.EntryPoint:X16} arg=0x{thread.Argument:X16} priority={thread.Priority} " +
 			$"host_priority={MapGuestThreadPriority(thread.Priority)} affinity=0x{thread.AffinityMask:X}");
+		LoadProgressDiagnostics.ArmIfNorthAudioThread(thread.Name);
 		Pump(creatorContext, "pthread_create");
 		// Pump is suppressed while another cooperative dispatch is active. The
 		// background dispatcher would eventually observe this thread, but an

src/SharpEmu.Core/Memory/PhysicalVirtualMemory.cs

@@ -238,15 +238,22 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         var alignedSize = (size + 0xFFF) & ~0xFFFUL;
         var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
         var hostProtection = executable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
-
+        var allowLazyReserve = !executable &&
-        // Reserve address space only for very large non-executable regions; commit is done lazily later.
-        var reservedOnly = !executable &&
             alignedSize >= LargeDataReserveThreshold &&
             alignedSize > FullCommitRegionLimit;
 
-        var result = reservedOnly
+        // Commit first so titles that walk guest memory via raw host pointers
-            ? _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite)
+        // (GTA post-RenderThread workers) keep fully backed pages. Fall back to
-            : _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
+        // reserve-only + lazy commit only when a huge non-exec commit fails —
+        // that is the Poppy / large-reservation path #608 was aiming for.
+        var reservedOnly = false;
+        var result = _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
+        if (result == 0 && allowLazyReserve)
+        {
+            result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
+            reservedOnly = result != 0;
+        }
+
         if (result == 0)
         {
             return false;
@@ -260,7 +267,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             return false;
         }
 
-        var state = reservedOnly ? ReserveRegion(actualAddress, alignedSize) : "n/a";
+        var lazyPrimeState = reservedOnly ? PrimeLazyReserveRegion(actualAddress, alignedSize) : "n/a";
 
         _gate.EnterWriteLock();
         try
@@ -279,9 +286,12 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             _gate.ExitWriteLock();
         }
 
-
+        var allocationKind = reservedOnly
-        var allocationKind = executable ? "executable memory" : "data memory";
+            ? "reserved data memory (lazy commit)"
-        TraceVmem($"Allocated exact {allocationKind}: 0x{actualAddress:X16} - 0x{actualAddress + alignedSize:X16} ({alignedSize} bytes)");
+            : (executable ? "executable memory" : "data memory");
+        TraceVmem(
+            $"Allocated exact {allocationKind}: 0x{actualAddress:X16} - 0x{actualAddress + alignedSize:X16} " +
+            $"({alignedSize} bytes) lazy_prime={lazyPrimeState}");
         return true;
     }
 
@@ -312,55 +322,44 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
         var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
         var hostProtection = executable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
-        var reservedOnly = false;
+        var allowLazyReserve = !executable &&
-        var preferReserveOnly = !executable &&
             alignedSize >= LargeDataReserveThreshold &&
             alignedSize > FullCommitRegionLimit;
+        var reservedOnly = false;
 
-        ulong result = 0;
+        // Prefer a full commit. Only fall back to reserve-only when a large
-        if (preferReserveOnly)
+        // non-executable commit cannot be satisfied (see TryAllocateAtExact).
-        {
+        ulong result = _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
-            result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
-            if (result == 0 && allowAlternative)
-            {
-                result = _hostMemory.Reserve(0, alignedSize, HostPageProtection.ReadWrite);
-            }
-
-            if (result != 0)
-            {
-                reservedOnly = true;
-            }
-        }
-
-        if (result == 0)
-        {
-            result = _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
-        }
 
         if (result == 0)
         {
             if (!allowAlternative)
             {
-                throw new InvalidOperationException($"Failed to allocate exact mapping at 0x{desiredAddress:X16} ({alignedSize} bytes)");
+                if (allowLazyReserve)
-            }
-
-            TraceVmem($"Could not allocate at 0x{desiredAddress:X16}, trying any address...");
-            result = _hostMemory.Allocate(0, alignedSize, hostProtection);
-
-            if (result == 0)
-            {
-                if (!executable)
                 {
                     result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
-                    if (result == 0 && allowAlternative)
+                    reservedOnly = result != 0;
+                }
+
+                if (result == 0)
+                {
+                    throw new InvalidOperationException($"Failed to allocate exact mapping at 0x{desiredAddress:X16} ({alignedSize} bytes)");
+                }
+            }
+            else
+            {
+                TraceVmem($"Could not allocate at 0x{desiredAddress:X16}, trying any address...");
+                result = _hostMemory.Allocate(0, alignedSize, hostProtection);
+
+                if (result == 0 && allowLazyReserve)
+                {
+                    result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
+                    if (result == 0)
                     {
                         result = _hostMemory.Reserve(0, alignedSize, HostPageProtection.ReadWrite);
                     }
 
-                    if (result != 0)
+                    reservedOnly = result != 0;
-                    {
-                        reservedOnly = true;
-                    }
                 }
 
                 if (result == 0)
@@ -371,8 +370,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         }
 
         var actualAddress = result;
-
+        var lazyPrimeState = reservedOnly ? PrimeLazyReserveRegion(actualAddress, alignedSize) : "n/a";
-        var lazyPrimeState = reservedOnly ? ReserveRegion(actualAddress, alignedSize) : "n/a";
 
         _gate.EnterWriteLock();
         try
@@ -399,7 +397,11 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         return actualAddress;
     }
 
-    private string ReserveRegion(ulong actualAddress, ulong alignedSize)
+    /// <summary>
+    /// Commits the leading slice of a reserve-only region so early guest touches
+    /// succeed before on-demand <see cref="EnsureRangeCommitted"/> runs.
+    /// </summary>
+    private string PrimeLazyReserveRegion(ulong actualAddress, ulong alignedSize)
     {
         var primeBytes = Math.Min(alignedSize, LazyReservePrimeBytes);
         if (primeBytes == 0)
@@ -426,11 +428,11 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             var state = committedBytes == primeBytes
                 ? $"ok:{committedBytes:X}"
                 : $"partial:{committedBytes:X}/{primeBytes:X}";
-            TraceVmem($"region: 0x{actualAddress:X16} - 0x{actualAddress + committedBytes:X16} ({committedBytes} bytes)");
+            TraceVmem($"Primed lazy region: 0x{actualAddress:X16} - 0x{actualAddress + committedBytes:X16} ({committedBytes} bytes)");
             return state;
         }
 
-        TraceVmem($"Failed to reserve region at 0x{actualAddress:X16} ({primeBytes} bytes)!");
+        TraceVmem($"Failed to prime lazy region at 0x{actualAddress:X16} ({primeBytes} bytes), continuing with on-demand commit");
         return $"fail:{primeBytes:X}";
     }
 
@@ -1316,12 +1318,26 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         try
         {
             var region = FindRegion(virtualAddress, 1);
-            if (region is null ||
+            if (region is null)
-                (region.IsReservedOnly && !EnsureRangeCommitted(virtualAddress, 1, region)))
             {
                 return null;
             }
 
+            // Raw host pointers are walked by native/JIT code without further
+            // EnsureRangeCommitted calls. For reserve-only regions, commit a
+            // leading working-set chunk from this address so the common case
+            // does not immediately AV on the next page.
+            if (region.IsReservedOnly)
+            {
+                var regionEnd = region.VirtualAddress + region.Size;
+                var remaining = regionEnd > virtualAddress ? regionEnd - virtualAddress : 0;
+                var commitBytes = Math.Min(remaining, LazyReservePrimeChunkBytes);
+                if (commitBytes == 0 || !EnsureRangeCommitted(virtualAddress, commitBytes, region))
+                {
+                    return null;
+                }
+            }
+
             return (void*)virtualAddress;
         }
         finally

src/SharpEmu.HLE/GuestImageWriteTracker.cs

@@ -1,6 +1,7 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Diagnostics;
 using System.Globalization;
 using System.Runtime.InteropServices;
 
@@ -30,6 +31,12 @@ public static unsafe class GuestImageWriteTracker
         public ulong End;
         public int Dirty;
         public int Armed;
+        /// <summary>
+        /// When false the range is watch-only: managed writes still dirty it via
+        /// <see cref="NotifyManagedWrite"/>, but pages are never write-protected
+        /// so native CPU stores do not fault.
+        /// </summary>
+        public bool Protect;
         public int FirstCpuWriteSeen;
         public int PendingFirstCpuWrite;
         public long WriteGeneration;
@@ -80,8 +87,17 @@ public static unsafe class GuestImageWriteTracker
 
     private static RangeSnapshot _rangeSnapshot = RangeSnapshot.Empty;
 
-    private static readonly bool _enabled = !OperatingSystem.IsWindows() &&
+    // Windows defaults off: VirtualProtect fault sync still regresses titles
-        Environment.GetEnvironmentVariable("SHARPEMU_GUEST_IMAGE_CPU_SYNC") != "0";
+    // like Dead Cells / Demon's Souls. Opt in with SHARPEMU_GUEST_IMAGE_CPU_SYNC=1
+    // when a title needs CPU-written guest planes (e.g. GTA intro). Linux/macOS
+    // keep the historical opt-out (=0 disables).
+    private static readonly bool _enabled =
+        OperatingSystem.IsWindows()
+            ? string.Equals(
+                Environment.GetEnvironmentVariable("SHARPEMU_GUEST_IMAGE_CPU_SYNC"),
+                "1",
+                StringComparison.Ordinal)
+            : Environment.GetEnvironmentVariable("SHARPEMU_GUEST_IMAGE_CPU_SYNC") != "0";
     private static readonly (bool Wildcard, ulong[] Addresses) _lifetimeTraceFilter =
         ParseAddressList(Environment.GetEnvironmentVariable("SHARPEMU_TRACE_GUEST_IMAGE_ADDRS"));
     private static readonly (bool Wildcard, string[] Sources) _lifetimeSourceTraceFilter =
@@ -95,14 +111,67 @@ public static unsafe class GuestImageWriteTracker
         _enabled && _lifetimeTraceEnabled ? GetMonotonicNanoseconds() : 0;
     private static long _lifetimeTraceSequence;
 
+    private const uint PageReadonly = 0x02;
+    private const uint PageReadWrite = 0x04;
+
     [DllImport("libc", EntryPoint = "mprotect", SetLastError = true)]
     private static extern int Mprotect(nint address, nuint length, int protection);
 
     [DllImport("libc", EntryPoint = "clock_gettime", SetLastError = false)]
     private static extern int ClockGetTime(int clockId, Timespec* time);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern int VirtualProtect(
+        nint lpAddress,
+        nuint dwSize,
+        uint flNewProtect,
+        out uint lpflOldProtect);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern nint VirtualAlloc(
+        nint lpAddress,
+        nuint dwSize,
+        uint flAllocationType,
+        uint flProtect);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern int VirtualFree(nint lpAddress, nuint dwSize, uint dwFreeType);
+
+    private const uint MemCommit = 0x1000;
+    private const uint MemReserve = 0x2000;
+    private const uint MemRelease = 0x8000;
+
     public static bool Enabled => _enabled;
 
+    /// <summary>
+    /// Test/diagnostics helper: whether <paramref name="address"/> is tracked
+    /// with write protection armed (watch-only ranges report protect=false).
+    /// </summary>
+    public static bool TryGetProtectionState(
+        ulong address,
+        out bool protect,
+        out bool armed)
+    {
+        protect = false;
+        armed = false;
+        if (!_enabled)
+        {
+            return false;
+        }
+
+        lock (_gate)
+        {
+            if (!_rangesByAddress.TryGetValue(address, out var range))
+            {
+                return false;
+            }
+
+            protect = range.Protect;
+            armed = Volatile.Read(ref range.Armed) != 0;
+            return true;
+        }
+    }
+
     /// <summary>
     /// Exercises the fault-handling path once outside signal context so every
     /// branch is JIT-compiled (and, under Rosetta 2, translated) before a real
@@ -115,7 +184,17 @@ public static unsafe class GuestImageWriteTracker
             return;
         }
 
-        var scratch = NativeMemory.AllocZeroed(4096);
+        // VirtualProtect only belongs on VirtualAlloc/mmap pages. Warming on
+        // CRT heap memory makes neighbouring heap metadata read-only and
+        // crashes the process on Windows.
+        var scratch = OperatingSystem.IsWindows()
+            ? VirtualAlloc(0, 4096, MemCommit | MemReserve, PageReadWrite)
+            : (nint)NativeMemory.AllocZeroed(4096);
+        if (scratch == 0)
+        {
+            return;
+        }
+
         try
         {
             // Warm the timestamp P/Invoke used by the signal-safe scalar
@@ -129,16 +208,29 @@ public static unsafe class GuestImageWriteTracker
         }
         finally
         {
-            NativeMemory.Free(scratch);
+            if (OperatingSystem.IsWindows())
+            {
+                _ = VirtualFree(scratch, 0, MemRelease);
+            }
+            else
+            {
+                NativeMemory.Free((void*)scratch);
+            }
         }
     }
 
-    /// <summary>Registers a range and arms write protection on it.</summary>
+    /// <summary>
+    /// Registers a range. When <paramref name="protect"/> is true, arms write
+    /// protection so native stores fault and mark the range dirty. When false,
+    /// the range is watch-only (managed HLE writes still dirty via
+    /// <see cref="NotifyManagedWrite"/>) and never <c>VirtualProtect</c>'d.
+    /// </summary>
     public static void Track(
         ulong address,
         ulong byteCount,
         long sourceSequence = 0,
-        string source = "unspecified")
+        string source = "unspecified",
+        bool protect = true)
     {
         if (!_enabled || address == 0 || byteCount == 0)
         {
@@ -159,6 +251,7 @@ public static unsafe class GuestImageWriteTracker
                 // a fresh immutable range, carrying the write generation so
                 // resizes do not hide guest CPU rewrites from cache owners.
                 var writeGeneration = Volatile.Read(ref range.WriteGeneration);
+                var keepProtect = range.Protect || protect;
                 DisarmLocked(range, "replace-range");
                 _rangesByAddress.Remove(address);
                 range = new TrackedRange
@@ -167,6 +260,7 @@ public static unsafe class GuestImageWriteTracker
                     ByteCount = byteCount,
                     Start = start,
                     End = start + length,
+                    Protect = keepProtect,
                     WriteGeneration = writeGeneration,
                 };
                 _rangesByAddress[address] = range;
@@ -181,6 +275,7 @@ public static unsafe class GuestImageWriteTracker
                     ByteCount = byteCount,
                     Start = start,
                     End = start + length,
+                    Protect = protect,
                     TraceLifetime =
                         ShouldTraceRange(start, start + length) || ShouldTraceSource(source),
                     SourceSequence = sourceSequence,
@@ -192,13 +287,22 @@ public static unsafe class GuestImageWriteTracker
             else
             {
                 FlushPendingFirstCpuWrite(range);
+                // Protect is sticky: a later watch-only Track (texture cache)
+                // must not disarm an RT that already needs page faults.
+                if (protect && !range.Protect)
+                {
+                    range.Protect = true;
+                }
             }
 
             range.SourceSequence = sourceSequence;
             range.Source = source;
             range.TraceLifetime =
                 ShouldTraceRange(range.Start, range.End) || ShouldTraceSource(source);
-            ArmLocked(range, "arm");
+            if (range.Protect)
+            {
+                ArmLocked(range, "arm");
+            }
         }
     }
 
@@ -277,7 +381,8 @@ public static unsafe class GuestImageWriteTracker
 
         lock (_gate)
         {
-            if (_rangesByAddress.TryGetValue(address, out var range))
+            if (_rangesByAddress.TryGetValue(address, out var range) &&
+                range.Protect)
             {
                 ArmLocked(range, "rearm");
             }
@@ -445,10 +550,7 @@ public static unsafe class GuestImageWriteTracker
         }
 
         if (needsUnprotect &&
-            Mprotect(
+            !TrySetProtection(writableStart, writableEnd - writableStart, writable: true))
-                (nint)writableStart,
-                (nuint)(writableEnd - writableStart),
-                ProtRead | ProtWrite) != 0)
         {
             return false;
         }
@@ -462,7 +564,11 @@ public static unsafe class GuestImageWriteTracker
             }
 
             var wasArmed = Interlocked.Exchange(ref range.Armed, 0) != 0;
-            if (wasArmed)
+            var wasDirty = Interlocked.Exchange(ref range.Dirty, 1) != 0;
+            // Protected ranges bump generation once per arm/fault cycle.
+            // Watch-only ranges never arm, so bump on the first dirty mark
+            // (NotifyManagedWrite) so cache owners still see a rewrite.
+            if (wasArmed || (!range.Protect && !wasDirty))
             {
                 Interlocked.Increment(ref range.WriteGeneration);
             }
@@ -480,8 +586,6 @@ public static unsafe class GuestImageWriteTracker
                 Volatile.Write(ref range.PendingFirstCpuWrite, 1);
                 Volatile.Write(ref range.FirstCpuWriteSeen, 2);
             }
-
-            Volatile.Write(ref range.Dirty, 1);
         }
 
         return true;
@@ -497,10 +601,7 @@ public static unsafe class GuestImageWriteTracker
 
         // A new publication/rearm starts a new first-write lifetime.
         Volatile.Write(ref range.FirstCpuWriteSeen, 0);
-        var failed = Mprotect(
+        var failed = !TrySetProtection(range.Start, range.End - range.Start, writable: false);
-            (nint)range.Start,
-            (nuint)(range.End - range.Start),
-            ProtRead) != 0;
         if (failed)
         {
             Volatile.Write(ref range.Armed, 0);
@@ -520,10 +621,7 @@ public static unsafe class GuestImageWriteTracker
         var wasArmed = Interlocked.Exchange(ref range.Armed, 0) == 1;
         if (wasArmed)
         {
-            _ = Mprotect(
+            _ = TrySetProtection(range.Start, range.End - range.Start, writable: true);
-                (nint)range.Start,
-                (nuint)(range.End - range.Start),
-                ProtRead | ProtWrite);
         }
 
         if (range.TraceLifetime)
@@ -534,7 +632,13 @@ public static unsafe class GuestImageWriteTracker
 
     private static void RebuildSnapshotLocked()
     {
-        Volatile.Write(ref _rangeSnapshot, new RangeSnapshot(_rangesByAddress.Values.ToArray()));
+        // Fault / NotifyManagedWrite hot paths must only see protected ranges.
+        // Watch-only texture-cache registrations used to widen Start..End across
+        // nearly all GPU memory so every managed guest write walked this path.
+        var protectedRanges = _rangesByAddress.Values
+            .Where(static range => range.Protect)
+            .ToArray();
+        Volatile.Write(ref _rangeSnapshot, new RangeSnapshot(protectedRanges));
     }
 
     private static (ulong Start, ulong Length) PageAlign(ulong address, ulong byteCount)
@@ -679,8 +783,35 @@ public static unsafe class GuestImageWriteTracker
             $"fault=0x{faultAddress:X16} page=0x{faultPage:X16}");
     }
 
+    private static bool TrySetProtection(ulong start, ulong length, bool writable)
+    {
+        if (length == 0)
+        {
+            return true;
+        }
+
+        if (OperatingSystem.IsWindows())
+        {
+            return VirtualProtect(
+                (nint)start,
+                (nuint)length,
+                writable ? PageReadWrite : PageReadonly,
+                out _) != 0;
+        }
+
+        return Mprotect(
+            (nint)start,
+            (nuint)length,
+            writable ? ProtRead | ProtWrite : ProtRead) == 0;
+    }
+
     private static long GetMonotonicNanoseconds()
     {
+        if (OperatingSystem.IsWindows())
+        {
+            return Stopwatch.GetTimestamp() * 1_000_000_000L / Stopwatch.Frequency;
+        }
+
         Timespec time;
         return ClockGetTime(ClockMonotonicRaw, &time) == 0
             ? unchecked((time.Seconds * 1_000_000_000L) + time.Nanoseconds)

src/SharpEmu.HLE/Host/IHostAudioOutput.cs

@@ -19,5 +19,11 @@ public interface IHostAudioOutput
     /// Throws when the host has no usable output device; callers degrade to a silent
     /// port and pace the guest instead.
     /// </summary>
-    IHostAudioStream OpenStereoPcm16Stream(uint sampleRate);
+    /// <param name="sampleRate">Host stream sample rate in Hz.</param>
+    /// <param name="maxQueuedPcmBytes">
+    /// Soft backpressure cap for queued stereo PCM16. Default 32 KiB (~171 ms at
+    /// 48 kHz) matches classic AudioOut latency. Bursty AudioOut2 / FMOD feeders
+    /// may pass a deeper cap to avoid underruns.
+    /// </param>
+    IHostAudioStream OpenStereoPcm16Stream(uint sampleRate, int maxQueuedPcmBytes = 32 * 1024);
 }

src/SharpEmu.HLE/Host/Posix/PosixAlsaAudioStream.cs

@@ -14,9 +14,6 @@ namespace SharpEmu.HLE.Host.Posix;
 /// </summary>
 internal sealed unsafe class PosixAlsaAudioStream : IHostAudioStream
 {
-    // 32KB of stereo PCM16 at 48kHz is ~170ms; keep the same device-side
-    // queue depth the WinMM/CoreAudio ports enforce in managed code.
-    private const uint DeviceLatencyMicroseconds = 170_000;
     private const int StreamPlayback = 0;
     private const int FormatS16LittleEndian = 2;
     private const int AccessReadWriteInterleaved = 3;
@@ -27,7 +24,7 @@ internal sealed unsafe class PosixAlsaAudioStream : IHostAudioStream
     private nint _pcm;
     private bool _disposed;
 
-    public PosixAlsaAudioStream(uint sampleRate)
+    public PosixAlsaAudioStream(uint sampleRate, int maxQueuedPcmBytes = 32 * 1024)
     {
         if (!OperatingSystem.IsLinux())
         {
@@ -47,6 +44,14 @@ internal sealed unsafe class PosixAlsaAudioStream : IHostAudioStream
                 $"snd_pcm_open(\"{device}\") failed: {DescribeError(status)}.");
         }
 
+        // Match WinMM/CoreAudio soft queue depth: 32 KiB stereo PCM16 @ 48 kHz
+        // is ~170 ms. AudioOut2 may request a deeper bed.
+        var queuedBytes = Math.Max(maxQueuedPcmBytes, 4 * 1024);
+        var latencyMicroseconds = (uint)Math.Clamp(
+            (long)queuedBytes * 1_000_000L / Math.Max(sampleRate * 4u, 1u),
+            20_000L,
+            2_000_000L);
+
         status = snd_pcm_set_params(
             _pcm,
             FormatS16LittleEndian,
@@ -54,7 +59,7 @@ internal sealed unsafe class PosixAlsaAudioStream : IHostAudioStream
             2,
             sampleRate,
             1,
-            DeviceLatencyMicroseconds);
+            latencyMicroseconds);
         if (status != 0)
         {
             _ = snd_pcm_close(_pcm);

src/SharpEmu.HLE/Host/Posix/PosixCoreAudioStream.cs

@@ -13,11 +13,11 @@ namespace SharpEmu.HLE.Host.Posix;
 /// </summary>
 internal sealed unsafe class PosixCoreAudioStream : IHostAudioStream
 {
-    private const int MaximumQueuedPcmBytes = 32 * 1024;
     private const uint FormatLinearPcm = 0x6C70636D; // 'lpcm'
     private const uint FlagIsSignedInteger = 0x4;
     private const uint FlagIsPacked = 0x8;
 
+    private readonly int _maximumQueuedPcmBytes;
     private readonly object _gate = new();
     private readonly AutoResetEvent _completion = new(false);
     private readonly Queue<nint> _freeBuffers = new();
@@ -27,13 +27,15 @@ internal sealed unsafe class PosixCoreAudioStream : IHostAudioStream
     private bool _started;
     private bool _disposed;
 
-    public PosixCoreAudioStream(uint sampleRate)
+    public PosixCoreAudioStream(uint sampleRate, int maxQueuedPcmBytes = 32 * 1024)
     {
         if (!OperatingSystem.IsMacOS())
         {
             throw new PlatformNotSupportedException("CoreAudio is only available on macOS.");
         }
 
+        _maximumQueuedPcmBytes = Math.Max(maxQueuedPcmBytes, 4 * 1024);
+
         var format = new AudioStreamBasicDescription
         {
             SampleRate = sampleRate,
@@ -73,7 +75,7 @@ internal sealed unsafe class PosixCoreAudioStream : IHostAudioStream
 
             var outputLength = stereoPcm16.Length;
             while (_queuedPcmBytes != 0 &&
-                   _queuedPcmBytes + outputLength > MaximumQueuedPcmBytes)
+                   _queuedPcmBytes + outputLength > _maximumQueuedPcmBytes)
             {
                 Monitor.Exit(_gate);
                 try

src/SharpEmu.HLE/Host/Posix/PosixHostAudio.cs

@@ -12,10 +12,10 @@ internal sealed class PosixHostAudio : IHostAudioOutput
 {
     public string BackendName => OperatingSystem.IsMacOS() ? "coreaudio" : "alsa";
 
-    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate)
+    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate, int maxQueuedPcmBytes = 32 * 1024)
     {
         return OperatingSystem.IsMacOS()
-            ? new PosixCoreAudioStream(sampleRate)
+            ? new PosixCoreAudioStream(sampleRate, maxQueuedPcmBytes)
-            : new PosixAlsaAudioStream(sampleRate);
+            : new PosixAlsaAudioStream(sampleRate, maxQueuedPcmBytes);
     }
 }

src/SharpEmu.HLE/Host/Windows/WindowsWaveOutAudio.cs

@@ -9,7 +9,8 @@ internal sealed partial class WindowsWaveOutAudio : IHostAudioOutput
 {
     public string BackendName => "winmm";
 
-    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate) => new WaveOutStream(sampleRate);
+    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate, int maxQueuedPcmBytes = 32 * 1024) =>
+        new WaveOutStream(sampleRate, maxQueuedPcmBytes);
 
     private sealed partial class WaveOutStream : IHostAudioStream
     {
@@ -17,8 +18,8 @@ internal sealed partial class WindowsWaveOutAudio : IHostAudioOutput
         private const uint CallbackEvent = 0x0005_0000;
         private const ushort WaveFormatPcm = 1;
         private const uint WaveHeaderDone = 0x0000_0001;
-        private const int MaximumQueuedPcmBytes = 32 * 1024;
 
+        private readonly int _maximumQueuedPcmBytes;
         private readonly object _gate = new();
         private readonly AutoResetEvent _completion = new(false);
         private readonly Queue<NativeBuffer> _buffers = new();
@@ -26,8 +27,9 @@ internal sealed partial class WindowsWaveOutAudio : IHostAudioOutput
         private int _queuedPcmBytes;
         private bool _disposed;
 
-        public WaveOutStream(uint sampleRate)
+        public WaveOutStream(uint sampleRate, int maxQueuedPcmBytes)
         {
+            _maximumQueuedPcmBytes = Math.Max(maxQueuedPcmBytes, 4 * 1024);
             var format = new WaveFormat
             {
                 FormatTag = WaveFormatPcm,
@@ -62,7 +64,7 @@ internal sealed partial class WindowsWaveOutAudio : IHostAudioOutput
 
                 ReapCompletedBuffers();
                 while (_queuedPcmBytes != 0 &&
-                       _queuedPcmBytes + stereoPcm16.Length > MaximumQueuedPcmBytes)
+                       _queuedPcmBytes + stereoPcm16.Length > _maximumQueuedPcmBytes)
                 {
                     if (!_completion.WaitOne(TimeSpan.FromSeconds(1)))
                     {

src/SharpEmu.Libs/Agc/AgcIndexHelpers.cs

@@ -0,0 +1,49 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.Agc;
+
+/// <summary>Prospero/AGC IndexType helpers (gpu_defs / renderDraw index8 expand).</summary>
+internal static class AgcIndexHelpers
+{
+    internal enum ProsperoIndexType : uint
+    {
+        Index16 = 0,
+        Index32 = 1,
+        Index8 = 2,
+    }
+
+    internal static ProsperoIndexType Decode(uint raw) =>
+        (raw & 0x3u) switch
+        {
+            1 => ProsperoIndexType.Index32,
+            2 => ProsperoIndexType.Index8,
+            _ => ProsperoIndexType.Index16,
+        };
+
+    internal static int GetGuestStrideBytes(ProsperoIndexType indexType) =>
+        indexType switch
+        {
+            ProsperoIndexType.Index32 => sizeof(uint),
+            ProsperoIndexType.Index8 => sizeof(byte),
+            _ => sizeof(ushort),
+        };
+
+    /// <summary>Expand guest u8 indices to host u16 (Vulkan/Metal bindable).</summary>
+    internal static void ExpandIndex8ToU16(ReadOnlySpan<byte> source, Span<byte> destination)
+    {
+        if (destination.Length < source.Length * sizeof(ushort))
+        {
+            throw new ArgumentException("destination too small for u8->u16 expansion.");
+        }
+
+        for (var index = 0; index < source.Length; index++)
+        {
+            BinaryPrimitives.WriteUInt16LittleEndian(
+                destination.Slice(index * sizeof(ushort), sizeof(ushort)),
+                source[index]);
+        }
+    }
+}

src/SharpEmu.Libs/Agc/AgcPrimitiveHelpers.cs

@@ -0,0 +1,107 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.Libs.Agc;
+
+/// <summary>
+/// Shared Prospero/AGC primitive-type helpers (renderDraw / gpu_defs).
+/// </summary>
+internal static class AgcPrimitiveHelpers
+{
+    internal const uint PrimitiveRectList = 7;
+    internal const uint PrimitiveRectListLegacy = 0x11;
+
+    internal enum GsOutputPrimitiveType : uint
+    {
+        Points = 0,
+        Lines = 1,
+        Triangles = 2,
+        Rectangle2D = 3,
+        RectList = 4,
+    }
+
+    internal static bool IsRectListPrimitive(uint primitiveType) =>
+        primitiveType is PrimitiveRectList or PrimitiveRectListLegacy;
+
+    /// <summary>
+    /// Maps draw prim type to VGT_GS_OUT_PRIM_TYPE when NGG is not enabled
+    /// on the GS (GraphicsPrimitiveTypeToGsOut).
+    /// </summary>
+    internal static uint PrimitiveTypeToGsOut(uint primitiveType) =>
+        primitiveType switch
+        {
+            1 => (uint)GsOutputPrimitiveType.Points, // PointList
+            2 or 3 or 10 or 11 or 18 => (uint)GsOutputPrimitiveType.Lines,
+            PrimitiveRectList => (uint)GsOutputPrimitiveType.Rectangle2D,
+            PrimitiveRectListLegacy => (uint)GsOutputPrimitiveType.RectList,
+            _ => (uint)GsOutputPrimitiveType.Triangles,
+        };
+
+    /// <summary>
+    /// Rect-list auto-draw topology selection.
+    /// NGG single-rect UI quads (DualSense prompts) submit count 1/3/4 and
+    /// must become a 4-vert triangle strip — even when the VS has embedded
+    /// vertex-buffer fetches (those still show up as host VBs). Indexed and
+    /// larger auto counts stay triangle list so the loading video is safe.
+    /// </summary>
+    internal static bool ShouldDrawRectListAsTriangleStrip(
+        uint primitiveType,
+        bool indexed,
+        uint vertexCount,
+        bool hasVertexBuffers = false)
+    {
+        _ = hasVertexBuffers;
+        if (indexed || !IsRectListPrimitive(primitiveType))
+        {
+            return false;
+        }
+
+        if (primitiveType == PrimitiveRectListLegacy)
+        {
+            return true;
+        }
+
+        // NGG kRectList: strip for auto + ngg_rectlist_draw.
+        // Restrict to the single-rect counts GTA UI actually submits.
+        return vertexCount is 1 or 3 or 4;
+    }
+
+    /// <summary>
+    /// Host vertex count for auto rect-list draws that expand to a strip.
+    /// NGG single-rect: always 4. Legacy 0x11: 3 -> 4.
+    /// </summary>
+    internal static uint GetRectListDrawVertexCount(
+        uint primitiveType,
+        uint vertexCount,
+        bool indexed,
+        bool hasVertexBuffers = false)
+    {
+        if (!ShouldDrawRectListAsTriangleStrip(
+                primitiveType,
+                indexed,
+                vertexCount,
+                hasVertexBuffers))
+        {
+            return vertexCount;
+        }
+
+        if (primitiveType == PrimitiveRectList)
+        {
+            return 4;
+        }
+
+        if (primitiveType == PrimitiveRectListLegacy && vertexCount == 3)
+        {
+            return 4;
+        }
+
+        return vertexCount;
+    }
+
+    /// <summary>
+    /// Legacy helper — prefer
+    /// <see cref="ShouldDrawRectListAsTriangleStrip"/>.
+    /// </summary>
+    internal static bool IsRectListTriangleStrip(uint primitiveType) =>
+        IsRectListPrimitive(primitiveType);
+}

src/SharpEmu.Libs/Agc/AgcVertexMetadata.cs

@@ -0,0 +1,788 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.ShaderCompiler;
+
+namespace SharpEmu.Libs.Agc;
+
+/// <summary>
+/// AGC embedded vertex metadata. Locates
+/// PtrVertexBufferTable / PtrVertexAttribDescTable and builds authoritative
+/// attribute layouts that draw translation merges onto IR-discovered fetches.
+/// </summary>
+internal static class AgcVertexMetadata
+{
+    private const ushort IllegalDirectOffset = 0xFFFF;
+    private const ulong ShaderUserDataOffset = 0x08;
+    private const ulong ShaderInputSemanticsOffset = 0x30;
+    private const ulong ShaderNumInputSemanticsOffset = 0x50;
+
+    internal enum AgcDirectResourceType : uint
+    {
+        PtrVertexBufferTable = 8,
+        PtrVertexAttribDescTable = 10,
+        Last = PtrVertexAttribDescTable,
+    }
+
+    internal readonly record struct VertexTableRegisters(
+        int VertexBufferReg,
+        int VertexAttribReg,
+        uint InputSemanticsCount,
+        ulong InputSemanticsAddress);
+
+    /// <summary>
+    /// One AGC attrib-table resource.
+    /// Representation: <see cref="SharpBase"/> is the V# base; attribute byte
+    /// offset is applied as <see cref="OffsetBytes"/> (Vulkan bind offset),
+    /// not folded into the base — avoids double-counting when the IR prolog
+    /// already bumped the sharp address.
+    /// </summary>
+    internal readonly record struct MetadataVertexResource(
+        uint Location,
+        uint Semantic,
+        uint HardwareMapping,
+        uint SizeInElements,
+        ulong SharpBase,
+        uint Stride,
+        uint OffsetBytes,
+        uint DataFormat,
+        uint NumberFormat,
+        uint ComponentCount,
+        bool PerInstance);
+
+    /// <summary>
+    /// Reads AGC user-data direct-resource offsets for the ES header mapped to
+    /// <paramref name="shaderCodeAddress"/>. Returns false when the header is
+    /// unknown or the tables are absent (attribute-less clears).
+    /// </summary>
+    internal static bool TryGetVertexTableRegisters(
+        CpuContext ctx,
+        ulong shaderCodeAddress,
+        ulong shaderHeaderAddress,
+        out VertexTableRegisters registers)
+    {
+        registers = new VertexTableRegisters(-1, -1, 0, 0);
+        if (shaderHeaderAddress == 0 ||
+            !TryReadUInt64(ctx, shaderHeaderAddress + ShaderUserDataOffset, out var userDataAddress) ||
+            userDataAddress == 0)
+        {
+            return false;
+        }
+
+        // ShaderUserData layout:
+        //   0x00: uint16_t* direct_resource_offset
+        //   0x08: sharp_resource_offset[4]
+        //   0x28: eud_size_dw, srt_size_dw
+        //   0x2C: direct_resource_count
+        if (!TryReadUInt64(ctx, userDataAddress, out var directResourceOffset) ||
+            !TryReadUInt16(ctx, userDataAddress + 0x2C, out var directResourceCount))
+        {
+            return false;
+        }
+
+        var maxTypes = (uint)AgcDirectResourceType.Last + 1u;
+        if (directResourceCount > maxTypes || directResourceOffset == 0)
+        {
+            return false;
+        }
+
+        var vertexBufferReg = -1;
+        var vertexAttribReg = -1;
+        for (uint type = 0; type < directResourceCount; type++)
+        {
+            if (!TryReadUInt16(
+                    ctx,
+                    directResourceOffset + (type * sizeof(ushort)),
+                    out var reg) ||
+                reg == IllegalDirectOffset)
+            {
+                continue;
+            }
+
+            switch ((AgcDirectResourceType)type)
+            {
+                case AgcDirectResourceType.PtrVertexBufferTable:
+                    vertexBufferReg = reg;
+                    break;
+                case AgcDirectResourceType.PtrVertexAttribDescTable:
+                    vertexAttribReg = reg;
+                    break;
+            }
+        }
+
+        if (vertexBufferReg < 0 || vertexAttribReg < 0)
+        {
+            return false;
+        }
+
+        if (!TryReadUInt64(
+                ctx,
+                shaderHeaderAddress + ShaderInputSemanticsOffset,
+                out var inputSemanticsAddress) ||
+            !TryReadUInt32(
+                ctx,
+                shaderHeaderAddress + ShaderNumInputSemanticsOffset,
+                out var inputSemanticsCount) ||
+            inputSemanticsCount == 0 ||
+            inputSemanticsAddress == 0)
+        {
+            return false;
+        }
+
+        registers = new VertexTableRegisters(
+            vertexBufferReg,
+            vertexAttribReg,
+            inputSemanticsCount,
+            inputSemanticsAddress);
+        return true;
+    }
+
+    /// <summary>
+    /// Builds attrib resources from AGC input_semantics + tables.
+    /// ShaderSemantic packing:
+    ///   bits [7:0]   semantic          → attrib table index
+    ///   bits [15:8]  hardware_mapping  → VGPR destination
+    ///   bits [19:16] size_in_elements
+    /// </summary>
+    internal static bool TryBuildVertexResourcesFromMetadata(
+        CpuContext ctx,
+        IReadOnlyList<uint> scalarRegisters,
+        VertexTableRegisters tables,
+        out IReadOnlyList<MetadataVertexResource> resources)
+    {
+        resources = Array.Empty<MetadataVertexResource>();
+        if (tables.VertexAttribReg < 0 ||
+            tables.VertexBufferReg < 0 ||
+            tables.VertexAttribReg + 1 >= scalarRegisters.Count ||
+            tables.VertexBufferReg + 1 >= scalarRegisters.Count ||
+            tables.InputSemanticsCount == 0)
+        {
+            return false;
+        }
+
+        var attribTable =
+            ((ulong)scalarRegisters[tables.VertexAttribReg + 1] << 32) |
+            scalarRegisters[tables.VertexAttribReg];
+        var bufferTable =
+            ((ulong)scalarRegisters[tables.VertexBufferReg + 1] << 32) |
+            scalarRegisters[tables.VertexBufferReg];
+        if (attribTable == 0 || bufferTable == 0)
+        {
+            return false;
+        }
+
+        var built = new List<MetadataVertexResource>((int)tables.InputSemanticsCount);
+        for (uint i = 0; i < tables.InputSemanticsCount; i++)
+        {
+            if (!TryReadUInt32(
+                    ctx,
+                    tables.InputSemanticsAddress + (i * sizeof(uint)),
+                    out var semanticWord))
+            {
+                return false;
+            }
+
+            // Attrib index is semantic bits [7:0], not hardware_mapping.
+            var semantic = semanticWord & 0xFFu;
+            var hardwareMapping = (semanticWord >> 8) & 0xFFu;
+            var sizeInElements = (semanticWord >> 16) & 0xFu;
+            if (!TryReadUInt32(ctx, attribTable + (semantic * sizeof(uint)), out var attribWord))
+            {
+                return false;
+            }
+
+            // Attrib dword: buffer index [4:0], format [13:5], offset [25:14], fetch [26].
+            var bufferIndex = attribWord & 0x1Fu;
+            var format = (attribWord >> 5) & 0x1FFu;
+            var offset = (attribWord >> 14) & 0xFFFu;
+            var fetchIndex = (attribWord >> 26) & 0x1u;
+            var sharpAddress = bufferTable + (bufferIndex * 16u);
+            if (!TryReadUInt32(ctx, sharpAddress, out var sharp0) ||
+                !TryReadUInt32(ctx, sharpAddress + 4, out var sharp1))
+            {
+                return false;
+            }
+
+            var sharpBase = sharp0 | ((ulong)(sharp1 & 0xFFFFu) << 32);
+            var stride = (sharp1 >> 16) & 0x3FFFu;
+            if (sharpBase == 0 || stride == 0)
+            {
+                continue;
+            }
+
+            var fallbackComponents = sizeInElements != 0 ? sizeInElements : 4u;
+            var (dataFormat, numberFormat, components) =
+                MapAttribFormat(format, fallbackComponents);
+            built.Add(new MetadataVertexResource(
+                Location: i,
+                Semantic: semantic,
+                HardwareMapping: hardwareMapping,
+                SizeInElements: sizeInElements,
+                SharpBase: sharpBase,
+                Stride: stride,
+                OffsetBytes: offset,
+                DataFormat: dataFormat,
+                NumberFormat: numberFormat,
+                ComponentCount: components,
+                PerInstance: fetchIndex != 0));
+        }
+
+        if (built.Count == 0)
+        {
+            return false;
+        }
+
+        resources = built;
+        return true;
+    }
+
+    /// <summary>
+    /// Patch IR-discovered fetches from the attrib table onto the V# format/offset.
+    /// Prefer 1:1 Location pairing when counts match on one interleaved stream
+    /// (GTA UI glyphs). Otherwise match by stride + byte offset. Never rebases
+    /// BaseAddress/Data/Location/Pc/PerInstance.
+    /// </summary>
+    internal static IReadOnlyList<Gen5VertexInputBinding> MergeVertexInputsFromMetadata(
+        CpuContext ctx,
+        IReadOnlyList<uint> scalarRegisters,
+        VertexTableRegisters tables,
+        IReadOnlyList<Gen5VertexInputBinding> discovered)
+    {
+        if (discovered.Count == 0 ||
+            !TryBuildVertexResourcesFromMetadata(
+                ctx,
+                scalarRegisters,
+                tables,
+                out var resources))
+        {
+            return discovered;
+        }
+
+        if (TryMergeByLocationPairing(discovered, resources, out var paired))
+        {
+            return paired;
+        }
+
+        var merged = new List<Gen5VertexInputBinding>(discovered.Count);
+        var usedResources = new bool[resources.Count];
+        var changed = false;
+        foreach (var input in discovered)
+        {
+            if (!TryMatchMetadataResource(input, resources, usedResources, out var resource, out var fillOffset))
+            {
+                merged.Add(input);
+                continue;
+            }
+
+            var refined = ApplyMetadataFormat(input, resource, fillOffset);
+            changed |= refined != input;
+            merged.Add(refined);
+        }
+
+        return changed ? merged : discovered;
+    }
+
+    /// <summary>
+    /// When discovery and metadata describe the same interleaved stream with
+    /// equal attribute counts, pair by sorted Location (semantic order).
+    /// Keeps each binding's Pc/Location for SPIR-V; overlays format + offset.
+    /// </summary>
+    private static bool TryMergeByLocationPairing(
+        IReadOnlyList<Gen5VertexInputBinding> discovered,
+        IReadOnlyList<MetadataVertexResource> resources,
+        out IReadOnlyList<Gen5VertexInputBinding> merged)
+    {
+        merged = discovered;
+        if (discovered.Count != resources.Count || discovered.Count == 0)
+        {
+            return false;
+        }
+
+        var orderedInputs = discovered.OrderBy(static input => input.Location).ToArray();
+        var orderedResources = resources.OrderBy(static resource => resource.Location).ToArray();
+        var streamBase = orderedResources[0].SharpBase;
+        var streamStride = orderedResources[0].Stride;
+        for (var index = 0; index < orderedResources.Length; index++)
+        {
+            var resource = orderedResources[index];
+            var input = orderedInputs[index];
+            if (resource.SharpBase != streamBase ||
+                resource.Stride != streamStride ||
+                (input.Stride != 0 && input.Stride != streamStride) ||
+                !IsSameVertexStream(input, resource))
+            {
+                return false;
+            }
+        }
+
+        var byPc = new Dictionary<uint, Gen5VertexInputBinding>(discovered.Count);
+        var changed = false;
+        for (var index = 0; index < orderedInputs.Length; index++)
+        {
+            var input = orderedInputs[index];
+            var resource = orderedResources[index];
+            var fillOffset = input.BaseAddress == resource.SharpBase ||
+                             IsAddressInsideCapturedSpan(input, resource.SharpBase);
+            var refined = ApplyMetadataFormat(input, resource, fillOffset);
+            changed |= refined != input;
+            byPc[input.Pc] = refined;
+        }
+
+        if (!changed)
+        {
+            return false;
+        }
+
+        var result = new Gen5VertexInputBinding[discovered.Count];
+        for (var index = 0; index < discovered.Count; index++)
+        {
+            result[index] = byPc[discovered[index].Pc];
+        }
+
+        merged = result;
+        return true;
+    }
+
+    private static Gen5VertexInputBinding ApplyMetadataFormat(
+        Gen5VertexInputBinding input,
+        MetadataVertexResource resource,
+        bool fillOffsetBytes)
+    {
+        var components = input.ComponentCount != 0 &&
+                         input.ComponentCount < resource.ComponentCount
+            ? input.ComponentCount
+            : resource.ComponentCount;
+
+        return input with
+        {
+            DataFormat = resource.DataFormat,
+            NumberFormat = resource.NumberFormat,
+            ComponentCount = components,
+            OffsetBytes = fillOffsetBytes ? resource.OffsetBytes : input.OffsetBytes,
+        };
+    }
+
+    /// <summary>
+    /// Legacy entry point — forwards to <see cref="MergeVertexInputsFromMetadata"/>.
+    /// </summary>
+    internal static IReadOnlyList<Gen5VertexInputBinding> RefineVertexInputs(
+        CpuContext ctx,
+        IReadOnlyList<uint> scalarRegisters,
+        VertexTableRegisters tables,
+        IReadOnlyList<Gen5VertexInputBinding> discovered) =>
+        MergeVertexInputsFromMetadata(ctx, scalarRegisters, tables, discovered);
+
+    /// <summary>
+    /// Collects SBufferLoad / SLoad PCs that read the AGC attrib or buffer
+    /// tables (embedded-fetch prolog). Those loads are executed on the
+    /// CPU during scalar evaluation; once vertex inputs are bound they must
+    /// not run again as live SSBOs on the GPU.
+    /// </summary>
+    internal static HashSet<uint> CollectFetchPrologPcs(
+        Gen5ShaderProgram program,
+        VertexTableRegisters tables)
+    {
+        var pcs = new HashSet<uint>();
+        if (tables.VertexAttribReg < 0 || tables.VertexBufferReg < 0)
+        {
+            return pcs;
+        }
+
+        var tableRegs = new HashSet<uint>
+        {
+            (uint)tables.VertexAttribReg,
+            (uint)tables.VertexAttribReg + 1u,
+            (uint)tables.VertexBufferReg,
+            (uint)tables.VertexBufferReg + 1u,
+        };
+
+        foreach (var instruction in program.Instructions)
+        {
+            var isScalarLoad =
+                instruction.Opcode.StartsWith("SBufferLoad", StringComparison.Ordinal) ||
+                instruction.Opcode.StartsWith("SLoad", StringComparison.Ordinal);
+            if (!isScalarLoad)
+            {
+                continue;
+            }
+
+            // SMEM loads encode the scalar base pointer in Sources[0].
+            if (instruction.Sources.Count > 0 &&
+                instruction.Sources[0] is
+                {
+                    Kind: Gen5OperandKind.ScalarRegister,
+                    Value: var scalarBase,
+                } &&
+                tableRegs.Contains(scalarBase))
+            {
+                pcs.Add(instruction.Pc);
+                continue;
+            }
+
+            if (instruction.Control is Gen5BufferMemoryControl buffer &&
+                tableRegs.Contains(buffer.ScalarResource))
+            {
+                pcs.Add(instruction.Pc);
+            }
+        }
+
+        return pcs;
+    }
+
+    private static bool TryMatchMetadataResource(
+        Gen5VertexInputBinding input,
+        IReadOnlyList<MetadataVertexResource> resources,
+        bool[] usedResources,
+        out MetadataVertexResource resource,
+        out bool fillOffsetBytes)
+    {
+        resource = default;
+        fillOffsetBytes = false;
+        var bestScore = int.MinValue;
+        var bestIndex = -1;
+        var bestFillOffset = false;
+        for (var index = 0; index < resources.Count; index++)
+        {
+            if (usedResources[index])
+            {
+                continue;
+            }
+
+            var candidate = resources[index];
+            if (candidate.Stride != 0 &&
+                input.Stride != 0 &&
+                candidate.Stride != input.Stride)
+            {
+                continue;
+            }
+
+            if (!IsSameVertexStream(input, candidate))
+            {
+                continue;
+            }
+
+            var attrAddress = candidate.SharpBase + candidate.OffsetBytes;
+            var score = int.MinValue;
+            var fillOffset = false;
+
+            // Post-capture interleaved: shared BaseAddress, distinct OffsetBytes.
+            if (input.OffsetBytes == candidate.OffsetBytes &&
+                (input.BaseAddress == candidate.SharpBase ||
+                 IsAddressInsideCapturedSpan(input, candidate.SharpBase)))
+            {
+                score = 400;
+            }
+            // IR prolog baked attrib offset into the V# base.
+            else if (input.BaseAddress == attrAddress)
+            {
+                score = 350;
+            }
+            // Discovery never saw the attrib offset — only safe when this
+            // resource's offset uniquely identifies it among unused entries.
+            else if (input.BaseAddress == candidate.SharpBase &&
+                     input.OffsetBytes == 0 &&
+                     candidate.OffsetBytes != 0 &&
+                     IsUniqueUnusedOffset(resources, usedResources, candidate.OffsetBytes, index))
+            {
+                score = 300;
+                fillOffset = true;
+            }
+            else if (input.BaseAddress == candidate.SharpBase &&
+                     input.OffsetBytes == 0 &&
+                     candidate.OffsetBytes == 0)
+            {
+                score = 250;
+            }
+
+            if (score > bestScore)
+            {
+                bestScore = score;
+                bestIndex = index;
+                bestFillOffset = fillOffset;
+            }
+        }
+
+        // Require an offset-aware match. Bare SharpBase ties (score 250) are
+        // only accepted when a single unused resource remains for that stream.
+        if (bestIndex < 0 || bestScore < 300)
+        {
+            if (bestIndex < 0 || bestScore < 250)
+            {
+                return false;
+            }
+
+            var unusedSameStream = 0;
+            for (var index = 0; index < resources.Count; index++)
+            {
+                if (!usedResources[index] && IsSameVertexStream(input, resources[index]))
+                {
+                    unusedSameStream++;
+                }
+            }
+
+            if (unusedSameStream != 1)
+            {
+                return false;
+            }
+        }
+
+        usedResources[bestIndex] = true;
+        resource = resources[bestIndex];
+        fillOffsetBytes = bestFillOffset;
+        return true;
+    }
+
+    private static bool IsSameVertexStream(
+        Gen5VertexInputBinding input,
+        MetadataVertexResource resource)
+    {
+        if (input.BaseAddress == resource.SharpBase ||
+            input.BaseAddress == resource.SharpBase + resource.OffsetBytes)
+        {
+            return true;
+        }
+
+        return IsAddressInsideCapturedSpan(input, resource.SharpBase);
+    }
+
+    private static bool IsAddressInsideCapturedSpan(
+        Gen5VertexInputBinding input,
+        ulong address) =>
+        input.DataLength > 0 &&
+        address >= input.BaseAddress &&
+        address < input.BaseAddress + (ulong)input.DataLength;
+
+    private static bool IsUniqueUnusedOffset(
+        IReadOnlyList<MetadataVertexResource> resources,
+        bool[] usedResources,
+        uint offsetBytes,
+        int candidateIndex)
+    {
+        for (var index = 0; index < resources.Count; index++)
+        {
+            if (index == candidateIndex || usedResources[index])
+            {
+                continue;
+            }
+
+            if (resources[index].OffsetBytes == offsetBytes)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// Attrib-table format
+    /// fields are VertexAttribFormat; V# / Vulkan paths need BufferFormat.
+    /// Unknown values pass through (already BufferFormat).
+    /// </summary>
+    private static uint VertexAttribFormatToBufferFormat(uint format) =>
+        format switch
+        {
+            0 => 0,     // Invalid
+            4 => 1,     // k8UNorm
+            8 => 2,     // k8SNorm
+            12 => 3,    // k8UScaled
+            16 => 4,    // k8SScaled
+            20 => 5,    // k8UInt
+            24 => 6,    // k8SInt
+            28 => 7,    // k16UNorm
+            32 => 8,    // k16SNorm
+            36 => 9,    // k16UScaled
+            40 => 10,   // k16SScaled
+            44 => 11,   // k16UInt
+            48 => 12,   // k16SInt
+            52 => 13,   // k16Float
+            57 => 14,   // k8_8UNorm
+            61 => 15,   // k8_8SNorm
+            65 => 16,   // k8_8UScaled
+            69 => 17,   // k8_8SScaled
+            73 => 18,   // k8_8UInt
+            77 => 19,   // k8_8SInt
+            80 => 20,   // k32UInt
+            84 => 21,   // k32SInt
+            88 => 22,   // k32Float
+            93 => 23,   // k16_16UNorm
+            97 => 24,   // k16_16SNorm
+            101 => 25,  // k16_16UScaled
+            105 => 26,  // k16_16SScaled
+            109 => 27,  // k16_16UInt
+            113 => 28,  // k16_16SInt
+            117 => 29,  // k16_16Float
+            122 => 30,  // k11_11_10UNorm
+            126 => 31,
+            130 => 32,
+            134 => 33,
+            138 => 34,
+            142 => 35,
+            146 => 36,
+            150 => 37,  // k10_11_11UNorm
+            154 => 38,
+            158 => 39,
+            162 => 40,
+            166 => 41,
+            170 => 42,
+            174 => 43,
+            179 => 44,  // k2_10_10_10UNorm
+            183 => 45,
+            187 => 46,
+            191 => 47,
+            195 => 48,
+            199 => 49,
+            203 => 50,  // k10_10_10_2UNorm
+            207 => 51,
+            211 => 52,
+            215 => 53,
+            219 => 54,
+            223 => 55,
+            227 => 56,  // k8_8_8_8UNorm
+            231 => 57,
+            235 => 58,
+            239 => 59,
+            243 => 60,
+            247 => 61,
+            249 => 62,  // k32_32UInt
+            253 => 63,
+            257 => 64,  // k32_32Float
+            263 => 65,  // k16_16_16_16UNorm
+            267 => 66,
+            271 => 67,
+            275 => 68,
+            279 => 69,
+            283 => 70,
+            287 => 71,  // k16_16_16_16Float
+            290 => 72,  // k32_32_32UInt
+            294 => 73,
+            298 => 74,
+            303 => 75,  // k32_32_32_32UInt
+            307 => 76,
+            311 => 77,  // k32_32_32_32Float
+            _ => format,
+        };
+
+    /// <summary>
+    /// Maps Prospero attrib-table formats onto GNM (DataFormat, NumberFormat,
+    /// Components) for <c>ToVkVertexFormat</c>. Accepts VertexAttribFormat
+    /// or BufferFormat (pass-through). NumberFormat: 0 Unorm, 1 SNorm,
+    /// 2 UScaled, 3 SScaled, 4 UInt, 5 SInt, 7 Float.
+    /// </summary>
+    private static (uint DataFormat, uint NumberFormat, uint Components) MapAttribFormat(
+        uint attribFormat,
+        uint fallbackComponents)
+    {
+        // Prospero VertexAttribFormat quirks before BufferFormat conversion.
+        if (attribFormat == 113)
+        {
+            return (14, 7, 4); // R32G32B32A32_SFLOAT
+        }
+
+        if (attribFormat == 121)
+        {
+            return (5, 7, 2); // R16G16_SFLOAT
+        }
+
+        var bufferFormat = VertexAttribFormatToBufferFormat(attribFormat);
+
+        // Prospero::BufferFormat numeric values (gpu_defs.h).
+        return bufferFormat switch
+        {
+            1 => (1, 0, 1),   // k8UNorm
+            2 => (1, 1, 1),   // k8SNorm
+            3 => (1, 2, 1),   // k8UScaled
+            4 => (1, 3, 1),   // k8SScaled
+            5 => (1, 4, 1),   // k8UInt
+            6 => (1, 5, 1),   // k8SInt
+            7 => (2, 0, 1),   // k16UNorm
+            8 => (2, 1, 1),   // k16SNorm
+            9 => (2, 2, 1),   // k16UScaled
+            10 => (2, 3, 1),  // k16SScaled
+            11 => (2, 4, 1),  // k16UInt
+            12 => (2, 5, 1),  // k16SInt
+            13 => (2, 7, 1),  // k16Float
+            14 => (3, 0, 2),  // k8_8UNorm
+            15 => (3, 1, 2),  // k8_8SNorm
+            16 => (3, 2, 2),  // k8_8UScaled
+            17 => (3, 3, 2),  // k8_8SScaled
+            18 => (3, 4, 2),  // k8_8UInt
+            19 => (3, 5, 2),  // k8_8SInt
+            20 => (4, 4, 1),  // k32UInt
+            21 => (4, 5, 1),  // k32SInt
+            22 => (4, 7, 1),  // k32Float
+            23 => (5, 0, 2),  // k16_16UNorm
+            24 => (5, 1, 2),  // k16_16SNorm
+            25 => (5, 2, 2),  // k16_16UScaled
+            26 => (5, 3, 2),  // k16_16SScaled
+            27 => (5, 4, 2),  // k16_16UInt
+            28 => (5, 5, 2),  // k16_16SInt
+            29 => (5, 7, 2),  // k16_16Float
+            50 => (9, 0, 4),  // k10_10_10_2UNorm
+            51 => (9, 1, 4),  // k10_10_10_2SNorm
+            56 => (10, 0, 4), // k8_8_8_8UNorm
+            57 => (10, 1, 4), // k8_8_8_8SNorm
+            58 => (10, 2, 4), // k8_8_8_8UScaled
+            59 => (10, 3, 4), // k8_8_8_8SScaled
+            60 => (10, 4, 4), // k8_8_8_8UInt
+            61 => (10, 5, 4), // k8_8_8_8SInt
+            62 => (11, 4, 2), // k32_32UInt
+            63 => (11, 5, 2), // k32_32SInt
+            64 => (11, 7, 2), // k32_32Float
+            65 => (12, 0, 4), // k16_16_16_16UNorm
+            66 => (12, 1, 4), // k16_16_16_16SNorm
+            67 => (12, 2, 4), // k16_16_16_16UScaled
+            68 => (12, 3, 4), // k16_16_16_16SScaled
+            69 => (12, 4, 4), // k16_16_16_16UInt
+            70 => (12, 5, 4), // k16_16_16_16SInt
+            71 => (12, 7, 4), // k16_16_16_16Float
+            72 => (13, 4, 3), // k32_32_32UInt
+            73 => (13, 5, 3), // k32_32_32SInt
+            74 => (13, 7, 3), // k32_32_32Float
+            75 => (14, 4, 4), // k32_32_32_32UInt
+            76 => (14, 5, 4), // k32_32_32_32SInt
+            77 => (14, 7, 4), // k32_32_32_32Float
+            _ => (14, 7, Math.Clamp(fallbackComponents, 1u, 4u)),
+        };
+    }
+
+    private static bool TryReadUInt16(CpuContext ctx, ulong address, out ushort value)
+    {
+        Span<byte> buffer = stackalloc byte[2];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = System.Buffers.Binary.BinaryPrimitives.ReadUInt16LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryReadUInt32(CpuContext ctx, ulong address, out uint value)
+    {
+        Span<byte> buffer = stackalloc byte[4];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = System.Buffers.Binary.BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryReadUInt64(CpuContext ctx, ulong address, out ulong value)
+    {
+        Span<byte> buffer = stackalloc byte[8];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = System.Buffers.Binary.BinaryPrimitives.ReadUInt64LittleEndian(buffer);
+        return true;
+    }
+}

src/SharpEmu.Libs/Agc/GnmTiling.cs

@@ -12,7 +12,7 @@ internal enum DetileEquation
     /// <summary>Unsupported mode/format; caller must use the CPU path or raw upload.</summary>
     None,
 
-    /// <summary>Exact AddrLib XOR equation (RDNA2 modes 5/9/24/27): factored X/Y terms.</summary>
+    /// <summary>Exact AddrLib XOR equation (RDNA2 modes 1/5/9/24/27): factored X/Y terms.</summary>
     ExactXor,
 
     /// <summary>Other modes: a precomputed in-block Morton/standard element-offset table.</summary>
@@ -145,6 +145,18 @@ internal static unsafe class GnmTiling
          Y(2), X(2), Y(3), X(3), Y(4), X(4), Y(5), X(5)],
     ];
 
+    // GFX10 256B_S: 8-bit micro-tile equation (low octet of the 4K_S pattern).
+    // The generic StandardSwizzle bit-interleave is a different layout and leaves
+    // a broken grid on Gen5 UI atlases that ship as Standard256B.
+    private static readonly AddressBit[][] Standard256 =
+    [
+        [X(0), X(1), X(2), X(3), Y(0), Y(1), Y(2), Y(3)],
+        [Zero, X(0), X(1), X(2), Y(0), Y(1), Y(2), X(3)],
+        [Zero, Zero, X(0), X(1), Y(0), Y(1), Y(2), X(2)],
+        [Zero, Zero, Zero, X(0), Y(0), Y(1), X(1), X(2)],
+        [Zero, Zero, Zero, Zero, Y(0), Y(1), X(0), X(1)],
+    ];
+
     // GFX10 4K_S has a separate 12-bit micro-tile equation. It is not the
     // generic x/y interleave used by the 64K standard block; using that larger
     // equation leaves a regular grid in linearized atlases.
@@ -789,6 +801,7 @@ internal static unsafe class GnmTiling
 
         pattern = swizzleMode switch
         {
+            1 => Standard256[bytesPerElementLog2],
             5 => Standard4K[bytesPerElementLog2],
             9 => RbPlus64KStandard[bytesPerElementLog2],
             24 => RbPlus64KDepthX[bytesPerElementLog2],

src/SharpEmu.Libs/Agc/GpuWaitRegistry.cs

@@ -1,6 +1,8 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Diagnostics;
+
 namespace SharpEmu.Libs.Agc;
 
 /// <summary>
@@ -92,6 +94,64 @@ internal static class GpuWaitRegistry
         }
     }
 
+    public readonly record struct OutstandingSnapshot(
+        int Outstanding,
+        int Latched,
+        long OldestAgeMs,
+        ulong SampleWaitAddress,
+        string? SampleQueueName);
+
+    /// <summary>
+    /// Diagnostics snapshot of suspended WAIT_REG_MEM / dims waiters.
+    /// </summary>
+    public static OutstandingSnapshot SnapshotOutstanding(object? memory = null)
+    {
+        lock (_gate)
+        {
+            var outstanding = 0;
+            var latched = 0;
+            var oldestTicks = long.MaxValue;
+            ulong sampleAddress = 0;
+            string? sampleQueue = null;
+            var now = Stopwatch.GetTimestamp();
+            foreach (var (_, list) in _waiters)
+            {
+                foreach (var waiter in list)
+                {
+                    if (memory is not null &&
+                        !ReferenceEquals(waiter.Memory, memory))
+                    {
+                        continue;
+                    }
+
+                    outstanding++;
+                    if (waiter.Latched)
+                    {
+                        latched++;
+                    }
+
+                    if (waiter.RegisteredTicks != 0 &&
+                        waiter.RegisteredTicks < oldestTicks)
+                    {
+                        oldestTicks = waiter.RegisteredTicks;
+                        sampleAddress = waiter.WaitAddress;
+                        sampleQueue = waiter.QueueName;
+                    }
+                }
+            }
+
+            var oldestAgeMs = oldestTicks == long.MaxValue || oldestTicks == 0
+                ? 0L
+                : (now - oldestTicks) * 1000L / Stopwatch.Frequency;
+            return new OutstandingSnapshot(
+                outstanding,
+                latched,
+                oldestAgeMs,
+                sampleAddress,
+                sampleQueue);
+        }
+    }
+
     public static void Register(ulong address, WaitingDcb waiter)
     {
         waiter.WaitAddress = address;

src/SharpEmu.Libs/Ampr/AmprExports.cs

@@ -275,6 +275,19 @@ public static class AmprExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
         }
 
+        // Offset -1 means "continue after the previous read of this file id".
+        // #216 dropped this wiring; without it sequential pack/streamer reads
+        // fail as INVALID_ARGUMENT and RAGE load jobs never complete while the
+        // North Yankton UI keeps flipping.
+        if (fileOffset == unchecked((ulong)(long)-1))
+        {
+            fileOffset = PakDirectoryTracker.ResolveSequentialOffset(fileId, size);
+        }
+        else if (fileOffset > long.MaxValue)
+        {
+            fileOffset = 0;
+        }
+
         var result = TryReadFileToGuestMemory(ctx, hostPath, fileOffset, destination, size, out var bytesRead);
         if (result != (int)OrbisGen2Result.ORBIS_GEN2_OK)
         {
@@ -282,6 +295,8 @@ public static class AmprExports
             return result;
         }
 
+        PakDirectoryTracker.OnReadCompleted(ctx, fileId, destination, fileOffset, bytesRead);
+
         if (!AppendReadFileRecord(ctx, commandBuffer, fileId, destination, size, fileOffset, bytesRead))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;

src/SharpEmu.Libs/Audio/AjmExports.cs

@@ -23,13 +23,32 @@ public static class AjmExports
     private static int _nextContextId;
     private static int _nextBatchId;
 
+    private const uint AjmCodecMp3 = 0;
+
+    private sealed class AjmInstanceState
+    {
+        public required uint Codec { get; init; }
+        public required ulong Flags { get; init; }
+        public AjmMp3Decoder? Mp3 { get; init; }
+
+        public bool PreferPcm16
+        {
+            get
+            {
+                // AjmInstanceFlags: version:3, channels:4, format:3
+                var encoding = (Flags >> 7) & 0x7;
+                return encoding is 0 or 1; // S16 / S32 — we emit S16 for both
+            }
+        }
+    }
+
     private sealed class AjmContextState
     {
         public object Gate { get; } = new();
 
         public HashSet<uint> RegisteredCodecs { get; } = new();
 
-        public Dictionary<uint, uint> InstancesBySlot { get; } = new();
+        public Dictionary<uint, AjmInstanceState> InstancesBySlot { get; } = new();
 
         public int NextInstanceIndex { get; set; }
     }
@@ -169,7 +188,14 @@ public static class AjmExports
             }
 
             state.NextInstanceIndex = nextInstanceIndex;
-            state.InstancesBySlot.Add(instanceSlot, instanceId);
+            state.InstancesBySlot.Add(
+                instanceSlot,
+                new AjmInstanceState
+                {
+                    Codec = codecType,
+                    Flags = flags,
+                    Mp3 = codecType == AjmCodecMp3 ? new AjmMp3Decoder() : null,
+                });
         }
 
         Trace($"instance_create context={contextId} codec={codecType} flags=0x{flags:X} instance=0x{instanceId:X8}");
@@ -229,11 +255,9 @@ public static class AjmExports
     }
 
     /// <summary>
-    /// Enqueues a decode job on a batch. Titles call this on the Bink/AJM hot
+    /// Enqueues a decode job on a batch. GTA V Enhanced streams menu music
-    /// path; leaving it unresolved floods Import WARN spam. This is a silence
+    /// through AJM MP3 (codec 0); we decode eagerly here so BatchStart/Wait
-    /// stub, not a codec: advance the batch cursor and report the input as
+    /// stay synchronous no-ops.
-    /// consumed with silence produced so the title does not spin on the same
-    /// packet.
     /// </summary>
     [SysAbiExport(
         Nid = "39WxhR-ePew",
@@ -255,37 +279,120 @@ public static class AjmExports
             return ctx.SetReturn(OrbisAjmErrorInvalidParameter);
         }
 
-        // Best-effort: bump the batch cursor when the guest filled AjmBatchInfo.
-        // Still succeed without it — the unresolved stub returned 0 and titles
-        // keep calling; failing here would reintroduce hot-path spam via retries.
         _ = TryAppendBatchJob(ctx, infoAddress, AjmJobRunSize);
 
-        // Silence: clear PCM out and claim full input consumed so the guest
+        var inputConsumed = 0;
-        // advances its bitstream cursor instead of re-submitting forever.
+        var outputWritten = 0;
-        if (outputAddress != 0 && outputSize != 0 && outputSize <= MaxSilentPcmBytes)
+        ulong totalSamples = 0;
+        var frames = 0u;
+        var decoded = false;
+
+        if (TryGetInstance(instanceId, out var instance) &&
+            instance.Mp3 is not null &&
+            inputAddress != 0 &&
+            inputSize is > 0 and <= MaxSilentPcmBytes &&
+            outputAddress != 0 &&
+            outputSize is > 0 and <= MaxSilentPcmBytes)
         {
-            ClearGuestMemory(ctx, outputAddress, outputSize);
+            var input = new byte[inputSize];
+            var output = new byte[outputSize];
+            if (ctx.Memory.TryRead(inputAddress, input))
+            {
+                var result = instance.Mp3.Decode(input, output, pcm16: instance.PreferPcm16);
+                if (result.OutputWritten > 0)
+                {
+                    if (!ctx.Memory.TryWrite(outputAddress, output.AsSpan(0, result.OutputWritten)))
+                    {
+                        return ctx.SetReturn(OrbisAjmErrorInvalidParameter);
+                    }
+
+                    // Zero any remainder so stale PCM does not leak into FMOD.
+                    if ((ulong)result.OutputWritten < outputSize)
+                    {
+                        ClearGuestMemory(
+                            ctx,
+                            outputAddress + (ulong)result.OutputWritten,
+                            outputSize - (ulong)result.OutputWritten);
+                    }
+
+                    decoded = true;
+                    inputConsumed = result.InputConsumed;
+                    outputWritten = result.OutputWritten;
+                    frames = result.Frames;
+                    totalSamples = instance.Mp3.TotalDecodedSamples;
+                }
+                else
+                {
+                    inputConsumed = result.InputConsumed;
+                    totalSamples = instance.Mp3.TotalDecodedSamples;
+                }
+            }
+        }
+
+        if (!decoded)
+        {
+            // Fallback: silence + consume input so the guest does not spin.
+            if (outputAddress != 0 && outputSize != 0 && outputSize <= MaxSilentPcmBytes)
+            {
+                ClearGuestMemory(ctx, outputAddress, outputSize);
+            }
+
+            if (inputConsumed == 0)
+            {
+                inputConsumed = inputSize > int.MaxValue ? int.MaxValue : (int)inputSize;
+            }
+
+            if (frames == 0 && (inputSize != 0 || outputSize != 0))
+            {
+                frames = 1;
+            }
         }
 
         WriteDecodeStreamResult(
             ctx,
             resultAddress,
-            inputConsumed: inputSize > int.MaxValue ? int.MaxValue : (int)inputSize,
+            inputConsumed,
-            outputWritten: 0,
+            outputWritten,
-            totalDecodedSamples: 0,
+            totalSamples,
-            frames: inputSize != 0 || outputSize != 0 ? 1u : 0u);
+            frames);
 
         Trace(
             $"batch_job_decode info=0x{infoAddress:X16} instance=0x{instanceId:X8} " +
             $"in=0x{inputAddress:X16}+0x{inputSize:X} out=0x{outputAddress:X16}+0x{outputSize:X} " +
-            $"result=0x{resultAddress:X16}");
+            $"written={outputWritten} frames={frames} result=0x{resultAddress:X16}");
         return ctx.SetReturn(0);
     }
 
+    private static bool TryGetInstance(uint instanceId, out AjmInstanceState instance)
+    {
+        instance = null!;
+        var codec = instanceId >> 14;
+        var slot = instanceId & 0x3FFF;
+        if (slot == 0)
+        {
+            return false;
+        }
+
+        foreach (var context in Contexts.Values)
+        {
+            lock (context.Gate)
+            {
+                if (context.InstancesBySlot.TryGetValue(slot, out var found) &&
+                    found.Codec == codec)
+                {
+                    instance = found;
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
     /// <summary>
-    /// Submits a built batch. Instant-complete silence stub: publish a batch id
+    /// Submits a built batch. Hot path after BatchJobDecode; unresolved WARNs
-    /// and clear any error out. Decode sidebands were already filled at
+    /// dominate the log. Instant-complete: publish a batch id and clear any
-    /// job-enqueue time.
+    /// error out. Decode sidebands were already filled at job-enqueue time.
     /// </summary>
     [SysAbiExport(
         Nid = "5tOfnaClcqM",
@@ -363,6 +470,7 @@ public static class AjmExports
     private const ulong AjmBatchInfoSizeField = 16;
     private const ulong AjmBatchInfoLastGoodJobField = 24;
     private const ulong AjmJobRunSize = 64;
+    private const int OrbisAjmErrorJobCreation = unchecked((int)0x80930012);
     private const ulong MaxSilentPcmBytes = 1 << 20;
     // AjmSidebandResult (8) + AjmSidebandStream (16) + AjmSidebandMFrame (8).
     private const int DecodeSidebandBytes = 32;

src/SharpEmu.Libs/Audio/AjmMp3Decoder.cs

@@ -0,0 +1,231 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using NLayer;
+using System.Buffers.Binary;
+using System.Reflection;
+
+namespace SharpEmu.Libs.Audio;
+
+/// <summary>
+/// Stateful AJM MP3 (codec 0) decoder. GTA menu music arrives as ~960-byte
+/// packets that NLayer must decode with a persistent bit-reservoir.
+/// </summary>
+internal sealed class AjmMp3Decoder
+{
+    private static readonly Type? MpegStreamReaderType =
+        typeof(MpegFrameDecoder).Assembly.GetType("NLayer.Decoder.MpegStreamReader");
+
+    private static readonly MethodInfo? NextFrameMethod =
+        MpegStreamReaderType?.GetMethod(
+            "NextFrame",
+            BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic);
+
+    private static readonly MethodInfo? ClearBufferMethod =
+        typeof(MpegFrameDecoder).Assembly.GetType("NLayer.Decoder.FrameBase")
+            ?.GetMethod("ClearBuffer", BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic);
+
+    private readonly MpegFrameDecoder _decoder = new();
+    private readonly object _gate = new();
+    private byte[] _pending = Array.Empty<byte>();
+    private readonly float[] _floatScratch = new float[1152 * 2];
+
+    public ulong TotalDecodedSamples { get; private set; }
+
+    public void Reset()
+    {
+        lock (_gate)
+        {
+            _decoder.Reset();
+            _pending = Array.Empty<byte>();
+            TotalDecodedSamples = 0;
+        }
+    }
+
+    public DecodeResult Decode(ReadOnlySpan<byte> input, Span<byte> output, bool pcm16)
+    {
+        lock (_gate)
+        {
+            if (MpegStreamReaderType is null || NextFrameMethod is null)
+            {
+                return DecodeResult.Failed;
+            }
+
+            var merged = new byte[_pending.Length + input.Length];
+            if (_pending.Length != 0)
+            {
+                _pending.CopyTo(merged, 0);
+            }
+
+            input.CopyTo(merged.AsSpan(_pending.Length));
+
+            using var stream = new MemoryStream(merged, writable: false);
+            object? reader;
+            try
+            {
+                reader = Activator.CreateInstance(
+                    MpegStreamReaderType,
+                    BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic,
+                    binder: null,
+                    args: [stream],
+                    culture: null);
+            }
+            catch
+            {
+                return DecodeResult.Failed;
+            }
+
+            if (reader is null)
+            {
+                return DecodeResult.Failed;
+            }
+
+            var outputOffset = 0;
+            var inputConsumed = 0;
+            var frames = 0u;
+            var samplesThisCall = 0u;
+
+            while (outputOffset < output.Length)
+            {
+                object? frameObj;
+                try
+                {
+                    frameObj = NextFrameMethod.Invoke(reader, null);
+                }
+                catch
+                {
+                    break;
+                }
+
+                if (frameObj is not IMpegFrame frame)
+                {
+                    break;
+                }
+
+                try
+                {
+                    var frameOffset = GetFrameOffset(frameObj);
+                    var frameLength = frame.FrameLength;
+                    if (frameLength <= 0 || frameOffset + frameLength > merged.Length)
+                    {
+                        break;
+                    }
+
+                    int sampleCount;
+                    try
+                    {
+                        sampleCount = _decoder.DecodeFrame(frame, _floatScratch, 0);
+                    }
+                    catch
+                    {
+                        _decoder.Reset();
+                        inputConsumed = frameOffset + frameLength;
+                        continue;
+                    }
+
+                    if (sampleCount <= 0)
+                    {
+                        inputConsumed = frameOffset + frameLength;
+                        continue;
+                    }
+
+                    var channels = frame.ChannelMode == MpegChannelMode.Mono ? 1 : 2;
+                    var bytesPerSample = pcm16 ? 2 : 4;
+                    var byteCount = sampleCount * bytesPerSample;
+                    if (outputOffset + byteCount > output.Length)
+                    {
+                        // Not enough room for this frame — leave it for next job.
+                        break;
+                    }
+
+                    if (pcm16)
+                    {
+                        WritePcm16(_floatScratch.AsSpan(0, sampleCount), output[outputOffset..]);
+                    }
+                    else
+                    {
+                        WriteFloat(_floatScratch.AsSpan(0, sampleCount), output[outputOffset..]);
+                    }
+
+                    outputOffset += byteCount;
+                    inputConsumed = frameOffset + frameLength;
+                    frames++;
+                    samplesThisCall += (uint)(sampleCount / Math.Max(channels, 1));
+                    TotalDecodedSamples += (ulong)(sampleCount / Math.Max(channels, 1));
+                }
+                finally
+                {
+                    try
+                    {
+                        ClearBufferMethod?.Invoke(frameObj, null);
+                    }
+                    catch
+                    {
+                        // best-effort
+                    }
+                }
+            }
+
+            _pending = inputConsumed < merged.Length
+                ? merged[inputConsumed..]
+                : Array.Empty<byte>();
+
+            // Consume the portion of *this* input that left the pending window.
+            var pendingBefore = merged.Length - input.Length;
+            var consumedFromInput = Math.Clamp(inputConsumed - pendingBefore, 0, input.Length);
+
+            return new DecodeResult(
+                Success: frames > 0 || consumedFromInput > 0,
+                InputConsumed: consumedFromInput,
+                OutputWritten: outputOffset,
+                Frames: frames,
+                SamplesThisCall: samplesThisCall);
+        }
+    }
+
+    private static int GetFrameOffset(object frameObj)
+    {
+        for (var type = frameObj.GetType(); type is not null; type = type.BaseType)
+        {
+            var prop = type.GetProperty(
+                "Offset",
+                BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.DeclaredOnly);
+            if (prop?.GetValue(frameObj) is long offset)
+            {
+                return checked((int)offset);
+            }
+        }
+
+        return 0;
+    }
+
+    private static void WritePcm16(ReadOnlySpan<float> samples, Span<byte> destination)
+    {
+        for (var i = 0; i < samples.Length; i++)
+        {
+            var sample = samples[i];
+            var scaled = sample < 0f ? sample * 32768f : sample * 32767f;
+            var value = (short)Math.Clamp(MathF.Round(scaled), short.MinValue, short.MaxValue);
+            BinaryPrimitives.WriteInt16LittleEndian(destination[(i * 2)..], value);
+        }
+    }
+
+    private static void WriteFloat(ReadOnlySpan<float> samples, Span<byte> destination)
+    {
+        for (var i = 0; i < samples.Length; i++)
+        {
+            var bits = BitConverter.SingleToInt32Bits(samples[i]);
+            BinaryPrimitives.WriteInt32LittleEndian(destination[(i * 4)..], bits);
+        }
+    }
+
+    internal readonly record struct DecodeResult(
+        bool Success,
+        int InputConsumed,
+        int OutputWritten,
+        uint Frames,
+        uint SamplesThisCall)
+    {
+        public static DecodeResult Failed { get; } = new(false, 0, 0, 0, 0);
+    }
+}

src/SharpEmu.Libs/Audio/AudioOutExports.cs

@@ -212,6 +212,14 @@ public static class AudioOutExports
             return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
+        // Same rule as AudioOut2 PortGetState: never bulk-write onto the caller
+        // stack. Some titles place small locals next to the canary; a full
+        // SceAudioOutPortState write smashes it.
+        if (IsGuestStackAddress(stateAddress))
+        {
+            return ctx.SetReturn(0);
+        }
+
         // SceAudioOutPortState: report a connected primary output at full volume
         // so pacing/mixing code sees a live port. We do no host rerouting, so
         // rerouteCounter and flag stay zero.
@@ -229,6 +237,9 @@ public static class AudioOutExports
         return ctx.SetReturn(0);
     }
 
+    private static bool IsGuestStackAddress(ulong value) =>
+        value >= 0x0000_7FF0_0000_0000UL && value <= 0x0000_7FFF_FFFF_FFFFUL;
+
     [SysAbiExport(
         Nid = "w3PdaSTSwGE",
         ExportName = "sceAudioOutOutputs",

src/SharpEmu.Libs/Diagnostics/LoadProgressDiagnostics.cs

@@ -0,0 +1,155 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Diagnostics;
+using System.Threading;
+using SharpEmu.Libs.Agc;
+
+namespace SharpEmu.Libs.Diagnostics;
+
+/// <summary>
+/// Rate-limited progress probes armed when GTA's 'North Audio Update' thread
+/// starts. Used to classify North Yankton freezes (flip vs present vs GPU wait)
+/// without enabling full AGC/VideoOut trace.
+/// </summary>
+public static class LoadProgressDiagnostics
+{
+    // Keep probes live long enough to cover a stuck Yankton session.
+    private const long ActiveWindowMs = 120_000;
+
+    private static long _armedTicks;
+    private static long _flipSubmitTraceCount;
+    private static long _orderedFlipEnqueueTraceCount;
+    private static long _presentTakenTraceCount;
+    private static long _presentNotTakenTraceCount;
+    private static long _gpuWaitSnapshotTraceCount;
+
+    public static void ArmIfNorthAudioThread(string? threadName)
+    {
+        if (string.IsNullOrEmpty(threadName) ||
+            threadName.IndexOf("North Audio", StringComparison.OrdinalIgnoreCase) < 0)
+        {
+            return;
+        }
+
+        if (Interlocked.CompareExchange(
+                ref _armedTicks,
+                Stopwatch.GetTimestamp(),
+                0) == 0)
+        {
+            Console.Error.WriteLine(
+                "[LOADER][TRACE] load_progress.armed reason=north_audio " +
+                $"window_ms={ActiveWindowMs}");
+        }
+    }
+
+    public static bool IsActive
+    {
+        get
+        {
+            var armed = Volatile.Read(ref _armedTicks);
+            if (armed == 0)
+            {
+                return false;
+            }
+
+            var elapsedMs = (Stopwatch.GetTimestamp() - armed) * 1000L /
+                Stopwatch.Frequency;
+            return elapsedMs <= ActiveWindowMs;
+        }
+    }
+
+    public static void TraceFlipSubmit(
+        int handle,
+        int bufferIndex,
+        int flipMode,
+        bool submitGpuImage,
+        bool guestImageSubmitted,
+        ulong guestImageAddress,
+        int flipEventCount)
+    {
+        if (!IsActive || !ShouldTrace(ref _flipSubmitTraceCount, out var count))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] load_progress.flip_submit count={count} " +
+            $"handle={handle} index={bufferIndex} mode={flipMode} " +
+            $"gpu_image={submitGpuImage} submitted={guestImageSubmitted} " +
+            $"addr=0x{guestImageAddress:X16} events={flipEventCount}");
+    }
+
+    public static void TraceOrderedFlipEnqueue(
+        int videoOutHandle,
+        int displayBufferIndex,
+        ulong address,
+        long version,
+        bool enqueued)
+    {
+        if (!IsActive ||
+            !ShouldTrace(ref _orderedFlipEnqueueTraceCount, out var count))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] load_progress.ordered_flip count={count} " +
+            $"handle={videoOutHandle} index={displayBufferIndex} " +
+            $"addr=0x{address:X16} version={version} enqueued={enqueued}");
+    }
+
+    public static void TracePresentTaken(
+        long presentedSequence,
+        ulong guestImageAddress,
+        long guestImageVersion)
+    {
+        if (!IsActive || !ShouldTrace(ref _presentTakenTraceCount, out var count))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] load_progress.present_taken count={count} " +
+            $"seq={presentedSequence} addr=0x{guestImageAddress:X16} " +
+            $"version={guestImageVersion}");
+    }
+
+    public static void TracePresentNotTaken(
+        long presentedSequence,
+        bool hasPendingPresentation)
+    {
+        if (!IsActive ||
+            !ShouldTrace(ref _presentNotTakenTraceCount, out var count))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] load_progress.present_not_taken count={count} " +
+            $"seq={presentedSequence} pending={hasPendingPresentation}");
+    }
+
+    public static void TraceGpuWaitSnapshot(object? memory = null)
+    {
+        if (!IsActive ||
+            !ShouldTrace(ref _gpuWaitSnapshotTraceCount, out var count))
+        {
+            return;
+        }
+
+        var snapshot = GpuWaitRegistry.SnapshotOutstanding(memory);
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] load_progress.gpu_waits count={count} " +
+            $"outstanding={snapshot.Outstanding} latched={snapshot.Latched} " +
+            $"oldest_ms={snapshot.OldestAgeMs} " +
+            $"sample_addr=0x{snapshot.SampleWaitAddress:X16} " +
+            $"sample_queue={snapshot.SampleQueueName ?? "-"}");
+    }
+
+    private static bool ShouldTrace(ref long counter, out long count)
+    {
+        count = Interlocked.Increment(ref counter);
+        return count <= 16 || (count & (count - 1)) == 0;
+    }
+}

src/SharpEmu.Libs/Gpu/GuestGpuTypes.cs

@@ -89,7 +89,8 @@ internal sealed record GuestVertexBuffer(
     uint OffsetBytes,
     byte[] Data,
     int Length,
-    bool Pooled);
+    bool Pooled,
+    bool PerInstance = false);
 
 internal sealed record GuestIndexBuffer(
     byte[] Data,

src/SharpEmu.Libs/Gpu/IGuestGpuBackend.cs

@@ -54,6 +54,7 @@ internal interface IGuestGpuBackend
         int scalarRegisterBufferIndex = -1,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1);
 
     bool TryCompileComputeShader(
@@ -108,7 +109,8 @@ internal interface IGuestGpuBackend
         GuestIndexBuffer? indexBuffer = null,
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
-        ulong shaderAddress = 0);
+        ulong shaderAddress = 0,
+        int baseVertex = 0);
 
     void SubmitOffscreenTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -124,7 +126,8 @@ internal interface IGuestGpuBackend
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
         GuestDepthTarget? depthTarget = null,
-        ulong shaderAddress = 0);
+        ulong shaderAddress = 0,
+        int baseVertex = 0);
 
     void SubmitStorageTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -236,6 +239,12 @@ internal interface IGuestGpuBackend
 
     void SubmitGuestImageWrite(ulong address, byte[] pixels);
 
+    /// <summary>
+    /// Asks the presenter to refresh CPU-dirty guest images on its render/present
+    /// drain. Must not enqueue retained plane copies on the producer path.
+    /// </summary>
+    void RequestCpuWrittenGuestImageSync(ulong scopeAddress = 0, ulong scopeByteCount = ulong.MaxValue);
+
     bool TryGetGuestImageExtent(ulong address, out uint width, out uint height, out ulong byteCount);
 
     IReadOnlyList<(ulong Address, uint Width, uint Height, ulong ByteCount)> GetGuestImageExtents();

src/SharpEmu.Libs/Gpu/Metal/MetalGuestFormats.cs

@@ -218,6 +218,13 @@ internal static class MetalGuestFormats
     {
         var format = (dataFormat, numberType) switch
         {
+            // Early G-buffer / scene targets (R16 + RG32). Keep in sync with
+            // VulkanVideoPresenter.TryDecodeRenderTargetFormat.
+            (2, 0) => MtlPixelFormat.R16Unorm,
+            (2, 1) => MtlPixelFormat.R16Snorm,
+            (2, 4) => MtlPixelFormat.R16Uint,
+            (2, 5) => MtlPixelFormat.R16Sint,
+            (2, 7) => MtlPixelFormat.R16Float,
             (4, 4) => MtlPixelFormat.R32Uint,
             (4, 5) => MtlPixelFormat.R32Sint,
             (4, 7) => MtlPixelFormat.R32Float,
@@ -230,6 +237,8 @@ internal static class MetalGuestFormats
             (10, 5) => MtlPixelFormat.Rgba8Sint,
             (10, 9) => MtlPixelFormat.Rgba8UnormSrgb,
             (10, _) => MtlPixelFormat.Rgba8Unorm,
+            (11, 4) => MtlPixelFormat.Rg32Uint,
+            (11, 5) => MtlPixelFormat.Rg32Sint,
             (11, 7) => MtlPixelFormat.Rg32Float,
             (12, 4) => MtlPixelFormat.Rgba16Uint,
             (12, 5) => MtlPixelFormat.Rgba16Sint,
@@ -258,10 +267,12 @@ internal static class MetalGuestFormats
 
         var outputKind = format switch
         {
-            MtlPixelFormat.R8Uint or MtlPixelFormat.R32Uint or MtlPixelFormat.Rg16Uint or
+            MtlPixelFormat.R8Uint or MtlPixelFormat.R16Uint or MtlPixelFormat.R32Uint or
-                MtlPixelFormat.Rgba8Uint or MtlPixelFormat.Rgba16Uint => Gen5PixelOutputKind.Uint,
+                MtlPixelFormat.Rg16Uint or MtlPixelFormat.Rg32Uint or MtlPixelFormat.Rgba8Uint or
-            MtlPixelFormat.R32Sint or MtlPixelFormat.Rg16Sint or MtlPixelFormat.Rgba8Sint or
+                MtlPixelFormat.Rgba16Uint => Gen5PixelOutputKind.Uint,
-                MtlPixelFormat.Rgba16Sint => Gen5PixelOutputKind.Sint,
+            MtlPixelFormat.R16Sint or MtlPixelFormat.R32Sint or MtlPixelFormat.Rg16Sint or
+                MtlPixelFormat.Rg32Sint or MtlPixelFormat.Rgba8Sint or MtlPixelFormat.Rgba16Sint =>
+                Gen5PixelOutputKind.Sint,
             _ => Gen5PixelOutputKind.Float,
         };
         result = new MetalRenderTargetFormat(format, outputKind);

src/SharpEmu.Libs/Gpu/Metal/MetalGuestGpuBackend.cs

@@ -70,6 +70,7 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
         int scalarRegisterBufferIndex = -1,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1)
     {
         shader = null;
@@ -85,6 +86,7 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
                 scalarRegisterBufferIndex,
                 pixelInputEnable,
                 pixelInputAddress,
+                pixelInputCntl,
                 storageBufferOffsetAlignment))
         {
             return false;
@@ -251,7 +253,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
         GuestIndexBuffer? indexBuffer = null,
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
         MetalVideoPresenter.SubmitDepthOnlyTranslatedDraw(
             Msl(pixelShader),
             textures,
@@ -265,7 +268,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
             indexBuffer,
             vertexBuffers,
             renderState,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);
 
     public void SubmitOffscreenTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -281,7 +285,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
         GuestDepthTarget? depthTarget = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
         MetalVideoPresenter.SubmitOffscreenTranslatedDraw(
             Msl(pixelShader),
             textures,
@@ -296,7 +301,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
             vertexBuffers,
             renderState,
             depthTarget,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);
 
     public void SubmitStorageTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -395,6 +401,9 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
     public void SubmitGuestImageWrite(ulong address, byte[] pixels) =>
         MetalVideoPresenter.SubmitGuestImageWrite(address, pixels);
 
+    public void RequestCpuWrittenGuestImageSync(ulong scopeAddress = 0, ulong scopeByteCount = ulong.MaxValue) =>
+        MetalVideoPresenter.RequestCpuWrittenGuestImageSync(scopeAddress, scopeByteCount);
+
     public bool TryGetGuestImageExtent(ulong address, out uint width, out uint height, out ulong byteCount) =>
         MetalVideoPresenter.TryGetGuestImageExtent(address, out width, out height, out byteCount);
 

src/SharpEmu.Libs/Gpu/Metal/MetalVideoPresenter.Draws.cs

@@ -1,6 +1,7 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Buffers.Binary;
 using SharpEmu.Libs.Agc;
 using SharpEmu.ShaderCompiler;
 using SharpEmu.ShaderCompiler.Metal;
@@ -87,7 +88,8 @@ internal static partial class MetalVideoPresenter
         uint InstanceCount,
         uint PrimitiveType,
         GuestIndexBuffer? IndexBuffer,
-        GuestRenderState RenderState);
+        GuestRenderState RenderState,
+        int BaseVertex = 0);
 
     private sealed record OffscreenGuestDraw(
         TranslatedGuestDraw Draw,
@@ -245,7 +247,8 @@ internal static partial class MetalVideoPresenter
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers,
         GuestRenderState? renderState,
         GuestDepthTarget? depthTarget,
-        ulong shaderAddress)
+        ulong shaderAddress,
+        int baseVertex = 0)
     {
         if (targets.Count == 0)
         {
@@ -293,7 +296,8 @@ internal static partial class MetalVideoPresenter
                         instanceCount,
                         primitiveType,
                         indexBuffer,
-                        effectiveRenderState),
+                        effectiveRenderState,
+                        baseVertex),
                     ToArray(targets),
                     depthTarget,
                     PublishTarget: true,
@@ -321,7 +325,8 @@ internal static partial class MetalVideoPresenter
         GuestIndexBuffer? indexBuffer,
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers,
         GuestRenderState? renderState,
-        ulong shaderAddress)
+        ulong shaderAddress,
+        int baseVertex = 0)
     {
         if (depthTarget.Address == 0 || depthTarget.Width == 0 || depthTarget.Height == 0)
         {
@@ -348,7 +353,8 @@ internal static partial class MetalVideoPresenter
                         instanceCount,
                         primitiveType,
                         indexBuffer,
-                        renderState ?? GuestRenderState.Default),
+                        renderState ?? GuestRenderState.Default,
+                        baseVertex),
                     [new GuestRenderTarget(Address: 0, depthTarget.Width, depthTarget.Height, Format: 10, NumberType: 0)],
                     depthTarget,
                     PublishTarget: false,
@@ -981,17 +987,38 @@ internal static partial class MetalVideoPresenter
 
     private static void EncodeDrawCall(nint encoder, TranslatedGuestDraw draw)
     {
-        var primitive = GetPrimitiveType(draw.PrimitiveType);
+        var indexed = draw.IndexBuffer is not null;
-        var vertexCount = draw.PrimitiveType == 0x11 && draw.IndexBuffer is null
+        var hasVertexBuffers = draw.VertexBuffers.Length > 0;
-            ? 4u
+        var primitive = GetPrimitiveType(
-            : draw.VertexCount;
+            draw.PrimitiveType,
+            indexed,
+            draw.VertexCount,
+            hasVertexBuffers);
+        var vertexCount = AgcPrimitiveHelpers.GetRectListDrawVertexCount(
+            draw.PrimitiveType,
+            draw.VertexCount,
+            indexed,
+            hasVertexBuffers);
+        var baseVertex = (nuint)Math.Max(draw.BaseVertex, 0);
         if (draw.IndexBuffer is { } indexBuffer)
         {
             var device = MetalNative.Send(encoder, MetalNative.Selector("device"));
             var slice = AllocateUpload(
                 device, Math.Max(indexBuffer.Length, 1), out var buffer, out var offset);
-            indexBuffer.Data.AsSpan(0, Math.Min(indexBuffer.Length, indexBuffer.Data.Length))
+            var source = indexBuffer.Data.AsSpan(
-                .CopyTo(slice);
+                0,
+                Math.Min(indexBuffer.Length, indexBuffer.Data.Length));
+            // Metal drawIndexed without baseVertex: bake GE_INDX_OFFSET into
+            // the uploaded indices so glyph batches still hit the right verts.
+            if (draw.BaseVertex != 0)
+            {
+                BakeBaseVertexIntoIndices(source, slice, indexBuffer.Is32Bit, draw.BaseVertex);
+            }
+            else
+            {
+                source.CopyTo(slice);
+            }
+
             MetalNative.SendDrawIndexedPrimitives(
                 encoder,
                 MetalNative.Selector("drawIndexedPrimitives:indexCount:indexType:indexBuffer:indexBufferOffset:instanceCount:"),
@@ -1012,12 +1039,46 @@ internal static partial class MetalVideoPresenter
                 encoder,
                 MetalNative.Selector("drawPrimitives:vertexStart:vertexCount:instanceCount:"),
                 primitive,
-                0,
+                baseVertex,
                 vertexCount,
                 Math.Max(draw.InstanceCount, 1));
         }
     }
 
+    private static void BakeBaseVertexIntoIndices(
+        ReadOnlySpan<byte> source,
+        Span<byte> destination,
+        bool is32Bit,
+        int baseVertex)
+    {
+        if (is32Bit)
+        {
+            var count = source.Length / sizeof(uint);
+            for (var index = 0; index < count; index++)
+            {
+                var value = BinaryPrimitives.ReadUInt32LittleEndian(
+                    source.Slice(index * sizeof(uint), sizeof(uint)));
+                var adjusted = unchecked((uint)(value + baseVertex));
+                BinaryPrimitives.WriteUInt32LittleEndian(
+                    destination.Slice(index * sizeof(uint), sizeof(uint)),
+                    adjusted);
+            }
+
+            return;
+        }
+
+        var shortCount = source.Length / sizeof(ushort);
+        for (var index = 0; index < shortCount; index++)
+        {
+            var value = BinaryPrimitives.ReadUInt16LittleEndian(
+                source.Slice(index * sizeof(ushort), sizeof(ushort)));
+            var adjusted = unchecked((ushort)(value + baseVertex));
+            BinaryPrimitives.WriteUInt16LittleEndian(
+                destination.Slice(index * sizeof(ushort), sizeof(ushort)),
+                adjusted);
+        }
+    }
+
     private static bool TryGetDrawPipeline(
         nint device,
         TranslatedGuestDraw draw,
@@ -1226,8 +1287,11 @@ internal static partial class MetalVideoPresenter
                 ? vertexBuffer.Stride
                 : Math.Max(vertexBuffer.ComponentCount, 1) * 4;
             MetalNative.Send(layout, MetalNative.Selector("setStride:"), (nint)stride);
-            // MTLVertexStepFunction.PerVertex = 1.
+            // MTLVertexStepFunction: PerVertex = 1, PerInstance = 2.
-            MetalNative.Send(layout, MetalNative.Selector("setStepFunction:"), 1);
+            MetalNative.Send(
+                layout,
+                MetalNative.Selector("setStepFunction:"),
+                vertexBuffer.PerInstance ? 2 : 1);
         }
 
         return descriptor;
@@ -2059,13 +2123,30 @@ internal static partial class MetalVideoPresenter
 
                 return 3;
             case 6:
-            case 0x11:
                 return 4;
             default:
                 return 3;
         }
     }
 
+    private static nuint GetPrimitiveType(
+        uint guestPrimitiveType,
+        bool indexed,
+        uint vertexCount,
+        bool hasVertexBuffers)
+    {
+        if (AgcPrimitiveHelpers.ShouldDrawRectListAsTriangleStrip(
+                guestPrimitiveType,
+                indexed,
+                vertexCount,
+                hasVertexBuffers))
+        {
+            return 4; // MTLPrimitiveTypeTriangleStrip
+        }
+
+        return GetPrimitiveType(guestPrimitiveType);
+    }
+
     private static bool IsIntegerFormat(Gen5PixelOutputKind kind) =>
         kind is Gen5PixelOutputKind.Uint or Gen5PixelOutputKind.Sint;
 

src/SharpEmu.Libs/Gpu/Metal/MetalVideoPresenter.GuestImages.cs

@@ -128,6 +128,7 @@ internal static partial class MetalVideoPresenter
     private static readonly Dictionary<long, GuestImage> _guestImageVersions = new();
     private static readonly Dictionary<(int Handle, int BufferIndex), long>
         _lastOrderedGuestFlipVersions = new();
+    private static readonly Dictionary<ulong, ulong> _untrackedGuestImageContentProbes = new();
     private static long _orderedGuestFlipVersionSequence;
     private static volatile ICpuMemory? _guestMemory;
 
@@ -162,6 +163,22 @@ internal static partial class MetalVideoPresenter
     public static void AttachGuestMemory(ICpuMemory memory) =>
         _guestMemory = memory;
 
+    private static int _cpuWrittenGuestImageSyncRequested;
+    private static long _guestImageCpuSyncTraceCount;
+
+    public static void RequestCpuWrittenGuestImageSync(
+        ulong scopeAddress = 0,
+        ulong scopeByteCount = ulong.MaxValue)
+    {
+        _ = scopeAddress;
+        if (scopeByteCount == 0 || !GuestImageWriteTracker.Enabled)
+        {
+            return;
+        }
+
+        Volatile.Write(ref _cpuWrittenGuestImageSyncRequested, 1);
+    }
+
     public static long SubmitOrderedGuestAction(Action action, string debugName)
     {
         ArgumentNullException.ThrowIfNull(action);
@@ -253,8 +270,110 @@ internal static partial class MetalVideoPresenter
         }
     }
 
-    public static bool IsGuestImageUploadKnown(ulong address, uint format, uint numberType) =>
+    public static bool IsGuestImageUploadKnown(ulong address, uint format, uint numberType)
-        IsGuestImageAvailable(address, format, numberType);
+    {
+        var guestFormat = GetGuestTextureFormat(format, numberType);
+        if (address == 0 || guestFormat == 0)
+        {
+            return false;
+        }
+
+        ulong probeByteCount = 0;
+        lock (_gate)
+        {
+            if (!_availableGuestImages.TryGetValue(address, out var availableFormat) ||
+                availableFormat != guestFormat)
+            {
+                return false;
+            }
+
+            if (GuestImageWriteTracker.Enabled)
+            {
+                return true;
+            }
+
+            if (_guestImageExtents.TryGetValue(address, out var extent))
+            {
+                probeByteCount = extent.ByteCount;
+            }
+        }
+
+        return IsUntrackedGuestImageContentUnchanged(address, probeByteCount);
+    }
+
+    private static bool IsUntrackedGuestImageContentUnchanged(ulong address, ulong byteCount)
+    {
+        var memory = _guestMemory;
+        if (memory is null || byteCount == 0)
+        {
+            return true;
+        }
+
+        var probe = ComputeSparseGuestContentProbe(memory, address, byteCount);
+        lock (_gate)
+        {
+            if (!_untrackedGuestImageContentProbes.TryGetValue(address, out var previous))
+            {
+                _untrackedGuestImageContentProbes[address] = probe;
+                return true;
+            }
+
+            if (previous == probe)
+            {
+                return true;
+            }
+
+            _untrackedGuestImageContentProbes[address] = probe;
+            return false;
+        }
+    }
+
+    private static ulong ComputeSparseGuestContentProbe(
+        ICpuMemory memory,
+        ulong address,
+        ulong byteCount)
+    {
+        Span<byte> sample = stackalloc byte[64];
+        ulong hash = 14695981039346656037UL;
+        Span<ulong> offsets = stackalloc ulong[3];
+        var offsetCount = 0;
+        offsets[offsetCount++] = 0;
+        if (byteCount > 128)
+        {
+            offsets[offsetCount++] = byteCount / 2;
+        }
+
+        if (byteCount > 64)
+        {
+            offsets[offsetCount++] = byteCount - 64;
+        }
+
+        for (var o = 0; o < offsetCount; o++)
+        {
+            var offset = offsets[o];
+            if (offset >= byteCount)
+            {
+                continue;
+            }
+
+            var length = (int)Math.Min(64UL, byteCount - offset);
+            if (!memory.TryRead(address + offset, sample[..length]))
+            {
+                hash ^= 0x9E3779B97F4A7C15UL + offset;
+                continue;
+            }
+
+            for (var i = 0; i < length; i++)
+            {
+                hash ^= sample[i];
+                hash *= 1099511628211UL;
+            }
+
+            hash ^= (ulong)length + offset;
+        }
+
+        return hash ^ byteCount;
+    }
 
     public static bool GuestImageWantsInitialData(ulong address)
     {
@@ -599,7 +718,7 @@ internal static partial class MetalVideoPresenter
         var completedWork = 0;
         RecycleCompletedUploadPages();
         RecycleCompletedSnapshotResources();
-        EvictDirtyCachedDrawTextures();
+        DrainGuestImageCpuSync(device);
         try
         {
             while (completedWork < MaxGuestWorkPerRender)

src/SharpEmu.Libs/Gpu/Metal/MetalVideoPresenter.TextureCache.cs

@@ -45,12 +45,11 @@ internal static partial class MetalVideoPresenter
         texture.Pitch,
         texture.Sampler);
 
-    /// <summary>Caching requires the write tracker: without page protection a
+    /// <summary>Storage textures are shader-writable on the GPU, so their
-    /// guest CPU write would never evict the entry and draws would sample
+    /// content identity is not stable. CPU rewrites of protected/CPU-backed
-    /// stale texels forever. Storage textures are shader-writable on the GPU,
+    /// images still evict via DrainGuestImageCpuSync when those addresses
-    /// so their content identity is not stable either.</summary>
+    /// are dirty.</summary>
     private static bool IsCacheableDrawTexture(GuestDrawTexture texture) =>
-        GuestImageWriteTracker.Enabled &&
         texture.Address != 0 &&
         !texture.IsStorage &&
         !texture.IsFallback;
@@ -69,20 +68,100 @@ internal static partial class MetalVideoPresenter
         _ = MetalNative.Send(handle, MetalNative.Selector("retain"));
         _drawTextureCache[key] = handle;
         _cachedDrawTextureIdentities[key] = 0;
-        GuestImageWriteTracker.Track(
+        // No GuestImageWriteTracker.Track: watch-only cache registrations
-            texture.Address,
+        // widened the managed-write hot path. CPU-backed / protected images
-            (ulong)texture.RgbaPixels.Length,
+        // own dirty notifications used for eviction.
-            Volatile.Read(ref _executingGuestWorkSequence),
-            "metal.texture-cache");
     }
 
-    /// <summary>Runs once per drain, before any queued draw executes: a draw
+    /// <summary>
-    /// whose texels the submit thread skipped must never resolve to an entry
+    /// Single dirty consumer per drain: re-upload CPU-written guest images,
-    /// the guest has since rewritten.</summary>
+    /// evict matching draw-texture cache entries, then re-arm once per address.
-    private static void EvictDirtyCachedDrawTextures()
+    /// </summary>
+    private static void DrainGuestImageCpuSync(nint device)
     {
+        if (!GuestImageWriteTracker.Enabled)
+        {
+            return;
+        }
+
+        _ = Interlocked.Exchange(ref _cpuWrittenGuestImageSyncRequested, 0);
+
+        HashSet<ulong>? dirtyAddresses = null;
+        List<(ulong Address, uint Width, uint Height, ulong ByteCount)>? extents = null;
+        lock (_gate)
+        {
+            if (_guestImageExtents.Count > 0)
+            {
+                extents = new(_guestImageExtents.Count);
+                foreach (var entry in _guestImageExtents)
+                {
+                    extents.Add((
+                        entry.Key,
+                        entry.Value.Width,
+                        entry.Value.Height,
+                        entry.Value.ByteCount));
+                }
+            }
+        }
+
+        var memory = _guestMemory;
+        if (extents is not null)
+        {
+            foreach (var (address, width, height, byteCount) in extents)
+            {
+                if (!GuestImageWriteTracker.ConsumeDirty(address))
+                {
+                    continue;
+                }
+
+                (dirtyAddresses ??= []).Add(address);
+                if (memory is null ||
+                    byteCount == 0 ||
+                    byteCount > 128UL * 1024UL * 1024UL)
+                {
+                    continue;
+                }
+
+                GuestImage? image;
+                lock (_gate)
+                {
+                    _guestImages.TryGetValue(address, out image);
+                }
+
+                if (image is null)
+                {
+                    continue;
+                }
+
+                var pixels = new byte[byteCount];
+                if (!memory.TryRead(address, pixels) ||
+                    pixels.AsSpan().IndexOfAnyExcept((byte)0) < 0)
+                {
+                    continue;
+                }
+
+                ExecuteGuestImageWrite(
+                    device,
+                    queue: 0,
+                    new GuestImageWrite(address, pixels, 0));
+                if (Interlocked.Increment(ref _guestImageCpuSyncTraceCount) <= 64)
+                {
+                    Console.Error.WriteLine(
+                        $"[SYNC] cpu-write-drain addr=0x{address:X} {width}x{height}");
+                }
+            }
+        }
+
         if (_drawTextureCache.Count == 0)
         {
+            if (dirtyAddresses is not null)
+            {
+                foreach (var address in dirtyAddresses)
+                {
+                    GuestImageWriteTracker.Rearm(address);
+                }
+            }
+
             return;
         }
 
@@ -90,17 +169,17 @@ internal static partial class MetalVideoPresenter
         // share one source address (same texels, different samplers), and
         // ConsumeDirty clears the flag on first read — evicting only the
         // first identity would leave the others sampling stale texels.
-        HashSet<ulong>? dirtyAddresses = null;
         foreach (var entry in _drawTextureCache)
         {
-            if (dirtyAddresses is not null && dirtyAddresses.Contains(entry.Key.Address))
+            var address = entry.Key.Address;
+            if (dirtyAddresses is not null && dirtyAddresses.Contains(address))
             {
                 continue;
             }
 
-            if (GuestImageWriteTracker.ConsumeDirty(entry.Key.Address))
+            if (GuestImageWriteTracker.ConsumeDirty(address))
             {
-                (dirtyAddresses ??= []).Add(entry.Key.Address);
+                (dirtyAddresses ??= []).Add(address);
             }
         }
 
@@ -118,6 +197,14 @@ internal static partial class MetalVideoPresenter
 
             _drawTextureCache.Clear();
             _cachedDrawTextureIdentities.Clear();
+            if (dirtyAddresses is not null)
+            {
+                foreach (var address in dirtyAddresses)
+                {
+                    GuestImageWriteTracker.Rearm(address);
+                }
+            }
+
             return;
         }
 

src/SharpEmu.Libs/Gpu/Vulkan/VulkanGuestGpuBackend.cs

@@ -64,6 +64,7 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
         int scalarRegisterBufferIndex = -1,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1)
     {
         shader = null;
@@ -79,6 +80,7 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
                 scalarRegisterBufferIndex,
                 pixelInputEnable,
                 pixelInputAddress,
+                pixelInputCntl,
                 storageBufferOffsetAlignment))
         {
             return false;
@@ -179,7 +181,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
         GuestIndexBuffer? indexBuffer = null,
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
         VulkanVideoPresenter.SubmitDepthOnlyTranslatedDraw(
             Spirv(pixelShader),
             textures,
@@ -193,7 +196,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
             indexBuffer,
             vertexBuffers,
             renderState,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);
 
     public void SubmitOffscreenTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -209,7 +213,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
         GuestDepthTarget? depthTarget = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
         VulkanVideoPresenter.SubmitOffscreenTranslatedDraw(
             Spirv(pixelShader),
             textures,
@@ -224,7 +229,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
             vertexBuffers,
             renderState,
             depthTarget,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);
 
     public void SubmitStorageTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -375,6 +381,9 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
     public void SubmitGuestImageWrite(ulong address, byte[] pixels) =>
         VulkanVideoPresenter.SubmitGuestImageWrite(address, pixels);
 
+    public void RequestCpuWrittenGuestImageSync(ulong scopeAddress = 0, ulong scopeByteCount = ulong.MaxValue) =>
+        VulkanVideoPresenter.RequestCpuWrittenGuestImageSync(scopeAddress, scopeByteCount);
+
     public bool TryGetGuestImageExtent(ulong address, out uint width, out uint height, out ulong byteCount) =>
         VulkanVideoPresenter.TryGetGuestImageExtent(address, out width, out height, out byteCount);
 

src/SharpEmu.Libs/Kernel/KernelMemoryCompatExports.cs

@@ -1,4 +1,4 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
+// Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
@@ -1773,6 +1773,113 @@ public static partial class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    // WithPrefix sibling of sceKernelAprResolveFilepathsToIdsAndFileSizes.
+    // Resource streamers resolve relative asset paths against a shared directory
+    // prefix. Without HLE, every call returned the generic NOT_FOUND sentinel
+    // and no asset received a real file id/size. Signature inferred from
+    // observed guest registers (rdi=prefix, rsi=path list, rdx=count, rcx=ids,
+    // r8=sizes, r9=error index): the no-prefix sibling's args shifted right by
+    // one with a leading `const char* prefix`.
+    [SysAbiExport(
+        Nid = "w5fcCG+t31g",
+        ExportName = "sceKernelAprResolveFilepathsWithPrefixToIdsAndFileSizes",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAprResolveFilepathsWithPrefixToIdsAndFileSizes(CpuContext ctx)
+    {
+        var prefixAddress = ctx[CpuRegister.Rdi];
+        var pathListAddress = ctx[CpuRegister.Rsi];
+        var count = ctx[CpuRegister.Rdx];
+        var idsAddress = ctx[CpuRegister.Rcx];
+        var sizesAddress = ctx[CpuRegister.R8];
+        var errorIndexAddress = ctx[CpuRegister.R9];
+        if (pathListAddress == 0 || count == 0 || sizesAddress == 0 || count > 1024)
+        {
+            KernelRuntimeCompatExports.TrySetErrno(ctx, Einval);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var prefix = string.Empty;
+        if (prefixAddress != 0)
+        {
+            _ = TryReadNullTerminatedUtf8(ctx, prefixAddress, MaxGuestStringLength, out prefix);
+        }
+
+        for (ulong i = 0; i < count; i++)
+        {
+            if (idsAddress != 0 &&
+                !TryWriteUInt32Compat(ctx, idsAddress + (i * sizeof(uint)), uint.MaxValue))
+            {
+                KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            if (!TryResolveAprFilepath(ctx, pathListAddress, i, out var relativePath))
+            {
+                KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            var guestPath = CombineAprPrefixedPath(prefix, relativePath);
+            var hostPath = ResolveGuestPath(guestPath);
+            if (!TryGetAprFileSize(hostPath, out var fileSize))
+            {
+                LogIoTrace("apr_resolve_with_prefix", guestPath, $"host='{hostPath}' index={i} count={count} result=not_found");
+                if (sizesAddress != 0 &&
+                    !TryWriteUInt64Compat(ctx, sizesAddress + (i * sizeof(ulong)), 0))
+                {
+                    KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                }
+
+                if (errorIndexAddress != 0 &&
+                    !TryWriteUInt32Compat(ctx, errorIndexAddress, (uint)i))
+                {
+                    KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                }
+
+                KernelRuntimeCompatExports.TrySetErrno(ctx, 2); // ENOENT
+                ctx[CpuRegister.Rax] = ulong.MaxValue;
+                return -1;
+            }
+
+            var fileId = AmprFileRegistry.Register(guestPath, hostPath);
+            LogIoTrace("apr_resolve_with_prefix", guestPath, $"host='{hostPath}' index={i} count={count} id=0x{fileId:X8} size={fileSize}");
+
+            if (idsAddress != 0 &&
+                !TryWriteUInt32Compat(ctx, idsAddress + (i * sizeof(uint)), fileId))
+            {
+                KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            if (!TryWriteUInt64Compat(ctx, sizesAddress + (i * sizeof(ulong)), fileSize))
+            {
+                KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static string CombineAprPrefixedPath(string prefix, string relative)
+    {
+        if (string.IsNullOrEmpty(prefix))
+        {
+            return relative;
+        }
+
+        if (string.IsNullOrEmpty(relative))
+        {
+            return prefix;
+        }
+
+        return $"{prefix.TrimEnd('/')}/{relative.TrimStart('/')}";
+    }
+
     // The IDs-only sibling of sceKernelAprResolveFilepathsToIdsAndFileSizes.
     // Games that stream via AMPR APR call this to turn asset paths into file
     // IDs, then hand those IDs to sceAmprAprCommandBufferReadFile. Without it
@@ -7182,28 +7289,41 @@ public static partial class KernelMemoryCompatExports
     {
         if (fd < 0 || bufferAddress == 0 || requested < 512)
         {
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
         OpenDirectory? directory;
+        bool isOpenFile;
         lock (_fdGate)
         {
             _openDirectories.TryGetValue(fd, out directory);
+            isOpenFile = directory is null && _openFiles.ContainsKey(fd);
         }
 
         if (directory is null)
         {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            // A regular file fd used with getdents must not look like EOF (rax=0);
+            // that path has caused GTA's fiWriteAsyncDataWorker to treat the fd
+            // integer as a pointer and AV at address 0xB1.
+            var error = isOpenFile
+                ? OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT
+                : OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            LogIoTrace("getdents", $"fd:{fd}", $"result={(isOpenFile ? "not_directory" : "badfd")}");
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)error);
+            return (int)error;
         }
 
         var currentIndex = directory.NextIndex;
         if (basePointerAddress != 0 && !TryWriteUInt64Compat(ctx, basePointerAddress, (ulong)currentIndex))
         {
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
         if (currentIndex >= directory.Entries.Length)
         {
+            LogIoTrace("getdents", directory.Path, $"fd={fd} result=eof entries={directory.Entries.Length}");
             ctx[CpuRegister.Rax] = 0;
             return (int)OrbisGen2Result.ORBIS_GEN2_OK;
         }
@@ -7234,11 +7354,16 @@ public static partial class KernelMemoryCompatExports
 
     private static string[] EnumerateDirectoryEntries(string hostPath)
     {
-        return Directory.EnumerateFileSystemEntries(hostPath)
+        // Real getdents always yields "." / ".." before other names. An empty
+        // host dir previously returned EOF on the first call (rax=0), which
+        // sent GTA's fiWriteAsyncDataWorker down a path that treated the fd as
+        // a pointer (AV at 0xB1 on /download0/cloudcache/).
+        var children = Directory.EnumerateFileSystemEntries(hostPath)
             .Select(Path.GetFileName)
             .Where(static name => !string.IsNullOrEmpty(name))
-            .OrderBy(static name => name, StringComparer.OrdinalIgnoreCase)
+            .OrderBy(static name => name, StringComparer.OrdinalIgnoreCase);
-            .ToArray()!;
+
+        return new[] { ".", ".." }.Concat(children).ToArray()!;
     }
 
     private static uint ComputeDirectoryEntryHash(ReadOnlySpan<byte> utf8Name)
@@ -7792,6 +7917,47 @@ public static partial class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    private static long _checkReachabilityMissTraceCount;
+
+    // POSIX access(2)-style path reachability probe used by RAGE EnumerationThread.
+    [SysAbiExport(
+        Nid = "uWyW3v98sU4",
+        ExportName = "sceKernelCheckReachability",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCheckReachability(CpuContext ctx)
+    {
+        var pathAddress = ctx[CpuRegister.Rdi];
+        if (pathAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryReadNullTerminatedUtf8(ctx, pathAddress, MaxGuestStringLength, out var guestPath))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var hostPath = ResolveGuestPath(guestPath);
+        if (File.Exists(hostPath) || Directory.Exists(hostPath))
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        // EnumerationThread probes missing mounts during load; surface guest/host
+        // paths so North Yankton stalls are diagnosable without SHARPEMU_LOG_IO.
+        var miss = Interlocked.Increment(ref _checkReachabilityMissTraceCount);
+        if (miss <= 16 || (miss & (miss - 1)) == 0)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][TRACE] kernel.check_reachability_miss count={miss} " +
+                $"guest='{guestPath}' host='{hostPath}'");
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+    }
+
     [SysAbiExport(
         Nid = "fgIsQ10xYVA",
         ExportName = "sceKernelChmod",

src/SharpEmu.Libs/Np/NpEntitlementAccessExports.cs

@@ -1,6 +1,8 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Buffers.Binary;
+using System.Text;
 using SharpEmu.HLE;
 
 namespace SharpEmu.Libs.Np;
@@ -8,7 +10,34 @@ namespace SharpEmu.Libs.Np;
 public static class NpEntitlementAccessExports
 {
     private const int BootParamClearSize = 0x20;
-    private const int EmptyAddcontInfoListSize = 0x10;
+    private const int EntitlementLabelSize = 17;
+    private const int EntitlementLabelPadding = 3;
+    private const int AddcontEntitlementInfoSize =
+        EntitlementLabelSize + EntitlementLabelPadding + sizeof(uint) + sizeof(uint);
+
+    // libSceNpEntitlementAccess package / download codes observed on Prospero.
+    // package_type 3 = PSAL (license-style add-on); download_status 4 = INSTALLED.
+    private const uint PackageTypePsal = 3;
+    private const uint DownloadStatusInstalled = 4;
+    private const uint SkuFlagFull = 3;
+
+    private const int NpEntitlementAccessErrorParameter = unchecked((int)0x817D0002);
+    private const int NpEntitlementAccessErrorNoEntitlement = unchecked((int)0x817D0007);
+
+    // Offline add-on entitlements titles query through NpEntitlementAccess.
+    // GTA V Enhanced (PPSA04264) gates Story Mode on these three labels; without
+    // them the frontend offers "Buy GTAV Story Mode" despite a full dump.
+    private static readonly AddcontEntitlement[] OwnedAddcontEntitlements =
+    [
+        new("85y-je", PackageTypePsal, DownloadStatusInstalled),
+        new("5d5c48", PackageTypePsal, DownloadStatusInstalled),
+        new("_mtqu6", PackageTypePsal, DownloadStatusInstalled),
+    ];
+
+    private readonly record struct AddcontEntitlement(
+        string Label,
+        uint PackageType,
+        uint DownloadStatus);
 
     [SysAbiExport(
         Nid = "jO8DM8oyego",
@@ -19,21 +48,46 @@ public static class NpEntitlementAccessExports
     {
         var initParam = ctx[CpuRegister.Rdi];
         var bootParam = ctx[CpuRegister.Rsi];
-
+        if (initParam == 0 || bootParam == 0)
-        if (bootParam != 0)
         {
-            Span<byte> clear = stackalloc byte[BootParamClearSize];
+            return ctx.SetReturn(NpEntitlementAccessErrorParameter);
-            clear.Clear();
+        }
-            if (!ctx.Memory.TryWrite(bootParam, clear))
+
-            {
+        Span<byte> clear = stackalloc byte[BootParamClearSize];
-                return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        clear.Clear();
-            }
+        if (!ctx.Memory.TryWrite(bootParam, clear))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
         TraceNpEntitlementAccess($"initialize init=0x{initParam:X16} boot=0x{bootParam:X16}");
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
+    [SysAbiExport(
+        Nid = "lPDO62PpJIA",
+        ExportName = "sceNpEntitlementAccessGetSkuFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpEntitlementAccess")]
+    public static int NpEntitlementAccessGetSkuFlag(CpuContext ctx)
+    {
+        var skuFlagAddress = ctx[CpuRegister.Rdi];
+        if (skuFlagAddress == 0)
+        {
+            return ctx.SetReturn(NpEntitlementAccessErrorParameter);
+        }
+
+        Span<byte> skuFlagBytes = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(skuFlagBytes, SkuFlagFull);
+        if (!ctx.Memory.TryWrite(skuFlagAddress, skuFlagBytes))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceNpEntitlementAccess($"get_sku_flag -> {SkuFlagFull}");
+        return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     [SysAbiExport(
         Nid = "TFyU+KFBv54",
         ExportName = "sceNpEntitlementAccessGetAddcontEntitlementInfoList",
@@ -42,28 +96,53 @@ public static class NpEntitlementAccessExports
     public static int NpEntitlementAccessGetAddcontEntitlementInfoList(CpuContext ctx)
     {
         var listAddress = ctx[CpuRegister.Rsi];
-        if (listAddress != 0)
+        var listNum = (uint)ctx[CpuRegister.Rdx];
+        var hitNumAddress = ctx[CpuRegister.Rcx];
+
+        if (hitNumAddress == 0 || (listAddress == 0 && listNum != 0))
         {
-            Span<byte> emptyList = stackalloc byte[EmptyAddcontInfoListSize];
+            return ctx.SetReturn(NpEntitlementAccessErrorParameter);
-            emptyList.Clear();
+        }
-            if (!ctx.Memory.TryWrite(listAddress, emptyList))
+
+        var hitNum = (uint)OwnedAddcontEntitlements.Length;
+        Span<byte> hitNumBytes = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(hitNumBytes, hitNum);
+        if (!ctx.Memory.TryWrite(hitNumAddress, hitNumBytes))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        if (listAddress != 0 && listNum != 0)
+        {
+            var clearBytes = checked((int)listNum * AddcontEntitlementInfoSize);
+            Span<byte> clear = clearBytes <= 512
+                ? stackalloc byte[clearBytes]
+                : new byte[clearBytes];
+            clear.Clear();
+            if (!ctx.Memory.TryWrite(listAddress, clear))
             {
                 return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
+
+            var copyNum = Math.Min(listNum, hitNum);
+            for (var index = 0u; index < copyNum; index++)
+            {
+                if (!TryWriteAddcontEntitlementInfo(
+                        ctx,
+                        listAddress + index * (ulong)AddcontEntitlementInfoSize,
+                        OwnedAddcontEntitlements[(int)index]))
+                {
+                    return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+            }
         }
 
         TraceNpEntitlementAccess(
-            $"get_addcont_info_list service=0x{ctx[CpuRegister.Rdi]:X16} list=0x{listAddress:X16} " +
+            $"get_addcont_info_list service={ctx[CpuRegister.Rdi]} list=0x{listAddress:X16} " +
-            $"max={ctx[CpuRegister.Rdx]} flags=0x{ctx[CpuRegister.Rcx]:X16} -> empty");
+            $"list_num={listNum} hit_num={hitNum}");
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
-    private const int EmptyAddcontInfoSize = 0x30;
-
-    // Singular lookup of one add-on-content entitlement (rdx = info out). We own
-    // no DLC, so report an empty/zeroed info and success — matching the list
-    // variant's "no entitlements" answer. Dead Cells calls this while loading a
-    // level; leaving it unresolved left the info struct uninitialized.
     [SysAbiExport(
         Nid = "xddD23+8TfQ",
         ExportName = "sceNpEntitlementAccessGetAddcontEntitlementInfo",
@@ -71,21 +150,84 @@ public static class NpEntitlementAccessExports
         LibraryName = "libSceNpEntitlementAccess")]
     public static int NpEntitlementAccessGetAddcontEntitlementInfo(CpuContext ctx)
     {
+        var labelAddress = ctx[CpuRegister.Rsi];
         var infoAddress = ctx[CpuRegister.Rdx];
-        if (infoAddress != 0)
+        if (labelAddress == 0 || infoAddress == 0)
         {
-            Span<byte> info = stackalloc byte[EmptyAddcontInfoSize];
+            return ctx.SetReturn(NpEntitlementAccessErrorParameter);
-            info.Clear();
+        }
-            if (!ctx.Memory.TryWrite(infoAddress, info))
+
+        Span<byte> labelBytes = stackalloc byte[EntitlementLabelSize];
+        if (!ctx.Memory.TryRead(labelAddress, labelBytes))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        var label = ReadEntitlementLabel(labelBytes);
+        Span<byte> info = stackalloc byte[AddcontEntitlementInfoSize];
+        info.Clear();
+        if (!ctx.Memory.TryWrite(infoAddress, info))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        foreach (var entitlement in OwnedAddcontEntitlements)
+        {
+            if (!string.Equals(label, entitlement.Label, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            if (!TryWriteAddcontEntitlementInfo(ctx, infoAddress, entitlement))
             {
                 return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
+
+            TraceNpEntitlementAccess(
+                $"get_addcont_info service={ctx[CpuRegister.Rdi]} label='{label}' -> owned");
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
         }
 
         TraceNpEntitlementAccess(
-            $"get_addcont_info service=0x{ctx[CpuRegister.Rdi]:X16} label=0x{ctx[CpuRegister.Rsi]:X16} " +
+            $"get_addcont_info service={ctx[CpuRegister.Rdi]} label='{label}' -> no entitlement");
-            $"info=0x{infoAddress:X16} -> empty");
+        return ctx.SetReturn(NpEntitlementAccessErrorNoEntitlement);
-        return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private static bool TryWriteAddcontEntitlementInfo(
+        CpuContext ctx,
+        ulong address,
+        AddcontEntitlement entitlement)
+    {
+        Span<byte> info = stackalloc byte[AddcontEntitlementInfoSize];
+        info.Clear();
+
+        var labelBytes = Encoding.ASCII.GetBytes(entitlement.Label);
+        var labelLength = Math.Min(labelBytes.Length, EntitlementLabelSize - 1);
+        labelBytes.AsSpan(0, labelLength).CopyTo(info);
+
+        BinaryPrimitives.WriteUInt32LittleEndian(
+            info.Slice(EntitlementLabelSize + EntitlementLabelPadding, sizeof(uint)),
+            entitlement.PackageType);
+        BinaryPrimitives.WriteUInt32LittleEndian(
+            info.Slice(
+                EntitlementLabelSize + EntitlementLabelPadding + sizeof(uint),
+                sizeof(uint)),
+            entitlement.DownloadStatus);
+
+        return ctx.Memory.TryWrite(address, info);
+    }
+
+    private static string ReadEntitlementLabel(ReadOnlySpan<byte> bytes)
+    {
+        var length = 0;
+        while (length < bytes.Length && bytes[length] != 0)
+        {
+            length++;
+        }
+
+        return length == 0
+            ? string.Empty
+            : Encoding.ASCII.GetString(bytes[..length]);
     }
 
     private static void TraceNpEntitlementAccess(string message)

src/SharpEmu.Libs/Np/NpManagerExports.cs

@@ -86,6 +86,25 @@ public static class NpManagerExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    /// <summary>
+    /// Accepts the premium-event callback and never invokes it. Offline sessions
+    /// have no PS Plus / premium transitions to deliver, and leaving this NID
+    /// unresolved returns NOT_FOUND which soft-locks titles that register it
+    /// during settings / store probes (GTA V Enhanced).
+    /// </summary>
+    [SysAbiExport(
+        Nid = "+yqjab2fUJA",
+        ExportName = "sceNpRegisterPremiumEventCallback",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpManager")]
+    public static int NpRegisterPremiumEventCallback(CpuContext ctx)
+    {
+        TraceNp(
+            $"register_premium_event_callback cb=0x{ctx[CpuRegister.Rdi]:X16} " +
+            $"userdata=0x{ctx[CpuRegister.Rsi]:X16}");
+        return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     [SysAbiExport(
         Nid = "qQJfO8HAiaY",
         ExportName = "sceNpRegisterStateCallbackA",

src/SharpEmu.Libs/Remoteplay/RemoteplayExports.cs

@@ -0,0 +1,51 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Remoteplay;
+
+// SharpEmu does not implement PS5 Remote Play. Titles still probe this API
+// during startup (initialize + connection-status checks while bringing up
+// pad/network subsystems). Without a handler they get ORBIS_GEN2_ERROR_NOT_FOUND
+// instead of a real status code. Reporting a clean "initialized, not connected"
+// state lets callers take their normal no-remote-play path.
+public static class RemoteplayExports
+{
+    private const int StatusDisconnected = 0;
+
+    [SysAbiExport(
+        Nid = "k1SwgkMSOM8",
+        ExportName = "sceRemoteplayInitialize",
+        Target = Generation.Gen5,
+        LibraryName = "libSceRemoteplay")]
+    public static int RemoteplayInitialize(CpuContext ctx) => SetReturn(ctx, 0);
+
+    [SysAbiExport(
+        Nid = "g3PNjYKWqnQ",
+        ExportName = "sceRemoteplayGetConnectionStatus",
+        Target = Generation.Gen5,
+        LibraryName = "libSceRemoteplay")]
+    public static int RemoteplayGetConnectionStatus(CpuContext ctx)
+    {
+        var statusAddress = ctx[CpuRegister.Rsi];
+        if (statusAddress != 0)
+        {
+            Span<byte> status = stackalloc byte[0x10];
+            status.Clear();
+            status[0] = StatusDisconnected;
+            if (!ctx.Memory.TryWrite(statusAddress, status))
+            {
+                return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/SharpEmu.Libs.csproj

@@ -26,6 +26,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
   <ItemGroup>
     <PackageReference Include="FFmpeg.AutoGen" />
+    <PackageReference Include="NLayer" />
     <PackageReference Include="Silk.NET.Input" />
     <PackageReference Include="Silk.NET.Vulkan" />
     <PackageReference Include="Silk.NET.Vulkan.Extensions.EXT" />

src/SharpEmu.Libs/Stubs/GameServiceStubs.cs

@@ -100,6 +100,26 @@ public static class GameServiceStubs
         Target = Generation.Gen5, LibraryName = "libSceVoice")]
     public static int VoiceSetThreadsParams(CpuContext ctx) => Ok(ctx);
 
+    [SysAbiExport(Nid = "nXpje5yNpaE", ExportName = "sceVoiceCreatePort",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceCreatePort(CpuContext ctx) => OkWithHandle(ctx, CpuRegister.Rdi);
+
+    [SysAbiExport(Nid = "b7kJI+nx2hg", ExportName = "sceVoiceDeletePort",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceDeletePort(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "oV9GAdJ23Gw", ExportName = "sceVoiceConnectIPortToOPort",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceConnectIPortToOPort(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "ajVj3QG2um4", ExportName = "sceVoiceDisconnectIPortFromOPort",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceDisconnectIPortFromOPort(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "Oo0S5PH7FIQ", ExportName = "sceVoiceEnd",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceEnd(CpuContext ctx) => Ok(ctx);
+
     [SysAbiExport(Nid = "dPj4ZtRcIWk", ExportName = "sceContentSearchInit",
         Target = Generation.Gen5, LibraryName = "libSceContentSearch")]
     public static int ContentSearchInit(CpuContext ctx) => Ok(ctx);

src/SharpEmu.Libs/VideoOut/VideoOutExports.cs

@@ -3,6 +3,7 @@
 
 using SharpEmu.HLE;
 using SharpEmu.HLE.Host;
+using SharpEmu.Libs.Diagnostics;
 using SharpEmu.Libs.Gpu;
 using SharpEmu.Libs.Audio;
 using SharpEmu.Libs.Kernel;
@@ -1233,6 +1234,15 @@ public static class VideoOutExports
             $"videoout.submit_flip handle={handle} index={bufferIndex} mode={flipMode} " +
             $"arg={flipArg} addr=0x{guestImageAddress:X16} submitted={guestImageSubmitted} " +
             $"events={flipEventCount} ordered_completion={!submitGpuImage}");
+        LoadProgressDiagnostics.TraceFlipSubmit(
+            handle,
+            bufferIndex,
+            flipMode,
+            submitGpuImage,
+            guestImageSubmitted,
+            guestImageAddress,
+            flipEventCount);
+        LoadProgressDiagnostics.TraceGpuWaitSnapshot(ctx.Memory);
         ReportFrameRate(presented: false);
         var diagnosticFlipNumber = Interlocked.Increment(ref _diagnosticFlipCount);
         if (_holdFirstFlipMilliseconds > 0 && diagnosticFlipNumber == _holdFlipNumber)

src/SharpEmu.Libs/VideoOut/VulkanHostBufferPool.cs

@@ -18,6 +18,7 @@ internal readonly record struct VulkanHostBufferAllocation(
 
 internal sealed class VulkanHostBufferPool : IDisposable
 {
+    private readonly object _gate = new();
     private readonly Dictionary<VulkanHostBufferPoolKey, Stack<VulkanHostBufferAllocation>>
         _available = [];
     private readonly Dictionary<ulong, VulkanHostBufferAllocation> _allocations = [];
@@ -40,16 +41,19 @@ internal sealed class VulkanHostBufferPool : IDisposable
         VulkanHostBufferPoolKey key,
         out VulkanHostBufferAllocation allocation)
     {
-        if (!_available.TryGetValue(key, out var available) ||
+        lock (_gate)
-            !available.TryPop(out allocation))
         {
-            allocation = default;
+            if (!_available.TryGetValue(key, out var available) ||
-            return false;
+                !available.TryPop(out allocation))
-        }
+            {
+                allocation = default;
+                return false;
+            }
 
-        _cachedHandles.Remove(allocation.Buffer.Handle);
+            _cachedHandles.Remove(allocation.Buffer.Handle);
-        CachedBytes -= allocation.Key.Capacity;
+            CachedBytes -= allocation.Key.Capacity;
-        return true;
+            return true;
+        }
     }
 
     public void Register(VulkanHostBufferAllocation allocation)
@@ -59,51 +63,79 @@ internal sealed class VulkanHostBufferPool : IDisposable
             throw new ArgumentException("A pooled buffer must have a valid handle.", nameof(allocation));
         }
 
-        _allocations.Add(allocation.Buffer.Handle, allocation);
+        lock (_gate)
+        {
+            _allocations.Add(allocation.Buffer.Handle, allocation);
+        }
     }
 
     public bool Return(VkBuffer buffer, DeviceMemory memory)
     {
-        if (!_allocations.TryGetValue(buffer.Handle, out var allocation) ||
+        VulkanHostBufferAllocation? toDestroy = null;
-            allocation.Memory.Handle != memory.Handle)
+        lock (_gate)
         {
-            return false;
+            if (!_allocations.TryGetValue(buffer.Handle, out var allocation) ||
+                allocation.Memory.Handle != memory.Handle)
+            {
+                return false;
+            }
+
+            if (!_cachedHandles.Add(buffer.Handle))
+            {
+                return true;
+            }
+
+            if (allocation.Key.Capacity > MaximumCachedBytes - CachedBytes)
+            {
+                _cachedHandles.Remove(buffer.Handle);
+                _allocations.Remove(buffer.Handle);
+                toDestroy = allocation;
+            }
+            else
+            {
+                if (!_available.TryGetValue(allocation.Key, out var available))
+                {
+                    available = [];
+                    _available.Add(allocation.Key, available);
+                }
+
+                available.Push(allocation);
+                CachedBytes += allocation.Key.Capacity;
+            }
         }
 
-        if (!_cachedHandles.Add(buffer.Handle))
+        // Destroy outside the lock — _destroy calls into Vulkan which may
-        {
+        // grab device-level locks, and holding _gate while doing so risks
-            return true;
+        // a lock-ordering deadlock with a thread that holds the device lock
+        // and is waiting on _gate.
+if (toDestroy is { } td)
+{
+    _destroy(td);
+
         }
 
-        if (allocation.Key.Capacity > MaximumCachedBytes - CachedBytes)
-        {
-            _cachedHandles.Remove(buffer.Handle);
-            _allocations.Remove(buffer.Handle);
-            _destroy(allocation);
-            return true;
-        }
-
-        if (!_available.TryGetValue(allocation.Key, out var available))
-        {
-            available = [];
-            _available.Add(allocation.Key, available);
-        }
-
-        available.Push(allocation);
-        CachedBytes += allocation.Key.Capacity;
         return true;
     }
 
     public void Dispose()
     {
-        foreach (var allocation in _allocations.Values)
+        // Snapshot under the lock, destroy outside — _destroy calls into
+        // Vulkan which may grab device-level locks; holding _gate while
+        // doing so risks a lock-ordering deadlock with any thread that
+        // acquires the device lock first and then waits on _gate.
+        List<VulkanHostBufferAllocation> toDestroy;
+        lock (_gate)
+        {
+            toDestroy = new List<VulkanHostBufferAllocation>(_allocations.Values);
+            _allocations.Clear();
+            _available.Clear();
+            _cachedHandles.Clear();
+            CachedBytes = 0;
+        }
+
+        foreach (var allocation in toDestroy)
         {
             _destroy(allocation);
         }
-
-        _allocations.Clear();
-        _available.Clear();
-        _cachedHandles.Clear();
-        CachedBytes = 0;
     }
 }

src/SharpEmu.ShaderCompiler.Metal/Gen5MslTranslator.cs

@@ -74,6 +74,7 @@ public static partial class Gen5MslTranslator
         int pixelRenderTargetSlot = 0,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1) =>
         TryCompilePixelShader(
             state,
@@ -87,6 +88,7 @@ public static partial class Gen5MslTranslator
             initialScalarBufferIndex,
             pixelInputEnable,
             pixelInputAddress,
+            pixelInputCntl,
             storageBufferOffsetAlignment);
 
     public static bool TryCompilePixelShader(
@@ -101,6 +103,7 @@ public static partial class Gen5MslTranslator
         int initialScalarBufferIndex = -1,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1)
     {
         shader = default!;
@@ -161,7 +164,8 @@ public static partial class Gen5MslTranslator
             pixelOutputBindings: outputs,
             imageBindingBase: imageBindingBase,
             pixelInputEnable: pixelInputEnable,
-            pixelInputAddress: pixelInputAddress);
+            pixelInputAddress: pixelInputAddress,
+            pixelInputCntl: pixelInputCntl);
         return context.TryCompile(out shader, out error);
     }
 
@@ -254,6 +258,7 @@ public static partial class Gen5MslTranslator
         private readonly int _imageBindingBase;
         private readonly uint _pixelInputEnable;
         private readonly uint _pixelInputAddress;
+        private readonly uint[] _pixelInputCntl;
         private readonly Dictionary<uint, int> _imageBindingByPc = [];
         private readonly Dictionary<uint, int> _bufferBindingByPc = [];
         private readonly List<(bool IsStorage, string ComponentKind)> _imageKinds = [];
@@ -294,12 +299,20 @@ public static partial class Gen5MslTranslator
             int imageBindingBase = 0,
             uint pixelInputEnable = 0,
             uint pixelInputAddress = 0,
+            IReadOnlyList<uint>? pixelInputCntl = null,
             int requiredVertexOutputCount = 0)
         {
             _pixelOutputBindings = pixelOutputBindings ?? [];
             _imageBindingBase = imageBindingBase;
             _pixelInputEnable = pixelInputEnable;
             _pixelInputAddress = pixelInputAddress;
+            _pixelInputCntl = new uint[32];
+            for (uint i = 0; i < 32u; i++)
+            {
+                _pixelInputCntl[i] = pixelInputCntl is not null && i < (uint)pixelInputCntl.Count
+                    ? pixelInputCntl[(int)i]
+                    : i;
+            }
             _requiredVertexOutputCount = requiredVertexOutputCount;
             _stage = stage;
             _state = state;
@@ -592,7 +605,13 @@ public static partial class Gen5MslTranslator
                 source.AppendLine("    float4 sharpemu_frag_coord [[position]];");
                 foreach (var attribute in _pixelAttributes)
                 {
-                    source.AppendLine($"    float4 attr{attribute} [[user(locn{attribute})]];");
+                    var cntl = attribute < (uint)_pixelInputCntl.Length
+                        ? _pixelInputCntl[attribute]
+                        : attribute;
+                    var location = cntl & 0x1Fu;
+                    var flat = (cntl & 0x400u) != 0 ? ", flat" : string.Empty;
+                    source.AppendLine(
+                        $"    float4 attr{attribute} [[user(locn{location}){flat}]];");
                 }
 
                 source.AppendLine("};");

src/SharpEmu.ShaderCompiler.Vulkan/Gen5SpirvTranslator.cs

@@ -31,6 +31,7 @@ public static partial class Gen5SpirvTranslator
         int pixelRenderTargetSlot = 0,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1) =>
         TryCompilePixelShader(
             state,
@@ -44,6 +45,7 @@ public static partial class Gen5SpirvTranslator
             initialScalarBufferIndex,
             pixelInputEnable,
             pixelInputAddress,
+            pixelInputCntl,
             storageBufferOffsetAlignment);
 
     public static bool TryCompilePixelShader(
@@ -58,6 +60,7 @@ public static partial class Gen5SpirvTranslator
         int initialScalarBufferIndex = -1,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1)
     {
         if (outputs.Count > 8 || outputs.Any(output => output.GuestSlot > 7))
@@ -99,6 +102,7 @@ public static partial class Gen5SpirvTranslator
             initialScalarBufferIndex,
             pixelInputEnable: pixelInputEnable,
             pixelInputAddress: pixelInputAddress,
+            pixelInputCntl: pixelInputCntl,
             storageBufferOffsetAlignment: storageBufferOffsetAlignment);
         return context.TryCompile(out shader, out error);
     }
@@ -231,6 +235,7 @@ public static partial class Gen5SpirvTranslator
         private readonly int _initialScalarBufferIndex;
         private readonly uint _pixelInputEnable;
         private readonly uint _pixelInputAddress;
+        private readonly uint[] _pixelInputCntl;
         private readonly ulong _storageBufferOffsetAlignment;
         private readonly List<uint> _interfaces = [];
         private readonly Dictionary<uint, uint> _pixelInputs = [];
@@ -343,6 +348,7 @@ public static partial class Gen5SpirvTranslator
             int initialScalarBufferIndex,
             uint pixelInputEnable = 0,
             uint pixelInputAddress = 0,
+            IReadOnlyList<uint>? pixelInputCntl = null,
             int requiredVertexOutputCount = 0,
             uint waveLaneCount = 32,
             ulong storageBufferOffsetAlignment = 1)
@@ -368,6 +374,13 @@ public static partial class Gen5SpirvTranslator
             _initialScalarBufferIndex = initialScalarBufferIndex;
             _pixelInputEnable = pixelInputEnable;
             _pixelInputAddress = pixelInputAddress;
+            _pixelInputCntl = new uint[32];
+            for (uint i = 0; i < 32u; i++)
+            {
+                _pixelInputCntl[i] = pixelInputCntl is not null && i < (uint)pixelInputCntl.Count
+                    ? pixelInputCntl[(int)i]
+                    : i;
+            }
             if (storageBufferOffsetAlignment == 0 ||
                 (storageBufferOffsetAlignment & (storageBufferOffsetAlignment - 1)) != 0 ||
                 storageBufferOffsetAlignment > uint.MaxValue)
@@ -1242,7 +1255,18 @@ public static partial class Gen5SpirvTranslator
                     var variable = _module.AddGlobalVariable(
                         inputVec4Pointer,
                         SpirvStorageClass.Input);
-                    _module.AddDecoration(variable, SpirvDecoration.Location, attribute);
+                    // VINTRP ATTR selects the PS input slot. SPI_PS_INPUT_CNTL
+                    // maps that slot to a VS parameter export location.
+                    var cntl = attribute < (uint)_pixelInputCntl.Length
+                        ? _pixelInputCntl[attribute]
+                        : attribute;
+                    var location = cntl & 0x1Fu;
+                    _module.AddDecoration(variable, SpirvDecoration.Location, location);
+                    if ((cntl & 0x400u) != 0)
+                    {
+                        _module.AddDecoration(variable, SpirvDecoration.Flat);
+                    }
+
                     _pixelInputs.Add(attribute, variable);
                     _interfaces.Add(variable);
                 }

src/SharpEmu.ShaderCompiler/Gen5ShaderIr.cs

@@ -313,7 +313,8 @@ public sealed record Gen5VertexInputBinding(
     uint OffsetBytes,
     byte[] Data,
     int DataLength,
-    bool DataPooled);
+    bool DataPooled,
+    bool PerInstance = false);
 
 public sealed record Gen5ShaderEvaluation(
     IReadOnlyList<uint> InitialScalarRegisters,

src/SharpEmu.ShaderCompiler/Gen5ShaderScalarEvaluator.cs

@@ -893,8 +893,11 @@ public static class Gen5ShaderScalarEvaluator
         Gen5ShaderInstruction instruction,
         Gen5BufferMemoryControl control,
         BufferDescriptor descriptor) =>
+        // AGC embedded fetch is BufferLoadFormat/TBufferLoadFormat with idxen.
+        // offen is allowed: the constant/scalar offset folds into OffsetBytes
+        // (UI glyph shaders use this shape). Rejecting offen left those loads
+        // as live SSBOs and dropped vertex attributes.
         control.IndexEnabled &&
-        !control.OffsetEnabled &&
         control.DwordCount is >= 1 and <= 4 &&
         descriptor.BaseAddress != 0 &&
         descriptor.Stride != 0 &&

tests/SharpEmu.Libs.Tests/Agc/AgcFusedShaderTests.cs

@@ -0,0 +1,330 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Agc;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+// sceAgcGetFusedShaderSize (dolOmWH+huQ) and sceAgcFuseShaderHalves (fd5Bp5tGTgo)
+// join a GS or HS front/back shader half pair into one shader: the fused header
+// is the back half retyped, the back half's SH registers become the fused
+// register image, and the front half contributes its program address
+// (SPI_SHADER_PGM_LO/HI_ES) and checksum registers.
+public sealed class AgcFusedShaderTests
+{
+    private const ulong BaseAddress = 0x1_0000_0000;
+    private const int MemorySize = 0x4000;
+
+    private const ulong FrontShader = BaseAddress + 0x0000;
+    private const ulong BackShader = BaseAddress + 0x0100;
+    private const ulong FusedShader = BaseAddress + 0x0200;
+    private const ulong FrontRegisters = BaseAddress + 0x0300;
+    private const ulong BackRegisters = BaseAddress + 0x0400;
+    private const ulong FrontSpecials = BaseAddress + 0x0500;
+    private const ulong BackSpecials = BaseAddress + 0x0600;
+    private const ulong Scratch = BaseAddress + 0x0700;
+    private const ulong SizeResult = BaseAddress + 0x0800;
+
+    private const ulong ShaderUserDataOffset = 0x08;
+    private const ulong ShaderCodeOffset = 0x10;
+    private const ulong ShaderShRegistersOffset = 0x20;
+    private const ulong ShaderSpecialsOffset = 0x28;
+    private const ulong ShaderTypeOffset = 0x5A;
+    private const ulong ShaderNumShRegistersOffset = 0x5C;
+
+    private const byte GsFront = 4;
+    private const byte HsFront = 5;
+    private const byte GsBack = 6;
+    private const byte HsBack = 7;
+
+    private const ulong FrontCode = 0x0000_1234_5678_9A00;
+
+    [Fact]
+    public void GetFusedShaderSize_GsPair_ReportsBackRegisterBytes()
+    {
+        var (memory, ctx) = CreateGsPair();
+
+        ctx[CpuRegister.Rdi] = SizeResult;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        var result = AgcExports.GetFusedShaderSize(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(5UL * 8UL, ReadUInt64(memory, SizeResult));
+        Assert.Equal(4UL, ReadUInt64(memory, SizeResult + 8));
+    }
+
+    [Fact]
+    public void GetFusedShaderSize_MismatchedHalves_Rejects()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteByte(memory, BackShader + ShaderTypeOffset, HsBack);
+
+        ctx[CpuRegister.Rdi] = SizeResult;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        var result = AgcExports.GetFusedShaderSize(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT, result);
+        Assert.Equal(0UL, ReadUInt64(memory, SizeResult));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_GsPairWithScratch_BuildsFusedShader()
+    {
+        var (memory, ctx) = CreateGsPair();
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+
+        // Fused header is the back half with type kGs, cleared user data, and
+        // registers relocated to the scratch image.
+        Assert.Equal(2, ReadByte(memory, FusedShader + ShaderTypeOffset));
+        Assert.Equal(0UL, ReadUInt64(memory, FusedShader + ShaderUserDataOffset));
+        Assert.Equal(Scratch, ReadUInt64(memory, FusedShader + ShaderShRegistersOffset));
+        Assert.Equal(5, ReadByte(memory, FusedShader + ShaderNumShRegistersOffset));
+        Assert.Equal(
+            ReadUInt64(memory, BackShader + ShaderCodeOffset),
+            ReadUInt64(memory, FusedShader + ShaderCodeOffset));
+
+        // The back half's own register image is untouched.
+        Assert.Equal(0x1111_1111u, ReadUInt32(memory, BackRegisters + 4));
+
+        // Scratch image: LO_ES points at the front code, HI_ES keeps its upper
+        // bits, both checksum occurrences carry the front half's values.
+        Assert.Equal(0xC8u, ReadUInt32(memory, Scratch + 0));
+        Assert.Equal(0x3456_789Au, ReadUInt32(memory, Scratch + 4));
+        Assert.Equal(0xC9u, ReadUInt32(memory, Scratch + 8));
+        Assert.Equal(0xAABB_CC12u, ReadUInt32(memory, Scratch + 12));
+        Assert.Equal(0xAAAA_0001u, ReadUInt32(memory, Scratch + 20));
+        Assert.Equal(0xBBBB_0002u, ReadUInt32(memory, Scratch + 28));
+        Assert.Equal(0x5555_5555u, ReadUInt32(memory, Scratch + 36));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_NoScratch_PatchesBackRegistersInPlace()
+    {
+        var (memory, ctx) = CreateGsPair();
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = 0;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(BackRegisters, ReadUInt64(memory, FusedShader + ShaderShRegistersOffset));
+        Assert.Equal(0x3456_789Au, ReadUInt32(memory, BackRegisters + 4));
+        Assert.Equal(0xAABB_CC12u, ReadUInt32(memory, BackRegisters + 12));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_WaveSizeMismatch_Rejects()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteUInt32(memory, BackSpecials + 0x08 + 4, 0u);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT, result);
+        Assert.Equal(0, ReadByte(memory, FusedShader + ShaderTypeOffset));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_HsPair_PatchesLoLs()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteByte(memory, FrontShader + ShaderTypeOffset, HsFront);
+        WriteByte(memory, BackShader + ShaderTypeOffset, HsBack);
+        WriteUInt32(memory, BackRegisters + 0, 0x148u);
+        WriteUInt32(memory, BackRegisters + 8, 0x149u);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(3, ReadByte(memory, FusedShader + ShaderTypeOffset));
+        Assert.Equal(0x3456_789Au, ReadUInt32(memory, Scratch + 4));
+        // Checksum grafting is a geometry-pair behavior; the HS image keeps its own values.
+        Assert.Equal(0x1111_0001u, ReadUInt32(memory, Scratch + 20));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_MissingSpecials_SkipsWaveSizeGate()
+    {
+        var (memory, ctx) = CreateGsPair();
+        // The divergence the mismatch test rejects passes when a half lacks specials.
+        WriteUInt64(memory, FrontShader + ShaderSpecialsOffset, 0);
+        WriteUInt32(memory, BackSpecials + 0x08 + 4, 0u);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(2, ReadByte(memory, FusedShader + ShaderTypeOffset));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_ProgramRegisterAbsent_LeavesImageUntouched()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteByte(memory, FrontShader + ShaderTypeOffset, HsFront);
+        WriteByte(memory, BackShader + ShaderTypeOffset, HsBack);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        // No LO_LS entry in the back image: the fuse still succeeds and the
+        // scratch copy stays verbatim.
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(3, ReadByte(memory, FusedShader + ShaderTypeOffset));
+        Assert.Equal(0x1111_1111u, ReadUInt32(memory, Scratch + 4));
+        Assert.Equal(0xAABB_CC77u, ReadUInt32(memory, Scratch + 12));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_UnpairedProgramRegister_LeavesImageUntouched()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteByte(memory, FrontShader + ShaderTypeOffset, HsFront);
+        WriteByte(memory, BackShader + ShaderTypeOffset, HsBack);
+        WriteUInt32(memory, BackRegisters + 0, 0x148u);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        // LO_LS is present but the next entry is not HI_LS, so the patch is skipped.
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(0x1111_1111u, ReadUInt32(memory, Scratch + 4));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_ProgramRegisterAtImageEnd_LeavesImageUntouched()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteByte(memory, FrontShader + ShaderTypeOffset, HsFront);
+        WriteByte(memory, BackShader + ShaderTypeOffset, HsBack);
+        WriteUInt32(memory, BackRegisters + 4 * 8, 0x148u);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        // The hi half of the pair would sit past the register image.
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(0x5555_5555u, ReadUInt32(memory, Scratch + 36));
+    }
+
+    private static (FakeCpuMemory Memory, CpuContext Ctx) CreateGsPair()
+    {
+        var memory = new FakeCpuMemory(BaseAddress, MemorySize);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        WriteByte(memory, FrontShader + ShaderTypeOffset, GsFront);
+        WriteUInt64(memory, FrontShader + ShaderCodeOffset, FrontCode);
+        WriteUInt64(memory, FrontShader + ShaderShRegistersOffset, FrontRegisters);
+        WriteUInt64(memory, FrontShader + ShaderSpecialsOffset, FrontSpecials);
+        WriteByte(memory, FrontShader + ShaderNumShRegistersOffset, 4);
+
+        WriteByte(memory, BackShader + ShaderTypeOffset, GsBack);
+        WriteUInt64(memory, BackShader + ShaderCodeOffset, 0x0000_0BAD_F00D_BE00);
+        WriteUInt64(memory, BackShader + ShaderShRegistersOffset, BackRegisters);
+        WriteUInt64(memory, BackShader + ShaderSpecialsOffset, BackSpecials);
+        WriteUInt64(memory, BackShader + ShaderUserDataOffset, 0xDEAD_BEEF);
+        WriteByte(memory, BackShader + ShaderNumShRegistersOffset, 5);
+
+        // Back image: ES program address pair, two checksum slots, one bystander.
+        WriteRegister(memory, BackRegisters, 0, 0xC8u, 0x1111_1111u);
+        WriteRegister(memory, BackRegisters, 1, 0xC9u, 0xAABB_CC77u);
+        WriteRegister(memory, BackRegisters, 2, 0x80u, 0x1111_0001u);
+        WriteRegister(memory, BackRegisters, 3, 0x80u, 0x1111_0002u);
+        WriteRegister(memory, BackRegisters, 4, 0x10u, 0x5555_5555u);
+
+        // Front image: GS RSRC pair as shipped, then the checksum values to graft.
+        WriteRegister(memory, FrontRegisters, 0, 0x8Au, 0x0123_4567u);
+        WriteRegister(memory, FrontRegisters, 1, 0x8Bu, 0x89AB_CDEFu);
+        WriteRegister(memory, FrontRegisters, 2, 0x80u, 0xAAAA_0001u);
+        WriteRegister(memory, FrontRegisters, 3, 0x80u, 0xBBBB_0002u);
+
+        // VGT_SHADER_STAGES_EN register pairs with the GS wave32 enable bit set on both halves.
+        WriteUInt32(memory, FrontSpecials + 0x08, 0x1F1u);
+        WriteUInt32(memory, FrontSpecials + 0x08 + 4, 1u << 22);
+        WriteUInt32(memory, BackSpecials + 0x08, 0x1F1u);
+        WriteUInt32(memory, BackSpecials + 0x08 + 4, 1u << 22);
+
+        return (memory, ctx);
+    }
+
+    private static void WriteRegister(FakeCpuMemory memory, ulong array, int index, uint offset, uint value)
+    {
+        WriteUInt32(memory, array + (ulong)index * 8, offset);
+        WriteUInt32(memory, array + (ulong)index * 8 + 4, value);
+    }
+
+    private static void WriteByte(FakeCpuMemory memory, ulong address, byte value)
+    {
+        Span<byte> buffer = [value];
+        Assert.True(memory.TryWrite(address, buffer));
+    }
+
+    private static void WriteUInt32(FakeCpuMemory memory, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        Assert.True(memory.TryWrite(address, buffer));
+    }
+
+    private static void WriteUInt64(FakeCpuMemory memory, ulong address, ulong value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ulong)];
+        BinaryPrimitives.WriteUInt64LittleEndian(buffer, value);
+        Assert.True(memory.TryWrite(address, buffer));
+    }
+
+    private static byte ReadByte(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[1];
+        Assert.True(memory.TryRead(address, buffer));
+        return buffer[0];
+    }
+
+    private static uint ReadUInt32(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        Assert.True(memory.TryRead(address, buffer));
+        return BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+    }
+
+    private static ulong ReadUInt64(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ulong)];
+        Assert.True(memory.TryRead(address, buffer));
+        return BinaryPrimitives.ReadUInt64LittleEndian(buffer);
+    }
+}

tests/SharpEmu.Libs.Tests/Agc/AgcPrimStateHullVariantTests.cs

@@ -0,0 +1,66 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Agc;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+public sealed class AgcPrimStateHullVariantTests
+{
+    private const ulong BaseAddress = 0x1_0000_0000;
+    private const ulong CxRegistersAddress = BaseAddress + 0x100;
+    private const ulong UcRegistersAddress = BaseAddress + 0x200;
+    private const ulong HullStateAddress = BaseAddress + 0x300;
+    private const ulong GeometryShaderAddress = BaseAddress + 0x400;
+    private const ulong SpecialsAddress = BaseAddress + 0x500;
+
+    // Tessellation pipelines pass a non-null hull-state block; the
+    // geometry-derived register writes must still happen instead of an
+    // INVALID_ARGUMENT that leaves the caller's register storage as garbage.
+    [Fact]
+    public void CreatePrimState_AcceptsHullStateBlock()
+    {
+        var memory = new FakeCpuMemory(BaseAddress, 0x1000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        memory.TryWrite(GeometryShaderAddress + 0x5A, new byte[] { 2 });
+        WriteUInt64(memory, GeometryShaderAddress + 0x28, SpecialsAddress);
+
+        // Specials: {register, value} pairs at GeCntl 0x00, StagesEn 0x08,
+        // GsOutPrimType 0x20, GeUserVgprEn 0x28.
+        WriteUInt64(memory, SpecialsAddress + 0x00, 0x0000_0111_0000_0222UL);
+        WriteUInt64(memory, SpecialsAddress + 0x08, 0x0000_0333_0000_0444UL);
+        WriteUInt64(memory, SpecialsAddress + 0x20, 0x0000_0555_0000_0666UL);
+        WriteUInt64(memory, SpecialsAddress + 0x28, 0x0000_0777_0000_0888UL);
+
+        ctx[CpuRegister.Rdi] = CxRegistersAddress;
+        ctx[CpuRegister.Rsi] = UcRegistersAddress;
+        ctx[CpuRegister.Rdx] = HullStateAddress;
+        ctx[CpuRegister.Rcx] = GeometryShaderAddress;
+        ctx[CpuRegister.R8] = 0x11;
+
+        Assert.Equal(
+            (int)OrbisGen2Result.ORBIS_GEN2_OK,
+            AgcExports.CreatePrimState(ctx));
+
+        Assert.NotEqual(0u, ReadUInt32(memory, CxRegistersAddress));
+        Assert.Equal(0x11u, ReadUInt32(memory, UcRegistersAddress + 20));
+    }
+
+    private static void WriteUInt64(FakeCpuMemory memory, ulong address, ulong value)
+    {
+        Span<byte> bytes = stackalloc byte[sizeof(ulong)];
+        BinaryPrimitives.WriteUInt64LittleEndian(bytes, value);
+        Assert.True(memory.TryWrite(address, bytes));
+    }
+
+    private static uint ReadUInt32(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> value = stackalloc byte[sizeof(uint)];
+        Assert.True(memory.TryRead(address, value));
+        return BinaryPrimitives.ReadUInt32LittleEndian(value);
+    }
+}

tests/SharpEmu.Libs.Tests/Agc/AgcRectListIndexHelpersTests.cs

@@ -0,0 +1,95 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.Libs.Agc;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+/// <summary>
+/// Regression coverage for the AGC UI path: index8 expansion and rect-list
+/// vertex counts / topology selection.
+/// </summary>
+public sealed class AgcRectListIndexHelpersTests
+{
+    [Theory]
+    [InlineData(0u, 0u, 2)] // Index16
+    [InlineData(1u, 1u, 4)] // Index32
+    [InlineData(2u, 2u, 1)] // Index8
+    [InlineData(0x402u, 2u, 1)] // UC 0x400|size -> Index8
+    public void IndexType_DecodeAndStride_MatchProspero(uint raw, uint expected, int stride)
+    {
+        var decoded = AgcIndexHelpers.Decode(raw);
+        Assert.Equal((AgcIndexHelpers.ProsperoIndexType)expected, decoded);
+        Assert.Equal(stride, AgcIndexHelpers.GetGuestStrideBytes(decoded));
+    }
+
+    [Fact]
+    public void ExpandIndex8ToU16_PreservesValues()
+    {
+        ReadOnlySpan<byte> source = [0x00, 0x01, 0xFF, 0x7F];
+        Span<byte> destination = stackalloc byte[8];
+        AgcIndexHelpers.ExpandIndex8ToU16(source, destination);
+        Assert.Equal(0, BinaryPrimitives.ReadUInt16LittleEndian(destination[..2]));
+        Assert.Equal(1, BinaryPrimitives.ReadUInt16LittleEndian(destination.Slice(2, 2)));
+        Assert.Equal(255, BinaryPrimitives.ReadUInt16LittleEndian(destination.Slice(4, 2)));
+        Assert.Equal(127, BinaryPrimitives.ReadUInt16LittleEndian(destination.Slice(6, 2)));
+    }
+
+    [Theory]
+    // NGG single-rect UI (DualSense): expand even when VBs are present
+    [InlineData(7u, 3u, false, true, 4u)]
+    [InlineData(7u, 1u, false, false, 4u)]
+    [InlineData(7u, 4u, false, true, 4u)]
+    // Indexed / multi-vert auto: keep guest count (loading video)
+    [InlineData(7u, 3u, true, false, 3u)]
+    [InlineData(7u, 6u, false, true, 6u)]
+    [InlineData(7u, 4u, true, true, 4u)]
+    [InlineData(0x11u, 3u, false, false, 4u)]
+    [InlineData(0x11u, 6u, false, false, 6u)]
+    [InlineData(4u, 3u, false, false, 3u)]
+    public void RectListDrawVertexCount_MatchesExpansion(
+        uint primitiveType,
+        uint vertexCount,
+        bool indexed,
+        bool hasVertexBuffers,
+        uint expected)
+    {
+        Assert.Equal(
+            expected,
+            AgcPrimitiveHelpers.GetRectListDrawVertexCount(
+                primitiveType,
+                vertexCount,
+                indexed,
+                hasVertexBuffers));
+    }
+
+    [Theory]
+    [InlineData(7u, false, 3u, true, true)]
+    [InlineData(7u, false, 6u, true, false)]
+    [InlineData(7u, true, 3u, false, false)]
+    [InlineData(0x11u, false, 3u, true, true)]
+    [InlineData(0x11u, true, 3u, false, false)]
+    public void RectListTriangleStrip_MatchesGuards(
+        uint primitiveType,
+        bool indexed,
+        uint vertexCount,
+        bool hasVertexBuffers,
+        bool expected) =>
+        Assert.Equal(
+            expected,
+            AgcPrimitiveHelpers.ShouldDrawRectListAsTriangleStrip(
+                primitiveType,
+                indexed,
+                vertexCount,
+                hasVertexBuffers));
+
+    [Theory]
+    [InlineData(7u, (uint)AgcPrimitiveHelpers.GsOutputPrimitiveType.Rectangle2D)]
+    [InlineData(0x11u, (uint)AgcPrimitiveHelpers.GsOutputPrimitiveType.RectList)]
+    [InlineData(4u, (uint)AgcPrimitiveHelpers.GsOutputPrimitiveType.Triangles)]
+    [InlineData(1u, (uint)AgcPrimitiveHelpers.GsOutputPrimitiveType.Points)]
+    public void PrimitiveTypeToGsOut_MatchesProspero(uint primitiveType, uint expected) =>
+        Assert.Equal(expected, AgcPrimitiveHelpers.PrimitiveTypeToGsOut(primitiveType));
+}

tests/SharpEmu.Libs.Tests/Agc/AgcVertexMetadataTests.cs

@@ -0,0 +1,293 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Agc;
+using SharpEmu.ShaderCompiler;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+/// <summary>
+/// Coverage for AGC attrib-table → BufferFormat merge and semantic indexing.
+/// </summary>
+public sealed class AgcVertexMetadataTests
+{
+    [Fact]
+    public void BuildVertexResources_UsesSemanticNotHardwareMappingAsAttribIndex()
+    {
+        // input_semantics[0]: semantic=1, hardware_mapping=4, size=2
+        // If hardware_mapping were wrongly used as the attrib index, we'd read
+        // attrib[4] instead of attrib[1] and get the wrong format/offset.
+        const ulong memoryBase = 0x1_0000_0000;
+        var memory = new FakeCpuMemory(memoryBase, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        const ulong semanticsAddress = memoryBase + 0x100;
+        const ulong attribTable = memoryBase + 0x200;
+        const ulong bufferTable = memoryBase + 0x300;
+        const ulong sharpBase = memoryBase + 0x800;
+
+        // ShaderSemantic word: semantic=1, hw_mapping=4, size_in_elements=2
+        WriteUInt32(memory, semanticsAddress, 1u | (4u << 8) | (2u << 16));
+
+        // attrib[0] unused garbage
+        WriteUInt32(memory, attribTable, 0xDEAD_BEEFu);
+        // attrib[1]: buffer=0, format=k16_16Float(29), offset=8, fetch=0
+        WriteUInt32(memory, attribTable + 4, 0u | (29u << 5) | (8u << 14));
+
+        // V# at buffer table[0]: base=sharpBase, stride=16
+        WriteUInt32(memory, bufferTable, (uint)(sharpBase & 0xFFFF_FFFFUL));
+        WriteUInt32(
+            memory,
+            bufferTable + 4,
+            (uint)(sharpBase >> 32) | (16u << 16));
+
+        var scalars = new uint[32];
+        scalars[8] = (uint)(attribTable & 0xFFFF_FFFFUL);
+        scalars[9] = (uint)(attribTable >> 32);
+        scalars[10] = (uint)(bufferTable & 0xFFFF_FFFFUL);
+        scalars[11] = (uint)(bufferTable >> 32);
+
+        var tables = new AgcVertexMetadata.VertexTableRegisters(
+            VertexBufferReg: 10,
+            VertexAttribReg: 8,
+            InputSemanticsCount: 1,
+            InputSemanticsAddress: semanticsAddress);
+
+        Assert.True(
+            AgcVertexMetadata.TryBuildVertexResourcesFromMetadata(
+                ctx,
+                scalars,
+                tables,
+                out var resources));
+        Assert.Single(resources);
+        Assert.Equal(1u, resources[0].Semantic);
+        Assert.Equal(4u, resources[0].HardwareMapping);
+        Assert.Equal(8u, resources[0].OffsetBytes);
+        Assert.Equal(5u, resources[0].DataFormat); // R16G16
+        Assert.Equal(7u, resources[0].NumberFormat); // Float
+        Assert.Equal(2u, resources[0].ComponentCount);
+        Assert.Equal(sharpBase, resources[0].SharpBase);
+        Assert.False(resources[0].PerInstance);
+    }
+
+    [Fact]
+    public void MergeVertexInputs_OverlaysFormatWithoutRebasingCapture()
+    {
+        const ulong memoryBase = 0x1_0000_0000;
+        var memory = new FakeCpuMemory(memoryBase, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        const ulong semanticsAddress = memoryBase + 0x100;
+        const ulong attribTable = memoryBase + 0x200;
+        const ulong bufferTable = memoryBase + 0x300;
+        const ulong sharpBase = memoryBase + 0x800;
+
+        WriteUInt32(memory, semanticsAddress, 0u | (0u << 8) | (4u << 16));
+        // format k8_8_8_8UNorm(56), offset=12
+        WriteUInt32(memory, attribTable, 0u | (56u << 5) | (12u << 14));
+        WriteUInt32(memory, bufferTable, (uint)(sharpBase & 0xFFFF_FFFFUL));
+        WriteUInt32(memory, bufferTable + 4, (uint)(sharpBase >> 32) | (16u << 16));
+
+        var scalars = new uint[32];
+        scalars[4] = (uint)(attribTable & 0xFFFF_FFFFUL);
+        scalars[5] = (uint)(attribTable >> 32);
+        scalars[6] = (uint)(bufferTable & 0xFFFF_FFFFUL);
+        scalars[7] = (uint)(bufferTable >> 32);
+
+        var tables = new AgcVertexMetadata.VertexTableRegisters(
+            VertexBufferReg: 6,
+            VertexAttribReg: 4,
+            InputSemanticsCount: 1,
+            InputSemanticsAddress: semanticsAddress);
+
+        var data = new byte[64];
+        var discovered = new[]
+        {
+            new Gen5VertexInputBinding(
+                Pc: 0x40,
+                Location: 0,
+                ComponentCount: 4,
+                DataFormat: 14, // wrong IR guess
+                NumberFormat: 7,
+                BaseAddress: sharpBase,
+                Stride: 16,
+                OffsetBytes: 0,
+                Data: data,
+                DataLength: data.Length,
+                DataPooled: false),
+        };
+
+        var merged = AgcVertexMetadata.MergeVertexInputsFromMetadata(
+            ctx,
+            scalars,
+            tables,
+            discovered);
+        Assert.Single(merged);
+        Assert.Equal(0u, merged[0].Location);
+        Assert.Equal(sharpBase, merged[0].BaseAddress);
+        Assert.Same(data, merged[0].Data);
+        Assert.Equal(10u, merged[0].DataFormat); // RGBA8
+        Assert.Equal(0u, merged[0].NumberFormat); // Unorm
+        Assert.Equal(12u, merged[0].OffsetBytes);
+        Assert.Equal(0x40u, merged[0].Pc);
+    }
+
+    [Fact]
+    public void MergeVertexInputs_AcceptsVertexAttribFormatEnums()
+    {
+        // Attrib tables store VertexAttribFormat (227 = rgba8 unorm), not
+        // BufferFormat (56). Without conversion the format patch is a no-op.
+        const ulong memoryBase = 0x1_0000_0000;
+        var memory = new FakeCpuMemory(memoryBase, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        const ulong semanticsAddress = memoryBase + 0x100;
+        const ulong attribTable = memoryBase + 0x200;
+        const ulong bufferTable = memoryBase + 0x300;
+        const ulong sharpBase = memoryBase + 0x800;
+
+        WriteUInt32(memory, semanticsAddress, 0u | (0u << 8) | (4u << 16));
+        WriteUInt32(memory, attribTable, 0u | (227u << 5) | (12u << 14)); // VertexAttribFormat
+        WriteUInt32(memory, bufferTable, (uint)(sharpBase & 0xFFFF_FFFFUL));
+        WriteUInt32(memory, bufferTable + 4, (uint)(sharpBase >> 32) | (16u << 16));
+
+        var scalars = new uint[32];
+        scalars[4] = (uint)(attribTable & 0xFFFF_FFFFUL);
+        scalars[5] = (uint)(attribTable >> 32);
+        scalars[6] = (uint)(bufferTable & 0xFFFF_FFFFUL);
+        scalars[7] = (uint)(bufferTable >> 32);
+
+        var tables = new AgcVertexMetadata.VertexTableRegisters(
+            VertexBufferReg: 6,
+            VertexAttribReg: 4,
+            InputSemanticsCount: 1,
+            InputSemanticsAddress: semanticsAddress);
+
+        var data = new byte[64];
+        var discovered = new[]
+        {
+            new Gen5VertexInputBinding(
+                0x40, 0, 4, 14, 7, sharpBase, 16, 12, data, data.Length, false),
+        };
+
+        var merged = AgcVertexMetadata.MergeVertexInputsFromMetadata(
+            ctx,
+            scalars,
+            tables,
+            discovered);
+        Assert.Equal(10u, merged[0].DataFormat);
+        Assert.Equal(0u, merged[0].NumberFormat);
+        Assert.Equal(12u, merged[0].OffsetBytes);
+    }
+
+    [Fact]
+    public void MergeVertexInputs_MatchesInterleavedAttrsByOffsetNotBareBase()
+    {
+        // Both attributes share SharpBase. Matching by base alone would assign
+        // the color format to position (video/UI regression).
+        const ulong memoryBase = 0x1_0000_0000;
+        var memory = new FakeCpuMemory(memoryBase, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        const ulong semanticsAddress = memoryBase + 0x100;
+        const ulong attribTable = memoryBase + 0x200;
+        const ulong bufferTable = memoryBase + 0x300;
+        const ulong sharpBase = memoryBase + 0x800;
+
+        // semantic0 → pos float4 @0; semantic1 → color rgba8 @12
+        WriteUInt32(memory, semanticsAddress, 0u | (0u << 8) | (4u << 16));
+        WriteUInt32(memory, semanticsAddress + 4, 1u | (4u << 8) | (4u << 16));
+        WriteUInt32(memory, attribTable, 0u | (77u << 5) | (0u << 14)); // k32_32_32_32Float
+        WriteUInt32(memory, attribTable + 4, 0u | (56u << 5) | (12u << 14)); // rgba8unorm @12
+        WriteUInt32(memory, bufferTable, (uint)(sharpBase & 0xFFFF_FFFFUL));
+        WriteUInt32(memory, bufferTable + 4, (uint)(sharpBase >> 32) | (16u << 16));
+
+        var scalars = new uint[32];
+        scalars[4] = (uint)(attribTable & 0xFFFF_FFFFUL);
+        scalars[5] = (uint)(attribTable >> 32);
+        scalars[6] = (uint)(bufferTable & 0xFFFF_FFFFUL);
+        scalars[7] = (uint)(bufferTable >> 32);
+
+        var tables = new AgcVertexMetadata.VertexTableRegisters(
+            VertexBufferReg: 6,
+            VertexAttribReg: 4,
+            InputSemanticsCount: 2,
+            InputSemanticsAddress: semanticsAddress);
+
+        var data = new byte[64];
+        var discovered = new[]
+        {
+            new Gen5VertexInputBinding(
+                0x40, 0, 4, 14, 7, sharpBase, 16, 0, data, data.Length, false),
+            new Gen5VertexInputBinding(
+                0x80, 1, 4, 14, 7, sharpBase, 16, 12, data, data.Length, false),
+        };
+
+        var merged = AgcVertexMetadata.MergeVertexInputsFromMetadata(
+            ctx,
+            scalars,
+            tables,
+            discovered);
+        Assert.Equal(2, merged.Count);
+        Assert.Equal(0u, merged[0].OffsetBytes);
+        Assert.Equal(12u, merged[1].OffsetBytes);
+        Assert.Equal(0u, merged[1].NumberFormat); // Unorm color, not float
+        Assert.Equal(10u, merged[1].DataFormat); // RGBA8
+        Assert.Equal(sharpBase, merged[0].BaseAddress);
+        Assert.Equal(sharpBase, merged[1].BaseAddress);
+        Assert.Same(data, merged[0].Data);
+    }
+
+    [Fact]
+    public void CollectFetchPrologPcs_FindsSBufferLoadsFromTableRegisters()
+    {
+        var tables = new AgcVertexMetadata.VertexTableRegisters(
+            VertexBufferReg: 10,
+            VertexAttribReg: 8,
+            InputSemanticsCount: 1,
+            InputSemanticsAddress: 1);
+
+        var program = new Gen5ShaderProgram(
+            0,
+            [
+                new Gen5ShaderInstruction(
+                    0x10,
+                    Gen5ShaderEncoding.Smem,
+                    "SBufferLoadDword",
+                    Words: [],
+                    Sources: [Gen5Operand.Scalar(8)],
+                    Destinations: [Gen5Operand.Scalar(20)],
+                    new Gen5ScalarMemoryControl(1, 0, null)),
+                new Gen5ShaderInstruction(
+                    0x20,
+                    Gen5ShaderEncoding.Smem,
+                    "SBufferLoadDword",
+                    Words: [],
+                    Sources: [Gen5Operand.Scalar(12)],
+                    Destinations: [Gen5Operand.Scalar(24)],
+                    new Gen5ScalarMemoryControl(1, 0, null)),
+                new Gen5ShaderInstruction(
+                    0x30,
+                    Gen5ShaderEncoding.Sopp,
+                    "SEndpgm",
+                    Words: [],
+                    Sources: [],
+                    Destinations: [],
+                    null),
+            ]);
+
+        var pcs = AgcVertexMetadata.CollectFetchPrologPcs(program, tables);
+        Assert.Contains(0x10u, pcs);
+        Assert.DoesNotContain(0x20u, pcs);
+    }
+
+    private static void WriteUInt32(FakeCpuMemory memory, ulong address, uint value)
+    {
+        Span<byte> bytes = stackalloc byte[4];
+        BinaryPrimitives.WriteUInt32LittleEndian(bytes, value);
+        Assert.True(memory.TryWrite(address, bytes));
+    }
+}

tests/SharpEmu.Libs.Tests/Agc/GnmTilingDetileTests.cs

@@ -6,7 +6,7 @@ using Xunit;
 
 namespace SharpEmu.Libs.Tests.Agc;
 
-// TryDetile's exact-XOR fast path (PS5 swizzle modes 5/9/24/27) factors the
+// TryDetile's exact-XOR fast path (PS5 swizzle modes 1/5/9/24/27) factors the
 // AddrLib bit-interleave into independent per-column X and per-row Y terms so
 // the inner loop is one array load and one XOR instead of a 16-bit interleave.
 // These tests pin that the factored output stays byte-identical to the direct
@@ -84,6 +84,50 @@ public sealed class GnmTilingDetileTests
         }
     }
 
+    // Gen5 Standard256B (mode 1) uses the 8-bit AddrLib S equation, not the
+    // generic StandardSwizzle bit-interleave. Pin that TryDetile recovers a
+    // known linear fill placed with that equation.
+    private static readonly (uint XMask, uint YMask)[] Standard256_1Bpp =
+    [
+        (1u << 0, 0), (1u << 1, 0), (1u << 2, 0), (1u << 3, 0),
+        (0, 1u << 0), (0, 1u << 1), (0, 1u << 2), (0, 1u << 3),
+    ];
+
+    [Theory]
+    [InlineData(32, 32)]
+    [InlineData(64, 48)]
+    public void TryDetile_ExactXorMode1_MatchesReferenceAddressEquation(
+        int elementsWide,
+        int elementsHigh)
+    {
+        const uint swizzleMode = 1; // Standard256B
+        const int bytesPerElement = 1;
+        const int blockBytes = 256;
+        const int blockWidth = 16;
+        const int blockHeight = 16;
+        var blocksPerRow = (elementsWide + blockWidth - 1) / blockWidth;
+        var blocksPerColumn = (elementsHigh + blockHeight - 1) / blockHeight;
+
+        var tiled = new byte[blocksPerRow * blocksPerColumn * blockBytes];
+        for (var y = 0; y < elementsHigh; y++)
+        {
+            for (var x = 0; x < elementsWide; x++)
+            {
+                var blockIndex = (long)(y / blockHeight) * blocksPerRow + (x / blockWidth);
+                var sourceByte = (int)(blockIndex * blockBytes +
+                    ReferenceOffset((uint)x, (uint)y, Standard256_1Bpp));
+                tiled[sourceByte] = (byte)(y * elementsWide + x);
+            }
+        }
+
+        var linear = new byte[elementsWide * elementsHigh * bytesPerElement];
+        Assert.True(GnmTiling.TryDetile(tiled, linear, swizzleMode, elementsWide, elementsHigh, bytesPerElement));
+        for (var i = 0; i < elementsWide * elementsHigh; i++)
+        {
+            Assert.Equal((byte)i, linear[i]);
+        }
+    }
+
     // GetDetileParams must reproduce TryDetile bit-for-bit: the CPU fallback and
     // the GPU compute kernel both consume these params, so a detile driven purely
     // by DetileParams (the shared addressing formula the kernel runs) must equal
@@ -94,8 +138,8 @@ public sealed class GnmTilingDetileTests
     [InlineData(9u, 4, 300, 300)]  // 64 KiB standard (exact-XOR)
     [InlineData(24u, 4, 128, 256)] // 64 KiB RB+ Z_X (exact-XOR)
     [InlineData(5u, 4, 200, 120)]  // 4 KiB standard (exact-XOR)
+    [InlineData(1u, 4, 64, 64)]    // 256 B standard (exact-XOR)
     [InlineData(8u, 4, 128, 128)]  // 64 KiB Z (block-table path)
-    [InlineData(1u, 4, 64, 64)]    // 256 B standard (block-table path)
     public void GetDetileParams_ReproducesTryDetile(uint mode, int bpp, int w, int h)
     {
         var p = GnmTiling.GetDetileParams(mode, bpp, w, h);

tests/SharpEmu.Libs.Tests/Ampr/AprStreamingContractTests.cs

@@ -105,6 +105,92 @@ public sealed class AprStreamingContractTests
         }
     }
 
+    [Fact]
+    public void ResolveFilepathsWithPrefixToIdsAndFileSizes_CombinesPrefixAndResolvesRealFile()
+    {
+        // Resource streamers call WithPrefix to join a directory prefix with a
+        // relative asset path. Without HLE every call returned NOT_FOUND and no
+        // asset received a real file id/size.
+        const ulong memoryBase = 0x1_0000_0000;
+        const ulong prefixAddress = memoryBase + 0x80;
+        const ulong pathListAddress = memoryBase + 0x100;
+        const ulong pathAddress = memoryBase + 0x200;
+        const ulong idsAddress = memoryBase + 0x800;
+        const ulong sizesAddress = memoryBase + 0x880;
+        byte[] fileContents = [1, 2, 3, 4, 5, 6];
+        var mountRoot = Path.Combine(
+            Path.GetTempPath(),
+            $"sharpemu-apr-prefix-{Guid.NewGuid():N}");
+        Directory.CreateDirectory(mountRoot);
+        var mountPoint = $"/sharpemu_apr_prefix_mnt_{Guid.NewGuid():N}";
+        const string fileName = "asset.bin";
+        var hostPath = Path.Combine(mountRoot, fileName);
+
+        try
+        {
+            File.WriteAllBytes(hostPath, fileContents);
+            KernelMemoryCompatExports.RegisterGuestPathMount(mountPoint, mountRoot);
+            var memory = new FakeCpuMemory(memoryBase, 0x4000);
+            var context = new CpuContext(memory, Generation.Gen5);
+            memory.WriteCString(prefixAddress, mountPoint);
+            memory.WriteCString(pathAddress, fileName);
+            WriteUInt64(memory, pathListAddress, pathAddress);
+
+            context[CpuRegister.Rdi] = prefixAddress;
+            context[CpuRegister.Rsi] = pathListAddress;
+            context[CpuRegister.Rdx] = 1;
+            context[CpuRegister.Rcx] = idsAddress;
+            context[CpuRegister.R8] = sizesAddress;
+            context[CpuRegister.R9] = 0;
+
+            Assert.Equal(
+                (int)OrbisGen2Result.ORBIS_GEN2_OK,
+                KernelMemoryCompatExports.KernelAprResolveFilepathsWithPrefixToIdsAndFileSizes(context));
+            Assert.NotEqual(uint.MaxValue, ReadUInt32(memory, idsAddress));
+            Assert.Equal((ulong)fileContents.Length, ReadUInt64(memory, sizesAddress));
+        }
+        finally
+        {
+            KernelMemoryCompatExports.UnregisterGuestPathMount(mountPoint);
+            if (Directory.Exists(mountRoot))
+            {
+                Directory.Delete(mountRoot, recursive: true);
+            }
+        }
+    }
+
+    [Fact]
+    public void ResolveFilepathsWithPrefixToIdsAndFileSizes_MissingFile_FailsFastWithErrorIndex()
+    {
+        const ulong memoryBase = 0x1_0000_0000;
+        const ulong prefixAddress = memoryBase + 0x80;
+        const ulong pathListAddress = memoryBase + 0x100;
+        const ulong pathAddress = memoryBase + 0x200;
+        const ulong idsAddress = memoryBase + 0x800;
+        const ulong sizesAddress = memoryBase + 0x880;
+        const ulong errorIndexAddress = memoryBase + 0x8F0;
+        var memory = new FakeCpuMemory(memoryBase, 0x4000);
+        var context = new CpuContext(memory, Generation.Gen5);
+        memory.WriteCString(prefixAddress, "/does-not-exist-prefix");
+        memory.WriteCString(pathAddress, $"missing-{Guid.NewGuid():N}.bin");
+        WriteUInt64(memory, pathListAddress, pathAddress);
+
+        context[CpuRegister.Rdi] = prefixAddress;
+        context[CpuRegister.Rsi] = pathListAddress;
+        context[CpuRegister.Rdx] = 1;
+        context[CpuRegister.Rcx] = idsAddress;
+        context[CpuRegister.R8] = sizesAddress;
+        context[CpuRegister.R9] = errorIndexAddress;
+
+        Assert.Equal(
+            -1,
+            KernelMemoryCompatExports.KernelAprResolveFilepathsWithPrefixToIdsAndFileSizes(context));
+        Assert.Equal(ulong.MaxValue, context[CpuRegister.Rax]);
+        Assert.Equal(uint.MaxValue, ReadUInt32(memory, idsAddress));
+        Assert.Equal(0ul, ReadUInt64(memory, sizesAddress));
+        Assert.Equal(0u, ReadUInt32(memory, errorIndexAddress));
+    }
+
     [Fact]
     public void ResolveFilepathsToIdsAndFileSizes_MissingFile_FailsFastWithErrorIndex()
     {

tests/SharpEmu.Libs.Tests/Audio/AudioOut2PortGetStateExportsTests.cs

@@ -0,0 +1,86 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Audio;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Audio;
+
+public sealed class AudioOut2PortGetStateExportsTests
+{
+    private const ulong MemoryBase = 0x1_0000_0000;
+    private const ulong StateAddress = MemoryBase + 0x100;
+
+    private static CpuContext CreateContext(out FakeCpuMemory memory)
+    {
+        memory = new FakeCpuMemory(MemoryBase, 0x1000);
+        return new CpuContext(memory, Generation.Gen5);
+    }
+
+    [Fact]
+    public void PortGetState_WritesFixedSizeIgnoringPollutedR9()
+    {
+        var ctx = CreateContext(out var memory);
+        // Paint the buffer so we can see the write footprint.
+        Span<byte> paint = stackalloc byte[0x100];
+        paint.Fill(0xAB);
+        Assert.True(memory.TryWrite(StateAddress, paint));
+
+        ctx[CpuRegister.Rdi] = 0xDE1FF6800001UL;
+        ctx[CpuRegister.Rsi] = StateAddress;
+        ctx[CpuRegister.Rdx] = StateAddress + 0x200;
+        // Polluted GetSize leftover — must NOT enlarge the write.
+        ctx[CpuRegister.R9] = 0x180;
+
+        var result = AudioOut2Exports.AudioOut2PortGetState(ctx);
+
+        Assert.Equal(0, result);
+        Span<byte> state = stackalloc byte[0x100];
+        Assert.True(memory.TryRead(StateAddress, state));
+        Assert.Equal(1, BinaryPrimitives.ReadUInt16LittleEndian(state));
+        Assert.Equal(2, state[2]);
+        // Bytes past the fixed 0x20 header must remain untouched.
+        Assert.Equal(0xAB, state[0x20]);
+        Assert.Equal(0xAB, state[0x7F]);
+    }
+
+    [Fact]
+    public void PortGetState_SkipsGuestStackOutBuffer()
+    {
+        var ctx = CreateContext(out _);
+        const ulong stackOut = 0x00007FFFDE1FF688UL;
+        ctx[CpuRegister.Rdi] = 0xDE1FF688004DUL;
+        ctx[CpuRegister.Rsi] = stackOut;
+        ctx[CpuRegister.Rdx] = 0;
+
+        var result = AudioOut2Exports.AudioOut2PortGetState(ctx);
+
+        Assert.Equal(0, result);
+    }
+
+    [Fact]
+    public void GetSpeakerInfo_WritesFixedSizeToRdiNotRsiTypeFlag()
+    {
+        var ctx = CreateContext(out var memory);
+        Span<byte> paint = stackalloc byte[0x80];
+        paint.Fill(0xCD);
+        Assert.True(memory.TryWrite(StateAddress, paint));
+
+        ctx[CpuRegister.Rdi] = StateAddress;
+        ctx[CpuRegister.Rsi] = 1;
+        ctx[CpuRegister.Rdx] = StateAddress + 0x200;
+        ctx[CpuRegister.R8] = 0x840;
+        ctx[CpuRegister.R9] = 0x10C;
+
+        var result = AudioOut2Exports.AudioOut2GetSpeakerInfo(ctx);
+
+        Assert.Equal(0, result);
+        Span<byte> info = stackalloc byte[0x80];
+        Assert.True(memory.TryRead(StateAddress, info));
+        Assert.Equal(2u, BinaryPrimitives.ReadUInt32LittleEndian(info));
+        Assert.Equal(48000u, BinaryPrimitives.ReadUInt32LittleEndian(info[4..]));
+        Assert.Equal(0xCD, info[0x20]);
+    }
+}

tests/SharpEmu.Libs.Tests/Audio/AudioOut2SpeakerArrayExportsTests.cs

@@ -0,0 +1,140 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Audio;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Audio;
+
+public sealed class AudioOut2SpeakerArrayExportsTests
+{
+    private const ulong MemoryBase = 0x1_0000_0000;
+    private const ulong OutHandleAddress = MemoryBase + 0x100;
+    private const ulong ReservedAddress = MemoryBase + 0x120;
+    private const ulong ParamAddress = MemoryBase + 0x200;
+    private const ulong SpeakerMemoryAddress = MemoryBase + 0x400;
+
+    private static CpuContext CreateContext(out FakeCpuMemory memory)
+    {
+        memory = new FakeCpuMemory(MemoryBase, 0x2000);
+        return new CpuContext(memory, Generation.Gen5);
+    }
+
+    private static void WriteU64(FakeCpuMemory memory, ulong address, ulong value)
+    {
+        Span<byte> bytes = stackalloc byte[8];
+        BinaryPrimitives.WriteUInt64LittleEndian(bytes, value);
+        Assert.True(memory.TryWrite(address, bytes));
+    }
+
+    private static ulong ReadU64(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> bytes = stackalloc byte[8];
+        Assert.True(memory.TryRead(address, bytes));
+        return BinaryPrimitives.ReadUInt64LittleEndian(bytes);
+    }
+
+    private static uint ReadU32(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> bytes = stackalloc byte[4];
+        Assert.True(memory.TryRead(address, bytes));
+        return BinaryPrimitives.ReadUInt32LittleEndian(bytes);
+    }
+
+    [Fact]
+    public void GetSpeakerArrayMemorySize_NeverReturnsTheNotFoundSentinel()
+    {
+        var ctx = CreateContext(out _);
+        ctx[CpuRegister.Rdi] = 8;
+
+        var result = AudioOut2Exports.AudioOut2GetSpeakerArrayMemorySize(ctx);
+
+        Assert.NotEqual((int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND, result);
+        Assert.Equal(0x40 + 8 * 0x100 + 0x400, result);
+        Assert.Equal((ulong)result, ctx[CpuRegister.Rax]);
+        Assert.True(result < 0x10000);
+    }
+
+    [Fact]
+    public void GetSpeakerArrayMemorySize_TwoChannelsIsExactChannelScaledSize()
+    {
+        var ctx = CreateContext(out _);
+        ctx[CpuRegister.Rdi] = 2;
+
+        var result = AudioOut2Exports.AudioOut2GetSpeakerArrayMemorySize(ctx);
+
+        Assert.Equal(0x40 + 2 * 0x100 + 0x400, result);
+        Assert.Equal(0x640UL, ctx[CpuRegister.Rax]);
+    }
+
+    [Fact]
+    public void SpeakerArrayCreate_PublishesObjectPointerAndLeavesReservedSizeAlone()
+    {
+        var ctx = CreateContext(out var memory);
+        // Stage a size in the reserved slot the way callers do before Create.
+        WriteU64(memory, ReservedAddress, 0x100);
+        ctx[CpuRegister.Rdi] = ParamAddress;
+        ctx[CpuRegister.Rsi] = OutHandleAddress;
+        ctx[CpuRegister.Rdx] = ReservedAddress;
+        ctx[CpuRegister.Rcx] = 2;
+
+        var result = AudioOut2Exports.AudioOut2SpeakerArrayCreate(ctx);
+
+        Assert.Equal(0, result);
+        Assert.NotEqual(0UL, ctx[CpuRegister.Rax]);
+        Assert.NotEqual(0x100UL, ctx[CpuRegister.Rax]);
+        Assert.Equal(ctx[CpuRegister.Rax], ReadU64(memory, OutHandleAddress));
+        // Reserved/size slot must remain untouched — writing it corrupted canaries.
+        Assert.Equal(0x100UL, ReadU64(memory, ReservedAddress));
+    }
+
+    [Fact]
+    public void SpeakerArrayCreate_PublishesHandleForTypicalCallShape()
+    {
+        var ctx = CreateContext(out _);
+        ctx[CpuRegister.Rdi] = ParamAddress;
+        ctx[CpuRegister.Rsi] = OutHandleAddress;
+        ctx[CpuRegister.Rdx] = ReservedAddress;
+        ctx[CpuRegister.Rcx] = 2;
+
+        var result = AudioOut2Exports.AudioOut2SpeakerArrayCreate(ctx);
+
+        Assert.Equal(0, result);
+        Assert.NotEqual(0UL, ctx[CpuRegister.Rax]);
+        Assert.NotEqual(0x10000UL, ctx[CpuRegister.Rax]);
+        Assert.NotEqual((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT, result);
+    }
+
+    [Fact]
+    public void SpeakerArrayCreate_IgnoresCorruptedParamBufferFields()
+    {
+        var ctx = CreateContext(out var memory);
+        // Simulate PortGetState having overwritten param+0x18 (size) with a
+        // state blob — Create must NOT adopt that as an in-place buffer.
+        WriteU64(memory, ParamAddress + 0x10, SpeakerMemoryAddress);
+        WriteU64(memory, ParamAddress + 0x18, 0x100);
+        ctx[CpuRegister.Rdi] = ParamAddress;
+        ctx[CpuRegister.Rsi] = OutHandleAddress;
+        ctx[CpuRegister.Rdx] = ReservedAddress;
+        ctx[CpuRegister.Rcx] = 2;
+
+        var result = AudioOut2Exports.AudioOut2SpeakerArrayCreate(ctx);
+
+        Assert.Equal(0, result);
+        Assert.NotEqual(SpeakerMemoryAddress, ctx[CpuRegister.Rax]);
+        Assert.NotEqual(0x100UL, ctx[CpuRegister.Rax]);
+    }
+
+    [Fact]
+    public void SpeakerArrayDestroy_UnknownHandleStillSucceeds()
+    {
+        var ctx = CreateContext(out _);
+        ctx[CpuRegister.Rdi] = 0xDEAD_BEEF;
+
+        var result = AudioOut2Exports.AudioOut2SpeakerArrayDestroy(ctx);
+
+        Assert.Equal(0, result);
+    }
+}

tests/SharpEmu.Libs.Tests/FakeCpuMemory.cs

@@ -7,15 +7,18 @@ namespace SharpEmu.Libs.Tests;
 
 // A single contiguous guest region backed by a byte[]. Enough to hand C strings and small
 // structures to HLE exports under test without a live guest.
-internal sealed class FakeCpuMemory : ICpuMemory
+internal sealed class FakeCpuMemory : ICpuMemory, IGuestMemoryAllocator
 {
     private readonly ulong _base;
     private readonly byte[] _storage;
+    private ulong _allocBump;
 
     public FakeCpuMemory(ulong baseAddress, int size)
     {
         _base = baseAddress;
         _storage = new byte[size];
+        // Bump from the top so test fixtures at low offsets stay intact.
+        _allocBump = baseAddress + (ulong)size;
     }
 
     public bool TryRead(ulong virtualAddress, Span<byte> destination)
@@ -40,6 +43,33 @@ internal sealed class FakeCpuMemory : ICpuMemory
         return true;
     }
 
+    public bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address)
+    {
+        address = 0;
+        if (size == 0 || alignment == 0 || (alignment & (alignment - 1)) != 0)
+        {
+            return false;
+        }
+
+        var alignedSize = (size + alignment - 1) & ~(alignment - 1);
+        if (alignedSize > _allocBump - _base)
+        {
+            return false;
+        }
+
+        var next = (_allocBump - alignedSize) & ~(alignment - 1);
+        if (next < _base)
+        {
+            return false;
+        }
+
+        _allocBump = next;
+        address = next;
+        return true;
+    }
+
+    public bool TryFreeGuestMemory(ulong address) => false;
+
     public ulong WriteCString(ulong virtualAddress, string text)
     {
         var bytes = System.Text.Encoding.UTF8.GetBytes(text);

tests/SharpEmu.Libs.Tests/Memory/GuestImageWriteTrackerTests.cs

@@ -24,13 +24,53 @@ public sealed unsafe class GuestImageWriteTrackerTests
     // spilling onto neighbouring heap pages.
     private const nuint TrackedByteCount = 4096;
     private const nuint HostPageAlignment = 16384;
+    private const uint MemCommit = 0x1000;
+    private const uint MemReserve = 0x2000;
+    private const uint MemRelease = 0x8000;
+    private const uint PageReadWrite = 0x04;
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern nint VirtualAlloc(
+        nint lpAddress,
+        nuint dwSize,
+        uint flAllocationType,
+        uint flProtect);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern int VirtualFree(nint lpAddress, nuint dwSize, uint dwFreeType);
 
     private static ulong AllocateTrackedPages(out void* allocation)
     {
+        // VirtualProtect (Windows) / mprotect (POSIX) must target
+        // VirtualAlloc/mmap pages. Protecting CRT heap pages poisons
+        // neighbouring allocator metadata and crashes the test host.
+        if (OperatingSystem.IsWindows())
+        {
+            var windowsAllocation = VirtualAlloc(
+                0,
+                HostPageAlignment,
+                MemCommit | MemReserve,
+                PageReadWrite);
+            Assert.NotEqual(nint.Zero, windowsAllocation);
+            allocation = (void*)windowsAllocation;
+            return (ulong)windowsAllocation;
+        }
+
         allocation = NativeMemory.AlignedAlloc(2 * HostPageAlignment, HostPageAlignment);
         return (ulong)allocation;
     }
 
+    private static void FreeTrackedPages(void* allocation)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            _ = VirtualFree((nint)allocation, 0, MemRelease);
+            return;
+        }
+
+        NativeMemory.Free(allocation);
+    }
+
     [Fact]
     public void GenerationSurvivesDirtyConsume()
     {
@@ -58,7 +98,7 @@ public sealed unsafe class GuestImageWriteTrackerTests
         finally
         {
             GuestImageWriteTracker.Untrack(address);
-            NativeMemory.Free(allocation);
+            FreeTrackedPages(allocation);
         }
     }
 
@@ -89,7 +129,7 @@ public sealed unsafe class GuestImageWriteTrackerTests
         finally
         {
             GuestImageWriteTracker.Untrack(address);
-            NativeMemory.Free(allocation);
+            FreeTrackedPages(allocation);
         }
     }
 
@@ -118,7 +158,7 @@ public sealed unsafe class GuestImageWriteTrackerTests
         finally
         {
             GuestImageWriteTracker.Untrack(address);
-            NativeMemory.Free(allocation);
+            FreeTrackedPages(allocation);
         }
     }
 
@@ -132,4 +172,132 @@ public sealed unsafe class GuestImageWriteTrackerTests
 
         Assert.False(GuestImageWriteTracker.TryGetWriteGeneration(0xDEAD_0000_0000UL, out _));
     }
+
+    [Fact]
+    public void WatchOnlyTrackDoesNotArmWriteProtection()
+    {
+        if (!GuestImageWriteTracker.Enabled)
+        {
+            return;
+        }
+
+        var address = AllocateTrackedPages(out var allocation);
+        try
+        {
+            GuestImageWriteTracker.Track(
+                address,
+                TrackedByteCount,
+                source: "test.watch-only",
+                protect: false);
+            Assert.True(
+                GuestImageWriteTracker.TryGetProtectionState(
+                    address,
+                    out var protect,
+                    out var armed));
+            Assert.False(protect);
+            Assert.False(armed);
+
+            // Pages stay writable: a native store must not require a fault handler.
+            *(byte*)address = 0xAB;
+            Assert.Equal(0xAB, *(byte*)address);
+        }
+        finally
+        {
+            GuestImageWriteTracker.Untrack(address);
+            FreeTrackedPages(allocation);
+        }
+    }
+
+    [Fact]
+    public void WatchOnlyRangesAreExcludedFromManagedWriteSnapshot()
+    {
+        if (!GuestImageWriteTracker.Enabled)
+        {
+            return;
+        }
+
+        var address = AllocateTrackedPages(out var allocation);
+        try
+        {
+            GuestImageWriteTracker.Track(
+                address,
+                TrackedByteCount,
+                source: "test.watch-only",
+                protect: false);
+            // Watch-only must not widen the NotifyManagedWrite hot path.
+            GuestImageWriteTracker.NotifyManagedWrite(address, sizeof(uint));
+            Assert.False(GuestImageWriteTracker.ConsumeDirty(address));
+            Assert.True(
+                GuestImageWriteTracker.TryGetProtectionState(
+                    address,
+                    out var protect,
+                    out var armed));
+            Assert.False(protect);
+            Assert.False(armed);
+        }
+        finally
+        {
+            GuestImageWriteTracker.Untrack(address);
+            FreeTrackedPages(allocation);
+        }
+    }
+
+    [Fact]
+    public void ProtectedTrackArmsWriteProtection()
+    {
+        if (!GuestImageWriteTracker.Enabled)
+        {
+            return;
+        }
+
+        var address = AllocateTrackedPages(out var allocation);
+        try
+        {
+            GuestImageWriteTracker.Track(address, TrackedByteCount);
+            Assert.True(
+                GuestImageWriteTracker.TryGetProtectionState(
+                    address,
+                    out var protect,
+                    out var armed));
+            Assert.True(protect);
+            Assert.True(armed);
+        }
+        finally
+        {
+            GuestImageWriteTracker.Untrack(address);
+            FreeTrackedPages(allocation);
+        }
+    }
+
+    [Fact]
+    public void WatchOnlyTrackDoesNotDowngradeProtectedRange()
+    {
+        if (!GuestImageWriteTracker.Enabled)
+        {
+            return;
+        }
+
+        var address = AllocateTrackedPages(out var allocation);
+        try
+        {
+            GuestImageWriteTracker.Track(address, TrackedByteCount, source: "test.rt");
+            GuestImageWriteTracker.Track(
+                address,
+                TrackedByteCount,
+                source: "test.texture-cache",
+                protect: false);
+            Assert.True(
+                GuestImageWriteTracker.TryGetProtectionState(
+                    address,
+                    out var protect,
+                    out var armed));
+            Assert.True(protect);
+            Assert.True(armed);
+        }
+        finally
+        {
+            GuestImageWriteTracker.Untrack(address);
+            FreeTrackedPages(allocation);
+        }
+    }
 }

tests/SharpEmu.Libs.Tests/Memory/GuestMemoryAllocatorTests.cs

@@ -79,7 +79,16 @@ public sealed class GuestMemoryAllocatorTests
         var pointer = memory.GetPointer(address + 0x123);
 
         Assert.Equal(address + 0x123, (ulong)pointer);
-        Assert.Equal([(address, pageSize, HostPageProtection.ReadWrite)], host.CommitCalls);
+        // GetPointer commits a 32 MiB working-set chunk as 4 KiB pages against
+        // this fake host (Query reports 4 KiB reserved regions). Non-page-
+        // aligned start makes AlignUp(addr + chunk) cover one extra page.
+        const ulong lazyPrimeChunkBytes = 0x0200_0000UL;
+        var endPage = (address + 0x123 + lazyPrimeChunkBytes + pageSize - 1) & ~(pageSize - 1);
+        Assert.Equal((int)((endPage - address) / pageSize), host.CommitCalls.Count);
+        Assert.Equal((address, pageSize, HostPageProtection.ReadWrite), host.CommitCalls[0]);
+        Assert.All(
+            host.CommitCalls,
+            call => Assert.Equal(pageSize, call.Size));
     }
 
     [Fact]

tests/SharpEmu.Libs.Tests/Memory/PhysicalVirtualMemoryTests.cs

@@ -9,9 +9,10 @@ using Xunit;
 namespace SharpEmu.Libs.Tests.Memory;
 
 // PhysicalVirtualMemory is the host-backed (identity-mapped) implementation.
-// Reserve-only regions (> 4 GiB, non-executable) defer commit until first
+// Huge non-executable maps (> 4 GiB) prefer commit-first, then fall back to
-// access; TryAllocateGuestMemory serves a first-fit free-list with coalescing.
+// reserve-only + lazy commit when Allocate fails. TryAllocateGuestMemory serves
-// These tests pin that behaviour through fake IHostMemory implementations.
+// a first-fit free-list with coalescing. These tests pin that behaviour through
+// fake IHostMemory implementations that refuse full Allocate for huge sizes.
 public sealed class PhysicalVirtualMemoryTests
 {
     // 1. Lazy commit: a reserve-only region has its pages committed on demand
@@ -22,7 +23,8 @@ public sealed class PhysicalVirtualMemoryTests
         using var host = new LazyZeroedHostMemory();
         using var memory = new PhysicalVirtualMemory(host);
 
-        // > 4 GiB, non-executable -> reserve-only with lazy commit.
+        // > 4 GiB, non-executable; fake host rejects Allocate so reserve-only
+        // + lazy commit is used.
         var address = memory.AllocateAt(0, (4UL << 30) + 0x1000, executable: false);
         Assert.NotEqual(0UL, address);
 
@@ -108,8 +110,17 @@ public sealed class PhysicalVirtualMemoryTests
         Assert.NotEqual(0UL, (ulong)pointer);
         Assert.Equal(address + 0x123, (ulong)pointer);
 
+        // GetPointer primes a 32 MiB working-set chunk (page-sized commits
+        // against this fake host's 4 KiB Query regions). Non-page-aligned
+        // start makes AlignUp(addr + chunk) cover one extra page.
+        const ulong lazyPrimeChunkBytes = 0x0200_0000UL;
         var page = (address + 0x123) & ~0xFFFUL;
-        Assert.Equal([(page, 0x1000UL, HostPageProtection.ReadWrite)], host.CommitCalls);
+        var endPage = (address + 0x123 + lazyPrimeChunkBytes + 0xFFFUL) & ~0xFFFUL;
+        Assert.Equal((int)((endPage - page) / 0x1000UL), host.CommitCalls.Count);
+        Assert.Equal((page, 0x1000UL, HostPageProtection.ReadWrite), host.CommitCalls[0]);
+        Assert.All(
+            host.CommitCalls,
+            call => Assert.Equal(0x1000UL, call.Size));
     }
 
     [Fact]
@@ -187,7 +198,8 @@ public sealed class PhysicalVirtualMemoryTests
 
         public int QueryCalls { get; private set; }
 
-        public ulong Allocate(ulong desiredAddress, ulong size, HostPageProtection protection) => _address;
+        // Force the commit-first → reserve-only fallback for huge maps.
+        public ulong Allocate(ulong desiredAddress, ulong size, HostPageProtection protection) => 0;
 
         public ulong Reserve(ulong desiredAddress, ulong size, HostPageProtection protection) => _address;
 

tests/SharpEmu.Libs.Tests/Remoteplay/RemoteplayExportsTests.cs

@@ -0,0 +1,58 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.Libs.Remoteplay;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Remoteplay;
+
+public sealed class RemoteplayExportsTests
+{
+    private const ulong MemoryBase = 0x1_0000_0000;
+    private const ulong StatusAddress = MemoryBase + 0x100;
+
+    private static CpuContext CreateContext(out FakeCpuMemory memory)
+    {
+        memory = new FakeCpuMemory(MemoryBase, 0x1000);
+        return new CpuContext(memory, Generation.Gen5);
+    }
+
+    [Fact]
+    public void Initialize_Succeeds()
+    {
+        var ctx = CreateContext(out _);
+
+        var result = RemoteplayExports.RemoteplayInitialize(ctx);
+
+        Assert.Equal(0, result);
+    }
+
+    [Fact]
+    public void GetConnectionStatus_WritesDisconnectedStatus()
+    {
+        var ctx = CreateContext(out var memory);
+        ctx[CpuRegister.Rdi] = 0x1000_0000;
+        ctx[CpuRegister.Rsi] = StatusAddress;
+        memory.TryWrite(StatusAddress, stackalloc byte[] { 0xFF, 0xFF, 0xFF, 0xFF });
+
+        var result = RemoteplayExports.RemoteplayGetConnectionStatus(ctx);
+
+        Assert.Equal(0, result);
+        var status = new byte[4];
+        Assert.True(ctx.Memory.TryRead(StatusAddress, status));
+        Assert.Equal(0, status[0]);
+    }
+
+    [Fact]
+    public void GetConnectionStatus_NullOutPointerStillSucceeds()
+    {
+        var ctx = CreateContext(out _);
+        ctx[CpuRegister.Rdi] = 0x1000_0000;
+        ctx[CpuRegister.Rsi] = 0;
+
+        var result = RemoteplayExports.RemoteplayGetConnectionStatus(ctx);
+
+        Assert.Equal(0, result);
+    }
+}

tests/SharpEmu.Libs.Tests/VideoOut/VulkanPresentEncodeFormatTests.cs

@@ -56,4 +56,26 @@ public sealed class VulkanPresentEncodeFormatTests
     {
         Assert.False(VulkanVideoPresenter.IsLinearFloatPresentSource(sourceFormat));
     }
+
+    // GTA V Enhanced early G-buffer color targets observed as COMPAT failures
+    // when missing from TryDecodeRenderTargetFormat (format=2 / format=11).
+    [Theory]
+    [InlineData(2u, 0u, Format.R16Unorm)]
+    [InlineData(2u, 4u, Format.R16Uint)]
+    [InlineData(2u, 7u, Format.R16Sfloat)]
+    [InlineData(11u, 4u, Format.R32G32Uint)]
+    [InlineData(11u, 5u, Format.R32G32Sint)]
+    [InlineData(11u, 7u, Format.R32G32Sfloat)]
+    public void TryDecodeRenderTargetFormat_DecodesGen5R16AndRg32(
+        uint dataFormat,
+        uint numberType,
+        Format expected)
+    {
+        Assert.True(
+            VulkanVideoPresenter.TryDecodeRenderTargetFormat(
+                dataFormat,
+                numberType,
+                out var decoded));
+        Assert.Equal(expected, decoded.Format);
+    }
 }