fix(gta): restore wiped GTA foundation and gameplay path (PPSA04264) (#650)

* fix(kernel): implement APR ResolveFilepathsWithPrefixToIdsAndFileSizes

Resource streamers resolve relative paths against a shared prefix; without
this HLE every call returned NOT_FOUND and assets never got real ids/sizes.

* fix(remoteplay): stub Initialize and GetConnectionStatus as disconnected

Titles probe Remote Play during pad/network bring-up; unresolved imports
returned NOT_FOUND. Report initialized + disconnected so callers take the
normal offline path.

* fix(agc): accept Gen5 hull shaders that omit PGM_LO/HI in CreateShader

Type-5 headers can start with RSRC1/RSRC2; rejecting them left null handles
and Main Thread AVs. Scan the SH table and skip PGM patch when absent.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fix(kernel): reject getdents on file fds and emit . / .. for empty dirs

Returning rax=0 for non-directory or empty listings looked like EOF and
let GTA treat the fd as a pointer (fiWriteAsyncDataWorker AV at 0xB1).

* fix(hle): enable GuestImageWriteTracker CPU sync on Windows

Windows previously hard-disabled the tracker, so CPU-written guest
planes never marked dirty and host textures stayed empty. Arm pages
with VirtualProtect, handle write AVs in VEH, and warm/test on
VirtualAlloc memory so protect cannot poison the CRT heap.

* fix(agc): skip CB metadata draws for EliminateFastClear/Fmask/DCC

CB_COLOR_CONTROL modes 2/5/6 are colour-buffer metadata ops; applying
the bound shader as a normal colour draw corrupts subsequent composites.
Decode MODE from bits [6:4] and return before translate.

* fix(agc): merge Prospero attrib-table formats onto IR vertex inputs

IR-discovered BufferLoadFormat often keeps a stale float sharp format;
patch DataFormat/offset from the AGC attrib table (semantic index),
allow offen fetches, and map quirks 113/121 through NarrowVk for host
vertex input.

* fix(audio): harden AudioOut2 stack out-buffer writes against canary smash

Titles that stack-allocate AudioOut2 outs next to the frame canary were
corrupted by oversized or mistyped HLE writes; keep ContextPush pacing.

* Revert "fix(memory): reserve only large regions (#608)"

This reverts commit 8f9456229a.

* fix(gpu): decode Gen5 R16 and RG32 render-target formats

* fix(audio): AudioOut2 host beds, deeper waveOut queue, AJM MP3

GTA V Enhanced routes intro/menu audio through AudioOut2 and FMOD's AJM
MP3 path. Wire PortCreate/PortSetAttributes/ContextPush to dual host
stereo streams, deepen WinMM queue to 128KiB, and decode AJM codec 0
with a stateful NLayer helper so menu music is not silent.

* fix(agc): map PS interpolants via SPI_PS_INPUT_CNTL semantics

Identity ATTR→param wiring ignored hardware remapping, so UI draws
got wrong (or empty) interpolants. Pack CNTL from matched PS/GS
semantics, thread it into Vulkan/Metal as Location/Flat, and fingerprint
it in the graphics shader cache key.

* fix(agc): rect-list/NGG strips, Index8 expand, and GE_INDX_OFFSET

NGG single-rect UI needs triangle-strip expansion; Prospero Index8 must
expand to host u16; glyphs need base vertex from GE_INDX_OFFSET. Skip
param-less rect-lists instead of inventing colour draws.

* fix(np): report GTA Story Mode addcont entitlements as owned

NpEntitlementAccess was returning an empty add-on list, so GTA V Enhanced offered Buy Story Mode. Publish the installed license labels and stub premium-event registration so offline sessions take the owned path.

* fix(cpu): prefer native workers for all guest entry stubs

Route thread entry, continuation, and main entry through RunGuestEntryStub so guest stubs are not invoked above CLR-managed frames (UnmanagedCallersOnly FailFast). Keep requireNativeWorker for tbb_thead; other paths prefer workers with calli fallback.

* fix(agc): implement Rewind/Jump writers and IT_REWIND waits

GTA Subrender AVs came from AcbJumpGetSize / DcbRewind returning NOT_FOUND as packet sizes. Add IT_REWIND and INDIRECT_BUFFER writers, patch SetRewindState into the GPU wait registry, and nest-parse 4-dword jumps.

* fix(gpu): use AddrLib ExactXor for Gen5 Standard256B (mode 1)

Mode 5 already had Standard4K ExactXor; mode 1 still used the generic StandardSwizzle block table, which mis-detiles Gen5 UI atlases.

* Revert "fix(cpu): prefer native workers for all guest entry stubs"

This reverts commit 31c4db0d38.

* fix(memory): commit-first large maps; reserve only on failure

Replace the #608 always-reserve-only exact-map path with allocate-first and lazy reserve fallback when a huge non-exec commit cannot be satisfied. Prime and widen GetPointer commit so the fallback path is safer for native walkers. Drops the need for a hard #608 revert.

* [Agc] Implement fused shader half exports

* fix(agc): accept optional hull state in CreatePrimState

Port the CreatePrimState hull-optional path from #583 so fused HS pipelines (GTA) are not rejected with INVALID_ARGUMENT. Geometry-derived CX/UC writes are unchanged; hull is traced only.

* fix(videoout): restore thread-safe VulkanHostBufferPool (#564)

The 6db095e wipe dropped CasualcoderDev's lock-ordering-safe pool. Concurrent Return/TryTake without the gate races after the first present and can hang the submit path.

* Revert "fix(agc): implement Rewind/Jump writers and IT_REWIND waits"

This reverts commit bec77bf083.

* test(memory): align lazy-commit expectations with commit-first policy

Fake hosts must reject Allocate so reserve-only paths still run, and GetPointer asserts the 32 MiB prime range including AlignUp spill.

* diag(gpu): log guest-queue backlog breakdown under backpressure

Rate-limit top work types and ordered debugName prefixes when the Vulkan guest work queue stalls, so North Yankton logs show acquire/label vs draw traffic instead of only VulkanOrderedGuestAction.

* perf(agc): coalesce acquire flushes and batch non-DMA label wakes

Flush pending ACQUIRE_MEM invalidation at draw/dispatch/dma/flip boundaries instead of before every packet, and complete release/write-data producers in the same ordered action so load paths enqueue far fewer VulkanOrderedGuestAction items.

* perf(gpu): wait for ordered-action fences and keep draining sync

On Windows/Linux, block briefly for queue-visibility fences instead of deferring the whole logical queue for the tick. Prefer ordered sync/flip heads under backlog pressure, and keep macOS non-blocking defer behavior.

* perf(gpu): raise sync-item ceiling above payload guest-work cap

Apply SHARPEMU_PENDING_GUEST_WORK_ITEMS mainly to compute/draw/image payload work, and allow a higher SHARPEMU_PENDING_GUEST_SYNC_ITEMS ceiling for zero-payload ordered actions and flip markers. Keep the byte budget as the RAM safety valve.

* fix(gta): stub Voice ports and implement sceKernelCheckReachability

Resolve North Yankton-path Voice Create/Delete/Connect/Disconnect/End NIDs and EnumerationThread reachability checks so leftover unresolved imports are not on the critical path.

* diag(gta): arm flip/present/wait probes after North Audio

Rate-limited load_progress TRACE for flip submit, ordered flip enqueue, present taken/not-taken, and GPU wait backlog so North Yankton freezes can be classified without full AGC tracing.

* fix(ampr): restore sequential offset=-1 reads for streamer packs

Re-wire PakDirectoryTracker into sceAmprAprCommandBufferReadFile (dropped in #216) so RAGE sequential pack reads no longer fail while the North Yankton UI keeps flipping. Also rate-limit CheckReachability miss paths for EnumerationThread diagnosis.

* fix(hle/videoout): Windows GuestImage opt-in and keep GTA intro without sync

Default the tracker off on Windows to avoid VirtualProtect thrash, gate AGC
texel-copy skips on Enabled so guest Bink planes keep shipping pixels, and
drain CPU-written images on the present thread when sync is opted in.

* fix(videoout): probe guest content when tracker off so UI can skip copies

Restores upload-known/texture-cache skips for Dead Cells menus, and uses a
sparse guest-memory fingerprint when GuestImageWriteTracker is disabled so
CPU-updated Bink planes still force texel copies for GTA intro.

* fix(audio): keep 128KiB host queue AudioOut2-only

Restore the default 32 KiB (~171 ms) PCM bed for classic AudioOut so
titles like Dreaming Sarah stay in sync; only AudioOut2 opens the deeper
queue needed for bursty FMOD Push on GTA.

---------

Co-authored-by: samto6 <123419830+samto6@users.noreply.github.com>

CONTRIBUTING.md

@@ -26,6 +26,25 @@ Before opening a pull request, please keep the following in mind:
 
 If you're unsure about a design decision, feel free to open a discussion or draft PR first.
 
+## Pull Request Expectations
+
+Pull requests should provide real, observable emulator behavior rather than only suppressing errors or unresolved imports.
+
+Changes that only return success, zero, or fabricated handles without implementing the expected state, output, or side effects will generally not be accepted. Functions that create resources, write output structures, register callbacks, or expose runtime state should model the behavior required by the guest.
+
+When applicable, PRs should include:
+
+- The affected game or application.
+- Relevant logs or failing imports.
+- Behavior before and after the change.
+- Real game testing and known limitations.
+
+Avoid submitting large collections of speculative NIDs or unrelated exports. Keep each PR focused on one problem or a closely related set of changes.
+
+Large architectural changes should be discussed with the maintainers before implementation. Contributors are encouraged to ask first when they are uncertain whether a proposed direction fits the project.
+
+Opening a PR does not guarantee that it will be merged. Maintainers evaluate changes based on correctness, evidence, testing, scope, maintenance cost, and the long-term direction of the project.
+
 ## AI-Assisted Contributions
 
 AI-assisted development is welcome and may be used for research, reverse engineering, code generation, or documentation.

Directory.Build.props

@@ -9,11 +9,18 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <SharpEmuVersion>0.0.2-beta.4</SharpEmuVersion>
+    <SharpEmuVersion>0.0.2-beta.5</SharpEmuVersion>
     <Version>$(SharpEmuVersion)</Version>
 
     <RepoRoot>$([MSBuild]::NormalizeDirectory('$(MSBuildThisFileDirectory)'))</RepoRoot>
 
+    <_HostRidOSPrefix Condition="'$(RuntimeIdentifier)' == '' And '$(MSBuildProjectName)' == 'SharpEmu.CLI' And $([MSBuild]::IsOSPlatform('Windows'))">win</_HostRidOSPrefix>
+    <_HostRidOSPrefix Condition="'$(RuntimeIdentifier)' == '' And '$(MSBuildProjectName)' == 'SharpEmu.CLI' And '$(_HostRidOSPrefix)' == '' And $([MSBuild]::IsOSPlatform('Linux'))">linux</_HostRidOSPrefix>
+    <_HostRidOSPrefix Condition="'$(RuntimeIdentifier)' == '' And '$(MSBuildProjectName)' == 'SharpEmu.CLI' And '$(_HostRidOSPrefix)' == '' And $([MSBuild]::IsOSPlatform('OSX'))">osx</_HostRidOSPrefix>
+    <_HostRidArch Condition="'$(_HostRidOSPrefix)' != '' And '$([System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture)' == 'Arm64'">arm64</_HostRidArch>
+    <_HostRidArch Condition="'$(_HostRidOSPrefix)' != '' And '$(_HostRidArch)' == ''">x64</_HostRidArch>
+    <RuntimeIdentifier Condition="'$(_HostRidOSPrefix)' != ''">$(_HostRidOSPrefix)-$(_HostRidArch)</RuntimeIdentifier>
+
     <BaseIntermediateOutputPath>$(RepoRoot)artifacts/obj/$(MSBuildProjectName)/</BaseIntermediateOutputPath>
     <BaseOutputPath>$(RepoRoot)artifacts/bin/</BaseOutputPath>
 

Directory.Packages.props

@@ -11,11 +11,13 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <PackageVersion Include="Avalonia.Desktop" Version="11.3.18" />
     <PackageVersion Include="Avalonia.Fonts.Inter" Version="11.3.18" />
     <PackageVersion Include="Avalonia.Themes.Fluent" Version="11.3.18" />
+    <PackageVersion Include="FFmpeg.AutoGen" Version="7.1.1" />
     <PackageVersion Include="Iced" Version="1.21.0" />
     <PackageVersion Include="Microsoft.Build.Framework" Version="17.14.8" />
     <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="3.11.0" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.12.0" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageVersion Include="NLayer" Version="1.14.0" />
     <PackageVersion Include="Silk.NET.Input" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.EXT" Version="2.23.0" />

README.md

@@ -13,14 +13,12 @@ SPDX-License-Identifier: GPL-2.0-or-later
   An experimental PlayStation 5 emulator for Windows, Linux and macOS.  
 </p>
 
-<p align="center">
-  <a href="https://discord.gg/6GejPEDqpc">
-    <img src="https://img.shields.io/badge/Discord-Join%20our%20Community-5865F2?style=for-the-badge&logo=discord&logoColor=white" alt="Join our Discord">
-  </a>
-</p>
+---
 
 <p align="center">
-  <strong>Join our Discord for development updates, compatibility discussions, support, and community chat.</strong>
+  <a href="#support">
+    <img src="https://img.shields.io/badge/Support-GitHub%20Sponsors%20%26%20Crypto-EA4AAA?style=for-the-badge&logo=githubsponsors&logoColor=white" alt="Support SharpEmu">
+  </a>
 </p>
 
 ---
@@ -136,6 +134,18 @@ Provided valuable references for filesystem handling and low-level C# implementa
 
 - [**GPL-2.0 license**](https://github.com/sharpemu/sharpemu/blob/main/LICENSE)
 
+## Support
+
+Support SharpEmu via GitHub Sponsors or cryptocurrency. Every contribution helps fund ongoing development and long-term maintenance. GitHub Sponsors is the preferred way to support the project, but cryptocurrency donations are also appreciated.
+
+### ETH/USDT
+
+`0xF315F5d986c790bB3A58DbE60F1B2760997dEd82`
+
+### BTC
+
+`bc1qmr9k8899njys5ny63xsues4jgmkk96erslrkmv`
+
 ## Contributing
 
 Before opening an issue or pull request, please read our contribution guidelines:

SharpEmu.slnx

@@ -21,6 +21,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
   <Folder Name="/tests/">
     <Project Path="tests/SharpEmu.Libs.Tests/SharpEmu.Libs.Tests.csproj" />
     <Project Path="tests/SharpEmu.ShaderCompiler.Metal.Tests/SharpEmu.ShaderCompiler.Metal.Tests.csproj" />
+    <Project Path="tests/SharpEmu.ShaderCompiler.Tests/SharpEmu.ShaderCompiler.Tests.csproj" />
     <Project Path="tests/SharpEmu.SourceGenerators.Tests/SharpEmu.SourceGenerators.Tests.csproj" />
   </Folder>
 </Solution>

docs/bink2-bridge.md

@@ -9,38 +9,67 @@ Demon's Souls plays Bink 2 (.bk2) files through a Bink implementation linked
 directly into eboot.bin. It does not use libSceVideodec, therefore an HLE video
 decoder cannot observe or replace those frames.
 
-SharpEmu observes successful guest .bk2 opens and, when a Bink bridge is
+SharpEmu observes successful guest .bk2 opens and, when a Bink decoder is
 available, presents its decoded BGRA frames at the normal guest-flip boundary.
 This preserves the game's own timing and lets the host Vulkan presenter display
 the movie without trying to execute the PS5-specific Bink GPU decode path.
 
-Without an adapter, Bink files remain visible to the guest and the game's
-statically linked decoder runs normally. Set SHARPEMU_BINK_MODE=skip only when
-explicitly testing a title whose cinematics are optional.
+The default path decodes by calling FFmpeg's own C API directly from managed
+code (`src/SharpEmu.Libs/Bink/FfmpegNativeBinkFrameSource.cs`, via the
+[FFmpeg.AutoGen](https://github.com/Ruslan-B/FFmpeg.AutoGen) P/Invoke
+bindings) against a custom FFmpeg build
+(`github.com/sharpemu/ffmpeg-core`, LGPL-2.1) that adds a Bink 2 decoder to
+FFmpeg 7.1.2; see "Supplying the FFmpeg libraries" below for where those
+libraries come from. No proprietary RAD SDK is needed to build or run
+SharpEmu, and there is no C/C++ code of SharpEmu's own involved in decoding
+-- SharpEmu.CLI.csproj only downloads a prebuilt release archive.
+
+Set `SHARPEMU_BINK_MODE=guest` to leave decoding to the Bink implementation
+statically linked into the game instead. Set `skip` only when explicitly
+testing a title whose cinematics are optional.
 
 Set SHARPEMU_BINK_MODE=dummy to retain the open and show a built-in,
 non-decoded placeholder frame. This requires no SDK, but is a visual diagnostic
-only; it does not decode the movie or alter its game logic. Set
-SHARPEMU_BINK_MODE=native to force native bridge mode.
+only; it does not decode the movie or alter its game logic.
+SHARPEMU_BINK_MODE=native is equivalent to the default and mainly useful for
+being explicit about it.
 
-## Supplying the adapter
+The experimental `SHARPEMU_BINK_MODE=ffmpeg` override is unrelated to the
+default path above: instead of calling into FFmpeg in-process, it spawns a
+standalone `ffmpeg` executable and reads raw frames from its stdout
+(`src/SharpEmu.Libs/Bink/FfmpegBinkFrameSource.cs`). SharpEmu searches
+`SHARPEMU_FFMPEG_PATH`, the executable directory, its `ffmpeg` subdirectory,
+and then `PATH` (plus a couple of common Homebrew paths on macOS). That
+`ffmpeg` build must contain a Bink 2 decoder itself; a stock FFmpeg build that
+only recognizes the Bink container is not sufficient. Most users want the
+default `native` mode instead, which always has Bink 2 support since it's
+built against `ffmpeg-core` specifically.
 
-Bink 2 is proprietary. Obtain a compatible Mac Bink 2 SDK from RAD Game Tools,
-then compile sharpemu_bink2_bridge.c against the SDK's bink.h and Mac library.
-The adapter deliberately contains only a three-function C ABI so the managed
-emulator never depends on RAD's private binary ABI.
+## Supplying the FFmpeg libraries
 
-Place the resulting libsharpemu_bink2_bridge.dylib next to the SharpEmu
-executable, or point to it explicitly:
+`dotnet publish` fetches a prebuilt release of `github.com/sharpemu/ffmpeg-core`
+(the tag is pinned in `SharpEmu.CLI.csproj`'s `FfmpegRuntimeTag`, matched to
+the `FFmpeg.AutoGen` package version in `Directory.Packages.props` -- both
+need to agree on the same FFmpeg ABI) and copies its dynamically linked
+libraries into a `plugins` folder next to the published executable. No C
+toolchain is required to build SharpEmu; publishing just downloads a zip.
+`plugins` is a loose, unpacked folder rather than something embedded in the
+single-file bundle, so the OS loader can resolve the libraries' own
+inter-dependencies (`avcodec` depends on `avutil`, etc.) itself.
 
-    SHARPEMU_BINK2_BRIDGE=/absolute/path/libsharpemu_bink2_bridge.dylib \
-      ./SharpEmu /path/to/eboot.bin
+A plain `dotnet publish` with no `-r` still works: it defaults to the host
+machine's own RID (see `Directory.Build.props`), so it fetches the matching
+`ffmpeg-core` archive and populates `plugins` without any extra flags.
+Passing an explicit `-r <rid>` (e.g. to cross-publish `linux-x64` from
+Windows) still overrides that default normally.
 
-The expected exports are sharpemu_bink2_open_utf8,
-sharpemu_bink2_decode_next_bgra, and sharpemu_bink2_close. The supplied
-adapter opens one movie, exposes BGRA pixels, and advances after each decoded
-frame. The managed side validates dimensions and retains ownership of the
-destination buffer.
+To use a different set of FFmpeg libraries, drop them into the published
+`plugins` folder yourself (matching FFmpeg's own file-naming and versioning
+conventions, e.g. `avformat-61.dll` / `libavformat.so.61` / matching
+`.dylib`) -- `FfmpegNativeBinkFrameSource` points `ffmpeg.RootPath` at that
+folder and does not otherwise care where the files came from.
 
-If the bridge is absent in native mode, SharpEmu logs one informational line
-and retains the existing guest rendering path.
+If the libraries are absent or fail to load, `FfmpegNativeBinkFrameSource.TryOpen`
+degrades gracefully: SharpEmu logs one informational line ("Bink2 bridge
+could not open movie ...") and leaves the guest's own rendering path
+untouched, rather than crashing.

native/bink2-bridge/sharpemu_bink2_bridge.c

@@ -1,66 +0,0 @@
-/*
- * Copyright (C) 2026 SharpEmu Emulator Project
- * SPDX-License-Identifier: GPL-2.0-or-later
- *
- * Build this small adapter with a licensed RAD Bink 2 SDK. The SDK and its
- * headers are not distributed by SharpEmu. See docs/bink2-bridge.md.
- */
-#include <stdint.h>
-#include "bink.h"
-
-typedef struct sharpemu_bink2_info {
-   uint32_t width;
-   uint32_t height;
-   uint32_t frames_per_second_numerator;
-   uint32_t frames_per_second_denominator;
-} sharpemu_bink2_info;
-
-int sharpemu_bink2_open_utf8(const char *path, HBINK *movie, sharpemu_bink2_info *info) {
-    HBINK bink;
-    if (!path || !movie || !info) return 0;
-
-    *movie = NULL;
-
-    bink = BinkOpen(path, 0);
-    if (!bink) return 0;
-
-    if (bink->Width == 0 || bink->Height == 0) {
-        BinkClose(bink);
-        return 0;
-    }
-
-    *movie = bink;
-    info->width = bink->Width;
-    info->height = bink->Height;
-    info->frames_per_second_numerator = bink->FrameRate;
-    info->frames_per_second_denominator = bink->FrameRateDiv;
-    return 1;
-}
-
-int sharpemu_bink2_decode_next_bgra(HBINK movie, uint8_t *destination,
-                                    uint32_t stride, uint32_t destination_bytes) {
-    uint64_t needed;
-    uint64_t min_stride;
-
-    if (!movie || !destination) return 0;
-
-    min_stride = (uint64_t)movie->Width * 4;
-    if ((uint64_t)stride < min_stride) return 0;
-
-    needed = (uint64_t)stride * movie->Height;
-    if (needed > destination_bytes) return 0;
-
-    /* Async Bink I/O has not filled the next frame yet; retry on the next host present. */
-    if (BinkWait(movie)) return 0;
-
-    if (!BinkDoFrame(movie)) return 0;
-
-    if (!BinkCopyToBuffer(movie, destination, stride, movie->Height, 0, 0, BINKSURFACE32RA)) return 0;
-
-    BinkNextFrame(movie);
-    return 1;
-}
-
-void sharpemu_bink2_close(HBINK movie) {
-   if (movie) BinkClose(movie);
-}

scripts/ps5_names.txt

@@ -153133,6 +153133,7 @@ scePsmlMfsrGetContextBufferRequirement800M3_2
 scePsmlMfsrGetDispatchMfsrPacket1000
 scePsmlMfsrGetDispatchMfsrPacket1100
 scePsmlMfsrGetDispatchMfsrPacketSizeInDwords
+scePsmlMfsrGetDispatchMfsrPacket900
 scePsmlMfsrGetMipmapBias
 scePsmlMfsrGetSharedResourcesInitRequirement
 scePsmlMfsrInit

src/SharpEmu.CLI/Program.cs

@@ -64,6 +64,7 @@ internal static partial class Program
         }
 
         args = NormalizeInternalArguments(args, out var isMitigatedChild);
+        PreloadGlfw();
 
         if (args.Length == 0)
         {
@@ -213,6 +214,27 @@ internal static partial class Program
             "as libvulkan.1.dylib.");
     }
 
+    /// <summary>
+    /// SharpEmu.CLI.csproj publishes glfw into a "plugins" subfolder rather
+    /// than flat next to the executable, which falls outside the default OS
+    /// DLL/dlopen search path. Preloading it here by full path first means
+    /// any later bare-name lookup (however Silk.NET/GLFW itself resolves the
+    /// library) finds it already loaded in the process and reuses it -- the
+    /// same technique <see cref="PreloadMacVulkanLoader"/> already relies on
+    /// for the Vulkan loader.
+    /// </summary>
+    private static void PreloadGlfw()
+    {
+        var fileName = OperatingSystem.IsWindows() ? "glfw3.dll"
+            : OperatingSystem.IsMacOS() ? "libglfw.3.dylib"
+            : "libglfw.so.3";
+        var candidate = Path.Combine(AppContext.BaseDirectory, "plugins", fileName);
+        if (File.Exists(candidate))
+        {
+            NativeLibrary.TryLoad(candidate, out _);
+        }
+    }
+
     private static int RunEmulator(string[] args, bool isMitigatedChild)
     {
         Console.Error.WriteLine($"[DEBUG] SharpEmu starting with {args.Length} args");
@@ -551,12 +573,7 @@ internal static partial class Program
             return false;
         }
 
-        var childArgs = new string[args.Length + 1];
-        childArgs[0] = MitigatedChildFlag;
-        for (var i = 0; i < args.Length; i++)
-        {
-            childArgs[i + 1] = args[i];
-        }
+        string[] childArgs = [MitigatedChildFlag, .. args];
 
         var commandLine = BuildCommandLine(processPath, childArgs);
         var startupInfoEx = new STARTUPINFOEX();

src/SharpEmu.CLI/SharpEmu.CLI.csproj

@@ -20,6 +20,11 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <!-- osx-x64 is the macOS target: the CPU backend executes guest x86-64
          natively, so on Apple Silicon it runs under Rosetta 2. -->
     <RuntimeIdentifiers>win-x64;linux-x64;osx-x64;osx-arm64</RuntimeIdentifiers>
+    <!-- A plain "dotnet publish" with no -r defaults $(RuntimeIdentifier) to
+         the host's own RID; see Directory.Build.props, which is where that
+         default actually has to live (PublishDir's RID suffix is decided
+         there, evaluated before this file, so a default set only here would
+         be too late for it). -->
     <SelfContained>true</SelfContained>
     <PublishSingleFile>true</PublishSingleFile>
     <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
@@ -60,7 +65,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
   <PropertyGroup>
     <NoWarn>$(NoWarn);1591</NoWarn>
   </PropertyGroup>
-  
+
   <ItemGroup>
     <Content Include="..\..\LICENSE.txt">
       <CopyToOutputDirectory>Always</CopyToOutputDirectory>
@@ -74,17 +79,75 @@ SPDX-License-Identifier: GPL-2.0-or-later
     </Content>
   </ItemGroup>
 
-  <!-- Keep glfw as a loose file next to the executable; every other native
+  <!-- Native libraries (glfw, FFmpeg) publish into a subfolder next to the
+       executable instead of sitting loose beside it, so the publish
+       directory stays uncluttered as more native deps get added. The folder
+       name is a fixed constant, not derived from the RID/architecture: each
+       publish output only ever holds one architecture's binaries anyway, so
+       varying the name added a class of bugs (RID resolution timing, host-OS
+       vs. target-RID mixups) for no benefit. Runtime code (Program.cs's
+       PreloadGlfw, FfmpegNativeBinkFrameSource's RootPath) uses the same
+       literal "plugins" folder name. -->
+  <PropertyGroup>
+    <NativeLibraryFolderName>plugins</NativeLibraryFolderName>
+  </PropertyGroup>
+
+  <!-- Keep glfw as a loose file in the native subfolder; every other native
        library is embedded into the single-file bundle. -->
   <Target Name="KeepGlfwOutsideSingleFile" AfterTargets="ComputeResolvedFilesToPublishList">
     <ItemGroup>
       <_GlfwPublishFiles Include="@(ResolvedFileToPublish)"
-                         Condition="$([System.String]::Copy('%(ResolvedFileToPublish.Filename)').StartsWith('glfw')) Or $([System.String]::Copy('%(ResolvedFileToPublish.Filename)').StartsWith('libglfw'))" />
+        Condition="$([System.String]::Copy('%(ResolvedFileToPublish.Filename)').StartsWith('glfw')) Or $([System.String]::Copy('%(ResolvedFileToPublish.Filename)').StartsWith('libglfw'))" />
       <ResolvedFileToPublish Remove="@(_GlfwPublishFiles)" />
       <ResolvedFileToPublish Include="@(_GlfwPublishFiles)">
         <ExcludeFromSingleFile>true</ExcludeFromSingleFile>
+        <RelativePath>$(NativeLibraryFolderName)/%(Filename)%(Extension)</RelativePath>
       </ResolvedFileToPublish>
     </ItemGroup>
   </Target>
 
+  <PropertyGroup>
+    <FfmpegRuntimeTag>2c92585</FfmpegRuntimeTag>
+    <FfmpegRuntimeDir>
+      $(BaseIntermediateOutputPath)ffmpeg-runtime/$(FfmpegRuntimeTag)/$(RuntimeIdentifier)</FfmpegRuntimeDir>
+    <FfmpegRuntimePackage Condition="'$(RuntimeIdentifier)' == 'win-x64'">ffmpeg-windows-x64.zip</FfmpegRuntimePackage>
+    <FfmpegRuntimePackage Condition="'$(RuntimeIdentifier)' == 'linux-x64'">ffmpeg-linux-x64.zip</FfmpegRuntimePackage>
+    <FfmpegRuntimePackage Condition="'$(RuntimeIdentifier)' == 'osx-x64'">ffmpeg-macos-x64.zip</FfmpegRuntimePackage>
+    <FfmpegRuntimePackage Condition="'$(RuntimeIdentifier)' == 'osx-arm64'">ffmpeg-macos-arm64.zip</FfmpegRuntimePackage>
+    <FfmpegRuntimeArchive>$(FfmpegRuntimeDir)/$(FfmpegRuntimePackage)</FfmpegRuntimeArchive>
+    <FfmpegRuntimeExtractDir>$(FfmpegRuntimeDir)/extracted</FfmpegRuntimeExtractDir>
+  </PropertyGroup>
+
+  <Target Name="FetchFfmpegRuntime"
+    BeforeTargets="Publish"
+    Condition="'$(RuntimeIdentifier)' != '' And '$(FfmpegRuntimePackage)' != ''">
+    <DownloadFile
+      SourceUrl="https://github.com/sharpemu/ffmpeg-core/releases/download/$(FfmpegRuntimeTag)/$(FfmpegRuntimePackage)"
+      DestinationFolder="$(FfmpegRuntimeDir)"
+      Condition="!Exists('$(FfmpegRuntimeArchive)')" />
+    <Unzip
+      SourceFiles="$(FfmpegRuntimeArchive)"
+      DestinationFolder="$(FfmpegRuntimeExtractDir)"
+      Condition="!Exists('$(FfmpegRuntimeExtractDir)')" />
+  </Target>
+
+  <Target Name="PublishFfmpegRuntime"
+    AfterTargets="Publish"
+    DependsOnTargets="FetchFfmpegRuntime"
+    Condition="'$(RuntimeIdentifier)' != '' And '$(FfmpegRuntimePackage)' != ''">
+    <!-- Keyed off the target $(RuntimeIdentifier), not the host OS: publishing
+         e.g. linux-x64 from a Windows machine is a supported cross-publish,
+         and the extracted archive's own layout (bin/*.dll vs lib/*.so*) only
+         depends on which platform's ffmpeg-core package was fetched. -->
+    <ItemGroup>
+      <_FfmpegRuntimeFiles Condition="$(RuntimeIdentifier.StartsWith('win'))"
+        Include="$(FfmpegRuntimeExtractDir)/bin/*.dll" />
+      <_FfmpegRuntimeFiles Condition="!$(RuntimeIdentifier.StartsWith('win'))"
+        Include="$(FfmpegRuntimeExtractDir)/lib/*.so;$(FfmpegRuntimeExtractDir)/lib/*.so.*;$(FfmpegRuntimeExtractDir)/lib/*.dylib" />
+    </ItemGroup>
+    <Copy SourceFiles="@(_FfmpegRuntimeFiles)"
+      DestinationFolder="$(PublishDir)$(NativeLibraryFolderName)"
+      SkipUnchangedFiles="true" />
+  </Target>
+
 </Project>

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Amd64Compat.cs

@@ -51,12 +51,13 @@ public sealed partial class DirectExecutionBackend
         // round-trips through the real ucontext, so it works on every supported OS. EXTRQ/
         // INSERTQ additionally read and write an XMM register: on Windows contextRecord is the
         // live CONTEXT the OS resumes the thread from, so touching the Xmm0.. slots is visible
-        // to the guest, but on POSIX contextRecord is a CONTEXT-shaped scratch buffer that the
-        // bridge only populates with the 17 general-purpose registers - the XMM region is never
-        // read from or written back to the real mcontext/ucontext. Running this on POSIX would
-        // silently compute a result from stale/zeroed XMM bytes and then discard whatever it
-        // "wrote", so keep it Windows-only, matching Kyty's own scope for the identical fix.
-        return OperatingSystem.IsWindows() && TryRecoverSse4aExtractInsert(contextRecord, rip);
+        // to the guest, and on Linux the bridge copies the mcontext's FXSAVE image into the
+        // Xmm0.. slots and writes them back through sigreturn (_posixXmmContextBridged). On
+        // Darwin the XMM area is still a zeroed scratch buffer - running this there would
+        // silently compute a result from stale bytes and then discard whatever it "wrote", so
+        // the recovery declines until that bridge exists.
+        return (OperatingSystem.IsWindows() || _posixXmmContextBridged) &&
+            TryRecoverSse4aExtractInsert(contextRecord, rip);
     }
 
     private unsafe bool TryRecoverMonitorxMwaitx(void* contextRecord, ulong rip)
@@ -97,7 +98,8 @@ public sealed partial class DirectExecutionBackend
 
     private unsafe bool TryRecoverSse4aExtractInsert(void* contextRecord, ulong rip)
     {
-        if (!OperatingSystem.IsWindows() || !TryReadFaultingInstruction(rip, out var instruction))
+        if (!OperatingSystem.IsWindows() && !_posixXmmContextBridged ||
+            !TryReadFaultingInstruction(rip, out var instruction))
         {
             return false;
         }

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Exceptions.cs

@@ -19,6 +19,9 @@ public sealed partial class DirectExecutionBackend
 	private static int _lazyCommitTraceCount;
 	private static int _guestAllocatorHoleRecoveries;
 	private static int _auxiliaryThreadExecuteFaultRecoveries;
+	private static int _auxiliaryThreadExecuteFaultSkips;
+	private nint _workerAbortStack;
+	private const uint WorkerAbortStackSize = 0x10000u;
 
 	private unsafe void SetupExceptionHandler()
 	{
@@ -52,6 +55,7 @@ public sealed partial class DirectExecutionBackend
 		}
 		_exceptionHandler = (nint)AddVectoredExceptionHandler(1u, _exceptionHandlerStub);
 		Console.Error.WriteLine($"[LOADER][INFO] Exception handler installed: 0x{_exceptionHandler:X16}");
+		SharpEmu.HLE.GuestImageWriteTracker.WarmUp();
 
 		_unhandledFilterDelegate = UnhandledExceptionFilter;
 		_unhandledFilterHandle = GCHandle.Alloc(_unhandledFilterDelegate);
@@ -114,6 +118,13 @@ public sealed partial class DirectExecutionBackend
 			{
 				return -1;
 			}
+			if (exceptionCode == 3221225477u &&
+				exceptionRecord->NumberParameters >= 2 &&
+				SharpEmu.HLE.GuestImageWriteTracker.TryHandleWriteFault(
+					exceptionRecord->ExceptionInformation[1]))
+			{
+				return -1;
+			}
 			if (TryRecoverAuxiliaryThreadExecuteFault(exceptionRecord, contextRecord, rip))
 			{
 				return -1;
@@ -435,18 +446,91 @@ public sealed partial class DirectExecutionBackend
 		void* contextRecord,
 		ulong rip)
 	{
-		if (exceptionRecord->ExceptionCode != 3221225477u ||
-			rip >= 0x0000000800000000UL ||
-			_activeGuestThreadState is not { Name: "tbb_thead" } activeThread)
+		if (exceptionRecord->ExceptionCode != 3221225477u)
 		{
 			return false;
 		}
 
+		// Prefer ThreadStatic active state; fall back to host-thread name when
+		// concurrent TBB AVs race logging (tLT61: recover skipped, then Fatal).
+		GuestThreadState? activeThread = _activeGuestThreadState;
+		if (activeThread is null || activeThread.Name != "tbb_thead")
+		{
+			var hostName = Thread.CurrentThread.Name;
+			if (hostName is null ||
+				!hostName.StartsWith("SharpEmu-tbb_thead", StringComparison.Ordinal))
+			{
+				return false;
+			}
+
+			activeThread = FindGuestThreadStateByHostThreadId(unchecked((int)GetCurrentThreadId()));
+			if (activeThread is null || activeThread.Name != "tbb_thead")
+			{
+				var skip = Interlocked.Increment(ref _auxiliaryThreadExecuteFaultSkips);
+				if (skip <= 8 || skip % 64 == 0)
+				{
+					Console.Error.WriteLine(
+						$"[LOADER][WARN] tbb_recover skip #{skip}: rip=0x{rip:X16} " +
+						$"host='{hostName}' active={(activeThread?.Name ?? "null")}");
+					Console.Error.Flush();
+				}
+				return false;
+			}
+		}
+
 		var hostExit = ActiveEntryReturnSentinelRip;
 		if (hostExit < 0x10000)
 		{
 			hostExit = unchecked((ulong)_guestReturnStub);
 		}
+
+			// Prefer worker-abort (SetEvent + ExitThread) over host_exit→RunEpilogue:
+		// the latter FailFasts the process after TBB recover (tLT28/30 silent die).
+		// Do NOT abandon mutexes here — managed HLE from inside VEH can re-enter
+		// and Fatal (tLT73). NativeGuestExecutor.Run abandons after detecting abort.
+		var abortRip = unchecked((ulong)_workerAbortStub);
+		if (abortRip >= 0x10000)
+		{
+			// Do NOT SetEvent from managed VEH: that wakes the renter which may
+			// TerminateThread while this thread is still inside VEH return
+			// (tLTA2: recover logged, no respawning, process die). Abort stub
+			// SetEvent's only after CONTINUE_EXECUTION resumes at park.
+
+			// Prefer the entry-stub-saved host RSP (real CreateThread stack).
+			// Do not treat mid-range host stacks as guest — Astro worker stacks
+			// often sit in 0x02xxxxxx_xxxx and were wrongly replaced with a
+			// shared VirtualAlloc abort stack (concurrent TBB AV → die).
+			var hostRspSlot = TlsGetValue(_hostRspSlotTlsIndex);
+			ulong hostRsp = 0;
+			if (hostRspSlot != 0)
+			{
+				hostRsp = *(ulong*)hostRspSlot;
+			}
+
+			if (hostRsp < 0x10000)
+			{
+				hostRsp = EnsureWorkerAbortStackRsp();
+			}
+
+			if (hostRsp >= 0x10000)
+			{
+				WriteCtxU64(contextRecord, 152, hostRsp & ~0xFUL);
+			}
+
+			WriteCtxU64(contextRecord, 120, 0);
+			WriteCtxU64(contextRecord, 248, abortRip);
+			var recovery = Interlocked.Increment(ref _auxiliaryThreadExecuteFaultRecoveries);
+			Console.Error.WriteLine(
+				$"[LOADER][WARN] Recovered auxiliary TBB execute fault #{recovery}: " +
+				$"thread=0x{activeThread.ThreadHandle:X16} target=0x{rip:X16} " +
+				$"host_rsp=0x{hostRsp:X16} -> worker_abort=0x{abortRip:X16}");
+			Console.Error.WriteLine(
+				"[LOADER][INFO] tbb_recover: parking native worker (SetEvent+park); " +
+				"renter will TerminateThread+respawn — avoids ExitThread after VEH");
+			Console.Error.Flush();
+			return true;
+		}
+
 		if (hostExit < 0x10000)
 		{
 			Console.Error.WriteLine(
@@ -458,13 +542,57 @@ public sealed partial class DirectExecutionBackend
 		_ = TryPatchActiveGuestReturnSlot(hostExit);
 		WriteCtxU64(contextRecord, 120, 0);
 		WriteCtxU64(contextRecord, 248, hostExit);
-		var recovery = Interlocked.Increment(ref _auxiliaryThreadExecuteFaultRecoveries);
+		var recoveryFallback = Interlocked.Increment(ref _auxiliaryThreadExecuteFaultRecoveries);
 		Console.Error.WriteLine(
-			$"[LOADER][WARN] Recovered auxiliary TBB execute fault #{recovery}: " +
+			$"[LOADER][WARN] Recovered auxiliary TBB execute fault #{recoveryFallback}: " +
 			$"thread=0x{activeThread.ThreadHandle:X16} target=0x{rip:X16} -> host_exit=0x{hostExit:X16}");
+		Console.Error.WriteLine(
+			"[LOADER][INFO] tbb_recover: resumed at host_exit (abort stub unavailable); " +
+			"subsequent FastFail/CLR must not re-enter managed VEH " +
+			"(live trampoline pre-filters 0xC0000409 / 0xE0434352)");
+		Console.Error.Flush();
 		return true;
 	}
 
+	private GuestThreadState? FindGuestThreadStateByHostThreadId(int hostThreadId)
+	{
+		if (hostThreadId == 0)
+		{
+			return null;
+		}
+
+		try
+		{
+			foreach (var thread in SnapshotGuestThreads())
+			{
+				if (Volatile.Read(ref thread.HostThreadId) == hostThreadId)
+				{
+					return thread;
+				}
+			}
+		}
+		catch
+		{
+		}
+
+		return null;
+	}
+
+	private unsafe ulong EnsureWorkerAbortStackRsp()
+	{
+		if (_workerAbortStack == 0)
+		{
+			_workerAbortStack = (nint)VirtualAlloc(null, WorkerAbortStackSize, 12288u, 4u);
+			if (_workerAbortStack == 0)
+			{
+				return 0;
+			}
+		}
+
+		// Grow-down stack: hand out near the top with alignment headroom.
+		return (ulong)(_workerAbortStack + (nint)WorkerAbortStackSize - 0x100) & ~0xFUL;
+	}
+
 	private unsafe bool TryRecoverGuestInt41(uint exceptionCode, void* contextRecord, ulong rip)
 	{
 		if (!_ignoreGuestInt41 || exceptionCode != 3221225477u || rip < 0x10000)
@@ -483,7 +611,7 @@ public sealed partial class DirectExecutionBackend
 		if (count <= 16 || count % 65536 == 0)
 		{
 			Console.Error.WriteLine(
-				$"[LOADER][WARN] Ignored guest int 0x41 trap #{count} at 0x{rip:X16} (SHARPEMU_IGNORE_INT41=1)");
+				$"[LOADER][WARN] Ignored guest int 0x41 trap #{count} at 0x{rip:X16} (default-on; set SHARPEMU_IGNORE_INT41=0 to disable)");
 			Console.Error.Flush();
 		}
 		return true;

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Imports.cs

@@ -69,6 +69,15 @@ public sealed partial class DirectExecutionBackend
 
 	private unsafe static int RawVectoredHandlerManaged(void* exceptionInfo)
 	{
+		EXCEPTION_RECORD* exceptionRecord = ((EXCEPTION_POINTERS*)exceptionInfo)->ExceptionRecord;
+		if (exceptionRecord->ExceptionCode == 3221225477u &&
+			exceptionRecord->NumberParameters >= 2 &&
+			SharpEmu.HLE.GuestImageWriteTracker.TryHandleWriteFault(
+				exceptionRecord->ExceptionInformation[1]))
+		{
+			return -1;
+		}
+
 		return TryRecoverUnresolvedSentinel(exceptionInfo);
 	}
 
@@ -1404,11 +1413,13 @@ public sealed partial class DirectExecutionBackend
 			"vWU-odnS+fU" or // sceAmprMeasureCommandSizeReadFile
 			"sSAUCCU1dv4" or // sceAmprMeasureCommandSizeWriteKernelEventQueue_04_00
 			"C+IEj+BsAFM" or // sceAmprMeasureCommandSizeWriteAddressOnCompletion
+            "4fgtGfXDrFc" or // sceAmprMeasureCommandSizeWriteAddress_04_00
 			"tZDDEo2tE5k" or // sceAmprCommandBufferGetSize
 			"GnxKOHEawhk" or // sceAmprCommandBufferGetCurrentOffset
 			"gzndltBEzWc" or // sceAmprCommandBufferGetNumCommands
 			"H896Pt-yB4I" or // sceAmprCommandBufferWriteKernelEventQueue_04_00
 			"sJXyWHjP-F8" or // sceAmprCommandBufferWriteAddressOnCompletion
+            "j0+3uJMxYJY" or // sceAmprCommandBufferWriteAddress_04_00
 			"mPpPxv5CZt4" or // sceSystemServiceGetHdrToneMapLuminance
 			"1FZBKy8HeNU" or // sceVideoOutGetVblankStatus
 			"ASoW5WE-UPo" or // sceKernelAprSubmitCommandBufferAndGetResult
@@ -1447,6 +1458,9 @@ public sealed partial class DirectExecutionBackend
 		var expectedSemaphoreTrywaitAgain =
 			string.Equals(nid, "H2a+IN9TP0E", StringComparison.Ordinal) &&
 			result == OrbisGen2Result.ORBIS_GEN2_ERROR_TRY_AGAIN;
+		var expectedPollSemaBusy =
+			string.Equals(nid, "12wOHk8ywb0", StringComparison.Ordinal) &&
+			result == OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY;
 		var expectedNetAcceptWouldBlock =
 			string.Equals(nid, "PIWqhn9oSxc", StringComparison.Ordinal) &&
 			resultValue == unchecked((int)0x80410123);
@@ -1461,6 +1475,7 @@ public sealed partial class DirectExecutionBackend
 			!expectedEqueueTimeout &&
 			!expectedMutexTrylockBusy &&
 			!expectedSemaphoreTrywaitAgain &&
+			!expectedPollSemaBusy &&
 			!expectedNetAcceptWouldBlock &&
 			!expectedUserServiceNoEvent &&
 			!expectedPrivacyInvalidParameter)
@@ -1554,11 +1569,13 @@ public sealed partial class DirectExecutionBackend
 			"vWU-odnS+fU" or
 			"sSAUCCU1dv4" or
 			"C+IEj+BsAFM" or
+            "4fgtGfXDrFc" or
 			"tZDDEo2tE5k" or
 			"GnxKOHEawhk" or
 			"gzndltBEzWc" or
 			"H896Pt-yB4I" or
 			"sJXyWHjP-F8" or
+            "j0+3uJMxYJY" or
 			"mPpPxv5CZt4" or
 			"1FZBKy8HeNU" or
 			"ASoW5WE-UPo" or

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.NativeWorker.cs

@@ -29,9 +29,29 @@ public sealed partial class DirectExecutionBackend
 	private static readonly bool NativeGuestWorkersDisabled =
 		string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_NATIVE_GUEST_WORKERS"), "1", StringComparison.Ordinal);
 
+	// Cap concurrent native-worker Runs. Astro's tbb_thead burst overlaps many
+	// UnmanagedCallersOnly prologues; a large prewarm + unbounded concurrency
+	// FailFasts (0xC0000409) mid-storm with no VEH breadcrumb. Pool size and
+	// in-flight Runs are separate knobs.
+	private static readonly int NativeWorkerMaxConcurrent = ReadNativeWorkerMaxConcurrent();
+
+	private static int ReadNativeWorkerMaxConcurrent()
+	{
+		if (int.TryParse(
+			    Environment.GetEnvironmentVariable("SHARPEMU_NATIVE_WORKER_MAX_CONCURRENT"),
+			    out var parsed) &&
+		    parsed > 0)
+		{
+			return Math.Clamp(parsed, 1, 64);
+		}
+
+		return 2;
+	}
+
 	private readonly object _nativeWorkerGate = new();
 	private readonly List<NativeGuestExecutor> _allNativeWorkers = new();
 	private readonly Stack<NativeGuestExecutor> _idleNativeWorkers = new();
+	private readonly SemaphoreSlim _nativeWorkerRunLimiter = new(NativeWorkerMaxConcurrent);
 	private bool _nativeWorkersDisposed;
 	private int _nativeWorkerCreationFailedLogged;
 
@@ -49,6 +69,9 @@ public sealed partial class DirectExecutionBackend
 	[DllImport("kernel32.dll", SetLastError = true)]
 	private static extern uint WaitForSingleObject(nint hHandle, uint dwMilliseconds);
 
+	[DllImport("kernel32.dll", SetLastError = true)]
+	private static extern bool TerminateThread(nint hThread, uint dwExitCode);
+
 	// Runs an emitted guest entry stub. Preferred path is a pooled native worker
 	// thread; falls back to the historical inline calli (guest frames above this
 	// thread's managed frames) when workers are disabled or unavailable.
@@ -56,40 +79,148 @@ public sealed partial class DirectExecutionBackend
 	// Callers set the Active* thread-statics before emitting the stub and read the
 	// yield/forced-exit flags right after this returns, so the worker outcome is
 	// copied back into this thread's statics before returning.
-	private unsafe int RunGuestEntryStub(void* entryStub, ulong hostRspSlot)
+	private unsafe int RunGuestEntryStub(void* entryStub, ulong hostRspSlot, bool requireNativeWorker = false)
 	{
-		var worker = RentNativeGuestExecutor();
-		if (worker is null)
-		{
-			TlsSetValue(_hostRspSlotTlsIndex, (nint)hostRspSlot);
-			return CallNativeEntry(entryStub);
-		}
+		// Limit in-flight native Runs before renting so the idle pool is not
+		// drained by threads blocked on the concurrency gate.
+		_nativeWorkerRunLimiter.Wait();
+		NativeGuestExecutor? worker = null;
 		try
 		{
-			var state = _activeGuestThreadState;
-			var nativeReturn = worker.Run(
-				_activeCpuContext!,
-				state,
-				GuestThreadExecution.CurrentGuestThreadHandle,
-				_activeEntryReturnSentinelRip,
-				_activeGuestReturnSlotAddress,
-				(nint)hostRspSlot,
-				(nint)entryStub,
-				state?.AffinityMask ?? 0,
-				out var yieldRequested,
-				out var yieldReason,
-				out var forcedExit);
-			_activeGuestThreadYieldRequested = yieldRequested;
-			_activeGuestThreadYieldReason = yieldReason;
-			_activeForcedGuestExit = forcedExit;
-			return nativeReturn;
+			// Astro can spawn a burst of tbb_thead while workers are still in
+			// TerminateThread+respawn. Wait for a native worker — never fall back
+			// to managed inline (FailFast) and never throw (uncaught throw mid-
+			// storm was a silent process die).
+			var maxAttempts = requireNativeWorker ? 500 : 48;
+			for (var attempt = 0; attempt < maxAttempts; attempt++)
+			{
+				worker = RentNativeGuestExecutor();
+				if (worker is not null)
+				{
+					break;
+				}
+
+				if (!requireNativeWorker)
+				{
+					break;
+				}
+
+				Thread.Sleep(attempt < 32 ? 1 : 4);
+			}
+
+			if (worker is null)
+			{
+				if (requireNativeWorker)
+				{
+					var n = Interlocked.Increment(ref _tbbNativeWorkerRefuseCount);
+					if (n <= 8 || n % 32 == 0)
+					{
+						Console.Error.WriteLine(
+							$"[LOADER][ERROR] tbb_native_worker unavailable #{n} after {maxAttempts} attempts; " +
+							"skipping run (no managed inline, no throw)");
+						Console.Error.Flush();
+					}
+
+					_activeGuestThreadYieldRequested = true;
+					_activeGuestThreadYieldReason = "tbb_native_worker_unavailable";
+					_activeForcedGuestExit = true;
+					return unchecked((int)0x80020012);
+				}
+
+				TlsSetValue(_hostRspSlotTlsIndex, (nint)hostRspSlot);
+				return CallNativeEntry(entryStub);
+			}
+
+			try
+			{
+				var state = _activeGuestThreadState;
+				if (state is { Name: "tbb_thead" })
+				{
+					var n = Interlocked.Increment(ref _tbbNativeRunEnterCount);
+					if (n <= 12 || n % 64 == 0)
+					{
+						Console.Error.WriteLine(
+							$"[LOADER][INFO] tbb_run_enter #{n} native_tid_pending handle=0x{state.ThreadHandle:X16} " +
+							$"max_concurrent={NativeWorkerMaxConcurrent}");
+						Console.Error.Flush();
+					}
+				}
+
+				var nativeReturn = worker.Run(
+					_activeCpuContext!,
+					state,
+					GuestThreadExecution.CurrentGuestThreadHandle,
+					_activeEntryReturnSentinelRip,
+					_activeGuestReturnSlotAddress,
+					(nint)hostRspSlot,
+					(nint)entryStub,
+					state?.AffinityMask ?? 0,
+					out var yieldRequested,
+					out var yieldReason,
+					out var forcedExit);
+				_activeGuestThreadYieldRequested = yieldRequested;
+				_activeGuestThreadYieldReason = yieldReason;
+				_activeForcedGuestExit = forcedExit;
+				return nativeReturn;
+			}
+			finally
+			{
+				ReturnNativeGuestExecutor(worker);
+			}
 		}
 		finally
 		{
-			ReturnNativeGuestExecutor(worker);
+			_nativeWorkerRunLimiter.Release();
 		}
 	}
 
+	private static int _tbbNativeRunEnterCount;
+	private static int _tbbNativeWorkerRefuseCount;
+	internal static int _tbbWorkerPrologueFaultCount;
+
+	private void PrewarmNativeGuestWorkers(int count)
+	{
+		if (!OperatingSystem.IsWindows() || NativeGuestWorkersDisabled || count <= 0)
+		{
+			return;
+		}
+
+		var warmed = new List<NativeGuestExecutor>(count);
+		for (var i = 0; i < count; i++)
+		{
+			var worker = NativeGuestExecutor.TryCreate(this);
+			if (worker is null)
+			{
+				break;
+			}
+
+			warmed.Add(worker);
+		}
+
+		lock (_nativeWorkerGate)
+		{
+			if (_nativeWorkersDisposed)
+			{
+				foreach (var worker in warmed)
+				{
+					worker.Dispose();
+				}
+				return;
+			}
+
+			foreach (var worker in warmed)
+			{
+				_allNativeWorkers.Add(worker);
+				_idleNativeWorkers.Push(worker);
+			}
+		}
+
+		Console.Error.WriteLine(
+			$"[LOADER][INFO] Native guest workers prewarmed: {warmed.Count}/{count} " +
+			$"max_concurrent={NativeWorkerMaxConcurrent}");
+		Console.Error.Flush();
+	}
+
 	private NativeGuestExecutor? RentNativeGuestExecutor()
 	{
 		// NativeGuestExecutor emits a Win32 wait loop and creates it with
@@ -400,6 +531,22 @@ public sealed partial class DirectExecutionBackend
 				return false;
 			}
 			FlushInstructionCache(GetCurrentProcess(), _loopStub, LoopStubSize);
+			return StartWorkerThread();
+		}
+
+		private bool RestartWorkerThread()
+		{
+			if (_loopStub == null || _controlBlock == null)
+			{
+				return false;
+			}
+
+			*(int*)_controlBlock = 0;
+			return StartWorkerThread();
+		}
+
+		private bool StartWorkerThread()
+		{
 			_threadHandle = CreateThread(
 				0,
 				WorkerStackReservation,
@@ -445,6 +592,49 @@ public sealed partial class DirectExecutionBackend
 			_runForcedExit = false;
 			SignalWorkAvailable();
 			WaitWorkCompleted();
+
+			// Normal path: RunEpilogue/ExitRun clears _entered before SetEvent(done).
+			// TBB abort stub SetEvent's without ExitRun — _entered stays true.
+			if (_entered)
+			{
+				var waitRc = WaitForSingleObject(_threadHandle, 500u);
+				Console.Error.WriteLine(
+					$"[LOADER][WARN] Native guest worker tid={_nativeThreadId} aborted during run; " +
+					$"wait_rc=0x{waitRc:X8} respawning");
+				Console.Error.Flush();
+				if (_runState is { } abortedState)
+				{
+					_ = GuestThreadExecution.NotifyGuestThreadAbandoned(
+						abortedState.ThreadHandle,
+						"tbb_worker_abort");
+					Volatile.Write(ref abortedState.HostThreadId, _prevHostThreadId);
+				}
+				_entered = false;
+				if (_threadHandle != 0)
+				{
+					// Abort stub parks (no ExitThread). Force-kill the parked OS
+					// thread so we can recreate the loop without process teardown.
+					if (waitRc != 0u)
+					{
+						_ = TerminateThread(_threadHandle, unchecked((uint)(-1)));
+						_ = WaitForSingleObject(_threadHandle, 1000u);
+					}
+					CloseHandle(_threadHandle);
+					_threadHandle = 0;
+					_nativeThreadId = 0;
+				}
+				if (!RestartWorkerThread())
+				{
+					_runPrologueFailed = true;
+				}
+				else
+				{
+					_runPrologueFailed = false;
+					_runForcedExit = true;
+					_runNativeResult = 0;
+				}
+			}
+
 			_runContext = null;
 			_runState = null;
 			yieldRequested = _runYieldRequested;
@@ -452,7 +642,22 @@ public sealed partial class DirectExecutionBackend
 			forcedExit = _runForcedExit;
 			if (_runPrologueFailed)
 			{
-				throw new InvalidOperationException("Native guest worker failed to bind the run ambient (prologue fault)");
+				// Never throw out of the native-worker rent path: an uncaught
+				// exception mid-TBB storm kills the process with no FailFast
+				// breadcrumb.
+				var n = Interlocked.Increment(ref _tbbWorkerPrologueFaultCount);
+				if (n <= 8 || n % 32 == 0)
+				{
+					Console.Error.WriteLine(
+						$"[LOADER][ERROR] tbb_worker prologue fault #{n}; soft-fail run " +
+						$"(tid={_nativeThreadId})");
+					Console.Error.Flush();
+				}
+
+				yieldRequested = true;
+				yieldReason = "tbb_worker_prologue_fault";
+				forcedExit = true;
+				return unchecked((int)0x80020012);
 			}
 			return _runNativeResult;
 		}
@@ -546,6 +751,18 @@ public sealed partial class DirectExecutionBackend
 			_activeGuestThreadState = _runState;
 			backend.BindTlsBase(_runContext!);
 			TlsSetValue(backend._hostRspSlotTlsIndex, _runHostRspSlot);
+			if (backend._workerDoneEventTlsIndex != uint.MaxValue)
+			{
+				nint doneHandle = OperatingSystem.IsWindows()
+					? _workCompleted!.SafeWaitHandle.DangerousGetHandle()
+					: _doneSemaphore;
+				TlsSetValue(backend._workerDoneEventTlsIndex, doneHandle);
+			}
+			if (backend._tbbAbortEligibleTlsIndex != uint.MaxValue)
+			{
+				nint eligible = _runState is { Name: "tbb_thead" } ? 1 : 0;
+				TlsSetValue(backend._tbbAbortEligibleTlsIndex, eligible);
+			}
 			if (_runState is { } state)
 			{
 				_prevHostThreadId = Volatile.Read(ref state.HostThreadId);
@@ -580,6 +797,14 @@ public sealed partial class DirectExecutionBackend
 				Volatile.Write(ref state.HostThreadId, _prevHostThreadId);
 			}
 			TlsSetValue(_backend._hostRspSlotTlsIndex, _prevHostRspSlot);
+			if (_backend._workerDoneEventTlsIndex != uint.MaxValue)
+			{
+				TlsSetValue(_backend._workerDoneEventTlsIndex, 0);
+			}
+			if (_backend._tbbAbortEligibleTlsIndex != uint.MaxValue)
+			{
+				TlsSetValue(_backend._tbbAbortEligibleTlsIndex, 0);
+			}
 			GuestThreadExecution.RestoreGuestThread(_prevGuestThreadHandle);
 			_activeExecutionBackend = _prevBackend;
 			_activeCpuContext = _prevContext;

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.PosixSignals.cs

@@ -50,6 +50,19 @@ public sealed unsafe partial class DirectExecutionBackend
 	private const int LinuxUcontextGregsOffset = 40;
 	private const int LinuxGregsErrOffset = 19 * 8;
 
+	// The kernel's x86-64 sigcontext places the FXSAVE-image pointer right
+	// after the general registers it hands to the handler: err(152)
+	// trapno(160) oldmask(168) cr2(176) fpstate(184), all relative to
+	// GetPosixRegisterBase. glibc and musl both overlay this kernel layout
+	// verbatim (glibc's mcontext_t.fpregs is the same slot), so the offset
+	// is libc-independent. Inside the FXSAVE image the XMM registers start
+	// at +160 (32-byte header + 8 legacy x87/MMX slots x 16 bytes) - the
+	// same relative position they occupy in the Win64 CONTEXT's FltSave
+	// area (Win64ContextXmm0Offset = 256 + 160).
+	private const int LinuxGregsFpstateOffset = 184;
+	private const int FxsaveXmmOffset = 160;
+	private const int XmmBlockSize = 16 * 16;
+
 	// Byte offsets of the general registers relative to GetPosixRegisterBase,
 	// ordered to match the contiguous Win64 CONTEXT block CTX_RAX..CTX_RIP
 	// (rax, rcx, rdx, rbx, rsp, rbp, rsi, rdi, r8..r15, rip). Verified
@@ -71,6 +84,15 @@ public sealed unsafe partial class DirectExecutionBackend
 	[ThreadStatic]
 	private static int _posixSignalHandlerDepth;
 
+	// True while the current thread's in-flight POSIX fault carries the real
+	// XMM registers in the CONTEXT scratch buffer and writes to them will
+	// reach the mcontext on resume. Gates recovery paths (SSE4a EXTRQ/
+	// INSERTQ) that would otherwise compute results from a zeroed XMM area
+	// and silently discard what they "wrote". Darwin is not bridged yet, so
+	// the flag stays false there.
+	[ThreadStatic]
+	private static bool _posixXmmContextBridged;
+
 	private void SetupPosixExceptionHandler()
 	{
 		if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_POSIX_SIGNALS"), "1", StringComparison.Ordinal))
@@ -252,6 +274,26 @@ public sealed unsafe partial class DirectExecutionBackend
 			WriteCtxU64(contextRecord, CTX_RAX + i * 8, *(ulong*)(registers + offsets[i]));
 		}
 
+		// Bridge the XMM registers alongside the GPRs where the layout is
+		// known: on Linux the fpstate pointer and FXSAVE image are kernel
+		// ABI, so recovery paths that read or write XMM state (SSE4a
+		// EXTRQ/INSERTQ) see the live registers and their writes reach the
+		// guest through sigreturn.
+		byte* fpstate = null;
+		if (OperatingSystem.IsLinux())
+		{
+			fpstate = *(byte**)(registers + LinuxGregsFpstateOffset);
+			if (fpstate != null)
+			{
+				Buffer.MemoryCopy(
+					fpstate + FxsaveXmmOffset,
+					contextRecord + Win64ContextXmm0Offset,
+					XmmBlockSize,
+					XmmBlockSize);
+			}
+		}
+		_posixXmmContextBridged = fpstate != null;
+
 		EXCEPTION_RECORD record = default;
 		record.ExceptionAddress = (void*)ReadCtxU64(contextRecord, CTX_RIP);
 		if (signal == PosixSigIll)
@@ -317,6 +359,14 @@ public sealed unsafe partial class DirectExecutionBackend
 		{
 			*(ulong*)(registers + offsets[i]) = ReadCtxU64(contextRecord, CTX_RAX + i * 8);
 		}
+		if (fpstate != null)
+		{
+			Buffer.MemoryCopy(
+				contextRecord + Win64ContextXmm0Offset,
+				fpstate + FxsaveXmmOffset,
+				XmmBlockSize,
+				XmmBlockSize);
+		}
 		return true;
 	}
 

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.cs

@@ -13,6 +13,7 @@ using SharpEmu.Core.Cpu.Debugging;
 using SharpEmu.Core.Loader;
 using SharpEmu.Core.Memory;
 using SharpEmu.HLE;
+using SharpEmu.Libs.Diagnostics;
 
 namespace SharpEmu.Core.Cpu.Native;
 
@@ -214,6 +215,15 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 	private nint _guestReturnStub;
 
+	private nint _workerAbortStub;
+	private nint _vehManagedEntryLock;
+
+	private uint _workerDoneEventTlsIndex = uint.MaxValue;
+
+	private uint _tbbAbortEligibleTlsIndex = uint.MaxValue;
+
+	private nint _setEventAddress;
+
 	private nint _rawExceptionHandler;
 
 	private nint _rawExceptionHandlerStub;
@@ -1041,6 +1051,8 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		_selfHandlePtr = GCHandle.ToIntPtr(_selfHandle);
 		_guestTlsBaseTlsIndex = TlsAlloc();
 		_hostRspSlotTlsIndex = TlsAlloc();
+		_workerDoneEventTlsIndex = OperatingSystem.IsWindows() ? TlsAlloc() : uint.MaxValue;
+		_tbbAbortEligibleTlsIndex = OperatingSystem.IsWindows() ? TlsAlloc() : uint.MaxValue;
 		if (_guestTlsBaseTlsIndex == uint.MaxValue || _hostRspSlotTlsIndex == uint.MaxValue)
 		{
 			throw new OutOfMemoryException("Failed to allocate native TLS slots");
@@ -1064,6 +1076,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			{
 				throw new InvalidOperationException("Failed to resolve kernel32 thread timing functions");
 			}
+			_setEventAddress = kernel32 != 0 ? GetProcAddress(kernel32, "SetEvent") : 0;
 		}
 		else
 		{
@@ -1087,13 +1100,29 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		{
 			throw new OutOfMemoryException("Failed to allocate host stack slot storage");
 		}
+		_vehManagedEntryLock = (nint)VirtualAlloc(null, 64u, 12288u, 4u);
+		if (_vehManagedEntryLock == 0)
+		{
+			throw new OutOfMemoryException("Failed to allocate VEH managed-entry lock");
+		}
+		// owner (nint) + depth (int); recursive — nested VEH on same thread must reenter.
+		*(nint*)_vehManagedEntryLock = 0;
+		*(int*)(_vehManagedEntryLock + sizeof(nint)) = 0;
 		_unresolvedReturnStub = CreateUnresolvedReturnStub();
 		_guestReturnStub = CreateGuestReturnStub();
 		if (_guestReturnStub == 0)
 		{
 			throw new OutOfMemoryException("Failed to allocate guest return stub");
 		}
+		_workerAbortStub = CreateWorkerAbortStub();
+		if (_workerAbortStub == 0 && OperatingSystem.IsWindows())
+		{
+			Console.Error.WriteLine(
+				"[LOADER][WARN] Worker abort stub unavailable; TBB execute-fault recover will use host_exit");
+		}
 		SetupExceptionHandler();
+		// Cover the Astro TBB spawn storm (often 8–12 concurrent tbb_thead).
+		PrewarmNativeGuestWorkers(Math.Max(NativeWorkerMaxConcurrent, 4));
 	}
 
 	public bool TryExecute(CpuContext context, ulong entryPoint, Generation generation, IReadOnlyDictionary<ulong, string> importStubs, IReadOnlyDictionary<string, ulong> runtimeSymbols, CpuExecutionOptions executionOptions, out OrbisGen2Result result)
@@ -1123,7 +1152,9 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		_logStrlenBursts = _logStrlenImports ||
 			string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_STRLEN_BURSTS"), "1", StringComparison.Ordinal);
 		_logGuestContext = string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_CONTEXT"), "1", StringComparison.Ordinal);
-		_ignoreGuestInt41 = string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_IGNORE_INT41"), "1", StringComparison.Ordinal);
+		var ignoreGuestInt41Env = Environment.GetEnvironmentVariable("SHARPEMU_IGNORE_INT41");
+		_ignoreGuestInt41 = !string.Equals(ignoreGuestInt41Env, "0", StringComparison.Ordinal) &&
+			!string.Equals(ignoreGuestInt41Env, "false", StringComparison.OrdinalIgnoreCase);
 		_ignoredGuestInt41Count = 0;
 		_logGuestThreads = string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_GUEST_THREADS"), "1", StringComparison.Ordinal);
 		_logUsleep = string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_USLEEP"), "1", StringComparison.Ordinal);
@@ -2407,9 +2438,147 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		return (nint)ptr;
 	}
 
+	/// <summary>
+	/// After a TBB execute-fault, VEH redirects here on a host stack.
+	/// SetEvent(done) then park forever — ExitThread from VEH CONTINUE_EXECUTION
+	/// was taking down the whole process (recover logged, no respawning). The
+	/// renter TerminateThread's the parked worker and respawns a clean loop.
+	/// </summary>
+	private unsafe nint CreateWorkerAbortStub()
+	{
+		if (!OperatingSystem.IsWindows() ||
+			_workerDoneEventTlsIndex == uint.MaxValue ||
+			_tlsGetValueAddress == 0 ||
+			_setEventAddress == 0)
+		{
+			return 0;
+		}
+
+		nint kernel32 = GetModuleHandle("kernel32.dll");
+		nint getStdHandle = kernel32 != 0 ? GetProcAddress(kernel32, "GetStdHandle") : 0;
+		nint writeFile = kernel32 != 0 ? GetProcAddress(kernel32, "WriteFile") : 0;
+		nint flushFileBuffers = kernel32 != 0 ? GetProcAddress(kernel32, "FlushFileBuffers") : 0;
+
+		const uint stubSize = 256u;
+		void* ptr = VirtualAlloc(null, stubSize, 12288u, 4u);
+		if (ptr == null)
+		{
+			return 0;
+		}
+
+		byte* code = (byte*)ptr;
+		int offset = 0;
+		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+		EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28); // sub rsp, 0x28
+		EmitByte(code, ref offset, 0xB9);
+		EmitUInt32(code, ref offset, _workerDoneEventTlsIndex); // mov ecx, tls
+		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+		*(nint*)(code + offset) = _tlsGetValueAddress;
+		offset += sizeof(nint);
+		EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0); // call TlsGetValue
+		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x85);
+		EmitByte(code, ref offset, 0xC0); // test rax, rax
+		EmitByte(code, ref offset, 0x74); EmitByte(code, ref offset, 0x0F); // jz skip SetEvent (15 bytes)
+		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89);
+		EmitByte(code, ref offset, 0xC1); // mov rcx, rax
+		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+		*(nint*)(code + offset) = _setEventAddress;
+		offset += sizeof(nint);
+		EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0); // call SetEvent
+
+		// Breadcrumb on host stack (survives silent teardown better than managed log).
+		int msgAbsSlot = -1;
+		if (getStdHandle != 0 && writeFile != 0)
+		{
+			ReadOnlySpan<byte> msg = "[LOADER][WARN] tbb_abort_stub SetEvent+park\n"u8;
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+			EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x20); // extra shadow for WriteFile args
+			EmitByte(code, ref offset, 0xB9); EmitUInt32(code, ref offset, unchecked((uint)-12));
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+			*(nint*)(code + offset) = getStdHandle;
+			offset += sizeof(nint);
+			EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89);
+			EmitByte(code, ref offset, 0xC1); // mov rcx, handle
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89);
+			EmitByte(code, ref offset, 0xC3); // mov rbx, handle (nonvolatile for flush)
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+			msgAbsSlot = offset;
+			*(nint*)(code + offset) = 0;
+			offset += sizeof(nint);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89);
+			EmitByte(code, ref offset, 0xC2); // mov rdx, msg
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xB8);
+			EmitUInt32(code, ref offset, (uint)msg.Length);
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8D);
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x20); // lea r9, [rsp+0x20]
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
+			EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x20); EmitUInt32(code, ref offset, 0);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
+			EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x28); EmitUInt32(code, ref offset, 0);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+			*(nint*)(code + offset) = writeFile;
+			offset += sizeof(nint);
+			EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+			if (flushFileBuffers != 0)
+			{
+				EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89);
+				EmitByte(code, ref offset, 0xD9); // mov rcx, rbx
+				EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+				*(nint*)(code + offset) = flushFileBuffers;
+				offset += sizeof(nint);
+				EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+			}
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+			EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x20);
+		}
+
+		// Park: do not ExitThread (process-wide silent die after VEH redirect).
+		int parkOffset = offset;
+		EmitByte(code, ref offset, 0xF3); EmitByte(code, ref offset, 0x90); // pause
+		EmitByte(code, ref offset, 0xEB);
+		EmitByte(code, ref offset, unchecked((byte)(parkOffset - (offset + 1)))); // jmp park
+
+		if (msgAbsSlot >= 0)
+		{
+			ReadOnlySpan<byte> msgEmbed = "[LOADER][WARN] tbb_abort_stub SetEvent+park\n"u8;
+			*(nint*)(code + msgAbsSlot) = (nint)ptr + offset;
+			for (int i = 0; i < msgEmbed.Length; i++)
+			{
+				EmitByte(code, ref offset, msgEmbed[i]);
+			}
+		}
+
+		if (offset > (int)stubSize)
+		{
+			Console.Error.WriteLine(
+				$"[LOADER][ERROR] Worker abort stub overflow: used={offset} cap={stubSize}");
+			VirtualFree(ptr, 0u, 32768u);
+			return 0;
+		}
+
+		uint oldProtect = default;
+		if (!VirtualProtect(ptr, stubSize, 32u, &oldProtect))
+		{
+			VirtualFree(ptr, 0u, 32768u);
+			return 0;
+		}
+		FlushInstructionCache(GetCurrentProcess(), ptr, (nuint)offset);
+		return (nint)ptr;
+	}
+
 	private unsafe nint CreateExceptionHandlerTrampoline(nint managedHandler)
 	{
-		const uint stubSize = 256u;
+		// Live VEH trampoline used by SetupExceptionHandler. Must pre-filter
+		// FastFail / CLR / MSVC C++ / stack-overflow the same way as
+		// WindowsFaultHandling.CreateHandlerThunk: entering managed VEH while
+		// the thread is in cooperative GC mode fail-fasts with
+		// "UnmanagedCallersOnly method from managed code" (tLT18–22).
+		// Extra headroom for native tbb abort + recursive managed-entry spinlock.
+		const uint stubSize = 2048u;
 		void* ptr = VirtualAlloc(null, stubSize, 12288u, 64u);
 		if (ptr == null)
 		{
@@ -2418,10 +2587,305 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 
 		byte* code = (byte*)ptr;
 		int offset = 0;
+
+		ReadOnlySpan<uint> nonManagedExceptionCodes =
+		[
+			0xE0434352u, // CLR managed exception
+			0xE06D7363u, // MSVC C++ exception
+			0xC0000409u, // STATUS_STACK_BUFFER_OVERRUN / FailFast
+			0xC00000FDu, // STATUS_STACK_OVERFLOW
+		];
+		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x01); // mov rax, [rcx]
+		EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x00); // mov eax, [rax] ExceptionCode
+		var passJumpOffsets = stackalloc int[nonManagedExceptionCodes.Length];
+		int fastFailJumpSlot = -1;
+		for (int i = 0; i < nonManagedExceptionCodes.Length; i++)
+		{
+			EmitByte(code, ref offset, 0x3D);
+			EmitUInt32(code, ref offset, nonManagedExceptionCodes[i]);
+			EmitByte(code, ref offset, 0x74);
+			passJumpOffsets[i] = offset;
+			EmitByte(code, ref offset, 0x00);
+			if (nonManagedExceptionCodes[i] == 0xC0000409u)
+			{
+				fastFailJumpSlot = i;
+			}
+		}
+
+		EmitByte(code, ref offset, 0xE9); // jmp mainBody (rel32; FastFail breadcrumb sits between)
+		var mainBodyJumpSlot = offset;
+		EmitUInt32(code, ref offset, 0u);
+
+		int passOffset = offset;
+		EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0); // xor eax, eax
+		EmitByte(code, ref offset, 0xC3);
+
+		int fastFailPassOffset = offset;
+		var fastFailLogInstalled = false;
+		nint kernel32 = GetModuleHandle("kernel32.dll");
+		nint getStdHandle = kernel32 != 0 ? GetProcAddress(kernel32, "GetStdHandle") : 0;
+		nint writeFile = kernel32 != 0 ? GetProcAddress(kernel32, "WriteFile") : 0;
+		if (fastFailJumpSlot >= 0 && getStdHandle != 0 && writeFile != 0)
+		{
+			// Prefix + Context.Rip hex (AMD64 CONTEXT.Rip @ 0xF8) + newline.
+			// Keep in sync with WindowsFaultHandling.CreateHandlerThunk.
+			ReadOnlySpan<byte> msg =
+				"[LOADER][FATAL] VEH_PASS FastFail 0xC0000409 (live trampoline; skip managed VEH) rip=0x"u8;
+			ReadOnlySpan<byte> hexDigits = "0123456789ABCDEF"u8;
+			// rcx=EXCEPTION_POINTERS*: capture Rip into r10 before clobbering.
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x41);
+			EmitByte(code, ref offset, 0x08); // mov rax, [rcx+8] ContextRecord*
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x90);
+			EmitUInt32(code, ref offset, 0xF8u); // mov r10, [rax+0xF8] Rip
+			EmitByte(code, ref offset, 0x50);
+			EmitByte(code, ref offset, 0x51);
+			EmitByte(code, ref offset, 0x52);
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x50);
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x51);
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x52); // push r10 (Rip)
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+			EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x40); // sub rsp, 0x40 (hex buf @ +0x30)
+			EmitByte(code, ref offset, 0xB9); EmitUInt32(code, ref offset, unchecked((uint)-12));
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+			*(nint*)(code + offset) = getStdHandle;
+			offset += sizeof(nint);
+			EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89);
+			EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x28); // mov [rsp+0x28], rax  stderr handle
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xC1);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+			var msgAbsSlot = offset;
+			*(nint*)(code + offset) = 0;
+			offset += sizeof(nint);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xC2);
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xB8);
+			EmitUInt32(code, ref offset, (uint)msg.Length);
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8D);
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x20);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
+			EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x20); EmitUInt32(code, ref offset, 0);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
+			EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x38); EmitUInt32(code, ref offset, 0); // lpOverlapped slot
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+			*(nint*)(code + offset) = writeFile;
+			offset += sizeof(nint);
+			EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+
+			// Hex-encode Rip. Stack after sub 0x40: [rsp+0x40]=saved Rip (push r10).
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8B);
+			EmitByte(code, ref offset, 0x54); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x40); // mov r10, [rsp+0x40]
+			EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xB8);
+			var hexDigitsAbsSlot = offset;
+			*(nint*)(code + offset) = 0;
+			offset += sizeof(nint); // mov r8, hexDigits
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8D);
+			EmitByte(code, ref offset, 0x5C); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x30); // lea r11, [rsp+0x30] hex out
+			EmitByte(code, ref offset, 0xB9); EmitUInt32(code, ref offset, 16u); // ecx = 16 nibbles
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xD0); // mov rax, r10
+			int hexLoopOffset = offset;
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC1); EmitByte(code, ref offset, 0xC0);
+			EmitByte(code, ref offset, 0x04); // rol rax, 4
+			EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xC2); // mov edx, eax
+			EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xE2); EmitByte(code, ref offset, 0x0F); // and edx, 0xF
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0xB6);
+			EmitByte(code, ref offset, 0x14); EmitByte(code, ref offset, 0x10); // movzx edx, byte [r8+rdx]
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x88); EmitByte(code, ref offset, 0x13); // mov [r11], dl
+			EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xC3); // inc r11
+			EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xC9); // dec ecx
+			EmitByte(code, ref offset, 0x75);
+			EmitByte(code, ref offset, unchecked((byte)(hexLoopOffset - (offset + 1)))); // jnz hexLoop (rel8)
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xC6); EmitByte(code, ref offset, 0x03);
+			EmitByte(code, ref offset, 0x0A); // mov byte [r11], '\n'
+
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B);
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x28); // mov rcx, [rsp+0x28] stderr
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8D);
+			EmitByte(code, ref offset, 0x54); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x30); // lea rdx, [rsp+0x30]
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xB8);
+			EmitUInt32(code, ref offset, 17u); // 16 hex + newline
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8D);
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x20);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
+			EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x20); EmitUInt32(code, ref offset, 0);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
+			EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+			EmitByte(code, ref offset, 0x38); EmitUInt32(code, ref offset, 0);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+			*(nint*)(code + offset) = writeFile;
+			offset += sizeof(nint);
+			EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+
+			// Flush redirected stderr so FastFail rip survives process teardown.
+			nint flushFileBuffers = kernel32 != 0 ? GetProcAddress(kernel32, "FlushFileBuffers") : 0;
+			if (flushFileBuffers != 0)
+			{
+				EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B);
+				EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
+				EmitByte(code, ref offset, 0x28); // mov rcx, stderr
+				EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+				*(nint*)(code + offset) = flushFileBuffers;
+				offset += sizeof(nint);
+				EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+			}
+
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+			EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x40);
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5A); // pop r10
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x59);
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x58);
+			EmitByte(code, ref offset, 0x5A);
+			EmitByte(code, ref offset, 0x59);
+			EmitByte(code, ref offset, 0x58);
+			EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0);
+			EmitByte(code, ref offset, 0xC3);
+
+			var msgOffset = offset;
+			for (int i = 0; i < msg.Length; i++)
+			{
+				EmitByte(code, ref offset, msg[i]);
+			}
+
+			var hexDigitsOffset = offset;
+			for (int i = 0; i < hexDigits.Length; i++)
+			{
+				EmitByte(code, ref offset, hexDigits[i]);
+			}
+
+			*(nint*)(code + msgAbsSlot) = (nint)ptr + msgOffset;
+			*(nint*)(code + hexDigitsAbsSlot) = (nint)ptr + hexDigitsOffset;
+			code[passJumpOffsets[fastFailJumpSlot]] =
+				checked((byte)(fastFailPassOffset - (passJumpOffsets[fastFailJumpSlot] + 1)));
+			fastFailLogInstalled = true;
+		}
+
+		int mainBodyOffset = offset;
+		*(int*)(code + mainBodyJumpSlot) = mainBodyOffset - (mainBodyJumpSlot + sizeof(int));
+		for (int i = 0; i < nonManagedExceptionCodes.Length; i++)
+		{
+			if (i == fastFailJumpSlot && fastFailLogInstalled)
+			{
+				continue;
+			}
+
+			code[passJumpOffsets[i]] = checked((byte)(passOffset - (passJumpOffsets[i] + 1)));
+		}
+
 		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x54); // push r12
 		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x55); // push r13
 		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE4); // mov r12, rsp
 		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xCD); // mov r13, rcx
+
+		// Native worker EXECUTE-AV abort without managed VEH.
+		// Do NOT catch read/write AVs — workers need managed lazy-commit (tLTJ
+		// silent-die when every worker AV was aborted). Execute faults on
+		// tbb_thead are the concurrent-managed FailFast case (tLTC).
+		int tbbFallthroughJump = -1;
+		if (_workerAbortStub != 0 &&
+			_tlsGetValueAddress != 0 &&
+			_hostRspSlotTlsIndex != uint.MaxValue)
+		{
+			EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x8B);
+			EmitByte(code, ref offset, 0x45); EmitByte(code, ref offset, 0x00); // mov rax, [r13]
+			EmitByte(code, ref offset, 0x81); EmitByte(code, ref offset, 0x38);
+			EmitUInt32(code, ref offset, 0xC0000005u); // cmp dword [rax], AV
+			EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x85);
+			tbbFallthroughJump = offset;
+			EmitUInt32(code, ref offset, 0u); // jne fallthrough
+
+			// ExceptionInformation[0] == 8 → EXECUTE (DEP). Offset 32 on x64 RECORD.
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+			EmitByte(code, ref offset, 0xB8); EmitUInt32(code, ref offset, 32u);
+			EmitByte(code, ref offset, 0x08); // cmp qword [rax+32], 8
+			EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x85);
+			var tbbNotExecuteJump = offset;
+			EmitUInt32(code, ref offset, 0u);
+
+			int tbbNotEligibleJump = -1;
+			if (_tbbAbortEligibleTlsIndex != uint.MaxValue)
+			{
+				EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+				EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
+				EmitByte(code, ref offset, 0xB9);
+				EmitUInt32(code, ref offset, _tbbAbortEligibleTlsIndex);
+				EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+				*(nint*)(code + offset) = _tlsGetValueAddress;
+				offset += sizeof(nint);
+				EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+				EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+				EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
+				EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x85);
+				EmitByte(code, ref offset, 0xC0);
+				EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
+				tbbNotEligibleJump = offset;
+				EmitUInt32(code, ref offset, 0u);
+			}
+
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+			EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
+			EmitByte(code, ref offset, 0xB9);
+			EmitUInt32(code, ref offset, _hostRspSlotTlsIndex);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+			*(nint*)(code + offset) = _tlsGetValueAddress;
+			offset += sizeof(nint);
+			EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+			EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x85);
+			EmitByte(code, ref offset, 0xC0);
+			EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
+			var tbbNoHostRspJump = offset;
+			EmitUInt32(code, ref offset, 0u);
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8B);
+			EmitByte(code, ref offset, 0x00); // mov r8, [rax] hostRsp
+			EmitByte(code, ref offset, 0x4D); EmitByte(code, ref offset, 0x85);
+			EmitByte(code, ref offset, 0xC0);
+			EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
+			var tbbZeroRspJump = offset;
+			EmitUInt32(code, ref offset, 0u);
+
+			EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x83);
+			EmitByte(code, ref offset, 0xE0); EmitByte(code, ref offset, 0xF0); // and r8, ~0xF
+			EmitByte(code, ref offset, 0x4D); EmitByte(code, ref offset, 0x8B);
+			EmitByte(code, ref offset, 0x4D); EmitByte(code, ref offset, 0x08); // mov r9, [r13+8]
+			EmitByte(code, ref offset, 0x4D); EmitByte(code, ref offset, 0x89);
+			EmitByte(code, ref offset, 0x81); EmitUInt32(code, ref offset, 0x98u); // Context.Rsp
+			EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+			*(nint*)(code + offset) = _workerAbortStub;
+			offset += sizeof(nint);
+			EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x89);
+			EmitByte(code, ref offset, 0x81); EmitUInt32(code, ref offset, 0xF8u); // Context.Rip
+			EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xC7);
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x78);
+			EmitUInt32(code, ref offset, 0u); // Context.Rax = 0
+
+			EmitByte(code, ref offset, 0xB8); EmitUInt32(code, ref offset, unchecked((uint)-1));
+			EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89);
+			EmitByte(code, ref offset, 0xE4); // mov rsp, r12
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5D);
+			EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5C);
+			EmitByte(code, ref offset, 0xC3);
+
+			int tbbFallthroughOffset = offset;
+			*(int*)(code + tbbFallthroughJump) = tbbFallthroughOffset - (tbbFallthroughJump + sizeof(int));
+			*(int*)(code + tbbNotExecuteJump) = tbbFallthroughOffset - (tbbNotExecuteJump + sizeof(int));
+			if (tbbNotEligibleJump >= 0)
+			{
+				*(int*)(code + tbbNotEligibleJump) = tbbFallthroughOffset - (tbbNotEligibleJump + sizeof(int));
+			}
+			*(int*)(code + tbbNoHostRspJump) = tbbFallthroughOffset - (tbbNoHostRspJump + sizeof(int));
+			*(int*)(code + tbbZeroRspJump) = tbbFallthroughOffset - (tbbZeroRspJump + sizeof(int));
+		}
+
 		EmitByte(code, ref offset, 0x65); EmitByte(code, ref offset, 0x48); // mov rax, gs:[8]
 		EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x04); EmitByte(code, ref offset, 0x25);
 		EmitUInt32(code, ref offset, 8u);
@@ -2438,11 +2902,67 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		EmitUInt32(code, ref offset, 0u);
 
 		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
+		// Serialize managed VEH entry (recursive spinlock). Concurrent UnmanagedCallersOnly
+		// FailFast was the tLTQ silent mid-TBB pattern (enter without abort breadcrumb).
+		// Lock layout: [0]=owner UniqueThread (nint), [8]=depth (int).
+		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xB9);
+		*(nint*)(code + offset) = _vehManagedEntryLock;
+		offset += sizeof(nint); // mov r9, lock*
+		EmitByte(code, ref offset, 0x65); EmitByte(code, ref offset, 0x4C);
+		EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x14);
+		EmitByte(code, ref offset, 0x25); EmitUInt32(code, ref offset, 0x48u); // mov r10, gs:[0x48]
+		int hostAcquireSpin = offset;
+		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x01); // mov rax, [r9]
+		EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x39); EmitByte(code, ref offset, 0xD0); // cmp rax, r10
+		EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
+		int hostMineJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x85); EmitByte(code, ref offset, 0xC0); // test rax, rax
+		EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x85);
+		int hostPauseJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		EmitByte(code, ref offset, 0xF0); EmitByte(code, ref offset, 0x4C);
+		EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0xB1); EmitByte(code, ref offset, 0x11); // lock cmpxchg [r9], r10
+		EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x85);
+		int hostRetryJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xC7);
+		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x08);
+		EmitUInt32(code, ref offset, 1u); // mov dword [r9+8], 1
+		EmitByte(code, ref offset, 0xE9);
+		int hostGotJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		int hostPauseOffset = offset;
+		EmitByte(code, ref offset, 0xF3); EmitByte(code, ref offset, 0x90); // pause
+		EmitByte(code, ref offset, 0xE9);
+		int hostPauseBackJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		int hostMineOffset = offset;
+		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xFF);
+		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x08); // inc dword [r9+8]
+		int hostGotOffset = offset;
+		*(int*)(code + hostMineJump) = hostMineOffset - (hostMineJump + sizeof(int));
+		*(int*)(code + hostPauseJump) = hostPauseOffset - (hostPauseJump + sizeof(int));
+		*(int*)(code + hostRetryJump) = hostAcquireSpin - (hostRetryJump + sizeof(int));
+		*(int*)(code + hostGotJump) = hostGotOffset - (hostGotJump + sizeof(int));
+		*(int*)(code + hostPauseBackJump) = hostAcquireSpin - (hostPauseBackJump + sizeof(int));
 		EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE9); // mov rcx, r13
 		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
 		*(nint*)(code + offset) = managedHandler;
 		offset += sizeof(nint);
 		EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xB9);
+		*(nint*)(code + offset) = _vehManagedEntryLock;
+		offset += sizeof(nint); // mov r9, lock*
+		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xFF);
+		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x08); // dec dword [r9+8]
+		EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x85);
+		int hostStillJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xC7);
+		EmitByte(code, ref offset, 0x01); EmitUInt32(code, ref offset, 0u); // mov qword [r9], 0
+		int hostStillOffset = offset;
+		*(int*)(code + hostStillJump) = hostStillOffset - (hostStillJump + sizeof(int));
 		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
 		EmitByte(code, ref offset, 0xE9);
 		int hostRestoreJump = offset;
@@ -2468,11 +2988,64 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		EmitUInt32(code, ref offset, 0u);
 		EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xDC); // mov rsp, r11
 		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
+		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xB9);
+		*(nint*)(code + offset) = _vehManagedEntryLock;
+		offset += sizeof(nint); // mov r9, lock*
+		EmitByte(code, ref offset, 0x65); EmitByte(code, ref offset, 0x4C);
+		EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x14);
+		EmitByte(code, ref offset, 0x25); EmitUInt32(code, ref offset, 0x48u); // mov r10, gs:[0x48]
+		int guestAcquireSpin = offset;
+		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x01); // mov rax, [r9]
+		EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x39); EmitByte(code, ref offset, 0xD0); // cmp rax, r10
+		EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
+		int guestMineJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x85); EmitByte(code, ref offset, 0xC0);
+		EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x85);
+		int guestPauseJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		EmitByte(code, ref offset, 0xF0); EmitByte(code, ref offset, 0x4C);
+		EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0xB1); EmitByte(code, ref offset, 0x11);
+		EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x85);
+		int guestRetryJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xC7);
+		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x08);
+		EmitUInt32(code, ref offset, 1u);
+		EmitByte(code, ref offset, 0xE9);
+		int guestGotJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		int guestPauseOffset = offset;
+		EmitByte(code, ref offset, 0xF3); EmitByte(code, ref offset, 0x90);
+		EmitByte(code, ref offset, 0xE9);
+		int guestPauseBackJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		int guestMineOffset = offset;
+		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xFF);
+		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x08);
+		int guestGotOffset = offset;
+		*(int*)(code + guestMineJump) = guestMineOffset - (guestMineJump + sizeof(int));
+		*(int*)(code + guestPauseJump) = guestPauseOffset - (guestPauseJump + sizeof(int));
+		*(int*)(code + guestRetryJump) = guestAcquireSpin - (guestRetryJump + sizeof(int));
+		*(int*)(code + guestGotJump) = guestGotOffset - (guestGotJump + sizeof(int));
+		*(int*)(code + guestPauseBackJump) = guestAcquireSpin - (guestPauseBackJump + sizeof(int));
 		EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE9); // mov rcx, r13
 		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
 		*(nint*)(code + offset) = managedHandler;
 		offset += sizeof(nint);
 		EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xB9);
+		*(nint*)(code + offset) = _vehManagedEntryLock;
+		offset += sizeof(nint);
+		EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xFF);
+		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x08); // dec dword [r9+8]
+		EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x85);
+		int guestStillJump = offset;
+		EmitUInt32(code, ref offset, 0u);
+		EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xC7);
+		EmitByte(code, ref offset, 0x01); EmitUInt32(code, ref offset, 0u);
+		int guestStillOffset = offset;
+		*(int*)(code + guestStillJump) = guestStillOffset - (guestStillJump + sizeof(int));
 		EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
 		EmitByte(code, ref offset, 0xE9);
 		int guestRestoreJump = offset;
@@ -2493,6 +3066,18 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 		*(int*)(code + missingHostStackJump) = passThroughOffset - (missingHostStackJump + sizeof(int));
 		*(int*)(code + guestRestoreJump) = restoreOffset - (guestRestoreJump + sizeof(int));
 
+		if (offset > (int)stubSize)
+		{
+			Console.Error.WriteLine(
+				$"[LOADER][ERROR] Exception handler trampoline overflow: used={offset} cap={stubSize}");
+			VirtualFree(ptr, 0, 0x8000u);
+			return 0;
+		}
+
+		Console.Error.WriteLine(
+			$"[LOADER][INFO] VEH trampoline built: bytes={offset} native_worker_abort=" +
+			$"{(_workerAbortStub != 0 && _hostRspSlotTlsIndex != uint.MaxValue)}");
+
 		uint oldProtect = default;
 		VirtualProtect(ptr, stubSize, 32u, &oldProtect);
 		FlushInstructionCache(GetCurrentProcess(), ptr, (nuint)offset);
@@ -3067,6 +3652,7 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			$"[LOADER][INFO] Scheduled guest thread '{thread.Name}' handle=0x{thread.ThreadHandle:X16} " +
 			$"entry=0x{thread.EntryPoint:X16} arg=0x{thread.Argument:X16} priority={thread.Priority} " +
 			$"host_priority={MapGuestThreadPriority(thread.Priority)} affinity=0x{thread.AffinityMask:X}");
+		LoadProgressDiagnostics.ArmIfNorthAudioThread(thread.Name);
 		Pump(creatorContext, "pthread_create");
 		// Pump is suppressed while another cooperative dispatch is active. The
 		// background dispatcher would eventually observe this thread, but an
@@ -5147,16 +5733,27 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 				return GuestNativeCallExitReason.Exception;
 			}
 			FlushInstructionCache(GetCurrentProcess(), ptr, stubSize);
-			if (!TlsSetValue(_hostRspSlotTlsIndex, (nint)hostRspSlot))
-			{
-				reason = "failed to bind host-RSP storage for guest thread stub";
-				return GuestNativeCallExitReason.Exception;
-			}
 			ActiveGuestThreadYieldRequested = false;
 			ActiveGuestThreadYieldReason = null;
 			try
 			{
-				var nativeReturn = CallNativeEntry(ptr);
+				// TBB execute-AV recover needs native-worker TLS (eligible/done).
+				// Other guests stay on CallNativeEntry — full native-worker migration
+				// increased splash hangs / UnmanagedCallersOnly (tLTN/tLTO).
+				int nativeReturn;
+				if (name == "tbb_thead")
+				{
+					nativeReturn = RunGuestEntryStub(ptr, hostRspSlot, requireNativeWorker: true);
+				}
+				else
+				{
+					if (!TlsSetValue(_hostRspSlotTlsIndex, (nint)hostRspSlot))
+					{
+						reason = "failed to bind host-RSP storage for guest thread stub";
+						return GuestNativeCallExitReason.Exception;
+					}
+					nativeReturn = CallNativeEntry(ptr);
+				}
 				if (ActiveGuestThreadYieldRequested)
 				{
 					reason = ActiveGuestThreadYieldReason ?? "guest thread blocked";
@@ -5302,16 +5899,24 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 				return GuestNativeCallExitReason.Exception;
 			}
 			FlushInstructionCache(GetCurrentProcess(), ptr, stubSize);
-			if (!TlsSetValue(_hostRspSlotTlsIndex, (nint)hostRspSlot))
-			{
-				reason = "failed to bind host-RSP storage for guest continuation stub";
-				return GuestNativeCallExitReason.Exception;
-			}
 			ActiveGuestThreadYieldRequested = false;
 			ActiveGuestThreadYieldReason = null;
 			try
 			{
-				var nativeReturn = CallNativeEntry(ptr);
+				int nativeReturn;
+				if (name == "tbb_thead")
+				{
+					nativeReturn = RunGuestEntryStub(ptr, hostRspSlot, requireNativeWorker: true);
+				}
+				else
+				{
+					if (!TlsSetValue(_hostRspSlotTlsIndex, (nint)hostRspSlot))
+					{
+						reason = "failed to bind host-RSP storage for guest continuation stub";
+						return GuestNativeCallExitReason.Exception;
+					}
+					nativeReturn = CallNativeEntry(ptr);
+				}
 				if (ActiveGuestThreadYieldRequested)
 				{
 					reason = ActiveGuestThreadYieldReason ?? "guest thread blocked";
@@ -6444,6 +7049,16 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			VirtualFree((void*)_hostRspSlotStorage, 0u, 32768u);
 			_hostRspSlotStorage = 0;
 		}
+		if (_vehManagedEntryLock != 0)
+		{
+			VirtualFree((void*)_vehManagedEntryLock, 0u, 32768u);
+			_vehManagedEntryLock = 0;
+		}
+		if (_workerAbortStack != 0)
+		{
+			VirtualFree((void*)_workerAbortStack, 0u, 32768u);
+			_workerAbortStack = 0;
+		}
 		if (_guestTlsBaseTlsIndex != uint.MaxValue)
 		{
 			TlsFree(_guestTlsBaseTlsIndex);
@@ -6454,6 +7069,11 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			TlsFree(_hostRspSlotTlsIndex);
 			_hostRspSlotTlsIndex = uint.MaxValue;
 		}
+		if (_workerDoneEventTlsIndex != uint.MaxValue)
+		{
+			TlsFree(_workerDoneEventTlsIndex);
+			_workerDoneEventTlsIndex = uint.MaxValue;
+		}
 		if (_unresolvedReturnStub != 0)
 		{
 			VirtualFree((void*)_unresolvedReturnStub, 0u, 32768u);
@@ -6464,6 +7084,11 @@ public sealed unsafe partial class DirectExecutionBackend : INativeCpuBackend, I
 			VirtualFree((void*)_guestReturnStub, 0u, 32768u);
 			_guestReturnStub = 0;
 		}
+		if (_workerAbortStub != 0)
+		{
+			VirtualFree((void*)_workerAbortStub, 0u, 32768u);
+			_workerAbortStub = 0;
+		}
 		if (_guestContextTransferStub != 0)
 		{
 			VirtualFree((void*)_guestContextTransferStub, 0u, 32768u);

src/SharpEmu.Core/Cpu/Native/Windows/WindowsFaultHandling.cs

@@ -24,7 +24,7 @@ internal sealed unsafe partial class WindowsFaultHandling : IHostFaultHandling
 
     public nint CreateHandlerThunk(nint managedCallback, uint hostRspSwitchTlsSlot, nint tlsGetValueAddress)
     {
-        const uint stubSize = 256u;
+        const uint stubSize = 1024u;
         void* ptr = (void*)_memory.Allocate(0, stubSize, HostPageProtection.ReadWriteExecute);
         if (ptr == null)
         {
@@ -43,11 +43,15 @@ internal sealed unsafe partial class WindowsFaultHandling : IHostFaultHandling
         // managed code; the CLR's own VEH handles its exceptions. MSVC C++ exceptions
         // (Vulkan drivers, host CRT) are excluded too: the managed handler only ever
         // returned CONTINUE_SEARCH for them.
+        //
+        // FastFail (0xC0000409) is logged from this native path only: managed VEH never
+        // sees it (tLT18–21 silent exits after TBB AV recovery).
         ReadOnlySpan<uint> nonManagedExceptionCodes =
             [WindowsFaultCodes.ClrManagedException, 0xE06D7363u, WindowsFaultCodes.FastFail, WindowsFaultCodes.StackOverflow];
         EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x01); // mov rax, [rcx] (ExceptionRecord*)
         EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x00);                                   // mov eax, [rax] (ExceptionCode)
         var passJumpOffsets = stackalloc int[nonManagedExceptionCodes.Length];
+        int fastFailJumpSlot = -1;
         for (int i = 0; i < nonManagedExceptionCodes.Length; i++)
         {
             EmitByte(code, ref offset, 0x3D);                                                                 // cmp eax, imm32
@@ -55,13 +59,162 @@ internal sealed unsafe partial class WindowsFaultHandling : IHostFaultHandling
             EmitByte(code, ref offset, 0x74);                                                                 // je pass
             passJumpOffsets[i] = offset;
             EmitByte(code, ref offset, 0x00);
+            if (nonManagedExceptionCodes[i] == WindowsFaultCodes.FastFail)
+            {
+                fastFailJumpSlot = i;
+            }
         }
-        EmitByte(code, ref offset, 0xEB); EmitByte(code, ref offset, 0x03);                                   // jmp over pass block
+        EmitByte(code, ref offset, 0xE9); // jmp mainBody rel32 (FastFail breadcrumb sits between)
+        var mainBodyJumpSlot = offset;
+        EmitUInt32(code, ref offset, 0u);
+
         int passOffset = offset;
         EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0);                                   // pass: xor eax, eax (EXCEPTION_CONTINUE_SEARCH)
         EmitByte(code, ref offset, 0xC3);                                                                     // ret
+
+        // FastFail: native stderr breadcrumb with Context.Rip (no managed entry), then CONTINUE_SEARCH.
+        // Keep in sync with DirectExecutionBackend.CreateExceptionHandlerTrampoline.
+        int fastFailPassOffset = offset;
+        var fastFailLogInstalled = false;
+        if (fastFailJumpSlot >= 0 &&
+            NativeLibrary.TryLoad("kernel32.dll", out var kernel32) &&
+            NativeLibrary.TryGetExport(kernel32, "GetStdHandle", out var getStdHandle) &&
+            NativeLibrary.TryGetExport(kernel32, "WriteFile", out var writeFile))
+        {
+            ReadOnlySpan<byte> msg =
+                "[LOADER][FATAL] VEH_PASS FastFail 0xC0000409 (native; no managed VEH) rip=0x"u8;
+            ReadOnlySpan<byte> hexDigits = "0123456789ABCDEF"u8;
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x41);
+            EmitByte(code, ref offset, 0x08); // mov rax, [rcx+8]
+            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x90);
+            EmitUInt32(code, ref offset, 0xF8u); // mov r10, [rax+0xF8]
+            EmitByte(code, ref offset, 0x50); // push rax
+            EmitByte(code, ref offset, 0x51); // push rcx
+            EmitByte(code, ref offset, 0x52); // push rdx
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x50); // push r8
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x51); // push r9
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x52); // push r10
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+            EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x40); // sub rsp, 0x40
+            EmitByte(code, ref offset, 0xB9); EmitUInt32(code, ref offset, unchecked((uint)-12));
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+            *(nint*)(code + offset) = getStdHandle;
+            offset += sizeof(nint);
+            EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89);
+            EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x28); // mov [rsp+0x28], rax
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xC1);
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+            var msgAbsSlot = offset;
+            *(nint*)(code + offset) = 0;
+            offset += sizeof(nint);
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xC2);
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xB8);
+            EmitUInt32(code, ref offset, (uint)msg.Length);
+            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8D);
+            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x20);
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
+            EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x20); EmitUInt32(code, ref offset, 0);
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
+            EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x38); EmitUInt32(code, ref offset, 0);
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+            *(nint*)(code + offset) = writeFile;
+            offset += sizeof(nint);
+            EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+
+            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8B);
+            EmitByte(code, ref offset, 0x54); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x40); // mov r10, [rsp+0x40]
+            EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xB8);
+            var hexDigitsAbsSlot = offset;
+            *(nint*)(code + offset) = 0;
+            offset += sizeof(nint);
+            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8D);
+            EmitByte(code, ref offset, 0x5C); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x30); // lea r11, [rsp+0x30]
+            EmitByte(code, ref offset, 0xB9); EmitUInt32(code, ref offset, 16u);
+            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xD0);
+            int hexLoopOffset = offset;
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC1); EmitByte(code, ref offset, 0xC0);
+            EmitByte(code, ref offset, 0x04);
+            EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xC2);
+            EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xE2); EmitByte(code, ref offset, 0x0F);
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0xB6);
+            EmitByte(code, ref offset, 0x14); EmitByte(code, ref offset, 0x10);
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x88); EmitByte(code, ref offset, 0x13);
+            EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xC3);
+            EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xC9);
+            EmitByte(code, ref offset, 0x75);
+            EmitByte(code, ref offset, unchecked((byte)(hexLoopOffset - (offset + 1)))); // jnz rel8
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xC6); EmitByte(code, ref offset, 0x03);
+            EmitByte(code, ref offset, 0x0A);
+
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B);
+            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x28);
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8D);
+            EmitByte(code, ref offset, 0x54); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x30);
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0xB8);
+            EmitUInt32(code, ref offset, 17u);
+            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8D);
+            EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x20);
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
+            EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x20); EmitUInt32(code, ref offset, 0);
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xC7);
+            EmitByte(code, ref offset, 0x44); EmitByte(code, ref offset, 0x24);
+            EmitByte(code, ref offset, 0x38); EmitUInt32(code, ref offset, 0);
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+            *(nint*)(code + offset) = writeFile;
+            offset += sizeof(nint);
+            EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+
+            EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83);
+            EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x40);
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5A);
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x59);
+            EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x58);
+            EmitByte(code, ref offset, 0x5A);
+            EmitByte(code, ref offset, 0x59);
+            EmitByte(code, ref offset, 0x58);
+            EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0);
+            EmitByte(code, ref offset, 0xC3);
+
+            var msgOffset = offset;
+            for (int i = 0; i < msg.Length; i++)
+            {
+                EmitByte(code, ref offset, msg[i]);
+            }
+
+            var hexDigitsOffset = offset;
+            for (int i = 0; i < hexDigits.Length; i++)
+            {
+                EmitByte(code, ref offset, hexDigits[i]);
+            }
+
+            *(nint*)(code + msgAbsSlot) = (nint)ptr + msgOffset;
+            *(nint*)(code + hexDigitsAbsSlot) = (nint)ptr + hexDigitsOffset;
+            code[passJumpOffsets[fastFailJumpSlot]] =
+                checked((byte)(fastFailPassOffset - (passJumpOffsets[fastFailJumpSlot] + 1)));
+            fastFailLogInstalled = true;
+        }
+
+        int mainBodyOffset = offset;
+        *(int*)(code + mainBodyJumpSlot) = mainBodyOffset - (mainBodyJumpSlot + sizeof(int));
+
         for (int i = 0; i < nonManagedExceptionCodes.Length; i++)
         {
+            if (i == fastFailJumpSlot && fastFailLogInstalled)
+            {
+                continue;
+            }
+
             code[passJumpOffsets[i]] = checked((byte)(passOffset - (passJumpOffsets[i] + 1)));
         }
         EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x54); // push r12

src/SharpEmu.Core/Loader/SelfLoader.cs

@@ -199,9 +199,32 @@ public sealed class SelfLoader : ISelfLoader
             {
                 if (!physicalVm.TryAllocateAtExact(imageBase, totalImageSize, executable: true, out var allocatedBase))
                 {
-                    var reason = physicalVm.DescribeAddressForDiagnostics(imageBase);
-                    throw new InvalidOperationException(
-                        $"Could not allocate main image at required base 0x{imageBase:X16} (size=0x{totalImageSize:X}): {reason}.");
+                    // Exact allocation failed — the host may have already claimed
+                    // part of this range (ASLR, Rosetta 2, or another process).
+                    // Try backing the fixed range page by page to claim whatever
+                    // free gaps exist. If the whole range is occupied the backfill
+                    // returns false and we surface the original failure reason.
+                    Console.Error.WriteLine(
+                        $"[LOADER] Exact allocation at main image base 0x{imageBase:X16} " +
+                        $"(size=0x{totalImageSize:X}) failed; attempting fixed-range backfill.");
+                    if (!physicalVm.TryBackFixedRange(imageBase, totalImageSize, executable: true))
+                    {
+                        // TryBackFixedRange may have partially backed pages before
+                        // failing. The earlier Clear() already reset all regions, so
+                        // this second Clear() is idempotent for everything except the
+                        // partial backfill — it frees only those orphaned pages.
+                        physicalVm.Clear();
+                        var reason = physicalVm.DescribeAddressForDiagnostics(imageBase);
+                        throw new InvalidOperationException(
+                            $"Could not allocate main image at required base 0x{imageBase:X16} " +
+                            $"(size=0x{totalImageSize:X}): {reason}. " +
+                            "Try closing other applications, rebooting, or " +
+                            (OperatingSystem.IsWindows()
+                                ? "setting SHARPEMU_DISABLE_MITIGATION_RELAUNCH=1."
+                                : "ensuring no other process maps into this address range."));
+                    }
+
+                    allocatedBase = imageBase;
                 }
 
                 imageBase = allocatedBase;
@@ -714,8 +737,9 @@ public sealed class SelfLoader : ISelfLoader
 
         importedRelocations = BuildImportedRelocations(descriptors);
 
+        var stubEligibleNids = CollectStubEligibleNids(descriptors, moduleManager);
         var stubImportNids = orderedImportNids
-            .Where(nid => ShouldCreateImportStub(nid, descriptors, moduleManager))
+            .Where(stubEligibleNids.Contains)
             .ToArray();
         var stubsByAddress = CreateImportStubMapping(virtualMemory, stubImportNids);
         Console.WriteLine($"[LOADER] Created {stubsByAddress.Count} import stubs");
@@ -1160,6 +1184,35 @@ public sealed class SelfLoader : ISelfLoader
             isWeak);
     }
 
+    // Collects every NID that needs a trap import stub in a single pass over the
+    // descriptors. This mirrors ShouldCreateImportStub applied per NID, but avoids
+    // the O(nids * descriptors) rescan that filtering each unique NID against the
+    // full descriptor list would incur on large modules. A NID qualifies as soon as
+    // one of its descriptors is non-weak, or is weak but resolvable via the module
+    // manager.
+    private static HashSet<string> CollectStubEligibleNids(
+        IReadOnlyList<RelocationDescriptor> descriptors,
+        IModuleManager? moduleManager)
+    {
+        var eligible = new HashSet<string>(StringComparer.Ordinal);
+        for (var i = 0; i < descriptors.Count; i++)
+        {
+            var descriptor = descriptors[i];
+            var nid = descriptor.ImportNid;
+            if (nid is null || eligible.Contains(nid))
+            {
+                continue;
+            }
+
+            if (!descriptor.IsWeak || moduleManager?.TryGetExport(nid, out _) == true)
+            {
+                eligible.Add(nid);
+            }
+        }
+
+        return eligible;
+    }
+
     private static bool ShouldCreateImportStub(
         string nid,
         IReadOnlyList<RelocationDescriptor> descriptors,
@@ -2431,6 +2484,19 @@ public sealed class SelfLoader : ISelfLoader
         Debug.Assert(
             !ShouldCreateImportStub("weak", [weak], moduleManager: null),
             "An unresolved weak symbol incorrectly received a trap import stub.");
+
+        var strong = new RelocationDescriptor(
+            TargetAddress: 0x3000,
+            Addend: 0,
+            ImportNid: "strong",
+            SymbolValue: 0,
+            RelocationValueKind.Pointer,
+            IsDataImport: false);
+        var mixed = new List<RelocationDescriptor> { weak, strong };
+        var eligible = CollectStubEligibleNids(mixed, moduleManager: null);
+        Debug.Assert(
+            eligible.Contains("strong") && !eligible.Contains("weak"),
+            "CollectStubEligibleNids disagreed with the per-NID stub eligibility rule.");
     }
 
     private static ulong AlignUp(ulong value, ulong alignment)

src/SharpEmu.Core/Memory/PhysicalVirtualMemory.cs

@@ -238,7 +238,22 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         var alignedSize = (size + 0xFFF) & ~0xFFFUL;
         var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
         var hostProtection = executable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
+        var allowLazyReserve = !executable &&
+            alignedSize >= LargeDataReserveThreshold &&
+            alignedSize > FullCommitRegionLimit;
+
+        // Commit first so titles that walk guest memory via raw host pointers
+        // (GTA post-RenderThread workers) keep fully backed pages. Fall back to
+        // reserve-only + lazy commit only when a huge non-exec commit fails —
+        // that is the Poppy / large-reservation path #608 was aiming for.
+        var reservedOnly = false;
         var result = _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
+        if (result == 0 && allowLazyReserve)
+        {
+            result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
+            reservedOnly = result != 0;
+        }
+
         if (result == 0)
         {
             return false;
@@ -252,6 +267,8 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             return false;
         }
 
+        var lazyPrimeState = reservedOnly ? PrimeLazyReserveRegion(actualAddress, alignedSize) : "n/a";
+
         _gate.EnterWriteLock();
         try
         {
@@ -260,7 +277,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 VirtualAddress = actualAddress,
                 Size = alignedSize,
                 IsExecutable = executable,
-                IsReservedOnly = false,
+                IsReservedOnly = reservedOnly,
                 Protection = protection
             });
         }
@@ -269,8 +286,12 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             _gate.ExitWriteLock();
         }
 
-        var allocationKind = executable ? "executable memory" : "data memory";
-        TraceVmem($"Allocated exact {allocationKind}: 0x{actualAddress:X16} - 0x{actualAddress + alignedSize:X16} ({alignedSize} bytes)");
+        var allocationKind = reservedOnly
+            ? "reserved data memory (lazy commit)"
+            : (executable ? "executable memory" : "data memory");
+        TraceVmem(
+            $"Allocated exact {allocationKind}: 0x{actualAddress:X16} - 0x{actualAddress + alignedSize:X16} " +
+            $"({alignedSize} bytes) lazy_prime={lazyPrimeState}");
         return true;
     }
 
@@ -301,55 +322,44 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
         var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
         var hostProtection = executable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
-        var reservedOnly = false;
-        var preferReserveOnly = !executable &&
+        var allowLazyReserve = !executable &&
             alignedSize >= LargeDataReserveThreshold &&
             alignedSize > FullCommitRegionLimit;
+        var reservedOnly = false;
 
-        ulong result = 0;
-        if (preferReserveOnly)
-        {
-            result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
-            if (result == 0 && allowAlternative)
-            {
-                result = _hostMemory.Reserve(0, alignedSize, HostPageProtection.ReadWrite);
-            }
-
-            if (result != 0)
-            {
-                reservedOnly = true;
-            }
-        }
-
-        if (result == 0)
-        {
-            result = _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
-        }
+        // Prefer a full commit. Only fall back to reserve-only when a large
+        // non-executable commit cannot be satisfied (see TryAllocateAtExact).
+        ulong result = _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
 
         if (result == 0)
         {
             if (!allowAlternative)
             {
-                throw new InvalidOperationException($"Failed to allocate exact mapping at 0x{desiredAddress:X16} ({alignedSize} bytes)");
-            }
-
-            TraceVmem($"Could not allocate at 0x{desiredAddress:X16}, trying any address...");
-            result = _hostMemory.Allocate(0, alignedSize, hostProtection);
-
-            if (result == 0)
-            {
-                if (!executable)
+                if (allowLazyReserve)
                 {
                     result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
-                    if (result == 0 && allowAlternative)
+                    reservedOnly = result != 0;
+                }
+
+                if (result == 0)
+                {
+                    throw new InvalidOperationException($"Failed to allocate exact mapping at 0x{desiredAddress:X16} ({alignedSize} bytes)");
+                }
+            }
+            else
+            {
+                TraceVmem($"Could not allocate at 0x{desiredAddress:X16}, trying any address...");
+                result = _hostMemory.Allocate(0, alignedSize, hostProtection);
+
+                if (result == 0 && allowLazyReserve)
+                {
+                    result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
+                    if (result == 0)
                     {
                         result = _hostMemory.Reserve(0, alignedSize, HostPageProtection.ReadWrite);
                     }
 
-                    if (result != 0)
-                    {
-                        reservedOnly = true;
-                    }
+                    reservedOnly = result != 0;
                 }
 
                 if (result == 0)
@@ -360,45 +370,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         }
 
         var actualAddress = result;
-
-        var lazyPrimeState = "n/a";
-        if (reservedOnly)
-        {
-            var primeBytes = Math.Min(alignedSize, LazyReservePrimeBytes);
-            if (primeBytes != 0)
-            {
-                ulong committedBytes = 0;
-                while (committedBytes < primeBytes)
-                {
-                    var remaining = primeBytes - committedBytes;
-                    var chunkBytes = Math.Min(remaining, LazyReservePrimeChunkBytes);
-                    var commitAddress = actualAddress + committedBytes;
-                    if (!_hostMemory.Commit(commitAddress, chunkBytes, HostPageProtection.ReadWrite))
-                    {
-                        break;
-                    }
-
-                    committedBytes += chunkBytes;
-                }
-
-                if (committedBytes != 0)
-                {
-                    lazyPrimeState = committedBytes == primeBytes
-                        ? $"ok:{committedBytes:X}"
-                        : $"partial:{committedBytes:X}/{primeBytes:X}";
-                    TraceVmem($"Primed lazy region: 0x{actualAddress:X16} - 0x{actualAddress + committedBytes:X16} ({committedBytes} bytes)");
-                }
-                else
-                {
-                    lazyPrimeState = $"fail:{primeBytes:X}";
-                    TraceVmem($"Failed to prime lazy region at 0x{actualAddress:X16} ({primeBytes} bytes), continuing with on-demand commit");
-                }
-            }
-            else
-            {
-                lazyPrimeState = "skip:0";
-            }
-        }
+        var lazyPrimeState = reservedOnly ? PrimeLazyReserveRegion(actualAddress, alignedSize) : "n/a";
 
         _gate.EnterWriteLock();
         try
@@ -425,6 +397,45 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         return actualAddress;
     }
 
+    /// <summary>
+    /// Commits the leading slice of a reserve-only region so early guest touches
+    /// succeed before on-demand <see cref="EnsureRangeCommitted"/> runs.
+    /// </summary>
+    private string PrimeLazyReserveRegion(ulong actualAddress, ulong alignedSize)
+    {
+        var primeBytes = Math.Min(alignedSize, LazyReservePrimeBytes);
+        if (primeBytes == 0)
+        {
+            return "skip:0";
+        }
+
+        ulong committedBytes = 0;
+        while (committedBytes < primeBytes)
+        {
+            var remaining = primeBytes - committedBytes;
+            var chunkBytes = Math.Min(remaining, LazyReservePrimeChunkBytes);
+            var commitAddress = actualAddress + committedBytes;
+            if (!_hostMemory.Commit(commitAddress, chunkBytes, HostPageProtection.ReadWrite))
+            {
+                break;
+            }
+
+            committedBytes += chunkBytes;
+        }
+
+        if (committedBytes != 0)
+        {
+            var state = committedBytes == primeBytes
+                ? $"ok:{committedBytes:X}"
+                : $"partial:{committedBytes:X}/{primeBytes:X}";
+            TraceVmem($"Primed lazy region: 0x{actualAddress:X16} - 0x{actualAddress + committedBytes:X16} ({committedBytes} bytes)");
+            return state;
+        }
+
+        TraceVmem($"Failed to prime lazy region at 0x{actualAddress:X16} ({primeBytes} bytes), continuing with on-demand commit");
+        return $"fail:{primeBytes:X}";
+    }
+
     public bool TryBackFixedRange(ulong address, ulong size, bool executable)
     {
         if (size == 0)
@@ -446,13 +457,20 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         // us over whole free or occupied stretches. Only free stretches get backed;
         // stretches already reserved or committed by another allocation are left as
         // they are, which is exactly what a fixed mapping does on hardware.
+        //
+        // Because backing may span several disjoint free runs, allocations are
+        // staged: host pages are reserved/committed first, and the corresponding
+        // MemoryRegions are inserted only once every gap in the range has been
+        // backed. If any gap fails to back, every earlier host allocation is freed
+        // and no region is inserted, so the address space is left untouched.
+        var stagedAllocations = new List<(ulong Address, ulong Size)>();
+
         var cursor = start;
-        var backedAny = false;
         while (cursor < end)
         {
             if (!_hostMemory.Query(cursor, out var info))
             {
-                return false;
+                goto Rollback;
             }
 
             var queriedEnd = info.RegionSize > ulong.MaxValue - info.BaseAddress
@@ -461,7 +479,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             var runEnd = Math.Min(end, queriedEnd);
             if (runEnd <= cursor)
             {
-                return false;
+                goto Rollback;
             }
 
             if (info.State == HostRegionState.Free)
@@ -475,35 +493,52 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                         _hostMemory.Free(allocated);
                     }
 
-                    return false;
-                }
-
-                var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
-                _gate.EnterWriteLock();
-                try
-                {
-                    InsertRegionSorted(new MemoryRegion
-                    {
-                        VirtualAddress = cursor,
-                        Size = runSize,
-                        IsExecutable = executable,
-                        IsReservedOnly = false,
-                        Protection = protection
-                    });
-                }
-                finally
-                {
-                    _gate.ExitWriteLock();
+                    goto Rollback;
                 }
 
+                stagedAllocations.Add((cursor, runSize));
                 TraceVmem($"Backed fixed range gap: 0x{cursor:X16} - 0x{runEnd:X16} ({runSize} bytes)");
-                backedAny = true;
             }
 
             cursor = runEnd;
         }
 
-        return backedAny;
+        if (stagedAllocations.Count == 0)
+        {
+            return false;
+        }
+
+        // All gaps backed successfully — insert regions in one batch.
+        var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
+        _gate.EnterWriteLock();
+        try
+        {
+            foreach (var (gapAddress, gapSize) in stagedAllocations)
+            {
+                InsertRegionSorted(new MemoryRegion
+                {
+                    VirtualAddress = gapAddress,
+                    Size = gapSize,
+                    IsExecutable = executable,
+                    IsReservedOnly = false,
+                    Protection = protection
+                });
+            }
+        }
+        finally
+        {
+            _gate.ExitWriteLock();
+        }
+
+        return true;
+
+    Rollback:
+        foreach (var (gapAddress, _) in stagedAllocations)
+        {
+            _hostMemory.Free(gapAddress);
+        }
+
+        return false;
     }
 
     public bool TryAllocateAtOrAbove(
@@ -1283,12 +1318,26 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         try
         {
             var region = FindRegion(virtualAddress, 1);
-            if (region is null ||
-                (region.IsReservedOnly && !EnsureRangeCommitted(virtualAddress, 1, region)))
+            if (region is null)
             {
                 return null;
             }
 
+            // Raw host pointers are walked by native/JIT code without further
+            // EnsureRangeCommitted calls. For reserve-only regions, commit a
+            // leading working-set chunk from this address so the common case
+            // does not immediately AV on the next page.
+            if (region.IsReservedOnly)
+            {
+                var regionEnd = region.VirtualAddress + region.Size;
+                var remaining = regionEnd > virtualAddress ? regionEnd - virtualAddress : 0;
+                var commitBytes = Math.Min(remaining, LazyReservePrimeChunkBytes);
+                if (commitBytes == 0 || !EnsureRangeCommitted(virtualAddress, commitBytes, region))
+                {
+                    return null;
+                }
+            }
+
             return (void*)virtualAddress;
         }
         finally

src/SharpEmu.HLE/GuestImageWriteTracker.cs

@@ -1,6 +1,7 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Diagnostics;
 using System.Globalization;
 using System.Runtime.InteropServices;
 
@@ -30,6 +31,12 @@ public static unsafe class GuestImageWriteTracker
         public ulong End;
         public int Dirty;
         public int Armed;
+        /// <summary>
+        /// When false the range is watch-only: managed writes still dirty it via
+        /// <see cref="NotifyManagedWrite"/>, but pages are never write-protected
+        /// so native CPU stores do not fault.
+        /// </summary>
+        public bool Protect;
         public int FirstCpuWriteSeen;
         public int PendingFirstCpuWrite;
         public long WriteGeneration;
@@ -80,8 +87,17 @@ public static unsafe class GuestImageWriteTracker
 
     private static RangeSnapshot _rangeSnapshot = RangeSnapshot.Empty;
 
-    private static readonly bool _enabled = !OperatingSystem.IsWindows() &&
-        Environment.GetEnvironmentVariable("SHARPEMU_GUEST_IMAGE_CPU_SYNC") != "0";
+    // Windows defaults off: VirtualProtect fault sync still regresses titles
+    // like Dead Cells / Demon's Souls. Opt in with SHARPEMU_GUEST_IMAGE_CPU_SYNC=1
+    // when a title needs CPU-written guest planes (e.g. GTA intro). Linux/macOS
+    // keep the historical opt-out (=0 disables).
+    private static readonly bool _enabled =
+        OperatingSystem.IsWindows()
+            ? string.Equals(
+                Environment.GetEnvironmentVariable("SHARPEMU_GUEST_IMAGE_CPU_SYNC"),
+                "1",
+                StringComparison.Ordinal)
+            : Environment.GetEnvironmentVariable("SHARPEMU_GUEST_IMAGE_CPU_SYNC") != "0";
     private static readonly (bool Wildcard, ulong[] Addresses) _lifetimeTraceFilter =
         ParseAddressList(Environment.GetEnvironmentVariable("SHARPEMU_TRACE_GUEST_IMAGE_ADDRS"));
     private static readonly (bool Wildcard, string[] Sources) _lifetimeSourceTraceFilter =
@@ -95,14 +111,67 @@ public static unsafe class GuestImageWriteTracker
         _enabled && _lifetimeTraceEnabled ? GetMonotonicNanoseconds() : 0;
     private static long _lifetimeTraceSequence;
 
+    private const uint PageReadonly = 0x02;
+    private const uint PageReadWrite = 0x04;
+
     [DllImport("libc", EntryPoint = "mprotect", SetLastError = true)]
     private static extern int Mprotect(nint address, nuint length, int protection);
 
     [DllImport("libc", EntryPoint = "clock_gettime", SetLastError = false)]
     private static extern int ClockGetTime(int clockId, Timespec* time);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern int VirtualProtect(
+        nint lpAddress,
+        nuint dwSize,
+        uint flNewProtect,
+        out uint lpflOldProtect);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern nint VirtualAlloc(
+        nint lpAddress,
+        nuint dwSize,
+        uint flAllocationType,
+        uint flProtect);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern int VirtualFree(nint lpAddress, nuint dwSize, uint dwFreeType);
+
+    private const uint MemCommit = 0x1000;
+    private const uint MemReserve = 0x2000;
+    private const uint MemRelease = 0x8000;
+
     public static bool Enabled => _enabled;
 
+    /// <summary>
+    /// Test/diagnostics helper: whether <paramref name="address"/> is tracked
+    /// with write protection armed (watch-only ranges report protect=false).
+    /// </summary>
+    public static bool TryGetProtectionState(
+        ulong address,
+        out bool protect,
+        out bool armed)
+    {
+        protect = false;
+        armed = false;
+        if (!_enabled)
+        {
+            return false;
+        }
+
+        lock (_gate)
+        {
+            if (!_rangesByAddress.TryGetValue(address, out var range))
+            {
+                return false;
+            }
+
+            protect = range.Protect;
+            armed = Volatile.Read(ref range.Armed) != 0;
+            return true;
+        }
+    }
+
     /// <summary>
     /// Exercises the fault-handling path once outside signal context so every
     /// branch is JIT-compiled (and, under Rosetta 2, translated) before a real
@@ -115,7 +184,17 @@ public static unsafe class GuestImageWriteTracker
             return;
         }
 
-        var scratch = NativeMemory.AllocZeroed(4096);
+        // VirtualProtect only belongs on VirtualAlloc/mmap pages. Warming on
+        // CRT heap memory makes neighbouring heap metadata read-only and
+        // crashes the process on Windows.
+        var scratch = OperatingSystem.IsWindows()
+            ? VirtualAlloc(0, 4096, MemCommit | MemReserve, PageReadWrite)
+            : (nint)NativeMemory.AllocZeroed(4096);
+        if (scratch == 0)
+        {
+            return;
+        }
+
         try
         {
             // Warm the timestamp P/Invoke used by the signal-safe scalar
@@ -129,16 +208,29 @@ public static unsafe class GuestImageWriteTracker
         }
         finally
         {
-            NativeMemory.Free(scratch);
+            if (OperatingSystem.IsWindows())
+            {
+                _ = VirtualFree(scratch, 0, MemRelease);
+            }
+            else
+            {
+                NativeMemory.Free((void*)scratch);
+            }
         }
     }
 
-    /// <summary>Registers a range and arms write protection on it.</summary>
+    /// <summary>
+    /// Registers a range. When <paramref name="protect"/> is true, arms write
+    /// protection so native stores fault and mark the range dirty. When false,
+    /// the range is watch-only (managed HLE writes still dirty via
+    /// <see cref="NotifyManagedWrite"/>) and never <c>VirtualProtect</c>'d.
+    /// </summary>
     public static void Track(
         ulong address,
         ulong byteCount,
         long sourceSequence = 0,
-        string source = "unspecified")
+        string source = "unspecified",
+        bool protect = true)
     {
         if (!_enabled || address == 0 || byteCount == 0)
         {
@@ -159,6 +251,7 @@ public static unsafe class GuestImageWriteTracker
                 // a fresh immutable range, carrying the write generation so
                 // resizes do not hide guest CPU rewrites from cache owners.
                 var writeGeneration = Volatile.Read(ref range.WriteGeneration);
+                var keepProtect = range.Protect || protect;
                 DisarmLocked(range, "replace-range");
                 _rangesByAddress.Remove(address);
                 range = new TrackedRange
@@ -167,6 +260,7 @@ public static unsafe class GuestImageWriteTracker
                     ByteCount = byteCount,
                     Start = start,
                     End = start + length,
+                    Protect = keepProtect,
                     WriteGeneration = writeGeneration,
                 };
                 _rangesByAddress[address] = range;
@@ -181,6 +275,7 @@ public static unsafe class GuestImageWriteTracker
                     ByteCount = byteCount,
                     Start = start,
                     End = start + length,
+                    Protect = protect,
                     TraceLifetime =
                         ShouldTraceRange(start, start + length) || ShouldTraceSource(source),
                     SourceSequence = sourceSequence,
@@ -192,13 +287,22 @@ public static unsafe class GuestImageWriteTracker
             else
             {
                 FlushPendingFirstCpuWrite(range);
+                // Protect is sticky: a later watch-only Track (texture cache)
+                // must not disarm an RT that already needs page faults.
+                if (protect && !range.Protect)
+                {
+                    range.Protect = true;
+                }
             }
 
             range.SourceSequence = sourceSequence;
             range.Source = source;
             range.TraceLifetime =
                 ShouldTraceRange(range.Start, range.End) || ShouldTraceSource(source);
-            ArmLocked(range, "arm");
+            if (range.Protect)
+            {
+                ArmLocked(range, "arm");
+            }
         }
     }
 
@@ -277,7 +381,8 @@ public static unsafe class GuestImageWriteTracker
 
         lock (_gate)
         {
-            if (_rangesByAddress.TryGetValue(address, out var range))
+            if (_rangesByAddress.TryGetValue(address, out var range) &&
+                range.Protect)
             {
                 ArmLocked(range, "rearm");
             }
@@ -445,10 +550,7 @@ public static unsafe class GuestImageWriteTracker
         }
 
         if (needsUnprotect &&
-            Mprotect(
-                (nint)writableStart,
-                (nuint)(writableEnd - writableStart),
-                ProtRead | ProtWrite) != 0)
+            !TrySetProtection(writableStart, writableEnd - writableStart, writable: true))
         {
             return false;
         }
@@ -462,7 +564,11 @@ public static unsafe class GuestImageWriteTracker
             }
 
             var wasArmed = Interlocked.Exchange(ref range.Armed, 0) != 0;
-            if (wasArmed)
+            var wasDirty = Interlocked.Exchange(ref range.Dirty, 1) != 0;
+            // Protected ranges bump generation once per arm/fault cycle.
+            // Watch-only ranges never arm, so bump on the first dirty mark
+            // (NotifyManagedWrite) so cache owners still see a rewrite.
+            if (wasArmed || (!range.Protect && !wasDirty))
             {
                 Interlocked.Increment(ref range.WriteGeneration);
             }
@@ -480,8 +586,6 @@ public static unsafe class GuestImageWriteTracker
                 Volatile.Write(ref range.PendingFirstCpuWrite, 1);
                 Volatile.Write(ref range.FirstCpuWriteSeen, 2);
             }
-
-            Volatile.Write(ref range.Dirty, 1);
         }
 
         return true;
@@ -497,10 +601,7 @@ public static unsafe class GuestImageWriteTracker
 
         // A new publication/rearm starts a new first-write lifetime.
         Volatile.Write(ref range.FirstCpuWriteSeen, 0);
-        var failed = Mprotect(
-            (nint)range.Start,
-            (nuint)(range.End - range.Start),
-            ProtRead) != 0;
+        var failed = !TrySetProtection(range.Start, range.End - range.Start, writable: false);
         if (failed)
         {
             Volatile.Write(ref range.Armed, 0);
@@ -520,10 +621,7 @@ public static unsafe class GuestImageWriteTracker
         var wasArmed = Interlocked.Exchange(ref range.Armed, 0) == 1;
         if (wasArmed)
         {
-            _ = Mprotect(
-                (nint)range.Start,
-                (nuint)(range.End - range.Start),
-                ProtRead | ProtWrite);
+            _ = TrySetProtection(range.Start, range.End - range.Start, writable: true);
         }
 
         if (range.TraceLifetime)
@@ -534,7 +632,13 @@ public static unsafe class GuestImageWriteTracker
 
     private static void RebuildSnapshotLocked()
     {
-        Volatile.Write(ref _rangeSnapshot, new RangeSnapshot(_rangesByAddress.Values.ToArray()));
+        // Fault / NotifyManagedWrite hot paths must only see protected ranges.
+        // Watch-only texture-cache registrations used to widen Start..End across
+        // nearly all GPU memory so every managed guest write walked this path.
+        var protectedRanges = _rangesByAddress.Values
+            .Where(static range => range.Protect)
+            .ToArray();
+        Volatile.Write(ref _rangeSnapshot, new RangeSnapshot(protectedRanges));
     }
 
     private static (ulong Start, ulong Length) PageAlign(ulong address, ulong byteCount)
@@ -679,8 +783,35 @@ public static unsafe class GuestImageWriteTracker
             $"fault=0x{faultAddress:X16} page=0x{faultPage:X16}");
     }
 
+    private static bool TrySetProtection(ulong start, ulong length, bool writable)
+    {
+        if (length == 0)
+        {
+            return true;
+        }
+
+        if (OperatingSystem.IsWindows())
+        {
+            return VirtualProtect(
+                (nint)start,
+                (nuint)length,
+                writable ? PageReadWrite : PageReadonly,
+                out _) != 0;
+        }
+
+        return Mprotect(
+            (nint)start,
+            (nuint)length,
+            writable ? ProtRead | ProtWrite : ProtRead) == 0;
+    }
+
     private static long GetMonotonicNanoseconds()
     {
+        if (OperatingSystem.IsWindows())
+        {
+            return Stopwatch.GetTimestamp() * 1_000_000_000L / Stopwatch.Frequency;
+        }
+
         Timespec time;
         return ClockGetTime(ClockMonotonicRaw, &time) == 0
             ? unchecked((time.Seconds * 1_000_000_000L) + time.Nanoseconds)

src/SharpEmu.HLE/GuestThreadExecution.cs

@@ -221,6 +221,29 @@ public static class GuestThreadExecution
 
     public static IGuestThreadScheduler? Scheduler { get; set; }
 
+    /// <summary>
+    /// Fired when a guest thread is torn down without a clean pthread_exit
+    /// (e.g. TBB execute-AV → worker_abort). Libs use this to abandon mutexes.
+    /// </summary>
+    public static event Func<ulong, string, int>? GuestThreadAbandoned;
+
+    public static int NotifyGuestThreadAbandoned(ulong threadHandle, string reason)
+    {
+        if (threadHandle == 0 || GuestThreadAbandoned is null)
+        {
+            return 0;
+        }
+
+        try
+        {
+            return GuestThreadAbandoned.Invoke(threadHandle, reason);
+        }
+        catch
+        {
+            return 0;
+        }
+    }
+
     public static bool IsGuestThread => _currentGuestThreadHandle != 0;
 
     public static ulong CurrentGuestThreadHandle => _currentGuestThreadHandle;

src/SharpEmu.HLE/Host/IHostAudioOutput.cs

@@ -19,5 +19,11 @@ public interface IHostAudioOutput
     /// Throws when the host has no usable output device; callers degrade to a silent
     /// port and pace the guest instead.
     /// </summary>
-    IHostAudioStream OpenStereoPcm16Stream(uint sampleRate);
+    /// <param name="sampleRate">Host stream sample rate in Hz.</param>
+    /// <param name="maxQueuedPcmBytes">
+    /// Soft backpressure cap for queued stereo PCM16. Default 32 KiB (~171 ms at
+    /// 48 kHz) matches classic AudioOut latency. Bursty AudioOut2 / FMOD feeders
+    /// may pass a deeper cap to avoid underruns.
+    /// </param>
+    IHostAudioStream OpenStereoPcm16Stream(uint sampleRate, int maxQueuedPcmBytes = 32 * 1024);
 }

src/SharpEmu.HLE/Host/Posix/PosixAlsaAudioStream.cs

@@ -14,9 +14,6 @@ namespace SharpEmu.HLE.Host.Posix;
 /// </summary>
 internal sealed unsafe class PosixAlsaAudioStream : IHostAudioStream
 {
-    // 32KB of stereo PCM16 at 48kHz is ~170ms; keep the same device-side
-    // queue depth the WinMM/CoreAudio ports enforce in managed code.
-    private const uint DeviceLatencyMicroseconds = 170_000;
     private const int StreamPlayback = 0;
     private const int FormatS16LittleEndian = 2;
     private const int AccessReadWriteInterleaved = 3;
@@ -27,7 +24,7 @@ internal sealed unsafe class PosixAlsaAudioStream : IHostAudioStream
     private nint _pcm;
     private bool _disposed;
 
-    public PosixAlsaAudioStream(uint sampleRate)
+    public PosixAlsaAudioStream(uint sampleRate, int maxQueuedPcmBytes = 32 * 1024)
     {
         if (!OperatingSystem.IsLinux())
         {
@@ -47,6 +44,14 @@ internal sealed unsafe class PosixAlsaAudioStream : IHostAudioStream
                 $"snd_pcm_open(\"{device}\") failed: {DescribeError(status)}.");
         }
 
+        // Match WinMM/CoreAudio soft queue depth: 32 KiB stereo PCM16 @ 48 kHz
+        // is ~170 ms. AudioOut2 may request a deeper bed.
+        var queuedBytes = Math.Max(maxQueuedPcmBytes, 4 * 1024);
+        var latencyMicroseconds = (uint)Math.Clamp(
+            (long)queuedBytes * 1_000_000L / Math.Max(sampleRate * 4u, 1u),
+            20_000L,
+            2_000_000L);
+
         status = snd_pcm_set_params(
             _pcm,
             FormatS16LittleEndian,
@@ -54,7 +59,7 @@ internal sealed unsafe class PosixAlsaAudioStream : IHostAudioStream
             2,
             sampleRate,
             1,
-            DeviceLatencyMicroseconds);
+            latencyMicroseconds);
         if (status != 0)
         {
             _ = snd_pcm_close(_pcm);

src/SharpEmu.HLE/Host/Posix/PosixCoreAudioStream.cs

@@ -13,11 +13,11 @@ namespace SharpEmu.HLE.Host.Posix;
 /// </summary>
 internal sealed unsafe class PosixCoreAudioStream : IHostAudioStream
 {
-    private const int MaximumQueuedPcmBytes = 32 * 1024;
     private const uint FormatLinearPcm = 0x6C70636D; // 'lpcm'
     private const uint FlagIsSignedInteger = 0x4;
     private const uint FlagIsPacked = 0x8;
 
+    private readonly int _maximumQueuedPcmBytes;
     private readonly object _gate = new();
     private readonly AutoResetEvent _completion = new(false);
     private readonly Queue<nint> _freeBuffers = new();
@@ -27,13 +27,15 @@ internal sealed unsafe class PosixCoreAudioStream : IHostAudioStream
     private bool _started;
     private bool _disposed;
 
-    public PosixCoreAudioStream(uint sampleRate)
+    public PosixCoreAudioStream(uint sampleRate, int maxQueuedPcmBytes = 32 * 1024)
     {
         if (!OperatingSystem.IsMacOS())
         {
             throw new PlatformNotSupportedException("CoreAudio is only available on macOS.");
         }
 
+        _maximumQueuedPcmBytes = Math.Max(maxQueuedPcmBytes, 4 * 1024);
+
         var format = new AudioStreamBasicDescription
         {
             SampleRate = sampleRate,
@@ -73,7 +75,7 @@ internal sealed unsafe class PosixCoreAudioStream : IHostAudioStream
 
             var outputLength = stereoPcm16.Length;
             while (_queuedPcmBytes != 0 &&
-                   _queuedPcmBytes + outputLength > MaximumQueuedPcmBytes)
+                   _queuedPcmBytes + outputLength > _maximumQueuedPcmBytes)
             {
                 Monitor.Exit(_gate);
                 try

src/SharpEmu.HLE/Host/Posix/PosixHostAudio.cs

@@ -12,10 +12,10 @@ internal sealed class PosixHostAudio : IHostAudioOutput
 {
     public string BackendName => OperatingSystem.IsMacOS() ? "coreaudio" : "alsa";
 
-    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate)
+    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate, int maxQueuedPcmBytes = 32 * 1024)
     {
         return OperatingSystem.IsMacOS()
-            ? new PosixCoreAudioStream(sampleRate)
-            : new PosixAlsaAudioStream(sampleRate);
+            ? new PosixCoreAudioStream(sampleRate, maxQueuedPcmBytes)
+            : new PosixAlsaAudioStream(sampleRate, maxQueuedPcmBytes);
     }
 }

src/SharpEmu.HLE/Host/Windows/WindowsWaveOutAudio.cs

@@ -9,7 +9,8 @@ internal sealed partial class WindowsWaveOutAudio : IHostAudioOutput
 {
     public string BackendName => "winmm";
 
-    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate) => new WaveOutStream(sampleRate);
+    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate, int maxQueuedPcmBytes = 32 * 1024) =>
+        new WaveOutStream(sampleRate, maxQueuedPcmBytes);
 
     private sealed partial class WaveOutStream : IHostAudioStream
     {
@@ -17,8 +18,8 @@ internal sealed partial class WindowsWaveOutAudio : IHostAudioOutput
         private const uint CallbackEvent = 0x0005_0000;
         private const ushort WaveFormatPcm = 1;
         private const uint WaveHeaderDone = 0x0000_0001;
-        private const int MaximumQueuedPcmBytes = 32 * 1024;
 
+        private readonly int _maximumQueuedPcmBytes;
         private readonly object _gate = new();
         private readonly AutoResetEvent _completion = new(false);
         private readonly Queue<NativeBuffer> _buffers = new();
@@ -26,8 +27,9 @@ internal sealed partial class WindowsWaveOutAudio : IHostAudioOutput
         private int _queuedPcmBytes;
         private bool _disposed;
 
-        public WaveOutStream(uint sampleRate)
+        public WaveOutStream(uint sampleRate, int maxQueuedPcmBytes)
         {
+            _maximumQueuedPcmBytes = Math.Max(maxQueuedPcmBytes, 4 * 1024);
             var format = new WaveFormat
             {
                 FormatTag = WaveFormatPcm,
@@ -62,7 +64,7 @@ internal sealed partial class WindowsWaveOutAudio : IHostAudioOutput
 
                 ReapCompletedBuffers();
                 while (_queuedPcmBytes != 0 &&
-                       _queuedPcmBytes + stereoPcm16.Length > MaximumQueuedPcmBytes)
+                       _queuedPcmBytes + stereoPcm16.Length > _maximumQueuedPcmBytes)
                 {
                     if (!_completion.WaitOne(TimeSpan.FromSeconds(1)))
                     {

src/SharpEmu.Libs/Acm/AcmExports.cs

@@ -0,0 +1,44 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Acm;
+
+public static class AcmExports
+{
+    private static int _nextContextHandle;
+
+    [SysAbiExport(
+        Nid = "ZIXln2K3XMk",
+        ExportName = "sceAcmContextCreate",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAcm")]
+    public static int AcmContextCreate(CpuContext ctx)
+    {
+        var outContextAddress = ctx[CpuRegister.Rdi];
+        if (outContextAddress == 0)
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        var handle = (ulong)Interlocked.Increment(ref _nextContextHandle);
+        Span<byte> handleBytes = stackalloc byte[sizeof(ulong)];
+        BinaryPrimitives.WriteUInt64LittleEndian(handleBytes, handle);
+        return ctx.Memory.TryWrite(outContextAddress, handleBytes)
+            ? ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK)
+            : ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    [SysAbiExport(
+        Nid = "jBgBjAj02R8",
+        ExportName = "sceAcmContextDestroy",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAcm")]
+    public static int AcmContextDestroy(CpuContext ctx)
+    {
+        _ = ctx;
+        return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+}

src/SharpEmu.Libs/Agc/AgcIndexHelpers.cs

@@ -0,0 +1,49 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.Agc;
+
+/// <summary>Prospero/AGC IndexType helpers (gpu_defs / renderDraw index8 expand).</summary>
+internal static class AgcIndexHelpers
+{
+    internal enum ProsperoIndexType : uint
+    {
+        Index16 = 0,
+        Index32 = 1,
+        Index8 = 2,
+    }
+
+    internal static ProsperoIndexType Decode(uint raw) =>
+        (raw & 0x3u) switch
+        {
+            1 => ProsperoIndexType.Index32,
+            2 => ProsperoIndexType.Index8,
+            _ => ProsperoIndexType.Index16,
+        };
+
+    internal static int GetGuestStrideBytes(ProsperoIndexType indexType) =>
+        indexType switch
+        {
+            ProsperoIndexType.Index32 => sizeof(uint),
+            ProsperoIndexType.Index8 => sizeof(byte),
+            _ => sizeof(ushort),
+        };
+
+    /// <summary>Expand guest u8 indices to host u16 (Vulkan/Metal bindable).</summary>
+    internal static void ExpandIndex8ToU16(ReadOnlySpan<byte> source, Span<byte> destination)
+    {
+        if (destination.Length < source.Length * sizeof(ushort))
+        {
+            throw new ArgumentException("destination too small for u8->u16 expansion.");
+        }
+
+        for (var index = 0; index < source.Length; index++)
+        {
+            BinaryPrimitives.WriteUInt16LittleEndian(
+                destination.Slice(index * sizeof(ushort), sizeof(ushort)),
+                source[index]);
+        }
+    }
+}

src/SharpEmu.Libs/Agc/AgcPrimitiveHelpers.cs

@@ -0,0 +1,107 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.Libs.Agc;
+
+/// <summary>
+/// Shared Prospero/AGC primitive-type helpers (renderDraw / gpu_defs).
+/// </summary>
+internal static class AgcPrimitiveHelpers
+{
+    internal const uint PrimitiveRectList = 7;
+    internal const uint PrimitiveRectListLegacy = 0x11;
+
+    internal enum GsOutputPrimitiveType : uint
+    {
+        Points = 0,
+        Lines = 1,
+        Triangles = 2,
+        Rectangle2D = 3,
+        RectList = 4,
+    }
+
+    internal static bool IsRectListPrimitive(uint primitiveType) =>
+        primitiveType is PrimitiveRectList or PrimitiveRectListLegacy;
+
+    /// <summary>
+    /// Maps draw prim type to VGT_GS_OUT_PRIM_TYPE when NGG is not enabled
+    /// on the GS (GraphicsPrimitiveTypeToGsOut).
+    /// </summary>
+    internal static uint PrimitiveTypeToGsOut(uint primitiveType) =>
+        primitiveType switch
+        {
+            1 => (uint)GsOutputPrimitiveType.Points, // PointList
+            2 or 3 or 10 or 11 or 18 => (uint)GsOutputPrimitiveType.Lines,
+            PrimitiveRectList => (uint)GsOutputPrimitiveType.Rectangle2D,
+            PrimitiveRectListLegacy => (uint)GsOutputPrimitiveType.RectList,
+            _ => (uint)GsOutputPrimitiveType.Triangles,
+        };
+
+    /// <summary>
+    /// Rect-list auto-draw topology selection.
+    /// NGG single-rect UI quads (DualSense prompts) submit count 1/3/4 and
+    /// must become a 4-vert triangle strip — even when the VS has embedded
+    /// vertex-buffer fetches (those still show up as host VBs). Indexed and
+    /// larger auto counts stay triangle list so the loading video is safe.
+    /// </summary>
+    internal static bool ShouldDrawRectListAsTriangleStrip(
+        uint primitiveType,
+        bool indexed,
+        uint vertexCount,
+        bool hasVertexBuffers = false)
+    {
+        _ = hasVertexBuffers;
+        if (indexed || !IsRectListPrimitive(primitiveType))
+        {
+            return false;
+        }
+
+        if (primitiveType == PrimitiveRectListLegacy)
+        {
+            return true;
+        }
+
+        // NGG kRectList: strip for auto + ngg_rectlist_draw.
+        // Restrict to the single-rect counts GTA UI actually submits.
+        return vertexCount is 1 or 3 or 4;
+    }
+
+    /// <summary>
+    /// Host vertex count for auto rect-list draws that expand to a strip.
+    /// NGG single-rect: always 4. Legacy 0x11: 3 -> 4.
+    /// </summary>
+    internal static uint GetRectListDrawVertexCount(
+        uint primitiveType,
+        uint vertexCount,
+        bool indexed,
+        bool hasVertexBuffers = false)
+    {
+        if (!ShouldDrawRectListAsTriangleStrip(
+                primitiveType,
+                indexed,
+                vertexCount,
+                hasVertexBuffers))
+        {
+            return vertexCount;
+        }
+
+        if (primitiveType == PrimitiveRectList)
+        {
+            return 4;
+        }
+
+        if (primitiveType == PrimitiveRectListLegacy && vertexCount == 3)
+        {
+            return 4;
+        }
+
+        return vertexCount;
+    }
+
+    /// <summary>
+    /// Legacy helper — prefer
+    /// <see cref="ShouldDrawRectListAsTriangleStrip"/>.
+    /// </summary>
+    internal static bool IsRectListTriangleStrip(uint primitiveType) =>
+        IsRectListPrimitive(primitiveType);
+}

src/SharpEmu.Libs/Agc/AgcVertexMetadata.cs

@@ -0,0 +1,788 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.ShaderCompiler;
+
+namespace SharpEmu.Libs.Agc;
+
+/// <summary>
+/// AGC embedded vertex metadata. Locates
+/// PtrVertexBufferTable / PtrVertexAttribDescTable and builds authoritative
+/// attribute layouts that draw translation merges onto IR-discovered fetches.
+/// </summary>
+internal static class AgcVertexMetadata
+{
+    private const ushort IllegalDirectOffset = 0xFFFF;
+    private const ulong ShaderUserDataOffset = 0x08;
+    private const ulong ShaderInputSemanticsOffset = 0x30;
+    private const ulong ShaderNumInputSemanticsOffset = 0x50;
+
+    internal enum AgcDirectResourceType : uint
+    {
+        PtrVertexBufferTable = 8,
+        PtrVertexAttribDescTable = 10,
+        Last = PtrVertexAttribDescTable,
+    }
+
+    internal readonly record struct VertexTableRegisters(
+        int VertexBufferReg,
+        int VertexAttribReg,
+        uint InputSemanticsCount,
+        ulong InputSemanticsAddress);
+
+    /// <summary>
+    /// One AGC attrib-table resource.
+    /// Representation: <see cref="SharpBase"/> is the V# base; attribute byte
+    /// offset is applied as <see cref="OffsetBytes"/> (Vulkan bind offset),
+    /// not folded into the base — avoids double-counting when the IR prolog
+    /// already bumped the sharp address.
+    /// </summary>
+    internal readonly record struct MetadataVertexResource(
+        uint Location,
+        uint Semantic,
+        uint HardwareMapping,
+        uint SizeInElements,
+        ulong SharpBase,
+        uint Stride,
+        uint OffsetBytes,
+        uint DataFormat,
+        uint NumberFormat,
+        uint ComponentCount,
+        bool PerInstance);
+
+    /// <summary>
+    /// Reads AGC user-data direct-resource offsets for the ES header mapped to
+    /// <paramref name="shaderCodeAddress"/>. Returns false when the header is
+    /// unknown or the tables are absent (attribute-less clears).
+    /// </summary>
+    internal static bool TryGetVertexTableRegisters(
+        CpuContext ctx,
+        ulong shaderCodeAddress,
+        ulong shaderHeaderAddress,
+        out VertexTableRegisters registers)
+    {
+        registers = new VertexTableRegisters(-1, -1, 0, 0);
+        if (shaderHeaderAddress == 0 ||
+            !TryReadUInt64(ctx, shaderHeaderAddress + ShaderUserDataOffset, out var userDataAddress) ||
+            userDataAddress == 0)
+        {
+            return false;
+        }
+
+        // ShaderUserData layout:
+        //   0x00: uint16_t* direct_resource_offset
+        //   0x08: sharp_resource_offset[4]
+        //   0x28: eud_size_dw, srt_size_dw
+        //   0x2C: direct_resource_count
+        if (!TryReadUInt64(ctx, userDataAddress, out var directResourceOffset) ||
+            !TryReadUInt16(ctx, userDataAddress + 0x2C, out var directResourceCount))
+        {
+            return false;
+        }
+
+        var maxTypes = (uint)AgcDirectResourceType.Last + 1u;
+        if (directResourceCount > maxTypes || directResourceOffset == 0)
+        {
+            return false;
+        }
+
+        var vertexBufferReg = -1;
+        var vertexAttribReg = -1;
+        for (uint type = 0; type < directResourceCount; type++)
+        {
+            if (!TryReadUInt16(
+                    ctx,
+                    directResourceOffset + (type * sizeof(ushort)),
+                    out var reg) ||
+                reg == IllegalDirectOffset)
+            {
+                continue;
+            }
+
+            switch ((AgcDirectResourceType)type)
+            {
+                case AgcDirectResourceType.PtrVertexBufferTable:
+                    vertexBufferReg = reg;
+                    break;
+                case AgcDirectResourceType.PtrVertexAttribDescTable:
+                    vertexAttribReg = reg;
+                    break;
+            }
+        }
+
+        if (vertexBufferReg < 0 || vertexAttribReg < 0)
+        {
+            return false;
+        }
+
+        if (!TryReadUInt64(
+                ctx,
+                shaderHeaderAddress + ShaderInputSemanticsOffset,
+                out var inputSemanticsAddress) ||
+            !TryReadUInt32(
+                ctx,
+                shaderHeaderAddress + ShaderNumInputSemanticsOffset,
+                out var inputSemanticsCount) ||
+            inputSemanticsCount == 0 ||
+            inputSemanticsAddress == 0)
+        {
+            return false;
+        }
+
+        registers = new VertexTableRegisters(
+            vertexBufferReg,
+            vertexAttribReg,
+            inputSemanticsCount,
+            inputSemanticsAddress);
+        return true;
+    }
+
+    /// <summary>
+    /// Builds attrib resources from AGC input_semantics + tables.
+    /// ShaderSemantic packing:
+    ///   bits [7:0]   semantic          → attrib table index
+    ///   bits [15:8]  hardware_mapping  → VGPR destination
+    ///   bits [19:16] size_in_elements
+    /// </summary>
+    internal static bool TryBuildVertexResourcesFromMetadata(
+        CpuContext ctx,
+        IReadOnlyList<uint> scalarRegisters,
+        VertexTableRegisters tables,
+        out IReadOnlyList<MetadataVertexResource> resources)
+    {
+        resources = Array.Empty<MetadataVertexResource>();
+        if (tables.VertexAttribReg < 0 ||
+            tables.VertexBufferReg < 0 ||
+            tables.VertexAttribReg + 1 >= scalarRegisters.Count ||
+            tables.VertexBufferReg + 1 >= scalarRegisters.Count ||
+            tables.InputSemanticsCount == 0)
+        {
+            return false;
+        }
+
+        var attribTable =
+            ((ulong)scalarRegisters[tables.VertexAttribReg + 1] << 32) |
+            scalarRegisters[tables.VertexAttribReg];
+        var bufferTable =
+            ((ulong)scalarRegisters[tables.VertexBufferReg + 1] << 32) |
+            scalarRegisters[tables.VertexBufferReg];
+        if (attribTable == 0 || bufferTable == 0)
+        {
+            return false;
+        }
+
+        var built = new List<MetadataVertexResource>((int)tables.InputSemanticsCount);
+        for (uint i = 0; i < tables.InputSemanticsCount; i++)
+        {
+            if (!TryReadUInt32(
+                    ctx,
+                    tables.InputSemanticsAddress + (i * sizeof(uint)),
+                    out var semanticWord))
+            {
+                return false;
+            }
+
+            // Attrib index is semantic bits [7:0], not hardware_mapping.
+            var semantic = semanticWord & 0xFFu;
+            var hardwareMapping = (semanticWord >> 8) & 0xFFu;
+            var sizeInElements = (semanticWord >> 16) & 0xFu;
+            if (!TryReadUInt32(ctx, attribTable + (semantic * sizeof(uint)), out var attribWord))
+            {
+                return false;
+            }
+
+            // Attrib dword: buffer index [4:0], format [13:5], offset [25:14], fetch [26].
+            var bufferIndex = attribWord & 0x1Fu;
+            var format = (attribWord >> 5) & 0x1FFu;
+            var offset = (attribWord >> 14) & 0xFFFu;
+            var fetchIndex = (attribWord >> 26) & 0x1u;
+            var sharpAddress = bufferTable + (bufferIndex * 16u);
+            if (!TryReadUInt32(ctx, sharpAddress, out var sharp0) ||
+                !TryReadUInt32(ctx, sharpAddress + 4, out var sharp1))
+            {
+                return false;
+            }
+
+            var sharpBase = sharp0 | ((ulong)(sharp1 & 0xFFFFu) << 32);
+            var stride = (sharp1 >> 16) & 0x3FFFu;
+            if (sharpBase == 0 || stride == 0)
+            {
+                continue;
+            }
+
+            var fallbackComponents = sizeInElements != 0 ? sizeInElements : 4u;
+            var (dataFormat, numberFormat, components) =
+                MapAttribFormat(format, fallbackComponents);
+            built.Add(new MetadataVertexResource(
+                Location: i,
+                Semantic: semantic,
+                HardwareMapping: hardwareMapping,
+                SizeInElements: sizeInElements,
+                SharpBase: sharpBase,
+                Stride: stride,
+                OffsetBytes: offset,
+                DataFormat: dataFormat,
+                NumberFormat: numberFormat,
+                ComponentCount: components,
+                PerInstance: fetchIndex != 0));
+        }
+
+        if (built.Count == 0)
+        {
+            return false;
+        }
+
+        resources = built;
+        return true;
+    }
+
+    /// <summary>
+    /// Patch IR-discovered fetches from the attrib table onto the V# format/offset.
+    /// Prefer 1:1 Location pairing when counts match on one interleaved stream
+    /// (GTA UI glyphs). Otherwise match by stride + byte offset. Never rebases
+    /// BaseAddress/Data/Location/Pc/PerInstance.
+    /// </summary>
+    internal static IReadOnlyList<Gen5VertexInputBinding> MergeVertexInputsFromMetadata(
+        CpuContext ctx,
+        IReadOnlyList<uint> scalarRegisters,
+        VertexTableRegisters tables,
+        IReadOnlyList<Gen5VertexInputBinding> discovered)
+    {
+        if (discovered.Count == 0 ||
+            !TryBuildVertexResourcesFromMetadata(
+                ctx,
+                scalarRegisters,
+                tables,
+                out var resources))
+        {
+            return discovered;
+        }
+
+        if (TryMergeByLocationPairing(discovered, resources, out var paired))
+        {
+            return paired;
+        }
+
+        var merged = new List<Gen5VertexInputBinding>(discovered.Count);
+        var usedResources = new bool[resources.Count];
+        var changed = false;
+        foreach (var input in discovered)
+        {
+            if (!TryMatchMetadataResource(input, resources, usedResources, out var resource, out var fillOffset))
+            {
+                merged.Add(input);
+                continue;
+            }
+
+            var refined = ApplyMetadataFormat(input, resource, fillOffset);
+            changed |= refined != input;
+            merged.Add(refined);
+        }
+
+        return changed ? merged : discovered;
+    }
+
+    /// <summary>
+    /// When discovery and metadata describe the same interleaved stream with
+    /// equal attribute counts, pair by sorted Location (semantic order).
+    /// Keeps each binding's Pc/Location for SPIR-V; overlays format + offset.
+    /// </summary>
+    private static bool TryMergeByLocationPairing(
+        IReadOnlyList<Gen5VertexInputBinding> discovered,
+        IReadOnlyList<MetadataVertexResource> resources,
+        out IReadOnlyList<Gen5VertexInputBinding> merged)
+    {
+        merged = discovered;
+        if (discovered.Count != resources.Count || discovered.Count == 0)
+        {
+            return false;
+        }
+
+        var orderedInputs = discovered.OrderBy(static input => input.Location).ToArray();
+        var orderedResources = resources.OrderBy(static resource => resource.Location).ToArray();
+        var streamBase = orderedResources[0].SharpBase;
+        var streamStride = orderedResources[0].Stride;
+        for (var index = 0; index < orderedResources.Length; index++)
+        {
+            var resource = orderedResources[index];
+            var input = orderedInputs[index];
+            if (resource.SharpBase != streamBase ||
+                resource.Stride != streamStride ||
+                (input.Stride != 0 && input.Stride != streamStride) ||
+                !IsSameVertexStream(input, resource))
+            {
+                return false;
+            }
+        }
+
+        var byPc = new Dictionary<uint, Gen5VertexInputBinding>(discovered.Count);
+        var changed = false;
+        for (var index = 0; index < orderedInputs.Length; index++)
+        {
+            var input = orderedInputs[index];
+            var resource = orderedResources[index];
+            var fillOffset = input.BaseAddress == resource.SharpBase ||
+                             IsAddressInsideCapturedSpan(input, resource.SharpBase);
+            var refined = ApplyMetadataFormat(input, resource, fillOffset);
+            changed |= refined != input;
+            byPc[input.Pc] = refined;
+        }
+
+        if (!changed)
+        {
+            return false;
+        }
+
+        var result = new Gen5VertexInputBinding[discovered.Count];
+        for (var index = 0; index < discovered.Count; index++)
+        {
+            result[index] = byPc[discovered[index].Pc];
+        }
+
+        merged = result;
+        return true;
+    }
+
+    private static Gen5VertexInputBinding ApplyMetadataFormat(
+        Gen5VertexInputBinding input,
+        MetadataVertexResource resource,
+        bool fillOffsetBytes)
+    {
+        var components = input.ComponentCount != 0 &&
+                         input.ComponentCount < resource.ComponentCount
+            ? input.ComponentCount
+            : resource.ComponentCount;
+
+        return input with
+        {
+            DataFormat = resource.DataFormat,
+            NumberFormat = resource.NumberFormat,
+            ComponentCount = components,
+            OffsetBytes = fillOffsetBytes ? resource.OffsetBytes : input.OffsetBytes,
+        };
+    }
+
+    /// <summary>
+    /// Legacy entry point — forwards to <see cref="MergeVertexInputsFromMetadata"/>.
+    /// </summary>
+    internal static IReadOnlyList<Gen5VertexInputBinding> RefineVertexInputs(
+        CpuContext ctx,
+        IReadOnlyList<uint> scalarRegisters,
+        VertexTableRegisters tables,
+        IReadOnlyList<Gen5VertexInputBinding> discovered) =>
+        MergeVertexInputsFromMetadata(ctx, scalarRegisters, tables, discovered);
+
+    /// <summary>
+    /// Collects SBufferLoad / SLoad PCs that read the AGC attrib or buffer
+    /// tables (embedded-fetch prolog). Those loads are executed on the
+    /// CPU during scalar evaluation; once vertex inputs are bound they must
+    /// not run again as live SSBOs on the GPU.
+    /// </summary>
+    internal static HashSet<uint> CollectFetchPrologPcs(
+        Gen5ShaderProgram program,
+        VertexTableRegisters tables)
+    {
+        var pcs = new HashSet<uint>();
+        if (tables.VertexAttribReg < 0 || tables.VertexBufferReg < 0)
+        {
+            return pcs;
+        }
+
+        var tableRegs = new HashSet<uint>
+        {
+            (uint)tables.VertexAttribReg,
+            (uint)tables.VertexAttribReg + 1u,
+            (uint)tables.VertexBufferReg,
+            (uint)tables.VertexBufferReg + 1u,
+        };
+
+        foreach (var instruction in program.Instructions)
+        {
+            var isScalarLoad =
+                instruction.Opcode.StartsWith("SBufferLoad", StringComparison.Ordinal) ||
+                instruction.Opcode.StartsWith("SLoad", StringComparison.Ordinal);
+            if (!isScalarLoad)
+            {
+                continue;
+            }
+
+            // SMEM loads encode the scalar base pointer in Sources[0].
+            if (instruction.Sources.Count > 0 &&
+                instruction.Sources[0] is
+                {
+                    Kind: Gen5OperandKind.ScalarRegister,
+                    Value: var scalarBase,
+                } &&
+                tableRegs.Contains(scalarBase))
+            {
+                pcs.Add(instruction.Pc);
+                continue;
+            }
+
+            if (instruction.Control is Gen5BufferMemoryControl buffer &&
+                tableRegs.Contains(buffer.ScalarResource))
+            {
+                pcs.Add(instruction.Pc);
+            }
+        }
+
+        return pcs;
+    }
+
+    private static bool TryMatchMetadataResource(
+        Gen5VertexInputBinding input,
+        IReadOnlyList<MetadataVertexResource> resources,
+        bool[] usedResources,
+        out MetadataVertexResource resource,
+        out bool fillOffsetBytes)
+    {
+        resource = default;
+        fillOffsetBytes = false;
+        var bestScore = int.MinValue;
+        var bestIndex = -1;
+        var bestFillOffset = false;
+        for (var index = 0; index < resources.Count; index++)
+        {
+            if (usedResources[index])
+            {
+                continue;
+            }
+
+            var candidate = resources[index];
+            if (candidate.Stride != 0 &&
+                input.Stride != 0 &&
+                candidate.Stride != input.Stride)
+            {
+                continue;
+            }
+
+            if (!IsSameVertexStream(input, candidate))
+            {
+                continue;
+            }
+
+            var attrAddress = candidate.SharpBase + candidate.OffsetBytes;
+            var score = int.MinValue;
+            var fillOffset = false;
+
+            // Post-capture interleaved: shared BaseAddress, distinct OffsetBytes.
+            if (input.OffsetBytes == candidate.OffsetBytes &&
+                (input.BaseAddress == candidate.SharpBase ||
+                 IsAddressInsideCapturedSpan(input, candidate.SharpBase)))
+            {
+                score = 400;
+            }
+            // IR prolog baked attrib offset into the V# base.
+            else if (input.BaseAddress == attrAddress)
+            {
+                score = 350;
+            }
+            // Discovery never saw the attrib offset — only safe when this
+            // resource's offset uniquely identifies it among unused entries.
+            else if (input.BaseAddress == candidate.SharpBase &&
+                     input.OffsetBytes == 0 &&
+                     candidate.OffsetBytes != 0 &&
+                     IsUniqueUnusedOffset(resources, usedResources, candidate.OffsetBytes, index))
+            {
+                score = 300;
+                fillOffset = true;
+            }
+            else if (input.BaseAddress == candidate.SharpBase &&
+                     input.OffsetBytes == 0 &&
+                     candidate.OffsetBytes == 0)
+            {
+                score = 250;
+            }
+
+            if (score > bestScore)
+            {
+                bestScore = score;
+                bestIndex = index;
+                bestFillOffset = fillOffset;
+            }
+        }
+
+        // Require an offset-aware match. Bare SharpBase ties (score 250) are
+        // only accepted when a single unused resource remains for that stream.
+        if (bestIndex < 0 || bestScore < 300)
+        {
+            if (bestIndex < 0 || bestScore < 250)
+            {
+                return false;
+            }
+
+            var unusedSameStream = 0;
+            for (var index = 0; index < resources.Count; index++)
+            {
+                if (!usedResources[index] && IsSameVertexStream(input, resources[index]))
+                {
+                    unusedSameStream++;
+                }
+            }
+
+            if (unusedSameStream != 1)
+            {
+                return false;
+            }
+        }
+
+        usedResources[bestIndex] = true;
+        resource = resources[bestIndex];
+        fillOffsetBytes = bestFillOffset;
+        return true;
+    }
+
+    private static bool IsSameVertexStream(
+        Gen5VertexInputBinding input,
+        MetadataVertexResource resource)
+    {
+        if (input.BaseAddress == resource.SharpBase ||
+            input.BaseAddress == resource.SharpBase + resource.OffsetBytes)
+        {
+            return true;
+        }
+
+        return IsAddressInsideCapturedSpan(input, resource.SharpBase);
+    }
+
+    private static bool IsAddressInsideCapturedSpan(
+        Gen5VertexInputBinding input,
+        ulong address) =>
+        input.DataLength > 0 &&
+        address >= input.BaseAddress &&
+        address < input.BaseAddress + (ulong)input.DataLength;
+
+    private static bool IsUniqueUnusedOffset(
+        IReadOnlyList<MetadataVertexResource> resources,
+        bool[] usedResources,
+        uint offsetBytes,
+        int candidateIndex)
+    {
+        for (var index = 0; index < resources.Count; index++)
+        {
+            if (index == candidateIndex || usedResources[index])
+            {
+                continue;
+            }
+
+            if (resources[index].OffsetBytes == offsetBytes)
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// <summary>
+    /// Attrib-table format
+    /// fields are VertexAttribFormat; V# / Vulkan paths need BufferFormat.
+    /// Unknown values pass through (already BufferFormat).
+    /// </summary>
+    private static uint VertexAttribFormatToBufferFormat(uint format) =>
+        format switch
+        {
+            0 => 0,     // Invalid
+            4 => 1,     // k8UNorm
+            8 => 2,     // k8SNorm
+            12 => 3,    // k8UScaled
+            16 => 4,    // k8SScaled
+            20 => 5,    // k8UInt
+            24 => 6,    // k8SInt
+            28 => 7,    // k16UNorm
+            32 => 8,    // k16SNorm
+            36 => 9,    // k16UScaled
+            40 => 10,   // k16SScaled
+            44 => 11,   // k16UInt
+            48 => 12,   // k16SInt
+            52 => 13,   // k16Float
+            57 => 14,   // k8_8UNorm
+            61 => 15,   // k8_8SNorm
+            65 => 16,   // k8_8UScaled
+            69 => 17,   // k8_8SScaled
+            73 => 18,   // k8_8UInt
+            77 => 19,   // k8_8SInt
+            80 => 20,   // k32UInt
+            84 => 21,   // k32SInt
+            88 => 22,   // k32Float
+            93 => 23,   // k16_16UNorm
+            97 => 24,   // k16_16SNorm
+            101 => 25,  // k16_16UScaled
+            105 => 26,  // k16_16SScaled
+            109 => 27,  // k16_16UInt
+            113 => 28,  // k16_16SInt
+            117 => 29,  // k16_16Float
+            122 => 30,  // k11_11_10UNorm
+            126 => 31,
+            130 => 32,
+            134 => 33,
+            138 => 34,
+            142 => 35,
+            146 => 36,
+            150 => 37,  // k10_11_11UNorm
+            154 => 38,
+            158 => 39,
+            162 => 40,
+            166 => 41,
+            170 => 42,
+            174 => 43,
+            179 => 44,  // k2_10_10_10UNorm
+            183 => 45,
+            187 => 46,
+            191 => 47,
+            195 => 48,
+            199 => 49,
+            203 => 50,  // k10_10_10_2UNorm
+            207 => 51,
+            211 => 52,
+            215 => 53,
+            219 => 54,
+            223 => 55,
+            227 => 56,  // k8_8_8_8UNorm
+            231 => 57,
+            235 => 58,
+            239 => 59,
+            243 => 60,
+            247 => 61,
+            249 => 62,  // k32_32UInt
+            253 => 63,
+            257 => 64,  // k32_32Float
+            263 => 65,  // k16_16_16_16UNorm
+            267 => 66,
+            271 => 67,
+            275 => 68,
+            279 => 69,
+            283 => 70,
+            287 => 71,  // k16_16_16_16Float
+            290 => 72,  // k32_32_32UInt
+            294 => 73,
+            298 => 74,
+            303 => 75,  // k32_32_32_32UInt
+            307 => 76,
+            311 => 77,  // k32_32_32_32Float
+            _ => format,
+        };
+
+    /// <summary>
+    /// Maps Prospero attrib-table formats onto GNM (DataFormat, NumberFormat,
+    /// Components) for <c>ToVkVertexFormat</c>. Accepts VertexAttribFormat
+    /// or BufferFormat (pass-through). NumberFormat: 0 Unorm, 1 SNorm,
+    /// 2 UScaled, 3 SScaled, 4 UInt, 5 SInt, 7 Float.
+    /// </summary>
+    private static (uint DataFormat, uint NumberFormat, uint Components) MapAttribFormat(
+        uint attribFormat,
+        uint fallbackComponents)
+    {
+        // Prospero VertexAttribFormat quirks before BufferFormat conversion.
+        if (attribFormat == 113)
+        {
+            return (14, 7, 4); // R32G32B32A32_SFLOAT
+        }
+
+        if (attribFormat == 121)
+        {
+            return (5, 7, 2); // R16G16_SFLOAT
+        }
+
+        var bufferFormat = VertexAttribFormatToBufferFormat(attribFormat);
+
+        // Prospero::BufferFormat numeric values (gpu_defs.h).
+        return bufferFormat switch
+        {
+            1 => (1, 0, 1),   // k8UNorm
+            2 => (1, 1, 1),   // k8SNorm
+            3 => (1, 2, 1),   // k8UScaled
+            4 => (1, 3, 1),   // k8SScaled
+            5 => (1, 4, 1),   // k8UInt
+            6 => (1, 5, 1),   // k8SInt
+            7 => (2, 0, 1),   // k16UNorm
+            8 => (2, 1, 1),   // k16SNorm
+            9 => (2, 2, 1),   // k16UScaled
+            10 => (2, 3, 1),  // k16SScaled
+            11 => (2, 4, 1),  // k16UInt
+            12 => (2, 5, 1),  // k16SInt
+            13 => (2, 7, 1),  // k16Float
+            14 => (3, 0, 2),  // k8_8UNorm
+            15 => (3, 1, 2),  // k8_8SNorm
+            16 => (3, 2, 2),  // k8_8UScaled
+            17 => (3, 3, 2),  // k8_8SScaled
+            18 => (3, 4, 2),  // k8_8UInt
+            19 => (3, 5, 2),  // k8_8SInt
+            20 => (4, 4, 1),  // k32UInt
+            21 => (4, 5, 1),  // k32SInt
+            22 => (4, 7, 1),  // k32Float
+            23 => (5, 0, 2),  // k16_16UNorm
+            24 => (5, 1, 2),  // k16_16SNorm
+            25 => (5, 2, 2),  // k16_16UScaled
+            26 => (5, 3, 2),  // k16_16SScaled
+            27 => (5, 4, 2),  // k16_16UInt
+            28 => (5, 5, 2),  // k16_16SInt
+            29 => (5, 7, 2),  // k16_16Float
+            50 => (9, 0, 4),  // k10_10_10_2UNorm
+            51 => (9, 1, 4),  // k10_10_10_2SNorm
+            56 => (10, 0, 4), // k8_8_8_8UNorm
+            57 => (10, 1, 4), // k8_8_8_8SNorm
+            58 => (10, 2, 4), // k8_8_8_8UScaled
+            59 => (10, 3, 4), // k8_8_8_8SScaled
+            60 => (10, 4, 4), // k8_8_8_8UInt
+            61 => (10, 5, 4), // k8_8_8_8SInt
+            62 => (11, 4, 2), // k32_32UInt
+            63 => (11, 5, 2), // k32_32SInt
+            64 => (11, 7, 2), // k32_32Float
+            65 => (12, 0, 4), // k16_16_16_16UNorm
+            66 => (12, 1, 4), // k16_16_16_16SNorm
+            67 => (12, 2, 4), // k16_16_16_16UScaled
+            68 => (12, 3, 4), // k16_16_16_16SScaled
+            69 => (12, 4, 4), // k16_16_16_16UInt
+            70 => (12, 5, 4), // k16_16_16_16SInt
+            71 => (12, 7, 4), // k16_16_16_16Float
+            72 => (13, 4, 3), // k32_32_32UInt
+            73 => (13, 5, 3), // k32_32_32SInt
+            74 => (13, 7, 3), // k32_32_32Float
+            75 => (14, 4, 4), // k32_32_32_32UInt
+            76 => (14, 5, 4), // k32_32_32_32SInt
+            77 => (14, 7, 4), // k32_32_32_32Float
+            _ => (14, 7, Math.Clamp(fallbackComponents, 1u, 4u)),
+        };
+    }
+
+    private static bool TryReadUInt16(CpuContext ctx, ulong address, out ushort value)
+    {
+        Span<byte> buffer = stackalloc byte[2];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = System.Buffers.Binary.BinaryPrimitives.ReadUInt16LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryReadUInt32(CpuContext ctx, ulong address, out uint value)
+    {
+        Span<byte> buffer = stackalloc byte[4];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = System.Buffers.Binary.BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryReadUInt64(CpuContext ctx, ulong address, out ulong value)
+    {
+        Span<byte> buffer = stackalloc byte[8];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = System.Buffers.Binary.BinaryPrimitives.ReadUInt64LittleEndian(buffer);
+        return true;
+    }
+}

src/SharpEmu.Libs/Agc/GnmTiling.cs

@@ -1,8 +1,60 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Collections.Concurrent;
+using System.Runtime.CompilerServices;
+
 namespace SharpEmu.Libs.Agc;
 
+/// <summary>Which in-block address equation a <see cref="DetileParams"/> carries.</summary>
+internal enum DetileEquation
+{
+    /// <summary>Unsupported mode/format; caller must use the CPU path or raw upload.</summary>
+    None,
+
+    /// <summary>Exact AddrLib XOR equation (RDNA2 modes 1/5/9/24/27): factored X/Y terms.</summary>
+    ExactXor,
+
+    /// <summary>Other modes: a precomputed in-block Morton/standard element-offset table.</summary>
+    BlockTable,
+}
+
+/// <summary>
+/// Backend-agnostic description of how to deswizzle one surface, produced by
+/// <see cref="GnmTiling.GetDetileParams"/>. Holds only plain integers and small
+/// int[] tables — no host graphics-API types — so it can cross the guest-GPU
+/// backend seam and drive a Vulkan (SPIR-V) or Metal (MSL) detile compute kernel
+/// identically to the CPU <see cref="GnmTiling.TryDetile"/> fallback. The single
+/// shared addressing formula both consume is:
+/// <code>
+///   inBlockByte = Equation == ExactXor
+///       ? XByteTerm[x &amp; XMask] ^ YByteTerm[y &amp; YMask]
+///       : BlockTable[(y % BlockHeight) * BlockWidth + (x % BlockWidth)] * BytesPerElement;
+///   srcByte = ((y / BlockHeight) * BlocksPerRow + (x / BlockWidth)) * BlockBytes + inBlockByte;
+/// </code>
+/// </summary>
+internal readonly record struct DetileParams(
+    DetileEquation Equation,
+    int ElementsWide,
+    int ElementsHigh,
+    int BytesPerElement,
+    int BlockWidth,
+    int BlockHeight,
+    int BlockElements,
+    int BlockBytes,
+    int BlocksPerRow,
+    // ExactXor: within-block BYTE offset = XByteTerm[x & XMask] ^ YByteTerm[y & YMask].
+    int[] XByteTerm,
+    int XMask,
+    int[] YByteTerm,
+    int YMask,
+    // BlockTable: within-block ELEMENT offset = BlockTable[inBlockY * BlockWidth + inBlockX].
+    int[] BlockTable)
+{
+    /// <summary>False when the mode/format is not GPU-portable (Equation == None).</summary>
+    public bool IsSupported => Equation != DetileEquation.None;
+}
+
 /// <summary>
 /// Deswizzles RDNA2 (GFX10) tiled texture surfaces into linear layout so they
 /// can be uploaded to Vulkan. PS5 stores most textures in a swizzled layout
@@ -16,8 +68,11 @@ namespace SharpEmu.Libs.Agc;
 /// other D/R and pipe/bank-XOR modes stay opt-in while their complete AddrLib
 /// equations are being ported.
 /// </summary>
-internal static class GnmTiling
+internal static unsafe class GnmTiling
 {
+    private const int ParallelDetileElementThreshold = 512 * 512;
+    private const int MaxDetileWorkers = 4;
+
     // Oberon uses the 16-pipe / 8-pixel-packer RB+ topology. These are the
     // single-sample 64 KiB equations generated by AMD AddrLib for that exact
     // topology. Each entry describes one address bit as an XOR of X/Y bits.
@@ -90,6 +145,18 @@ internal static class GnmTiling
          Y(2), X(2), Y(3), X(3), Y(4), X(4), Y(5), X(5)],
     ];
 
+    // GFX10 256B_S: 8-bit micro-tile equation (low octet of the 4K_S pattern).
+    // The generic StandardSwizzle bit-interleave is a different layout and leaves
+    // a broken grid on Gen5 UI atlases that ship as Standard256B.
+    private static readonly AddressBit[][] Standard256 =
+    [
+        [X(0), X(1), X(2), X(3), Y(0), Y(1), Y(2), Y(3)],
+        [Zero, X(0), X(1), X(2), Y(0), Y(1), Y(2), X(3)],
+        [Zero, Zero, X(0), X(1), Y(0), Y(1), Y(2), X(2)],
+        [Zero, Zero, Zero, X(0), Y(0), Y(1), X(1), X(2)],
+        [Zero, Zero, Zero, Zero, Y(0), Y(1), X(0), X(1)],
+    ];
+
     // GFX10 4K_S has a separate 12-bit micro-tile equation. It is not the
     // generic x/y interleave used by the 64K standard block; using that larger
     // equation leaves a regular grid in linearized atlases.
@@ -118,6 +185,14 @@ internal static class GnmTiling
         StringComparison.Ordinal);
 
     private static readonly HashSet<uint> _reportedModes = new();
+    private static readonly ConcurrentDictionary<(uint SwizzleMode, int BppLog2), PatternTerms>
+        _patternTermCache = new();
+    private static readonly ConcurrentDictionary<(SwizzleKind Kind, int Width, int Height), int[]>
+        _blockTableCache = new();
+    private static readonly ParallelOptions _parallelDetileOptions = new()
+    {
+        MaxDegreeOfParallelism = Math.Min(MaxDetileWorkers, Environment.ProcessorCount),
+    };
 
     public static bool Enabled => _enabled || !_disabled;
 
@@ -404,50 +479,218 @@ internal static class GnmTiling
             return false;
         }
 
-        // Precompute the within-block element offset for each (x, y) inside a
-        // single block. The swizzle equation only depends on the in-block
-        // coordinates, so this table is reused for every block — turning the
-        // per-pixel bit-interleave (a loop + calls) into a single array lookup.
-        // Detiling a 2048x2048 texture is millions of elements; without this the
-        // per-pixel math makes DETILE unusably slow during asset streaming.
+        // Address tables depend only on the swizzle equation and element size,
+        // so retain them across textures instead of rebuilding them per upload.
         var hasExactXorPattern = TryGetExactXorPattern(swizzleMode, bppLog2, out var xorPattern);
-        var blockTable = hasExactXorPattern ? [] : new int[blockWidth * blockHeight];
-        for (var by = 0; !hasExactXorPattern && by < blockHeight; by++)
+        var patternTerms = hasExactXorPattern
+            ? _patternTermCache.GetOrAdd(
+                (swizzleMode, bppLog2),
+                _ => CreatePatternTerms(xorPattern))
+            : default;
+        var blockTable = hasExactXorPattern
+            ? []
+            : _blockTableCache.GetOrAdd(
+                (kind, blockWidth, blockHeight),
+                static key => CreateBlockTable(key.Kind, key.Width, key.Height));
+
+        // The XOR equation offset factors cleanly into independent X and Y
+        // fields — each output bit is parity(x & XMask) XOR parity(y & YMask),
+        // and parity distributes over XOR, so offset(x, y) == xTerm(x) ^ yTerm(y).
+        // Exact equations repeat at a small power-of-two period. Cached axis
+        // terms reduce the inner loop to two array loads and one XOR.
+        fixed (byte* tiledPointer = tiled)
+        fixed (byte* linearPointer = linear)
         {
-            for (var bx = 0; bx < blockWidth; bx++)
+            var sourceAddress = (nint)tiledPointer;
+            var destinationAddress = (nint)linearPointer;
+            var sourceLength = tiled.Length;
+            var destinationLength = linear.Length;
+            var blockWidthShift = BitLog2((uint)blockWidth);
+            var blockWidthMask = blockWidth - 1;
+            var detileRow = (int y) =>
             {
-                blockTable[by * blockWidth + bx] = (int)(kind == SwizzleKind.ZOrder
-                    ? MortonInterleave((uint)bx, (uint)by, blockWidth, blockHeight)
-                    : StandardSwizzleOffset((uint)bx, (uint)by, blockWidth, blockHeight));
+                var blockY = y / blockHeight;
+                var inBlockY = y & (blockHeight - 1);
+                var rowBlockBase = (long)blockY * blocksPerRow;
+                var tableRowBase = inBlockY * blockWidth;
+                var destRowBase = (long)y * elementsWide * bytesPerElement;
+                var yTerm = hasExactXorPattern
+                    ? patternTerms.Y[y & patternTerms.YMask]
+                    : 0;
+                for (var x = 0; x < elementsWide; x++)
+                {
+                    var blockX = x >> blockWidthShift;
+                    var inBlockX = x & blockWidthMask;
+                    var blockIndex = rowBlockBase + blockX;
+                    var sourceByte = hasExactXorPattern
+                        ? blockIndex * blockBytes + (patternTerms.X[x & patternTerms.XMask] ^ yTerm)
+                        : (blockIndex * blockElements + blockTable[tableRowBase + inBlockX]) *
+                          (long)bytesPerElement;
+                    var destByte = destRowBase + (long)x * bytesPerElement;
+                    if (sourceByte < 0 ||
+                        sourceByte + bytesPerElement > sourceLength ||
+                        destByte + bytesPerElement > destinationLength)
+                    {
+                        continue;
+                    }
+
+                    CopyElement(
+                        (byte*)sourceAddress + sourceByte,
+                        (byte*)destinationAddress + destByte,
+                        bytesPerElement);
+                }
+            };
+
+            var elementCount = (long)elementsWide * elementsHigh;
+            if (elementCount >= ParallelDetileElementThreshold && Environment.ProcessorCount > 1)
+            {
+                Parallel.For(
+                    0,
+                    elementsHigh,
+                    _parallelDetileOptions,
+                    detileRow);
+            }
+            else
+            {
+                for (var y = 0; y < elementsHigh; y++)
+                {
+                    detileRow(y);
+                }
             }
         }
 
-        for (var y = 0; y < elementsHigh; y++)
-        {
-            var blockY = y / blockHeight;
-            var inBlockY = y % blockHeight;
-            var rowBlockBase = (long)blockY * blocksPerRow;
-            var tableRowBase = inBlockY * blockWidth;
-            var destRowBase = (long)y * elementsWide * bytesPerElement;
-            for (var x = 0; x < elementsWide; x++)
-            {
-                var blockX = x / blockWidth;
-                var inBlockX = x % blockWidth;
+        return true;
+    }
 
-                var blockIndex = rowBlockBase + blockX;
-                var sourceByte = hasExactXorPattern
-                    ? blockIndex * blockBytes + ComputePatternOffset((uint)x, (uint)y, xorPattern)
-                    : (blockIndex * blockElements + blockTable[tableRowBase + inBlockX]) *
-                      (long)bytesPerElement;
-                var destByte = destRowBase + (long)x * bytesPerElement;
-                if (sourceByte + bytesPerElement > tiled.Length ||
-                    destByte + bytesPerElement > linear.Length)
+    /// <summary>
+    /// Computes the detile parameters for a surface without performing the copy,
+    /// so a GPU compute kernel can run the deswizzle instead of the CPU. Returns
+    /// <see cref="DetileParams.IsSupported"/> == false (Equation == None) when the
+    /// mode/format is not GPU-portable, so the caller keeps the CPU
+    /// <see cref="TryDetile"/> path or a raw upload. Reuses the same helpers and
+    /// caches as <see cref="TryDetile"/>, so the two never disagree on addressing.
+    /// </summary>
+    public static DetileParams GetDetileParams(
+        uint swizzleMode,
+        int bytesPerElement,
+        int elementsWide,
+        int elementsHigh)
+    {
+        if (!ShouldDetile(swizzleMode) ||
+            bytesPerElement <= 0 ||
+            elementsWide <= 0 ||
+            elementsHigh <= 0 ||
+            !TryGetSwizzleKind(swizzleMode, out var kind, out var blockBytes))
+        {
+            return default;
+        }
+
+        var bppLog2 = BitLog2((uint)bytesPerElement);
+        if (bppLog2 < 0)
+        {
+            return default;
+        }
+
+        var blockElements = blockBytes >> bppLog2;
+        var (blockWidth, blockHeight) = SquareBlockDimensions(blockElements);
+        if (blockWidth == 0 || blockHeight == 0)
+        {
+            return default;
+        }
+
+        var blocksPerRow = (elementsWide + blockWidth - 1) / blockWidth;
+
+        if (TryGetExactXorPattern(swizzleMode, bppLog2, out var pattern))
+        {
+            var terms = _patternTermCache.GetOrAdd(
+                (swizzleMode, bppLog2),
+                _ => CreatePatternTerms(pattern));
+            return new DetileParams(
+                DetileEquation.ExactXor,
+                elementsWide,
+                elementsHigh,
+                bytesPerElement,
+                blockWidth,
+                blockHeight,
+                blockElements,
+                blockBytes,
+                blocksPerRow,
+                terms.X,
+                terms.XMask,
+                terms.Y,
+                terms.YMask,
+                []);
+        }
+
+        var blockTable = _blockTableCache.GetOrAdd(
+            (kind, blockWidth, blockHeight),
+            static key => CreateBlockTable(key.Kind, key.Width, key.Height));
+        return new DetileParams(
+            DetileEquation.BlockTable,
+            elementsWide,
+            elementsHigh,
+            bytesPerElement,
+            blockWidth,
+            blockHeight,
+            blockElements,
+            blockBytes,
+            blocksPerRow,
+            [],
+            0,
+            [],
+            0,
+            blockTable);
+    }
+
+    /// <summary>
+    /// CPU deswizzle driven entirely by a resolved <see cref="DetileParams"/> — the
+    /// exact addressing the Vulkan/Metal compute kernel runs per texel, so a
+    /// backend that packaged <paramref name="parameters"/> for the GPU path can
+    /// fall back to this without re-deriving the swizzle. Copies
+    /// <c>ElementsWide * ElementsHigh</c> elements from <paramref name="tiled"/>
+    /// into <paramref name="linear"/>; returns false when unsupported or the output
+    /// span is too small. Out-of-range source elements are left zero (matching the
+    /// reference), so a truncated <paramref name="tiled"/> degrades gracefully.
+    /// </summary>
+    public static bool DetileWithParams(
+        in DetileParams parameters,
+        ReadOnlySpan<byte> tiled,
+        Span<byte> linear)
+    {
+        if (!parameters.IsSupported)
+        {
+            return false;
+        }
+
+        var width = parameters.ElementsWide;
+        var height = parameters.ElementsHigh;
+        var bpp = parameters.BytesPerElement;
+        var requiredLinear = (long)width * height * bpp;
+        if (width <= 0 || height <= 0 || bpp <= 0 || linear.Length < requiredLinear)
+        {
+            return false;
+        }
+
+        var isExactXor = parameters.Equation == DetileEquation.ExactXor;
+        for (var y = 0; y < height; y++)
+        {
+            var blockY = y / parameters.BlockHeight;
+            var inY = y % parameters.BlockHeight;
+            var yTerm = isExactXor ? parameters.YByteTerm[y & parameters.YMask] : 0;
+            for (var x = 0; x < width; x++)
+            {
+                var blockX = x / parameters.BlockWidth;
+                var inBlockByte = isExactXor
+                    ? parameters.XByteTerm[x & parameters.XMask] ^ yTerm
+                    : parameters.BlockTable[inY * parameters.BlockWidth + (x % parameters.BlockWidth)] * bpp;
+                var srcByte = ((long)blockY * parameters.BlocksPerRow + blockX) * parameters.BlockBytes + inBlockByte;
+                var dstByte = ((long)y * width + x) * bpp;
+                if (srcByte < 0 || srcByte + bpp > tiled.Length)
                 {
                     continue;
                 }
 
-                tiled.Slice((int)sourceByte, bytesPerElement)
-                    .CopyTo(linear.Slice((int)destByte, bytesPerElement));
+                tiled.Slice((int)srcByte, bpp).CopyTo(linear.Slice((int)dstByte, bpp));
             }
         }
 
@@ -460,6 +703,80 @@ internal static class GnmTiling
         ZOrder,
     }
 
+    private readonly record struct PatternTerms(int[] X, int XMask, int[] Y, int YMask);
+
+    private static PatternTerms CreatePatternTerms(AddressBit[] pattern)
+    {
+        uint xMask = 0;
+        uint yMask = 0;
+        foreach (var bit in pattern)
+        {
+            xMask |= bit.XMask;
+            yMask |= bit.YMask;
+        }
+
+        var xLength = AxisTermPeriod(xMask);
+        var yLength = AxisTermPeriod(yMask);
+        var xTerms = new int[xLength];
+        var yTerms = new int[yLength];
+        for (var x = 0; x < xTerms.Length; x++)
+        {
+            xTerms[x] = (int)PatternAxisTerm((uint)x, pattern, useX: true);
+        }
+
+        for (var y = 0; y < yTerms.Length; y++)
+        {
+            yTerms[y] = (int)PatternAxisTerm((uint)y, pattern, useX: false);
+        }
+
+        return new PatternTerms(xTerms, xLength - 1, yTerms, yLength - 1);
+    }
+
+    private static int AxisTermPeriod(uint mask) =>
+        mask == 0 ? 1 : 1 << (32 - System.Numerics.BitOperations.LeadingZeroCount(mask));
+
+    private static int[] CreateBlockTable(SwizzleKind kind, int blockWidth, int blockHeight)
+    {
+        var table = new int[blockWidth * blockHeight];
+        for (var y = 0; y < blockHeight; y++)
+        {
+            for (var x = 0; x < blockWidth; x++)
+            {
+                table[y * blockWidth + x] = (int)(kind == SwizzleKind.ZOrder
+                    ? MortonInterleave((uint)x, (uint)y, blockWidth, blockHeight)
+                    : StandardSwizzleOffset((uint)x, (uint)y, blockWidth, blockHeight));
+            }
+        }
+
+        return table;
+    }
+
+    [MethodImpl(MethodImplOptions.AggressiveInlining)]
+    private static void CopyElement(byte* source, byte* destination, int bytesPerElement)
+    {
+        switch (bytesPerElement)
+        {
+            case 1:
+                *destination = *source;
+                break;
+            case 2:
+                Unsafe.WriteUnaligned(destination, Unsafe.ReadUnaligned<ushort>(source));
+                break;
+            case 4:
+                Unsafe.WriteUnaligned(destination, Unsafe.ReadUnaligned<uint>(source));
+                break;
+            case 8:
+                Unsafe.WriteUnaligned(destination, Unsafe.ReadUnaligned<ulong>(source));
+                break;
+            case 16:
+                Unsafe.WriteUnaligned(destination, Unsafe.ReadUnaligned<UInt128>(source));
+                break;
+            default:
+                Unsafe.CopyBlockUnaligned(destination, source, (uint)bytesPerElement);
+                break;
+        }
+    }
+
     private static readonly AddressBit Zero = new(0, 0);
 
     private static AddressBit X(int bit) => new(1u << bit, 0);
@@ -484,6 +801,7 @@ internal static class GnmTiling
 
         pattern = swizzleMode switch
         {
+            1 => Standard256[bytesPerElementLog2],
             5 => Standard4K[bytesPerElementLog2],
             9 => RbPlus64KStandard[bytesPerElementLog2],
             24 => RbPlus64KDepthX[bytesPerElementLog2],
@@ -493,14 +811,20 @@ internal static class GnmTiling
         return pattern.Length != 0;
     }
 
-    private static long ComputePatternOffset(uint x, uint y, AddressBit[] pattern)
+    // The AddrLib within-block byte offset is a per-bit XOR equation:
+    //   offset = OR over bits of ( parity(x & XMask) XOR parity(y & YMask) ) << bit
+    // Because parity distributes over XOR, that whole offset factors into two
+    // independent axis terms: PatternAxisTerm(x, useX: true) ^
+    // PatternAxisTerm(y, useX: false). Splitting the axes lets TryDetile cache
+    // the X term per column and hoist the Y term per row instead of recomputing
+    // the full 16-bit interleave (32 PopCounts) for every element.
+    private static uint PatternAxisTerm(uint coordinate, AddressBit[] pattern, bool useX)
     {
         uint offset = 0;
         for (var bit = 0; bit < pattern.Length; bit++)
         {
-            var equation = pattern[bit];
-            var parity = (System.Numerics.BitOperations.PopCount(x & equation.XMask) +
-                          System.Numerics.BitOperations.PopCount(y & equation.YMask)) & 1;
+            var mask = useX ? pattern[bit].XMask : pattern[bit].YMask;
+            var parity = System.Numerics.BitOperations.PopCount(coordinate & mask) & 1;
             offset |= (uint)parity << bit;
         }
 

src/SharpEmu.Libs/Agc/GpuWaitRegistry.cs

@@ -1,6 +1,8 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Diagnostics;
+
 namespace SharpEmu.Libs.Agc;
 
 /// <summary>
@@ -92,6 +94,64 @@ internal static class GpuWaitRegistry
         }
     }
 
+    public readonly record struct OutstandingSnapshot(
+        int Outstanding,
+        int Latched,
+        long OldestAgeMs,
+        ulong SampleWaitAddress,
+        string? SampleQueueName);
+
+    /// <summary>
+    /// Diagnostics snapshot of suspended WAIT_REG_MEM / dims waiters.
+    /// </summary>
+    public static OutstandingSnapshot SnapshotOutstanding(object? memory = null)
+    {
+        lock (_gate)
+        {
+            var outstanding = 0;
+            var latched = 0;
+            var oldestTicks = long.MaxValue;
+            ulong sampleAddress = 0;
+            string? sampleQueue = null;
+            var now = Stopwatch.GetTimestamp();
+            foreach (var (_, list) in _waiters)
+            {
+                foreach (var waiter in list)
+                {
+                    if (memory is not null &&
+                        !ReferenceEquals(waiter.Memory, memory))
+                    {
+                        continue;
+                    }
+
+                    outstanding++;
+                    if (waiter.Latched)
+                    {
+                        latched++;
+                    }
+
+                    if (waiter.RegisteredTicks != 0 &&
+                        waiter.RegisteredTicks < oldestTicks)
+                    {
+                        oldestTicks = waiter.RegisteredTicks;
+                        sampleAddress = waiter.WaitAddress;
+                        sampleQueue = waiter.QueueName;
+                    }
+                }
+            }
+
+            var oldestAgeMs = oldestTicks == long.MaxValue || oldestTicks == 0
+                ? 0L
+                : (now - oldestTicks) * 1000L / Stopwatch.Frequency;
+            return new OutstandingSnapshot(
+                outstanding,
+                latched,
+                oldestAgeMs,
+                sampleAddress,
+                sampleQueue);
+        }
+    }
+
     public static void Register(ulong address, WaitingDcb waiter)
     {
         waiter.WaitAddress = address;
@@ -343,6 +403,45 @@ internal static class GpuWaitRegistry
         return expired;
     }
 
+    public static List<WaitingDcb>? CollectAllForMemory(object memory)
+    {
+        List<WaitingDcb>? collected = null;
+        lock (_gate)
+        {
+            List<ulong>? emptied = null;
+            foreach (var (address, list) in _waiters)
+            {
+                for (var index = list.Count - 1; index >= 0; index--)
+                {
+                    if (!ReferenceEquals(list[index].Memory, memory))
+                    {
+                        continue;
+                    }
+
+                    collected ??= new List<WaitingDcb>();
+                    collected.Add(list[index]);
+                    list.RemoveAt(index);
+                }
+
+                if (list.Count == 0)
+                {
+                    emptied ??= new List<ulong>();
+                    emptied.Add(address);
+                }
+            }
+
+            if (emptied is not null)
+            {
+                foreach (var address in emptied)
+                {
+                    _waiters.Remove(address);
+                }
+            }
+        }
+
+        return collected;
+    }
+
     /// <summary>Records the value a label producer wrote, for the deadlock
     /// breaker. Also latches any already-waiting waiter it satisfies.</summary>
     public static bool RecordProduced(object memory, ulong address, ulong value)

src/SharpEmu.Libs/Ampr/AmprExports.cs

@@ -275,6 +275,19 @@ public static class AmprExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
         }
 
+        // Offset -1 means "continue after the previous read of this file id".
+        // #216 dropped this wiring; without it sequential pack/streamer reads
+        // fail as INVALID_ARGUMENT and RAGE load jobs never complete while the
+        // North Yankton UI keeps flipping.
+        if (fileOffset == unchecked((ulong)(long)-1))
+        {
+            fileOffset = PakDirectoryTracker.ResolveSequentialOffset(fileId, size);
+        }
+        else if (fileOffset > long.MaxValue)
+        {
+            fileOffset = 0;
+        }
+
         var result = TryReadFileToGuestMemory(ctx, hostPath, fileOffset, destination, size, out var bytesRead);
         if (result != (int)OrbisGen2Result.ORBIS_GEN2_OK)
         {
@@ -282,6 +295,8 @@ public static class AmprExports
             return result;
         }
 
+        PakDirectoryTracker.OnReadCompleted(ctx, fileId, destination, fileOffset, bytesRead);
+
         if (!AppendReadFileRecord(ctx, commandBuffer, fileId, destination, size, fileOffset, bytesRead))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
@@ -340,6 +355,18 @@ public static class AmprExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "4fgtGfXDrFc",
+        ExportName = "sceAmprMeasureCommandSizeWriteAddress_04_00",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int MeasureCommandSizeWriteAddress0400(CpuContext ctx)
+    {
+        TraceAmpr(ctx, "measure_write_address", 0, WriteAddressRecordSize, 0);
+        ctx[CpuRegister.Rax] = WriteAddressRecordSize;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "tZDDEo2tE5k",
         ExportName = "sceAmprCommandBufferGetSize",
@@ -509,6 +536,32 @@ public static class AmprExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "j0+3uJMxYJY",
+        ExportName = "sceAmprCommandBufferWriteAddress_04_00",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferWriteAddress0400(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var address = ctx[CpuRegister.Rsi];
+        var value = ctx[CpuRegister.Rdx];
+
+        if (commandBuffer == 0 || address == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!AppendWriteAddressRecord(ctx, commandBuffer, address, value))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "write_address", commandBuffer, address, value);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     public static int CompleteCommandBuffer(CpuContext ctx, ulong commandBuffer)
     {
         if (commandBuffer == 0)

src/SharpEmu.Libs/Audio/AjmExports.cs

@@ -17,10 +17,30 @@ public static class AjmExports
     private const int OrbisAjmErrorCodecAlreadyRegistered = unchecked((int)0x80930009);
     private const int OrbisAjmErrorCodecNotRegistered = unchecked((int)0x8093000A);
     private const int OrbisAjmErrorWrongRevisionFlag = unchecked((int)0x8093000B);
-    private const uint MaxCodecType = 23;
+    private const uint MaxCodecType = 25;
     private const int MaxInstanceIndex = 0x2FFF;
     private static readonly ConcurrentDictionary<uint, AjmContextState> Contexts = new();
     private static int _nextContextId;
+    private static int _nextBatchId;
+
+    private const uint AjmCodecMp3 = 0;
+
+    private sealed class AjmInstanceState
+    {
+        public required uint Codec { get; init; }
+        public required ulong Flags { get; init; }
+        public AjmMp3Decoder? Mp3 { get; init; }
+
+        public bool PreferPcm16
+        {
+            get
+            {
+                // AjmInstanceFlags: version:3, channels:4, format:3
+                var encoding = (Flags >> 7) & 0x7;
+                return encoding is 0 or 1; // S16 / S32 — we emit S16 for both
+            }
+        }
+    }
 
     private sealed class AjmContextState
     {
@@ -28,7 +48,7 @@ public static class AjmExports
 
         public HashSet<uint> RegisteredCodecs { get; } = new();
 
-        public Dictionary<uint, uint> InstancesBySlot { get; } = new();
+        public Dictionary<uint, AjmInstanceState> InstancesBySlot { get; } = new();
 
         public int NextInstanceIndex { get; set; }
     }
@@ -168,7 +188,14 @@ public static class AjmExports
             }
 
             state.NextInstanceIndex = nextInstanceIndex;
-            state.InstancesBySlot.Add(instanceSlot, instanceId);
+            state.InstancesBySlot.Add(
+                instanceSlot,
+                new AjmInstanceState
+                {
+                    Codec = codecType,
+                    Flags = flags,
+                    Mp3 = codecType == AjmCodecMp3 ? new AjmMp3Decoder() : null,
+                });
         }
 
         Trace($"instance_create context={contextId} codec={codecType} flags=0x{flags:X} instance=0x{instanceId:X8}");
@@ -227,10 +254,332 @@ public static class AjmExports
         return 0;
     }
 
+    /// <summary>
+    /// Enqueues a decode job on a batch. GTA V Enhanced streams menu music
+    /// through AJM MP3 (codec 0); we decode eagerly here so BatchStart/Wait
+    /// stay synchronous no-ops.
+    /// </summary>
+    [SysAbiExport(
+        Nid = "39WxhR-ePew",
+        ExportName = "sceAjmBatchJobDecode",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAjm")]
+    public static int AjmBatchJobDecode(CpuContext ctx)
+    {
+        var infoAddress = ctx[CpuRegister.Rdi];
+        var instanceId = unchecked((uint)ctx[CpuRegister.Rsi]);
+        var inputAddress = ctx[CpuRegister.Rdx];
+        var inputSize = ctx[CpuRegister.Rcx];
+        var outputAddress = ctx[CpuRegister.R8];
+        var outputSize = ctx[CpuRegister.R9];
+        var resultAddress = ReadStackArg64(ctx, 0);
+
+        if (infoAddress == 0)
+        {
+            return ctx.SetReturn(OrbisAjmErrorInvalidParameter);
+        }
+
+        _ = TryAppendBatchJob(ctx, infoAddress, AjmJobRunSize);
+
+        var inputConsumed = 0;
+        var outputWritten = 0;
+        ulong totalSamples = 0;
+        var frames = 0u;
+        var decoded = false;
+
+        if (TryGetInstance(instanceId, out var instance) &&
+            instance.Mp3 is not null &&
+            inputAddress != 0 &&
+            inputSize is > 0 and <= MaxSilentPcmBytes &&
+            outputAddress != 0 &&
+            outputSize is > 0 and <= MaxSilentPcmBytes)
+        {
+            var input = new byte[inputSize];
+            var output = new byte[outputSize];
+            if (ctx.Memory.TryRead(inputAddress, input))
+            {
+                var result = instance.Mp3.Decode(input, output, pcm16: instance.PreferPcm16);
+                if (result.OutputWritten > 0)
+                {
+                    if (!ctx.Memory.TryWrite(outputAddress, output.AsSpan(0, result.OutputWritten)))
+                    {
+                        return ctx.SetReturn(OrbisAjmErrorInvalidParameter);
+                    }
+
+                    // Zero any remainder so stale PCM does not leak into FMOD.
+                    if ((ulong)result.OutputWritten < outputSize)
+                    {
+                        ClearGuestMemory(
+                            ctx,
+                            outputAddress + (ulong)result.OutputWritten,
+                            outputSize - (ulong)result.OutputWritten);
+                    }
+
+                    decoded = true;
+                    inputConsumed = result.InputConsumed;
+                    outputWritten = result.OutputWritten;
+                    frames = result.Frames;
+                    totalSamples = instance.Mp3.TotalDecodedSamples;
+                }
+                else
+                {
+                    inputConsumed = result.InputConsumed;
+                    totalSamples = instance.Mp3.TotalDecodedSamples;
+                }
+            }
+        }
+
+        if (!decoded)
+        {
+            // Fallback: silence + consume input so the guest does not spin.
+            if (outputAddress != 0 && outputSize != 0 && outputSize <= MaxSilentPcmBytes)
+            {
+                ClearGuestMemory(ctx, outputAddress, outputSize);
+            }
+
+            if (inputConsumed == 0)
+            {
+                inputConsumed = inputSize > int.MaxValue ? int.MaxValue : (int)inputSize;
+            }
+
+            if (frames == 0 && (inputSize != 0 || outputSize != 0))
+            {
+                frames = 1;
+            }
+        }
+
+        WriteDecodeStreamResult(
+            ctx,
+            resultAddress,
+            inputConsumed,
+            outputWritten,
+            totalSamples,
+            frames);
+
+        Trace(
+            $"batch_job_decode info=0x{infoAddress:X16} instance=0x{instanceId:X8} " +
+            $"in=0x{inputAddress:X16}+0x{inputSize:X} out=0x{outputAddress:X16}+0x{outputSize:X} " +
+            $"written={outputWritten} frames={frames} result=0x{resultAddress:X16}");
+        return ctx.SetReturn(0);
+    }
+
+    private static bool TryGetInstance(uint instanceId, out AjmInstanceState instance)
+    {
+        instance = null!;
+        var codec = instanceId >> 14;
+        var slot = instanceId & 0x3FFF;
+        if (slot == 0)
+        {
+            return false;
+        }
+
+        foreach (var context in Contexts.Values)
+        {
+            lock (context.Gate)
+            {
+                if (context.InstancesBySlot.TryGetValue(slot, out var found) &&
+                    found.Codec == codec)
+                {
+                    instance = found;
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// Submits a built batch. Hot path after BatchJobDecode; unresolved WARNs
+    /// dominate the log. Instant-complete: publish a batch id and clear any
+    /// error out. Decode sidebands were already filled at job-enqueue time.
+    /// </summary>
+    [SysAbiExport(
+        Nid = "5tOfnaClcqM",
+        ExportName = "sceAjmBatchStart",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAjm")]
+    public static int AjmBatchStart(CpuContext ctx)
+    {
+        var contextId = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var infoAddress = ctx[CpuRegister.Rsi];
+        var priority = unchecked((int)ctx[CpuRegister.Rdx]);
+        var errorAddress = ctx[CpuRegister.Rcx];
+        var batchOutAddress = ctx[CpuRegister.R8];
+
+        if (infoAddress == 0 || batchOutAddress == 0)
+        {
+            return ctx.SetReturn(OrbisAjmErrorInvalidParameter);
+        }
+
+        ClearAjmBatchError(ctx, errorAddress);
+
+        var batchId = unchecked((uint)Interlocked.Increment(ref _nextBatchId));
+        Span<byte> batchValue = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(batchValue, batchId);
+        if (!ctx.Memory.TryWrite(batchOutAddress, batchValue))
+        {
+            return ctx.SetReturn(OrbisAjmErrorInvalidParameter);
+        }
+
+        Trace(
+            $"batch_start context={contextId} info=0x{infoAddress:X16} " +
+            $"priority={priority} batch={batchId} error=0x{errorAddress:X16}");
+        return ctx.SetReturn(0);
+    }
+
+    [SysAbiExport(
+        Nid = "-qLsfDAywIY",
+        ExportName = "sceAjmBatchWait",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAjm")]
+    public static int AjmBatchWait(CpuContext ctx)
+    {
+        // Batches complete synchronously in Start; Wait is a no-op success.
+        var errorAddress = ctx[CpuRegister.Rcx];
+        ClearAjmBatchError(ctx, errorAddress);
+        Trace(
+            $"batch_wait context={unchecked((uint)ctx[CpuRegister.Rdi])} " +
+            $"batch={unchecked((uint)ctx[CpuRegister.Rsi])} " +
+            $"timeout={unchecked((uint)ctx[CpuRegister.Rdx])}");
+        return ctx.SetReturn(0);
+    }
+
+    [SysAbiExport(
+        Nid = "NVDXiUesSbA",
+        ExportName = "sceAjmBatchCancel",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAjm")]
+    public static int AjmBatchCancel(CpuContext ctx)
+    {
+        Trace(
+            $"batch_cancel context={unchecked((uint)ctx[CpuRegister.Rdi])} " +
+            $"batch={unchecked((uint)ctx[CpuRegister.Rsi])}");
+        return ctx.SetReturn(0);
+    }
+
     internal static void ResetForTests()
     {
         Contexts.Clear();
         Interlocked.Exchange(ref _nextContextId, 0);
+        Interlocked.Exchange(ref _nextBatchId, 0);
+    }
+
+    // AjmBatchInfo: buffer, offset, size, last_good_job, last_good_job_ra (5× u64).
+    private const ulong AjmBatchInfoOffsetField = 8;
+    private const ulong AjmBatchInfoSizeField = 16;
+    private const ulong AjmBatchInfoLastGoodJobField = 24;
+    private const ulong AjmJobRunSize = 64;
+    private const int OrbisAjmErrorJobCreation = unchecked((int)0x80930012);
+    private const ulong MaxSilentPcmBytes = 1 << 20;
+    // AjmSidebandResult (8) + AjmSidebandStream (16) + AjmSidebandMFrame (8).
+    private const int DecodeSidebandBytes = 32;
+
+    private static bool TryAppendBatchJob(CpuContext ctx, ulong infoAddress, ulong jobSize)
+    {
+        if (!TryReadUInt64(ctx, infoAddress, out var buffer) ||
+            !TryReadUInt64(ctx, infoAddress + AjmBatchInfoOffsetField, out var offset) ||
+            !TryReadUInt64(ctx, infoAddress + AjmBatchInfoSizeField, out var size))
+        {
+            return false;
+        }
+
+        if (buffer == 0 || jobSize == 0 || offset > size || size - offset < jobSize)
+        {
+            return false;
+        }
+
+        var jobAddress = buffer + offset;
+        ClearGuestMemory(ctx, jobAddress, jobSize);
+        return TryWriteUInt64(ctx, infoAddress + AjmBatchInfoLastGoodJobField, jobAddress) &&
+               TryWriteUInt64(ctx, infoAddress + AjmBatchInfoOffsetField, offset + jobSize);
+    }
+
+    // AjmBatchError: int error_code; const void* job_addr; uint32_t cmd_offset; const void* job_ra;
+    private const int AjmBatchErrorBytes = 24;
+
+    private static void ClearAjmBatchError(CpuContext ctx, ulong errorAddress)
+    {
+        if (errorAddress == 0)
+        {
+            return;
+        }
+
+        Span<byte> error = stackalloc byte[AjmBatchErrorBytes];
+        error.Clear();
+        _ = ctx.Memory.TryWrite(errorAddress, error);
+    }
+
+    private static void WriteDecodeStreamResult(
+        CpuContext ctx,
+        ulong resultAddress,
+        int inputConsumed,
+        int outputWritten,
+        ulong totalDecodedSamples,
+        uint frames)
+    {
+        if (resultAddress == 0)
+        {
+            return;
+        }
+
+        Span<byte> sideband = stackalloc byte[DecodeSidebandBytes];
+        sideband.Clear();
+        // AjmSidebandResult.result / internal_result = 0 (OK)
+        BinaryPrimitives.WriteInt32LittleEndian(sideband.Slice(8, 4), inputConsumed);
+        BinaryPrimitives.WriteInt32LittleEndian(sideband.Slice(12, 4), outputWritten);
+        BinaryPrimitives.WriteUInt64LittleEndian(sideband.Slice(16, 8), totalDecodedSamples);
+        BinaryPrimitives.WriteUInt32LittleEndian(sideband.Slice(24, 4), frames);
+        _ = ctx.Memory.TryWrite(resultAddress, sideband);
+    }
+
+    private static void ClearGuestMemory(CpuContext ctx, ulong address, ulong byteCount)
+    {
+        if (address == 0 || byteCount == 0)
+        {
+            return;
+        }
+
+        var remaining = byteCount;
+        var cursor = address;
+        Span<byte> zero = stackalloc byte[256];
+        while (remaining > 0)
+        {
+            var chunk = (int)Math.Min(remaining, (ulong)zero.Length);
+            if (!ctx.Memory.TryWrite(cursor, zero[..chunk]))
+            {
+                return;
+            }
+
+            cursor += (ulong)chunk;
+            remaining -= (ulong)chunk;
+        }
+    }
+
+    private static ulong ReadStackArg64(CpuContext ctx, int index)
+    {
+        var address = ctx[CpuRegister.Rsp] + sizeof(ulong) + ((ulong)index * sizeof(ulong));
+        return TryReadUInt64(ctx, address, out var value) ? value : 0;
+    }
+
+    private static bool TryReadUInt64(CpuContext ctx, ulong address, out ulong value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ulong)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt64LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryWriteUInt64(CpuContext ctx, ulong address, ulong value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ulong)];
+        BinaryPrimitives.WriteUInt64LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
     }
 
     private static void Trace(string message)

src/SharpEmu.Libs/Audio/AjmMp3Decoder.cs

@@ -0,0 +1,231 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using NLayer;
+using System.Buffers.Binary;
+using System.Reflection;
+
+namespace SharpEmu.Libs.Audio;
+
+/// <summary>
+/// Stateful AJM MP3 (codec 0) decoder. GTA menu music arrives as ~960-byte
+/// packets that NLayer must decode with a persistent bit-reservoir.
+/// </summary>
+internal sealed class AjmMp3Decoder
+{
+    private static readonly Type? MpegStreamReaderType =
+        typeof(MpegFrameDecoder).Assembly.GetType("NLayer.Decoder.MpegStreamReader");
+
+    private static readonly MethodInfo? NextFrameMethod =
+        MpegStreamReaderType?.GetMethod(
+            "NextFrame",
+            BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic);
+
+    private static readonly MethodInfo? ClearBufferMethod =
+        typeof(MpegFrameDecoder).Assembly.GetType("NLayer.Decoder.FrameBase")
+            ?.GetMethod("ClearBuffer", BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic);
+
+    private readonly MpegFrameDecoder _decoder = new();
+    private readonly object _gate = new();
+    private byte[] _pending = Array.Empty<byte>();
+    private readonly float[] _floatScratch = new float[1152 * 2];
+
+    public ulong TotalDecodedSamples { get; private set; }
+
+    public void Reset()
+    {
+        lock (_gate)
+        {
+            _decoder.Reset();
+            _pending = Array.Empty<byte>();
+            TotalDecodedSamples = 0;
+        }
+    }
+
+    public DecodeResult Decode(ReadOnlySpan<byte> input, Span<byte> output, bool pcm16)
+    {
+        lock (_gate)
+        {
+            if (MpegStreamReaderType is null || NextFrameMethod is null)
+            {
+                return DecodeResult.Failed;
+            }
+
+            var merged = new byte[_pending.Length + input.Length];
+            if (_pending.Length != 0)
+            {
+                _pending.CopyTo(merged, 0);
+            }
+
+            input.CopyTo(merged.AsSpan(_pending.Length));
+
+            using var stream = new MemoryStream(merged, writable: false);
+            object? reader;
+            try
+            {
+                reader = Activator.CreateInstance(
+                    MpegStreamReaderType,
+                    BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic,
+                    binder: null,
+                    args: [stream],
+                    culture: null);
+            }
+            catch
+            {
+                return DecodeResult.Failed;
+            }
+
+            if (reader is null)
+            {
+                return DecodeResult.Failed;
+            }
+
+            var outputOffset = 0;
+            var inputConsumed = 0;
+            var frames = 0u;
+            var samplesThisCall = 0u;
+
+            while (outputOffset < output.Length)
+            {
+                object? frameObj;
+                try
+                {
+                    frameObj = NextFrameMethod.Invoke(reader, null);
+                }
+                catch
+                {
+                    break;
+                }
+
+                if (frameObj is not IMpegFrame frame)
+                {
+                    break;
+                }
+
+                try
+                {
+                    var frameOffset = GetFrameOffset(frameObj);
+                    var frameLength = frame.FrameLength;
+                    if (frameLength <= 0 || frameOffset + frameLength > merged.Length)
+                    {
+                        break;
+                    }
+
+                    int sampleCount;
+                    try
+                    {
+                        sampleCount = _decoder.DecodeFrame(frame, _floatScratch, 0);
+                    }
+                    catch
+                    {
+                        _decoder.Reset();
+                        inputConsumed = frameOffset + frameLength;
+                        continue;
+                    }
+
+                    if (sampleCount <= 0)
+                    {
+                        inputConsumed = frameOffset + frameLength;
+                        continue;
+                    }
+
+                    var channels = frame.ChannelMode == MpegChannelMode.Mono ? 1 : 2;
+                    var bytesPerSample = pcm16 ? 2 : 4;
+                    var byteCount = sampleCount * bytesPerSample;
+                    if (outputOffset + byteCount > output.Length)
+                    {
+                        // Not enough room for this frame — leave it for next job.
+                        break;
+                    }
+
+                    if (pcm16)
+                    {
+                        WritePcm16(_floatScratch.AsSpan(0, sampleCount), output[outputOffset..]);
+                    }
+                    else
+                    {
+                        WriteFloat(_floatScratch.AsSpan(0, sampleCount), output[outputOffset..]);
+                    }
+
+                    outputOffset += byteCount;
+                    inputConsumed = frameOffset + frameLength;
+                    frames++;
+                    samplesThisCall += (uint)(sampleCount / Math.Max(channels, 1));
+                    TotalDecodedSamples += (ulong)(sampleCount / Math.Max(channels, 1));
+                }
+                finally
+                {
+                    try
+                    {
+                        ClearBufferMethod?.Invoke(frameObj, null);
+                    }
+                    catch
+                    {
+                        // best-effort
+                    }
+                }
+            }
+
+            _pending = inputConsumed < merged.Length
+                ? merged[inputConsumed..]
+                : Array.Empty<byte>();
+
+            // Consume the portion of *this* input that left the pending window.
+            var pendingBefore = merged.Length - input.Length;
+            var consumedFromInput = Math.Clamp(inputConsumed - pendingBefore, 0, input.Length);
+
+            return new DecodeResult(
+                Success: frames > 0 || consumedFromInput > 0,
+                InputConsumed: consumedFromInput,
+                OutputWritten: outputOffset,
+                Frames: frames,
+                SamplesThisCall: samplesThisCall);
+        }
+    }
+
+    private static int GetFrameOffset(object frameObj)
+    {
+        for (var type = frameObj.GetType(); type is not null; type = type.BaseType)
+        {
+            var prop = type.GetProperty(
+                "Offset",
+                BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.DeclaredOnly);
+            if (prop?.GetValue(frameObj) is long offset)
+            {
+                return checked((int)offset);
+            }
+        }
+
+        return 0;
+    }
+
+    private static void WritePcm16(ReadOnlySpan<float> samples, Span<byte> destination)
+    {
+        for (var i = 0; i < samples.Length; i++)
+        {
+            var sample = samples[i];
+            var scaled = sample < 0f ? sample * 32768f : sample * 32767f;
+            var value = (short)Math.Clamp(MathF.Round(scaled), short.MinValue, short.MaxValue);
+            BinaryPrimitives.WriteInt16LittleEndian(destination[(i * 2)..], value);
+        }
+    }
+
+    private static void WriteFloat(ReadOnlySpan<float> samples, Span<byte> destination)
+    {
+        for (var i = 0; i < samples.Length; i++)
+        {
+            var bits = BitConverter.SingleToInt32Bits(samples[i]);
+            BinaryPrimitives.WriteInt32LittleEndian(destination[(i * 4)..], bits);
+        }
+    }
+
+    internal readonly record struct DecodeResult(
+        bool Success,
+        int InputConsumed,
+        int OutputWritten,
+        uint Frames,
+        uint SamplesThisCall)
+    {
+        public static DecodeResult Failed { get; } = new(false, 0, 0, 0, 0);
+    }
+}

src/SharpEmu.Libs/Audio/AudioOutExports.cs

@@ -4,6 +4,7 @@
 using SharpEmu.HLE;
 using SharpEmu.HLE.Host;
 using System.Buffers;
+using System.Buffers.Binary;
 using System.Collections.Concurrent;
 using System.Diagnostics;
 
@@ -11,8 +12,17 @@ namespace SharpEmu.Libs.Audio;
 
 public static class AudioOutExports
 {
+    private const int AudioOutOutputParamSize = 16;
+    private const int AudioOutMaximumOutputCount = 25;
+
+    internal const int AudioOutErrorInvalidPort = unchecked((int)0x80260003);
+    internal const int AudioOutErrorInvalidPointer = unchecked((int)0x80260004);
+    internal const int AudioOutErrorPortFull = unchecked((int)0x80260005);
+    internal const int AudioOutErrorInvalidSize = unchecked((int)0x80260006);
+
     private static readonly ConcurrentDictionary<int, PortState> Ports = new();
     private static int _nextPortHandle;
+    private static Func<uint, IHostAudioStream?>? _streamFactoryForTests;
 
     // Diagnostic: confirm sceAudioOutOutput is actually called and whether the
     // guest submits real samples or silence. Gated so it costs nothing when off.
@@ -56,6 +66,7 @@ public static class AudioOutExports
         public int BytesPerSample { get; }
         public bool IsFloat { get; }
         public IHostAudioStream? Backend { get; }
+        public object SubmissionGate { get; } = new();
         public volatile float Volume = 1.0f;
         public int BufferByteLength =>
             checked((int)BufferLength * Channels * BytesPerSample);
@@ -83,7 +94,24 @@ public static class AudioOutExports
             }
         }
 
-        public void Dispose() => Backend?.Dispose();
+        public void Dispose()
+        {
+            lock (SubmissionGate)
+            {
+                Backend?.Dispose();
+            }
+        }
+    }
+
+    private readonly record struct OutputDescriptor(int Handle, ulong SourceAddress);
+
+    private struct ResolvedOutput
+    {
+        public int Handle;
+        public ulong SourceAddress;
+        public PortState Port;
+        public byte[]? HostBuffer;
+        public int HostBufferLength;
     }
 
     [SysAbiExport(
@@ -115,9 +143,18 @@ public static class AudioOutExports
         string backendName;
         try
         {
-            var audio = HostPlatform.Current.Audio;
-            backend = audio.OpenStereoPcm16Stream(frequency);
-            backendName = audio.BackendName;
+            var streamFactory = Volatile.Read(ref _streamFactoryForTests);
+            if (streamFactory is not null)
+            {
+                backend = streamFactory(frequency);
+                backendName = "test";
+            }
+            else
+            {
+                var audio = HostPlatform.Current.Audio;
+                backend = audio.OpenStereoPcm16Stream(frequency);
+                backendName = audio.BackendName;
+            }
         }
         catch (Exception exception)
         {
@@ -175,6 +212,14 @@ public static class AudioOutExports
             return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
         }
 
+        // Same rule as AudioOut2 PortGetState: never bulk-write onto the caller
+        // stack. Some titles place small locals next to the canary; a full
+        // SceAudioOutPortState write smashes it.
+        if (IsGuestStackAddress(stateAddress))
+        {
+            return ctx.SetReturn(0);
+        }
+
         // SceAudioOutPortState: report a connected primary output at full volume
         // so pacing/mixing code sees a live port. We do no host rerouting, so
         // rerouteCounter and flag stay zero.
@@ -192,6 +237,49 @@ public static class AudioOutExports
         return ctx.SetReturn(0);
     }
 
+    private static bool IsGuestStackAddress(ulong value) =>
+        value >= 0x0000_7FF0_0000_0000UL && value <= 0x0000_7FFF_FFFF_FFFFUL;
+
+    [SysAbiExport(
+        Nid = "w3PdaSTSwGE",
+        ExportName = "sceAudioOutOutputs",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAudioOut")]
+    public static int AudioOutOutputs(CpuContext ctx)
+    {
+        var parameterAddress = ctx[CpuRegister.Rdi];
+        var outputCount = unchecked((uint)ctx[CpuRegister.Rsi]);
+        if (outputCount == 0 || outputCount > AudioOutMaximumOutputCount)
+        {
+            return ctx.SetReturn(AudioOutErrorPortFull);
+        }
+
+        if (parameterAddress == 0)
+        {
+            return ctx.SetReturn(AudioOutErrorInvalidPointer);
+        }
+
+        var count = checked((int)outputCount);
+        Span<byte> parameterBytes =
+            stackalloc byte[AudioOutMaximumOutputCount * AudioOutOutputParamSize];
+        parameterBytes = parameterBytes[..checked(count * AudioOutOutputParamSize)];
+        if (!ctx.Memory.TryRead(parameterAddress, parameterBytes))
+        {
+            return ctx.SetReturn(AudioOutErrorInvalidPointer);
+        }
+
+        Span<OutputDescriptor> descriptors = stackalloc OutputDescriptor[count];
+        for (var i = 0; i < count; i++)
+        {
+            var entry = parameterBytes.Slice(i * AudioOutOutputParamSize, AudioOutOutputParamSize);
+            descriptors[i] = new OutputDescriptor(
+                BinaryPrimitives.ReadInt32LittleEndian(entry),
+                BinaryPrimitives.ReadUInt64LittleEndian(entry[8..]));
+        }
+
+        return ctx.SetReturn(SubmitOutputs(ctx, descriptors));
+    }
+
     [SysAbiExport(
         Nid = "QOQtbeDqsT4",
         ExportName = "sceAudioOutOutput",
@@ -225,16 +313,7 @@ public static class AudioOutExports
                 return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
 
-            if (_traceOutput)
-            {
-                var n = Interlocked.Increment(ref _outputCount);
-                if (n <= 8 || n % 200 == 0)
-                {
-                    var peak = PeakAmplitude(source, port.IsFloat, port.BytesPerSample);
-                    Console.Error.WriteLine(
-                        $"[LOADER][TRACE] audioout.output#{n} handle={handle} bytes={source.Length} ch={port.Channels} float={port.IsFloat} vol={port.Volume:F2} peak={peak:F4} backend={(port.Backend is null ? "none" : "coreaudio")}");
-                }
-            }
+            TraceOutput(handle, port, source);
 
             if (port.Backend is null)
             {
@@ -272,6 +351,184 @@ public static class AudioOutExports
         }
     }
 
+    private static int SubmitOutputs(CpuContext ctx, ReadOnlySpan<OutputDescriptor> descriptors)
+    {
+        var resolvedArray = ArrayPool<ResolvedOutput>.Shared.Rent(descriptors.Length);
+        var resolved = resolvedArray.AsSpan(0, descriptors.Length);
+        resolved.Clear();
+
+        Span<int> lockOrder = stackalloc int[descriptors.Length];
+        var acquiredLocks = 0;
+        try
+        {
+            uint bufferLength = 0;
+            for (var i = 0; i < descriptors.Length; i++)
+            {
+                var descriptor = descriptors[i];
+                for (var previous = 0; previous < i; previous++)
+                {
+                    if (resolved[previous].Handle == descriptor.Handle)
+                    {
+                        return AudioOutErrorInvalidPort;
+                    }
+                }
+
+                if (!Ports.TryGetValue(descriptor.Handle, out var port))
+                {
+                    return _shutdown ? 0 : AudioOutErrorInvalidPort;
+                }
+
+                if (i == 0)
+                {
+                    bufferLength = port.BufferLength;
+                }
+                else if (port.BufferLength != bufferLength)
+                {
+                    return AudioOutErrorInvalidSize;
+                }
+
+                resolved[i].Handle = descriptor.Handle;
+                resolved[i].SourceAddress = descriptor.SourceAddress;
+                resolved[i].Port = port;
+                lockOrder[i] = i;
+            }
+
+            // Every batch takes port locks in handle order. Two guest threads can
+            // submit overlapping batches in a different descriptor order without
+            // deadlocking each other.
+            for (var i = 1; i < lockOrder.Length; i++)
+            {
+                var index = lockOrder[i];
+                var position = i;
+                while (position > 0 &&
+                       resolved[lockOrder[position - 1]].Handle > resolved[index].Handle)
+                {
+                    lockOrder[position] = lockOrder[position - 1];
+                    position--;
+                }
+
+                lockOrder[position] = index;
+            }
+
+            for (; acquiredLocks < lockOrder.Length; acquiredLocks++)
+            {
+                Monitor.Enter(resolved[lockOrder[acquiredLocks]].Port.SubmissionGate);
+            }
+
+            // AudioOutClose removes the handle before waiting for SubmissionGate.
+            // Recheck after acquiring all gates so a close racing this batch cannot
+            // turn a validated submission into a write to a disposed backend.
+            for (var i = 0; i < resolved.Length; i++)
+            {
+                if (!Ports.TryGetValue(resolved[i].Handle, out var current) ||
+                    !ReferenceEquals(current, resolved[i].Port))
+                {
+                    return _shutdown ? 0 : AudioOutErrorInvalidPort;
+                }
+            }
+
+            // Stage every guest buffer before the first host submission. A bad
+            // pointer in a later descriptor therefore cannot partially enqueue the
+            // earlier ports.
+            for (var i = 0; i < resolved.Length; i++)
+            {
+                ref var output = ref resolved[i];
+                if (output.SourceAddress == 0)
+                {
+                    continue;
+                }
+
+                var sourceBuffer = ArrayPool<byte>.Shared.Rent(output.Port.BufferByteLength);
+                try
+                {
+                    var source = sourceBuffer.AsSpan(0, output.Port.BufferByteLength);
+                    if (!ctx.Memory.TryRead(output.SourceAddress, source))
+                    {
+                        return AudioOutErrorInvalidPointer;
+                    }
+
+                    TraceOutput(output.Handle, output.Port, source);
+
+                    output.HostBufferLength = checked(
+                        (int)output.Port.BufferLength * AudioPcmConversion.OutputFrameSize);
+                    output.HostBuffer = ArrayPool<byte>.Shared.Rent(output.HostBufferLength);
+                    AudioPcmConversion.ConvertToStereoPcm16(
+                        source,
+                        output.HostBuffer.AsSpan(0, output.HostBufferLength),
+                        checked((int)output.Port.BufferLength),
+                        output.Port.Channels,
+                        output.Port.BytesPerSample,
+                        output.Port.IsFloat,
+                        output.Port.Volume);
+                }
+                finally
+                {
+                    ArrayPool<byte>.Shared.Return(sourceBuffer);
+                }
+            }
+
+            PortState? pacingPort = null;
+            for (var i = 0; i < resolved.Length; i++)
+            {
+                ref var output = ref resolved[i];
+                if (output.HostBuffer is null ||
+                    output.Port.Backend is null ||
+                    !output.Port.Backend.Submit(
+                        output.HostBuffer.AsSpan(0, output.HostBufferLength)))
+                {
+                    if (pacingPort is null ||
+                        HasLongerBufferDuration(output.Port, pacingPort))
+                    {
+                        pacingPort = output.Port;
+                    }
+                }
+            }
+
+            // A batch is one guest scheduling point. When one or more ports have
+            // no usable backend, pace once using the longest affected buffer rather
+            // than sleeping once per port.
+            pacingPort?.PaceSilence();
+            return checked((int)resolved[0].Port.BufferLength);
+        }
+        finally
+        {
+            for (var i = acquiredLocks - 1; i >= 0; i--)
+            {
+                Monitor.Exit(resolved[lockOrder[i]].Port.SubmissionGate);
+            }
+
+            for (var i = 0; i < resolved.Length; i++)
+            {
+                if (resolved[i].HostBuffer is { } hostBuffer)
+                {
+                    ArrayPool<byte>.Shared.Return(hostBuffer);
+                }
+            }
+
+            ArrayPool<ResolvedOutput>.Shared.Return(resolvedArray, clearArray: true);
+        }
+    }
+
+    private static bool HasLongerBufferDuration(PortState candidate, PortState current) =>
+        (ulong)candidate.BufferLength * current.Frequency >
+        (ulong)current.BufferLength * candidate.Frequency;
+
+    private static void TraceOutput(int handle, PortState port, ReadOnlySpan<byte> source)
+    {
+        if (!_traceOutput)
+        {
+            return;
+        }
+
+        var n = Interlocked.Increment(ref _outputCount);
+        if (n <= 8 || n % 200 == 0)
+        {
+            var peak = PeakAmplitude(source, port.IsFloat, port.BytesPerSample);
+            Console.Error.WriteLine(
+                $"[LOADER][TRACE] audioout.output#{n} handle={handle} bytes={source.Length} ch={port.Channels} float={port.IsFloat} vol={port.Volume:F2} peak={peak:F4} backend={(port.Backend is null ? "none" : "coreaudio")}");
+        }
+    }
+
     [SysAbiExport(
         Nid = "b+uAV89IlxE",
         ExportName = "sceAudioOutSetVolume",
@@ -362,6 +619,25 @@ public static class AudioOutExports
         }
     }
 
+    internal static void SetStreamFactoryForTests(Func<uint, IHostAudioStream?>? streamFactory) =>
+        Volatile.Write(ref _streamFactoryForTests, streamFactory);
+
+    internal static void ResetForTests()
+    {
+        foreach (var handle in Ports.Keys)
+        {
+            if (Ports.TryRemove(handle, out var port))
+            {
+                port.Dispose();
+            }
+        }
+
+        _nextPortHandle = 0;
+        _outputCount = 0;
+        Volatile.Write(ref _shutdown, false);
+        Volatile.Write(ref _streamFactoryForTests, null);
+    }
+
     private static bool _shutdown;
 
     private static bool TryGetFormat(

src/SharpEmu.Libs/Audio/AudioPcmConversion.cs

@@ -25,6 +25,10 @@ internal static class AudioPcmConversion
         float volume)
     {
         var sourceFrameSize = checked(channels * bytesPerSample);
+        // Volume is constant for the whole submission, so clamp it once here
+        // rather than per sample inside the loop (this runs on every real-time
+        // audio buffer, hundreds of frames at a time).
+        var clampedVolume = Math.Clamp(volume, 0.0f, 1.0f);
         for (var frame = 0; frame < frames; frame++)
         {
             var sourceFrame = source.Slice(frame * sourceFrameSize, sourceFrameSize);
@@ -32,8 +36,8 @@ internal static class AudioPcmConversion
             var right = channels == 1
                 ? left
                 : ReadSample(sourceFrame, 1, bytesPerSample, isFloat);
-            left = ApplyVolume(left, volume);
-            right = ApplyVolume(right, volume);
+            left = ApplyVolume(left, clampedVolume);
+            right = ApplyVolume(right, clampedVolume);
             BinaryPrimitives.WriteInt16LittleEndian(destination[(frame * OutputFrameSize)..], left);
             BinaryPrimitives.WriteInt16LittleEndian(destination[((frame * OutputFrameSize) + 2)..], right);
         }
@@ -67,9 +71,10 @@ internal static class AudioPcmConversion
         return checked((short)MathF.Round(value * scale));
     }
 
+    // <paramref name="volume"/> is expected pre-clamped to [0, 1] by the caller.
     private static short ApplyVolume(short sample, float volume)
     {
-        var scaled = MathF.Round(sample * Math.Clamp(volume, 0.0f, 1.0f));
+        var scaled = MathF.Round(sample * volume);
         return (short)Math.Clamp(scaled, short.MinValue, short.MaxValue);
     }
 }

src/SharpEmu.Libs/AvPlayer/AvPlayerExports.cs

@@ -1131,16 +1131,18 @@ public static class AvPlayerExports
         }
     }
 
-    private static string? FindFfmpeg() =>
+    internal static string? FindFfmpeg() =>
         FindFfmpeg(
             Environment.GetEnvironmentVariable("SHARPEMU_FFMPEG_PATH"),
             Environment.GetEnvironmentVariable("PATH"),
-            OperatingSystem.IsWindows());
+            OperatingSystem.IsWindows(),
+            AppContext.BaseDirectory);
 
     internal static string? FindFfmpeg(
         string? configured,
         string? searchPath,
-        bool isWindows)
+        bool isWindows,
+        string? baseDirectory = null)
     {
         if (!string.IsNullOrWhiteSpace(configured) && File.Exists(configured))
         {
@@ -1148,6 +1150,21 @@ public static class AvPlayerExports
         }
 
         var executable = isWindows ? "ffmpeg.exe" : "ffmpeg";
+        if (!string.IsNullOrWhiteSpace(baseDirectory))
+        {
+            foreach (var candidate in new[]
+                     {
+                         Path.Combine(baseDirectory, executable),
+                         Path.Combine(baseDirectory, "ffmpeg", executable),
+                     })
+            {
+                if (File.Exists(candidate))
+                {
+                    return candidate;
+                }
+            }
+        }
+
         foreach (var directory in (searchPath ?? string.Empty)
                      .Split(Path.PathSeparator, StringSplitOptions.RemoveEmptyEntries))
         {

src/SharpEmu.Libs/Bink/Bink2MovieBridge.cs

@@ -18,15 +18,43 @@ namespace SharpEmu.Libs.Bink;
 internal static class Bink2MovieBridge
 {
     private const uint MaxDimension = 16384;
+    private const uint MaxHostVideoWidth = 1920;
+    private const uint MaxHostVideoHeight = 1080;
+
     private static readonly object Gate = new();
-    private static NativeAdapter? _adapter;
     private static string? _activePath;
-    private static IntPtr _activeMovie;
     private static Bink2MovieInfo _activeInfo;
     private static byte[]? _frameBuffer;
-    private static bool _usingDummyMovie;
-    private static bool _loadAttempted;
-    private static bool _availabilityReported;
+    private static bool _frameBufferPresented;
+    private static BinkFramePlayback? _playback;
+    private static long _frameSerial;
+    private static uint _presentationWidth = MaxHostVideoWidth;
+    private static uint _presentationHeight = MaxHostVideoHeight;
+
+    internal static bool IsHostPlaybackActive
+    {
+        get
+        {
+            lock (Gate)
+            {
+                return _playback is not null || _frameBuffer is not null;
+            }
+        }
+    }
+
+    internal static void SetPresentationSize(uint width, uint height)
+    {
+        if (width == 0 || height == 0)
+        {
+            return;
+        }
+
+        lock (Gate)
+        {
+            _presentationWidth = Math.Min(width, MaxHostVideoWidth);
+            _presentationHeight = Math.Min(height, MaxHostVideoHeight);
+        }
+    }
 
     /// <summary>
     /// Returns true only when movie skipping was explicitly requested. Without
@@ -37,109 +65,106 @@ internal static class Bink2MovieBridge
         hostPath.EndsWith(".bk2", StringComparison.OrdinalIgnoreCase) &&
         ResolveMode() == MovieMode.Skip;
 
-    internal static void ObserveGuestMovie(string hostPath)
+    /// <summary>
+    /// Starts or queues host decoding. Decoded frames are only exposed as a
+    /// sampled guest texture; presentation and UI composition remain guest-owned.
+    /// </summary>
+    internal static bool ObserveGuestMovie(string hostPath)
     {
         if (!hostPath.EndsWith(".bk2", StringComparison.OrdinalIgnoreCase) ||
             !File.Exists(hostPath))
         {
-            return;
+            return false;
         }
 
         lock (Gate)
         {
             if (string.Equals(_activePath, hostPath, StringComparison.OrdinalIgnoreCase))
             {
-                return;
+                return _playback is not null || _frameBuffer is not null;
             }
 
             var mode = ResolveMode();
-            if (mode == MovieMode.Dummy)
+            if (mode is MovieMode.Guest or MovieMode.Skip)
             {
-                AttachDummyMovieLocked(hostPath);
-                return;
+                return false;
             }
 
-            if (mode != MovieMode.Native)
+            if (_playback is not null || _frameBuffer is not null)
             {
-                return;
+                if (PendingMoviePathSet.Add(hostPath))
+                {
+                    PendingMoviePaths.Enqueue(hostPath);
+                    Console.Error.WriteLine(
+                        "[LOADER][INFO] Bink2 bridge queued: " +
+                        Path.GetFileName(hostPath));
+                }
+                return PendingMoviePathSet.Contains(hostPath);
             }
 
-            var adapter = GetAdapterLocked();
-            if (adapter is null)
-            {
-                return;
-            }
-
-            CloseActiveLocked();
-            if (!adapter.TryOpen(hostPath, out var movie, out var info))
-            {
-                Console.Error.WriteLine(
-                    "[LOADER][WARN] Bink2 bridge could not open movie '" +
-                    Path.GetFileName(hostPath) + "'.");
-                return;
-            }
-
-            if (!IsValid(info))
-            {
-                adapter.Close(movie);
-                Console.Error.WriteLine(
-                    "[LOADER][WARN] Bink2 bridge rejected invalid movie dimensions for '" +
-                    Path.GetFileName(hostPath) + "'.");
-                return;
-            }
-
-            _activePath = hostPath;
-            _activeMovie = movie;
-            _activeInfo = info;
-            _frameBuffer = GC.AllocateUninitializedArray<byte>(GetFrameBufferLength(info));
-            Console.Error.WriteLine(
-                "[LOADER][INFO] Bink2 bridge attached: " + Path.GetFileName(hostPath) + " " +
-                info.Width + "x" + info.Height + " @ " +
-                info.FramesPerSecondNumerator + "/" + info.FramesPerSecondDenominator + " fps.");
+            AttachMovieLocked(hostPath, mode);
+            return string.Equals(_activePath, hostPath, StringComparison.OrdinalIgnoreCase) &&
+                   (_playback is not null || _frameBuffer is not null);
         }
     }
 
     internal static bool TryDecodeNextFrame(
+        bool advanceClock,
         out byte[] pixels,
         out uint width,
-        out uint height)
+        out uint height,
+        out bool advanced,
+        out long frameSerial,
+        out string hostPath)
     {
         lock (Gate)
         {
             pixels = [];
             width = 0;
             height = 0;
-            if (_adapter is null || _activeMovie == IntPtr.Zero || _frameBuffer is null)
+            advanced = false;
+            frameSerial = _frameSerial;
+            hostPath = _activePath ?? string.Empty;
+
+            if (_playback is not null)
             {
-                if (_usingDummyMovie && _frameBuffer is not null)
+                if (!_playback.TryGetFrame(advanceClock, out pixels, out advanced))
                 {
-                    pixels = _frameBuffer;
-                    width = _activeInfo.Width;
-                    height = _activeInfo.Height;
-                    return true;
+                    if (_playback.IsFinished)
+                    {
+                        var completedPath = _activePath;
+                        CloseActiveLocked();
+                        Console.Error.WriteLine(
+                            "[LOADER][INFO] Bink2 bridge completed: " +
+                            Path.GetFileName(completedPath));
+                        AttachNextQueuedMovieLocked();
+                    }
+                    return false;
                 }
 
-                return false;
+                width = _activeInfo.Width;
+                height = _activeInfo.Height;
+                if (advanced)
+                {
+                    frameSerial = ++_frameSerial;
+                }
+                return true;
             }
 
-            unsafe
+            if (_frameBuffer is null)
             {
-                fixed (byte* destination = _frameBuffer)
-                {
-                    if (!_adapter.DecodeNextBgra(
-                            _activeMovie,
-                            (IntPtr)destination,
-                            _activeInfo.Width * 4,
-                            (uint)_frameBuffer.Length))
-                    {
-                        return false;
-                    }
-                }
+                return false;
             }
 
             pixels = _frameBuffer;
             width = _activeInfo.Width;
             height = _activeInfo.Height;
+            advanced = !_frameBufferPresented;
+            _frameBufferPresented = true;
+            if (advanced)
+            {
+                frameSerial = ++_frameSerial;
+            }
             return true;
         }
     }
@@ -152,6 +177,52 @@ internal static class Bink2MovieBridge
     private static int GetFrameBufferLength(Bink2MovieInfo info) =>
         checked((int)((ulong)info.Width * info.Height * 4));
 
+    private static void AttachMovieLocked(string hostPath, MovieMode mode)
+    {
+        switch (mode)
+        {
+            case MovieMode.Dummy:
+                AttachDummyMovieLocked(hostPath);
+                return;
+            case MovieMode.Ffmpeg:
+                AttachFfmpegMovieLocked(hostPath);
+                return;
+            case MovieMode.Native:
+                AttachNativeMovieLocked(hostPath);
+                return;
+        }
+    }
+
+    private static void AttachNativeMovieLocked(string hostPath)
+    {
+        if (!FfmpegNativeBinkFrameSource.TryOpen(
+                hostPath, _presentationWidth, _presentationHeight, out var source) ||
+            source is null)
+        {
+            Console.Error.WriteLine(
+                "[LOADER][WARN] Bink2 bridge could not open movie '" +
+                Path.GetFileName(hostPath) + "'.");
+            return;
+        }
+
+        var info = new Bink2MovieInfo(
+            source.Width, source.Height, source.FramesPerSecondNumerator, source.FramesPerSecondDenominator);
+        if (!IsValid(info))
+        {
+            source.Dispose();
+            Console.Error.WriteLine(
+                "[LOADER][WARN] Bink2 bridge rejected invalid movie dimensions for '" +
+                Path.GetFileName(hostPath) + "'.");
+            return;
+        }
+
+        AttachPlaybackLocked(hostPath, info, source);
+        Console.Error.WriteLine(
+            "[LOADER][INFO] Bink2 bridge attached: " + Path.GetFileName(hostPath) + " " +
+            info.Width + "x" + info.Height + " @ " +
+            info.FramesPerSecondNumerator + "/" + info.FramesPerSecondDenominator + " fps.");
+    }
+
     private static MovieMode ResolveMode()
     {
         var configured = Environment.GetEnvironmentVariable("SHARPEMU_BINK_MODE");
@@ -170,15 +241,22 @@ internal static class Bink2MovieBridge
             return MovieMode.Skip;
         }
 
-        // Prefer the optional host adapter when one is supplied. Otherwise let
-        // the game's statically linked Bink implementation consume the file.
-        if (!string.IsNullOrWhiteSpace(Environment.GetEnvironmentVariable("SHARPEMU_BINK2_BRIDGE")) ||
-            EnumerateAdapterCandidates().Any(File.Exists))
+        if (string.Equals(configured, "guest", StringComparison.OrdinalIgnoreCase))
         {
-            return MovieMode.Native;
+            return MovieMode.Guest;
         }
 
-        return MovieMode.Guest;
+        if (string.Equals(configured, "ffmpeg", StringComparison.OrdinalIgnoreCase))
+        {
+            return MovieMode.Ffmpeg;
+        }
+
+        // Native is the default: FfmpegNativeBinkFrameSource.TryOpen degrades
+        // gracefully (falls back to the guest's own decode, logging one
+        // informational line) if the FFmpeg libraries SharpEmu.CLI.csproj
+        // downloads next to the executable are genuinely unavailable, so
+        // defaulting to Native unconditionally is safe.
+        return MovieMode.Native;
     }
 
     private static void AttachDummyMovieLocked(string hostPath)
@@ -195,22 +273,61 @@ internal static class Bink2MovieBridge
         _activePath = hostPath;
         _activeInfo = info;
         _frameBuffer = GC.AllocateUninitializedArray<byte>(GetFrameBufferLength(info));
+        _frameBufferPresented = false;
         FillDummyFrame(_frameBuffer, info.Width, info.Height);
-        _usingDummyMovie = true;
         Console.Error.WriteLine(
             "[LOADER][INFO] Bink dummy attached: " + Path.GetFileName(hostPath) + " " +
             info.Width + "x" + info.Height + ".");
     }
 
-    private static bool TryReadBinkInfo(string path, out Bink2MovieInfo info)
+    private static void AttachFfmpegMovieLocked(string hostPath)
+    {
+        if (!TryReadBinkInfo(hostPath, out var info) || !IsValid(info))
+        {
+            Console.Error.WriteLine(
+                "[LOADER][WARN] Bink FFmpeg source has an invalid header: " +
+                Path.GetFileName(hostPath));
+            return;
+        }
+
+        if (!FfmpegBinkFrameSource.TryOpen(
+                hostPath,
+                info.Width,
+                info.Height,
+                info.FramesPerSecondNumerator,
+                info.FramesPerSecondDenominator,
+                out var source) || source is null)
+        {
+            return;
+        }
+
+        AttachPlaybackLocked(hostPath, info, source);
+        Console.Error.WriteLine(
+            "[LOADER][INFO] Bink FFmpeg source attached: " +
+            Path.GetFileName(hostPath) + " " + info.Width + "x" + info.Height + " @ " +
+            info.FramesPerSecondNumerator + "/" + info.FramesPerSecondDenominator + " fps.");
+    }
+
+    private static void AttachPlaybackLocked(
+        string hostPath,
+        Bink2MovieInfo info,
+        IBinkFrameDecoder decoder)
+    {
+        CloseActiveLocked();
+        _activePath = hostPath;
+        _activeInfo = info;
+        _playback = new BinkFramePlayback(decoder);
+    }
+
+    internal static bool TryReadBinkInfo(string path, out Bink2MovieInfo info)
     {
         info = default;
-        Span<byte> header = stackalloc byte[32];
+        Span<byte> header = stackalloc byte[36];
         try
         {
             using var stream = File.OpenRead(path);
-            if (stream.Read(header) != header.Length ||
-                !header[..4].SequenceEqual("KB2j"u8))
+            stream.ReadExactly(header);
+            if (!header[..3].SequenceEqual("KB2"u8))
             {
                 return false;
             }
@@ -219,10 +336,11 @@ internal static class Bink2MovieBridge
                 BinaryPrimitives.ReadUInt32LittleEndian(header.Slice(0x14, 4)),
                 BinaryPrimitives.ReadUInt32LittleEndian(header.Slice(0x18, 4)),
                 BinaryPrimitives.ReadUInt32LittleEndian(header.Slice(0x1C, 4)),
-                1);
-            return true;
+                BinaryPrimitives.ReadUInt32LittleEndian(header.Slice(0x20, 4)));
+            return info.FramesPerSecondNumerator != 0 &&
+                   info.FramesPerSecondDenominator != 0;
         }
-        catch (IOException)
+        catch (Exception exception) when (exception is IOException or EndOfStreamException)
         {
             return false;
         }
@@ -244,80 +362,23 @@ internal static class Bink2MovieBridge
         }
     }
 
-    private static NativeAdapter? GetAdapterLocked()
-    {
-        if (_loadAttempted)
-        {
-            return _adapter;
-        }
-
-        _loadAttempted = true;
-        foreach (var candidate in EnumerateAdapterCandidates())
-        {
-            if (!NativeLibrary.TryLoad(candidate, out var library))
-            {
-                continue;
-            }
-
-            if (NativeAdapter.TryCreate(library, out var adapter))
-            {
-                _adapter = adapter;
-                Console.Error.WriteLine("[LOADER][INFO] Bink2 bridge loaded: " + candidate);
-                return adapter;
-            }
-
-            NativeLibrary.Free(library);
-        }
-
-        if (!_availabilityReported)
-        {
-            _availabilityReported = true;
-            Console.Error.WriteLine(
-                "[LOADER][INFO] Bink2 bridge unavailable; install the licensed adapter and set SHARPEMU_BINK2_BRIDGE.");
-        }
-
-        return null;
-    }
-
-    private static IEnumerable<string> EnumerateAdapterCandidates()
-    {
-        var configured = Environment.GetEnvironmentVariable("SHARPEMU_BINK2_BRIDGE");
-        if (!string.IsNullOrWhiteSpace(configured))
-        {
-            yield return configured;
-        }
-
-        var baseDirectory = AppContext.BaseDirectory;
-        if (OperatingSystem.IsMacOS())
-        {
-            yield return Path.Combine(baseDirectory, "libsharpemu_bink2_bridge.dylib");
-        }
-        else if (OperatingSystem.IsWindows())
-        {
-            yield return Path.Combine(baseDirectory, "sharpemu_bink2_bridge.dll");
-        }
-        else
-        {
-            yield return Path.Combine(baseDirectory, "libsharpemu_bink2_bridge.so");
-        }
-    }
 
     private static void CloseActiveLocked()
     {
-        if (_activeMovie != IntPtr.Zero)
-        {
-            _adapter?.Close(_activeMovie);
-        }
-
+        _playback?.Dispose();
+        _playback = null;
         _activePath = null;
-        _activeMovie = IntPtr.Zero;
         _activeInfo = default;
         _frameBuffer = null;
-        _usingDummyMovie = false;
+        _frameBufferPresented = false;
+
+        // Wake any guest _read() blocked in WaitForHostPlaybackToFinish: its
+        // movie either just finished or is being pre-empted by a new attach.
+        Monitor.PulseAll(Gate);
     }
 
     [StructLayout(LayoutKind.Sequential)]
-    private readonly struct Bink2MovieInfo
+    internal readonly struct Bink2MovieInfo
     {
         public readonly uint Width;
         public readonly uint Height;
@@ -343,66 +404,222 @@ internal static class Bink2MovieBridge
         Skip,
         Dummy,
         Native,
+        Ffmpeg,
     }
 
-    private sealed class NativeAdapter
+    private static readonly Queue<string> PendingMoviePaths = new();
+    private static readonly HashSet<string> PendingMoviePathSet =
+        new(StringComparer.OrdinalIgnoreCase);
+    private static void AttachNextQueuedMovieLocked()
     {
-        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
-        private delegate int OpenUtf8Delegate(IntPtr pathUtf8, out IntPtr movie, out Bink2MovieInfo info);
-
-        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
-        private delegate int DecodeNextBgraDelegate(IntPtr movie, IntPtr destination, uint stride, uint destinationBytes);
-
-        [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
-        private delegate void CloseDelegate(IntPtr movie);
-
-        private readonly OpenUtf8Delegate _openUtf8;
-        private readonly DecodeNextBgraDelegate _decodeNextBgra;
-        private readonly CloseDelegate _close;
-
-        private NativeAdapter(
-            OpenUtf8Delegate openUtf8,
-            DecodeNextBgraDelegate decodeNextBgra,
-            CloseDelegate close)
+        while (PendingMoviePaths.Count > 0)
         {
-            _openUtf8 = openUtf8;
-            _decodeNextBgra = decodeNextBgra;
-            _close = close;
+            var path = PendingMoviePaths.Dequeue();
+            PendingMoviePathSet.Remove(path);
+            if (!File.Exists(path))
+            {
+                continue;
+            }
+
+            AttachMovieLocked(path, ResolveMode());
+            if (_playback is not null || _frameBuffer is not null)
+            {
+                return;
+            }
         }
-
-        internal static bool TryCreate(IntPtr library, out NativeAdapter? adapter)
+    }
+    // Longest a guest _read() will block waiting for real host playback to
+    // finish. A safety net, not a target: real movies finish well under
+    // this. Bounds the damage if a movie fails to attach/decode after being
+    // queued, so the guest thread doesn't hang forever.
+    private const long MaxCompletionWaitMilliseconds = 5 * 60 * 1000;
+    /// <summary>
+    /// Blocks the calling (guest I/O) thread until the host has actually
+    /// finished presenting <paramref name="hostPath"/> — either because it
+    /// played through, or because something else took over the timeline.
+    ///
+    /// The completion shim tells the guest's own Bink header parse "this
+    /// movie is one frame and already done" so its native decoder never
+    /// blocks the guest on real per-frame work. Without this wait, that lie
+    /// lands the instant the guest reads the header, so guest-side game
+    /// logic races far ahead of whatever the host is still showing on
+    /// screen: pressing a button lands on the (already-advanced) guest
+    /// state, but the video visibly keeps playing, and any real-time-gated
+    /// trigger later in the guest's own flow can fire against a clock that
+    /// no longer matches wall time. Gating the "done" read on real host
+    /// completion keeps guest pacing and on-screen playback in lockstep.
+    /// </summary>
+    internal static void WaitForHostPlaybackToFinish(string hostPath)
+    {
+        var deadline = Environment.TickCount64 + MaxCompletionWaitMilliseconds;
+        lock (Gate)
         {
-            adapter = null;
-            if (!NativeLibrary.TryGetExport(library, "sharpemu_bink2_open_utf8", out var open) ||
-                !NativeLibrary.TryGetExport(library, "sharpemu_bink2_decode_next_bgra", out var decode) ||
-                !NativeLibrary.TryGetExport(library, "sharpemu_bink2_close", out var close))
+            while (IsTrackedLocked(hostPath))
+            {
+                var remaining = deadline - Environment.TickCount64;
+                if (remaining <= 0)
+                {
+                    Console.Error.WriteLine(
+                        "[LOADER][WARN] Bink2 bridge completion wait timed out for '" +
+                        Path.GetFileName(hostPath) + "'.");
+                    return;
+                }
+
+                Monitor.Wait(Gate, (int)Math.Min(remaining, 200));
+            }
+        }
+    }
+
+    private static bool IsTrackedLocked(string hostPath) =>
+        string.Equals(_activePath, hostPath, StringComparison.OrdinalIgnoreCase) ||
+        PendingMoviePathSet.Contains(hostPath);
+
+    internal static bool TryTakeOverGuestMovie(
+        string hostPath,
+        out BinkGuestCompletionShim completionShim,
+        out bool observed)
+    {
+        completionShim = default;
+        observed = ObserveGuestMovie(hostPath);
+
+        // Keep the real header visible so the guest creates its movie surface
+        // and draw. Host-decoded pixels replace that sampled image later; a
+        // one-frame completion shim would finish before the descriptor exists.
+        return false;
+    }
+
+    internal static void NotifyGuestMovieClosed(string hostPath)
+    {
+        lock (Gate)
+        {
+            if (PendingMoviePathSet.Remove(hostPath))
+            {
+                var retained = PendingMoviePaths
+                    .Where(path => !string.Equals(
+                        path,
+                        hostPath,
+                        StringComparison.OrdinalIgnoreCase))
+                    .ToArray();
+                PendingMoviePaths.Clear();
+                foreach (var path in retained)
+                {
+                    PendingMoviePaths.Enqueue(path);
+                }
+            }
+
+            if (!string.Equals(_activePath, hostPath, StringComparison.OrdinalIgnoreCase))
+            {
+                Monitor.PulseAll(Gate);
+                return;
+            }
+
+            Console.Error.WriteLine(
+                "[LOADER][INFO] Bink2 bridge stopped by guest close: " +
+                Path.GetFileName(hostPath));
+            CloseActiveLocked();
+            AttachNextQueuedMovieLocked();
+        }
+    }
+
+    internal static bool TryReadGuestCompletionShim(
+        string hostPath,
+        out BinkGuestCompletionShim completionShim)
+    {
+        completionShim = default;
+        Span<byte> header = stackalloc byte[48];
+        try
+        {
+            using var stream = File.OpenRead(hostPath);
+            stream.ReadExactly(header);
+            if (!header[..3].SequenceEqual("KB2"u8))
             {
                 return false;
             }
 
-            adapter = new NativeAdapter(
-                Marshal.GetDelegateForFunctionPointer<OpenUtf8Delegate>(open),
-                Marshal.GetDelegateForFunctionPointer<DecodeNextBgraDelegate>(decode),
-                Marshal.GetDelegateForFunctionPointer<CloseDelegate>(close));
+            var frameCount = BinaryPrimitives.ReadUInt32LittleEndian(header[8..12]);
+            var audioTrackCount = BinaryPrimitives.ReadUInt32LittleEndian(header[40..44]);
+            if (frameCount < 2 || audioTrackCount > 256)
+            {
+                return false;
+            }
+
+            var revision = header[3];
+            var frameIndexOffset = 44L + checked(12L * audioTrackCount);
+            if (revision == (byte)'m')
+            {
+                frameIndexOffset += 16;
+            }
+            else if (revision is (byte)'i' or (byte)'j' or (byte)'k' or (byte)'n')
+            {
+                frameIndexOffset += 4;
+            }
+
+            Span<byte> frameOffsets = stackalloc byte[8];
+            stream.Position = frameIndexOffset;
+            stream.ReadExactly(frameOffsets);
+            var firstFrameOffset = BinaryPrimitives.ReadUInt32LittleEndian(frameOffsets[..4]) & ~1u;
+            var secondFrameOffset = BinaryPrimitives.ReadUInt32LittleEndian(frameOffsets[4..]) & ~1u;
+            if (firstFrameOffset < frameIndexOffset + 8 ||
+                secondFrameOffset <= firstFrameOffset ||
+                secondFrameOffset > stream.Length)
+            {
+                return false;
+            }
+
+            completionShim = new BinkGuestCompletionShim(
+                secondFrameOffset - 8,
+                secondFrameOffset - firstFrameOffset);
             return true;
         }
-
-        internal bool TryOpen(string path, out IntPtr movie, out Bink2MovieInfo info)
+        catch (Exception exception) when (
+            exception is IOException or EndOfStreamException or OverflowException)
         {
-            var utf8 = Marshal.StringToCoTaskMemUTF8(path);
-            try
-            {
-                return _openUtf8(utf8, out movie, out info) != 0 && movie != IntPtr.Zero;
-            }
-            finally
-            {
-                Marshal.FreeCoTaskMem(utf8);
-            }
+            return false;
+        }
+    }
+
+    internal readonly struct BinkGuestCompletionShim
+    {
+        private readonly uint _fileSizeMinusHeader;
+        private readonly uint _largestFrameSize;
+
+        internal BinkGuestCompletionShim(uint fileSizeMinusHeader, uint largestFrameSize)
+        {
+            _fileSizeMinusHeader = fileSizeMinusHeader;
+            _largestFrameSize = largestFrameSize;
         }
 
-        internal bool DecodeNextBgra(IntPtr movie, IntPtr destination, uint stride, uint destinationBytes) =>
-            _decodeNextBgra(movie, destination, stride, destinationBytes) != 0;
+        /// <summary>
+        /// Rewrites the frame-count/size fields the guest's own Bink header
+        /// parse reads, if this read covers them. Returns true when the
+        /// NumFrames field (the field that tells the guest "this movie is
+        /// done") was in range, so the caller can gate that specific read on
+        /// the host's real playback actually finishing first.
+        /// </summary>
+        internal bool Patch(long fileOffset, Span<byte> bytes)
+        {
+            PatchUInt32(fileOffset, bytes, 4, _fileSizeMinusHeader);
+            var touchedCompletionField = PatchUInt32(fileOffset, bytes, 8, 1);
+            PatchUInt32(fileOffset, bytes, 12, _largestFrameSize);
+            return touchedCompletionField;
+        }
 
-        internal void Close(IntPtr movie) => _close(movie);
+        private static bool PatchUInt32(
+            long fileOffset,
+            Span<byte> bytes,
+            long fieldOffset,
+            uint value)
+        {
+            var relativeOffset = fieldOffset - fileOffset;
+            if (relativeOffset < 0 || relativeOffset + sizeof(uint) > bytes.Length)
+            {
+                return false;
+            }
+
+            BinaryPrimitives.WriteUInt32LittleEndian(
+                bytes.Slice((int)relativeOffset, sizeof(uint)),
+                value);
+            return true;
+        }
     }
 }

src/SharpEmu.Libs/Bink/BinkFramePlayback.cs

@@ -0,0 +1,246 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Diagnostics;
+
+namespace SharpEmu.Libs.Bink;
+
+internal interface IBinkFrameDecoder : IDisposable
+{
+    uint Width { get; }
+
+    uint Height { get; }
+
+    uint FramesPerSecondNumerator { get; }
+
+    uint FramesPerSecondDenominator { get; }
+
+    bool TryDecodeNextFrame(Span<byte> destination);
+}
+
+/// <summary>
+/// Keeps blocking codec work away from the Vulkan presentation thread and
+/// releases decoded frames according to the movie time base.
+/// </summary>
+internal sealed class BinkFramePlayback : IDisposable
+{
+    private const int BufferCount = 5;
+
+    private readonly object _gate = new();
+    private readonly IBinkFrameDecoder _decoder;
+    private readonly Queue<byte[]> _freeBuffers = new();
+    private readonly Queue<DecodedFrame> _decodedFrames = new();
+    private readonly Thread _decoderThread;
+    private byte[]? _currentFrame;
+    private byte[]? _retiredFrame;
+    private long _currentFrameIndex = -1;
+    private long _nextDecodedFrameIndex;
+    private long _playbackStartTimestamp;
+    private bool _playbackClockStarted;
+    private bool _decoderCompleted;
+    private bool _stopRequested;
+    private bool _finished;
+    private int _disposed;
+
+    internal BinkFramePlayback(IBinkFrameDecoder decoder)
+    {
+        _decoder = decoder;
+        Width = decoder.Width;
+        Height = decoder.Height;
+        FramesPerSecondNumerator = decoder.FramesPerSecondNumerator;
+        FramesPerSecondDenominator = decoder.FramesPerSecondDenominator;
+
+        var frameBytes = checked((int)((ulong)Width * Height * 4));
+        for (var index = 0; index < BufferCount; index++)
+        {
+            _freeBuffers.Enqueue(GC.AllocateUninitializedArray<byte>(frameBytes));
+        }
+
+        _decoderThread = new Thread(DecodeLoop)
+        {
+            IsBackground = true,
+            Name = "SharpEmu Bink video decoder",
+        };
+        _decoderThread.Start();
+    }
+
+    internal uint Width { get; }
+
+    internal uint Height { get; }
+
+    internal uint FramesPerSecondNumerator { get; }
+
+    internal uint FramesPerSecondDenominator { get; }
+
+    internal bool IsFinished
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _finished;
+            }
+        }
+    }
+
+    internal bool TryGetFrame(
+        bool advanceClock,
+        out byte[] pixels,
+        out bool advanced)
+    {
+        lock (_gate)
+        {
+            pixels = [];
+            advanced = false;
+            if (_finished)
+            {
+                return false;
+            }
+
+            if (_currentFrame is null)
+            {
+                if (_decodedFrames.Count == 0)
+                {
+                    if (_decoderCompleted)
+                    {
+                        _finished = true;
+                    }
+                    return false;
+                }
+
+                var first = _decodedFrames.Dequeue();
+                _currentFrame = first.Pixels;
+                _currentFrameIndex = first.Index;
+                advanced = true;
+                Monitor.PulseAll(_gate);
+            }
+
+            if (advanceClock && !_playbackClockStarted)
+            {
+                _playbackStartTimestamp = Stopwatch.GetTimestamp();
+                _playbackClockStarted = true;
+            }
+
+            var elapsedSeconds = _playbackClockStarted
+                ? Stopwatch.GetElapsedTime(_playbackStartTimestamp).TotalSeconds
+                : 0;
+            var targetFrameIndex = (long)Math.Floor(
+                elapsedSeconds * FramesPerSecondNumerator / FramesPerSecondDenominator);
+            DecodedFrame? replacement = null;
+            while (_decodedFrames.Count > 0 &&
+                   _decodedFrames.Peek().Index <= targetFrameIndex)
+            {
+                if (replacement is { } skipped)
+                {
+                    _freeBuffers.Enqueue(skipped.Pixels);
+                }
+                replacement = _decodedFrames.Dequeue();
+            }
+
+            if (replacement is { } next)
+            {
+                if (_retiredFrame is not null)
+                {
+                    _freeBuffers.Enqueue(_retiredFrame);
+                }
+                _retiredFrame = _currentFrame;
+                _currentFrame = next.Pixels;
+                _currentFrameIndex = next.Index;
+                advanced = true;
+                Monitor.PulseAll(_gate);
+            }
+
+            var frameDurationSeconds =
+                (double)FramesPerSecondDenominator / FramesPerSecondNumerator;
+            if (_playbackClockStarted &&
+                _decoderCompleted &&
+                _decodedFrames.Count == 0 &&
+                elapsedSeconds >= (_currentFrameIndex + 1) * frameDurationSeconds)
+            {
+                _finished = true;
+                return false;
+            }
+
+            pixels = _currentFrame;
+            return true;
+        }
+    }
+
+    private void DecodeLoop()
+    {
+        try
+        {
+            while (true)
+            {
+                byte[] destination;
+                lock (_gate)
+                {
+                    while (!_stopRequested && _freeBuffers.Count == 0)
+                    {
+                        Monitor.Wait(_gate);
+                    }
+                    if (_stopRequested)
+                    {
+                        return;
+                    }
+                    destination = _freeBuffers.Dequeue();
+                }
+
+                if (!_decoder.TryDecodeNextFrame(destination))
+                {
+                    lock (_gate)
+                    {
+                        _freeBuffers.Enqueue(destination);
+                        _decoderCompleted = true;
+                        Monitor.PulseAll(_gate);
+                    }
+                    return;
+                }
+
+                lock (_gate)
+                {
+                    _decodedFrames.Enqueue(new DecodedFrame(
+                        _nextDecodedFrameIndex++, destination));
+                    Monitor.PulseAll(_gate);
+                }
+            }
+        }
+        catch (Exception exception) when (exception is IOException or
+                                             InvalidOperationException)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][WARN] Bink decoder stopped: {exception.Message}");
+            lock (_gate)
+            {
+                _decoderCompleted = true;
+                Monitor.PulseAll(_gate);
+            }
+        }
+    }
+
+    public void Dispose()
+    {
+        if (Interlocked.Exchange(ref _disposed, 1) != 0)
+        {
+            return;
+        }
+
+        lock (_gate)
+        {
+            _stopRequested = true;
+            Monitor.PulseAll(_gate);
+        }
+        if (Thread.CurrentThread != _decoderThread &&
+            !_decoderThread.Join(TimeSpan.FromMilliseconds(100)))
+        {
+            _decoder.Dispose();
+            _decoderThread.Join(TimeSpan.FromSeconds(2));
+        }
+        else
+        {
+            _decoder.Dispose();
+        }
+    }
+
+    private readonly record struct DecodedFrame(long Index, byte[] Pixels);
+}

src/SharpEmu.Libs/Bink/FfmpegBinkFrameSource.cs

@@ -0,0 +1,166 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Diagnostics;
+using SharpEmu.Libs.AvPlayer;
+
+namespace SharpEmu.Libs.Bink;
+
+internal sealed class FfmpegBinkFrameSource : IBinkFrameDecoder
+{
+    private readonly Process _process;
+    private readonly Stream _output;
+    private int _errorLines;
+    private int _disposed;
+
+    private FfmpegBinkFrameSource(
+        Process process,
+        uint width,
+        uint height,
+        uint framesPerSecondNumerator,
+        uint framesPerSecondDenominator)
+    {
+        _process = process;
+        _output = process.StandardOutput.BaseStream;
+        Width = width;
+        Height = height;
+        FramesPerSecondNumerator = framesPerSecondNumerator;
+        FramesPerSecondDenominator = framesPerSecondDenominator;
+    }
+
+    public uint Width { get; }
+
+    public uint Height { get; }
+
+    public uint FramesPerSecondNumerator { get; }
+
+    public uint FramesPerSecondDenominator { get; }
+
+    internal static bool IsAvailable => AvPlayerExports.FindFfmpeg() is not null;
+
+    internal static bool TryOpen(
+        string path,
+        uint width,
+        uint height,
+        uint framesPerSecondNumerator,
+        uint framesPerSecondDenominator,
+        out FfmpegBinkFrameSource? source)
+    {
+        source = null;
+        var ffmpeg = AvPlayerExports.FindFfmpeg();
+        if (ffmpeg is null)
+        {
+            return false;
+        }
+
+        var startInfo = new ProcessStartInfo(ffmpeg)
+        {
+            UseShellExecute = false,
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            CreateNoWindow = true,
+        };
+        startInfo.ArgumentList.Add("-nostdin");
+        startInfo.ArgumentList.Add("-hide_banner");
+        startInfo.ArgumentList.Add("-loglevel");
+        startInfo.ArgumentList.Add("error");
+        startInfo.ArgumentList.Add("-i");
+        startInfo.ArgumentList.Add(path);
+        startInfo.ArgumentList.Add("-map");
+        startInfo.ArgumentList.Add("0:v:0");
+        startInfo.ArgumentList.Add("-an");
+        startInfo.ArgumentList.Add("-pix_fmt");
+        startInfo.ArgumentList.Add("bgra");
+        startInfo.ArgumentList.Add("-f");
+        startInfo.ArgumentList.Add("rawvideo");
+        startInfo.ArgumentList.Add("pipe:1");
+
+        try
+        {
+            var process = Process.Start(startInfo);
+            if (process is null)
+            {
+                return false;
+            }
+
+            source = new FfmpegBinkFrameSource(
+                process,
+                width,
+                height,
+                framesPerSecondNumerator,
+                framesPerSecondDenominator);
+            process.ErrorDataReceived += source.OnErrorData;
+            process.BeginErrorReadLine();
+            return true;
+        }
+        catch (Exception exception) when (exception is IOException or
+                                             InvalidOperationException or
+                                             System.ComponentModel.Win32Exception)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][WARN] Bink FFmpeg decoder could not start: {exception.Message}");
+            return false;
+        }
+    }
+
+    public bool TryDecodeNextFrame(Span<byte> destination)
+    {
+        try
+        {
+            var offset = 0;
+            while (offset < destination.Length)
+            {
+                var read = _output.Read(destination[offset..]);
+                if (read == 0)
+                {
+                    return false;
+                }
+                offset += read;
+            }
+            return true;
+        }
+        catch (Exception exception) when (exception is IOException or ObjectDisposedException)
+        {
+            if (Volatile.Read(ref _disposed) == 0)
+            {
+                Console.Error.WriteLine(
+                    $"[LOADER][WARN] Bink FFmpeg stream failed: {exception.Message}");
+            }
+            return false;
+        }
+    }
+
+    private void OnErrorData(object sender, DataReceivedEventArgs eventArgs)
+    {
+        if (string.IsNullOrWhiteSpace(eventArgs.Data) ||
+            Interlocked.Increment(ref _errorLines) > 20)
+        {
+            return;
+        }
+        Console.Error.WriteLine($"[LOADER][FFMPEG-BINK] {eventArgs.Data}");
+    }
+
+    public void Dispose()
+    {
+        if (Interlocked.Exchange(ref _disposed, 1) != 0)
+        {
+            return;
+        }
+
+        _output.Dispose();
+        try
+        {
+            if (!_process.HasExited)
+            {
+                _process.Kill(entireProcessTree: true);
+            }
+        }
+        catch (InvalidOperationException)
+        {
+        }
+        finally
+        {
+            _process.Dispose();
+        }
+    }
+}

src/SharpEmu.Libs/Bink/FfmpegNativeBinkFrameSource.cs

@@ -0,0 +1,355 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using FFmpeg.AutoGen;
+
+namespace SharpEmu.Libs.Bink;
+
+/// <summary>
+/// Decodes a .bk2 (or any FFmpeg-readable movie) directly via FFmpeg's C API
+/// through FFmpeg.AutoGen P/Invoke bindings against the dynamically linked
+/// libraries published by github.com/sharpemu/ffmpeg-core -- no native C
+/// bridge of our own to build. See docs/bink2-bridge.md.
+/// </summary>
+internal sealed unsafe class FfmpegNativeBinkFrameSource : IBinkFrameDecoder
+{
+    private AVFormatContext* _formatContext;
+    private AVCodecContext* _codecContext;
+    private SwsContext* _swsContext;
+    private AVFrame* _frame;
+    private AVPacket* _packet;
+    private readonly int _videoStreamIndex;
+    private bool _draining;
+    private int _disposed;
+
+    public uint Width { get; }
+
+    public uint Height { get; }
+
+    public uint FramesPerSecondNumerator { get; }
+
+    public uint FramesPerSecondDenominator { get; }
+
+    private FfmpegNativeBinkFrameSource(
+        AVFormatContext* formatContext,
+        AVCodecContext* codecContext,
+        int videoStreamIndex,
+        uint width,
+        uint height,
+        uint framesPerSecondNumerator,
+        uint framesPerSecondDenominator)
+    {
+        _formatContext = formatContext;
+        _codecContext = codecContext;
+        _videoStreamIndex = videoStreamIndex;
+        Width = width;
+        Height = height;
+        FramesPerSecondNumerator = framesPerSecondNumerator;
+        FramesPerSecondDenominator = framesPerSecondDenominator;
+        _frame = ffmpeg.av_frame_alloc();
+        _packet = ffmpeg.av_packet_alloc();
+    }
+
+    private static bool _rootPathInitialized;
+
+    /// <summary>
+    /// Points FFmpeg.AutoGen at the FFmpeg shared libraries SharpEmu.CLI
+    /// downloads next to the executable (see SharpEmu.CLI.csproj's
+    /// FetchFfmpegRuntime target); kept as loose files rather than embedded
+    /// in the single-file bundle so the OS loader can resolve the normal
+    /// inter-library dependencies (avcodec depends on avutil, etc.) itself.
+    /// </summary>
+    private static void EnsureRootPathInitialized()
+    {
+        if (_rootPathInitialized)
+        {
+            return;
+        }
+
+        _rootPathInitialized = true;
+        // SharpEmu.CLI.csproj publishes FFmpeg's shared libraries into a
+        // "plugins" subfolder next to the executable rather than flat beside
+        // it (see NativeLibraryFolderName in SharpEmu.CLI.csproj).
+        ffmpeg.RootPath = Path.Combine(AppContext.BaseDirectory, "plugins");
+
+        // ffmpeg's static constructor runs DynamicallyLoadedBindings.Initialize()
+        // itself, but that constructor fires on first touch of the ffmpeg type --
+        // which is the RootPath assignment above -- so it binds against the
+        // default (empty) RootPath before the assignment's own setter body runs.
+        // Every function resolved during that first pass permanently throws
+        // NotSupportedException. Re-running Initialize() now, with RootPath
+        // actually set, rebinds everything against the real search path.
+        DynamicallyLoadedBindings.Initialize();
+    }
+
+    internal static bool TryOpen(
+        string path,
+        uint maximumWidth,
+        uint maximumHeight,
+        out FfmpegNativeBinkFrameSource? source)
+    {
+        source = null;
+        EnsureRootPathInitialized();
+
+        AVFormatContext* formatContext = null;
+        AVCodecContext* codecContext = null;
+        try
+        {
+            if (ffmpeg.avformat_open_input(&formatContext, path, null, null) < 0)
+            {
+                return false;
+            }
+
+            if (ffmpeg.avformat_find_stream_info(formatContext, null) < 0)
+            {
+                return false;
+            }
+
+            AVCodec* decoder = null;
+            var videoStreamIndex = ffmpeg.av_find_best_stream(
+                formatContext, AVMediaType.AVMEDIA_TYPE_VIDEO, -1, -1, &decoder, 0);
+            if (videoStreamIndex < 0 || decoder is null)
+            {
+                return false;
+            }
+
+            var stream = formatContext->streams[videoStreamIndex];
+            codecContext = ffmpeg.avcodec_alloc_context3(decoder);
+            if (codecContext is null)
+            {
+                return false;
+            }
+
+            if (ffmpeg.avcodec_parameters_to_context(codecContext, stream->codecpar) < 0)
+            {
+                return false;
+            }
+
+            codecContext->thread_count = 0;
+            codecContext->thread_type = ffmpeg.FF_THREAD_FRAME | ffmpeg.FF_THREAD_SLICE;
+            if (ffmpeg.avcodec_open2(codecContext, decoder, null) < 0)
+            {
+                return false;
+            }
+
+            if (codecContext->width <= 0 || codecContext->height <= 0)
+            {
+                return false;
+            }
+
+            var frameRate = ffmpeg.av_guess_frame_rate(formatContext, stream, null);
+            if (frameRate.num <= 0 || frameRate.den <= 0)
+            {
+                frameRate = stream->avg_frame_rate;
+            }
+            if (frameRate.num <= 0 || frameRate.den <= 0)
+            {
+                frameRate = stream->r_frame_rate;
+            }
+            if (frameRate.num <= 0 || frameRate.den <= 0)
+            {
+                frameRate = new AVRational { num = 30, den = 1 };
+            }
+
+            var outputWidth = (uint)codecContext->width;
+            var outputHeight = (uint)codecContext->height;
+            if (maximumWidth > 0 && maximumHeight > 0 &&
+                (outputWidth > maximumWidth || outputHeight > maximumHeight))
+            {
+                if ((ulong)outputWidth * maximumHeight > (ulong)outputHeight * maximumWidth)
+                {
+                    outputHeight = (uint)((ulong)outputHeight * maximumWidth / outputWidth);
+                    outputWidth = maximumWidth;
+                }
+                else
+                {
+                    outputWidth = (uint)((ulong)outputWidth * maximumHeight / outputHeight);
+                    outputHeight = maximumHeight;
+                }
+
+                outputWidth = Math.Max(1, outputWidth);
+                outputHeight = Math.Max(1, outputHeight);
+            }
+
+            source = new FfmpegNativeBinkFrameSource(
+                formatContext,
+                codecContext,
+                videoStreamIndex,
+                outputWidth,
+                outputHeight,
+                (uint)frameRate.num,
+                (uint)frameRate.den);
+            formatContext = null;
+            codecContext = null;
+            return true;
+        }
+        catch (DllNotFoundException)
+        {
+            return false;
+        }
+        finally
+        {
+            if (codecContext is not null)
+            {
+                ffmpeg.avcodec_free_context(&codecContext);
+            }
+
+            if (formatContext is not null)
+            {
+                ffmpeg.avformat_close_input(&formatContext);
+            }
+        }
+    }
+
+    public bool TryDecodeNextFrame(Span<byte> destination)
+    {
+        var stride = checked((int)(Width * 4));
+        var required = (long)stride * Height;
+        if (destination.Length < required)
+        {
+            return false;
+        }
+
+        if (!TryReceiveFrame())
+        {
+            return false;
+        }
+
+        _swsContext = ffmpeg.sws_getCachedContext(
+            _swsContext,
+            _frame->width,
+            _frame->height,
+            (AVPixelFormat)_frame->format,
+            (int)Width,
+            (int)Height,
+            AVPixelFormat.AV_PIX_FMT_BGRA,
+            ffmpeg.SWS_FAST_BILINEAR,
+            null,
+            null,
+            null);
+        if (_swsContext is null)
+        {
+            ffmpeg.av_frame_unref(_frame);
+            return false;
+        }
+
+        fixed (byte* destinationPointer = destination)
+        {
+            var destinationPlanes = new byte*[4] { destinationPointer, null, null, null };
+            var destinationStrides = new int[4] { stride, 0, 0, 0 };
+            var convertedRows = ffmpeg.sws_scale(
+                _swsContext,
+                _frame->data,
+                _frame->linesize,
+                0,
+                _frame->height,
+                destinationPlanes,
+                destinationStrides);
+            ffmpeg.av_frame_unref(_frame);
+            return convertedRows == (int)Height;
+        }
+    }
+
+    private bool TryReceiveFrame()
+    {
+        while (true)
+        {
+            var receiveResult = ffmpeg.avcodec_receive_frame(_codecContext, _frame);
+            if (receiveResult >= 0)
+            {
+                return true;
+            }
+
+            if (receiveResult == ffmpeg.AVERROR_EOF)
+            {
+                return false;
+            }
+
+            if (receiveResult != ffmpeg.AVERROR(ffmpeg.EAGAIN))
+            {
+                return false;
+            }
+
+            if (_draining)
+            {
+                return false;
+            }
+
+            if (!TryFeedPacket())
+            {
+                return false;
+            }
+        }
+    }
+
+    private bool TryFeedPacket()
+    {
+        while (true)
+        {
+            var readResult = ffmpeg.av_read_frame(_formatContext, _packet);
+            if (readResult < 0)
+            {
+                _draining = true;
+                ffmpeg.avcodec_send_packet(_codecContext, null);
+                return true;
+            }
+
+            if (_packet->stream_index != _videoStreamIndex)
+            {
+                ffmpeg.av_packet_unref(_packet);
+                continue;
+            }
+
+            var sendResult = ffmpeg.avcodec_send_packet(_codecContext, _packet);
+            ffmpeg.av_packet_unref(_packet);
+            if (sendResult < 0 && sendResult != ffmpeg.AVERROR(ffmpeg.EAGAIN))
+            {
+                return false;
+            }
+
+            return true;
+        }
+    }
+
+    public void Dispose()
+    {
+        if (Interlocked.Exchange(ref _disposed, 1) != 0)
+        {
+            return;
+        }
+
+        if (_swsContext is not null)
+        {
+            ffmpeg.sws_freeContext(_swsContext);
+            _swsContext = null;
+        }
+
+        if (_packet is not null)
+        {
+            var packet = _packet;
+            ffmpeg.av_packet_free(&packet);
+            _packet = null;
+        }
+
+        if (_frame is not null)
+        {
+            var frame = _frame;
+            ffmpeg.av_frame_free(&frame);
+            _frame = null;
+        }
+
+        if (_codecContext is not null)
+        {
+            var codecContext = _codecContext;
+            ffmpeg.avcodec_free_context(&codecContext);
+            _codecContext = null;
+        }
+
+        if (_formatContext is not null)
+        {
+            var formatContext = _formatContext;
+            ffmpeg.avformat_close_input(&formatContext);
+            _formatContext = null;
+        }
+    }
+}

src/SharpEmu.Libs/Diagnostics/LoadProgressDiagnostics.cs

@@ -0,0 +1,155 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Diagnostics;
+using System.Threading;
+using SharpEmu.Libs.Agc;
+
+namespace SharpEmu.Libs.Diagnostics;
+
+/// <summary>
+/// Rate-limited progress probes armed when GTA's 'North Audio Update' thread
+/// starts. Used to classify North Yankton freezes (flip vs present vs GPU wait)
+/// without enabling full AGC/VideoOut trace.
+/// </summary>
+public static class LoadProgressDiagnostics
+{
+    // Keep probes live long enough to cover a stuck Yankton session.
+    private const long ActiveWindowMs = 120_000;
+
+    private static long _armedTicks;
+    private static long _flipSubmitTraceCount;
+    private static long _orderedFlipEnqueueTraceCount;
+    private static long _presentTakenTraceCount;
+    private static long _presentNotTakenTraceCount;
+    private static long _gpuWaitSnapshotTraceCount;
+
+    public static void ArmIfNorthAudioThread(string? threadName)
+    {
+        if (string.IsNullOrEmpty(threadName) ||
+            threadName.IndexOf("North Audio", StringComparison.OrdinalIgnoreCase) < 0)
+        {
+            return;
+        }
+
+        if (Interlocked.CompareExchange(
+                ref _armedTicks,
+                Stopwatch.GetTimestamp(),
+                0) == 0)
+        {
+            Console.Error.WriteLine(
+                "[LOADER][TRACE] load_progress.armed reason=north_audio " +
+                $"window_ms={ActiveWindowMs}");
+        }
+    }
+
+    public static bool IsActive
+    {
+        get
+        {
+            var armed = Volatile.Read(ref _armedTicks);
+            if (armed == 0)
+            {
+                return false;
+            }
+
+            var elapsedMs = (Stopwatch.GetTimestamp() - armed) * 1000L /
+                Stopwatch.Frequency;
+            return elapsedMs <= ActiveWindowMs;
+        }
+    }
+
+    public static void TraceFlipSubmit(
+        int handle,
+        int bufferIndex,
+        int flipMode,
+        bool submitGpuImage,
+        bool guestImageSubmitted,
+        ulong guestImageAddress,
+        int flipEventCount)
+    {
+        if (!IsActive || !ShouldTrace(ref _flipSubmitTraceCount, out var count))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] load_progress.flip_submit count={count} " +
+            $"handle={handle} index={bufferIndex} mode={flipMode} " +
+            $"gpu_image={submitGpuImage} submitted={guestImageSubmitted} " +
+            $"addr=0x{guestImageAddress:X16} events={flipEventCount}");
+    }
+
+    public static void TraceOrderedFlipEnqueue(
+        int videoOutHandle,
+        int displayBufferIndex,
+        ulong address,
+        long version,
+        bool enqueued)
+    {
+        if (!IsActive ||
+            !ShouldTrace(ref _orderedFlipEnqueueTraceCount, out var count))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] load_progress.ordered_flip count={count} " +
+            $"handle={videoOutHandle} index={displayBufferIndex} " +
+            $"addr=0x{address:X16} version={version} enqueued={enqueued}");
+    }
+
+    public static void TracePresentTaken(
+        long presentedSequence,
+        ulong guestImageAddress,
+        long guestImageVersion)
+    {
+        if (!IsActive || !ShouldTrace(ref _presentTakenTraceCount, out var count))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] load_progress.present_taken count={count} " +
+            $"seq={presentedSequence} addr=0x{guestImageAddress:X16} " +
+            $"version={guestImageVersion}");
+    }
+
+    public static void TracePresentNotTaken(
+        long presentedSequence,
+        bool hasPendingPresentation)
+    {
+        if (!IsActive ||
+            !ShouldTrace(ref _presentNotTakenTraceCount, out var count))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] load_progress.present_not_taken count={count} " +
+            $"seq={presentedSequence} pending={hasPendingPresentation}");
+    }
+
+    public static void TraceGpuWaitSnapshot(object? memory = null)
+    {
+        if (!IsActive ||
+            !ShouldTrace(ref _gpuWaitSnapshotTraceCount, out var count))
+        {
+            return;
+        }
+
+        var snapshot = GpuWaitRegistry.SnapshotOutstanding(memory);
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] load_progress.gpu_waits count={count} " +
+            $"outstanding={snapshot.Outstanding} latched={snapshot.Latched} " +
+            $"oldest_ms={snapshot.OldestAgeMs} " +
+            $"sample_addr=0x{snapshot.SampleWaitAddress:X16} " +
+            $"sample_queue={snapshot.SampleQueueName ?? "-"}");
+    }
+
+    private static bool ShouldTrace(ref long counter, out long count)
+    {
+        count = Interlocked.Increment(ref counter);
+        return count <= 16 || (count & (count - 1)) == 0;
+    }
+}

src/SharpEmu.Libs/Font/FontExports.cs

@@ -153,6 +153,37 @@ public static class FontExports
         return SetSuccess(ctx);
     }
 
+    [SysAbiExport(
+        Nid = "3BrWWFU+4ts",
+        ExportName = "sceFontGetVerticalLayout",
+        Target = Generation.Gen5,
+        LibraryName = "libSceFont")]
+    public static int GetVerticalLayout(CpuContext ctx)
+    {
+        var layoutAddress = ctx[CpuRegister.Rsi];
+        if (layoutAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        // Baseline (horizontal offset), line advance, decoration extent.
+        // Mirrors the same three-float layout as GetHorizontalLayout, but
+        // interpreted for vertical writing (e.g. CJK text rendered top-to-bottom).
+        var values = new[] { 8.0f, 16.0f, 0.0f };
+        for (var index = 0; index < values.Length; index++)
+        {
+            if (!TryWriteUInt32(
+                    ctx,
+                    layoutAddress + (ulong)(index * sizeof(float)),
+                    BitConverter.SingleToUInt32Bits(values[index])))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+        }
+
+        return SetSuccess(ctx);
+    }
+
     [SysAbiExport(
         Nid = "cKYtVmeSTcw",
         ExportName = "sceFontOpenFontSet",

src/SharpEmu.Libs/Gpu/GuestGpuTypes.cs

@@ -1,6 +1,8 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using SharpEmu.Libs.Agc;
+
 namespace SharpEmu.Libs.Gpu;
 
 // The types that cross the guest-GPU backend seam. Every field is either a neutral
@@ -10,7 +12,8 @@ namespace SharpEmu.Libs.Gpu;
 // translation for its API.
 
 /// <summary>A guest texture referenced by a draw or dispatch. Format/NumberType/
-/// TileMode/DstSelect are raw guest descriptor codes.</summary>
+/// TileMode/DstSelect/Type are raw guest descriptor codes. Depth is the
+/// normalized volume depth (one for non-3D resources).</summary>
 internal sealed record GuestDrawTexture(
     ulong Address,
     uint Width,
@@ -32,7 +35,15 @@ internal sealed record GuestDrawTexture(
     // from; -1 when the range is untracked or the pixels were not read here.
     long WriteGeneration = -1,
     bool ArrayedView = false,
-    uint ArrayLayers = 1);
+    uint ArrayLayers = 1,
+    uint Type = 9,
+    uint Depth = 1,
+    // GPU-detile opt-in (SHARPEMU_GPU_DETILE): when Detile is non-null the AGC
+    // layer skipped the CPU deswizzle and shipped the raw TILED bytes here in
+    // TiledSource; the Vulkan backend detiles them on the GPU. RgbaPixels is
+    // empty in that case. Both are neutral (no host graphics-API values).
+    byte[]? TiledSource = null,
+    DetileParams? Detile = null);
 
 /// <summary>Raw guest sampler descriptor dwords, copied verbatim from guest memory.</summary>
 internal readonly record struct GuestSampler(
@@ -55,7 +66,9 @@ internal readonly record struct TextureContentIdentity(
     uint Pitch,
     GuestSampler Sampler,
     bool Arrayed = false,
-    uint ArrayLayers = 1);
+    uint ArrayLayers = 1,
+    uint Type = 9,
+    uint Depth = 1);
 
 internal sealed record GuestMemoryBuffer(
     ulong BaseAddress,
@@ -76,7 +89,8 @@ internal sealed record GuestVertexBuffer(
     uint OffsetBytes,
     byte[] Data,
     int Length,
-    bool Pooled);
+    bool Pooled,
+    bool PerInstance = false);
 
 internal sealed record GuestIndexBuffer(
     byte[] Data,

src/SharpEmu.Libs/Gpu/IGuestGpuBackend.cs

@@ -54,6 +54,7 @@ internal interface IGuestGpuBackend
         int scalarRegisterBufferIndex = -1,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1);
 
     bool TryCompileComputeShader(
@@ -108,7 +109,8 @@ internal interface IGuestGpuBackend
         GuestIndexBuffer? indexBuffer = null,
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
-        ulong shaderAddress = 0);
+        ulong shaderAddress = 0,
+        int baseVertex = 0);
 
     void SubmitOffscreenTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -124,7 +126,8 @@ internal interface IGuestGpuBackend
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
         GuestDepthTarget? depthTarget = null,
-        ulong shaderAddress = 0);
+        ulong shaderAddress = 0,
+        int baseVertex = 0);
 
     void SubmitStorageTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -236,6 +239,12 @@ internal interface IGuestGpuBackend
 
     void SubmitGuestImageWrite(ulong address, byte[] pixels);
 
+    /// <summary>
+    /// Asks the presenter to refresh CPU-dirty guest images on its render/present
+    /// drain. Must not enqueue retained plane copies on the producer path.
+    /// </summary>
+    void RequestCpuWrittenGuestImageSync(ulong scopeAddress = 0, ulong scopeByteCount = ulong.MaxValue);
+
     bool TryGetGuestImageExtent(ulong address, out uint width, out uint height, out ulong byteCount);
 
     IReadOnlyList<(ulong Address, uint Width, uint Height, ulong ByteCount)> GetGuestImageExtents();

src/SharpEmu.Libs/Gpu/Metal/MetalDetilePass.cs

@@ -0,0 +1,313 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Numerics;
+using SharpEmu.Libs.Agc;
+using SharpEmu.ShaderCompiler.Metal;
+
+namespace SharpEmu.Libs.Gpu.Metal;
+
+/// <summary>
+/// Metal twin of <c>VulkanDetilePass</c>: runs the ExactXor detile equation from
+/// <see cref="GnmTiling.GetDetileParams"/> as a Metal compute kernel
+/// (<see cref="MslFixedShaders.CreateDetileCompute"/>), writing a linear buffer
+/// and blitting it into the sampled texture.
+///
+/// <see cref="RecordDetile"/> records the compute dispatch + blit onto a caller's
+/// command buffer and returns its transient buffers for the caller to release
+/// once that command buffer completes — the async, non-blocking shape (Metal
+/// hazard-tracks the compute-write → blit-read → sample dependency automatically,
+/// so no manual barriers are needed).
+///
+/// Only ExactXor 4-bytes/element surfaces are handled. NOTE: authored on Windows;
+/// the MSL and every Metal call here are <b>Mac-untested</b> — mirrors the
+/// verified Vulkan logic and the existing Metal message-send conventions, but
+/// must be validated on a real Metal device.
+/// </summary>
+internal sealed unsafe class MetalDetilePass : IDisposable
+{
+    private const uint LocalSize = 8;
+    private const int PushConstantUints = 11;
+
+    private readonly nint _device;
+    private nint _pipelineState;
+    private bool _initialized;
+    private bool _disposed;
+
+    public MetalDetilePass(nint device)
+    {
+        _device = device;
+    }
+
+    public static bool Supports(in DetileParams parameters) =>
+        (parameters.Equation == DetileEquation.ExactXor ||
+         parameters.Equation == DetileEquation.BlockTable) &&
+        parameters.BytesPerElement is 4 or 8 or 16;
+
+    /// <summary>
+    /// Records the deswizzle of <paramref name="tiled"/> into
+    /// <paramref name="texture"/> (<paramref name="texelWidth"/> x
+    /// <paramref name="texelHeight"/> texels x <paramref name="layers"/> slices)
+    /// onto <paramref name="commandBuffer"/>. The kernel iterates the element grid
+    /// from <paramref name="parameters"/> (for block-compressed formats a 4x4 block
+    /// is one element). Does not commit; the caller releases
+    /// <paramref name="transientBuffers"/> when the command buffer completes.
+    /// Returns false (empty transients) when unsupported or the pipeline could not
+    /// be built.
+    /// </summary>
+    public bool RecordDetile(
+        nint commandBuffer,
+        nint texture,
+        uint texelWidth,
+        uint texelHeight,
+        uint layers,
+        ReadOnlySpan<byte> tiled,
+        in DetileParams parameters,
+        out nint[] transientBuffers)
+    {
+        transientBuffers = [];
+        var bytesPerElement = (uint)parameters.BytesPerElement;
+        if (_disposed || commandBuffer == 0 || texture == 0 ||
+            !Supports(parameters) || texelWidth == 0 || texelHeight == 0 || layers == 0 || tiled.IsEmpty ||
+            tiled.Length % (int)(layers * bytesPerElement) != 0 ||
+            !EnsurePipeline())
+        {
+            return false;
+        }
+
+        var elementsWide = (uint)parameters.ElementsWide;
+        var elementsHigh = (uint)parameters.ElementsHigh;
+        var uintsPerElement = bytesPerElement / sizeof(uint);
+
+        // Array slices are packed contiguously in the tiled buffer; each slice's
+        // element stride is the whole buffer split evenly by layer.
+        var srcSliceElements = (uint)((ulong)tiled.Length / bytesPerElement / layers);
+
+        // Binding 1 carries the within-block offset table. ExactXor: element-shifted
+        // X/Y byte terms. BlockTable: GetDetileParams' block table (already element
+        // offsets) in binding 1, a placeholder in binding 2. The two equations index
+        // different-sized buffers, so the kernel branches and reads only one.
+        uint[] xTerm;
+        uint[] yTerm;
+        uint equationValue;
+        if (parameters.Equation == DetileEquation.BlockTable)
+        {
+            xTerm = new uint[parameters.BlockTable.Length];
+            for (var index = 0; index < xTerm.Length; index++)
+            {
+                xTerm[index] = (uint)parameters.BlockTable[index];
+            }
+
+            yTerm = [0];
+            equationValue = 1;
+        }
+        else
+        {
+            var shift = BitOperations.TrailingZeroCount((uint)parameters.BytesPerElement);
+            xTerm = ToElementTerms(parameters.XByteTerm, shift);
+            yTerm = ToElementTerms(parameters.YByteTerm, shift);
+            equationValue = 0;
+        }
+
+        var newBufferWithBytes = MetalNative.Selector("newBufferWithBytes:length:options:");
+        var newBufferWithLength = MetalNative.Selector("newBufferWithLength:options:");
+
+        nint tiledBuffer;
+        nint xBuffer;
+        nint yBuffer;
+        fixed (byte* tiledPointer = tiled)
+        {
+            tiledBuffer = MetalNative.SendBuffer(
+                _device, newBufferWithBytes, (nint)tiledPointer, (nuint)tiled.Length, 0);
+        }
+
+        fixed (uint* xPointer = xTerm)
+        {
+            xBuffer = MetalNative.SendBuffer(
+                _device, newBufferWithBytes, (nint)xPointer, (nuint)xTerm.Length * sizeof(uint), 0);
+        }
+
+        fixed (uint* yPointer = yTerm)
+        {
+            yBuffer = MetalNative.SendBuffer(
+                _device, newBufferWithBytes, (nint)yPointer, (nuint)yTerm.Length * sizeof(uint), 0);
+        }
+
+        var outputBytes = (nuint)elementsWide * elementsHigh * bytesPerElement * layers;
+        var outputBuffer = MetalNative.SendNewBuffer(_device, newBufferWithLength, outputBytes, 0);
+
+        Span<uint> push =
+        [
+            elementsWide,
+            elementsHigh,
+            (uint)parameters.BlockWidth,
+            (uint)parameters.BlockHeight,
+            (uint)parameters.BlockElements,
+            (uint)parameters.BlocksPerRow,
+            (uint)parameters.XMask,
+            (uint)parameters.YMask,
+            srcSliceElements,
+            equationValue,
+            uintsPerElement,
+        ];
+        nint paramsBuffer;
+        fixed (uint* pushPointer = push)
+        {
+            paramsBuffer = MetalNative.SendBuffer(
+                _device, newBufferWithBytes, (nint)pushPointer, (nuint)PushConstantUints * sizeof(uint), 0);
+        }
+
+        if (tiledBuffer == 0 || xBuffer == 0 || yBuffer == 0 || outputBuffer == 0 || paramsBuffer == 0)
+        {
+            ReleaseAll(tiledBuffer, xBuffer, yBuffer, outputBuffer, paramsBuffer);
+            return false;
+        }
+
+        // Compute encoder: one thread per texel.
+        var setBuffer = MetalNative.Selector("setBuffer:offset:atIndex:");
+        var encoder = MetalNative.Send(commandBuffer, MetalNative.Selector("computeCommandEncoder"));
+        MetalNative.Send(encoder, MetalNative.Selector("setComputePipelineState:"), _pipelineState);
+        MetalNative.SendSetBuffer(encoder, setBuffer, tiledBuffer, 0, 0);
+        MetalNative.SendSetBuffer(encoder, setBuffer, xBuffer, 0, 1);
+        MetalNative.SendSetBuffer(encoder, setBuffer, yBuffer, 0, 2);
+        MetalNative.SendSetBuffer(encoder, setBuffer, outputBuffer, 0, 3);
+        MetalNative.SendSetBuffer(encoder, setBuffer, paramsBuffer, 0, 4);
+
+        // X is widened by uintsPerElement (each thread copies one word); one
+        // grid-Z layer per array slice.
+        var threadgroups = new MtlSize
+        {
+            Width = (nuint)((elementsWide * uintsPerElement + LocalSize - 1) / LocalSize),
+            Height = (nuint)((elementsHigh + LocalSize - 1) / LocalSize),
+            Depth = layers,
+        };
+        var threadsPerThreadgroup = new MtlSize { Width = LocalSize, Height = LocalSize, Depth = 1 };
+        MetalNative.SendDispatch(
+            encoder,
+            MetalNative.Selector("dispatchThreadgroups:threadsPerThreadgroup:"),
+            threadgroups,
+            threadsPerThreadgroup);
+        MetalNative.SendVoid(encoder, MetalNative.Selector("endEncoding"));
+
+        // Blit the layer-major linear output buffer into the sampled texture, one
+        // slice per array layer (Metal copyFromBuffer targets a single slice). The
+        // buffer is element/block-packed (row stride = elementsWide*bpp); the copy
+        // region is in texels. Metal tracks the compute-write -> blit-read hazard.
+        var blit = MetalNative.Send(commandBuffer, MetalNative.Selector("blitCommandEncoder"));
+        var copySelector = MetalNative.Selector(
+            "copyFromBuffer:sourceOffset:sourceBytesPerRow:sourceBytesPerImage:sourceSize:" +
+            "toTexture:destinationSlice:destinationLevel:destinationOrigin:");
+        var sliceBytes = (nuint)elementsWide * elementsHigh * bytesPerElement;
+        var rowBytes = (nuint)elementsWide * bytesPerElement;
+        for (uint layer = 0; layer < layers; layer++)
+        {
+            MetalNative.SendCopyBufferToTexture(
+                blit,
+                copySelector,
+                outputBuffer,
+                (nuint)layer * sliceBytes,
+                rowBytes,
+                sliceBytes,
+                new MtlSize { Width = texelWidth, Height = texelHeight, Depth = 1 },
+                texture,
+                layer,
+                0,
+                new MtlOrigin { X = 0, Y = 0, Z = 0 });
+        }
+
+        MetalNative.SendVoid(blit, MetalNative.Selector("endEncoding"));
+
+        transientBuffers = [tiledBuffer, xBuffer, yBuffer, outputBuffer, paramsBuffer];
+        return true;
+    }
+
+    private bool EnsurePipeline()
+    {
+        if (_initialized)
+        {
+            return _pipelineState != 0;
+        }
+
+        _initialized = true;
+
+        var options = MetalNative.Send(
+            MetalNative.Send(MetalNative.Class("MTLCompileOptions"), MetalNative.Selector("alloc")),
+            MetalNative.Selector("init"));
+        MetalNative.SendVoidBool(options, MetalNative.Selector("setFastMathEnabled:"), false);
+
+        nint libraryError = 0;
+        var library = MetalNative.Send(
+            _device,
+            MetalNative.Selector("newLibraryWithSource:options:error:"),
+            MetalNative.NsString(MslFixedShaders.CreateDetileCompute()),
+            options,
+            ref libraryError);
+        if (library == 0)
+        {
+            Console.Error.WriteLine(
+                $"[GPU-DETILE] Metal detile library compile failed: {MetalNative.DescribeError(libraryError)}");
+            return false;
+        }
+
+        var function = MetalNative.Send(
+            library, MetalNative.Selector("newFunctionWithName:"), MetalNative.NsString("detile_cs"));
+        if (function == 0)
+        {
+            Console.Error.WriteLine("[GPU-DETILE] Metal detile function 'detile_cs' not found.");
+            return false;
+        }
+
+        nint pipelineError = 0;
+        _pipelineState = MetalNative.Send(
+            _device,
+            MetalNative.Selector("newComputePipelineStateWithFunction:error:"),
+            function,
+            ref pipelineError);
+        if (_pipelineState == 0)
+        {
+            Console.Error.WriteLine(
+                $"[GPU-DETILE] Metal detile pipeline failed: {MetalNative.DescribeError(pipelineError)}");
+            return false;
+        }
+
+        return true;
+    }
+
+    private static uint[] ToElementTerms(int[] byteTerms, int shift)
+    {
+        var terms = new uint[byteTerms.Length];
+        for (var index = 0; index < byteTerms.Length; index++)
+        {
+            terms[index] = (uint)byteTerms[index] >> shift;
+        }
+
+        return terms;
+    }
+
+    private static void ReleaseAll(params nint[] objects)
+    {
+        var release = MetalNative.Selector("release");
+        foreach (var handle in objects)
+        {
+            if (handle != 0)
+            {
+                MetalNative.SendVoid(handle, release);
+            }
+        }
+    }
+
+    public void Dispose()
+    {
+        if (_disposed)
+        {
+            return;
+        }
+
+        _disposed = true;
+        if (_pipelineState != 0)
+        {
+            MetalNative.SendVoid(_pipelineState, MetalNative.Selector("release"));
+            _pipelineState = 0;
+        }
+    }
+}

src/SharpEmu.Libs/Gpu/Metal/MetalGuestFormats.cs

@@ -218,6 +218,13 @@ internal static class MetalGuestFormats
     {
         var format = (dataFormat, numberType) switch
         {
+            // Early G-buffer / scene targets (R16 + RG32). Keep in sync with
+            // VulkanVideoPresenter.TryDecodeRenderTargetFormat.
+            (2, 0) => MtlPixelFormat.R16Unorm,
+            (2, 1) => MtlPixelFormat.R16Snorm,
+            (2, 4) => MtlPixelFormat.R16Uint,
+            (2, 5) => MtlPixelFormat.R16Sint,
+            (2, 7) => MtlPixelFormat.R16Float,
             (4, 4) => MtlPixelFormat.R32Uint,
             (4, 5) => MtlPixelFormat.R32Sint,
             (4, 7) => MtlPixelFormat.R32Float,
@@ -230,6 +237,8 @@ internal static class MetalGuestFormats
             (10, 5) => MtlPixelFormat.Rgba8Sint,
             (10, 9) => MtlPixelFormat.Rgba8UnormSrgb,
             (10, _) => MtlPixelFormat.Rgba8Unorm,
+            (11, 4) => MtlPixelFormat.Rg32Uint,
+            (11, 5) => MtlPixelFormat.Rg32Sint,
             (11, 7) => MtlPixelFormat.Rg32Float,
             (12, 4) => MtlPixelFormat.Rgba16Uint,
             (12, 5) => MtlPixelFormat.Rgba16Sint,
@@ -258,10 +267,12 @@ internal static class MetalGuestFormats
 
         var outputKind = format switch
         {
-            MtlPixelFormat.R8Uint or MtlPixelFormat.R32Uint or MtlPixelFormat.Rg16Uint or
-                MtlPixelFormat.Rgba8Uint or MtlPixelFormat.Rgba16Uint => Gen5PixelOutputKind.Uint,
-            MtlPixelFormat.R32Sint or MtlPixelFormat.Rg16Sint or MtlPixelFormat.Rgba8Sint or
-                MtlPixelFormat.Rgba16Sint => Gen5PixelOutputKind.Sint,
+            MtlPixelFormat.R8Uint or MtlPixelFormat.R16Uint or MtlPixelFormat.R32Uint or
+                MtlPixelFormat.Rg16Uint or MtlPixelFormat.Rg32Uint or MtlPixelFormat.Rgba8Uint or
+                MtlPixelFormat.Rgba16Uint => Gen5PixelOutputKind.Uint,
+            MtlPixelFormat.R16Sint or MtlPixelFormat.R32Sint or MtlPixelFormat.Rg16Sint or
+                MtlPixelFormat.Rg32Sint or MtlPixelFormat.Rgba8Sint or MtlPixelFormat.Rgba16Sint =>
+                Gen5PixelOutputKind.Sint,
             _ => Gen5PixelOutputKind.Float,
         };
         result = new MetalRenderTargetFormat(format, outputKind);

src/SharpEmu.Libs/Gpu/Metal/MetalGuestGpuBackend.cs

@@ -70,6 +70,7 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
         int scalarRegisterBufferIndex = -1,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1)
     {
         shader = null;
@@ -85,6 +86,7 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
                 scalarRegisterBufferIndex,
                 pixelInputEnable,
                 pixelInputAddress,
+                pixelInputCntl,
                 storageBufferOffsetAlignment))
         {
             return false;
@@ -251,7 +253,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
         GuestIndexBuffer? indexBuffer = null,
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
         MetalVideoPresenter.SubmitDepthOnlyTranslatedDraw(
             Msl(pixelShader),
             textures,
@@ -265,7 +268,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
             indexBuffer,
             vertexBuffers,
             renderState,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);
 
     public void SubmitOffscreenTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -281,7 +285,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
         GuestDepthTarget? depthTarget = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
         MetalVideoPresenter.SubmitOffscreenTranslatedDraw(
             Msl(pixelShader),
             textures,
@@ -296,7 +301,8 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
             vertexBuffers,
             renderState,
             depthTarget,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);
 
     public void SubmitStorageTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -395,6 +401,9 @@ internal sealed class MetalGuestGpuBackend : IGuestGpuBackend
     public void SubmitGuestImageWrite(ulong address, byte[] pixels) =>
         MetalVideoPresenter.SubmitGuestImageWrite(address, pixels);
 
+    public void RequestCpuWrittenGuestImageSync(ulong scopeAddress = 0, ulong scopeByteCount = ulong.MaxValue) =>
+        MetalVideoPresenter.RequestCpuWrittenGuestImageSync(scopeAddress, scopeByteCount);
+
     public bool TryGetGuestImageExtent(ulong address, out uint width, out uint height, out ulong byteCount) =>
         MetalVideoPresenter.TryGetGuestImageExtent(address, out width, out height, out byteCount);
 

src/SharpEmu.Libs/Gpu/Metal/MetalVideoPresenter.Draws.cs

@@ -1,6 +1,8 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Buffers.Binary;
+using SharpEmu.Libs.Agc;
 using SharpEmu.ShaderCompiler;
 using SharpEmu.ShaderCompiler.Metal;
 
@@ -86,7 +88,8 @@ internal static partial class MetalVideoPresenter
         uint InstanceCount,
         uint PrimitiveType,
         GuestIndexBuffer? IndexBuffer,
-        GuestRenderState RenderState);
+        GuestRenderState RenderState,
+        int BaseVertex = 0);
 
     private sealed record OffscreenGuestDraw(
         TranslatedGuestDraw Draw,
@@ -244,7 +247,8 @@ internal static partial class MetalVideoPresenter
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers,
         GuestRenderState? renderState,
         GuestDepthTarget? depthTarget,
-        ulong shaderAddress)
+        ulong shaderAddress,
+        int baseVertex = 0)
     {
         if (targets.Count == 0)
         {
@@ -292,7 +296,8 @@ internal static partial class MetalVideoPresenter
                         instanceCount,
                         primitiveType,
                         indexBuffer,
-                        effectiveRenderState),
+                        effectiveRenderState,
+                        baseVertex),
                     ToArray(targets),
                     depthTarget,
                     PublishTarget: true,
@@ -320,7 +325,8 @@ internal static partial class MetalVideoPresenter
         GuestIndexBuffer? indexBuffer,
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers,
         GuestRenderState? renderState,
-        ulong shaderAddress)
+        ulong shaderAddress,
+        int baseVertex = 0)
     {
         if (depthTarget.Address == 0 || depthTarget.Width == 0 || depthTarget.Height == 0)
         {
@@ -347,7 +353,8 @@ internal static partial class MetalVideoPresenter
                         instanceCount,
                         primitiveType,
                         indexBuffer,
-                        renderState ?? GuestRenderState.Default),
+                        renderState ?? GuestRenderState.Default,
+                        baseVertex),
                     [new GuestRenderTarget(Address: 0, depthTarget.Width, depthTarget.Height, Format: 10, NumberType: 0)],
                     depthTarget,
                     PublishTarget: false,
@@ -980,17 +987,38 @@ internal static partial class MetalVideoPresenter
 
     private static void EncodeDrawCall(nint encoder, TranslatedGuestDraw draw)
     {
-        var primitive = GetPrimitiveType(draw.PrimitiveType);
-        var vertexCount = draw.PrimitiveType == 0x11 && draw.IndexBuffer is null
-            ? 4u
-            : draw.VertexCount;
+        var indexed = draw.IndexBuffer is not null;
+        var hasVertexBuffers = draw.VertexBuffers.Length > 0;
+        var primitive = GetPrimitiveType(
+            draw.PrimitiveType,
+            indexed,
+            draw.VertexCount,
+            hasVertexBuffers);
+        var vertexCount = AgcPrimitiveHelpers.GetRectListDrawVertexCount(
+            draw.PrimitiveType,
+            draw.VertexCount,
+            indexed,
+            hasVertexBuffers);
+        var baseVertex = (nuint)Math.Max(draw.BaseVertex, 0);
         if (draw.IndexBuffer is { } indexBuffer)
         {
             var device = MetalNative.Send(encoder, MetalNative.Selector("device"));
             var slice = AllocateUpload(
                 device, Math.Max(indexBuffer.Length, 1), out var buffer, out var offset);
-            indexBuffer.Data.AsSpan(0, Math.Min(indexBuffer.Length, indexBuffer.Data.Length))
-                .CopyTo(slice);
+            var source = indexBuffer.Data.AsSpan(
+                0,
+                Math.Min(indexBuffer.Length, indexBuffer.Data.Length));
+            // Metal drawIndexed without baseVertex: bake GE_INDX_OFFSET into
+            // the uploaded indices so glyph batches still hit the right verts.
+            if (draw.BaseVertex != 0)
+            {
+                BakeBaseVertexIntoIndices(source, slice, indexBuffer.Is32Bit, draw.BaseVertex);
+            }
+            else
+            {
+                source.CopyTo(slice);
+            }
+
             MetalNative.SendDrawIndexedPrimitives(
                 encoder,
                 MetalNative.Selector("drawIndexedPrimitives:indexCount:indexType:indexBuffer:indexBufferOffset:instanceCount:"),
@@ -1011,12 +1039,46 @@ internal static partial class MetalVideoPresenter
                 encoder,
                 MetalNative.Selector("drawPrimitives:vertexStart:vertexCount:instanceCount:"),
                 primitive,
-                0,
+                baseVertex,
                 vertexCount,
                 Math.Max(draw.InstanceCount, 1));
         }
     }
 
+    private static void BakeBaseVertexIntoIndices(
+        ReadOnlySpan<byte> source,
+        Span<byte> destination,
+        bool is32Bit,
+        int baseVertex)
+    {
+        if (is32Bit)
+        {
+            var count = source.Length / sizeof(uint);
+            for (var index = 0; index < count; index++)
+            {
+                var value = BinaryPrimitives.ReadUInt32LittleEndian(
+                    source.Slice(index * sizeof(uint), sizeof(uint)));
+                var adjusted = unchecked((uint)(value + baseVertex));
+                BinaryPrimitives.WriteUInt32LittleEndian(
+                    destination.Slice(index * sizeof(uint), sizeof(uint)),
+                    adjusted);
+            }
+
+            return;
+        }
+
+        var shortCount = source.Length / sizeof(ushort);
+        for (var index = 0; index < shortCount; index++)
+        {
+            var value = BinaryPrimitives.ReadUInt16LittleEndian(
+                source.Slice(index * sizeof(ushort), sizeof(ushort)));
+            var adjusted = unchecked((ushort)(value + baseVertex));
+            BinaryPrimitives.WriteUInt16LittleEndian(
+                destination.Slice(index * sizeof(ushort), sizeof(ushort)),
+                adjusted);
+        }
+    }
+
     private static bool TryGetDrawPipeline(
         nint device,
         TranslatedGuestDraw draw,
@@ -1225,8 +1287,11 @@ internal static partial class MetalVideoPresenter
                 ? vertexBuffer.Stride
                 : Math.Max(vertexBuffer.ComponentCount, 1) * 4;
             MetalNative.Send(layout, MetalNative.Selector("setStride:"), (nint)stride);
-            // MTLVertexStepFunction.PerVertex = 1.
-            MetalNative.Send(layout, MetalNative.Selector("setStepFunction:"), 1);
+            // MTLVertexStepFunction: PerVertex = 1, PerInstance = 2.
+            MetalNative.Send(
+                layout,
+                MetalNative.Selector("setStepFunction:"),
+                vertexBuffer.PerInstance ? 2 : 1);
         }
 
         return descriptor;
@@ -1583,6 +1648,45 @@ internal static partial class MetalVideoPresenter
             return cached;
         }
 
+        // Default-on GPU detile packages the tiled source + resolved DetileParams
+        // with empty RgbaPixels so a backend can deswizzle on the GPU. The Metal
+        // GPU compute pass (MetalDetilePass / detile_compute.msl) is the intended
+        // equivalent of VulkanDetilePass, but it is Mac-untested, so the active
+        // Metal path CPU-detiles here via GnmTiling.DetileWithParams — the exact
+        // same DetileParams addressing the kernel runs — restoring the linear-upload
+        // behavior Metal had before GPU detile existed, with no regression.
+        if (texture.RgbaPixels.Length == 0 &&
+            texture.TiledSource is { } tiledSource &&
+            texture.Detile is { } detileParameters)
+        {
+            // The tiled source packs the array slices contiguously (one per layer);
+            // detile each into its layer-major linear region so the reconstructed
+            // pixels match what the CPU array-upload path produced pre-GPU-detile.
+            // A plain 2D texture is just one layer.
+            var layers = Math.Max((int)texture.ArrayLayers, 1);
+            var sliceLinearBytes =
+                detileParameters.ElementsWide * detileParameters.ElementsHigh * detileParameters.BytesPerElement;
+            var sliceTiledBytes = tiledSource.Length / layers;
+            var linear = new byte[sliceLinearBytes * layers];
+            var detiledAll = true;
+            for (var layer = 0; layer < layers; layer++)
+            {
+                if (!GnmTiling.DetileWithParams(
+                        detileParameters,
+                        tiledSource.AsSpan(layer * sliceTiledBytes, sliceTiledBytes),
+                        linear.AsSpan(layer * sliceLinearBytes, sliceLinearBytes)))
+                {
+                    detiledAll = false;
+                    break;
+                }
+            }
+
+            if (detiledAll)
+            {
+                texture = texture with { RgbaPixels = linear };
+            }
+        }
+
         // AGC ships the raw (detiled) source texels; create the texture in the
         // guest's native format — Mac-family GPUs sample BC blocks directly —
         // and size expectations with the same block-aware math AGC used.
@@ -2019,13 +2123,30 @@ internal static partial class MetalVideoPresenter
 
                 return 3;
             case 6:
-            case 0x11:
                 return 4;
             default:
                 return 3;
         }
     }
 
+    private static nuint GetPrimitiveType(
+        uint guestPrimitiveType,
+        bool indexed,
+        uint vertexCount,
+        bool hasVertexBuffers)
+    {
+        if (AgcPrimitiveHelpers.ShouldDrawRectListAsTriangleStrip(
+                guestPrimitiveType,
+                indexed,
+                vertexCount,
+                hasVertexBuffers))
+        {
+            return 4; // MTLPrimitiveTypeTriangleStrip
+        }
+
+        return GetPrimitiveType(guestPrimitiveType);
+    }
+
     private static bool IsIntegerFormat(Gen5PixelOutputKind kind) =>
         kind is Gen5PixelOutputKind.Uint or Gen5PixelOutputKind.Sint;
 

src/SharpEmu.Libs/Gpu/Metal/MetalVideoPresenter.GuestImages.cs

@@ -128,6 +128,7 @@ internal static partial class MetalVideoPresenter
     private static readonly Dictionary<long, GuestImage> _guestImageVersions = new();
     private static readonly Dictionary<(int Handle, int BufferIndex), long>
         _lastOrderedGuestFlipVersions = new();
+    private static readonly Dictionary<ulong, ulong> _untrackedGuestImageContentProbes = new();
     private static long _orderedGuestFlipVersionSequence;
     private static volatile ICpuMemory? _guestMemory;
 
@@ -162,6 +163,22 @@ internal static partial class MetalVideoPresenter
     public static void AttachGuestMemory(ICpuMemory memory) =>
         _guestMemory = memory;
 
+    private static int _cpuWrittenGuestImageSyncRequested;
+    private static long _guestImageCpuSyncTraceCount;
+
+    public static void RequestCpuWrittenGuestImageSync(
+        ulong scopeAddress = 0,
+        ulong scopeByteCount = ulong.MaxValue)
+    {
+        _ = scopeAddress;
+        if (scopeByteCount == 0 || !GuestImageWriteTracker.Enabled)
+        {
+            return;
+        }
+
+        Volatile.Write(ref _cpuWrittenGuestImageSyncRequested, 1);
+    }
+
     public static long SubmitOrderedGuestAction(Action action, string debugName)
     {
         ArgumentNullException.ThrowIfNull(action);
@@ -253,8 +270,110 @@ internal static partial class MetalVideoPresenter
         }
     }
 
-    public static bool IsGuestImageUploadKnown(ulong address, uint format, uint numberType) =>
-        IsGuestImageAvailable(address, format, numberType);
+    public static bool IsGuestImageUploadKnown(ulong address, uint format, uint numberType)
+    {
+        var guestFormat = GetGuestTextureFormat(format, numberType);
+        if (address == 0 || guestFormat == 0)
+        {
+            return false;
+        }
+
+        ulong probeByteCount = 0;
+        lock (_gate)
+        {
+            if (!_availableGuestImages.TryGetValue(address, out var availableFormat) ||
+                availableFormat != guestFormat)
+            {
+                return false;
+            }
+
+            if (GuestImageWriteTracker.Enabled)
+            {
+                return true;
+            }
+
+            if (_guestImageExtents.TryGetValue(address, out var extent))
+            {
+                probeByteCount = extent.ByteCount;
+            }
+        }
+
+        return IsUntrackedGuestImageContentUnchanged(address, probeByteCount);
+    }
+
+    private static bool IsUntrackedGuestImageContentUnchanged(ulong address, ulong byteCount)
+    {
+        var memory = _guestMemory;
+        if (memory is null || byteCount == 0)
+        {
+            return true;
+        }
+
+        var probe = ComputeSparseGuestContentProbe(memory, address, byteCount);
+        lock (_gate)
+        {
+            if (!_untrackedGuestImageContentProbes.TryGetValue(address, out var previous))
+            {
+                _untrackedGuestImageContentProbes[address] = probe;
+                return true;
+            }
+
+            if (previous == probe)
+            {
+                return true;
+            }
+
+            _untrackedGuestImageContentProbes[address] = probe;
+            return false;
+        }
+    }
+
+    private static ulong ComputeSparseGuestContentProbe(
+        ICpuMemory memory,
+        ulong address,
+        ulong byteCount)
+    {
+        Span<byte> sample = stackalloc byte[64];
+        ulong hash = 14695981039346656037UL;
+        Span<ulong> offsets = stackalloc ulong[3];
+        var offsetCount = 0;
+        offsets[offsetCount++] = 0;
+        if (byteCount > 128)
+        {
+            offsets[offsetCount++] = byteCount / 2;
+        }
+
+        if (byteCount > 64)
+        {
+            offsets[offsetCount++] = byteCount - 64;
+        }
+
+        for (var o = 0; o < offsetCount; o++)
+        {
+            var offset = offsets[o];
+            if (offset >= byteCount)
+            {
+                continue;
+            }
+
+            var length = (int)Math.Min(64UL, byteCount - offset);
+            if (!memory.TryRead(address + offset, sample[..length]))
+            {
+                hash ^= 0x9E3779B97F4A7C15UL + offset;
+                continue;
+            }
+
+            for (var i = 0; i < length; i++)
+            {
+                hash ^= sample[i];
+                hash *= 1099511628211UL;
+            }
+
+            hash ^= (ulong)length + offset;
+        }
+
+        return hash ^ byteCount;
+    }
 
     public static bool GuestImageWantsInitialData(ulong address)
     {
@@ -599,7 +718,7 @@ internal static partial class MetalVideoPresenter
         var completedWork = 0;
         RecycleCompletedUploadPages();
         RecycleCompletedSnapshotResources();
-        EvictDirtyCachedDrawTextures();
+        DrainGuestImageCpuSync(device);
         try
         {
             while (completedWork < MaxGuestWorkPerRender)

src/SharpEmu.Libs/Gpu/Metal/MetalVideoPresenter.TextureCache.cs

@@ -45,12 +45,11 @@ internal static partial class MetalVideoPresenter
         texture.Pitch,
         texture.Sampler);
 
-    /// <summary>Caching requires the write tracker: without page protection a
-    /// guest CPU write would never evict the entry and draws would sample
-    /// stale texels forever. Storage textures are shader-writable on the GPU,
-    /// so their content identity is not stable either.</summary>
+    /// <summary>Storage textures are shader-writable on the GPU, so their
+    /// content identity is not stable. CPU rewrites of protected/CPU-backed
+    /// images still evict via DrainGuestImageCpuSync when those addresses
+    /// are dirty.</summary>
     private static bool IsCacheableDrawTexture(GuestDrawTexture texture) =>
-        GuestImageWriteTracker.Enabled &&
         texture.Address != 0 &&
         !texture.IsStorage &&
         !texture.IsFallback;
@@ -69,20 +68,100 @@ internal static partial class MetalVideoPresenter
         _ = MetalNative.Send(handle, MetalNative.Selector("retain"));
         _drawTextureCache[key] = handle;
         _cachedDrawTextureIdentities[key] = 0;
-        GuestImageWriteTracker.Track(
-            texture.Address,
-            (ulong)texture.RgbaPixels.Length,
-            Volatile.Read(ref _executingGuestWorkSequence),
-            "metal.texture-cache");
+        // No GuestImageWriteTracker.Track: watch-only cache registrations
+        // widened the managed-write hot path. CPU-backed / protected images
+        // own dirty notifications used for eviction.
     }
 
-    /// <summary>Runs once per drain, before any queued draw executes: a draw
-    /// whose texels the submit thread skipped must never resolve to an entry
-    /// the guest has since rewritten.</summary>
-    private static void EvictDirtyCachedDrawTextures()
+    /// <summary>
+    /// Single dirty consumer per drain: re-upload CPU-written guest images,
+    /// evict matching draw-texture cache entries, then re-arm once per address.
+    /// </summary>
+    private static void DrainGuestImageCpuSync(nint device)
     {
+        if (!GuestImageWriteTracker.Enabled)
+        {
+            return;
+        }
+
+        _ = Interlocked.Exchange(ref _cpuWrittenGuestImageSyncRequested, 0);
+
+        HashSet<ulong>? dirtyAddresses = null;
+        List<(ulong Address, uint Width, uint Height, ulong ByteCount)>? extents = null;
+        lock (_gate)
+        {
+            if (_guestImageExtents.Count > 0)
+            {
+                extents = new(_guestImageExtents.Count);
+                foreach (var entry in _guestImageExtents)
+                {
+                    extents.Add((
+                        entry.Key,
+                        entry.Value.Width,
+                        entry.Value.Height,
+                        entry.Value.ByteCount));
+                }
+            }
+        }
+
+        var memory = _guestMemory;
+        if (extents is not null)
+        {
+            foreach (var (address, width, height, byteCount) in extents)
+            {
+                if (!GuestImageWriteTracker.ConsumeDirty(address))
+                {
+                    continue;
+                }
+
+                (dirtyAddresses ??= []).Add(address);
+                if (memory is null ||
+                    byteCount == 0 ||
+                    byteCount > 128UL * 1024UL * 1024UL)
+                {
+                    continue;
+                }
+
+                GuestImage? image;
+                lock (_gate)
+                {
+                    _guestImages.TryGetValue(address, out image);
+                }
+
+                if (image is null)
+                {
+                    continue;
+                }
+
+                var pixels = new byte[byteCount];
+                if (!memory.TryRead(address, pixels) ||
+                    pixels.AsSpan().IndexOfAnyExcept((byte)0) < 0)
+                {
+                    continue;
+                }
+
+                ExecuteGuestImageWrite(
+                    device,
+                    queue: 0,
+                    new GuestImageWrite(address, pixels, 0));
+                if (Interlocked.Increment(ref _guestImageCpuSyncTraceCount) <= 64)
+                {
+                    Console.Error.WriteLine(
+                        $"[SYNC] cpu-write-drain addr=0x{address:X} {width}x{height}");
+                }
+            }
+        }
+
         if (_drawTextureCache.Count == 0)
         {
+            if (dirtyAddresses is not null)
+            {
+                foreach (var address in dirtyAddresses)
+                {
+                    GuestImageWriteTracker.Rearm(address);
+                }
+            }
+
             return;
         }
 
@@ -90,17 +169,17 @@ internal static partial class MetalVideoPresenter
         // share one source address (same texels, different samplers), and
         // ConsumeDirty clears the flag on first read — evicting only the
         // first identity would leave the others sampling stale texels.
-        HashSet<ulong>? dirtyAddresses = null;
         foreach (var entry in _drawTextureCache)
         {
-            if (dirtyAddresses is not null && dirtyAddresses.Contains(entry.Key.Address))
+            var address = entry.Key.Address;
+            if (dirtyAddresses is not null && dirtyAddresses.Contains(address))
             {
                 continue;
             }
 
-            if (GuestImageWriteTracker.ConsumeDirty(entry.Key.Address))
+            if (GuestImageWriteTracker.ConsumeDirty(address))
             {
-                (dirtyAddresses ??= []).Add(entry.Key.Address);
+                (dirtyAddresses ??= []).Add(address);
             }
         }
 
@@ -118,6 +197,14 @@ internal static partial class MetalVideoPresenter
 
             _drawTextureCache.Clear();
             _cachedDrawTextureIdentities.Clear();
+            if (dirtyAddresses is not null)
+            {
+                foreach (var address in dirtyAddresses)
+                {
+                    GuestImageWriteTracker.Rearm(address);
+                }
+            }
+
             return;
         }
 

src/SharpEmu.Libs/Gpu/Vulkan/VulkanGuestGpuBackend.cs

@@ -64,6 +64,7 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
         int scalarRegisterBufferIndex = -1,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1)
     {
         shader = null;
@@ -79,6 +80,7 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
                 scalarRegisterBufferIndex,
                 pixelInputEnable,
                 pixelInputAddress,
+                pixelInputCntl,
                 storageBufferOffsetAlignment))
         {
             return false;
@@ -179,7 +181,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
         GuestIndexBuffer? indexBuffer = null,
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
         VulkanVideoPresenter.SubmitDepthOnlyTranslatedDraw(
             Spirv(pixelShader),
             textures,
@@ -193,7 +196,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
             indexBuffer,
             vertexBuffers,
             renderState,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);
 
     public void SubmitOffscreenTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -209,7 +213,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
         IReadOnlyList<GuestVertexBuffer>? vertexBuffers = null,
         GuestRenderState? renderState = null,
         GuestDepthTarget? depthTarget = null,
-        ulong shaderAddress = 0) =>
+        ulong shaderAddress = 0,
+        int baseVertex = 0) =>
         VulkanVideoPresenter.SubmitOffscreenTranslatedDraw(
             Spirv(pixelShader),
             textures,
@@ -224,7 +229,8 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
             vertexBuffers,
             renderState,
             depthTarget,
-            shaderAddress);
+            shaderAddress,
+            baseVertex);
 
     public void SubmitStorageTranslatedDraw(
         IGuestCompiledShader pixelShader,
@@ -375,6 +381,9 @@ internal sealed class VulkanGuestGpuBackend : IGuestGpuBackend
     public void SubmitGuestImageWrite(ulong address, byte[] pixels) =>
         VulkanVideoPresenter.SubmitGuestImageWrite(address, pixels);
 
+    public void RequestCpuWrittenGuestImageSync(ulong scopeAddress = 0, ulong scopeByteCount = ulong.MaxValue) =>
+        VulkanVideoPresenter.RequestCpuWrittenGuestImageSync(scopeAddress, scopeByteCount);
+
     public bool TryGetGuestImageExtent(ulong address, out uint width, out uint height, out ulong byteCount) =>
         VulkanVideoPresenter.TryGetGuestImageExtent(address, out width, out height, out byteCount);
 

src/SharpEmu.Libs/Json/JsonExports.cs

@@ -80,6 +80,18 @@ public static class JsonExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "PR5k1penBLM",
+        ExportName = "_ZN3sce4Json11Initializer9terminateEv",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int InitializerTerminate(CpuContext ctx)
+    {
+        TraceJson("Initializer.terminate", ctx[CpuRegister.Rdi], 0);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "Cxwy7wHq4J0",
         ExportName = "_ZN3sce4Json11Initializer10initializeEPKNS0_13InitParameterE",
@@ -119,6 +131,17 @@ public static class JsonExports
         return SetReturn(ctx, 0);
     }
 
+    // Catalog alias NID for the same callback setter.
+    #pragma warning disable SHEM004
+    [SysAbiExport(
+        Nid = "00oCq0RwSAY",
+        ExportName = "_ZN3sce4Json11Initializer27setGlobalNullAccessCallbackEPFRKNS0_5ValueENS0_9ValueTypeEPS3_PvES7_",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int InitializerSetGlobalNullAccessCallbackAlt(CpuContext ctx) =>
+        InitializerSetGlobalNullAccessCallback(ctx);
+    #pragma warning restore SHEM004
+
     [SysAbiExport(
         Nid = "WSOuge5IsCg",
         ExportName = "_ZN3sce4Json14InitParameter2C1Ev",

src/SharpEmu.Libs/Kernel/KernelFileExtendedExports.cs

@@ -267,6 +267,11 @@ public static partial class KernelMemoryCompatExports
         }
 
         var hostPath = ResolveGuestPath(guestPath);
+        if (string.IsNullOrEmpty(hostPath))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
         try
         {
             using var stream = new FileStream(hostPath, FileMode.Open, FileAccess.Write, FileShare.ReadWrite);
@@ -310,6 +315,11 @@ public static partial class KernelMemoryCompatExports
 
         var fromHost = ResolveGuestPath(fromGuest);
         var toHost = ResolveGuestPath(toGuest);
+        if (string.IsNullOrEmpty(fromHost) || string.IsNullOrEmpty(toHost))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
         try
         {
             if (Directory.Exists(fromHost))

src/SharpEmu.Libs/Kernel/KernelMemoryCompatExports.cs

@@ -1,4 +1,4 @@
-// Copyright (C) 2026 SharpEmu Emulator Project
+// Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
@@ -97,6 +97,9 @@ public static partial class KernelMemoryCompatExports
 
     private static readonly object _fdGate = new();
     private static readonly Dictionary<int, FileStream> _openFiles = new();
+    private static readonly Dictionary<int, Bink2MovieBridge.BinkGuestCompletionShim>
+        _binkGuestCompletionShims = new();
+    private static readonly Dictionary<int, string> _observedBinkGuestFiles = new();
     private static readonly Dictionary<int, OpenDirectory> _openDirectories = new();
     private static readonly object _libcAllocGate = new();
     private static readonly object _memoryGate = new();
@@ -268,13 +271,13 @@ public static partial class KernelMemoryCompatExports
             }
 
             _nextVirtualAddress = Math.Max(_nextVirtualAddress, address + mappedLength);
-            _mappedRegions[address] = new MappedRegion(
+            ReplaceMappedRegionRangeLocked(new MappedRegion(
                 address,
                 mappedLength,
                 OrbisProtCpuReadWrite,
                 IsFlexible: false,
                 IsDirect: false,
-                DirectStart: 0);
+                DirectStart: 0));
         }
 
         for (ulong offset = 0; offset < mappedLength;)
@@ -300,13 +303,13 @@ public static partial class KernelMemoryCompatExports
 
         lock (_memoryGate)
         {
-            _mappedRegions[address] = new MappedRegion(
+            ReplaceMappedRegionRangeLocked(new MappedRegion(
                 address,
                 length,
                 Protection: 0,
                 IsFlexible: false,
                 IsDirect: false,
-                DirectStart: 0);
+                DirectStart: 0));
         }
     }
 
@@ -1448,6 +1451,13 @@ public static partial class KernelMemoryCompatExports
         var hostPath = ResolveGuestPath(guestPath);
         var access = ResolveOpenAccess(flags);
         var mode = ResolveOpenMode(flags, access);
+        // A denied path (empty host path) must not reach FileStream, which would
+        // throw an ArgumentException the catch below does not cover.
+        if (string.IsNullOrEmpty(hostPath))
+        {
+            LogOpenTrace($"_open denied path='{guestPath}' flags=0x{flags:X8}");
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
         try
         {
             if (Bink2MovieBridge.ShouldSkipGuestMovie(hostPath))
@@ -1461,6 +1471,14 @@ public static partial class KernelMemoryCompatExports
                 return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
             }
 
+            Bink2MovieBridge.BinkGuestCompletionShim binkCompletionShim = default;
+            var observedBinkMovie = false;
+            var useBinkCompletionShim = access == FileAccess.Read &&
+                Bink2MovieBridge.TryTakeOverGuestMovie(
+                    hostPath,
+                    out binkCompletionShim,
+                    out observedBinkMovie);
+
             if (IsMutatingOpen(flags) && IsReadOnlyGuestMutationPath(guestPath))
             {
                 LogOpenTrace($"_open readonly path='{guestPath}' host='{hostPath}' flags=0x{flags:X8}");
@@ -1509,13 +1527,22 @@ public static partial class KernelMemoryCompatExports
             lock (_fdGate)
             {
                 _openFiles[fd] = stream;
+                if (useBinkCompletionShim)
+                {
+                    _binkGuestCompletionShims[fd] = binkCompletionShim;
+                }
+                if (observedBinkMovie)
+                {
+                    _observedBinkGuestFiles[fd] = hostPath;
+                }
             }
 
-            // Bink is linked directly into some games, so there is no media
-            // import for the HLE codec layer to intercept. The successful
-            // guest file open is the stable boundary at which the optional
-            // host Bink bridge can attach to the same movie.
-            Bink2MovieBridge.ObserveGuestMovie(hostPath);
+            if (useBinkCompletionShim)
+            {
+                LogOpenTrace(
+                    "_open bink-host-shim path='" + guestPath + "' host='" + hostPath +
+                    "' flags=0x" + flags.ToString("X8") + " fd=" + fd);
+            }
 
             if (IsMutatingOpen(flags))
             {
@@ -1746,6 +1773,113 @@ public static partial class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    // WithPrefix sibling of sceKernelAprResolveFilepathsToIdsAndFileSizes.
+    // Resource streamers resolve relative asset paths against a shared directory
+    // prefix. Without HLE, every call returned the generic NOT_FOUND sentinel
+    // and no asset received a real file id/size. Signature inferred from
+    // observed guest registers (rdi=prefix, rsi=path list, rdx=count, rcx=ids,
+    // r8=sizes, r9=error index): the no-prefix sibling's args shifted right by
+    // one with a leading `const char* prefix`.
+    [SysAbiExport(
+        Nid = "w5fcCG+t31g",
+        ExportName = "sceKernelAprResolveFilepathsWithPrefixToIdsAndFileSizes",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelAprResolveFilepathsWithPrefixToIdsAndFileSizes(CpuContext ctx)
+    {
+        var prefixAddress = ctx[CpuRegister.Rdi];
+        var pathListAddress = ctx[CpuRegister.Rsi];
+        var count = ctx[CpuRegister.Rdx];
+        var idsAddress = ctx[CpuRegister.Rcx];
+        var sizesAddress = ctx[CpuRegister.R8];
+        var errorIndexAddress = ctx[CpuRegister.R9];
+        if (pathListAddress == 0 || count == 0 || sizesAddress == 0 || count > 1024)
+        {
+            KernelRuntimeCompatExports.TrySetErrno(ctx, Einval);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var prefix = string.Empty;
+        if (prefixAddress != 0)
+        {
+            _ = TryReadNullTerminatedUtf8(ctx, prefixAddress, MaxGuestStringLength, out prefix);
+        }
+
+        for (ulong i = 0; i < count; i++)
+        {
+            if (idsAddress != 0 &&
+                !TryWriteUInt32Compat(ctx, idsAddress + (i * sizeof(uint)), uint.MaxValue))
+            {
+                KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            if (!TryResolveAprFilepath(ctx, pathListAddress, i, out var relativePath))
+            {
+                KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            var guestPath = CombineAprPrefixedPath(prefix, relativePath);
+            var hostPath = ResolveGuestPath(guestPath);
+            if (!TryGetAprFileSize(hostPath, out var fileSize))
+            {
+                LogIoTrace("apr_resolve_with_prefix", guestPath, $"host='{hostPath}' index={i} count={count} result=not_found");
+                if (sizesAddress != 0 &&
+                    !TryWriteUInt64Compat(ctx, sizesAddress + (i * sizeof(ulong)), 0))
+                {
+                    KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                }
+
+                if (errorIndexAddress != 0 &&
+                    !TryWriteUInt32Compat(ctx, errorIndexAddress, (uint)i))
+                {
+                    KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                }
+
+                KernelRuntimeCompatExports.TrySetErrno(ctx, 2); // ENOENT
+                ctx[CpuRegister.Rax] = ulong.MaxValue;
+                return -1;
+            }
+
+            var fileId = AmprFileRegistry.Register(guestPath, hostPath);
+            LogIoTrace("apr_resolve_with_prefix", guestPath, $"host='{hostPath}' index={i} count={count} id=0x{fileId:X8} size={fileSize}");
+
+            if (idsAddress != 0 &&
+                !TryWriteUInt32Compat(ctx, idsAddress + (i * sizeof(uint)), fileId))
+            {
+                KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            if (!TryWriteUInt64Compat(ctx, sizesAddress + (i * sizeof(ulong)), fileSize))
+            {
+                KernelRuntimeCompatExports.TrySetErrno(ctx, Efault);
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static string CombineAprPrefixedPath(string prefix, string relative)
+    {
+        if (string.IsNullOrEmpty(prefix))
+        {
+            return relative;
+        }
+
+        if (string.IsNullOrEmpty(relative))
+        {
+            return prefix;
+        }
+
+        return $"{prefix.TrimEnd('/')}/{relative.TrimStart('/')}";
+    }
+
     // The IDs-only sibling of sceKernelAprResolveFilepathsToIdsAndFileSizes.
     // Games that stream via AMPR APR call this to turn asset paths into file
     // IDs, then hand those IDs to sceAmprAprCommandBufferReadFile. Without it
@@ -2046,10 +2180,21 @@ public static partial class KernelMemoryCompatExports
         }
 
         FileStream? stream;
+        var notifyBinkClose = false;
+        string? observedBinkPath = null;
         lock (_fdGate)
         {
             if (_openFiles.Remove(fd, out stream))
             {
+                _binkGuestCompletionShims.Remove(fd);
+                if (_observedBinkGuestFiles.Remove(fd, out observedBinkPath))
+                {
+                    notifyBinkClose = !_observedBinkGuestFiles.Values.Any(path =>
+                        string.Equals(
+                            path,
+                            observedBinkPath,
+                            StringComparison.OrdinalIgnoreCase));
+                }
             }
             else if (_openDirectories.Remove(fd))
             {
@@ -2062,6 +2207,10 @@ public static partial class KernelMemoryCompatExports
             }
         }
 
+        if (notifyBinkClose)
+        {
+            Bink2MovieBridge.NotifyGuestMovieClosed(observedBinkPath!);
+        }
         stream.Dispose();
         ctx[CpuRegister.Rax] = 0;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
@@ -2089,9 +2238,12 @@ public static partial class KernelMemoryCompatExports
         }
 
         FileStream? stream;
+        Bink2MovieBridge.BinkGuestCompletionShim completionShim = default;
+        var useBinkCompletionShim = false;
         lock (_fdGate)
         {
             _openFiles.TryGetValue(fd, out stream);
+            useBinkCompletionShim = _binkGuestCompletionShims.TryGetValue(fd, out completionShim);
         }
 
         if (stream is null)
@@ -2111,6 +2263,17 @@ public static partial class KernelMemoryCompatExports
 
         var buffer = GC.AllocateUninitializedArray<byte>(requested);
         var read = stream.Read(buffer, 0, requested);
+        if (read > 0 && useBinkCompletionShim)
+        {
+            // The patched NumFrames field is what tells the guest "this
+            // movie is fully consumed" - hold that specific read until the
+            // host has actually finished showing it, so guest-side game
+            // logic can't race ahead of what's still on screen.
+            if (completionShim.Patch(positionBefore, buffer.AsSpan(0, read)))
+            {
+                Bink2MovieBridge.WaitForHostPlaybackToFinish(stream.Name);
+            }
+        }
         if (read > 0 && !ctx.Memory.TryWrite(bufferAddress, buffer.AsSpan(0, read)))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
@@ -2654,6 +2817,26 @@ public static partial class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "n1-v6FgU7MQ",
+        ExportName = "sceKernelConfiguredFlexibleMemorySize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelConfiguredFlexibleMemorySize(CpuContext ctx)
+    {
+        var outSizeAddress = ctx[CpuRegister.Rdi];
+        if (outSizeAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        Span<byte> sizeBytes = stackalloc byte[sizeof(ulong)];
+        BinaryPrimitives.WriteUInt64LittleEndian(sizeBytes, FlexibleMemorySizeBytes);
+        return ctx.Memory.TryWrite(outSizeAddress, sizeBytes)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
     [SysAbiExport(
         Nid = "rTXw65xmLIA",
         ExportName = "sceKernelAllocateDirectMemory",
@@ -3064,13 +3247,13 @@ public static partial class KernelMemoryCompatExports
             }
 
             _nextVirtualAddress = Math.Max(_nextVirtualAddress, mappedAddress + length);
-            _mappedRegions[mappedAddress] = new MappedRegion(
+            ReplaceMappedRegionRangeLocked(new MappedRegion(
                 mappedAddress,
                 length,
                 protection,
                 IsFlexible: false,
                 IsDirect: true,
-                DirectStart: directMemoryStart);
+                DirectStart: directMemoryStart));
         }
 
         if (!ctx.TryWriteUInt64(inOutAddressPointer, mappedAddress))
@@ -3156,13 +3339,13 @@ public static partial class KernelMemoryCompatExports
 
             _nextVirtualAddress = Math.Max(_nextVirtualAddress, mappedAddress + length);
             _allocatedFlexibleBytes = Math.Min(FlexibleMemorySizeBytes, _allocatedFlexibleBytes + length);
-            _mappedRegions[mappedAddress] = new MappedRegion(
+            ReplaceMappedRegionRangeLocked(new MappedRegion(
                 mappedAddress,
                 length,
                 protection,
                 IsFlexible: true,
                 IsDirect: false,
-                DirectStart: 0);
+                DirectStart: 0));
         }
 
         if (!ctx.TryWriteUInt64(inOutAddressPointer, mappedAddress))
@@ -4778,21 +4961,32 @@ public static partial class KernelMemoryCompatExports
             return guestPath;
         }
 
-        if (TryResolveRegisteredGuestMount(guestPath, out var mountedPath))
+        if (TryResolveRegisteredGuestMount(guestPath, out var mountedPath, out var mountPrefixMatched))
         {
             return mountedPath;
         }
 
+        // A registered mount claimed this path by prefix but denied it (failed
+        // containment or a reparse point inside the mount). That denial is
+        // authoritative: do NOT fall through to the built-in branches below,
+        // which could re-resolve an overlapping prefix (e.g. a registered
+        // "/app0" vs the built-in SHARPEMU_APP0_DIR branch) against a different
+        // root and turn the denial back into a resolution.
+        if (mountPrefixMatched)
+        {
+            return string.Empty;
+        }
+
         if (guestPath.StartsWith("/devlog/app/", StringComparison.OrdinalIgnoreCase))
         {
             var relative = NormalizeMountRelativePath(guestPath["/devlog/app/".Length..]);
-            return Path.Combine(ResolveDevlogAppRoot(), relative);
+            return CombineWithinMount(ResolveDevlogAppRoot(), relative);
         }
 
         if (guestPath.StartsWith("devlog/app/", StringComparison.OrdinalIgnoreCase))
         {
             var relative = NormalizeMountRelativePath(guestPath["devlog/app/".Length..]);
-            return Path.Combine(ResolveDevlogAppRoot(), relative);
+            return CombineWithinMount(ResolveDevlogAppRoot(), relative);
         }
 
         if (string.Equals(guestPath, "/devlog/app", StringComparison.OrdinalIgnoreCase) ||
@@ -4804,7 +4998,7 @@ public static partial class KernelMemoryCompatExports
         if (guestPath.StartsWith("/temp0/", StringComparison.OrdinalIgnoreCase))
         {
             var relative = NormalizeMountRelativePath(guestPath["/temp0/".Length..]);
-            return Path.Combine(ResolveTemp0Root(), relative);
+            return CombineWithinMount(ResolveTemp0Root(), relative);
         }
 
         if (string.Equals(guestPath, "/temp0", StringComparison.OrdinalIgnoreCase))
@@ -4815,13 +5009,13 @@ public static partial class KernelMemoryCompatExports
         if (guestPath.StartsWith("/download0/", StringComparison.OrdinalIgnoreCase))
         {
             var relative = NormalizeMountRelativePath(guestPath["/download0/".Length..]);
-            return Path.Combine(ResolveDownload0Root(), relative);
+            return CombineWithinMount(ResolveDownload0Root(), relative);
         }
 
         if (guestPath.StartsWith("download0/", StringComparison.OrdinalIgnoreCase))
         {
             var relative = NormalizeMountRelativePath(guestPath["download0/".Length..]);
-            return Path.Combine(ResolveDownload0Root(), relative);
+            return CombineWithinMount(ResolveDownload0Root(), relative);
         }
 
         if (string.Equals(guestPath, "/download0", StringComparison.OrdinalIgnoreCase) ||
@@ -4833,13 +5027,13 @@ public static partial class KernelMemoryCompatExports
         if (guestPath.StartsWith("/hostapp/", StringComparison.OrdinalIgnoreCase))
         {
             var relative = NormalizeMountRelativePath(guestPath["/hostapp/".Length..]);
-            return Path.Combine(ResolveHostappRoot(), relative);
+            return CombineWithinMount(ResolveHostappRoot(), relative);
         }
 
         if (guestPath.StartsWith("hostapp/", StringComparison.OrdinalIgnoreCase))
         {
             var relative = NormalizeMountRelativePath(guestPath["hostapp/".Length..]);
-            return Path.Combine(ResolveHostappRoot(), relative);
+            return CombineWithinMount(ResolveHostappRoot(), relative);
         }
 
         if (string.Equals(guestPath, "/hostapp", StringComparison.OrdinalIgnoreCase) ||
@@ -4862,7 +5056,7 @@ public static partial class KernelMemoryCompatExports
                 guestPath.StartsWith("$\\", StringComparison.Ordinal))
             {
                 var relative = NormalizeMountRelativePath(guestPath[2..]);
-                return Path.Combine(app0Root, relative);
+                return CombineWithinMount(app0Root, relative);
             }
 
             if (string.Equals(guestPath, "/app0", StringComparison.OrdinalIgnoreCase) ||
@@ -4874,13 +5068,13 @@ public static partial class KernelMemoryCompatExports
             if (guestPath.StartsWith("/app0/", StringComparison.OrdinalIgnoreCase))
             {
                 var relative = NormalizeMountRelativePath(guestPath["/app0/".Length..]);
-                return Path.Combine(app0Root, relative);
+                return CombineWithinMount(app0Root, relative);
             }
 
             if (guestPath.StartsWith("app0/", StringComparison.OrdinalIgnoreCase))
             {
                 var relative = NormalizeMountRelativePath(guestPath["app0/".Length..]);
-                return Path.Combine(app0Root, relative);
+                return CombineWithinMount(app0Root, relative);
             }
 
             if (!Path.IsPathFullyQualified(guestPath) &&
@@ -4888,16 +5082,26 @@ public static partial class KernelMemoryCompatExports
                 !guestPath.StartsWith("\\", StringComparison.Ordinal))
             {
                 var relative = NormalizeMountRelativePath(guestPath);
-                return Path.Combine(app0Root, relative);
+                return CombineWithinMount(app0Root, relative);
             }
         }
 
-        return guestPath;
+        // Default-deny: a guest path that matched no mount prefix must NOT be
+        // handed back verbatim as a host path. Returning it raw let any absolute
+        // guest path address the host filesystem directly ("/etc/passwd",
+        // "C:\\Windows\\...") because it is already fully qualified and skips the
+        // relative-path app0 fallback above. Callers treat an empty host path as
+        // "resolves to nothing" and fail the syscall with NOT_FOUND.
+        return string.Empty;
     }
 
-    private static bool TryResolveRegisteredGuestMount(string guestPath, out string hostPath)
+    private static bool TryResolveRegisteredGuestMount(
+        string guestPath,
+        out string hostPath,
+        out bool mountPrefixMatched)
     {
         hostPath = string.Empty;
+        mountPrefixMatched = false;
         var normalizedGuestPath = NormalizeGuestStatCachePath(guestPath);
         if (normalizedGuestPath is null)
         {
@@ -4925,10 +5129,30 @@ public static partial class KernelMemoryCompatExports
             return false;
         }
 
+        // A registered mount owns this prefix. Whatever the outcome below
+        // (containment or reparse denial), the caller must NOT fall through to a
+        // built-in branch for the same prefix, or a denied path could be
+        // re-resolved against a different root.
+        mountPrefixMatched = true;
+
         var relativePath = normalizedGuestPath[matchedMountPoint.Length..].TrimStart('/');
-        var candidate = Path.GetFullPath(Path.Combine(
-            matchedHostRoot,
-            NormalizeMountRelativePath(relativePath)));
+        string candidate;
+        try
+        {
+            candidate = Path.GetFullPath(Path.Combine(
+                matchedHostRoot,
+                NormalizeMountRelativePath(relativePath)));
+        }
+        catch (Exception ex) when (
+            ex is IOException or ArgumentException or NotSupportedException)
+        {
+            // The relative part comes from an untrusted guest path; a crafted
+            // over-long or invalid path can make GetFullPath throw. Fail closed
+            // rather than propagate out of ResolveGuestPath (which callers invoke
+            // outside their try blocks).
+            return false;
+        }
+
         var rootWithSeparator = Path.TrimEndingDirectorySeparator(matchedHostRoot) + Path.DirectorySeparatorChar;
         // Host-semantics comparison: an ignore-case check on a case-sensitive
         // host would let a relative path escape into a sibling directory that
@@ -4940,6 +5164,14 @@ public static partial class KernelMemoryCompatExports
             return false;
         }
 
+        // Textual containment does not follow symlinks/junctions; refuse a
+        // reparse point planted inside the mount that would redirect onto the
+        // host filesystem. See EscapesMountViaReparsePoint.
+        if (EscapesMountViaReparsePoint(Path.GetFullPath(matchedHostRoot), candidate))
+        {
+            return false;
+        }
+
         hostPath = candidate;
         return true;
     }
@@ -4998,6 +5230,116 @@ public static partial class KernelMemoryCompatExports
         return string.Join(Path.DirectorySeparatorChar, resolved);
     }
 
+    // Combines a mount-relative guest path onto a built-in mount root and
+    // re-verifies the result stays under that root. NormalizeMountRelativePath
+    // strips "." / ".." but splits only on separators, so a drive-qualified
+    // token like "C:" survives as a segment; Path.Combine then DISCARDS the
+    // mount root because its second argument is drive-rooted, yielding a raw
+    // host path such as "C:\Windows\...". Re-resolving with Path.GetFullPath and
+    // checking containment (the same guard TryResolveRegisteredGuestMount uses)
+    // rejects that escape. Returns string.Empty on denial, which callers treat
+    // as an unresolved path.
+    private static string CombineWithinMount(string mountRoot, string relative)
+    {
+        string fullRoot;
+        string candidate;
+        try
+        {
+            fullRoot = Path.GetFullPath(mountRoot);
+            candidate = Path.GetFullPath(Path.Combine(fullRoot, relative));
+        }
+        catch (Exception ex) when (
+            ex is IOException or ArgumentException or NotSupportedException)
+        {
+            // The relative part comes from an untrusted guest path; a crafted
+            // over-long or invalid path can make GetFullPath throw. Fail closed
+            // rather than propagate out of ResolveGuestPath (which callers invoke
+            // outside their try blocks).
+            return string.Empty;
+        }
+
+        var rootWithSeparator =
+            Path.TrimEndingDirectorySeparator(fullRoot) + Path.DirectorySeparatorChar;
+        if (!string.Equals(candidate, fullRoot, HostFsPathComparison) &&
+            !candidate.StartsWith(rootWithSeparator, HostFsPathComparison))
+        {
+            return string.Empty;
+        }
+
+        if (EscapesMountViaReparsePoint(fullRoot, candidate))
+        {
+            return string.Empty;
+        }
+
+        return candidate;
+    }
+
+    // Lexical containment (Path.GetFullPath + StartsWith) proves the TEXTUAL
+    // path stays under the mount root, but it does not follow symlinks or
+    // Windows junctions. A malicious game dump can plant a reparse point inside
+    // an otherwise-contained mount (e.g. "/app0/link" -> "/") so that
+    // "/app0/link/etc/passwd" passes the textual check yet resolves onto the
+    // host filesystem. Walk each already-existing component from the mount root
+    // down to the candidate and refuse if any is a reparse point. Components
+    // that do not yet exist (e.g. an O_CREAT target and its parents) carry no
+    // link to follow and are simply skipped. Mirrors the reparse rejection in
+    // AvPlayerExports.TryResolveSandboxedFile.
+    private static bool EscapesMountViaReparsePoint(string mountRoot, string candidate)
+    {
+        var rootTrimmed = Path.TrimEndingDirectorySeparator(mountRoot);
+        if (string.Equals(candidate, rootTrimmed, HostFsPathComparison))
+        {
+            return false;
+        }
+
+        var relative = Path.GetRelativePath(rootTrimmed, candidate);
+        // A leading ".." segment means the candidate is not under the root. Match
+        // the segment precisely: bare ".." or a "../" prefix, NOT a legitimate
+        // file merely named "..foo". This branch is a defensive fallback (lexical
+        // containment already passed before it runs), so it fails closed.
+        if (relative == "." || relative == ".." || Path.IsPathRooted(relative) ||
+            relative.StartsWith(".." + Path.DirectorySeparatorChar, StringComparison.Ordinal) ||
+            relative.StartsWith(".." + Path.AltDirectorySeparatorChar, StringComparison.Ordinal))
+        {
+            // Not actually under the root (should have been caught lexically);
+            // treat as an escape rather than walk outside it.
+            return true;
+        }
+
+        var current = rootTrimmed;
+        foreach (var segment in relative.Split(
+                     Path.DirectorySeparatorChar,
+                     StringSplitOptions.RemoveEmptyEntries))
+        {
+            current = Path.Combine(current, segment);
+            try
+            {
+                if ((File.GetAttributes(current) & FileAttributes.ReparsePoint) != 0)
+                {
+                    return true;
+                }
+            }
+            catch (Exception ex) when (ex is FileNotFoundException or DirectoryNotFoundException)
+            {
+                // Component does not exist yet (create path); nothing to follow.
+                break;
+            }
+            catch (Exception ex) when (
+                ex is IOException or UnauthorizedAccessException or ArgumentException or NotSupportedException)
+            {
+                // The path comes from an untrusted dump, so a crafted over-long,
+                // invalid-char, or unreadable intermediate component can make
+                // GetAttributes throw. Fail closed: if containment cannot be
+                // verified, treat it as an escape rather than let the exception
+                // crash the syscall (ResolveGuestPath runs outside the callers'
+                // try blocks).
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     private static string ResolveDevlogAppRoot()
     {
         var configuredRoot = Environment.GetEnvironmentVariable("SHARPEMU_DEVLOG_APP_DIR");
@@ -6947,28 +7289,41 @@ public static partial class KernelMemoryCompatExports
     {
         if (fd < 0 || bufferAddress == 0 || requested < 512)
         {
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
         OpenDirectory? directory;
+        bool isOpenFile;
         lock (_fdGate)
         {
             _openDirectories.TryGetValue(fd, out directory);
+            isOpenFile = directory is null && _openFiles.ContainsKey(fd);
         }
 
         if (directory is null)
         {
-            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            // A regular file fd used with getdents must not look like EOF (rax=0);
+            // that path has caused GTA's fiWriteAsyncDataWorker to treat the fd
+            // integer as a pointer and AV at address 0xB1.
+            var error = isOpenFile
+                ? OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT
+                : OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+            LogIoTrace("getdents", $"fd:{fd}", $"result={(isOpenFile ? "not_directory" : "badfd")}");
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)error);
+            return (int)error;
         }
 
         var currentIndex = directory.NextIndex;
         if (basePointerAddress != 0 && !TryWriteUInt64Compat(ctx, basePointerAddress, (ulong)currentIndex))
         {
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
         if (currentIndex >= directory.Entries.Length)
         {
+            LogIoTrace("getdents", directory.Path, $"fd={fd} result=eof entries={directory.Entries.Length}");
             ctx[CpuRegister.Rax] = 0;
             return (int)OrbisGen2Result.ORBIS_GEN2_OK;
         }
@@ -6999,11 +7354,16 @@ public static partial class KernelMemoryCompatExports
 
     private static string[] EnumerateDirectoryEntries(string hostPath)
     {
-        return Directory.EnumerateFileSystemEntries(hostPath)
+        // Real getdents always yields "." / ".." before other names. An empty
+        // host dir previously returned EOF on the first call (rax=0), which
+        // sent GTA's fiWriteAsyncDataWorker down a path that treated the fd as
+        // a pointer (AV at 0xB1 on /download0/cloudcache/).
+        var children = Directory.EnumerateFileSystemEntries(hostPath)
             .Select(Path.GetFileName)
             .Where(static name => !string.IsNullOrEmpty(name))
-            .OrderBy(static name => name, StringComparer.OrdinalIgnoreCase)
-            .ToArray()!;
+            .OrderBy(static name => name, StringComparer.OrdinalIgnoreCase);
+
+        return new[] { ".", ".." }.Concat(children).ToArray()!;
     }
 
     private static uint ComputeDirectoryEntryHash(ReadOnlySpan<byte> utf8Name)
@@ -7557,6 +7917,47 @@ public static partial class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    private static long _checkReachabilityMissTraceCount;
+
+    // POSIX access(2)-style path reachability probe used by RAGE EnumerationThread.
+    [SysAbiExport(
+        Nid = "uWyW3v98sU4",
+        ExportName = "sceKernelCheckReachability",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCheckReachability(CpuContext ctx)
+    {
+        var pathAddress = ctx[CpuRegister.Rdi];
+        if (pathAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryReadNullTerminatedUtf8(ctx, pathAddress, MaxGuestStringLength, out var guestPath))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var hostPath = ResolveGuestPath(guestPath);
+        if (File.Exists(hostPath) || Directory.Exists(hostPath))
+        {
+            ctx[CpuRegister.Rax] = 0;
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        // EnumerationThread probes missing mounts during load; surface guest/host
+        // paths so North Yankton stalls are diagnosable without SHARPEMU_LOG_IO.
+        var miss = Interlocked.Increment(ref _checkReachabilityMissTraceCount);
+        if (miss <= 16 || (miss & (miss - 1)) == 0)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][TRACE] kernel.check_reachability_miss count={miss} " +
+                $"guest='{guestPath}' host='{hostPath}'");
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+    }
+
     [SysAbiExport(
         Nid = "fgIsQ10xYVA",
         ExportName = "sceKernelChmod",

src/SharpEmu.Libs/Kernel/KernelPthreadCompatExports.cs

@@ -153,6 +153,64 @@ public static class KernelPthreadCompatExports
     static KernelPthreadCompatExports()
     {
         RunSynchronizationSelfChecks();
+        GuestThreadExecution.GuestThreadAbandoned += AbandonMutexesOwnedByThread;
+    }
+
+    /// <summary>
+    /// Force-release mutexes still owned by a guest thread that is being torn
+    /// down without a clean unlock (TBB worker_abort, abrupt exit). Otherwise
+    /// waiters can spin forever and block splash→first GPU submit.
+    /// </summary>
+    public static int AbandonMutexesOwnedByThread(ulong threadId, string reason)
+    {
+        if (threadId == 0)
+        {
+            return 0;
+        }
+
+        var released = 0;
+        var wakeKeys = new List<string>();
+        foreach (var pair in _mutexStates)
+        {
+            var state = pair.Value;
+            string? wakeKey = null;
+            lock (state)
+            {
+                if (state.OwnerThreadId != threadId || state.RecursionCount <= 0)
+                {
+                    continue;
+                }
+
+                state.OwnerThreadId = 0;
+                state.RecursionCount = 0;
+                wakeKey = state.Waiters.First?.Value.Cooperative == true
+                    ? state.Waiters.First.Value.WakeKey
+                    : null;
+                Monitor.PulseAll(state);
+                released++;
+                Console.Error.WriteLine(
+                    $"[LOADER][WARN] pthread_mutex_abandon mutex=0x{pair.Key:X16} " +
+                    $"owner={KernelPthreadState.DescribeThreadHandle(threadId)} " +
+                    $"reason={reason} waiters={state.Waiters.Count}");
+            }
+
+            if (wakeKey is not null)
+            {
+                wakeKeys.Add(wakeKey);
+            }
+        }
+
+        foreach (var wakeKey in wakeKeys)
+        {
+            _ = GuestThreadExecution.Scheduler?.WakeBlockedThreads(wakeKey, 1);
+        }
+
+        if (released > 0)
+        {
+            Console.Error.Flush();
+        }
+
+        return released;
     }
 
     [SysAbiExport(

src/SharpEmu.Libs/Kernel/KernelPthreadState.cs

@@ -27,8 +27,12 @@ internal static class KernelPthreadState
     internal static ulong GetCurrentThreadHandle()
     {
         var guestThreadHandle = GuestThreadExecution.CurrentGuestThreadHandle;
-        if (guestThreadHandle != 0 && TryGetThreadIdentity(guestThreadHandle, out _))
+        // Prefer the bound guest handle even when it is not yet in Threads.
+        // Falling through to a synthetic ThreadStatic handle while a guest
+        // thread is bound causes mutex owner mismatches (unlock PERM → hang).
+        if (guestThreadHandle != 0)
         {
+            EnsureGuestThreadIdentity(guestThreadHandle);
             return guestThreadHandle;
         }
 
@@ -39,15 +43,27 @@ internal static class KernelPthreadState
     internal static ulong GetCurrentThreadUniqueId()
     {
         var guestThreadHandle = GuestThreadExecution.CurrentGuestThreadHandle;
-        if (guestThreadHandle != 0 && TryGetThreadIdentity(guestThreadHandle, out var identity))
+        if (guestThreadHandle != 0)
         {
-            return identity.UniqueId;
+            return EnsureGuestThreadIdentity(guestThreadHandle).UniqueId;
         }
 
         EnsureCurrentThreadRegistered();
         return _currentThreadUniqueId;
     }
 
+    internal static string DescribeThreadHandle(ulong threadHandle)
+    {
+        if (threadHandle == 0)
+        {
+            return "none";
+        }
+
+        return TryGetThreadIdentity(threadHandle, out var identity)
+            ? $"0x{threadHandle:X16}('{identity.Name}')"
+            : $"0x{threadHandle:X16}";
+    }
+
     internal static ulong CreateThreadHandle(string name)
     {
         var uniqueId = unchecked((ulong)Interlocked.Increment(ref _nextUniqueThreadId));
@@ -59,6 +75,18 @@ internal static class KernelPthreadState
         return Threads.TryGetValue(threadHandle, out identity);
     }
 
+    private static ThreadIdentity EnsureGuestThreadIdentity(ulong guestThreadHandle)
+    {
+        if (Threads.TryGetValue(guestThreadHandle, out var existing))
+        {
+            return existing;
+        }
+
+        var uniqueId = unchecked((ulong)Interlocked.Increment(ref _nextUniqueThreadId));
+        var identity = new ThreadIdentity(uniqueId, $"Guest-0x{guestThreadHandle:X}");
+        return Threads.GetOrAdd(guestThreadHandle, identity);
+    }
+
     private static void EnsureCurrentThreadRegistered()
     {
         if (_currentThreadHandle != 0)

src/SharpEmu.Libs/Kernel/KernelSemaphoreCompatExports.cs

@@ -191,6 +191,27 @@ public static class KernelSemaphoreCompatExports
                 WakePredicate,
                 deadline))
         {
+            // A signal may have arrived between releasing the semaphore gate
+            // (after incrementing WaitingThreads) and the scheduler registering
+            // this block.  When that happens WakeBlockedThreads cannot find the
+            // waiter yet and the exit-handler re-check runs later; a re-check
+            // here keeps the thread from yielding to the scheduler at all when
+            // the count is already sufficient.
+            lock (semaphore.Gate)
+            {
+                if (semaphore.Count >= needCount)
+                {
+                    semaphore.Count -= needCount;
+                    semaphore.WaitingThreads = Math.Max(0, semaphore.WaitingThreads - 1);
+                    GuestThreadExecution.TryConsumeCurrentThreadBlock(out _);
+                    if (_traceSema)
+                    {
+                        TraceSemaphore($"wait-recheck handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count} {FormatCallSite(ctx)}");
+                    }
+                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+                }
+            }
+
             if (_traceSema)
             {
                 TraceSemaphore($"wait-block handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count} timeout={(timeoutAddress == 0 ? "infinite" : timeoutUsec)} waiters={semaphore.WaitingThreads} {FormatCallSite(ctx)}");

src/SharpEmu.Libs/Network/NetExports.cs

@@ -755,6 +755,52 @@ public static class NetExports
         return true;
     }
 
+    [SysAbiExport(
+        Nid = "8Kcp5d-q1Uo",
+        ExportName = "sceNetInetPton",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNet")]
+    public static int NetInetPton(CpuContext ctx)
+    {
+        var addressFamily = unchecked((int)ctx[CpuRegister.Rdi]);
+        var sourceAddress = ctx[CpuRegister.Rsi];
+        var destinationAddress = ctx[CpuRegister.Rdx];
+        if (sourceAddress == 0 || destinationAddress == 0)
+        {
+            return SetNetError(ctx, NetErrorInvalidArgument, NetErrnoInvalidArgument);
+        }
+
+        if (!TryReadUtf8Z(ctx, sourceAddress, MaxNameLength, out var source))
+        {
+            return SetNetError(ctx, NetErrorInvalidArgument, NetErrnoInvalidArgument);
+        }
+
+        var family = addressFamily switch
+        {
+            2 => AddressFamily.InterNetwork,      // AF_INET
+            28 => AddressFamily.InterNetworkV6,   // AF_INET6
+            _ => AddressFamily.Unknown,
+        };
+        if (family == AddressFamily.Unknown ||
+            !IPAddress.TryParse(source, out var parsed) ||
+            parsed.AddressFamily != family)
+        {
+            // Match BSD inet_pton: return 0 for a parseable-family miss.
+            ctx[CpuRegister.Rax] = 0;
+            return 0;
+        }
+
+        var bytes = parsed.GetAddressBytes();
+        if (!ctx.Memory.TryWrite(destinationAddress, bytes))
+        {
+            return SetNetError(ctx, NetErrorInvalidArgument, NetErrnoInvalidArgument);
+        }
+
+        TraceNet("inet_pton", addressFamily, sourceAddress, destinationAddress, (ulong)bytes.Length);
+        ctx[CpuRegister.Rax] = 1;
+        return 1;
+    }
+
     private static void TraceNet(string operation, int id, ulong arg0, ulong arg1, ulong arg2)
     {
         if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_NET"), "1", StringComparison.Ordinal))

src/SharpEmu.Libs/Np/NpEntitlementAccessExports.cs

@@ -1,6 +1,8 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Buffers.Binary;
+using System.Text;
 using SharpEmu.HLE;
 
 namespace SharpEmu.Libs.Np;
@@ -8,7 +10,34 @@ namespace SharpEmu.Libs.Np;
 public static class NpEntitlementAccessExports
 {
     private const int BootParamClearSize = 0x20;
-    private const int EmptyAddcontInfoListSize = 0x10;
+    private const int EntitlementLabelSize = 17;
+    private const int EntitlementLabelPadding = 3;
+    private const int AddcontEntitlementInfoSize =
+        EntitlementLabelSize + EntitlementLabelPadding + sizeof(uint) + sizeof(uint);
+
+    // libSceNpEntitlementAccess package / download codes observed on Prospero.
+    // package_type 3 = PSAL (license-style add-on); download_status 4 = INSTALLED.
+    private const uint PackageTypePsal = 3;
+    private const uint DownloadStatusInstalled = 4;
+    private const uint SkuFlagFull = 3;
+
+    private const int NpEntitlementAccessErrorParameter = unchecked((int)0x817D0002);
+    private const int NpEntitlementAccessErrorNoEntitlement = unchecked((int)0x817D0007);
+
+    // Offline add-on entitlements titles query through NpEntitlementAccess.
+    // GTA V Enhanced (PPSA04264) gates Story Mode on these three labels; without
+    // them the frontend offers "Buy GTAV Story Mode" despite a full dump.
+    private static readonly AddcontEntitlement[] OwnedAddcontEntitlements =
+    [
+        new("85y-je", PackageTypePsal, DownloadStatusInstalled),
+        new("5d5c48", PackageTypePsal, DownloadStatusInstalled),
+        new("_mtqu6", PackageTypePsal, DownloadStatusInstalled),
+    ];
+
+    private readonly record struct AddcontEntitlement(
+        string Label,
+        uint PackageType,
+        uint DownloadStatus);
 
     [SysAbiExport(
         Nid = "jO8DM8oyego",
@@ -19,21 +48,46 @@ public static class NpEntitlementAccessExports
     {
         var initParam = ctx[CpuRegister.Rdi];
         var bootParam = ctx[CpuRegister.Rsi];
-
-        if (bootParam != 0)
+        if (initParam == 0 || bootParam == 0)
         {
-            Span<byte> clear = stackalloc byte[BootParamClearSize];
-            clear.Clear();
-            if (!ctx.Memory.TryWrite(bootParam, clear))
-            {
-                return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
-            }
+            return ctx.SetReturn(NpEntitlementAccessErrorParameter);
+        }
+
+        Span<byte> clear = stackalloc byte[BootParamClearSize];
+        clear.Clear();
+        if (!ctx.Memory.TryWrite(bootParam, clear))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
         TraceNpEntitlementAccess($"initialize init=0x{initParam:X16} boot=0x{bootParam:X16}");
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
+    [SysAbiExport(
+        Nid = "lPDO62PpJIA",
+        ExportName = "sceNpEntitlementAccessGetSkuFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpEntitlementAccess")]
+    public static int NpEntitlementAccessGetSkuFlag(CpuContext ctx)
+    {
+        var skuFlagAddress = ctx[CpuRegister.Rdi];
+        if (skuFlagAddress == 0)
+        {
+            return ctx.SetReturn(NpEntitlementAccessErrorParameter);
+        }
+
+        Span<byte> skuFlagBytes = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(skuFlagBytes, SkuFlagFull);
+        if (!ctx.Memory.TryWrite(skuFlagAddress, skuFlagBytes))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceNpEntitlementAccess($"get_sku_flag -> {SkuFlagFull}");
+        return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     [SysAbiExport(
         Nid = "TFyU+KFBv54",
         ExportName = "sceNpEntitlementAccessGetAddcontEntitlementInfoList",
@@ -42,28 +96,53 @@ public static class NpEntitlementAccessExports
     public static int NpEntitlementAccessGetAddcontEntitlementInfoList(CpuContext ctx)
     {
         var listAddress = ctx[CpuRegister.Rsi];
-        if (listAddress != 0)
+        var listNum = (uint)ctx[CpuRegister.Rdx];
+        var hitNumAddress = ctx[CpuRegister.Rcx];
+
+        if (hitNumAddress == 0 || (listAddress == 0 && listNum != 0))
         {
-            Span<byte> emptyList = stackalloc byte[EmptyAddcontInfoListSize];
-            emptyList.Clear();
-            if (!ctx.Memory.TryWrite(listAddress, emptyList))
+            return ctx.SetReturn(NpEntitlementAccessErrorParameter);
+        }
+
+        var hitNum = (uint)OwnedAddcontEntitlements.Length;
+        Span<byte> hitNumBytes = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(hitNumBytes, hitNum);
+        if (!ctx.Memory.TryWrite(hitNumAddress, hitNumBytes))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        if (listAddress != 0 && listNum != 0)
+        {
+            var clearBytes = checked((int)listNum * AddcontEntitlementInfoSize);
+            Span<byte> clear = clearBytes <= 512
+                ? stackalloc byte[clearBytes]
+                : new byte[clearBytes];
+            clear.Clear();
+            if (!ctx.Memory.TryWrite(listAddress, clear))
             {
                 return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
+
+            var copyNum = Math.Min(listNum, hitNum);
+            for (var index = 0u; index < copyNum; index++)
+            {
+                if (!TryWriteAddcontEntitlementInfo(
+                        ctx,
+                        listAddress + index * (ulong)AddcontEntitlementInfoSize,
+                        OwnedAddcontEntitlements[(int)index]))
+                {
+                    return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+            }
         }
 
         TraceNpEntitlementAccess(
-            $"get_addcont_info_list service=0x{ctx[CpuRegister.Rdi]:X16} list=0x{listAddress:X16} " +
-            $"max={ctx[CpuRegister.Rdx]} flags=0x{ctx[CpuRegister.Rcx]:X16} -> empty");
+            $"get_addcont_info_list service={ctx[CpuRegister.Rdi]} list=0x{listAddress:X16} " +
+            $"list_num={listNum} hit_num={hitNum}");
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
-    private const int EmptyAddcontInfoSize = 0x30;
-
-    // Singular lookup of one add-on-content entitlement (rdx = info out). We own
-    // no DLC, so report an empty/zeroed info and success — matching the list
-    // variant's "no entitlements" answer. Dead Cells calls this while loading a
-    // level; leaving it unresolved left the info struct uninitialized.
     [SysAbiExport(
         Nid = "xddD23+8TfQ",
         ExportName = "sceNpEntitlementAccessGetAddcontEntitlementInfo",
@@ -71,21 +150,84 @@ public static class NpEntitlementAccessExports
         LibraryName = "libSceNpEntitlementAccess")]
     public static int NpEntitlementAccessGetAddcontEntitlementInfo(CpuContext ctx)
     {
+        var labelAddress = ctx[CpuRegister.Rsi];
         var infoAddress = ctx[CpuRegister.Rdx];
-        if (infoAddress != 0)
+        if (labelAddress == 0 || infoAddress == 0)
         {
-            Span<byte> info = stackalloc byte[EmptyAddcontInfoSize];
-            info.Clear();
-            if (!ctx.Memory.TryWrite(infoAddress, info))
+            return ctx.SetReturn(NpEntitlementAccessErrorParameter);
+        }
+
+        Span<byte> labelBytes = stackalloc byte[EntitlementLabelSize];
+        if (!ctx.Memory.TryRead(labelAddress, labelBytes))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        var label = ReadEntitlementLabel(labelBytes);
+        Span<byte> info = stackalloc byte[AddcontEntitlementInfoSize];
+        info.Clear();
+        if (!ctx.Memory.TryWrite(infoAddress, info))
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        foreach (var entitlement in OwnedAddcontEntitlements)
+        {
+            if (!string.Equals(label, entitlement.Label, StringComparison.Ordinal))
+            {
+                continue;
+            }
+
+            if (!TryWriteAddcontEntitlementInfo(ctx, infoAddress, entitlement))
             {
                 return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
             }
+
+            TraceNpEntitlementAccess(
+                $"get_addcont_info service={ctx[CpuRegister.Rdi]} label='{label}' -> owned");
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
         }
 
         TraceNpEntitlementAccess(
-            $"get_addcont_info service=0x{ctx[CpuRegister.Rdi]:X16} label=0x{ctx[CpuRegister.Rsi]:X16} " +
-            $"info=0x{infoAddress:X16} -> empty");
-        return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
+            $"get_addcont_info service={ctx[CpuRegister.Rdi]} label='{label}' -> no entitlement");
+        return ctx.SetReturn(NpEntitlementAccessErrorNoEntitlement);
+    }
+
+    private static bool TryWriteAddcontEntitlementInfo(
+        CpuContext ctx,
+        ulong address,
+        AddcontEntitlement entitlement)
+    {
+        Span<byte> info = stackalloc byte[AddcontEntitlementInfoSize];
+        info.Clear();
+
+        var labelBytes = Encoding.ASCII.GetBytes(entitlement.Label);
+        var labelLength = Math.Min(labelBytes.Length, EntitlementLabelSize - 1);
+        labelBytes.AsSpan(0, labelLength).CopyTo(info);
+
+        BinaryPrimitives.WriteUInt32LittleEndian(
+            info.Slice(EntitlementLabelSize + EntitlementLabelPadding, sizeof(uint)),
+            entitlement.PackageType);
+        BinaryPrimitives.WriteUInt32LittleEndian(
+            info.Slice(
+                EntitlementLabelSize + EntitlementLabelPadding + sizeof(uint),
+                sizeof(uint)),
+            entitlement.DownloadStatus);
+
+        return ctx.Memory.TryWrite(address, info);
+    }
+
+    private static string ReadEntitlementLabel(ReadOnlySpan<byte> bytes)
+    {
+        var length = 0;
+        while (length < bytes.Length && bytes[length] != 0)
+        {
+            length++;
+        }
+
+        return length == 0
+            ? string.Empty
+            : Encoding.ASCII.GetString(bytes[..length]);
     }
 
     private static void TraceNpEntitlementAccess(string message)

src/SharpEmu.Libs/Np/NpManagerExports.cs

@@ -86,6 +86,25 @@ public static class NpManagerExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    /// <summary>
+    /// Accepts the premium-event callback and never invokes it. Offline sessions
+    /// have no PS Plus / premium transitions to deliver, and leaving this NID
+    /// unresolved returns NOT_FOUND which soft-locks titles that register it
+    /// during settings / store probes (GTA V Enhanced).
+    /// </summary>
+    [SysAbiExport(
+        Nid = "+yqjab2fUJA",
+        ExportName = "sceNpRegisterPremiumEventCallback",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpManager")]
+    public static int NpRegisterPremiumEventCallback(CpuContext ctx)
+    {
+        TraceNp(
+            $"register_premium_event_callback cb=0x{ctx[CpuRegister.Rdi]:X16} " +
+            $"userdata=0x{ctx[CpuRegister.Rsi]:X16}");
+        return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     [SysAbiExport(
         Nid = "qQJfO8HAiaY",
         ExportName = "sceNpRegisterStateCallbackA",

src/SharpEmu.Libs/Np/NpWebApi2Exports.cs

@@ -10,6 +10,11 @@ public static class NpWebApi2Exports
     private const int NpWebApi2ErrorInvalidArgument = unchecked((int)0x80553402);
 
     private static int _initialized;
+    private static int _nextLibraryContextHandle;
+    private static int _nextPushEventHandle;
+    private static int _nextUserContextHandle = 1000;
+    private static readonly object _contextGate = new();
+    private static readonly HashSet<int> _libraryContexts = [];
 
     [SysAbiExport(
         Nid = "+o9816YQhqQ",
@@ -26,9 +31,28 @@ public static class NpWebApi2Exports
             return ctx.SetReturn(NpWebApi2ErrorInvalidArgument);
         }
 
+        var libraryContextId = CreateLibraryContextId();
         Interlocked.Exchange(ref _initialized, 1);
         TraceNpWebApi2("init", httpContextId, poolSize);
-        return ctx.SetReturn(0);
+        return ctx.SetReturn(libraryContextId);
+    }
+
+    [SysAbiExport(
+        Nid = "MsaFhR+lPE4",
+        ExportName = "sceNpWebApi2PushEventCreateFilter",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpWebApi2")]
+    public static int NpWebApi2PushEventCreateFilter(CpuContext ctx)
+    {
+        var libraryContextId = unchecked((int)ctx[CpuRegister.Rdi]);
+        if (!IsValidLibraryContextId(libraryContextId))
+        {
+            return ctx.SetReturn(NpWebApi2ErrorInvalidArgument);
+        }
+
+        var filterHandle = Interlocked.Increment(ref _nextPushEventHandle);
+        TraceNpWebApi2("push-event-create-filter", libraryContextId, (ulong)filterHandle);
+        return ctx.SetReturn(filterHandle);
     }
 
     [SysAbiExport(
@@ -38,9 +62,16 @@ public static class NpWebApi2Exports
         LibraryName = "libSceNpWebApi2")]
     public static int NpWebApi2InitializeAlt(CpuContext ctx)
     {
+        var libraryContextId = unchecked((int)ctx[CpuRegister.Rdi]);
+        if (!IsValidLibraryContextId(libraryContextId))
+        {
+            return ctx.SetReturn(NpWebApi2ErrorInvalidArgument);
+        }
+
+        var handle = CreatePushEventHandle();
         Interlocked.Exchange(ref _initialized, 1);
-        TraceNpWebApi2("init-alt", unchecked((int)ctx[CpuRegister.Rdi]), ctx[CpuRegister.Rsi]);
-        return ctx.SetReturn(0);
+        TraceNpWebApi2("init-alt", libraryContextId, 0);
+        return ctx.SetReturn(handle);
     }
 
     [SysAbiExport(
@@ -50,10 +81,23 @@ public static class NpWebApi2Exports
         LibraryName = "libSceNpWebApi2")]
     public static int NpWebApi2CreateUserContext(CpuContext ctx)
     {
-        // No PSN backend: refuse user-context creation so the title's online
-        // layer backs off instead of driving a half-created context handle.
-        TraceNpWebApi2("create-user-context", unchecked((int)ctx[CpuRegister.Rdi]), ctx[CpuRegister.Rsi]);
-        return ctx.SetReturn(NpWebApi2ErrorInvalidArgument);
+        var libraryContextId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var userId = unchecked((int)ctx[CpuRegister.Rsi]);
+
+        TraceNpWebApi2(
+            "create-user-context",
+            libraryContextId,
+            unchecked((uint)userId));
+
+        if (Volatile.Read(ref _initialized) == 0 ||
+            !IsValidLibraryContextId(libraryContextId) ||
+            userId == -1)
+        {
+            return ctx.SetReturn(NpWebApi2ErrorInvalidArgument);
+        }
+
+        var userContextId = Interlocked.Increment(ref _nextUserContextHandle);
+        return ctx.SetReturn(userContextId);
     }
 
     [SysAbiExport(
@@ -64,11 +108,57 @@ public static class NpWebApi2Exports
     public static int NpWebApi2Terminate(CpuContext ctx)
     {
         var libraryContextId = unchecked((int)ctx[CpuRegister.Rdi]);
-        Interlocked.Exchange(ref _initialized, 0);
+        if (!IsValidLibraryContextId(libraryContextId))
+        {
+            return ctx.SetReturn(NpWebApi2ErrorInvalidArgument);
+        }
+
+        RemoveLibraryContextId(libraryContextId);
         TraceNpWebApi2("term", libraryContextId, 0);
         return ctx.SetReturn(0);
     }
 
+    private static int CreateLibraryContextId()
+    {
+        var handle = Interlocked.Increment(ref _nextLibraryContextHandle);
+        lock (_contextGate)
+        {
+            _libraryContexts.Add(handle);
+        }
+
+        return handle;
+    }
+
+    private static int CreatePushEventHandle()
+    {
+        return Interlocked.Increment(ref _nextPushEventHandle);
+    }
+
+    private static bool IsValidLibraryContextId(int libraryContextId)
+    {
+        if (libraryContextId <= 0 || libraryContextId >= 0x8000)
+        {
+            return false;
+        }
+
+        lock (_contextGate)
+        {
+            return _libraryContexts.Contains(libraryContextId);
+        }
+    }
+
+    private static void RemoveLibraryContextId(int libraryContextId)
+    {
+        lock (_contextGate)
+        {
+            _libraryContexts.Remove(libraryContextId);
+            if (_libraryContexts.Count == 0)
+            {
+                Interlocked.Exchange(ref _initialized, 0);
+            }
+        }
+    }
+
     private static void TraceNpWebApi2(string operation, int id, ulong arg0)
     {
         if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_NP_WEB_API2"), "1", StringComparison.Ordinal))

src/SharpEmu.Libs/Psml/PsmlExports.cs

@@ -0,0 +1,365 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Psml;
+
+public static class PsmlExports
+{
+    // Empirically for Astro Bot (PPSA21567):
+    //   [0] must be 0x80 (sizeThis / r9); any other value в†’ Allocate length=0
+    //   AllocateMainDirectMemory(length=[0]*[16], alignment=[8], type=0xC)
+    // So put desired byte size in [8] (becomes alignment) and page size in [16].
+    private const ulong RequirementStructSize = 0x80;
+    private const ulong SharedResourcesPageSize = 0x10000;
+    private const ulong SharedResourcesBufferSizeBytes = 0x2000000;
+    private const ulong SharedResourcesContextSizeBytes = 0x100000;
+    private const ulong ContextBufferSizeBytes = 0x800000;
+    private const ulong ContextBufferAuxSizeBytes = 0x100000;
+
+    private static int _mfsrInitialized;
+    private static readonly Lock SharedResourcesGate = new();
+    private static readonly Dictionary<ulong, SharedResourcesState> SharedResourcesByDescriptor = new();
+    private static readonly Lock ContextGate = new();
+    private static readonly Dictionary<ulong, ContextState> ContextsByAddress = new();
+
+    [SysAbiExport(
+        Nid = "3WVD91e12ZQ",
+        ExportName = "scePsmlMfsrInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePsml")]
+    public static int PsmlMfsrInit(CpuContext ctx)
+    {
+        var arg0 = ctx[CpuRegister.Rdi];
+        var arg1 = ctx[CpuRegister.Rsi];
+        var arg2 = ctx[CpuRegister.Rdx];
+        Interlocked.Exchange(ref _mfsrInitialized, 1);
+        TracePsml($"mfsr_init arg0=0x{arg0:X} arg1=0x{arg1:X} arg2=0x{arg2:X}");
+        return ctx.SetReturn(0);
+    }
+
+    [SysAbiExport(
+        Nid = "+2KpvixvL6E",
+        ExportName = "scePsmlMfsrGetSharedResourcesInitRequirement",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePsml")]
+    public static int PsmlMfsrGetSharedResourcesInitRequirement(CpuContext ctx)
+    {
+        var bufferRequirementAddress = ctx[CpuRegister.Rdi];
+        var contextRequirementAddress = ctx[CpuRegister.Rsi];
+        var flags = ctx[CpuRegister.Rdx];
+        var configAddress = ctx[CpuRegister.Rcx];
+        if (bufferRequirementAddress == 0 || contextRequirementAddress == 0)
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!WriteMemoryRequirement(ctx, bufferRequirementAddress, SharedResourcesBufferSizeBytes) ||
+            !WriteMemoryRequirement(ctx, contextRequirementAddress, SharedResourcesContextSizeBytes))
+        {
+            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TracePsml(
+            $"mfsr_get_shared_resources_init_requirement buf=0x{bufferRequirementAddress:X16} " +
+            $"ctx=0x{contextRequirementAddress:X16} flags=0x{flags:X} config=0x{configAddress:X16} " +
+            $"buf_size=0x{SharedResourcesBufferSizeBytes:X} ctx_size=0x{SharedResourcesContextSizeBytes:X}");
+        return ctx.SetReturn(0);
+    }
+
+    [SysAbiExport(
+        Nid = "eWoKNeB6V-k",
+        ExportName = "scePsmlMfsrCreateSharedResources",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePsml")]
+    public static int PsmlMfsrCreateSharedResources(CpuContext ctx)
+    {
+        var descriptorAddress = ctx[CpuRegister.Rdi];
+        var contextRequirementAddress = ctx[CpuRegister.Rsi];
+        var directMemoryAddress = ctx[CpuRegister.Rdx];
+        if (descriptorAddress == 0 || contextRequirementAddress == 0 || directMemoryAddress == 0)
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        var contextSizeBytes = ReadRequirementSize(ctx, contextRequirementAddress, SharedResourcesContextSizeBytes);
+        var state = new SharedResourcesState(
+            DescriptorAddress: descriptorAddress,
+            DirectMemoryAddress: directMemoryAddress,
+            BufferSizeBytes: SharedResourcesBufferSizeBytes,
+            ContextSizeBytes: contextSizeBytes,
+            PageSizeBytes: SharedResourcesPageSize);
+
+        if (!WriteSharedResourcesDescriptor(ctx, state))
+        {
+            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        lock (SharedResourcesGate)
+        {
+            SharedResourcesByDescriptor[descriptorAddress] = state;
+        }
+
+        TracePsml(
+            $"mfsr_create_shared_resources desc=0x{descriptorAddress:X16} req=0x{contextRequirementAddress:X16} " +
+            $"direct=0x{directMemoryAddress:X16} buf_size=0x{state.BufferSizeBytes:X} " +
+            $"ctx_size=0x{state.ContextSizeBytes:X} page=0x{state.PageSizeBytes:X}");
+        return ctx.SetReturn(0);
+    }
+
+    [SysAbiExport(
+        Nid = "ArakEpzsZo0",
+        ExportName = "scePsmlMfsrGetContextBufferRequirement800M3_2",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePsml")]
+    public static int PsmlMfsrGetContextBufferRequirement800M3_2(CpuContext ctx)
+    {
+        var bufferRequirementAddress = ctx[CpuRegister.Rdi];
+        var contextRequirementAddress = ctx[CpuRegister.Rsi];
+        var directMemoryAddress = ctx[CpuRegister.Rdx];
+        if (bufferRequirementAddress == 0 || contextRequirementAddress == 0 || directMemoryAddress == 0)
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!WriteMemoryRequirement(ctx, bufferRequirementAddress, ContextBufferSizeBytes) ||
+            !WriteMemoryRequirement(ctx, contextRequirementAddress, ContextBufferAuxSizeBytes))
+        {
+            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TracePsml(
+            $"mfsr_get_context_buffer_requirement_800m3_2 buf=0x{bufferRequirementAddress:X16} " +
+            $"ctx=0x{contextRequirementAddress:X16} direct=0x{directMemoryAddress:X16} " +
+            $"buf_size=0x{ContextBufferSizeBytes:X} aux_size=0x{ContextBufferAuxSizeBytes:X}");
+        return ctx.SetReturn(0);
+    }
+
+    [SysAbiExport(
+        Nid = "gxv3i+MTEzU",
+        ExportName = "scePsmlMfsrCreateContext800M3_2",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePsml")]
+    public static int PsmlMfsrCreateContext800M3_2(CpuContext ctx)
+    {
+        var contextAddress = ctx[CpuRegister.Rdi];
+        var requirementAddress = ctx[CpuRegister.Rsi];
+        var structSize = ctx[CpuRegister.Rdx];
+        var sharedDirectMemory = ctx[CpuRegister.Rcx];
+        var pageSize = ctx[CpuRegister.R8];
+        if (contextAddress == 0 || sharedDirectMemory == 0)
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        var sharedState = TryFindSharedResources(sharedDirectMemory, contextAddress);
+        var effectiveStructSize = structSize != 0 ? structSize : RequirementStructSize;
+        var effectivePageSize = pageSize != 0 ? pageSize : SharedResourcesPageSize;
+        var sharedDescriptor = sharedState?.DescriptorAddress ?? contextAddress - 0x30;
+        var bufferSize = sharedState?.BufferSizeBytes ?? ContextBufferSizeBytes;
+
+        var state = new ContextState(
+            ContextAddress: contextAddress,
+            SharedResourcesDescriptor: sharedDescriptor,
+            DirectMemoryAddress: sharedDirectMemory,
+            BufferSizeBytes: bufferSize,
+            PageSizeBytes: effectivePageSize,
+            StructSizeBytes: effectiveStructSize);
+
+        if (!WriteContextObject(ctx, state))
+        {
+            return ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        lock (ContextGate)
+        {
+            ContextsByAddress[contextAddress] = state;
+        }
+
+        TracePsml(
+            $"mfsr_create_context_800m3_2 ctx=0x{contextAddress:X16} req=0x{requirementAddress:X16} " +
+            $"struct=0x{effectiveStructSize:X} direct=0x{sharedDirectMemory:X16} " +
+            $"shared_desc=0x{sharedDescriptor:X16} buf_size=0x{bufferSize:X} page=0x{effectivePageSize:X}");
+        return ctx.SetReturn(0);
+    }
+
+    private static bool WriteMemoryRequirement(CpuContext ctx, ulong address, ulong sizeBytes)
+    {
+        return ctx.TryWriteUInt64(address, RequirementStructSize) &&
+               ctx.TryWriteUInt64(address + 0x08, sizeBytes) &&
+               ctx.TryWriteUInt64(address + 0x10, SharedResourcesPageSize);
+    }
+
+    private static ulong ReadRequirementSize(CpuContext ctx, ulong address, ulong fallback)
+    {
+        if (!ctx.TryReadUInt64(address + 0x08, out var sizeBytes) || sizeBytes == 0)
+        {
+            return fallback;
+        }
+
+        // Guest requirement structs use size @8; reject pointer-like garbage.
+        return sizeBytes > 0x1000_0000UL ? fallback : sizeBytes;
+    }
+
+    private static SharedResourcesState? TryFindSharedResources(ulong directMemoryAddress, ulong contextAddress)
+    {
+        lock (SharedResourcesGate)
+        {
+            foreach (var state in SharedResourcesByDescriptor.Values)
+            {
+                if (state.DirectMemoryAddress == directMemoryAddress)
+                {
+                    return state;
+                }
+            }
+
+            var inferredDescriptor = contextAddress >= 0x30 ? contextAddress - 0x30 : 0;
+            if (inferredDescriptor != 0 &&
+                SharedResourcesByDescriptor.TryGetValue(inferredDescriptor, out var byDescriptor))
+            {
+                return byDescriptor;
+            }
+        }
+
+        return null;
+    }
+
+    private static bool WriteContextObject(CpuContext ctx, ContextState state)
+    {
+        return ctx.TryWriteUInt64(state.ContextAddress + 0x00, state.StructSizeBytes) &&
+               ctx.TryWriteUInt64(state.ContextAddress + 0x08, state.DirectMemoryAddress) &&
+               ctx.TryWriteUInt64(state.ContextAddress + 0x10, state.SharedResourcesDescriptor) &&
+               ctx.TryWriteUInt64(state.ContextAddress + 0x18, state.BufferSizeBytes) &&
+               ctx.TryWriteUInt64(state.ContextAddress + 0x20, state.PageSizeBytes) &&
+               ctx.TryWriteUInt64(state.ContextAddress + 0x28, state.ContextAddress) &&
+               ctx.TryWriteUInt64(state.ContextAddress + 0x30, state.DirectMemoryAddress);
+    }
+
+    private static bool WriteSharedResourcesDescriptor(CpuContext ctx, SharedResourcesState state)
+    {
+        // Stamp a compact self-describing blob so follow-up PSML calls can treat the
+        // descriptor as initialized guest memory instead of an all-zero placeholder.
+        return ctx.TryWriteUInt64(state.DescriptorAddress + 0x00, RequirementStructSize) &&
+               ctx.TryWriteUInt64(state.DescriptorAddress + 0x08, state.DirectMemoryAddress) &&
+               ctx.TryWriteUInt64(state.DescriptorAddress + 0x10, state.DirectMemoryAddress) &&
+               ctx.TryWriteUInt64(state.DescriptorAddress + 0x18, state.BufferSizeBytes) &&
+               ctx.TryWriteUInt64(state.DescriptorAddress + 0x20, state.ContextSizeBytes) &&
+               ctx.TryWriteUInt64(state.DescriptorAddress + 0x28, state.PageSizeBytes) &&
+               ctx.TryWriteUInt64(state.DescriptorAddress + 0x30, state.DirectMemoryAddress) &&
+               ctx.TryWriteUInt64(state.DescriptorAddress + 0x38, state.BufferSizeBytes + state.ContextSizeBytes);
+    }
+
+
+    // Astro logo path: SizeInDwords then GetDispatchMfsrPacket900 (RUNLFro+qok).
+    // Unresolved 900 returns non-zero and trips GfxRenderStagePSSR.cpp:266.
+    private const int SoftPacketSizeInDwords = 0x80;
+    private const ulong SoftPacketSizeBytes = SoftPacketSizeInDwords * 4UL;
+
+    [SysAbiExport(
+        Nid = "AHalTX9wFZY",
+        ExportName = "scePsmlMfsrGetDispatchMfsrPacketSizeInDwords",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePsml")]
+    public static int PsmlMfsrGetDispatchMfsrPacketSizeInDwords(CpuContext ctx)
+    {
+        // Logo/PSSR path: guest asserts ret == 0, then calls GetDispatchMfsrPacket900
+        // with rdi=SoftPacketSizeInDwords (observed 0x80). Returning the size in rax
+        // tripped :266 and skipped the 900 call (tDISP-s6). SCE_OK keeps the chain.
+        var arg0 = ctx[CpuRegister.Rdi];
+        TracePsml(
+            $"mfsr_get_dispatch_packet_size_dwords arg0=0x{arg0:X} " +
+            $"size=0x{SoftPacketSizeInDwords:X} ret=0");
+        return ctx.SetReturn(0);
+    }
+
+    [SysAbiExport(
+        Nid = "RUNLFro+qok",
+        ExportName = "scePsmlMfsrGetDispatchMfsrPacket900",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePsml")]
+    public static int PsmlMfsrGetDispatchMfsrPacket900(CpuContext ctx) =>
+        SoftGetDispatchMfsrPacket(ctx, "900");
+
+    [SysAbiExport(
+        Nid = "s2psNHUIdjk",
+        ExportName = "scePsmlMfsrGetDispatchMfsrPacket1000",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePsml")]
+    public static int PsmlMfsrGetDispatchMfsrPacket1000(CpuContext ctx) =>
+        SoftGetDispatchMfsrPacket(ctx, "1000");
+
+    [SysAbiExport(
+        Nid = "94iBp3KvIuI",
+        ExportName = "scePsmlMfsrGetDispatchMfsrPacket1100",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePsml")]
+    public static int PsmlMfsrGetDispatchMfsrPacket1100(CpuContext ctx) =>
+        SoftGetDispatchMfsrPacket(ctx, "1100");
+
+    private static int SoftGetDispatchMfsrPacket(CpuContext ctx, string variant)
+    {
+        var arg0 = ctx[CpuRegister.Rdi];
+        var arg1 = ctx[CpuRegister.Rsi];
+        var arg2 = ctx[CpuRegister.Rdx];
+        var arg3 = ctx[CpuRegister.Rcx];
+        // Logo call shape (tDISP-s3): rdi=size_dwords (0x80), rsi/rdx = guest
+        // packet/param buffers. Clear the first mapped buffer arg.
+        var packetAddress = 0UL;
+        foreach (var candidate in new[] { arg1, arg2, arg3 })
+        {
+            if (candidate >= 0x10000)
+            {
+                packetAddress = candidate;
+                break;
+            }
+        }
+
+        var cleared = packetAddress != 0 && TryClearGuestBuffer(ctx, packetAddress, SoftPacketSizeBytes);
+        TracePsml(
+            $"mfsr_get_dispatch_packet_{variant} a0=0x{arg0:X16} a1=0x{arg1:X16} " +
+            $"a2=0x{arg2:X16} a3=0x{arg3:X16} packet=0x{packetAddress:X16} cleared={cleared}");
+        return ctx.SetReturn(0);
+    }
+
+    private static bool TryClearGuestBuffer(CpuContext ctx, ulong address, ulong length)
+    {
+        Span<byte> zeroes = stackalloc byte[4096];
+        zeroes.Clear();
+        for (ulong offset = 0; offset < length;)
+        {
+            var chunkSize = (int)Math.Min((ulong)zeroes.Length, length - offset);
+            if (!ctx.Memory.TryWrite(address + offset, zeroes[..chunkSize]))
+            {
+                return false;
+            }
+
+            offset += unchecked((uint)chunkSize);
+        }
+
+        return true;
+    }
+
+    private static void TracePsml(string message)
+    {
+        if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_PSML"), "1", StringComparison.Ordinal))
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] psml.{message}");
+        }
+    }
+
+    private readonly record struct SharedResourcesState(
+        ulong DescriptorAddress,
+        ulong DirectMemoryAddress,
+        ulong BufferSizeBytes,
+        ulong ContextSizeBytes,
+        ulong PageSizeBytes);
+
+    private readonly record struct ContextState(
+        ulong ContextAddress,
+        ulong SharedResourcesDescriptor,
+        ulong DirectMemoryAddress,
+        ulong BufferSizeBytes,
+        ulong PageSizeBytes,
+        ulong StructSizeBytes);
+}

src/SharpEmu.Libs/Remoteplay/RemoteplayExports.cs

@@ -0,0 +1,51 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Remoteplay;
+
+// SharpEmu does not implement PS5 Remote Play. Titles still probe this API
+// during startup (initialize + connection-status checks while bringing up
+// pad/network subsystems). Without a handler they get ORBIS_GEN2_ERROR_NOT_FOUND
+// instead of a real status code. Reporting a clean "initialized, not connected"
+// state lets callers take their normal no-remote-play path.
+public static class RemoteplayExports
+{
+    private const int StatusDisconnected = 0;
+
+    [SysAbiExport(
+        Nid = "k1SwgkMSOM8",
+        ExportName = "sceRemoteplayInitialize",
+        Target = Generation.Gen5,
+        LibraryName = "libSceRemoteplay")]
+    public static int RemoteplayInitialize(CpuContext ctx) => SetReturn(ctx, 0);
+
+    [SysAbiExport(
+        Nid = "g3PNjYKWqnQ",
+        ExportName = "sceRemoteplayGetConnectionStatus",
+        Target = Generation.Gen5,
+        LibraryName = "libSceRemoteplay")]
+    public static int RemoteplayGetConnectionStatus(CpuContext ctx)
+    {
+        var statusAddress = ctx[CpuRegister.Rsi];
+        if (statusAddress != 0)
+        {
+            Span<byte> status = stackalloc byte[0x10];
+            status.Clear();
+            status[0] = StatusDisconnected;
+            if (!ctx.Memory.TryWrite(statusAddress, status))
+            {
+                return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+        }
+
+        return SetReturn(ctx, 0);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/SaveData/SaveDataExports.cs

@@ -28,6 +28,7 @@ public static class SaveDataExports
     private const ulong ResultInfosOffset = 0x20;
     private const uint SortKeyFreeBlocks = 5;
     private const uint SortOrderDescent = 1;
+    private const uint MountModeReadOnly = 1u << 0;
     private const uint MountModeCreate = 1u << 2;
     private const uint MountModeCreate2 = 1u << 5;
     private const int MountResultSize = 0x40;
@@ -713,16 +714,43 @@ public static class SaveDataExports
             return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
         }
 
-        if (userId < 0 || string.IsNullOrWhiteSpace(dirName))
+        return MountSaveData(
+            ctx,
+            "mount3",
+            userId,
+            ResolveConfiguredTitleId(),
+            dirName,
+            blocks,
+            systemBlocks,
+            mountMode,
+            resource,
+            mode,
+            resultAddress);
+    }
+
+    private static int MountSaveData(
+        CpuContext ctx,
+        string operation,
+        int userId,
+        string titleId,
+        string dirName,
+        ulong blocks,
+        ulong systemBlocks,
+        uint mountMode,
+        uint resource,
+        uint mode,
+        ulong resultAddress)
+    {
+        if (userId < 0 || string.IsNullOrWhiteSpace(titleId) || string.IsNullOrWhiteSpace(dirName))
         {
             return SetReturn(ctx, OrbisSaveDataErrorParameter);
         }
 
         try
         {
-            var titleId = ResolveConfiguredTitleId();
+            var sanitizedTitleId = SanitizePathSegment(titleId.Trim());
             var savePath = Path.Combine(
-                ResolveTitleSaveRoot(userId, titleId),
+                ResolveTitleSaveRoot(userId, sanitizedTitleId),
                 SanitizePathSegment(dirName));
             var existed = Directory.Exists(savePath);
             var create = (mountMode & MountModeCreate) != 0;
@@ -760,7 +788,7 @@ public static class SaveDataExports
             }
 
             TraceSaveData(
-                $"mount3 user={userId} title={titleId} dir={dirName} blocks={blocks} " +
+                $"{operation} user={userId} title={sanitizedTitleId} dir={dirName} blocks={blocks} " +
                 $"system_blocks={systemBlocks} mount_mode=0x{mountMode:X} resource={resource} mode={mode} " +
                 $"mount_point={mountPoint} created={!existed} root='{savePath}'");
             return SetReturn(ctx, 0);
@@ -779,6 +807,52 @@ public static class SaveDataExports
         }
     }
 
+    [SysAbiExport(
+        Nid = "WAzWTZm1H+I",
+        ExportName = "sceSaveDataTransferringMount",
+        Target = Generation.Gen5,
+        LibraryName = "libSceSaveData")]
+    public static int SaveDataTransferringMount(CpuContext ctx)
+    {
+        var mountAddress = ctx[CpuRegister.Rdi];
+        var resultAddress = ctx[CpuRegister.Rsi];
+        if (mountAddress == 0 || resultAddress == 0)
+        {
+            return SetReturn(ctx, OrbisSaveDataErrorParameter);
+        }
+
+        if (!TryReadInt32(ctx, mountAddress, out var userId) ||
+            !ctx.TryReadUInt64(mountAddress + 0x08, out var titleIdAddress) ||
+            !ctx.TryReadUInt64(mountAddress + 0x10, out var dirNameAddress) ||
+            titleIdAddress == 0 ||
+            dirNameAddress == 0 ||
+            !TryReadFixedAscii(ctx, titleIdAddress, SaveDataTitleIdSize, out var titleId) ||
+            !TryReadFixedAscii(ctx, dirNameAddress, SaveDataDirNameSize, out var dirName))
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        return MountSaveData(
+            ctx,
+            "transferring_mount",
+            userId,
+            titleId,
+            dirName,
+            0,
+            0,
+            MountModeReadOnly,
+            0,
+            0,
+            resultAddress);
+    }
+
+    [SysAbiExport(
+        Nid = "RjMlsR8EXrw",
+        ExportName = "sceSaveDataTransferringMountPs4",
+        Target = Generation.Gen5,
+        LibraryName = "libSceSaveData")]
+    public static int SaveDataTransferringMountPs4(CpuContext ctx) => SaveDataTransferringMount(ctx);
+
     private static int _nextTransactionResource;
     [SysAbiExport(
         Nid = "gjRZNnw0JPE",
@@ -787,6 +861,34 @@ public static class SaveDataExports
         LibraryName = "libSceSaveData")]
     public static int SaveDataCreateTransactionResource(CpuContext ctx)
     {
+        // Demon's Souls first-run call:
+        // RDI = 0xC0000, RSI = RDX + 8, RDX = resource output.
+        // Writing integer handle 1 makes the title dereference [1 + 8],
+        // causing the repeatable access violation at guest address 0x9.
+        var desWorkSize = ctx[CpuRegister.Rdi];
+        var desWorkAddress = ctx[CpuRegister.Rsi];
+        var desResourceAddress = ctx[CpuRegister.Rdx];
+
+        if (desWorkSize == 0xC0000 &&
+            desResourceAddress != 0 &&
+            desResourceAddress <= ulong.MaxValue - sizeof(ulong) &&
+            desWorkAddress == desResourceAddress + sizeof(ulong))
+        {
+            if (!ctx.TryWriteUInt64(desResourceAddress, 0))
+            {
+                return SetReturn(
+                    ctx,
+                    (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            TraceSaveData(
+                $"create_transaction_resource_des_guard " +
+                $"work_size=0x{desWorkSize:X} " +
+                $"work=0x{desWorkAddress:X} " +
+                $"resource_addr=0x{desResourceAddress:X} resource=0x0");
+
+            return SetReturn(ctx, 0);
+        }
         var userId = unchecked((int)ctx[CpuRegister.Rdi]);
         var reserved = ctx[CpuRegister.Rsi];
 

src/SharpEmu.Libs/Share/ShareExports.cs

@@ -12,6 +12,9 @@ public static class ShareExports
 
     private static int _initialized;
     private static string _contentParam = string.Empty;
+    private static readonly object _callbackGate = new();
+    private static ulong _contentEventCallback;
+    private static ulong _contentEventCallbackArgument;
 
     [SysAbiExport(
         Nid = "nBDD66kiFW8",
@@ -62,6 +65,56 @@ public static class ShareExports
         return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
     }
 
+    [SysAbiExport(
+        Nid = "Sygnk9dr5WQ",
+        ExportName = "sceShareRegisterContentEventCallback",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceShareUtility")]
+    public static int ShareRegisterContentEventCallback(CpuContext ctx)
+    {
+        var callback = ctx[CpuRegister.Rdi];
+        var argument = ctx[CpuRegister.Rsi];
+        if (callback == 0)
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (_callbackGate)
+        {
+            _contentEventCallback = callback;
+            _contentEventCallbackArgument = argument;
+        }
+
+        TraceShare($"register_content_event_callback fn=0x{callback:X16} arg=0x{argument:X16}");
+        return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "KnsfHKmZqFA",
+        ExportName = "sceShareUnregisterContentEventCallback",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceShareUtility")]
+    public static int ShareUnregisterContentEventCallback(CpuContext ctx)
+    {
+        var callback = ctx[CpuRegister.Rdi];
+        if (callback == 0)
+        {
+            return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (_callbackGate)
+        {
+            if (_contentEventCallback == callback)
+            {
+                _contentEventCallback = 0;
+                _contentEventCallbackArgument = 0;
+            }
+        }
+
+        TraceShare($"unregister_content_event_callback fn=0x{callback:X16}");
+        return ctx.SetReturn(OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     private static bool TryReadNullTerminatedUtf8(CpuContext ctx, ulong address, int maxLength, out string value)
     {
         Span<byte> bytes = stackalloc byte[maxLength];

src/SharpEmu.Libs/SharpEmu.Libs.csproj

@@ -25,6 +25,8 @@ SPDX-License-Identifier: GPL-2.0-or-later
   </ItemGroup>
 
   <ItemGroup>
+    <PackageReference Include="FFmpeg.AutoGen" />
+    <PackageReference Include="NLayer" />
     <PackageReference Include="Silk.NET.Input" />
     <PackageReference Include="Silk.NET.Vulkan" />
     <PackageReference Include="Silk.NET.Vulkan.Extensions.EXT" />

src/SharpEmu.Libs/Stubs/GameServiceStubs.cs

@@ -59,4 +59,85 @@ public static class GameServiceStubs
     public static int NpUniversalDataSystemCreateEvent(CpuContext ctx) => OkWithHandle(ctx, CpuRegister.Rdi);
     public static int NpUniversalDataSystemPostEvent(CpuContext ctx) => Ok(ctx);
     public static int NpUniversalDataSystemDestroyEvent(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "47UAEuQl+iI", ExportName = "sceNpUniversalDataSystemTerminate",
+        Target = Generation.Gen5, LibraryName = "libSceNpUniversalDataSystem")]
+    public static int NpUniversalDataSystemTerminate(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "0HBYxYAjmf0", ExportName = "sceNpGameIntentTerminate",
+        Target = Generation.Gen5, LibraryName = "libSceNpGameIntent")]
+    public static int NpGameIntentTerminate(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "jqb7HntFQFc", ExportName = "sceWebBrowserDialogInitialize",
+        Target = Generation.Gen5, LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogInitialize(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "ocHtyBwHfys", ExportName = "sceWebBrowserDialogTerminate",
+        Target = Generation.Gen5, LibraryName = "libSceWebBrowserDialog")]
+    public static int WebBrowserDialogTerminate(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "kvYEw2lBndk", ExportName = "sceGameLiveStreamingInitialize",
+        Target = Generation.Gen5, LibraryName = "libSceGameLiveStreaming")]
+    public static int GameLiveStreamingInitialize(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "isruqthpYcw", ExportName = "sceSharePlayInitialize",
+        Target = Generation.Gen5, LibraryName = "libSceSharePlay")]
+    public static int SharePlayInitialize(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "0IL1keINExQ", ExportName = "sceShareTerminate",
+        Target = Generation.Gen5, LibraryName = "libSceShareUtility")]
+    public static int ShareTerminate(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "YBiIdcDPrxs", ExportName = "sceShareFeaturePermit",
+        Target = Generation.Gen5, LibraryName = "libSceShareUtility")]
+    public static int ShareFeaturePermit(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "9TrhuGzberQ", ExportName = "sceVoiceInit",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceInit(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "clyKUyi3RYU", ExportName = "sceVoiceSetThreadsParams",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceSetThreadsParams(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "nXpje5yNpaE", ExportName = "sceVoiceCreatePort",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceCreatePort(CpuContext ctx) => OkWithHandle(ctx, CpuRegister.Rdi);
+
+    [SysAbiExport(Nid = "b7kJI+nx2hg", ExportName = "sceVoiceDeletePort",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceDeletePort(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "oV9GAdJ23Gw", ExportName = "sceVoiceConnectIPortToOPort",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceConnectIPortToOPort(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "ajVj3QG2um4", ExportName = "sceVoiceDisconnectIPortFromOPort",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceDisconnectIPortFromOPort(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "Oo0S5PH7FIQ", ExportName = "sceVoiceEnd",
+        Target = Generation.Gen5, LibraryName = "libSceVoice")]
+    public static int VoiceEnd(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "dPj4ZtRcIWk", ExportName = "sceContentSearchInit",
+        Target = Generation.Gen5, LibraryName = "libSceContentSearch")]
+    public static int ContentSearchInit(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "zoxb0wEChEM", ExportName = "sceContentDeleteInitialize",
+        Target = Generation.Gen5, LibraryName = "libSceContentDelete")]
+    public static int ContentDeleteInitialize(CpuContext ctx) => Ok(ctx);
+
+    [SysAbiExport(Nid = "Fc8qxlKINYQ", ExportName = "sceVideoRecordingSetInfo",
+        Target = Generation.Gen5, LibraryName = "libSceVideoRecording")]
+    public static int VideoRecordingSetInfo(CpuContext ctx) => Ok(ctx);
+
+    // Captured from GTA V Enhanced (PPSA04264); not in the public NID catalog.
+    // Side-effect-free success — same as unresolved stub behavior that kept boot
+    // moving; reverse the ABI before writing guest memory.
+    #pragma warning disable SHEM006
+    [SysAbiExport(Nid = "Ikfdt-rIqCE", ExportName = "sceUnknownIkfdt",
+        Target = Generation.Gen5, LibraryName = "libKernel")]
+    public static int UnknownIkfdt(CpuContext ctx) => Ok(ctx);
+    #pragma warning restore SHEM006
 }

src/SharpEmu.Libs/SystemService/SystemServiceExports.cs

@@ -18,6 +18,7 @@ public static class SystemServiceExports
     private const int TitleIdFieldSize = 0x10;
 
     private static string? _mainAppTitleId;
+    private static int _noticeScreenSkipFlag;
 
     public static void ConfigureApplicationInfo(string? titleId)
     {
@@ -37,14 +38,40 @@ public static class SystemServiceExports
             return ctx.SetReturn(OrbisSystemServiceErrorParameter);
         }
 
-        // No system notice screen to skip in the emulator; report "do not skip".
+        // Keep the flag state even though the emulator does not display the
+        // system notice screen. Titles use this service as a normal preference
+        // store and expect a later get to observe the value they set.
         Span<byte> flagBytes = stackalloc byte[1];
-        flagBytes[0] = 0;
+        flagBytes[0] = unchecked((byte)Volatile.Read(ref _noticeScreenSkipFlag));
         return ctx.Memory.TryWrite(flagAddress, flagBytes)
             ? ctx.SetReturn(0)
             : ctx.SetReturn((int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
     }
 
+    [SysAbiExport(
+        Nid = "8Lo6Zv94aho",
+        ExportName = "sceSystemServiceDisableNoticeScreenSkipFlagAutoSet",
+        Target = Generation.Gen5,
+        LibraryName = "libSceSystemService")]
+    public static int SystemServiceDisableNoticeScreenSkipFlagAutoSet(CpuContext ctx) =>
+        ctx.SetReturn(0);
+
+    // Settings entry calls this immediately before spawning SaveModTime/Load
+    // threads. An unresolved stub returns NOT_FOUND and the title can stall in
+    // that path; accept the write and report success.
+    [SysAbiExport(
+        Nid = "Q3utJvma4Mo",
+        ExportName = "sceSystemServiceSetNoticeScreenSkipFlag",
+        Target = Generation.Gen5,
+        LibraryName = "libSceSystemService")]
+    public static int SystemServiceSetNoticeScreenSkipFlag(CpuContext ctx)
+    {
+        // The native API takes the flag value in the first argument. Treat any
+        // non-zero value as true, matching the bool-like PS5 ABI.
+        Volatile.Write(ref _noticeScreenSkipFlag, ctx[CpuRegister.Rdi] != 0 ? 1 : 0);
+        return ctx.SetReturn(0);
+    }
+
     [SysAbiExport(
         Nid = "4veE0XiIugA",
         ExportName = "sceSystemServiceGetMainAppTitleId",
@@ -212,4 +239,7 @@ public static class SystemServiceExports
         Target = Generation.Gen4 | Generation.Gen5,
         LibraryName = "libSceSystemService")]
     public static int SystemServiceReportAbnormalTermination(CpuContext ctx) => ctx.SetReturn(0);
+
+    internal static void ResetForTests() =>
+        Volatile.Write(ref _noticeScreenSkipFlag, 0);
 }

src/SharpEmu.Libs/UserService/UserServiceExports.cs

@@ -118,7 +118,7 @@ public static class UserServiceExports
         var userId = unchecked((int)ctx[CpuRegister.Rdi]);
         var nameAddress = ctx[CpuRegister.Rsi];
         var capacity = ctx[CpuRegister.Rdx];
-        if (userId != PrimaryUserId)
+        if (userId != PrimaryUserId && userId != 1)
         {
             return SetReturn(ctx, OrbisUserServiceErrorInvalidParameter);
         }
@@ -144,6 +144,16 @@ public static class UserServiceExports
             : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
     }
 
+    // Title-captured alias NID for the same username query.
+    #pragma warning disable SHEM004
+    [SysAbiExport(
+        Nid = "znaWI0gpuo8",
+        ExportName = "sceUserServiceGetUserName",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceUserService")]
+    public static int UserServiceGetUserNameAlt(CpuContext ctx) => UserServiceGetUserName(ctx);
+    #pragma warning restore SHEM004
+
     // Name not yet in ps5_names.txt and the NID was captured from titles; revisit when the symbol is catalogued.
     #pragma warning disable SHEM006
     [SysAbiExport(

src/SharpEmu.Libs/VideoOut/VideoOutExports.cs

@@ -3,6 +3,7 @@
 
 using SharpEmu.HLE;
 using SharpEmu.HLE.Host;
+using SharpEmu.Libs.Diagnostics;
 using SharpEmu.Libs.Gpu;
 using SharpEmu.Libs.Audio;
 using SharpEmu.Libs.Kernel;
@@ -1233,6 +1234,15 @@ public static class VideoOutExports
             $"videoout.submit_flip handle={handle} index={bufferIndex} mode={flipMode} " +
             $"arg={flipArg} addr=0x{guestImageAddress:X16} submitted={guestImageSubmitted} " +
             $"events={flipEventCount} ordered_completion={!submitGpuImage}");
+        LoadProgressDiagnostics.TraceFlipSubmit(
+            handle,
+            bufferIndex,
+            flipMode,
+            submitGpuImage,
+            guestImageSubmitted,
+            guestImageAddress,
+            flipEventCount);
+        LoadProgressDiagnostics.TraceGpuWaitSnapshot(ctx.Memory);
         ReportFrameRate(presented: false);
         var diagnosticFlipNumber = Interlocked.Increment(ref _diagnosticFlipCount);
         if (_holdFirstFlipMilliseconds > 0 && diagnosticFlipNumber == _holdFlipNumber)

src/SharpEmu.Libs/VideoOut/VulkanDetilePass.cs

@@ -0,0 +1,894 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Numerics;
+using System.Runtime.CompilerServices;
+using SharpEmu.Libs.Agc;
+using SharpEmu.ShaderCompiler.Vulkan;
+using Silk.NET.Vulkan;
+using VkBuffer = Silk.NET.Vulkan.Buffer;
+
+namespace SharpEmu.Libs.VideoOut;
+
+/// <summary>
+/// Self-contained GPU deswizzle pass: runs the ExactXor detile equation from
+/// <see cref="GnmTiling.GetDetileParams"/> as a Vulkan compute shader
+/// (<see cref="SpirvFixedShaders.CreateDetileCompute"/>), writing a linear buffer
+/// and copying it into a sampled image — the GPU equivalent of the CPU
+/// <c>GnmTiling.TryDetile</c> + staging upload.
+///
+/// Two entry points share the same (verified) recording:
+/// <see cref="DetileIntoImage"/> is a self-contained one-shot (submit + wait) used
+/// by the isolation self-test; <see cref="RecordDetile"/> records into a caller's
+/// command buffer and hands back its transient buffers + descriptor pool for the
+/// caller to retire with that command buffer's fence — the render-path variant,
+/// which must never block the render thread.
+///
+/// Only ExactXor 4-bytes/element surfaces are handled; <see cref="Supports"/> lets
+/// the caller fall back to the CPU path for everything else.
+/// </summary>
+internal sealed unsafe class VulkanDetilePass : IDisposable
+{
+    private const uint LocalSize = 8;
+    private const uint PushConstantBytes = 11 * sizeof(uint);
+
+    private readonly Vk _vk;
+    private readonly Device _device;
+    private readonly Queue _queue;
+    private readonly PhysicalDevice _physicalDevice;
+    private readonly uint _queueFamilyIndex;
+
+    private ShaderModule _shaderModule;
+    private DescriptorSetLayout _descriptorSetLayout;
+    private PipelineLayout _pipelineLayout;
+    private Pipeline _pipeline;
+    private CommandPool _commandPool;
+    private bool _initialized;
+    private bool _disposed;
+
+    private PhysicalDeviceMemoryProperties _memoryProperties;
+    private bool _memoryPropertiesLoaded;
+
+    private readonly Dictionary<int[], TermBuffer> _xorTermBuffers = new(ReferenceComparer.Instance);
+    private readonly Dictionary<int[], TermBuffer> _blockTermBuffers = new(ReferenceComparer.Instance);
+    private TermBuffer _placeholderTermBuffer;
+
+    private readonly Dictionary<(ulong Bucket, bool HostVisible), Stack<Allocation>> _bufferPool = new();
+    private readonly List<Allocation> _allAllocations = new();
+
+    private readonly Stack<DescriptorSet> _freeDescriptorSets = new();
+    private readonly List<DescriptorPool> _descriptorPools = new();
+    private const uint DescriptorSetsPerPool = 64;
+    private const ulong MinimumBufferBucket = 4096;
+
+    public VulkanDetilePass(
+        Vk vk,
+        Device device,
+        Queue queue,
+        PhysicalDevice physicalDevice,
+        uint queueFamilyIndex)
+    {
+        _vk = vk;
+        _device = device;
+        _queue = queue;
+        _physicalDevice = physicalDevice;
+        _queueFamilyIndex = queueFamilyIndex;
+    }
+
+    /// <summary>
+    /// The kernel handles the exact-XOR and block-table modes at 4/8/16
+    /// bytes-per-element (one, two, or four 32-bit words per element). 1/2 bpp are
+    /// sub-word and stay on the CPU.
+    /// </summary>
+    public static bool Supports(in DetileParams parameters) =>
+        (parameters.Equation == DetileEquation.ExactXor ||
+         parameters.Equation == DetileEquation.BlockTable) &&
+        parameters.BytesPerElement is 4 or 8 or 16;
+
+    /// <summary>Opaque handle to the pooled resources one recorded detile is using.
+    /// The caller hands it back to <see cref="Retire"/> once the command buffer they
+    /// were recorded into has completed; nothing is destroyed, the buffers and the
+    /// descriptor set return to this pass's free lists for the next texture.</summary>
+    public sealed class Transients
+    {
+        internal static readonly Transients Empty = new();
+
+        internal Allocation Tiled;
+        internal Allocation Output;
+        internal DescriptorSet Set;
+        internal bool Rented;
+    }
+
+    internal readonly record struct Allocation(
+        VkBuffer Buffer,
+        DeviceMemory Memory,
+        ulong Capacity,
+        bool HostVisible);
+
+    private readonly record struct TermBuffer(VkBuffer Buffer, ulong ByteSize);
+
+    private struct DetileResources
+    {
+        public Allocation Tiled;
+        public Allocation Output;
+        public DescriptorSet Set;
+        public ulong OutputBytes;
+        public uint SrcSliceElements;
+        public uint EquationValue;
+        public uint UintsPerElement;
+    }
+
+    private sealed class ReferenceComparer : IEqualityComparer<int[]>
+    {
+        public static readonly ReferenceComparer Instance = new();
+
+        public bool Equals(int[]? x, int[]? y) => ReferenceEquals(x, y);
+
+        public int GetHashCode(int[] obj) => RuntimeHelpers.GetHashCode(obj);
+    }
+
+    /// <summary>
+    /// Records the deswizzle of <paramref name="tiled"/> into <paramref name="image"/>
+    /// (<paramref name="texelWidth"/> x <paramref name="texelHeight"/> texels x
+    /// <paramref name="layers"/> array slices, currently in
+    /// <paramref name="currentLayout"/>) onto <paramref name="commandBuffer"/>,
+    /// leaving the image <see cref="ImageLayout.ShaderReadOnlyOptimal"/>. The kernel
+    /// iterates the element grid from <paramref name="parameters"/> (for
+    /// block-compressed formats a 4x4 block is one element, so the element grid is
+    /// smaller than the texel grid). The tiled buffer holds the array slices packed
+    /// contiguously (each an independently tiled 2D surface). Does not submit; the
+    /// caller retires <paramref name="transients"/> with the command buffer's fence.
+    /// Returns false (with empty transients) when unsupported.
+    /// </summary>
+    public bool RecordDetile(
+        CommandBuffer commandBuffer,
+        Image image,
+        ImageLayout currentLayout,
+        uint texelWidth,
+        uint texelHeight,
+        uint layers,
+        ReadOnlySpan<byte> tiled,
+        in DetileParams parameters,
+        out Transients transients)
+    {
+        transients = Transients.Empty;
+        if (_disposed || !Supports(parameters) || texelWidth == 0 || texelHeight == 0 || layers == 0 ||
+            tiled.IsEmpty || tiled.Length % (int)(layers * (uint)parameters.BytesPerElement) != 0)
+        {
+            return false;
+        }
+
+        EnsurePipeline();
+
+        var resources = default(DetileResources);
+        try
+        {
+            PrepareResources(tiled, parameters, layers, ref resources);
+            RecordCommands(commandBuffer, in resources, image, currentLayout, texelWidth, texelHeight, layers, in parameters);
+        }
+        catch
+        {
+            ReleaseResources(in resources);
+            throw;
+        }
+
+        transients = new Transients
+        {
+            Tiled = resources.Tiled,
+            Output = resources.Output,
+            Set = resources.Set,
+            Rented = true,
+        };
+        return true;
+    }
+
+    public void Retire(Transients transients)
+    {
+        if (_disposed || transients is null || !transients.Rented)
+        {
+            return;
+        }
+
+        transients.Rented = false;
+        ReturnBuffer(transients.Tiled);
+        ReturnBuffer(transients.Output);
+        _freeDescriptorSets.Push(transients.Set);
+    }
+
+    /// <summary>
+    /// One-shot variant used by the isolation self-test: records the detile onto a
+    /// private command buffer, submits, waits, and frees every transient. Never
+    /// call this on the render thread — its blocking wait would deadlock the
+    /// present pipeline; use <see cref="RecordDetile"/> there.
+    /// </summary>
+    public bool DetileIntoImage(
+        Image image,
+        ImageLayout currentLayout,
+        uint texelWidth,
+        uint texelHeight,
+        uint layers,
+        ReadOnlySpan<byte> tiled,
+        in DetileParams parameters)
+    {
+        if (_disposed || !Supports(parameters) || texelWidth == 0 || texelHeight == 0 || layers == 0 ||
+            tiled.IsEmpty || tiled.Length % (int)(layers * (uint)parameters.BytesPerElement) != 0)
+        {
+            return false;
+        }
+
+        EnsurePipeline();
+
+        var resources = default(DetileResources);
+        CommandBuffer commandBuffer = default;
+        Fence fence = default;
+        try
+        {
+            PrepareResources(tiled, parameters, layers, ref resources);
+
+            commandBuffer = AllocateCommandBuffer();
+            BeginCommandBuffer(commandBuffer);
+            RecordCommands(commandBuffer, in resources, image, currentLayout, texelWidth, texelHeight, layers, in parameters);
+            Check(_vk.EndCommandBuffer(commandBuffer), "vkEndCommandBuffer(detile)");
+
+            fence = CreateFence();
+            var submitInfo = new SubmitInfo
+            {
+                SType = StructureType.SubmitInfo,
+                CommandBufferCount = 1,
+                PCommandBuffers = &commandBuffer,
+            };
+            Check(_vk.QueueSubmit(_queue, 1, &submitInfo, fence), "vkQueueSubmit(detile)");
+            Check(_vk.WaitForFences(_device, 1, &fence, true, ulong.MaxValue), "vkWaitForFences(detile)");
+            return true;
+        }
+        finally
+        {
+            if (fence.Handle != 0)
+            {
+                _vk.DestroyFence(_device, fence, null);
+            }
+
+            if (commandBuffer.Handle != 0)
+            {
+                _vk.FreeCommandBuffers(_device, _commandPool, 1, &commandBuffer);
+            }
+
+            ReleaseResources(in resources);
+        }
+    }
+
+    private void PrepareResources(ReadOnlySpan<byte> tiled, in DetileParams parameters, uint layers, ref DetileResources resources)
+    {
+        // Binding 1 carries the within-block offset table, binding 2 the Y terms.
+        // ExactXor: xTerm/yTerm are byte offsets; the kernel indexes a uint[], so it
+        // wants element offsets — for a power-of-two element size the low
+        // log2(bpp) bits of every term are 0, so the right shift is exact.
+        // BlockTable: GetDetileParams' block table is already element offsets; it
+        // goes in binding 1 and binding 2 is an unused placeholder.
+        TermBuffer xTerm;
+        TermBuffer yTerm;
+        if (parameters.Equation == DetileEquation.BlockTable)
+        {
+            xTerm = GetTermBuffer(_blockTermBuffers, parameters.BlockTable, shift: 0);
+            yTerm = GetPlaceholderTermBuffer();
+            resources.EquationValue = 1;
+        }
+        else
+        {
+            var shift = BitOperations.TrailingZeroCount((uint)parameters.BytesPerElement);
+            xTerm = GetTermBuffer(_xorTermBuffers, parameters.XByteTerm, shift);
+            yTerm = GetTermBuffer(_xorTermBuffers, parameters.YByteTerm, shift);
+            resources.EquationValue = 0;
+        }
+
+        // The array slices are packed contiguously in the tiled buffer, so each
+        // slice's element stride is the whole tiled buffer split evenly by layer.
+        // Element sizes are in bytes-per-element; the kernel moves bpp/4 words each.
+        var bytesPerElement = (uint)parameters.BytesPerElement;
+        resources.UintsPerElement = bytesPerElement / sizeof(uint);
+        resources.SrcSliceElements = (uint)((ulong)tiled.Length / bytesPerElement / layers);
+        resources.OutputBytes =
+            (ulong)parameters.ElementsWide * (ulong)parameters.ElementsHigh * bytesPerElement * layers;
+
+        resources.Tiled = RentBuffer((ulong)tiled.Length, hostVisible: true);
+        UploadBytes(resources.Tiled.Memory, tiled);
+        resources.Output = RentBuffer(resources.OutputBytes, hostVisible: false);
+
+        resources.Set = RentDescriptorSet();
+        WriteDescriptors(
+            resources.Set,
+            (resources.Tiled.Buffer, (ulong)tiled.Length),
+            (xTerm.Buffer, xTerm.ByteSize),
+            (yTerm.Buffer, yTerm.ByteSize),
+            (resources.Output.Buffer, resources.OutputBytes));
+    }
+
+    private TermBuffer GetTermBuffer(Dictionary<int[], TermBuffer> cache, int[] table, int shift)
+    {
+        if (cache.TryGetValue(table, out var cached))
+        {
+            return cached;
+        }
+
+        var terms = ToElementTerms(table, shift);
+        var byteSize = (ulong)terms.Length * sizeof(uint);
+        var allocation = CreateBuffer(byteSize, hostVisible: true);
+        UploadUInts(allocation.Memory, terms);
+        var termBuffer = new TermBuffer(allocation.Buffer, byteSize);
+        cache[table] = termBuffer;
+        return termBuffer;
+    }
+
+    private TermBuffer GetPlaceholderTermBuffer()
+    {
+        if (_placeholderTermBuffer.Buffer.Handle != 0)
+        {
+            return _placeholderTermBuffer;
+        }
+
+        var allocation = CreateBuffer(sizeof(uint), hostVisible: true);
+        UploadUInts(allocation.Memory, [0u]);
+        _placeholderTermBuffer = new TermBuffer(allocation.Buffer, sizeof(uint));
+        return _placeholderTermBuffer;
+    }
+
+    private static ulong BucketFor(ulong size)
+    {
+        var bucket = MinimumBufferBucket;
+        while (bucket < size)
+        {
+            bucket <<= 1;
+        }
+
+        return bucket;
+    }
+
+    private Allocation RentBuffer(ulong size, bool hostVisible)
+    {
+        var bucket = BucketFor(size);
+        if (_bufferPool.TryGetValue((bucket, hostVisible), out var free) && free.Count > 0)
+        {
+            return free.Pop();
+        }
+
+        return CreateBuffer(bucket, hostVisible);
+    }
+
+    private void ReturnBuffer(Allocation allocation)
+    {
+        if (allocation.Buffer.Handle == 0)
+        {
+            return;
+        }
+
+        var key = (allocation.Capacity, allocation.HostVisible);
+        if (!_bufferPool.TryGetValue(key, out var free))
+        {
+            free = new Stack<Allocation>();
+            _bufferPool[key] = free;
+        }
+
+        free.Push(allocation);
+    }
+
+    private DescriptorSet RentDescriptorSet()
+    {
+        if (_freeDescriptorSets.Count > 0)
+        {
+            return _freeDescriptorSets.Pop();
+        }
+
+        var poolSize = new DescriptorPoolSize
+        {
+            Type = DescriptorType.StorageBuffer,
+            DescriptorCount = 4 * DescriptorSetsPerPool,
+        };
+        var poolInfo = new DescriptorPoolCreateInfo
+        {
+            SType = StructureType.DescriptorPoolCreateInfo,
+            MaxSets = DescriptorSetsPerPool,
+            PoolSizeCount = 1,
+            PPoolSizes = &poolSize,
+        };
+        Check(
+            _vk.CreateDescriptorPool(_device, &poolInfo, null, out var pool),
+            "vkCreateDescriptorPool(detile)");
+        _descriptorPools.Add(pool);
+
+        var layouts = stackalloc DescriptorSetLayout[(int)DescriptorSetsPerPool];
+        for (var index = 0; index < DescriptorSetsPerPool; index++)
+        {
+            layouts[index] = _descriptorSetLayout;
+        }
+
+        var sets = stackalloc DescriptorSet[(int)DescriptorSetsPerPool];
+        var allocateInfo = new DescriptorSetAllocateInfo
+        {
+            SType = StructureType.DescriptorSetAllocateInfo,
+            DescriptorPool = pool,
+            DescriptorSetCount = DescriptorSetsPerPool,
+            PSetLayouts = layouts,
+        };
+        Check(
+            _vk.AllocateDescriptorSets(_device, &allocateInfo, sets),
+            "vkAllocateDescriptorSets(detile)");
+        for (var index = 0; index < DescriptorSetsPerPool; index++)
+        {
+            _freeDescriptorSets.Push(sets[index]);
+        }
+
+        return _freeDescriptorSets.Pop();
+    }
+
+    private void ReleaseResources(in DetileResources resources)
+    {
+        ReturnBuffer(resources.Tiled);
+        ReturnBuffer(resources.Output);
+        if (resources.Set.Handle != 0)
+        {
+            _freeDescriptorSets.Push(resources.Set);
+        }
+    }
+
+    private void RecordCommands(
+        CommandBuffer commandBuffer,
+        in DetileResources resources,
+        Image image,
+        ImageLayout currentLayout,
+        uint texelWidth,
+        uint texelHeight,
+        uint layers,
+        in DetileParams parameters)
+    {
+        // The kernel iterates the element grid (smaller than the texel grid for
+        // block-compressed formats); the image copy below uses the texel grid.
+        var elementsWide = (uint)parameters.ElementsWide;
+        var elementsHigh = (uint)parameters.ElementsHigh;
+
+        var descriptorSet = resources.Set;
+        _vk.CmdBindPipeline(commandBuffer, PipelineBindPoint.Compute, _pipeline);
+        _vk.CmdBindDescriptorSets(
+            commandBuffer, PipelineBindPoint.Compute, _pipelineLayout, 0, 1, &descriptorSet, 0, null);
+
+        Span<uint> push =
+        [
+            elementsWide,
+            elementsHigh,
+            (uint)parameters.BlockWidth,
+            (uint)parameters.BlockHeight,
+            (uint)parameters.BlockElements,
+            (uint)parameters.BlocksPerRow,
+            (uint)parameters.XMask,
+            (uint)parameters.YMask,
+            resources.SrcSliceElements,
+            resources.EquationValue,
+            resources.UintsPerElement,
+        ];
+        fixed (uint* pushPointer = push)
+        {
+            _vk.CmdPushConstants(
+                commandBuffer, _pipelineLayout, ShaderStageFlags.ComputeBit, 0, PushConstantBytes, pushPointer);
+        }
+
+        // X is widened by uintsPerElement (each thread copies one word); one
+        // dispatch-Z layer per array slice.
+        _vk.CmdDispatch(
+            commandBuffer,
+            (elementsWide * resources.UintsPerElement + LocalSize - 1) / LocalSize,
+            (elementsHigh + LocalSize - 1) / LocalSize,
+            layers);
+
+        // Compute store -> transfer read on the linear output buffer.
+        var outputBarrier = new BufferMemoryBarrier
+        {
+            SType = StructureType.BufferMemoryBarrier,
+            SrcAccessMask = AccessFlags.ShaderWriteBit,
+            DstAccessMask = AccessFlags.TransferReadBit,
+            SrcQueueFamilyIndex = Vk.QueueFamilyIgnored,
+            DstQueueFamilyIndex = Vk.QueueFamilyIgnored,
+            Buffer = resources.Output.Buffer,
+            Offset = 0,
+            Size = resources.OutputBytes,
+        };
+        _vk.CmdPipelineBarrier(
+            commandBuffer,
+            PipelineStageFlags.ComputeShaderBit,
+            PipelineStageFlags.TransferBit,
+            0,
+            0,
+            null,
+            1,
+            &outputBarrier,
+            0,
+            null);
+
+        var initialized = currentLayout == ImageLayout.ShaderReadOnlyOptimal;
+        TransitionImage(
+            commandBuffer,
+            image,
+            currentLayout,
+            ImageLayout.TransferDstOptimal,
+            initialized ? AccessFlags.ShaderReadBit : 0,
+            AccessFlags.TransferWriteBit,
+            initialized ? PipelineStageFlags.FragmentShaderBit : PipelineStageFlags.TopOfPipeBit,
+            PipelineStageFlags.TransferBit,
+            layers);
+
+        // The output buffer is layer-major, tightly packed (BufferRowLength 0 =>
+        // one element-row per texel-row, which for compressed formats is the block
+        // row), so a single copy fills every array layer. Extent is in texels.
+        var copyRegion = new BufferImageCopy
+        {
+            BufferOffset = 0,
+            BufferRowLength = 0,
+            BufferImageHeight = 0,
+            ImageSubresource = new ImageSubresourceLayers(ImageAspectFlags.ColorBit, 0, 0, layers),
+            ImageOffset = default,
+            ImageExtent = new Extent3D(texelWidth, texelHeight, 1),
+        };
+        _vk.CmdCopyBufferToImage(
+            commandBuffer, resources.Output.Buffer, image, ImageLayout.TransferDstOptimal, 1, &copyRegion);
+
+        TransitionImage(
+            commandBuffer,
+            image,
+            ImageLayout.TransferDstOptimal,
+            ImageLayout.ShaderReadOnlyOptimal,
+            AccessFlags.TransferWriteBit,
+            AccessFlags.ShaderReadBit,
+            PipelineStageFlags.TransferBit,
+            PipelineStageFlags.FragmentShaderBit,
+            layers);
+    }
+
+    private void EnsurePipeline()
+    {
+        if (_initialized)
+        {
+            return;
+        }
+
+        var spirv = SpirvFixedShaders.CreateDetileCompute();
+        fixed (byte* code = spirv)
+        {
+            var moduleInfo = new ShaderModuleCreateInfo
+            {
+                SType = StructureType.ShaderModuleCreateInfo,
+                CodeSize = (nuint)spirv.Length,
+                PCode = (uint*)code,
+            };
+            Check(
+                _vk.CreateShaderModule(_device, &moduleInfo, null, out _shaderModule),
+                "vkCreateShaderModule(detile)");
+        }
+
+        var bindings = stackalloc DescriptorSetLayoutBinding[4];
+        for (uint index = 0; index < 4; index++)
+        {
+            bindings[index] = new DescriptorSetLayoutBinding
+            {
+                Binding = index,
+                DescriptorType = DescriptorType.StorageBuffer,
+                DescriptorCount = 1,
+                StageFlags = ShaderStageFlags.ComputeBit,
+            };
+        }
+
+        var layoutInfo = new DescriptorSetLayoutCreateInfo
+        {
+            SType = StructureType.DescriptorSetLayoutCreateInfo,
+            BindingCount = 4,
+            PBindings = bindings,
+        };
+        Check(
+            _vk.CreateDescriptorSetLayout(_device, &layoutInfo, null, out _descriptorSetLayout),
+            "vkCreateDescriptorSetLayout(detile)");
+
+        var pushRange = new PushConstantRange
+        {
+            StageFlags = ShaderStageFlags.ComputeBit,
+            Offset = 0,
+            Size = PushConstantBytes,
+        };
+        var setLayout = _descriptorSetLayout;
+        var pipelineLayoutInfo = new PipelineLayoutCreateInfo
+        {
+            SType = StructureType.PipelineLayoutCreateInfo,
+            SetLayoutCount = 1,
+            PSetLayouts = &setLayout,
+            PushConstantRangeCount = 1,
+            PPushConstantRanges = &pushRange,
+        };
+        Check(
+            _vk.CreatePipelineLayout(_device, &pipelineLayoutInfo, null, out _pipelineLayout),
+            "vkCreatePipelineLayout(detile)");
+
+        ReadOnlySpan<byte> entryPoint = "main\0"u8;
+        fixed (byte* entry = entryPoint)
+        {
+            var pipelineInfo = new ComputePipelineCreateInfo
+            {
+                SType = StructureType.ComputePipelineCreateInfo,
+                Layout = _pipelineLayout,
+                Stage = new PipelineShaderStageCreateInfo
+                {
+                    SType = StructureType.PipelineShaderStageCreateInfo,
+                    Stage = ShaderStageFlags.ComputeBit,
+                    Module = _shaderModule,
+                    PName = entry,
+                },
+            };
+            Check(
+                _vk.CreateComputePipelines(_device, default, 1, &pipelineInfo, null, out _pipeline),
+                "vkCreateComputePipelines(detile)");
+        }
+
+        var poolInfo = new CommandPoolCreateInfo
+        {
+            SType = StructureType.CommandPoolCreateInfo,
+            QueueFamilyIndex = _queueFamilyIndex,
+            Flags = CommandPoolCreateFlags.ResetCommandBufferBit,
+        };
+        Check(
+            _vk.CreateCommandPool(_device, &poolInfo, null, out _commandPool),
+            "vkCreateCommandPool(detile)");
+
+        _initialized = true;
+    }
+
+    private static uint[] ToElementTerms(int[] byteTerms, int shift)
+    {
+        var terms = new uint[byteTerms.Length];
+        for (var index = 0; index < byteTerms.Length; index++)
+        {
+            terms[index] = (uint)byteTerms[index] >> shift;
+        }
+
+        return terms;
+    }
+
+    private Allocation CreateBuffer(ulong size, bool hostVisible)
+    {
+        var bufferInfo = new BufferCreateInfo
+        {
+            SType = StructureType.BufferCreateInfo,
+            Size = size,
+            Usage = BufferUsageFlags.StorageBufferBit | BufferUsageFlags.TransferSrcBit,
+            SharingMode = SharingMode.Exclusive,
+        };
+        Check(_vk.CreateBuffer(_device, &bufferInfo, null, out var buffer), "vkCreateBuffer(detile)");
+
+        _vk.GetBufferMemoryRequirements(_device, buffer, out var requirements);
+        var required = hostVisible
+            ? MemoryPropertyFlags.HostVisibleBit | MemoryPropertyFlags.HostCoherentBit
+            : MemoryPropertyFlags.DeviceLocalBit;
+        var allocateInfo = new MemoryAllocateInfo
+        {
+            SType = StructureType.MemoryAllocateInfo,
+            AllocationSize = requirements.Size,
+            MemoryTypeIndex = FindMemoryType(requirements.MemoryTypeBits, required, hostVisible),
+        };
+        Check(_vk.AllocateMemory(_device, &allocateInfo, null, out var memory), "vkAllocateMemory(detile)");
+        Check(_vk.BindBufferMemory(_device, buffer, memory, 0), "vkBindBufferMemory(detile)");
+        var allocation = new Allocation(buffer, memory, size, hostVisible);
+        _allAllocations.Add(allocation);
+        return allocation;
+    }
+
+    private uint FindMemoryType(uint typeBits, MemoryPropertyFlags requiredFlags, bool hostVisible)
+    {
+        if (!_memoryPropertiesLoaded)
+        {
+            _vk.GetPhysicalDeviceMemoryProperties(_physicalDevice, out _memoryProperties);
+            _memoryPropertiesLoaded = true;
+        }
+
+        fixed (PhysicalDeviceMemoryProperties* properties = &_memoryProperties)
+        {
+            var memoryTypes = &properties->MemoryTypes.Element0;
+            for (uint index = 0; index < properties->MemoryTypeCount; index++)
+            {
+                if ((typeBits & (1u << (int)index)) != 0 &&
+                    (memoryTypes[index].PropertyFlags & requiredFlags) == requiredFlags)
+                {
+                    return index;
+                }
+            }
+
+            if (!hostVisible)
+            {
+                for (uint index = 0; index < properties->MemoryTypeCount; index++)
+                {
+                    if ((typeBits & (1u << (int)index)) != 0)
+                    {
+                        return index;
+                    }
+                }
+            }
+        }
+
+        throw new InvalidOperationException("No compatible Vulkan memory type for detile.");
+    }
+
+    private void UploadBytes(DeviceMemory memory, ReadOnlySpan<byte> data)
+    {
+        void* mapped;
+        Check(_vk.MapMemory(_device, memory, 0, (ulong)data.Length, 0, &mapped), "vkMapMemory(detile)");
+        data.CopyTo(new Span<byte>(mapped, data.Length));
+        _vk.UnmapMemory(_device, memory);
+    }
+
+    private void UploadUInts(DeviceMemory memory, uint[] data)
+    {
+        void* mapped;
+        var byteCount = (ulong)data.Length * sizeof(uint);
+        Check(_vk.MapMemory(_device, memory, 0, byteCount, 0, &mapped), "vkMapMemory(detile terms)");
+        data.AsSpan().CopyTo(new Span<uint>(mapped, data.Length));
+        _vk.UnmapMemory(_device, memory);
+    }
+
+    private void WriteDescriptors(
+        DescriptorSet descriptorSet,
+        (VkBuffer Buffer, ulong Size) binding0,
+        (VkBuffer Buffer, ulong Size) binding1,
+        (VkBuffer Buffer, ulong Size) binding2,
+        (VkBuffer Buffer, ulong Size) binding3)
+    {
+        var buffers = stackalloc DescriptorBufferInfo[4]
+        {
+            new DescriptorBufferInfo { Buffer = binding0.Buffer, Offset = 0, Range = binding0.Size },
+            new DescriptorBufferInfo { Buffer = binding1.Buffer, Offset = 0, Range = binding1.Size },
+            new DescriptorBufferInfo { Buffer = binding2.Buffer, Offset = 0, Range = binding2.Size },
+            new DescriptorBufferInfo { Buffer = binding3.Buffer, Offset = 0, Range = binding3.Size },
+        };
+
+        var writes = stackalloc WriteDescriptorSet[4];
+        for (uint index = 0; index < 4; index++)
+        {
+            writes[index] = new WriteDescriptorSet
+            {
+                SType = StructureType.WriteDescriptorSet,
+                DstSet = descriptorSet,
+                DstBinding = index,
+                DstArrayElement = 0,
+                DescriptorCount = 1,
+                DescriptorType = DescriptorType.StorageBuffer,
+                PBufferInfo = &buffers[index],
+            };
+        }
+
+        _vk.UpdateDescriptorSets(_device, 4, writes, 0, null);
+    }
+
+    private CommandBuffer AllocateCommandBuffer()
+    {
+        var allocateInfo = new CommandBufferAllocateInfo
+        {
+            SType = StructureType.CommandBufferAllocateInfo,
+            CommandPool = _commandPool,
+            Level = CommandBufferLevel.Primary,
+            CommandBufferCount = 1,
+        };
+        Check(
+            _vk.AllocateCommandBuffers(_device, &allocateInfo, out var commandBuffer),
+            "vkAllocateCommandBuffers(detile)");
+        return commandBuffer;
+    }
+
+    private void BeginCommandBuffer(CommandBuffer commandBuffer)
+    {
+        var beginInfo = new CommandBufferBeginInfo
+        {
+            SType = StructureType.CommandBufferBeginInfo,
+            Flags = CommandBufferUsageFlags.OneTimeSubmitBit,
+        };
+        Check(_vk.BeginCommandBuffer(commandBuffer, &beginInfo), "vkBeginCommandBuffer(detile)");
+    }
+
+    private void TransitionImage(
+        CommandBuffer commandBuffer,
+        Image image,
+        ImageLayout oldLayout,
+        ImageLayout newLayout,
+        AccessFlags srcAccess,
+        AccessFlags dstAccess,
+        PipelineStageFlags srcStage,
+        PipelineStageFlags dstStage,
+        uint layers)
+    {
+        var barrier = new ImageMemoryBarrier
+        {
+            SType = StructureType.ImageMemoryBarrier,
+            SrcAccessMask = srcAccess,
+            DstAccessMask = dstAccess,
+            OldLayout = oldLayout,
+            NewLayout = newLayout,
+            SrcQueueFamilyIndex = Vk.QueueFamilyIgnored,
+            DstQueueFamilyIndex = Vk.QueueFamilyIgnored,
+            Image = image,
+            SubresourceRange = new ImageSubresourceRange(ImageAspectFlags.ColorBit, 0, 1, 0, layers),
+        };
+        _vk.CmdPipelineBarrier(commandBuffer, srcStage, dstStage, 0, 0, null, 0, null, 1, &barrier);
+    }
+
+    private Fence CreateFence()
+    {
+        var fenceInfo = new FenceCreateInfo { SType = StructureType.FenceCreateInfo };
+        Check(_vk.CreateFence(_device, &fenceInfo, null, out var fence), "vkCreateFence(detile)");
+        return fence;
+    }
+
+    private void DestroyBuffer(VkBuffer buffer, DeviceMemory memory)
+    {
+        if (buffer.Handle != 0)
+        {
+            _vk.DestroyBuffer(_device, buffer, null);
+        }
+
+        if (memory.Handle != 0)
+        {
+            _vk.FreeMemory(_device, memory, null);
+        }
+    }
+
+    private void Check(Result result, string operation)
+    {
+        if (result != Result.Success)
+        {
+            throw new InvalidOperationException($"{operation} failed: {result}");
+        }
+    }
+
+    public void Dispose()
+    {
+        if (_disposed)
+        {
+            return;
+        }
+
+        _disposed = true;
+
+        foreach (var allocation in _allAllocations)
+        {
+            DestroyBuffer(allocation.Buffer, allocation.Memory);
+        }
+
+        _allAllocations.Clear();
+        _bufferPool.Clear();
+        _xorTermBuffers.Clear();
+        _blockTermBuffers.Clear();
+        _placeholderTermBuffer = default;
+        _freeDescriptorSets.Clear();
+        foreach (var pool in _descriptorPools)
+        {
+            _vk.DestroyDescriptorPool(_device, pool, null);
+        }
+
+        _descriptorPools.Clear();
+
+        if (_pipeline.Handle != 0)
+        {
+            _vk.DestroyPipeline(_device, _pipeline, null);
+        }
+
+        if (_pipelineLayout.Handle != 0)
+        {
+            _vk.DestroyPipelineLayout(_device, _pipelineLayout, null);
+        }
+
+        if (_descriptorSetLayout.Handle != 0)
+        {
+            _vk.DestroyDescriptorSetLayout(_device, _descriptorSetLayout, null);
+        }
+
+        if (_shaderModule.Handle != 0)
+        {
+            _vk.DestroyShaderModule(_device, _shaderModule, null);
+        }
+
+        if (_commandPool.Handle != 0)
+        {
+            _vk.DestroyCommandPool(_device, _commandPool, null);
+        }
+    }
+}

src/SharpEmu.Libs/VideoOut/VulkanDetileSelfTest.cs

@@ -0,0 +1,482 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.Libs.Agc;
+using Silk.NET.Vulkan;
+using VkBuffer = Silk.NET.Vulkan.Buffer;
+
+namespace SharpEmu.Libs.VideoOut;
+
+/// <summary>
+/// Opt-in GPU equivalence check for <see cref="VulkanDetilePass"/>. When
+/// SHARPEMU_DETILE_SELFTEST=1 it builds a known tiled surface, deswizzles it on
+/// the GPU into a real image, reads the image back, and compares against the CPU
+/// <see cref="GnmTiling.TryDetile"/> — the same equivalence the unit test proves
+/// for the params, now end-to-end through the actual Vulkan pass. It logs
+/// [DETILE-SELFTEST] PASS/FAIL and never throws into startup (any failure is
+/// caught and logged), so it is safe to leave wired.
+/// </summary>
+internal static unsafe class VulkanDetileSelfTest
+{
+    private const uint Width = 256;
+    private const uint Height = 256;
+
+    // (swizzleMode, bytesPerElement, image format). Mode 27 is exact-XOR, mode 8
+    // (64 KiB Z) is block-table — both branches. bpp 4/8/16 exercises the
+    // one/two/four-words-per-element copy. These formats are non-block-compressed
+    // (element grid == texel grid), so Width/Height are both element and texel dims.
+    private static readonly (uint Mode, int Bpp, Format Format)[] Cases =
+    [
+        (27, 4, Format.R8G8B8A8Unorm),
+        (8, 4, Format.R8G8B8A8Unorm),
+        (27, 8, Format.R32G32Uint),
+        (27, 16, Format.R32G32B32A32Uint),
+    ];
+
+    public static void RunIfRequested(
+        Vk vk,
+        Device device,
+        Queue queue,
+        PhysicalDevice physicalDevice,
+        uint queueFamilyIndex)
+    {
+        if (Environment.GetEnvironmentVariable("SHARPEMU_DETILE_SELFTEST") != "1")
+        {
+            return;
+        }
+
+        try
+        {
+            Run(vk, device, queue, physicalDevice, queueFamilyIndex);
+        }
+        catch (Exception exception)
+        {
+            Console.Error.WriteLine($"[DETILE-SELFTEST] FAIL (exception): {exception.Message}");
+        }
+    }
+
+    private static void Run(
+        Vk vk,
+        Device device,
+        Queue queue,
+        PhysicalDevice physicalDevice,
+        uint queueFamilyIndex)
+    {
+        using var pass = new VulkanDetilePass(vk, device, queue, physicalDevice, queueFamilyIndex);
+        var commandPool = CreateCommandPool(vk, device, queueFamilyIndex);
+        try
+        {
+            foreach (var (mode, bpp, format) in Cases)
+            {
+                // A plain 2D texture (1 layer) and an array texture (2 layers) — the
+                // arrayed case exercises the kernel's dispatch-Z slice addressing.
+                RunCase(vk, device, physicalDevice, queue, commandPool, pass, mode, bpp, format, layers: 1);
+                RunCase(vk, device, physicalDevice, queue, commandPool, pass, mode, bpp, format, layers: 2);
+            }
+        }
+        finally
+        {
+            if (commandPool.Handle != 0)
+            {
+                vk.DestroyCommandPool(device, commandPool, null);
+            }
+        }
+    }
+
+    private static void RunCase(
+        Vk vk,
+        Device device,
+        PhysicalDevice physicalDevice,
+        Queue queue,
+        CommandPool commandPool,
+        VulkanDetilePass pass,
+        uint swizzleMode,
+        int bytesPerElement,
+        Format format,
+        uint layers)
+    {
+        var parameters = GnmTiling.GetDetileParams(swizzleMode, bytesPerElement, (int)Width, (int)Height);
+        if (!parameters.IsSupported || !VulkanDetilePass.Supports(parameters))
+        {
+            Console.Error.WriteLine(
+                $"[DETILE-SELFTEST] FAIL: mode {swizzleMode} bpp {bytesPerElement} not supported by the GPU pass.");
+            return;
+        }
+
+        // Whole-block tiled source with a per-layer-distinct deterministic pattern
+        // (so a slice mix-up is caught), the array slices packed contiguously.
+        var blocksHigh = ((int)Height + parameters.BlockHeight - 1) / parameters.BlockHeight;
+        var sliceTiledBytes = (int)((long)parameters.BlocksPerRow * blocksHigh * parameters.BlockBytes);
+        var sliceLinearBytes = (int)(Width * Height * bytesPerElement);
+        var tiled = new byte[sliceTiledBytes * layers];
+        var expected = new byte[sliceLinearBytes * layers];
+        for (var layer = 0; layer < layers; layer++)
+        {
+            for (var index = 0; index < sliceTiledBytes; index++)
+            {
+                tiled[layer * sliceTiledBytes + index] = (byte)((index * 31 + 7 + layer * 101) & 0xFF);
+            }
+
+            if (!GnmTiling.TryDetile(
+                    tiled.AsSpan(layer * sliceTiledBytes, sliceTiledBytes),
+                    expected.AsSpan(layer * sliceLinearBytes, sliceLinearBytes),
+                    swizzleMode, (int)Width, (int)Height, bytesPerElement))
+            {
+                Console.Error.WriteLine("[DETILE-SELFTEST] FAIL: CPU TryDetile declined.");
+                return;
+            }
+        }
+
+        var tiledBytes = tiled;
+        var label = $"mode{swizzleMode} {bytesPerElement}bpp x{layers}";
+
+        // Phase 1: the one-shot DetileIntoImage (submit + wait in place).
+        VerifyPhase(
+            vk, device, physicalDevice, queue, commandPool, expected, layers, format, $"DetileIntoImage {label}",
+            image => pass.DetileIntoImage(image, ImageLayout.Undefined, Width, Height, layers, tiledBytes, parameters));
+
+        // Phase 2: RecordDetile — the exact code path the render loop uses
+        // (record into a command buffer, submit, retire the transients).
+        VerifyPhase(
+            vk, device, physicalDevice, queue, commandPool, expected, layers, format, $"RecordDetile {label}",
+            image => RecordDetileAndSubmit(vk, device, queue, commandPool, pass, image, layers, tiledBytes, parameters));
+    }
+
+    private static void VerifyPhase(
+        Vk vk,
+        Device device,
+        PhysicalDevice physicalDevice,
+        Queue queue,
+        CommandPool commandPool,
+        byte[] expected,
+        uint layers,
+        Format format,
+        string label,
+        Func<Image, bool> detile)
+    {
+        var image = CreateImage(vk, device, physicalDevice, format, layers, out var imageMemory);
+        var readback = CreateHostBuffer(
+            vk, device, physicalDevice, (ulong)expected.Length, BufferUsageFlags.TransferDstBit, out var readbackMemory);
+        try
+        {
+            if (!detile(image))
+            {
+                Console.Error.WriteLine($"[DETILE-SELFTEST] {label} FAIL: declined.");
+                return;
+            }
+
+            CopyImageToBuffer(vk, device, queue, commandPool, image, readback, layers);
+
+            void* mapped;
+            Check(
+                vk.MapMemory(device, readbackMemory, 0, (ulong)expected.Length, 0, &mapped),
+                $"vkMapMemory(selftest {label})");
+            var actual = new Span<byte>(mapped, expected.Length);
+            var firstMismatch = -1;
+            for (var index = 0; index < expected.Length; index++)
+            {
+                if (actual[index] != expected[index])
+                {
+                    firstMismatch = index;
+                    break;
+                }
+            }
+
+            vk.UnmapMemory(device, readbackMemory);
+
+            Console.Error.WriteLine(firstMismatch < 0
+                ? $"[DETILE-SELFTEST] {label} PASS: {Width}x{Height}x{layers} matches CPU detile ({expected.Length} bytes)."
+                : $"[DETILE-SELFTEST] {label} FAIL: first mismatch at byte {firstMismatch}.");
+        }
+        finally
+        {
+            if (readback.Handle != 0)
+            {
+                vk.DestroyBuffer(device, readback, null);
+            }
+
+            if (readbackMemory.Handle != 0)
+            {
+                vk.FreeMemory(device, readbackMemory, null);
+            }
+
+            if (image.Handle != 0)
+            {
+                vk.DestroyImage(device, image, null);
+            }
+
+            if (imageMemory.Handle != 0)
+            {
+                vk.FreeMemory(device, imageMemory, null);
+            }
+        }
+    }
+
+    // Records the detile into a fresh command buffer, submits, waits, and retires
+    // the transients exactly as the presenter's batch does — verifying the render
+    // path's code (RecordDetile) without needing a game to trigger it.
+    private static bool RecordDetileAndSubmit(
+        Vk vk,
+        Device device,
+        Queue queue,
+        CommandPool commandPool,
+        VulkanDetilePass pass,
+        Image image,
+        uint layers,
+        ReadOnlySpan<byte> tiled,
+        in DetileParams parameters)
+    {
+        var commandBuffer = AllocateCommandBuffer(vk, device, commandPool);
+        var beginInfo = new CommandBufferBeginInfo
+        {
+            SType = StructureType.CommandBufferBeginInfo,
+            Flags = CommandBufferUsageFlags.OneTimeSubmitBit,
+        };
+        Check(vk.BeginCommandBuffer(commandBuffer, &beginInfo), "vkBeginCommandBuffer(selftest record)");
+
+        if (!pass.RecordDetile(
+                commandBuffer, image, ImageLayout.Undefined, Width, Height, layers, tiled, parameters, out var transients))
+        {
+            _ = vk.EndCommandBuffer(commandBuffer);
+            vk.FreeCommandBuffers(device, commandPool, 1, &commandBuffer);
+            return false;
+        }
+
+        Check(vk.EndCommandBuffer(commandBuffer), "vkEndCommandBuffer(selftest record)");
+
+        var fenceInfo = new FenceCreateInfo { SType = StructureType.FenceCreateInfo };
+        Check(vk.CreateFence(device, &fenceInfo, null, out var fence), "vkCreateFence(selftest record)");
+        try
+        {
+            var submitInfo = new SubmitInfo
+            {
+                SType = StructureType.SubmitInfo,
+                CommandBufferCount = 1,
+                PCommandBuffers = &commandBuffer,
+            };
+            Check(vk.QueueSubmit(queue, 1, &submitInfo, fence), "vkQueueSubmit(selftest record)");
+            Check(vk.WaitForFences(device, 1, &fence, true, ulong.MaxValue), "vkWaitForFences(selftest record)");
+        }
+        finally
+        {
+            vk.DestroyFence(device, fence, null);
+            vk.FreeCommandBuffers(device, commandPool, 1, &commandBuffer);
+            pass.Retire(transients);
+        }
+
+        return true;
+    }
+
+    private static Image CreateImage(
+        Vk vk,
+        Device device,
+        PhysicalDevice physicalDevice,
+        Format format,
+        uint layers,
+        out DeviceMemory memory)
+    {
+        var imageInfo = new ImageCreateInfo
+        {
+            SType = StructureType.ImageCreateInfo,
+            ImageType = ImageType.Type2D,
+            Format = format,
+            Extent = new Extent3D(Width, Height, 1),
+            MipLevels = 1,
+            ArrayLayers = layers,
+            Samples = SampleCountFlags.Count1Bit,
+            Tiling = ImageTiling.Optimal,
+            Usage = ImageUsageFlags.TransferDstBit | ImageUsageFlags.TransferSrcBit,
+            SharingMode = SharingMode.Exclusive,
+            InitialLayout = ImageLayout.Undefined,
+        };
+        Check(vk.CreateImage(device, &imageInfo, null, out var image), "vkCreateImage(selftest)");
+
+        vk.GetImageMemoryRequirements(device, image, out var requirements);
+        var allocateInfo = new MemoryAllocateInfo
+        {
+            SType = StructureType.MemoryAllocateInfo,
+            AllocationSize = requirements.Size,
+            MemoryTypeIndex = FindMemoryType(
+                vk,
+                physicalDevice,
+                requirements.MemoryTypeBits,
+                MemoryPropertyFlags.DeviceLocalBit),
+        };
+        Check(vk.AllocateMemory(device, &allocateInfo, null, out memory), "vkAllocateMemory(selftest image)");
+        Check(vk.BindImageMemory(device, image, memory, 0), "vkBindImageMemory(selftest)");
+        return image;
+    }
+
+    private static void CopyImageToBuffer(
+        Vk vk,
+        Device device,
+        Queue queue,
+        CommandPool commandPool,
+        Image image,
+        VkBuffer destination,
+        uint layers)
+    {
+        var commandBuffer = AllocateCommandBuffer(vk, device, commandPool);
+        var beginInfo = new CommandBufferBeginInfo
+        {
+            SType = StructureType.CommandBufferBeginInfo,
+            Flags = CommandBufferUsageFlags.OneTimeSubmitBit,
+        };
+        Check(vk.BeginCommandBuffer(commandBuffer, &beginInfo), "vkBeginCommandBuffer(selftest readback)");
+
+        // DetileIntoImage left the image ShaderReadOnly; move it to TransferSrc.
+        var toTransferSrc = new ImageMemoryBarrier
+        {
+            SType = StructureType.ImageMemoryBarrier,
+            SrcAccessMask = AccessFlags.ShaderReadBit,
+            DstAccessMask = AccessFlags.TransferReadBit,
+            OldLayout = ImageLayout.ShaderReadOnlyOptimal,
+            NewLayout = ImageLayout.TransferSrcOptimal,
+            SrcQueueFamilyIndex = Vk.QueueFamilyIgnored,
+            DstQueueFamilyIndex = Vk.QueueFamilyIgnored,
+            Image = image,
+            SubresourceRange = new ImageSubresourceRange(ImageAspectFlags.ColorBit, 0, 1, 0, layers),
+        };
+        vk.CmdPipelineBarrier(
+            commandBuffer,
+            PipelineStageFlags.FragmentShaderBit,
+            PipelineStageFlags.TransferBit,
+            0,
+            0,
+            null,
+            0,
+            null,
+            1,
+            &toTransferSrc);
+
+        // Layer-major readback: one copy pulls every array slice back into the
+        // buffer contiguously, matching the packed `expected` layout.
+        var region = new BufferImageCopy
+        {
+            BufferOffset = 0,
+            BufferRowLength = 0,
+            BufferImageHeight = 0,
+            ImageSubresource = new ImageSubresourceLayers(ImageAspectFlags.ColorBit, 0, 0, layers),
+            ImageOffset = default,
+            ImageExtent = new Extent3D(Width, Height, 1),
+        };
+        vk.CmdCopyImageToBuffer(
+            commandBuffer,
+            image,
+            ImageLayout.TransferSrcOptimal,
+            destination,
+            1,
+            &region);
+
+        Check(vk.EndCommandBuffer(commandBuffer), "vkEndCommandBuffer(selftest readback)");
+
+        var fenceInfo = new FenceCreateInfo { SType = StructureType.FenceCreateInfo };
+        Check(vk.CreateFence(device, &fenceInfo, null, out var fence), "vkCreateFence(selftest)");
+        try
+        {
+            var submitInfo = new SubmitInfo
+            {
+                SType = StructureType.SubmitInfo,
+                CommandBufferCount = 1,
+                PCommandBuffers = &commandBuffer,
+            };
+            Check(vk.QueueSubmit(queue, 1, &submitInfo, fence), "vkQueueSubmit(selftest readback)");
+            Check(
+                vk.WaitForFences(device, 1, &fence, true, ulong.MaxValue),
+                "vkWaitForFences(selftest readback)");
+        }
+        finally
+        {
+            vk.DestroyFence(device, fence, null);
+            vk.FreeCommandBuffers(device, commandPool, 1, &commandBuffer);
+        }
+    }
+
+    private static CommandPool CreateCommandPool(Vk vk, Device device, uint queueFamilyIndex)
+    {
+        var poolInfo = new CommandPoolCreateInfo
+        {
+            SType = StructureType.CommandPoolCreateInfo,
+            QueueFamilyIndex = queueFamilyIndex,
+            Flags = CommandPoolCreateFlags.ResetCommandBufferBit,
+        };
+        Check(vk.CreateCommandPool(device, &poolInfo, null, out var pool), "vkCreateCommandPool(selftest)");
+        return pool;
+    }
+
+    private static CommandBuffer AllocateCommandBuffer(Vk vk, Device device, CommandPool commandPool)
+    {
+        var allocateInfo = new CommandBufferAllocateInfo
+        {
+            SType = StructureType.CommandBufferAllocateInfo,
+            CommandPool = commandPool,
+            Level = CommandBufferLevel.Primary,
+            CommandBufferCount = 1,
+        };
+        Check(
+            vk.AllocateCommandBuffers(device, &allocateInfo, out var commandBuffer),
+            "vkAllocateCommandBuffers(selftest)");
+        return commandBuffer;
+    }
+
+    private static VkBuffer CreateHostBuffer(
+        Vk vk,
+        Device device,
+        PhysicalDevice physicalDevice,
+        ulong size,
+        BufferUsageFlags usage,
+        out DeviceMemory memory)
+    {
+        var bufferInfo = new BufferCreateInfo
+        {
+            SType = StructureType.BufferCreateInfo,
+            Size = size,
+            Usage = usage,
+            SharingMode = SharingMode.Exclusive,
+        };
+        Check(vk.CreateBuffer(device, &bufferInfo, null, out var buffer), "vkCreateBuffer(selftest)");
+
+        vk.GetBufferMemoryRequirements(device, buffer, out var requirements);
+        var allocateInfo = new MemoryAllocateInfo
+        {
+            SType = StructureType.MemoryAllocateInfo,
+            AllocationSize = requirements.Size,
+            MemoryTypeIndex = FindMemoryType(
+                vk,
+                physicalDevice,
+                requirements.MemoryTypeBits,
+                MemoryPropertyFlags.HostVisibleBit | MemoryPropertyFlags.HostCoherentBit),
+        };
+        Check(vk.AllocateMemory(device, &allocateInfo, null, out memory), "vkAllocateMemory(selftest buffer)");
+        Check(vk.BindBufferMemory(device, buffer, memory, 0), "vkBindBufferMemory(selftest)");
+        return buffer;
+    }
+
+    private static uint FindMemoryType(
+        Vk vk,
+        PhysicalDevice physicalDevice,
+        uint typeBits,
+        MemoryPropertyFlags requiredFlags)
+    {
+        vk.GetPhysicalDeviceMemoryProperties(physicalDevice, out var properties);
+        var memoryTypes = &properties.MemoryTypes.Element0;
+        for (uint index = 0; index < properties.MemoryTypeCount; index++)
+        {
+            if ((typeBits & (1u << (int)index)) != 0 &&
+                (memoryTypes[index].PropertyFlags & requiredFlags) == requiredFlags)
+            {
+                return index;
+            }
+        }
+
+        throw new InvalidOperationException("No compatible Vulkan memory type for the detile self-test.");
+    }
+
+    private static void Check(Result result, string operation)
+    {
+        if (result != Result.Success)
+        {
+            throw new InvalidOperationException($"{operation} failed: {result}");
+        }
+    }
+}

src/SharpEmu.Libs/VideoOut/VulkanHostBufferPool.cs

@@ -18,6 +18,7 @@ internal readonly record struct VulkanHostBufferAllocation(
 
 internal sealed class VulkanHostBufferPool : IDisposable
 {
+    private readonly object _gate = new();
     private readonly Dictionary<VulkanHostBufferPoolKey, Stack<VulkanHostBufferAllocation>>
         _available = [];
     private readonly Dictionary<ulong, VulkanHostBufferAllocation> _allocations = [];
@@ -40,16 +41,19 @@ internal sealed class VulkanHostBufferPool : IDisposable
         VulkanHostBufferPoolKey key,
         out VulkanHostBufferAllocation allocation)
     {
-        if (!_available.TryGetValue(key, out var available) ||
-            !available.TryPop(out allocation))
+        lock (_gate)
         {
-            allocation = default;
-            return false;
-        }
+            if (!_available.TryGetValue(key, out var available) ||
+                !available.TryPop(out allocation))
+            {
+                allocation = default;
+                return false;
+            }
 
-        _cachedHandles.Remove(allocation.Buffer.Handle);
-        CachedBytes -= allocation.Key.Capacity;
-        return true;
+            _cachedHandles.Remove(allocation.Buffer.Handle);
+            CachedBytes -= allocation.Key.Capacity;
+            return true;
+        }
     }
 
     public void Register(VulkanHostBufferAllocation allocation)
@@ -59,51 +63,79 @@ internal sealed class VulkanHostBufferPool : IDisposable
             throw new ArgumentException("A pooled buffer must have a valid handle.", nameof(allocation));
         }
 
-        _allocations.Add(allocation.Buffer.Handle, allocation);
+        lock (_gate)
+        {
+            _allocations.Add(allocation.Buffer.Handle, allocation);
+        }
     }
 
     public bool Return(VkBuffer buffer, DeviceMemory memory)
     {
-        if (!_allocations.TryGetValue(buffer.Handle, out var allocation) ||
-            allocation.Memory.Handle != memory.Handle)
+        VulkanHostBufferAllocation? toDestroy = null;
+        lock (_gate)
         {
-            return false;
+            if (!_allocations.TryGetValue(buffer.Handle, out var allocation) ||
+                allocation.Memory.Handle != memory.Handle)
+            {
+                return false;
+            }
+
+            if (!_cachedHandles.Add(buffer.Handle))
+            {
+                return true;
+            }
+
+            if (allocation.Key.Capacity > MaximumCachedBytes - CachedBytes)
+            {
+                _cachedHandles.Remove(buffer.Handle);
+                _allocations.Remove(buffer.Handle);
+                toDestroy = allocation;
+            }
+            else
+            {
+                if (!_available.TryGetValue(allocation.Key, out var available))
+                {
+                    available = [];
+                    _available.Add(allocation.Key, available);
+                }
+
+                available.Push(allocation);
+                CachedBytes += allocation.Key.Capacity;
+            }
         }
 
-        if (!_cachedHandles.Add(buffer.Handle))
-        {
-            return true;
+        // Destroy outside the lock — _destroy calls into Vulkan which may
+        // grab device-level locks, and holding _gate while doing so risks
+        // a lock-ordering deadlock with a thread that holds the device lock
+        // and is waiting on _gate.
+if (toDestroy is { } td)
+{
+    _destroy(td);
+
         }
 
-        if (allocation.Key.Capacity > MaximumCachedBytes - CachedBytes)
-        {
-            _cachedHandles.Remove(buffer.Handle);
-            _allocations.Remove(buffer.Handle);
-            _destroy(allocation);
-            return true;
-        }
-
-        if (!_available.TryGetValue(allocation.Key, out var available))
-        {
-            available = [];
-            _available.Add(allocation.Key, available);
-        }
-
-        available.Push(allocation);
-        CachedBytes += allocation.Key.Capacity;
         return true;
     }
 
     public void Dispose()
     {
-        foreach (var allocation in _allocations.Values)
+        // Snapshot under the lock, destroy outside — _destroy calls into
+        // Vulkan which may grab device-level locks; holding _gate while
+        // doing so risks a lock-ordering deadlock with any thread that
+        // acquires the device lock first and then waits on _gate.
+        List<VulkanHostBufferAllocation> toDestroy;
+        lock (_gate)
+        {
+            toDestroy = new List<VulkanHostBufferAllocation>(_allocations.Values);
+            _allocations.Clear();
+            _available.Clear();
+            _cachedHandles.Clear();
+            CachedBytes = 0;
+        }
+
+        foreach (var allocation in toDestroy)
         {
             _destroy(allocation);
         }
-
-        _allocations.Clear();
-        _available.Clear();
-        _cachedHandles.Clear();
-        CachedBytes = 0;
     }
 }

src/SharpEmu.Libs/Voice/VoiceQoSExports.cs

@@ -16,4 +16,37 @@ public static class VoiceQoSExports
     {
         return ctx.SetReturn(0);
     }
+
+    [SysAbiExport(
+        Nid = "Trpt2QBZHCI",
+        ExportName = "sceVoiceQoSGetStatus",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceVoiceQoS")]
+    public static int VoiceQoSGetStatus(CpuContext ctx)
+    {
+        // Returns 0 to indicate connected state (voice available)
+        return ctx.SetReturn(0);
+    }
+
+    [SysAbiExport(
+        Nid = "FuXenJLkk-c",
+        ExportName = "sceVoiceQoSTerminate",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceVoiceQoS")]
+    public static int VoiceQoSTerminate(CpuContext ctx)
+    {
+        // No-op: cleanup is handled by emulator shutdown
+        return ctx.SetReturn(0);
+    }
+
+    [SysAbiExport(
+        Nid = "+0lOiPZjnBI",
+        ExportName = "sceVoiceQoSSetMode",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceVoiceQoS")]
+    public static int VoiceQoSSetMode(CpuContext ctx)
+    {
+        // No-op: mode configuration is not emulated
+        return ctx.SetReturn(0);
+    }
 }

src/SharpEmu.ShaderCompiler.Metal/Gen5MslTranslator.cs

@@ -74,6 +74,7 @@ public static partial class Gen5MslTranslator
         int pixelRenderTargetSlot = 0,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1) =>
         TryCompilePixelShader(
             state,
@@ -87,6 +88,7 @@ public static partial class Gen5MslTranslator
             initialScalarBufferIndex,
             pixelInputEnable,
             pixelInputAddress,
+            pixelInputCntl,
             storageBufferOffsetAlignment);
 
     public static bool TryCompilePixelShader(
@@ -101,6 +103,7 @@ public static partial class Gen5MslTranslator
         int initialScalarBufferIndex = -1,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1)
     {
         shader = default!;
@@ -161,7 +164,8 @@ public static partial class Gen5MslTranslator
             pixelOutputBindings: outputs,
             imageBindingBase: imageBindingBase,
             pixelInputEnable: pixelInputEnable,
-            pixelInputAddress: pixelInputAddress);
+            pixelInputAddress: pixelInputAddress,
+            pixelInputCntl: pixelInputCntl);
         return context.TryCompile(out shader, out error);
     }
 
@@ -254,6 +258,7 @@ public static partial class Gen5MslTranslator
         private readonly int _imageBindingBase;
         private readonly uint _pixelInputEnable;
         private readonly uint _pixelInputAddress;
+        private readonly uint[] _pixelInputCntl;
         private readonly Dictionary<uint, int> _imageBindingByPc = [];
         private readonly Dictionary<uint, int> _bufferBindingByPc = [];
         private readonly List<(bool IsStorage, string ComponentKind)> _imageKinds = [];
@@ -294,12 +299,20 @@ public static partial class Gen5MslTranslator
             int imageBindingBase = 0,
             uint pixelInputEnable = 0,
             uint pixelInputAddress = 0,
+            IReadOnlyList<uint>? pixelInputCntl = null,
             int requiredVertexOutputCount = 0)
         {
             _pixelOutputBindings = pixelOutputBindings ?? [];
             _imageBindingBase = imageBindingBase;
             _pixelInputEnable = pixelInputEnable;
             _pixelInputAddress = pixelInputAddress;
+            _pixelInputCntl = new uint[32];
+            for (uint i = 0; i < 32u; i++)
+            {
+                _pixelInputCntl[i] = pixelInputCntl is not null && i < (uint)pixelInputCntl.Count
+                    ? pixelInputCntl[(int)i]
+                    : i;
+            }
             _requiredVertexOutputCount = requiredVertexOutputCount;
             _stage = stage;
             _state = state;
@@ -592,7 +605,13 @@ public static partial class Gen5MslTranslator
                 source.AppendLine("    float4 sharpemu_frag_coord [[position]];");
                 foreach (var attribute in _pixelAttributes)
                 {
-                    source.AppendLine($"    float4 attr{attribute} [[user(locn{attribute})]];");
+                    var cntl = attribute < (uint)_pixelInputCntl.Length
+                        ? _pixelInputCntl[attribute]
+                        : attribute;
+                    var location = cntl & 0x1Fu;
+                    var flat = (cntl & 0x400u) != 0 ? ", flat" : string.Empty;
+                    source.AppendLine(
+                        $"    float4 attr{attribute} [[user(locn{location}){flat}]];");
                 }
 
                 source.AppendLine("};");

src/SharpEmu.ShaderCompiler.Metal/MslFixedShaders.cs

@@ -76,6 +76,14 @@ public static class MslFixedShaders
     /// </summary>
     public static string CreateDepthOnlyFragment() => MslTemplates.Render("depth_only_fragment");
 
+    /// <summary>
+    /// Compute kernel that deswizzles one RDNA2 exact-XOR tiled surface (swizzle
+    /// modes 5/9/24/27) at 4 bytes/element into a linear output buffer — the MSL
+    /// twin of <c>SpirvFixedShaders.CreateDetileCompute</c>. Entry point
+    /// "detile_cs"; buffers 0=tiled, 1=xTerm, 2=yTerm, 3=out, 4=DetileParams.
+    /// </summary>
+    public static string CreateDetileCompute() => MslTemplates.Render("detile_compute");
+
     private static string Format(float value) =>
         value.ToString("0.0######", CultureInfo.InvariantCulture) + "f";
 }

src/SharpEmu.ShaderCompiler.Metal/Templates/detile_compute.msl

@@ -0,0 +1,70 @@
+#include <metal_stdlib>
+
+using namespace metal;
+
+// GPU deswizzle for RDNA2 tiled surfaces at 4/8/16 bytes/element — the MSL twin of
+// SpirvFixedShaders.CreateDetileCompute and a direct mirror of
+// GnmTiling.GetDetileParams. Handles both supported equation families and both
+// plain 2D textures and array textures (one grid-Z layer per slice; the caller
+// packs the tiled slices contiguously). width/height are ELEMENT dims (for
+// block-compressed formats a 4x4 block is one element); each element spans
+// uintsPerElement = bpp/4 words, and the X grid is widened by that factor so each
+// thread copies one word (elemX = gidX / upe, word = gidX % upe):
+//   inBlock = equation == 1  // BlockTable, modes 1/4/8
+//             ? blockTable[(y % blockHeight) * blockWidth + (elemX % blockWidth)]
+//             : xTerm[elemX & xMask] ^ yTerm[y & yMask];   // ExactXor 5/9/24/27
+//   srcElem = z * srcSliceElements
+//           + (y / blockHeight * blocksPerRow + elemX / blockWidth) * blockElements
+//           + inBlock;
+//   dstElem = z * width * height + y * width + elemX;
+//   out[dstElem * upe + word] = tiled[srcElem * upe + word];
+// Term tables hold ELEMENT offsets. buffer(1) carries xTerm (ExactXor) OR the
+// block table (BlockTable); the two equations index different-sized buffers, so
+// exactly one branch runs. 1/2 bpp are sub-word and stay on the CPU.
+struct DetileParams
+{
+    uint width;
+    uint height;
+    uint blockWidth;
+    uint blockHeight;
+    uint blockElements;
+    uint blocksPerRow;
+    uint xMask;
+    uint yMask;
+    uint srcSliceElements;
+    uint equation;
+    uint uintsPerElement;
+};
+
+kernel void detile_cs(
+    device const uint* tiled        [[buffer(0)]],
+    device const uint* xTermOrTable [[buffer(1)]],
+    device const uint* yTerm        [[buffer(2)]],
+    device uint* outLinear          [[buffer(3)]],
+    constant DetileParams& params   [[buffer(4)]],
+    uint3 gid                       [[thread_position_in_grid]])
+{
+    uint elemX = gid.x / params.uintsPerElement;
+    uint word = gid.x - elemX * params.uintsPerElement;
+    if (elemX >= params.width || gid.y >= params.height)
+    {
+        return;
+    }
+
+    uint blockIndex = (gid.y / params.blockHeight) * params.blocksPerRow + (elemX / params.blockWidth);
+    uint off;
+    if (params.equation != 0u)
+    {
+        uint inX = elemX - (elemX / params.blockWidth) * params.blockWidth;
+        uint inY = gid.y - (gid.y / params.blockHeight) * params.blockHeight;
+        off = xTermOrTable[inY * params.blockWidth + inX];
+    }
+    else
+    {
+        off = xTermOrTable[elemX & params.xMask] ^ yTerm[gid.y & params.yMask];
+    }
+
+    uint srcElem = gid.z * params.srcSliceElements + blockIndex * params.blockElements + off;
+    uint dstElem = gid.z * params.width * params.height + gid.y * params.width + elemX;
+    outLinear[dstElem * params.uintsPerElement + word] = tiled[srcElem * params.uintsPerElement + word];
+}

src/SharpEmu.ShaderCompiler.Vulkan/Gen5SpirvTranslator.cs

@@ -31,6 +31,7 @@ public static partial class Gen5SpirvTranslator
         int pixelRenderTargetSlot = 0,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1) =>
         TryCompilePixelShader(
             state,
@@ -44,6 +45,7 @@ public static partial class Gen5SpirvTranslator
             initialScalarBufferIndex,
             pixelInputEnable,
             pixelInputAddress,
+            pixelInputCntl,
             storageBufferOffsetAlignment);
 
     public static bool TryCompilePixelShader(
@@ -58,6 +60,7 @@ public static partial class Gen5SpirvTranslator
         int initialScalarBufferIndex = -1,
         uint pixelInputEnable = 0,
         uint pixelInputAddress = 0,
+        IReadOnlyList<uint>? pixelInputCntl = null,
         ulong storageBufferOffsetAlignment = 1)
     {
         if (outputs.Count > 8 || outputs.Any(output => output.GuestSlot > 7))
@@ -99,6 +102,7 @@ public static partial class Gen5SpirvTranslator
             initialScalarBufferIndex,
             pixelInputEnable: pixelInputEnable,
             pixelInputAddress: pixelInputAddress,
+            pixelInputCntl: pixelInputCntl,
             storageBufferOffsetAlignment: storageBufferOffsetAlignment);
         return context.TryCompile(out shader, out error);
     }
@@ -231,6 +235,7 @@ public static partial class Gen5SpirvTranslator
         private readonly int _initialScalarBufferIndex;
         private readonly uint _pixelInputEnable;
         private readonly uint _pixelInputAddress;
+        private readonly uint[] _pixelInputCntl;
         private readonly ulong _storageBufferOffsetAlignment;
         private readonly List<uint> _interfaces = [];
         private readonly Dictionary<uint, uint> _pixelInputs = [];
@@ -314,7 +319,8 @@ public static partial class Gen5SpirvTranslator
             uint VectorType,
             ImageComponentKind ComponentKind,
             bool IsStorage,
-            bool Arrayed);
+            bool Arrayed,
+            SpirvImageDim Dimension);
 
         private readonly record struct SpirvVertexInput(
             uint Variable,
@@ -342,6 +348,7 @@ public static partial class Gen5SpirvTranslator
             int initialScalarBufferIndex,
             uint pixelInputEnable = 0,
             uint pixelInputAddress = 0,
+            IReadOnlyList<uint>? pixelInputCntl = null,
             int requiredVertexOutputCount = 0,
             uint waveLaneCount = 32,
             ulong storageBufferOffsetAlignment = 1)
@@ -367,6 +374,13 @@ public static partial class Gen5SpirvTranslator
             _initialScalarBufferIndex = initialScalarBufferIndex;
             _pixelInputEnable = pixelInputEnable;
             _pixelInputAddress = pixelInputAddress;
+            _pixelInputCntl = new uint[32];
+            for (uint i = 0; i < 32u; i++)
+            {
+                _pixelInputCntl[i] = pixelInputCntl is not null && i < (uint)pixelInputCntl.Count
+                    ? pixelInputCntl[(int)i]
+                    : i;
+            }
             if (storageBufferOffsetAlignment == 0 ||
                 (storageBufferOffsetAlignment & (storageBufferOffsetAlignment - 1)) != 0 ||
                 storageBufferOffsetAlignment > uint.MaxValue)
@@ -1001,11 +1015,15 @@ public static partial class Gen5SpirvTranslator
                         SpirvCapability.StorageImageExtendedFormats);
                 }
 
-                var isArrayed = !isStorage &&
+                var dimension = binding.Control.Dimension == 2
+                    ? SpirvImageDim.Dim3D
+                    : SpirvImageDim.Dim2D;
+                var isArrayed = dimension != SpirvImageDim.Dim3D &&
+                    !isStorage &&
                     Gen5ShaderTranslator.IsArrayedImageBinding(binding);
                 var imageType = _module.TypeImage(
                     componentType,
-                    SpirvImageDim.Dim2D,
+                    dimension,
                     depth: false,
                     arrayed: isArrayed,
                     multisampled: false,
@@ -1035,7 +1053,8 @@ public static partial class Gen5SpirvTranslator
                         _module.TypeVector(componentType, 4),
                         componentKind,
                         isStorage,
-                        isArrayed));
+                        isArrayed,
+                        dimension));
                 _interfaces.Add(variable);
             }
         }
@@ -1236,7 +1255,18 @@ public static partial class Gen5SpirvTranslator
                     var variable = _module.AddGlobalVariable(
                         inputVec4Pointer,
                         SpirvStorageClass.Input);
-                    _module.AddDecoration(variable, SpirvDecoration.Location, attribute);
+                    // VINTRP ATTR selects the PS input slot. SPI_PS_INPUT_CNTL
+                    // maps that slot to a VS parameter export location.
+                    var cntl = attribute < (uint)_pixelInputCntl.Length
+                        ? _pixelInputCntl[attribute]
+                        : attribute;
+                    var location = cntl & 0x1Fu;
+                    _module.AddDecoration(variable, SpirvDecoration.Location, location);
+                    if ((cntl & 0x400u) != 0)
+                    {
+                        _module.AddDecoration(variable, SpirvDecoration.Flat);
+                    }
+
                     _pixelInputs.Add(attribute, variable);
                     _interfaces.Add(variable);
                 }
@@ -2259,20 +2289,39 @@ public static partial class Gen5SpirvTranslator
                 return false;
             }
 
+            var memoryOpcode = control.UsesFlatAddress
+                ? "Global" + instruction.Opcode["Flat".Length..]
+                : instruction.Opcode;
+            var vectorByteAddress = LoadV(control.VectorAddress);
+            if (control.UsesFlatAddress)
+            {
+                // FLAT instructions carry the complete 64-bit guest address
+                // in a VGPR pair. The scalar evaluator captures the buffer
+                // rooted at the inferred SGPR pair, so convert the low address
+                // dword back to a byte offset inside that binding. Subtraction
+                // modulo 2^32 also handles an address addition that carried
+                // into the high dword, while the bounded binding prevents an
+                // unrelated pointer from escaping into host storage.
+                vectorByteAddress = _module.AddInstruction(
+                    SpirvOp.ISub,
+                    _uintType,
+                    vectorByteAddress,
+                    LoadS(control.ScalarAddress));
+            }
             var byteAddress = IAdd(
-                LoadV(control.VectorAddress),
+                vectorByteAddress,
                 UInt(unchecked((uint)control.OffsetBytes)));
             byteAddress = ApplyGuestBufferByteBias(bindingIndex, byteAddress);
             var dwordAddress = ShiftRightLogical(byteAddress, UInt(2));
 
-            if (instruction.Opcode is "GlobalAtomicAdd" or "GlobalAtomicUMax")
+            if (memoryOpcode is "GlobalAtomicAdd" or "GlobalAtomicUMax")
             {
                 EmitExecConditional(() =>
                 {
                     EmitConditional(IsBufferWordInRange(bindingIndex, dwordAddress), () =>
                     {
                         var original = _module.AddInstruction(
-                            instruction.Opcode == "GlobalAtomicAdd"
+                            memoryOpcode == "GlobalAtomicAdd"
                                 ? SpirvOp.AtomicIAdd
                                 : SpirvOp.AtomicUMax,
                             _uintType,
@@ -2289,12 +2338,12 @@ public static partial class Gen5SpirvTranslator
                 return true;
             }
 
-            if (instruction.Opcode.StartsWith("GlobalStore", StringComparison.Ordinal))
+            if (memoryOpcode.StartsWith("GlobalStore", StringComparison.Ordinal))
             {
                 EmitExecConditional(() =>
                 {
                     if (TryGetSubdwordStoreInfo(
-                            instruction.Opcode,
+                            memoryOpcode,
                             out var byteCount,
                             out var sourceShift))
                     {
@@ -2324,7 +2373,7 @@ public static partial class Gen5SpirvTranslator
             }
 
             if (TryGetSubdwordLoadInfo(
-                    instruction.Opcode,
+                    memoryOpcode,
                     out var loadByteCount,
                     out var signExtend,
                     out var d16,
@@ -3268,6 +3317,7 @@ public static partial class Gen5SpirvTranslator
             var imageObject = Load(resource.ObjectType, resource.Variable);
             if (instruction.Opcode == "ImageGetResinfo")
             {
+                var sizeComponentCount = ImageCoordinateComponentCount(resource);
                 var queryImage = resource.IsStorage
                     ? imageObject
                     : _module.AddInstruction(
@@ -3278,7 +3328,7 @@ public static partial class Gen5SpirvTranslator
                     resource.IsStorage
                         ? SpirvOp.ImageQuerySize
                         : SpirvOp.ImageQuerySizeLod,
-                    _module.TypeVector(_intType, 2),
+                    _module.TypeVector(_intType, sizeComponentCount),
                     resource.IsStorage
                         ? [queryImage]
                         : [queryImage, UInt(0)]);
@@ -3291,7 +3341,7 @@ public static partial class Gen5SpirvTranslator
                     }
 
                     uint value;
-                    if (component < 2)
+                    if (component < sizeComponentCount)
                     {
                         var signedValue = _module.AddInstruction(
                             SpirvOp.CompositeExtract,
@@ -3319,7 +3369,12 @@ public static partial class Gen5SpirvTranslator
                     return false;
                 }
 
-                var coordinates = BuildIntegerCoordinates(image, 0);
+                var coordinateComponentCount =
+                    ImageCoordinateComponentCount(resource);
+                var coordinates = BuildIntegerCoordinates(
+                    image,
+                    0,
+                    coordinateComponentCount);
                 var components = new uint[4];
                 uint sourceIndex = 0;
                 for (var component = 0; component < components.Length; component++)
@@ -3355,13 +3410,14 @@ public static partial class Gen5SpirvTranslator
                     components);
                 var imageSize = _module.AddInstruction(
                     SpirvOp.ImageQuerySize,
-                    _module.TypeVector(_intType, 2),
+                    _module.TypeVector(_intType, coordinateComponentCount),
                     imageObject);
                 EmitBoundsCheckedImageWrite(
                     coordinates,
                     imageSize,
                     imageObject,
-                    texel);
+                    texel,
+                    coordinateComponentCount);
 
                 return true;
             }
@@ -3382,14 +3438,17 @@ public static partial class Gen5SpirvTranslator
                 }
 
                 var signed = resource.ComponentKind == ImageComponentKind.Sint;
+                var coordinateComponentCount =
+                    ImageCoordinateComponentCount(resource);
                 var atomicImageSize = _module.AddInstruction(
                     SpirvOp.ImageQuerySize,
-                    _module.TypeVector(_intType, 2),
+                    _module.TypeVector(_intType, coordinateComponentCount),
                     imageObject);
                 var coordinates = BuildClampedIntegerCoordinates(
                     image,
                     0,
-                    atomicImageSize);
+                    atomicImageSize,
+                    coordinateComponentCount);
                 EmitExecConditional(() =>
                 {
                     var pointer = _module.AddInstruction(
@@ -3433,14 +3492,17 @@ public static partial class Gen5SpirvTranslator
             {
                 if (resource.IsStorage)
                 {
+                    var coordinateComponentCount =
+                        ImageCoordinateComponentCount(resource);
                     var imageSize = _module.AddInstruction(
                         SpirvOp.ImageQuerySize,
-                        _module.TypeVector(_intType, 2),
+                        _module.TypeVector(_intType, coordinateComponentCount),
                         imageObject);
                     var coordinates = BuildClampedIntegerCoordinates(
                         image,
                         0,
-                        imageSize);
+                        imageSize,
+                        coordinateComponentCount);
                     sampled = _module.AddInstruction(
                         SpirvOp.ImageRead,
                         resource.VectorType,
@@ -3454,15 +3516,18 @@ public static partial class Gen5SpirvTranslator
                         SpirvOp.Image,
                         resource.ImageType,
                         imageObject);
+                    var coordinateComponentCount =
+                        ImageCoordinateComponentCount(resource);
                     var imageSize = _module.AddInstruction(
                         SpirvOp.ImageQuerySizeLod,
-                        _module.TypeVector(_intType, 2),
+                        _module.TypeVector(_intType, coordinateComponentCount),
                         fetchedImage,
                         UInt(mipLevel));
                     var coordinates = BuildClampedIntegerCoordinates(
                         image,
                         0,
-                        imageSize);
+                        imageSize,
+                        coordinateComponentCount);
                     sampled = _module.AddInstruction(
                         SpirvOp.ImageFetch,
                         resource.VectorType,
@@ -3494,12 +3559,19 @@ public static partial class Gen5SpirvTranslator
                 // lowering treated SAMPLE_D as body-first and consequently
                 // sampled gradients as coordinates in every captured
                 // derivative operation.
+                var spatialComponentCount =
+                    ImageSpatialComponentCount(resource);
+                var coordinateComponentCount =
+                    ImageCoordinateComponentCount(resource);
                 var addressCursor = 0;
                 var offset = 0u;
                 if (hasOffset)
                 {
                     addressCursor = AlignFullImageAddress(image, addressCursor);
-                    offset = BuildImageOffset(image, addressCursor);
+                    offset = BuildImageOffset(
+                        image,
+                        addressCursor,
+                        spatialComponentCount);
                     addressCursor += ImageFullAddressSlots(image);
                 }
 
@@ -3523,26 +3595,33 @@ public static partial class Gen5SpirvTranslator
                 }
 
                 var gradientX = hasGradients
-                    ? BuildFloatCoordinates(image, addressCursor)
+                    ? BuildFloatCoordinates(
+                        image,
+                        addressCursor,
+                        spatialComponentCount)
                     : 0u;
                 var gradientY = hasGradients
-                    ? BuildFloatCoordinates(image, addressCursor + 2)
+                    ? BuildFloatCoordinates(
+                        image,
+                        addressCursor + (int)spatialComponentCount,
+                        spatialComponentCount)
                     : 0u;
                 if (hasGradients)
                 {
-                    addressCursor += 4;
+                    addressCursor += checked((int)(spatialComponentCount * 2));
                 }
 
-                var coordinates = resource.Arrayed
-                    ? BuildFloatArrayCoordinates(image, addressCursor)
-                    : BuildFloatCoordinates(image, addressCursor);
+                var coordinates = BuildFloatCoordinates(
+                    image,
+                    addressCursor,
+                    coordinateComponentCount);
                 var explicitLod = hasGradients || hasZeroLod || hasLod;
                 var lod = hasZeroLod
                     ? Float(0)
                     : hasLod
                         ? LoadImageFloatAddress(
                             image,
-                            addressCursor + (resource.Arrayed ? 3 : 2))
+                            addressCursor + (int)coordinateComponentCount)
                         : lodOrBias;
                 if (hasOffset)
                 {
@@ -3608,11 +3687,18 @@ public static partial class Gen5SpirvTranslator
                     instruction.Opcode.EndsWith("O", StringComparison.Ordinal);
                 var hasCompare =
                     instruction.Opcode.Contains("Gather4C", StringComparison.Ordinal);
+                var spatialComponentCount =
+                    ImageSpatialComponentCount(resource);
+                var coordinateComponentCount =
+                    ImageCoordinateComponentCount(resource);
                 var addressCursor = 0;
                 var offset = 0u;
                 if (hasOffset)
                 {
-                    offset = BuildImageOffset(image, addressCursor);
+                    offset = BuildImageOffset(
+                        image,
+                        addressCursor,
+                        spatialComponentCount);
                     addressCursor += ImageFullAddressSlots(image);
                 }
 
@@ -3627,9 +3713,10 @@ public static partial class Gen5SpirvTranslator
                     addressCursor += ImageFullAddressSlots(image);
                 }
 
-                var coordinates = resource.Arrayed
-                    ? BuildFloatArrayCoordinates(image, addressCursor)
-                    : BuildFloatCoordinates(image, addressCursor);
+                var coordinates = BuildFloatCoordinates(
+                    image,
+                    addressCursor,
+                    coordinateComponentCount);
                 var operands = new List<uint>
                 {
                     imageObject,
@@ -3822,28 +3909,31 @@ public static partial class Gen5SpirvTranslator
                 });
         }
 
-        private uint BuildFloatCoordinates(Gen5ImageControl image, int start)
-        {
-            var x = LoadImageFloatAddress(image, start);
-            var y = LoadImageFloatAddress(image, start + 1);
-            return _module.AddInstruction(
-                SpirvOp.CompositeConstruct,
-                _vec2Type,
-                x,
-                y);
-        }
+        private static uint ImageSpatialComponentCount(
+            SpirvImageResource resource) =>
+            resource.Dimension == SpirvImageDim.Dim3D ? 3u : 2u;
 
-        private uint BuildFloatArrayCoordinates(Gen5ImageControl image, int start)
+        private static uint ImageCoordinateComponentCount(
+            SpirvImageResource resource) =>
+            resource.Arrayed ? 3u : ImageSpatialComponentCount(resource);
+
+        private uint BuildFloatCoordinates(
+            Gen5ImageControl image,
+            int start,
+            uint componentCount)
         {
-            var x = LoadImageFloatAddress(image, start);
-            var y = LoadImageFloatAddress(image, start + 1);
-            var slice = LoadImageFloatAddress(image, start + 2);
+            var components = new uint[checked((int)componentCount)];
+            for (var component = 0; component < components.Length; component++)
+            {
+                components[component] = LoadImageFloatAddress(
+                    image,
+                    start + component);
+            }
+
             return _module.AddInstruction(
                 SpirvOp.CompositeConstruct,
-                _vec3Type,
-                x,
-                y,
-                slice);
+                _module.TypeVector(_floatType, componentCount),
+                components);
         }
 
         private static int ImageAddressRegister(
@@ -3948,47 +4038,49 @@ public static partial class Gen5SpirvTranslator
                 ShiftLeftLogical(BitwiseAnd(high, UInt(0xFFFF)), UInt(16)));
         }
 
-        private uint BuildIntegerCoordinates(Gen5ImageControl image, int start)
+        private uint BuildIntegerCoordinates(
+            Gen5ImageControl image,
+            int start,
+            uint componentCount)
         {
-            var ivec2 = _module.TypeVector(_intType, 2);
-            var x = Bitcast(_intType, LoadImageIntegerAddress(image, start));
-            var y = Bitcast(_intType, LoadImageIntegerAddress(image, start + 1));
+            var components = new uint[checked((int)componentCount)];
+            for (var component = 0; component < components.Length; component++)
+            {
+                components[component] = Bitcast(
+                    _intType,
+                    LoadImageIntegerAddress(image, start + component));
+            }
+
             return _module.AddInstruction(
                 SpirvOp.CompositeConstruct,
-                ivec2,
-                x,
-                y);
+                _module.TypeVector(_intType, componentCount),
+                components);
         }
 
         private uint BuildClampedIntegerCoordinates(
             Gen5ImageControl image,
             int start,
-            uint imageSize)
+            uint imageSize,
+            uint componentCount)
         {
-            var ivec2 = _module.TypeVector(_intType, 2);
-            var x = ClampSignedCoordinate(
-                Bitcast(
-                    _intType,
-                    LoadImageIntegerAddress(image, start)),
-                _module.AddInstruction(
-                    SpirvOp.CompositeExtract,
-                    _intType,
-                    imageSize,
-                    0));
-            var y = ClampSignedCoordinate(
-                Bitcast(
-                    _intType,
-                    LoadImageIntegerAddress(image, start + 1)),
-                _module.AddInstruction(
-                    SpirvOp.CompositeExtract,
-                    _intType,
-                    imageSize,
-                    1));
+            var components = new uint[checked((int)componentCount)];
+            for (var component = 0; component < components.Length; component++)
+            {
+                components[component] = ClampSignedCoordinate(
+                    Bitcast(
+                        _intType,
+                        LoadImageIntegerAddress(image, start + component)),
+                    _module.AddInstruction(
+                        SpirvOp.CompositeExtract,
+                        _intType,
+                        imageSize,
+                        (uint)component));
+            }
+
             return _module.AddInstruction(
                 SpirvOp.CompositeConstruct,
-                ivec2,
-                x,
-                y);
+                _module.TypeVector(_intType, componentCount),
+                components);
         }
 
         private uint ClampSignedCoordinate(uint value, uint extent)
@@ -4027,69 +4119,47 @@ public static partial class Gen5SpirvTranslator
             uint coordinates,
             uint imageSize,
             uint imageObject,
-            uint texel)
+            uint texel,
+            uint coordinateComponentCount)
         {
-            var x = _module.AddInstruction(
-                SpirvOp.CompositeExtract,
-                _intType,
-                coordinates,
-                0);
-            var y = _module.AddInstruction(
-                SpirvOp.CompositeExtract,
-                _intType,
-                coordinates,
-                1);
-            var width = _module.AddInstruction(
-                SpirvOp.CompositeExtract,
-                _intType,
-                imageSize,
-                0);
-            var height = _module.AddInstruction(
-                SpirvOp.CompositeExtract,
-                _intType,
-                imageSize,
-                1);
             var zero = _module.Constant(_intType, 0);
-            var xNonNegative = _module.AddInstruction(
-                SpirvOp.SGreaterThanEqual,
-                _boolType,
-                x,
-                zero);
-            var yNonNegative = _module.AddInstruction(
-                SpirvOp.SGreaterThanEqual,
-                _boolType,
-                y,
-                zero);
-            var xInRange = _module.AddInstruction(
-                SpirvOp.SLessThan,
-                _boolType,
-                x,
-                width);
-            var yInRange = _module.AddInstruction(
-                SpirvOp.SLessThan,
-                _boolType,
-                y,
-                height);
-            var lowerInRange = _module.AddInstruction(
-                SpirvOp.LogicalAnd,
-                _boolType,
-                xNonNegative,
-                yNonNegative);
-            var upperInRange = _module.AddInstruction(
-                SpirvOp.LogicalAnd,
-                _boolType,
-                xInRange,
-                yInRange);
-            var inRange = _module.AddInstruction(
-                SpirvOp.LogicalAnd,
-                _boolType,
-                lowerInRange,
-                upperInRange);
-            inRange = _module.AddInstruction(
-                SpirvOp.LogicalAnd,
-                _boolType,
-                Load(_boolType, _exec),
-                inRange);
+            var inRange = Load(_boolType, _exec);
+            for (uint component = 0;
+                 component < coordinateComponentCount;
+                 component++)
+            {
+                var coordinate = _module.AddInstruction(
+                    SpirvOp.CompositeExtract,
+                    _intType,
+                    coordinates,
+                    component);
+                var extent = _module.AddInstruction(
+                    SpirvOp.CompositeExtract,
+                    _intType,
+                    imageSize,
+                    component);
+                var nonNegative = _module.AddInstruction(
+                    SpirvOp.SGreaterThanEqual,
+                    _boolType,
+                    coordinate,
+                    zero);
+                var belowExtent = _module.AddInstruction(
+                    SpirvOp.SLessThan,
+                    _boolType,
+                    coordinate,
+                    extent);
+                var componentInRange = _module.AddInstruction(
+                    SpirvOp.LogicalAnd,
+                    _boolType,
+                    nonNegative,
+                    belowExtent);
+                inRange = _module.AddInstruction(
+                    SpirvOp.LogicalAnd,
+                    _boolType,
+                    inRange,
+                    componentInRange);
+            }
+
             var writeLabel = _module.AllocateId();
             var mergeLabel = _module.AllocateId();
             _module.AddStatement(SpirvOp.SelectionMerge, mergeLabel, 0);
@@ -4108,30 +4178,30 @@ public static partial class Gen5SpirvTranslator
             _module.AddLabel(mergeLabel);
         }
 
-        private uint BuildImageOffset(Gen5ImageControl image, int component)
+        private uint BuildImageOffset(
+            Gen5ImageControl image,
+            int component,
+            uint componentCount)
         {
-            var ivec2 = _module.TypeVector(_intType, 2);
             var packed = Bitcast(
                 _intType,
                 LoadV(image.GetAddressRegister(
                     ImageAddressRegister(image, component))));
-            var x = _module.AddInstruction(
-                SpirvOp.BitFieldSExtract,
-                _intType,
-                packed,
-                UInt(0),
-                UInt(6));
-            var y = _module.AddInstruction(
-                SpirvOp.BitFieldSExtract,
-                _intType,
-                packed,
-                UInt(8),
-                UInt(6));
+            var components = new uint[checked((int)componentCount)];
+            for (var index = 0; index < components.Length; index++)
+            {
+                components[index] = _module.AddInstruction(
+                    SpirvOp.BitFieldSExtract,
+                    _intType,
+                    packed,
+                    UInt((uint)(index * 8)),
+                    UInt(6));
+            }
+
             return _module.AddInstruction(
                 SpirvOp.CompositeConstruct,
-                ivec2,
-                x,
-                y);
+                _module.TypeVector(_intType, componentCount),
+                components);
         }
 
         private uint ApplyDynamicSampleOffset(
@@ -4141,7 +4211,16 @@ public static partial class Gen5SpirvTranslator
             uint texelOffset,
             uint lod)
         {
-            var ivec2 = _module.TypeVector(_intType, 2);
+            var spatialComponentCount = ImageSpatialComponentCount(resource);
+            var coordinateComponentCount =
+                ImageCoordinateComponentCount(resource);
+            var spatialIntegerType =
+                _module.TypeVector(_intType, spatialComponentCount);
+            var spatialFloatType =
+                _module.TypeVector(_floatType, spatialComponentCount);
+            var queryComponentCount = resource.Arrayed
+                ? coordinateComponentCount
+                : spatialComponentCount;
             var image = _module.AddInstruction(
                 SpirvOp.Image,
                 resource.ImageType,
@@ -4163,14 +4242,14 @@ public static partial class Gen5SpirvTranslator
                 signedLod);
             var size = _module.AddInstruction(
                 SpirvOp.ImageQuerySizeLod,
-                resource.Arrayed ? _module.TypeVector(_intType, 3) : ivec2,
+                _module.TypeVector(_intType, queryComponentCount),
                 image,
                 clampedLod);
             if (resource.Arrayed)
             {
                 size = _module.AddInstruction(
                     SpirvOp.VectorShuffle,
-                    ivec2,
+                    spatialIntegerType,
                     size,
                     size,
                     0u,
@@ -4179,27 +4258,27 @@ public static partial class Gen5SpirvTranslator
 
             var sizeFloat = _module.AddInstruction(
                 SpirvOp.ConvertSToF,
-                _vec2Type,
+                spatialFloatType,
                 size);
             var offsetFloat = _module.AddInstruction(
                 SpirvOp.ConvertSToF,
-                _vec2Type,
+                spatialFloatType,
                 texelOffset);
             var normalizedOffset = _module.AddInstruction(
                 SpirvOp.FDiv,
-                _vec2Type,
+                spatialFloatType,
                 offsetFloat,
                 sizeFloat);
             if (!resource.Arrayed)
             {
                 return _module.AddInstruction(
                     SpirvOp.FAdd,
-                    _vec2Type,
+                    spatialFloatType,
                     coordinates,
                     normalizedOffset);
             }
 
-            var offsetVec3 = _module.AddInstruction(
+            var arrayOffset = _module.AddInstruction(
                 SpirvOp.CompositeConstruct,
                 _vec3Type,
                 _module.AddInstruction(
@@ -4217,7 +4296,7 @@ public static partial class Gen5SpirvTranslator
                 SpirvOp.FAdd,
                 _vec3Type,
                 coordinates,
-                offsetVec3);
+                arrayOffset);
         }
 
         private bool TryEmitExport(

src/SharpEmu.ShaderCompiler.Vulkan/SpirvFixedShaders.cs

@@ -260,4 +260,233 @@ public static class SpirvFixedShaders
         module.AddExecutionMode(main, SpirvExecutionMode.OriginUpperLeft);
         return module.Build();
     }
+
+    /// <summary>
+    /// Compute kernel that deswizzles RDNA2 tiled surfaces at 4 bytes/element into
+    /// a linear output buffer — one GPU thread per texel, one dispatch-Z layer per
+    /// array slice. Mirrors <c>GnmTiling.GetDetileParams</c> so it is bit-identical
+    /// to the CPU fallback for both supported equation families:
+    /// <code>
+    ///   z = layer;
+    ///   inBlock = equation == BlockTable            // modes 1/4/8
+    ///             ? blockTable[(y % blockHeight) * blockWidth + (x % blockWidth)]
+    ///             : xTerm[x &amp; xMask] ^ yTerm[y &amp; yMask];   // ExactXor 5/9/24/27
+    ///   src = z * srcSliceElements
+    ///         + (y / blockHeight * blocksPerRow + x / blockWidth) * blockElements
+    ///         + inBlock;
+    ///   out[z * width * height + y * width + x] = tiled[src];
+    /// </code>
+    /// Each array slice is an independently tiled 2D surface; the caller packs the
+    /// slices contiguously in the tiled buffer (stride <c>srcSliceElements</c>) and
+    /// the output ends up layer-major, matching a single multi-layer
+    /// buffer-&gt;image copy. For a non-arrayed texture the caller dispatches a
+    /// single Z layer with <c>srcSliceElements</c> unused (z == 0).
+    ///
+    /// The term tables hold ELEMENT offsets. For ExactXor the caller pre-shifts the
+    /// byte-unit GetDetileParams terms right by log2(bytesPerElement) (exact at 4bpp
+    /// since the equation's low two byte-offset bits are 0); for BlockTable the
+    /// GetDetileParams block table is already in element units. Binding 1 carries
+    /// xTerm (ExactXor) OR blockTable (BlockTable) — the two equations index
+    /// different-sized buffers, so the kernel branches and evaluates exactly one.
+    ///
+    /// width/height are ELEMENT dims (for block-compressed formats a 4x4 block is
+    /// one element). Each element spans uintsPerElement = bpp/4 words (4bpp -> 1,
+    /// 8bpp -> 2, 16bpp -> 4); the X dispatch is widened by that factor so each
+    /// thread copies one word (elemX = gidX / upe, word = gidX % upe). 1/2 bpp are
+    /// sub-word and stay on the CPU.
+    ///
+    /// Descriptor set 0: binding 0 = tiled uint[], 1 = xTerm/blockTable uint[],
+    /// 2 = yTerm uint[], 3 = out uint[]. Push constants (11 x uint, offset i*4):
+    /// width, height, blockWidth, blockHeight, blockElements, blocksPerRow,
+    /// xMask, yMask, srcSliceElements, equation (0 = ExactXor, 1 = BlockTable),
+    /// uintsPerElement. Local size 8x8x1; dispatch X = ceil(width*upe/8),
+    /// Y = ceil(height/8), Z = arrayLayers.
+    /// </summary>
+    public static byte[] CreateDetileCompute()
+    {
+        var module = new SpirvModuleBuilder();
+        module.AddCapability(SpirvCapability.Shader);
+
+        var voidType = module.TypeVoid();
+        var boolType = module.TypeBool();
+        var uintType = module.TypeInt(32, signed: false);
+        var uvec3Type = module.TypeVector(uintType, 3);
+
+        // One shared Block-decorated storage-buffer struct: struct { uint data[]; }.
+        var runtimeArray = module.TypeRuntimeArray(uintType);
+        module.AddDecoration(runtimeArray, SpirvDecoration.ArrayStride, 4);
+        var bufferStruct = module.TypeStruct(runtimeArray);
+        module.AddDecoration(bufferStruct, SpirvDecoration.Block);
+        module.AddMemberDecoration(bufferStruct, 0, SpirvDecoration.Offset, 0);
+        var bufferPtrType = module.TypePointer(SpirvStorageClass.StorageBuffer, bufferStruct);
+        var uintStoragePtr = module.TypePointer(SpirvStorageClass.StorageBuffer, uintType);
+
+        uint MakeBuffer(uint binding, string name)
+        {
+            var variable = module.AddGlobalVariable(bufferPtrType, SpirvStorageClass.StorageBuffer);
+            module.AddName(variable, name);
+            module.AddDecoration(variable, SpirvDecoration.DescriptorSet, 0);
+            module.AddDecoration(variable, SpirvDecoration.Binding, binding);
+            return variable;
+        }
+
+        var tiledVar = MakeBuffer(0, "tiled");
+        var xTermVar = MakeBuffer(1, "xTerm");
+        var yTermVar = MakeBuffer(2, "yTerm");
+        var outVar = MakeBuffer(3, "outLinear");
+
+        // Push constants: struct { uint p0..p10; }, each member at offset i*4.
+        var pushStruct = module.TypeStruct(
+            uintType, uintType, uintType, uintType, uintType, uintType,
+            uintType, uintType, uintType, uintType, uintType);
+        module.AddDecoration(pushStruct, SpirvDecoration.Block);
+        for (uint member = 0; member < 11; member++)
+        {
+            module.AddMemberDecoration(pushStruct, member, SpirvDecoration.Offset, member * 4);
+        }
+
+        var pushPtrType = module.TypePointer(SpirvStorageClass.PushConstant, pushStruct);
+        var pushMemberPtrType = module.TypePointer(SpirvStorageClass.PushConstant, uintType);
+        var pushVar = module.AddGlobalVariable(pushPtrType, SpirvStorageClass.PushConstant);
+        module.AddName(pushVar, "pc");
+
+        var inputUvec3Ptr = module.TypePointer(SpirvStorageClass.Input, uvec3Type);
+        var gidVar = module.AddGlobalVariable(inputUvec3Ptr, SpirvStorageClass.Input);
+        module.AddName(gidVar, "gid");
+        module.AddDecoration(gidVar, SpirvDecoration.BuiltIn, (uint)SpirvBuiltIn.GlobalInvocationId);
+
+        var uintConst = new uint[11];
+        for (uint value = 0; value < 11; value++)
+        {
+            uintConst[value] = module.Constant(uintType, value);
+        }
+
+        var functionType = module.TypeFunction(voidType);
+        var main = module.BeginFunction(voidType, functionType);
+        module.AddName(main, "main");
+        module.AddLabel();
+
+        var gid = module.AddInstruction(SpirvOp.Load, uvec3Type, gidVar);
+        var gidX = module.AddInstruction(SpirvOp.CompositeExtract, uintType, gid, 0);
+        var y = module.AddInstruction(SpirvOp.CompositeExtract, uintType, gid, 1);
+        var z = module.AddInstruction(SpirvOp.CompositeExtract, uintType, gid, 2);
+
+        uint PushField(uint index)
+        {
+            var pointer = module.AddInstruction(
+                SpirvOp.AccessChain, pushMemberPtrType, pushVar, uintConst[index]);
+            return module.AddInstruction(SpirvOp.Load, uintType, pointer);
+        }
+
+        // width/height are ELEMENT dims (for BC, a 4x4 block is one element). Each
+        // element spans uintsPerElement 32-bit words (bpp/4: 4bpp->1, 8bpp->2,
+        // 16bpp->4). The X dispatch is widened by uintsPerElement so each thread
+        // copies exactly one word: elemX = gidX / upe, wordIndex = gidX % upe.
+        var width = PushField(0);
+        var height = PushField(1);
+        var blockWidth = PushField(2);
+        var blockHeight = PushField(3);
+        var blockElements = PushField(4);
+        var blocksPerRow = PushField(5);
+        var xMask = PushField(6);
+        var yMask = PushField(7);
+        var srcSliceElements = PushField(8);
+        var equation = PushField(9);
+        var uintsPerElement = PushField(10);
+
+        var elemX = module.AddInstruction(SpirvOp.UDiv, uintType, gidX, uintsPerElement);
+        var elemXTimesUpe = module.AddInstruction(SpirvOp.IMul, uintType, elemX, uintsPerElement);
+        var wordIndex = module.AddInstruction(SpirvOp.ISub, uintType, gidX, elemXTimesUpe);
+
+        var xInRange = module.AddInstruction(SpirvOp.ULessThan, boolType, elemX, width);
+        var yInRange = module.AddInstruction(SpirvOp.ULessThan, boolType, y, height);
+        var inRange = module.AddInstruction(SpirvOp.LogicalAnd, boolType, xInRange, yInRange);
+
+        var bodyLabel = module.AllocateId();
+        var mergeLabel = module.AllocateId();
+        module.AddStatement(SpirvOp.SelectionMerge, mergeLabel, 0);
+        module.AddStatement(SpirvOp.BranchConditional, inRange, bodyLabel, mergeLabel);
+
+        module.AddLabel(bodyLabel);
+
+        // blockIdx = (y / blockHeight) * blocksPerRow + (elemX / blockWidth)
+        var yDiv = module.AddInstruction(SpirvOp.UDiv, uintType, y, blockHeight);
+        var blockRow = module.AddInstruction(SpirvOp.IMul, uintType, yDiv, blocksPerRow);
+        var xDiv = module.AddInstruction(SpirvOp.UDiv, uintType, elemX, blockWidth);
+        var blockIdx = module.AddInstruction(SpirvOp.IAdd, uintType, blockRow, xDiv);
+
+        // off (element offset within the block) = equation == BlockTable
+        //   ? blockTable[(y % blockHeight) * blockWidth + (elemX % blockWidth)]
+        //   : xTerm[elemX & xMask] ^ yTerm[y & yMask]
+        // Binding 1 (xTermVar) doubles as the block table; the two equations index
+        // different-sized buffers, so exactly one branch executes (no OOB read).
+        var isBlockTable = module.AddInstruction(SpirvOp.INotEqual, boolType, equation, uintConst[0]);
+        var xorLabel = module.AllocateId();
+        var tableLabel = module.AllocateId();
+        var offMergeLabel = module.AllocateId();
+        module.AddStatement(SpirvOp.SelectionMerge, offMergeLabel, 0);
+        module.AddStatement(SpirvOp.BranchConditional, isBlockTable, tableLabel, xorLabel);
+
+        // ExactXor: xTerm[elemX & xMask] ^ yTerm[y & yMask]
+        module.AddLabel(xorLabel);
+        var xIdx = module.AddInstruction(SpirvOp.BitwiseAnd, uintType, elemX, xMask);
+        var xPtr = module.AddInstruction(SpirvOp.AccessChain, uintStoragePtr, xTermVar, uintConst[0], xIdx);
+        var xTerm = module.AddInstruction(SpirvOp.Load, uintType, xPtr);
+        var yIdx = module.AddInstruction(SpirvOp.BitwiseAnd, uintType, y, yMask);
+        var yPtr = module.AddInstruction(SpirvOp.AccessChain, uintStoragePtr, yTermVar, uintConst[0], yIdx);
+        var yTerm = module.AddInstruction(SpirvOp.Load, uintType, yPtr);
+        var offXor = module.AddInstruction(SpirvOp.BitwiseXor, uintType, xTerm, yTerm);
+        module.AddStatement(SpirvOp.Branch, offMergeLabel);
+
+        // BlockTable: blockTable[inY * blockWidth + inX], inX/inY = position in block
+        module.AddLabel(tableLabel);
+        var blockXBase = module.AddInstruction(SpirvOp.IMul, uintType, xDiv, blockWidth);
+        var inX = module.AddInstruction(SpirvOp.ISub, uintType, elemX, blockXBase);
+        var blockYBase = module.AddInstruction(SpirvOp.IMul, uintType, yDiv, blockHeight);
+        var inY = module.AddInstruction(SpirvOp.ISub, uintType, y, blockYBase);
+        var rowInBlock = module.AddInstruction(SpirvOp.IMul, uintType, inY, blockWidth);
+        var tableIdx = module.AddInstruction(SpirvOp.IAdd, uintType, rowInBlock, inX);
+        var tablePtr = module.AddInstruction(SpirvOp.AccessChain, uintStoragePtr, xTermVar, uintConst[0], tableIdx);
+        var offTable = module.AddInstruction(SpirvOp.Load, uintType, tablePtr);
+        module.AddStatement(SpirvOp.Branch, offMergeLabel);
+
+        module.AddLabel(offMergeLabel);
+        var off = module.AddInstruction(SpirvOp.Phi, uintType, offXor, xorLabel, offTable, tableLabel);
+
+        // srcElem = z * srcSliceElements + blockIdx * blockElements + off  (in elements)
+        // srcWord = srcElem * uintsPerElement + wordIndex
+        var srcSliceBase = module.AddInstruction(SpirvOp.IMul, uintType, z, srcSliceElements);
+        var blockBase = module.AddInstruction(SpirvOp.IMul, uintType, blockIdx, blockElements);
+        var srcInSlice = module.AddInstruction(SpirvOp.IAdd, uintType, blockBase, off);
+        var srcElem = module.AddInstruction(SpirvOp.IAdd, uintType, srcSliceBase, srcInSlice);
+        var srcElemWords = module.AddInstruction(SpirvOp.IMul, uintType, srcElem, uintsPerElement);
+        var src = module.AddInstruction(SpirvOp.IAdd, uintType, srcElemWords, wordIndex);
+        var srcPtr = module.AddInstruction(SpirvOp.AccessChain, uintStoragePtr, tiledVar, uintConst[0], src);
+        var word = module.AddInstruction(SpirvOp.Load, uintType, srcPtr);
+
+        // dstElem = z * width * height + y * width + elemX  (in elements)
+        // dstWord = dstElem * uintsPerElement + wordIndex
+        var sliceElements = module.AddInstruction(SpirvOp.IMul, uintType, width, height);
+        var dstSliceBase = module.AddInstruction(SpirvOp.IMul, uintType, z, sliceElements);
+        var rowBase = module.AddInstruction(SpirvOp.IMul, uintType, y, width);
+        var dstRow = module.AddInstruction(SpirvOp.IAdd, uintType, rowBase, elemX);
+        var dstElem = module.AddInstruction(SpirvOp.IAdd, uintType, dstSliceBase, dstRow);
+        var dstElemWords = module.AddInstruction(SpirvOp.IMul, uintType, dstElem, uintsPerElement);
+        var dstIdx = module.AddInstruction(SpirvOp.IAdd, uintType, dstElemWords, wordIndex);
+        var dstPtr = module.AddInstruction(SpirvOp.AccessChain, uintStoragePtr, outVar, uintConst[0], dstIdx);
+        module.AddStatement(SpirvOp.Store, dstPtr, word);
+
+        module.AddStatement(SpirvOp.Branch, mergeLabel);
+        module.AddLabel(mergeLabel);
+        module.AddStatement(SpirvOp.Return);
+        module.EndFunction();
+
+        module.AddExecutionMode(main, SpirvExecutionMode.LocalSize, 8, 8, 1);
+        module.AddEntryPoint(
+            SpirvExecutionModel.GLCompute,
+            main,
+            "main",
+            [gidVar, tiledVar, xTermVar, yTermVar, outVar, pushVar]);
+        return module.Build();
+    }
 }

src/SharpEmu.ShaderCompiler/Gen5ShaderIr.cs

@@ -192,7 +192,8 @@ public sealed record Gen5GlobalMemoryControl(
     uint ScalarAddress,
     int OffsetBytes,
     bool Glc,
-    bool Slc) : Gen5InstructionControl;
+    bool Slc,
+    bool UsesFlatAddress = false) : Gen5InstructionControl;
 
 public sealed record Gen5BufferMemoryControl(
     uint DwordCount,
@@ -312,7 +313,8 @@ public sealed record Gen5VertexInputBinding(
     uint OffsetBytes,
     byte[] Data,
     int DataLength,
-    bool DataPooled);
+    bool DataPooled,
+    bool PerInstance = false);
 
 public sealed record Gen5ShaderEvaluation(
     IReadOnlyList<uint> InitialScalarRegisters,

src/SharpEmu.ShaderCompiler/Gen5ShaderScalarEvaluator.cs

@@ -4,6 +4,7 @@
 using SharpEmu.HLE;
 using System.Buffers;
 using System.Buffers.Binary;
+using System.Collections.Concurrent;
 using System.Diagnostics;
 using System.Numerics;
 
@@ -35,6 +36,14 @@ public static class Gen5ShaderScalarEvaluator
             StringComparison.Ordinal);
     private static readonly object _scalarFallbackTraceGate = new();
     private static readonly HashSet<(ulong Shader, uint Pc)> _tracedScalarFallbacks = [];
+    // Shaders whose empty SRT/EUD caused a null-base scalar pointer load.
+    // Host submit of those translations has lost the Vulkan device; Agc skips
+    // them before QueueSubmit.
+    private static readonly ConcurrentDictionary<ulong, byte> _emptySrtScalarPointerFallbacks =
+        new();
+
+    public static bool WasEmptySrtScalarPointerFallback(ulong shaderAddress) =>
+        _emptySrtScalarPointerFallbacks.ContainsKey(shaderAddress);
 
     // Uniform forward branches select material/resource bodies that remain
     // statically present in the translated shader. Discover the skipped body's
@@ -349,7 +358,10 @@ public static class Gen5ShaderScalarEvaluator
                 if (globalMemory.ScalarAddress >= ScalarRegisterCount - 1)
                 {
                     error =
-                        $"global-address-register-range pc=0x{instruction.Pc:X} " +
+                        $"{(globalMemory.UsesFlatAddress
+                            ? "flat-address-base-unresolved"
+                            : "global-address-register-range")} " +
+                        $"pc=0x{instruction.Pc:X} " +
                         $"s{globalMemory.ScalarAddress}";
                     return false;
                 }
@@ -364,11 +376,18 @@ public static class Gen5ShaderScalarEvaluator
                 }
 
                 var key = (globalMemory.ScalarAddress, baseAddress);
-                var writable = instruction.Opcode.StartsWith(
+                var writable =
+                    instruction.Opcode.StartsWith(
                         "GlobalStore",
                         StringComparison.Ordinal) ||
                     instruction.Opcode.StartsWith(
                         "GlobalAtomic",
+                        StringComparison.Ordinal) ||
+                    instruction.Opcode.StartsWith(
+                        "FlatStore",
+                        StringComparison.Ordinal) ||
+                    instruction.Opcode.StartsWith(
+                        "FlatAtomic",
                         StringComparison.Ordinal);
                 if (globalMemoryByAddress.TryGetValue(key, out var existingBinding))
                 {
@@ -874,8 +893,11 @@ public static class Gen5ShaderScalarEvaluator
         Gen5ShaderInstruction instruction,
         Gen5BufferMemoryControl control,
         BufferDescriptor descriptor) =>
+        // AGC embedded fetch is BufferLoadFormat/TBufferLoadFormat with idxen.
+        // offen is allowed: the constant/scalar offset folds into OffsetBytes
+        // (UI glyph shaders use this shape). Rejecting offen left those loads
+        // as live SSBOs and dropped vertex attributes.
         control.IndexEnabled &&
-        !control.OffsetEnabled &&
         control.DwordCount is >= 1 and <= 4 &&
         descriptor.BaseAddress != 0 &&
         descriptor.Stride != 0 &&
@@ -2101,6 +2123,15 @@ public static class Gen5ShaderScalarEvaluator
             $"dynamic={dynamicOffset} definitions=[{string.Join(';', definitions)}] " +
             $"user_data=[{userData}] metadata=" +
             $"{(state.Metadata is null ? "missing" : $"srt={state.Metadata.ShaderResourceTableSizeDwords},eud={state.Metadata.ExtendedUserDataSizeDwords}")}");
+        if (baseAddress == 0 &&
+            state.Metadata is
+            {
+                ShaderResourceTableSizeDwords: 0,
+                ExtendedUserDataSizeDwords: 0,
+            })
+        {
+            _emptySrtScalarPointerFallbacks.TryAdd(state.Program.Address, 0);
+        }
     }
 
     [Conditional("DEBUG")]

src/SharpEmu.ShaderCompiler/Gen5ShaderTranslator.cs

@@ -80,7 +80,7 @@ public static class Gen5ShaderTranslator
     public static bool IsScalarConsumed(ulong[] mask, uint register) =>
         register < 256 && (mask[register >> 6] & (1UL << (int)(register & 63))) != 0;
 
-    private const int MaxInstructions = 4096;
+    private const int MaxInstructions = 16384;
     private const uint PsUserDataRegister = 0x0C;
     private const uint VsUserDataRegister = 0x4C;
     private const uint GsUserDataRegister = 0x8C;
@@ -305,6 +305,23 @@ public static class Gen5ShaderTranslator
             count |= 0x20;
         }
 
+        // Primary SH defaults leave SPI_SHADER_PGM_RSRC2_PS at 0. Draws that
+        // still wrote USER_DATA_n via SetShReg would otherwise translate with
+        // an empty SRT window (Astro title PS → Address-0 descriptors →
+        // device lost). Recover the window from contiguous live registers.
+        if (count == 0 &&
+            userDataBaseRegister is not ComputeUserDataRegister)
+        {
+            var probed = 0;
+            while (probed < MaximumHardwareUserSgprs &&
+                   shaderRegisters.ContainsKey(userDataBaseRegister + (uint)probed))
+            {
+                probed++;
+            }
+
+            count = probed;
+        }
+
         if (userDataBaseRegister is not (PsUserDataRegister or
                 VsUserDataRegister or
                 GsUserDataRegister or
@@ -454,7 +471,15 @@ public static class Gen5ShaderTranslator
                 }
             }
 
-            instructions.Add(CreateInstruction(pc, encoding, name, words));
+            var instruction = CreateInstruction(pc, encoding, name, words);
+            if (instruction.Control is Gen5GlobalMemoryControl
+                {
+                    UsesFlatAddress: true,
+                })
+            {
+                instruction = ResolveFlatAddressBase(instructions, instruction);
+            }
+            instructions.Add(instruction);
             instructionCount++;
 
             pc += sizeDwords * sizeof(uint);
@@ -1378,35 +1403,42 @@ public static class Gen5ShaderTranslator
         var opcode = (word >> 18) & 0x7F;
         sizeDwords = 2;
         error = string.Empty;
-        name = segment == 0x2
-            ? opcode switch
-            {
-                0x08 => "GlobalLoadUbyte",
-                0x09 => "GlobalLoadSbyte",
-                0x0A => "GlobalLoadUshort",
-                0x0B => "GlobalLoadSshort",
-                0x0C => "GlobalLoadDword",
-                0x0D => "GlobalLoadDwordx2",
-                0x0E => "GlobalLoadDwordx4",
-                0x0F => "GlobalLoadDwordx3",
-                0x18 => "GlobalStoreByte",
-                0x19 => "GlobalStoreByteD16Hi",
-                0x1A => "GlobalStoreShort",
-                0x1B => "GlobalStoreShortD16Hi",
-                0x1C => "GlobalStoreDword",
-                0x1D => "GlobalStoreDwordx2",
-                0x1E => "GlobalStoreDwordx4",
-                0x1F => "GlobalStoreDwordx3",
-                0x20 => "GlobalLoadUbyteD16",
-                0x21 => "GlobalLoadUbyteD16Hi",
-                0x22 => "GlobalLoadSbyteD16",
-                0x23 => "GlobalLoadSbyteD16Hi",
-                0x24 => "GlobalLoadShortD16",
-                0x25 => "GlobalLoadShortD16Hi",
-                0x32 => "GlobalAtomicAdd",
-                0x38 => "GlobalAtomicUMax",
-                _ => string.Empty,
-            }
+        var prefix = segment switch
+        {
+            0x0 => "Flat",
+            0x2 => "Global",
+            _ => string.Empty,
+        };
+        var suffix = opcode switch
+        {
+            0x08 => "LoadUbyte",
+            0x09 => "LoadSbyte",
+            0x0A => "LoadUshort",
+            0x0B => "LoadSshort",
+            0x0C => "LoadDword",
+            0x0D => "LoadDwordx2",
+            0x0E => "LoadDwordx4",
+            0x0F => "LoadDwordx3",
+            0x18 => "StoreByte",
+            0x19 => "StoreByteD16Hi",
+            0x1A => "StoreShort",
+            0x1B => "StoreShortD16Hi",
+            0x1C => "StoreDword",
+            0x1D => "StoreDwordx2",
+            0x1E => "StoreDwordx4",
+            0x1F => "StoreDwordx3",
+            0x20 => "LoadUbyteD16",
+            0x21 => "LoadUbyteD16Hi",
+            0x22 => "LoadSbyteD16",
+            0x23 => "LoadSbyteD16Hi",
+            0x24 => "LoadShortD16",
+            0x25 => "LoadShortD16Hi",
+            0x32 => "AtomicAdd",
+            0x38 => "AtomicUMax",
+            _ => string.Empty,
+        };
+        name = prefix.Length != 0 && suffix.Length != 0
+            ? prefix + suffix
             : string.Empty;
 
         return FinishDecode(
@@ -1629,6 +1661,82 @@ public static class Gen5ShaderTranslator
         _ => false,
     };
 
+    private static Gen5ShaderInstruction ResolveFlatAddressBase(
+        IReadOnlyList<Gen5ShaderInstruction> precedingInstructions,
+        Gen5ShaderInstruction instruction)
+    {
+        if (instruction.Control is not Gen5GlobalMemoryControl
+            {
+                UsesFlatAddress: true,
+            } control ||
+            !TryFindVectorDefinition(
+                precedingInstructions,
+                control.VectorAddress,
+                out var lowDefinition) ||
+            !TryFindVectorDefinition(
+                precedingInstructions,
+                control.VectorAddress + 1,
+                out var highDefinition))
+        {
+            return instruction;
+        }
+
+        foreach (var lowSource in lowDefinition.Sources)
+        {
+            if (lowSource.Kind != Gen5OperandKind.ScalarRegister)
+            {
+                continue;
+            }
+
+            foreach (var highSource in highDefinition.Sources)
+            {
+                if (highSource.Kind != Gen5OperandKind.ScalarRegister ||
+                    highSource.Value != lowSource.Value + 1)
+                {
+                    continue;
+                }
+
+                return instruction with
+                {
+                    Sources =
+                    [
+                        .. instruction.Sources,
+                        Gen5Operand.Scalar(lowSource.Value),
+                    ],
+                    Control = control with
+                    {
+                        ScalarAddress = lowSource.Value,
+                    },
+                };
+            }
+        }
+
+        return instruction;
+    }
+
+    private static bool TryFindVectorDefinition(
+        IReadOnlyList<Gen5ShaderInstruction> instructions,
+        uint register,
+        out Gen5ShaderInstruction definition)
+    {
+        for (var index = instructions.Count - 1; index >= 0; index--)
+        {
+            var candidate = instructions[index];
+            foreach (var destination in candidate.Destinations)
+            {
+                if (destination.Kind == Gen5OperandKind.VectorRegister &&
+                    destination.Value == register)
+                {
+                    definition = candidate;
+                    return true;
+                }
+            }
+        }
+
+        definition = default!;
+        return false;
+    }
+
     private static Gen5ShaderInstruction CreateInstruction(
         uint pc,
         Gen5ShaderEncoding encoding,
@@ -2040,7 +2148,13 @@ public static class Gen5ShaderTranslator
                 var vectorAddress = extra & 0xFF;
                 var vectorData = (extra >> 8) & 0xFF;
                 var scalarAddress = (extra >> 16) & 0x7F;
-                var dwordCount = opcode switch
+                var usesFlatAddress = opcode.StartsWith(
+                    "Flat",
+                    StringComparison.Ordinal);
+                var memoryOpcode = usesFlatAddress
+                    ? "Global" + opcode["Flat".Length..]
+                    : opcode;
+                var dwordCount = memoryOpcode switch
                 {
                     "GlobalLoadUbyte" or
                     "GlobalLoadSbyte" or
@@ -2068,12 +2182,20 @@ public static class Gen5ShaderTranslator
                     "GlobalStoreDwordx4" => 4u,
                     _ => 0u,
                 };
-                sources =
-                [
-                    Gen5Operand.Vector(vectorAddress),
-                    Gen5Operand.Scalar(scalarAddress),
-                ];
-                destinations = opcode.StartsWith("GlobalLoad", StringComparison.Ordinal)
+                sources = usesFlatAddress
+                    ?
+                    [
+                        Gen5Operand.Vector(vectorAddress),
+                        Gen5Operand.Vector(vectorAddress + 1),
+                    ]
+                    :
+                    [
+                        Gen5Operand.Vector(vectorAddress),
+                        Gen5Operand.Scalar(scalarAddress),
+                    ];
+                destinations = memoryOpcode.StartsWith(
+                        "GlobalLoad",
+                        StringComparison.Ordinal)
                     ? Enumerable
                         .Range((int)vectorData, checked((int)dwordCount))
                         .Select(index => Gen5Operand.Vector((uint)index))
@@ -2083,10 +2205,11 @@ public static class Gen5ShaderTranslator
                     dwordCount,
                     vectorAddress,
                     vectorData,
-                    scalarAddress,
+                    usesFlatAddress ? uint.MaxValue : scalarAddress,
                     SignExtend(word & 0x1FFF, 13),
                     ((word >> 16) & 1) != 0,
-                    ((word >> 17) & 1) != 0);
+                    ((word >> 17) & 1) != 0,
+                    usesFlatAddress);
                 break;
             }
             case Gen5ShaderEncoding.Mubuf:

tests/SharpEmu.Libs.Tests/Agc/AgcFusedShaderTests.cs

@@ -0,0 +1,330 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Agc;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+// sceAgcGetFusedShaderSize (dolOmWH+huQ) and sceAgcFuseShaderHalves (fd5Bp5tGTgo)
+// join a GS or HS front/back shader half pair into one shader: the fused header
+// is the back half retyped, the back half's SH registers become the fused
+// register image, and the front half contributes its program address
+// (SPI_SHADER_PGM_LO/HI_ES) and checksum registers.
+public sealed class AgcFusedShaderTests
+{
+    private const ulong BaseAddress = 0x1_0000_0000;
+    private const int MemorySize = 0x4000;
+
+    private const ulong FrontShader = BaseAddress + 0x0000;
+    private const ulong BackShader = BaseAddress + 0x0100;
+    private const ulong FusedShader = BaseAddress + 0x0200;
+    private const ulong FrontRegisters = BaseAddress + 0x0300;
+    private const ulong BackRegisters = BaseAddress + 0x0400;
+    private const ulong FrontSpecials = BaseAddress + 0x0500;
+    private const ulong BackSpecials = BaseAddress + 0x0600;
+    private const ulong Scratch = BaseAddress + 0x0700;
+    private const ulong SizeResult = BaseAddress + 0x0800;
+
+    private const ulong ShaderUserDataOffset = 0x08;
+    private const ulong ShaderCodeOffset = 0x10;
+    private const ulong ShaderShRegistersOffset = 0x20;
+    private const ulong ShaderSpecialsOffset = 0x28;
+    private const ulong ShaderTypeOffset = 0x5A;
+    private const ulong ShaderNumShRegistersOffset = 0x5C;
+
+    private const byte GsFront = 4;
+    private const byte HsFront = 5;
+    private const byte GsBack = 6;
+    private const byte HsBack = 7;
+
+    private const ulong FrontCode = 0x0000_1234_5678_9A00;
+
+    [Fact]
+    public void GetFusedShaderSize_GsPair_ReportsBackRegisterBytes()
+    {
+        var (memory, ctx) = CreateGsPair();
+
+        ctx[CpuRegister.Rdi] = SizeResult;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        var result = AgcExports.GetFusedShaderSize(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(5UL * 8UL, ReadUInt64(memory, SizeResult));
+        Assert.Equal(4UL, ReadUInt64(memory, SizeResult + 8));
+    }
+
+    [Fact]
+    public void GetFusedShaderSize_MismatchedHalves_Rejects()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteByte(memory, BackShader + ShaderTypeOffset, HsBack);
+
+        ctx[CpuRegister.Rdi] = SizeResult;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        var result = AgcExports.GetFusedShaderSize(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT, result);
+        Assert.Equal(0UL, ReadUInt64(memory, SizeResult));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_GsPairWithScratch_BuildsFusedShader()
+    {
+        var (memory, ctx) = CreateGsPair();
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+
+        // Fused header is the back half with type kGs, cleared user data, and
+        // registers relocated to the scratch image.
+        Assert.Equal(2, ReadByte(memory, FusedShader + ShaderTypeOffset));
+        Assert.Equal(0UL, ReadUInt64(memory, FusedShader + ShaderUserDataOffset));
+        Assert.Equal(Scratch, ReadUInt64(memory, FusedShader + ShaderShRegistersOffset));
+        Assert.Equal(5, ReadByte(memory, FusedShader + ShaderNumShRegistersOffset));
+        Assert.Equal(
+            ReadUInt64(memory, BackShader + ShaderCodeOffset),
+            ReadUInt64(memory, FusedShader + ShaderCodeOffset));
+
+        // The back half's own register image is untouched.
+        Assert.Equal(0x1111_1111u, ReadUInt32(memory, BackRegisters + 4));
+
+        // Scratch image: LO_ES points at the front code, HI_ES keeps its upper
+        // bits, both checksum occurrences carry the front half's values.
+        Assert.Equal(0xC8u, ReadUInt32(memory, Scratch + 0));
+        Assert.Equal(0x3456_789Au, ReadUInt32(memory, Scratch + 4));
+        Assert.Equal(0xC9u, ReadUInt32(memory, Scratch + 8));
+        Assert.Equal(0xAABB_CC12u, ReadUInt32(memory, Scratch + 12));
+        Assert.Equal(0xAAAA_0001u, ReadUInt32(memory, Scratch + 20));
+        Assert.Equal(0xBBBB_0002u, ReadUInt32(memory, Scratch + 28));
+        Assert.Equal(0x5555_5555u, ReadUInt32(memory, Scratch + 36));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_NoScratch_PatchesBackRegistersInPlace()
+    {
+        var (memory, ctx) = CreateGsPair();
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = 0;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(BackRegisters, ReadUInt64(memory, FusedShader + ShaderShRegistersOffset));
+        Assert.Equal(0x3456_789Au, ReadUInt32(memory, BackRegisters + 4));
+        Assert.Equal(0xAABB_CC12u, ReadUInt32(memory, BackRegisters + 12));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_WaveSizeMismatch_Rejects()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteUInt32(memory, BackSpecials + 0x08 + 4, 0u);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT, result);
+        Assert.Equal(0, ReadByte(memory, FusedShader + ShaderTypeOffset));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_HsPair_PatchesLoLs()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteByte(memory, FrontShader + ShaderTypeOffset, HsFront);
+        WriteByte(memory, BackShader + ShaderTypeOffset, HsBack);
+        WriteUInt32(memory, BackRegisters + 0, 0x148u);
+        WriteUInt32(memory, BackRegisters + 8, 0x149u);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(3, ReadByte(memory, FusedShader + ShaderTypeOffset));
+        Assert.Equal(0x3456_789Au, ReadUInt32(memory, Scratch + 4));
+        // Checksum grafting is a geometry-pair behavior; the HS image keeps its own values.
+        Assert.Equal(0x1111_0001u, ReadUInt32(memory, Scratch + 20));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_MissingSpecials_SkipsWaveSizeGate()
+    {
+        var (memory, ctx) = CreateGsPair();
+        // The divergence the mismatch test rejects passes when a half lacks specials.
+        WriteUInt64(memory, FrontShader + ShaderSpecialsOffset, 0);
+        WriteUInt32(memory, BackSpecials + 0x08 + 4, 0u);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(2, ReadByte(memory, FusedShader + ShaderTypeOffset));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_ProgramRegisterAbsent_LeavesImageUntouched()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteByte(memory, FrontShader + ShaderTypeOffset, HsFront);
+        WriteByte(memory, BackShader + ShaderTypeOffset, HsBack);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        // No LO_LS entry in the back image: the fuse still succeeds and the
+        // scratch copy stays verbatim.
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(3, ReadByte(memory, FusedShader + ShaderTypeOffset));
+        Assert.Equal(0x1111_1111u, ReadUInt32(memory, Scratch + 4));
+        Assert.Equal(0xAABB_CC77u, ReadUInt32(memory, Scratch + 12));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_UnpairedProgramRegister_LeavesImageUntouched()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteByte(memory, FrontShader + ShaderTypeOffset, HsFront);
+        WriteByte(memory, BackShader + ShaderTypeOffset, HsBack);
+        WriteUInt32(memory, BackRegisters + 0, 0x148u);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        // LO_LS is present but the next entry is not HI_LS, so the patch is skipped.
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(0x1111_1111u, ReadUInt32(memory, Scratch + 4));
+    }
+
+    [Fact]
+    public void FuseShaderHalves_ProgramRegisterAtImageEnd_LeavesImageUntouched()
+    {
+        var (memory, ctx) = CreateGsPair();
+        WriteByte(memory, FrontShader + ShaderTypeOffset, HsFront);
+        WriteByte(memory, BackShader + ShaderTypeOffset, HsBack);
+        WriteUInt32(memory, BackRegisters + 4 * 8, 0x148u);
+
+        ctx[CpuRegister.Rdi] = FusedShader;
+        ctx[CpuRegister.Rsi] = FrontShader;
+        ctx[CpuRegister.Rdx] = BackShader;
+        ctx[CpuRegister.Rcx] = Scratch;
+        var result = AgcExports.FuseShaderHalves(ctx);
+
+        // The hi half of the pair would sit past the register image.
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(0x5555_5555u, ReadUInt32(memory, Scratch + 36));
+    }
+
+    private static (FakeCpuMemory Memory, CpuContext Ctx) CreateGsPair()
+    {
+        var memory = new FakeCpuMemory(BaseAddress, MemorySize);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        WriteByte(memory, FrontShader + ShaderTypeOffset, GsFront);
+        WriteUInt64(memory, FrontShader + ShaderCodeOffset, FrontCode);
+        WriteUInt64(memory, FrontShader + ShaderShRegistersOffset, FrontRegisters);
+        WriteUInt64(memory, FrontShader + ShaderSpecialsOffset, FrontSpecials);
+        WriteByte(memory, FrontShader + ShaderNumShRegistersOffset, 4);
+
+        WriteByte(memory, BackShader + ShaderTypeOffset, GsBack);
+        WriteUInt64(memory, BackShader + ShaderCodeOffset, 0x0000_0BAD_F00D_BE00);
+        WriteUInt64(memory, BackShader + ShaderShRegistersOffset, BackRegisters);
+        WriteUInt64(memory, BackShader + ShaderSpecialsOffset, BackSpecials);
+        WriteUInt64(memory, BackShader + ShaderUserDataOffset, 0xDEAD_BEEF);
+        WriteByte(memory, BackShader + ShaderNumShRegistersOffset, 5);
+
+        // Back image: ES program address pair, two checksum slots, one bystander.
+        WriteRegister(memory, BackRegisters, 0, 0xC8u, 0x1111_1111u);
+        WriteRegister(memory, BackRegisters, 1, 0xC9u, 0xAABB_CC77u);
+        WriteRegister(memory, BackRegisters, 2, 0x80u, 0x1111_0001u);
+        WriteRegister(memory, BackRegisters, 3, 0x80u, 0x1111_0002u);
+        WriteRegister(memory, BackRegisters, 4, 0x10u, 0x5555_5555u);
+
+        // Front image: GS RSRC pair as shipped, then the checksum values to graft.
+        WriteRegister(memory, FrontRegisters, 0, 0x8Au, 0x0123_4567u);
+        WriteRegister(memory, FrontRegisters, 1, 0x8Bu, 0x89AB_CDEFu);
+        WriteRegister(memory, FrontRegisters, 2, 0x80u, 0xAAAA_0001u);
+        WriteRegister(memory, FrontRegisters, 3, 0x80u, 0xBBBB_0002u);
+
+        // VGT_SHADER_STAGES_EN register pairs with the GS wave32 enable bit set on both halves.
+        WriteUInt32(memory, FrontSpecials + 0x08, 0x1F1u);
+        WriteUInt32(memory, FrontSpecials + 0x08 + 4, 1u << 22);
+        WriteUInt32(memory, BackSpecials + 0x08, 0x1F1u);
+        WriteUInt32(memory, BackSpecials + 0x08 + 4, 1u << 22);
+
+        return (memory, ctx);
+    }
+
+    private static void WriteRegister(FakeCpuMemory memory, ulong array, int index, uint offset, uint value)
+    {
+        WriteUInt32(memory, array + (ulong)index * 8, offset);
+        WriteUInt32(memory, array + (ulong)index * 8 + 4, value);
+    }
+
+    private static void WriteByte(FakeCpuMemory memory, ulong address, byte value)
+    {
+        Span<byte> buffer = [value];
+        Assert.True(memory.TryWrite(address, buffer));
+    }
+
+    private static void WriteUInt32(FakeCpuMemory memory, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        Assert.True(memory.TryWrite(address, buffer));
+    }
+
+    private static void WriteUInt64(FakeCpuMemory memory, ulong address, ulong value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ulong)];
+        BinaryPrimitives.WriteUInt64LittleEndian(buffer, value);
+        Assert.True(memory.TryWrite(address, buffer));
+    }
+
+    private static byte ReadByte(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[1];
+        Assert.True(memory.TryRead(address, buffer));
+        return buffer[0];
+    }
+
+    private static uint ReadUInt32(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        Assert.True(memory.TryRead(address, buffer));
+        return BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+    }
+
+    private static ulong ReadUInt64(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ulong)];
+        Assert.True(memory.TryRead(address, buffer));
+        return BinaryPrimitives.ReadUInt64LittleEndian(buffer);
+    }
+}

tests/SharpEmu.Libs.Tests/Agc/AgcPredicationTests.cs

@@ -0,0 +1,93 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Agc;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+public sealed class AgcPredicationTests
+{
+    private const ulong BaseAddress = 0x1_0000_0000;
+    private const ulong CommandBufferAddress = BaseAddress + 0x100;
+    private const ulong PacketAddress = BaseAddress + 0x400;
+    private const ulong PredicateAddress = BaseAddress + 0x800;
+
+    [Fact]
+    public void DcbSetPredication_EmitsGen5Packet()
+    {
+        var memory = new FakeCpuMemory(BaseAddress, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+        WriteUInt64(memory, CommandBufferAddress + 0x10, PacketAddress);
+        WriteUInt64(memory, CommandBufferAddress + 0x18, PacketAddress + 0x100);
+
+        ctx[CpuRegister.Rdi] = CommandBufferAddress;
+        ctx[CpuRegister.Rsi] = 1;
+        ctx[CpuRegister.Rdx] = 3;
+        ctx[CpuRegister.Rcx] = 1;
+        ctx[CpuRegister.R8] = PredicateAddress + 7;
+        ctx[CpuRegister.R9] = 2;
+
+        var result = AgcExports.DcbSetPredication(ctx);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, result);
+        Assert.Equal(PacketAddress, ctx[CpuRegister.Rax]);
+        Assert.Equal(0xC002_2000u, ReadUInt32(memory, PacketAddress));
+        Assert.Equal(0x0003_1100u, ReadUInt32(memory, PacketAddress + 4));
+        Assert.Equal(unchecked((uint)PredicateAddress), ReadUInt32(memory, PacketAddress + 8));
+        Assert.Equal((uint)(PredicateAddress >> 32), ReadUInt32(memory, PacketAddress + 12));
+        Assert.Equal(PacketAddress + 16, ReadUInt64(memory, CommandBufferAddress + 0x10));
+    }
+
+    [Fact]
+    public void SetPacketPredication_TogglesPacketHeaderBit()
+    {
+        var memory = new FakeCpuMemory(BaseAddress, 0x1000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+        const uint header = 0xC003_1500;
+        WriteUInt32(memory, PacketAddress, header);
+
+        ctx[CpuRegister.Rdi] = PacketAddress;
+        ctx[CpuRegister.Rsi] = 1;
+        Assert.Equal(
+            (int)OrbisGen2Result.ORBIS_GEN2_OK,
+            AgcExports.SetPacketPredication(ctx));
+        Assert.Equal(header | 1u, ReadUInt32(memory, PacketAddress));
+
+        ctx[CpuRegister.Rsi] = 0;
+        Assert.Equal(
+            (int)OrbisGen2Result.ORBIS_GEN2_OK,
+            AgcExports.SetPacketPredication(ctx));
+        Assert.Equal(header, ReadUInt32(memory, PacketAddress));
+    }
+
+    private static uint ReadUInt32(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[4];
+        Assert.True(memory.TryRead(address, buffer));
+        return BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+    }
+
+    private static ulong ReadUInt64(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[8];
+        Assert.True(memory.TryRead(address, buffer));
+        return BinaryPrimitives.ReadUInt64LittleEndian(buffer);
+    }
+
+    private static void WriteUInt32(FakeCpuMemory memory, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[4];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        Assert.True(memory.TryWrite(address, buffer));
+    }
+
+    private static void WriteUInt64(FakeCpuMemory memory, ulong address, ulong value)
+    {
+        Span<byte> buffer = stackalloc byte[8];
+        BinaryPrimitives.WriteUInt64LittleEndian(buffer, value);
+        Assert.True(memory.TryWrite(address, buffer));
+    }
+}

tests/SharpEmu.Libs.Tests/Agc/AgcPrimStateHullVariantTests.cs

@@ -0,0 +1,66 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Agc;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+public sealed class AgcPrimStateHullVariantTests
+{
+    private const ulong BaseAddress = 0x1_0000_0000;
+    private const ulong CxRegistersAddress = BaseAddress + 0x100;
+    private const ulong UcRegistersAddress = BaseAddress + 0x200;
+    private const ulong HullStateAddress = BaseAddress + 0x300;
+    private const ulong GeometryShaderAddress = BaseAddress + 0x400;
+    private const ulong SpecialsAddress = BaseAddress + 0x500;
+
+    // Tessellation pipelines pass a non-null hull-state block; the
+    // geometry-derived register writes must still happen instead of an
+    // INVALID_ARGUMENT that leaves the caller's register storage as garbage.
+    [Fact]
+    public void CreatePrimState_AcceptsHullStateBlock()
+    {
+        var memory = new FakeCpuMemory(BaseAddress, 0x1000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        memory.TryWrite(GeometryShaderAddress + 0x5A, new byte[] { 2 });
+        WriteUInt64(memory, GeometryShaderAddress + 0x28, SpecialsAddress);
+
+        // Specials: {register, value} pairs at GeCntl 0x00, StagesEn 0x08,
+        // GsOutPrimType 0x20, GeUserVgprEn 0x28.
+        WriteUInt64(memory, SpecialsAddress + 0x00, 0x0000_0111_0000_0222UL);
+        WriteUInt64(memory, SpecialsAddress + 0x08, 0x0000_0333_0000_0444UL);
+        WriteUInt64(memory, SpecialsAddress + 0x20, 0x0000_0555_0000_0666UL);
+        WriteUInt64(memory, SpecialsAddress + 0x28, 0x0000_0777_0000_0888UL);
+
+        ctx[CpuRegister.Rdi] = CxRegistersAddress;
+        ctx[CpuRegister.Rsi] = UcRegistersAddress;
+        ctx[CpuRegister.Rdx] = HullStateAddress;
+        ctx[CpuRegister.Rcx] = GeometryShaderAddress;
+        ctx[CpuRegister.R8] = 0x11;
+
+        Assert.Equal(
+            (int)OrbisGen2Result.ORBIS_GEN2_OK,
+            AgcExports.CreatePrimState(ctx));
+
+        Assert.NotEqual(0u, ReadUInt32(memory, CxRegistersAddress));
+        Assert.Equal(0x11u, ReadUInt32(memory, UcRegistersAddress + 20));
+    }
+
+    private static void WriteUInt64(FakeCpuMemory memory, ulong address, ulong value)
+    {
+        Span<byte> bytes = stackalloc byte[sizeof(ulong)];
+        BinaryPrimitives.WriteUInt64LittleEndian(bytes, value);
+        Assert.True(memory.TryWrite(address, bytes));
+    }
+
+    private static uint ReadUInt32(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> value = stackalloc byte[sizeof(uint)];
+        Assert.True(memory.TryRead(address, value));
+        return BinaryPrimitives.ReadUInt32LittleEndian(value);
+    }
+}

tests/SharpEmu.Libs.Tests/Agc/AgcRectListIndexHelpersTests.cs

@@ -0,0 +1,95 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.Libs.Agc;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+/// <summary>
+/// Regression coverage for the AGC UI path: index8 expansion and rect-list
+/// vertex counts / topology selection.
+/// </summary>
+public sealed class AgcRectListIndexHelpersTests
+{
+    [Theory]
+    [InlineData(0u, 0u, 2)] // Index16
+    [InlineData(1u, 1u, 4)] // Index32
+    [InlineData(2u, 2u, 1)] // Index8
+    [InlineData(0x402u, 2u, 1)] // UC 0x400|size -> Index8
+    public void IndexType_DecodeAndStride_MatchProspero(uint raw, uint expected, int stride)
+    {
+        var decoded = AgcIndexHelpers.Decode(raw);
+        Assert.Equal((AgcIndexHelpers.ProsperoIndexType)expected, decoded);
+        Assert.Equal(stride, AgcIndexHelpers.GetGuestStrideBytes(decoded));
+    }
+
+    [Fact]
+    public void ExpandIndex8ToU16_PreservesValues()
+    {
+        ReadOnlySpan<byte> source = [0x00, 0x01, 0xFF, 0x7F];
+        Span<byte> destination = stackalloc byte[8];
+        AgcIndexHelpers.ExpandIndex8ToU16(source, destination);
+        Assert.Equal(0, BinaryPrimitives.ReadUInt16LittleEndian(destination[..2]));
+        Assert.Equal(1, BinaryPrimitives.ReadUInt16LittleEndian(destination.Slice(2, 2)));
+        Assert.Equal(255, BinaryPrimitives.ReadUInt16LittleEndian(destination.Slice(4, 2)));
+        Assert.Equal(127, BinaryPrimitives.ReadUInt16LittleEndian(destination.Slice(6, 2)));
+    }
+
+    [Theory]
+    // NGG single-rect UI (DualSense): expand even when VBs are present
+    [InlineData(7u, 3u, false, true, 4u)]
+    [InlineData(7u, 1u, false, false, 4u)]
+    [InlineData(7u, 4u, false, true, 4u)]
+    // Indexed / multi-vert auto: keep guest count (loading video)
+    [InlineData(7u, 3u, true, false, 3u)]
+    [InlineData(7u, 6u, false, true, 6u)]
+    [InlineData(7u, 4u, true, true, 4u)]
+    [InlineData(0x11u, 3u, false, false, 4u)]
+    [InlineData(0x11u, 6u, false, false, 6u)]
+    [InlineData(4u, 3u, false, false, 3u)]
+    public void RectListDrawVertexCount_MatchesExpansion(
+        uint primitiveType,
+        uint vertexCount,
+        bool indexed,
+        bool hasVertexBuffers,
+        uint expected)
+    {
+        Assert.Equal(
+            expected,
+            AgcPrimitiveHelpers.GetRectListDrawVertexCount(
+                primitiveType,
+                vertexCount,
+                indexed,
+                hasVertexBuffers));
+    }
+
+    [Theory]
+    [InlineData(7u, false, 3u, true, true)]
+    [InlineData(7u, false, 6u, true, false)]
+    [InlineData(7u, true, 3u, false, false)]
+    [InlineData(0x11u, false, 3u, true, true)]
+    [InlineData(0x11u, true, 3u, false, false)]
+    public void RectListTriangleStrip_MatchesGuards(
+        uint primitiveType,
+        bool indexed,
+        uint vertexCount,
+        bool hasVertexBuffers,
+        bool expected) =>
+        Assert.Equal(
+            expected,
+            AgcPrimitiveHelpers.ShouldDrawRectListAsTriangleStrip(
+                primitiveType,
+                indexed,
+                vertexCount,
+                hasVertexBuffers));
+
+    [Theory]
+    [InlineData(7u, (uint)AgcPrimitiveHelpers.GsOutputPrimitiveType.Rectangle2D)]
+    [InlineData(0x11u, (uint)AgcPrimitiveHelpers.GsOutputPrimitiveType.RectList)]
+    [InlineData(4u, (uint)AgcPrimitiveHelpers.GsOutputPrimitiveType.Triangles)]
+    [InlineData(1u, (uint)AgcPrimitiveHelpers.GsOutputPrimitiveType.Points)]
+    public void PrimitiveTypeToGsOut_MatchesProspero(uint primitiveType, uint expected) =>
+        Assert.Equal(expected, AgcPrimitiveHelpers.PrimitiveTypeToGsOut(primitiveType));
+}

tests/SharpEmu.Libs.Tests/Agc/AgcResourceOwnerTests.cs

@@ -0,0 +1,61 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Agc;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+public sealed class AgcResourceOwnerTests
+{
+    private const ulong BaseAddress = 0x1_0000_0000;
+    private const ulong OwnerAddress = BaseAddress + 0x100;
+    private const ulong NameAddress = BaseAddress + 0x200;
+    private const ulong RegistrationMemoryAddress = BaseAddress + 0x400;
+
+    [Fact]
+    public void RegisterOwner_DoesNotRequireOptionalResourceRegistryMemory()
+    {
+        var memory = new FakeCpuMemory(BaseAddress, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+        memory.WriteCString(NameAddress, "GIRender");
+        ctx[CpuRegister.Rdi] = OwnerAddress;
+        ctx[CpuRegister.Rsi] = NameAddress;
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, AgcExports.DriverRegisterOwner(ctx));
+        Assert.NotEqual(0u, ReadUInt32(memory, OwnerAddress));
+    }
+
+    [Fact]
+    public void RegisterOwner_RespectsExplicitRegistryCapacity()
+    {
+        var memory = new FakeCpuMemory(BaseAddress, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+        ctx[CpuRegister.Rdi] = RegistrationMemoryAddress;
+        ctx[CpuRegister.Rsi] = 0x1000;
+        ctx[CpuRegister.Rdx] = 1;
+        Assert.Equal(
+            (int)OrbisGen2Result.ORBIS_GEN2_OK,
+            AgcExports.DriverInitResourceRegistration(ctx));
+
+        memory.WriteCString(NameAddress, "First");
+        ctx[CpuRegister.Rdi] = OwnerAddress;
+        ctx[CpuRegister.Rsi] = NameAddress;
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, AgcExports.DriverRegisterOwner(ctx));
+
+        memory.WriteCString(NameAddress, "Second");
+        ctx[CpuRegister.Rdi] = OwnerAddress + 4;
+        Assert.Equal(
+            (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT,
+            AgcExports.DriverRegisterOwner(ctx));
+    }
+
+    private static uint ReadUInt32(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[4];
+        Assert.True(memory.TryRead(address, buffer));
+        return BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+    }
+}

tests/SharpEmu.Libs.Tests/Agc/AgcTextureTransportTests.cs

@@ -0,0 +1,106 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.Libs.Agc;
+using SharpEmu.Libs.Gpu;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+public sealed class AgcTextureTransportTests
+{
+    [Theory]
+    [InlineData(10u, 4u, 4u)]
+    [InlineData(10u, 0u, 1u)]
+    [InlineData(9u, 4u, 1u)]
+    [InlineData(13u, 4u, 1u)]
+    public void GetTextureVolumeDepth_OnlyUsesDescriptorDepthFor3D(
+        uint type,
+        uint descriptorDepth,
+        uint expectedDepth)
+    {
+        Assert.Equal(
+            expectedDepth,
+            AgcExports.GetTextureVolumeDepth(type, descriptorDepth));
+    }
+
+    [Fact]
+    public void GetTextureByteCount_MultipliesUncompressedVolumeDepth()
+    {
+        Assert.Equal(
+            4UL * 8 * 6 * 5,
+            AgcExports.GetTextureByteCount(
+                format: 10,
+                width: 8,
+                height: 6,
+                depth: 5));
+    }
+
+    [Fact]
+    public void GetTextureByteCount_MultipliesBlockCompressedVolumeDepth()
+    {
+        // Format 169 uses one eight-byte BC block for each 4x4 texel block.
+        Assert.Equal(
+            2UL * 2 * 8 * 3,
+            AgcExports.GetTextureByteCount(
+                format: 169,
+                width: 7,
+                height: 5,
+                depth: 3));
+    }
+
+    [Fact]
+    public void GetTextureByteCount_LeavesTwoDimensionalSizingUnchanged()
+    {
+        Assert.Equal(
+            AgcExports.GetTextureByteCount(10, 8, 6),
+            AgcExports.GetTextureByteCount(10, 8, 6, depth: 1));
+        Assert.Equal(
+            AgcExports.GetTextureByteCount(10, 8, 6),
+            AgcExports.GetTextureByteCount(10, 8, 6, depth: 0));
+    }
+
+    [Fact]
+    public void GuestDrawTexture_CarriesRawTypeAndNormalizedDepth()
+    {
+        var texture = new GuestDrawTexture(
+            Address: 0x1234,
+            Width: 8,
+            Height: 6,
+            Format: 10,
+            NumberType: 0,
+            RgbaPixels: [],
+            IsFallback: false,
+            IsStorage: false,
+            Type: 10,
+            Depth: 5);
+
+        Assert.Equal(10u, texture.Type);
+        Assert.Equal(5u, texture.Depth);
+    }
+
+    [Fact]
+    public void TextureContentIdentity_DistinguishesTypeAndDepth()
+    {
+        var twoDimensional = CreateIdentity(type: 9, depth: 1);
+        var threeDimensional = CreateIdentity(type: 10, depth: 1);
+        var deeperThreeDimensional = CreateIdentity(type: 10, depth: 5);
+
+        Assert.NotEqual(twoDimensional, threeDimensional);
+        Assert.NotEqual(threeDimensional, deeperThreeDimensional);
+    }
+
+    private static TextureContentIdentity CreateIdentity(uint type, uint depth) =>
+        new(
+            Address: 0x1234,
+            Width: 8,
+            Height: 6,
+            Format: 10,
+            NumberType: 0,
+            DstSelect: 0xFAC,
+            TileMode: 0,
+            Pitch: 8,
+            Sampler: default,
+            Type: type,
+            Depth: depth);
+}

tests/SharpEmu.Libs.Tests/Agc/AgcVertexMetadataTests.cs

@@ -0,0 +1,293 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Agc;
+using SharpEmu.ShaderCompiler;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+/// <summary>
+/// Coverage for AGC attrib-table → BufferFormat merge and semantic indexing.
+/// </summary>
+public sealed class AgcVertexMetadataTests
+{
+    [Fact]
+    public void BuildVertexResources_UsesSemanticNotHardwareMappingAsAttribIndex()
+    {
+        // input_semantics[0]: semantic=1, hardware_mapping=4, size=2
+        // If hardware_mapping were wrongly used as the attrib index, we'd read
+        // attrib[4] instead of attrib[1] and get the wrong format/offset.
+        const ulong memoryBase = 0x1_0000_0000;
+        var memory = new FakeCpuMemory(memoryBase, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        const ulong semanticsAddress = memoryBase + 0x100;
+        const ulong attribTable = memoryBase + 0x200;
+        const ulong bufferTable = memoryBase + 0x300;
+        const ulong sharpBase = memoryBase + 0x800;
+
+        // ShaderSemantic word: semantic=1, hw_mapping=4, size_in_elements=2
+        WriteUInt32(memory, semanticsAddress, 1u | (4u << 8) | (2u << 16));
+
+        // attrib[0] unused garbage
+        WriteUInt32(memory, attribTable, 0xDEAD_BEEFu);
+        // attrib[1]: buffer=0, format=k16_16Float(29), offset=8, fetch=0
+        WriteUInt32(memory, attribTable + 4, 0u | (29u << 5) | (8u << 14));
+
+        // V# at buffer table[0]: base=sharpBase, stride=16
+        WriteUInt32(memory, bufferTable, (uint)(sharpBase & 0xFFFF_FFFFUL));
+        WriteUInt32(
+            memory,
+            bufferTable + 4,
+            (uint)(sharpBase >> 32) | (16u << 16));
+
+        var scalars = new uint[32];
+        scalars[8] = (uint)(attribTable & 0xFFFF_FFFFUL);
+        scalars[9] = (uint)(attribTable >> 32);
+        scalars[10] = (uint)(bufferTable & 0xFFFF_FFFFUL);
+        scalars[11] = (uint)(bufferTable >> 32);
+
+        var tables = new AgcVertexMetadata.VertexTableRegisters(
+            VertexBufferReg: 10,
+            VertexAttribReg: 8,
+            InputSemanticsCount: 1,
+            InputSemanticsAddress: semanticsAddress);
+
+        Assert.True(
+            AgcVertexMetadata.TryBuildVertexResourcesFromMetadata(
+                ctx,
+                scalars,
+                tables,
+                out var resources));
+        Assert.Single(resources);
+        Assert.Equal(1u, resources[0].Semantic);
+        Assert.Equal(4u, resources[0].HardwareMapping);
+        Assert.Equal(8u, resources[0].OffsetBytes);
+        Assert.Equal(5u, resources[0].DataFormat); // R16G16
+        Assert.Equal(7u, resources[0].NumberFormat); // Float
+        Assert.Equal(2u, resources[0].ComponentCount);
+        Assert.Equal(sharpBase, resources[0].SharpBase);
+        Assert.False(resources[0].PerInstance);
+    }
+
+    [Fact]
+    public void MergeVertexInputs_OverlaysFormatWithoutRebasingCapture()
+    {
+        const ulong memoryBase = 0x1_0000_0000;
+        var memory = new FakeCpuMemory(memoryBase, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        const ulong semanticsAddress = memoryBase + 0x100;
+        const ulong attribTable = memoryBase + 0x200;
+        const ulong bufferTable = memoryBase + 0x300;
+        const ulong sharpBase = memoryBase + 0x800;
+
+        WriteUInt32(memory, semanticsAddress, 0u | (0u << 8) | (4u << 16));
+        // format k8_8_8_8UNorm(56), offset=12
+        WriteUInt32(memory, attribTable, 0u | (56u << 5) | (12u << 14));
+        WriteUInt32(memory, bufferTable, (uint)(sharpBase & 0xFFFF_FFFFUL));
+        WriteUInt32(memory, bufferTable + 4, (uint)(sharpBase >> 32) | (16u << 16));
+
+        var scalars = new uint[32];
+        scalars[4] = (uint)(attribTable & 0xFFFF_FFFFUL);
+        scalars[5] = (uint)(attribTable >> 32);
+        scalars[6] = (uint)(bufferTable & 0xFFFF_FFFFUL);
+        scalars[7] = (uint)(bufferTable >> 32);
+
+        var tables = new AgcVertexMetadata.VertexTableRegisters(
+            VertexBufferReg: 6,
+            VertexAttribReg: 4,
+            InputSemanticsCount: 1,
+            InputSemanticsAddress: semanticsAddress);
+
+        var data = new byte[64];
+        var discovered = new[]
+        {
+            new Gen5VertexInputBinding(
+                Pc: 0x40,
+                Location: 0,
+                ComponentCount: 4,
+                DataFormat: 14, // wrong IR guess
+                NumberFormat: 7,
+                BaseAddress: sharpBase,
+                Stride: 16,
+                OffsetBytes: 0,
+                Data: data,
+                DataLength: data.Length,
+                DataPooled: false),
+        };
+
+        var merged = AgcVertexMetadata.MergeVertexInputsFromMetadata(
+            ctx,
+            scalars,
+            tables,
+            discovered);
+        Assert.Single(merged);
+        Assert.Equal(0u, merged[0].Location);
+        Assert.Equal(sharpBase, merged[0].BaseAddress);
+        Assert.Same(data, merged[0].Data);
+        Assert.Equal(10u, merged[0].DataFormat); // RGBA8
+        Assert.Equal(0u, merged[0].NumberFormat); // Unorm
+        Assert.Equal(12u, merged[0].OffsetBytes);
+        Assert.Equal(0x40u, merged[0].Pc);
+    }
+
+    [Fact]
+    public void MergeVertexInputs_AcceptsVertexAttribFormatEnums()
+    {
+        // Attrib tables store VertexAttribFormat (227 = rgba8 unorm), not
+        // BufferFormat (56). Without conversion the format patch is a no-op.
+        const ulong memoryBase = 0x1_0000_0000;
+        var memory = new FakeCpuMemory(memoryBase, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        const ulong semanticsAddress = memoryBase + 0x100;
+        const ulong attribTable = memoryBase + 0x200;
+        const ulong bufferTable = memoryBase + 0x300;
+        const ulong sharpBase = memoryBase + 0x800;
+
+        WriteUInt32(memory, semanticsAddress, 0u | (0u << 8) | (4u << 16));
+        WriteUInt32(memory, attribTable, 0u | (227u << 5) | (12u << 14)); // VertexAttribFormat
+        WriteUInt32(memory, bufferTable, (uint)(sharpBase & 0xFFFF_FFFFUL));
+        WriteUInt32(memory, bufferTable + 4, (uint)(sharpBase >> 32) | (16u << 16));
+
+        var scalars = new uint[32];
+        scalars[4] = (uint)(attribTable & 0xFFFF_FFFFUL);
+        scalars[5] = (uint)(attribTable >> 32);
+        scalars[6] = (uint)(bufferTable & 0xFFFF_FFFFUL);
+        scalars[7] = (uint)(bufferTable >> 32);
+
+        var tables = new AgcVertexMetadata.VertexTableRegisters(
+            VertexBufferReg: 6,
+            VertexAttribReg: 4,
+            InputSemanticsCount: 1,
+            InputSemanticsAddress: semanticsAddress);
+
+        var data = new byte[64];
+        var discovered = new[]
+        {
+            new Gen5VertexInputBinding(
+                0x40, 0, 4, 14, 7, sharpBase, 16, 12, data, data.Length, false),
+        };
+
+        var merged = AgcVertexMetadata.MergeVertexInputsFromMetadata(
+            ctx,
+            scalars,
+            tables,
+            discovered);
+        Assert.Equal(10u, merged[0].DataFormat);
+        Assert.Equal(0u, merged[0].NumberFormat);
+        Assert.Equal(12u, merged[0].OffsetBytes);
+    }
+
+    [Fact]
+    public void MergeVertexInputs_MatchesInterleavedAttrsByOffsetNotBareBase()
+    {
+        // Both attributes share SharpBase. Matching by base alone would assign
+        // the color format to position (video/UI regression).
+        const ulong memoryBase = 0x1_0000_0000;
+        var memory = new FakeCpuMemory(memoryBase, 0x2000);
+        var ctx = new CpuContext(memory, Generation.Gen5);
+
+        const ulong semanticsAddress = memoryBase + 0x100;
+        const ulong attribTable = memoryBase + 0x200;
+        const ulong bufferTable = memoryBase + 0x300;
+        const ulong sharpBase = memoryBase + 0x800;
+
+        // semantic0 → pos float4 @0; semantic1 → color rgba8 @12
+        WriteUInt32(memory, semanticsAddress, 0u | (0u << 8) | (4u << 16));
+        WriteUInt32(memory, semanticsAddress + 4, 1u | (4u << 8) | (4u << 16));
+        WriteUInt32(memory, attribTable, 0u | (77u << 5) | (0u << 14)); // k32_32_32_32Float
+        WriteUInt32(memory, attribTable + 4, 0u | (56u << 5) | (12u << 14)); // rgba8unorm @12
+        WriteUInt32(memory, bufferTable, (uint)(sharpBase & 0xFFFF_FFFFUL));
+        WriteUInt32(memory, bufferTable + 4, (uint)(sharpBase >> 32) | (16u << 16));
+
+        var scalars = new uint[32];
+        scalars[4] = (uint)(attribTable & 0xFFFF_FFFFUL);
+        scalars[5] = (uint)(attribTable >> 32);
+        scalars[6] = (uint)(bufferTable & 0xFFFF_FFFFUL);
+        scalars[7] = (uint)(bufferTable >> 32);
+
+        var tables = new AgcVertexMetadata.VertexTableRegisters(
+            VertexBufferReg: 6,
+            VertexAttribReg: 4,
+            InputSemanticsCount: 2,
+            InputSemanticsAddress: semanticsAddress);
+
+        var data = new byte[64];
+        var discovered = new[]
+        {
+            new Gen5VertexInputBinding(
+                0x40, 0, 4, 14, 7, sharpBase, 16, 0, data, data.Length, false),
+            new Gen5VertexInputBinding(
+                0x80, 1, 4, 14, 7, sharpBase, 16, 12, data, data.Length, false),
+        };
+
+        var merged = AgcVertexMetadata.MergeVertexInputsFromMetadata(
+            ctx,
+            scalars,
+            tables,
+            discovered);
+        Assert.Equal(2, merged.Count);
+        Assert.Equal(0u, merged[0].OffsetBytes);
+        Assert.Equal(12u, merged[1].OffsetBytes);
+        Assert.Equal(0u, merged[1].NumberFormat); // Unorm color, not float
+        Assert.Equal(10u, merged[1].DataFormat); // RGBA8
+        Assert.Equal(sharpBase, merged[0].BaseAddress);
+        Assert.Equal(sharpBase, merged[1].BaseAddress);
+        Assert.Same(data, merged[0].Data);
+    }
+
+    [Fact]
+    public void CollectFetchPrologPcs_FindsSBufferLoadsFromTableRegisters()
+    {
+        var tables = new AgcVertexMetadata.VertexTableRegisters(
+            VertexBufferReg: 10,
+            VertexAttribReg: 8,
+            InputSemanticsCount: 1,
+            InputSemanticsAddress: 1);
+
+        var program = new Gen5ShaderProgram(
+            0,
+            [
+                new Gen5ShaderInstruction(
+                    0x10,
+                    Gen5ShaderEncoding.Smem,
+                    "SBufferLoadDword",
+                    Words: [],
+                    Sources: [Gen5Operand.Scalar(8)],
+                    Destinations: [Gen5Operand.Scalar(20)],
+                    new Gen5ScalarMemoryControl(1, 0, null)),
+                new Gen5ShaderInstruction(
+                    0x20,
+                    Gen5ShaderEncoding.Smem,
+                    "SBufferLoadDword",
+                    Words: [],
+                    Sources: [Gen5Operand.Scalar(12)],
+                    Destinations: [Gen5Operand.Scalar(24)],
+                    new Gen5ScalarMemoryControl(1, 0, null)),
+                new Gen5ShaderInstruction(
+                    0x30,
+                    Gen5ShaderEncoding.Sopp,
+                    "SEndpgm",
+                    Words: [],
+                    Sources: [],
+                    Destinations: [],
+                    null),
+            ]);
+
+        var pcs = AgcVertexMetadata.CollectFetchPrologPcs(program, tables);
+        Assert.Contains(0x10u, pcs);
+        Assert.DoesNotContain(0x20u, pcs);
+    }
+
+    private static void WriteUInt32(FakeCpuMemory memory, ulong address, uint value)
+    {
+        Span<byte> bytes = stackalloc byte[4];
+        BinaryPrimitives.WriteUInt32LittleEndian(bytes, value);
+        Assert.True(memory.TryWrite(address, bytes));
+    }
+}

tests/SharpEmu.Libs.Tests/Agc/AgcWaitRegMemTests.cs

@@ -0,0 +1,133 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Agc;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+public sealed class AgcWaitRegMemTests
+{
+    private const ulong BaseAddress = 0x1_0000_0000;
+    private const ulong CommandBufferAddress = BaseAddress + 0x100;
+    private const ulong PacketAddress = BaseAddress + 0x400;
+    private const ulong StackAddress = BaseAddress + 0x800;
+
+    [Fact]
+    public void DcbWaitRegMem32_EmitsGen5PacketLayout()
+    {
+        var memory = CreateMemory(out var ctx);
+        var waitAddress = BaseAddress + 0xC03;
+
+        ctx[CpuRegister.Rdi] = CommandBufferAddress;
+        ctx[CpuRegister.Rsi] = 0;
+        ctx[CpuRegister.Rdx] = 3;
+        ctx[CpuRegister.Rcx] = 4;
+        ctx[CpuRegister.R8] = 2;
+        ctx[CpuRegister.R9] = waitAddress;
+        WriteUInt64(memory, StackAddress + 8, 0x1122_3344_5566_7788);
+        WriteUInt64(memory, StackAddress + 16, 0xAABB_CCDD_EEFF_0011);
+        WriteUInt32(memory, StackAddress + 24, 0x123456);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, AgcExports.DcbWaitRegMem(ctx));
+        Assert.Equal(PacketAddress, ctx[CpuRegister.Rax]);
+        Assert.Equal(0xC005_1028u, ReadUInt32(memory, PacketAddress));
+        Assert.Equal(0x0000_0C00u, ReadUInt32(memory, PacketAddress + 4));
+        Assert.Equal(1u, ReadUInt32(memory, PacketAddress + 8));
+        Assert.Equal(0xEEFF_0011u, ReadUInt32(memory, PacketAddress + 12));
+        Assert.Equal(0x5566_7788u, ReadUInt32(memory, PacketAddress + 16));
+        Assert.Equal(0x0400_0053u, ReadUInt32(memory, PacketAddress + 20));
+        Assert.Equal(0xFFFFu, ReadUInt32(memory, PacketAddress + 24));
+        Assert.Equal(PacketAddress + 28, ReadUInt64(memory, CommandBufferAddress + 0x10));
+    }
+
+    [Fact]
+    public void DcbWaitRegMem64_EmitsGen5PacketLayout()
+    {
+        var memory = CreateMemory(out var ctx);
+        var waitAddress = BaseAddress + 0xC07;
+
+        ctx[CpuRegister.Rdi] = CommandBufferAddress;
+        ctx[CpuRegister.Rsi] = 1;
+        ctx[CpuRegister.Rdx] = 6;
+        ctx[CpuRegister.Rcx] = 3;
+        ctx[CpuRegister.R8] = 1;
+        ctx[CpuRegister.R9] = waitAddress;
+        WriteUInt64(memory, StackAddress + 8, 0x1122_3344_5566_7788);
+        WriteUInt64(memory, StackAddress + 16, 0xAABB_CCDD_EEFF_0011);
+        WriteUInt32(memory, StackAddress + 24, 0x320);
+
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, AgcExports.DcbWaitRegMem(ctx));
+        Assert.Equal(0xC007_1058u, ReadUInt32(memory, PacketAddress));
+        Assert.Equal(0x0000_0C00u, ReadUInt32(memory, PacketAddress + 4));
+        Assert.Equal(1u, ReadUInt32(memory, PacketAddress + 8));
+        Assert.Equal(0xEEFF_0011u, ReadUInt32(memory, PacketAddress + 12));
+        Assert.Equal(0xAABB_CCDDu, ReadUInt32(memory, PacketAddress + 16));
+        Assert.Equal(0x5566_7788u, ReadUInt32(memory, PacketAddress + 20));
+        Assert.Equal(0x1122_3344u, ReadUInt32(memory, PacketAddress + 24));
+        Assert.Equal(0x0200_0156u, ReadUInt32(memory, PacketAddress + 28));
+        Assert.Equal(0x32u, ReadUInt32(memory, PacketAddress + 32));
+    }
+
+    [Fact]
+    public void WaitRegMemPatchFunctions_UseGen5Fields()
+    {
+        var memory = CreateMemory(out var ctx);
+        WriteUInt32(memory, PacketAddress, 0xC005_1028);
+        WriteUInt32(memory, PacketAddress + 20, 0x0400_0153);
+
+        ctx[CpuRegister.Rdi] = PacketAddress;
+        ctx[CpuRegister.Rsi] = BaseAddress + 0xD07;
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, AgcExports.WaitRegMemPatchAddress(ctx));
+        Assert.Equal(0x0000_0D04u, ReadUInt32(memory, PacketAddress + 4));
+        Assert.Equal(1u, ReadUInt32(memory, PacketAddress + 8));
+
+        ctx[CpuRegister.Rsi] = 5;
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, AgcExports.WaitRegMemPatchCompareFunction(ctx));
+        Assert.Equal(0x0400_0155u, ReadUInt32(memory, PacketAddress + 20));
+
+        ctx[CpuRegister.Rsi] = 0xDEAD_BEEF;
+        Assert.Equal((int)OrbisGen2Result.ORBIS_GEN2_OK, AgcExports.WaitRegMemPatchReference(ctx));
+        Assert.Equal(0xDEAD_BEEFu, ReadUInt32(memory, PacketAddress + 16));
+    }
+
+    private static FakeCpuMemory CreateMemory(out CpuContext ctx)
+    {
+        var memory = new FakeCpuMemory(BaseAddress, 0x2000);
+        ctx = new CpuContext(memory, Generation.Gen5);
+        ctx[CpuRegister.Rsp] = StackAddress;
+        WriteUInt64(memory, CommandBufferAddress + 0x10, PacketAddress);
+        WriteUInt64(memory, CommandBufferAddress + 0x18, PacketAddress + 0x100);
+        return memory;
+    }
+
+    private static uint ReadUInt32(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[4];
+        Assert.True(memory.TryRead(address, buffer));
+        return BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+    }
+
+    private static ulong ReadUInt64(FakeCpuMemory memory, ulong address)
+    {
+        Span<byte> buffer = stackalloc byte[8];
+        Assert.True(memory.TryRead(address, buffer));
+        return BinaryPrimitives.ReadUInt64LittleEndian(buffer);
+    }
+
+    private static void WriteUInt32(FakeCpuMemory memory, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[4];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        Assert.True(memory.TryWrite(address, buffer));
+    }
+
+    private static void WriteUInt64(FakeCpuMemory memory, ulong address, ulong value)
+    {
+        Span<byte> buffer = stackalloc byte[8];
+        BinaryPrimitives.WriteUInt64LittleEndian(buffer, value);
+        Assert.True(memory.TryWrite(address, buffer));
+    }
+}

tests/SharpEmu.Libs.Tests/Agc/DetileComputeSpirvTests.cs

@@ -0,0 +1,102 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using SharpEmu.ShaderCompiler.Vulkan;
+using Xunit;
+
+namespace SharpEmu.Libs.Tests.Agc;
+
+// Structural validation of the GPU detile compute kernel. This cannot run the
+// shader without a Vulkan device, but it pins the SPIR-V is well-formed: the
+// header is correct, every instruction's word count sums to exactly the module
+// length (the classic hand-emit bug), and the compute-specific pieces are
+// present (a GLCompute entry point, a LocalSize execution mode, and a runtime
+// array for the storage buffers). Full pixel correctness is verified on a GPU.
+public sealed class DetileComputeSpirvTests
+{
+    private const uint SpirvMagic = 0x07230203;
+    private const uint SpirvVersion15 = 0x00010500;
+
+    private const ushort OpEntryPoint = 15;
+    private const ushort OpExecutionMode = 16;
+    private const ushort OpTypeRuntimeArray = 29;
+    private const ushort OpFunction = 54;
+    private const ushort OpFunctionEnd = 56;
+
+    private const uint ExecutionModelGLCompute = 5;
+    private const uint ExecutionModeLocalSize = 17;
+
+    [Fact]
+    public void CreateDetileCompute_EmitsWellFormedComputeModule()
+    {
+        var spirv = SpirvFixedShaders.CreateDetileCompute();
+
+        Assert.True(spirv.Length % sizeof(uint) == 0, "SPIR-V must be a whole number of words.");
+        var words = new uint[spirv.Length / sizeof(uint)];
+        for (var i = 0; i < words.Length; i++)
+        {
+            words[i] = BinaryPrimitives.ReadUInt32LittleEndian(spirv.AsSpan(i * sizeof(uint)));
+        }
+
+        Assert.True(words.Length > 5, "Module must have a header plus instructions.");
+        Assert.Equal(SpirvMagic, words[0]);
+        Assert.Equal(SpirvVersion15, words[1]);
+
+        var bound = words[3];
+        Assert.True(bound > 1, "Id bound must be set.");
+
+        var sawComputeEntry = false;
+        var sawLocalSize = false;
+        var sawRuntimeArray = false;
+        var functionCount = 0;
+        var functionEndCount = 0;
+
+        var offset = 5;
+        while (offset < words.Length)
+        {
+            var word = words[offset];
+            var wordCount = (int)(word >> 16);
+            var opcode = (ushort)(word & 0xFFFF);
+
+            Assert.True(wordCount >= 1, $"Instruction at {offset} has a zero word count.");
+            Assert.True(
+                offset + wordCount <= words.Length,
+                $"Instruction at {offset} (op {opcode}, wc {wordCount}) overruns the module.");
+
+            switch (opcode)
+            {
+                case OpEntryPoint when words[offset + 1] == ExecutionModelGLCompute:
+                    sawComputeEntry = true;
+                    break;
+                case OpExecutionMode
+                    when wordCount >= 6 &&
+                         words[offset + 2] == ExecutionModeLocalSize &&
+                         words[offset + 3] == 8 &&
+                         words[offset + 4] == 8 &&
+                         words[offset + 5] == 1:
+                    sawLocalSize = true;
+                    break;
+                case OpTypeRuntimeArray:
+                    sawRuntimeArray = true;
+                    break;
+                case OpFunction:
+                    functionCount++;
+                    break;
+                case OpFunctionEnd:
+                    functionEndCount++;
+                    break;
+            }
+
+            offset += wordCount;
+        }
+
+        // Word counts must tile the module exactly — a wrong length lands here.
+        Assert.Equal(words.Length, offset);
+        Assert.True(sawComputeEntry, "Missing a GLCompute OpEntryPoint.");
+        Assert.True(sawLocalSize, "Missing an 8x8x1 LocalSize execution mode.");
+        Assert.True(sawRuntimeArray, "Missing a runtime array (storage buffers).");
+        Assert.Equal(1, functionCount);
+        Assert.Equal(1, functionEndCount);
+    }
+}