[npManager] initial Network Platform implement (just set game title etc.)

[ampr] new exports
[memory] trampoline fixes

Directory.Packages.props

@@ -9,5 +9,8 @@ SPDX-License-Identifier: GPL-2.0-or-later
   </PropertyGroup>
   <ItemGroup>
     <PackageVersion Include="Iced" Version="1.21.0" />
+    <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
+    <PackageVersion Include="Silk.NET.Vulkan.Extensions.KHR" Version="2.23.0" />
+    <PackageVersion Include="Silk.NET.Windowing" Version="2.23.0" />
   </ItemGroup>
 </Project>

REUSE.toml

@@ -7,7 +7,8 @@ path = [
     "**/packages.lock.json",
     "scripts/ps5_names.txt",
     "src/SharpEmu.HLE/Aerolib/aerolib.bin",
-    "_logs/**"
+    "_logs/**",
+    ".github/images/**"
 ]
 precedence = "aggregate"
 SPDX-FileCopyrightText = "SharpEmu Emulator Project"

src/SharpEmu.CLI/packages.lock.json

@@ -8,6 +8,62 @@
         "resolved": "10.0.3",
         "contentHash": "0B6nZyCHWXnvmlB559oduOspVdNOnpNXPjhpWVMovLPAsDVG7A4jJR9rzECf67JUzxP8/ee/wA8clwIzJcWNFA=="
       },
+      "Microsoft.DotNet.PlatformAbstractions": {
+        "type": "Transitive",
+        "resolved": "3.1.6",
+        "contentHash": "jek4XYaQ/PGUwDKKhwR8K47Uh1189PFzMeLqO83mXrXQVIpARZCcfuDedH50YDTepBkfijCZN5U/vZi++erxtg=="
+      },
+      "Microsoft.Extensions.DependencyModel": {
+        "type": "Transitive",
+        "resolved": "9.0.9",
+        "contentHash": "fNGvKct2De8ghm0Bpfq0iWthtzIWabgOTi+gJhNOPhNJIowXNEUE2eZNW/zNCzrHVA3PXg2yZ+3cWZndC2IqYA=="
+      },
+      "Silk.NET.Core": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "D7AT/nnwlB+4RZ84XY8QNGBZMJI5z9l4CSSETIJ1wCfRJzRt/341y3MRZ4HbnFz4r/IGaWOEZr86iE+0/65yyQ==",
+        "dependencies": {
+          "Microsoft.DotNet.PlatformAbstractions": "3.1.6",
+          "Microsoft.Extensions.DependencyModel": "9.0.9"
+        }
+      },
+      "Silk.NET.GLFW": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "UIs4sH57xlPUNHQ/1bt9rymPWlGy8IMDCNv86h0iM4TOA1CkIx0XM/n/tA4AReh1zQkNrvkxPEdZ3Blvy1dyXg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Ultz.Native.GLFW": "3.4.0"
+        }
+      },
+      "Silk.NET.Maths": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "r8PdIVzME8EH0qAgbmRPO87I4GfgR2j8TofT7EMuRJDf1QluoQwnVypDoFJjQ2ZBSRsGYk5unYxxogI05Ogsmw=="
+      },
+      "Silk.NET.Windowing.Common": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "ThStSinmY9KQI8DGiF5XEhkLJVnBcgRTBTzL9ijg1wMZAYuckz7ykrNw04fjRm2Gryh6tCNGbvz2XaY0efeFzg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Maths": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing.Glfw": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "aYBudKmENmvLRn9p15HbdvlQTnnXskcDfTfbYwSb/4fr263rGLwYuDw/txUEc2jihHJiWCp5+75Y7z5wTJWl7g==",
+        "dependencies": {
+          "Silk.NET.GLFW": "2.23.0",
+          "Silk.NET.Windowing.Common": "2.23.0"
+        }
+      },
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      },
       "sharpemu.core": {
         "type": "Project",
         "dependencies": {
@@ -23,7 +79,10 @@
       "sharpemu.libs": {
         "type": "Project",
         "dependencies": {
-          "SharpEmu.HLE": "[1.0.0, )"
+          "SharpEmu.HLE": "[1.0.0, )",
+          "Silk.NET.Vulkan": "[2.23.0, )",
+          "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
+          "Silk.NET.Windowing": "[2.23.0, )"
         }
       },
       "sharpemu.logging": {
@@ -34,10 +93,57 @@
         "requested": "[1.21.0, )",
         "resolved": "1.21.0",
         "contentHash": "dv5+81Q1TBQvVMSOOOmRcjJmvWcX3BZPZsIq31+RLc5cNft0IHAyNlkdb7ZarOWG913PyBoFDsDXoCIlKmLclg=="
+      },
+      "Silk.NET.Vulkan": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "3/irtlSWXZ3eTi8N6nelI6L34NTB8ZJHpqVMNzZx2aX7Ek9YEQ34NoQW8/Tljrtmkg8KRhHW8hKTEzZaKV8PgA==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0"
+        }
+      },
+      "Silk.NET.Vulkan.Extensions.KHR": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "uRaf4j+SmH3DumjSSSUbFg33BnsGZUyXGj93O9NgGKZSJN3OTmNmQDxRew+/KiVLcgH6qzbto8aNGZ++j9GFWg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "OPNPmt/lRyUKVYrFLQXVxyATqD3MKLc1iY1oKx1/2GppgmZxVZPwN12tekrQ4C7408kgB1L5JD1Wnirqqeb2kg==",
+        "dependencies": {
+          "Silk.NET.Windowing.Common": "2.23.0",
+          "Silk.NET.Windowing.Glfw": "2.23.0"
+        }
       }
     },
-    "net10.0/linux-x64": {},
-    "net10.0/osx-arm64": {},
-    "net10.0/win-x64": {}
+    "net10.0/linux-x64": {
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      }
+    },
+    "net10.0/osx-arm64": {
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      }
+    },
+    "net10.0/win-x64": {
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      }
+    }
   }
 }

src/SharpEmu.Core/Cpu/CpuDispatcher.cs

@@ -22,6 +22,7 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
     private const ulong StackSize = 0x0020_0000UL;
     private const ulong TlsBaseAddress = 0x7FFE_0000_0000UL;
     private const ulong TlsSize = 0x0001_0000UL;
+    private const ulong TlsPrefixSize = 0x0000_1000UL;
     private const ulong BootstrapStubBaseAddress = 0x7FFD_F000_0000UL;
     private const ulong BootstrapPayloadBaseAddress = 0x7FFD_E000_0000UL;
     private const ulong DynlibFallbackStubBaseAddress = 0x7FFD_D000_0000UL;
@@ -342,11 +343,12 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         for (var i = 0; i < 32; i++)
         {
             var candidateBase = TlsBaseAddress - ((ulong)i * tlsStride);
+            var mappedBase = candidateBase - TlsPrefixSize;
             try
             {
                 _virtualMemory.Map(
-                    candidateBase,
-                    TlsSize,
+                    mappedBase,
+                    TlsSize + TlsPrefixSize,
                     fileOffset: 0,
                     fileData: ReadOnlySpan<byte>.Empty,
                     ProgramHeaderFlags.Read | ProgramHeaderFlags.Write);
@@ -363,9 +365,11 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
 
     private static bool InitializeTls(CpuContext context, ulong tlsBase)
     {
-        return context.TryWriteUInt64(tlsBase + 0x00, tlsBase) &&
+        return context.TryWriteUInt64(tlsBase - 0xF0, 0) &&
+               context.TryWriteUInt64(tlsBase + 0x00, tlsBase) &&
                context.TryWriteUInt64(tlsBase + 0x10, tlsBase) &&
-               context.TryWriteUInt64(tlsBase + 0x28, 0xC0DEC0DECAFEBABEUL);
+               context.TryWriteUInt64(tlsBase + 0x28, 0xC0DEC0DECAFEBABEUL) &&
+               context.TryWriteUInt64(tlsBase + 0x60, tlsBase);
     }
 
     private static bool InitializeGuestFrameChainSentinel(CpuContext context)
@@ -420,6 +424,13 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
             return false;
         }
 
+        var entryStackPointer = entryParamsAddress - sizeof(ulong);
+        if (!context.TryWriteUInt64(entryStackPointer, 0))
+        {
+            return false;
+        }
+
+        context[CpuRegister.Rsp] = entryStackPointer;
         context[CpuRegister.Rdi] = entryParamsAddress;
         context[CpuRegister.Rsi] = programExitHandlerAddress;
         context[CpuRegister.Rdx] = 0;

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Diagnostics.cs

@@ -97,12 +97,13 @@ public sealed partial class DirectExecutionBackend
 
 	private void ProbeReturnRip(ulong returnRip, long dispatchIndex)
 	{
-		if (_cpuContext == null || returnRip == 0)
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null || returnRip == 0)
 		{
 			return;
 		}
 		Span<byte> destination = stackalloc byte[128];
-		if (!_cpuContext.Memory.TryRead(returnRip, destination))
+		if (!cpuContext.Memory.TryRead(returnRip, destination))
 		{
 			Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} return-rip probe: unreadable @0x{returnRip:X16}");
 			return;
@@ -113,7 +114,7 @@ public sealed partial class DirectExecutionBackend
 		{
 			int num = BitConverter.ToInt32(destination.Slice(2, 4));
 			ulong num2 = returnRip + 6 + (ulong)num;
-			if (_cpuContext.TryReadUInt64(num2, out var value2))
+			if (cpuContext.TryReadUInt64(num2, out var value2))
 			{
 				Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} return-rip slot: [0x{num2:X16}] = 0x{value2:X16}");
 			}
@@ -122,7 +123,7 @@ public sealed partial class DirectExecutionBackend
 		{
 			int num3 = BitConverter.ToInt32(destination.Slice(3, 4));
 			ulong num4 = returnRip + 7 + (ulong)num3;
-			if (_cpuContext.TryReadUInt64(num4, out var value3))
+			if (cpuContext.TryReadUInt64(num4, out var value3))
 			{
 				Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} return-rip mov-slot: [0x{num4:X16}] = 0x{value3:X16}");
 			}
@@ -134,12 +135,82 @@ public sealed partial class DirectExecutionBackend
 				int num5 = BitConverter.ToInt32(destination.Slice(i + 2, 4));
 				ulong num6 = returnRip + (ulong)i;
 				ulong num7 = num6 + 6 + (ulong)num5;
-				if (_cpuContext.TryReadUInt64(num7, out var value4))
+				if (cpuContext.TryReadUInt64(num7, out var value4))
 				{
 					Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} near-indirect @{num6:X16}: slot=0x{num7:X16} val=0x{value4:X16}");
 				}
 			}
 		}
+		Span<byte> targetBytes = stackalloc byte[32];
+		for (int i = 0; i + 5 <= destination.Length; i++)
+		{
+			if (destination[i] != 0xE8)
+			{
+				continue;
+			}
+
+			int rel32 = BitConverter.ToInt32(destination.Slice(i + 1, 4));
+			ulong callRip = returnRip + (ulong)i;
+			ulong target = unchecked((ulong)((long)(callRip + 5) + rel32));
+			Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} near-call @{callRip:X16}: target=0x{target:X16}");
+			for (int importIndex = 0; importIndex < _importEntries.Length; importIndex++)
+			{
+				if (_importEntries[importIndex].Address != target)
+				{
+					continue;
+				}
+
+				string nid = _importEntries[importIndex].Nid;
+				if (_moduleManager.TryGetExport(nid, out var export))
+				{
+					Console.Error.WriteLine(
+						$"[LOADER][TRACE] Import#{dispatchIndex} near-call import: index={importIndex} {export.LibraryName}:{export.Name} ({nid})");
+				}
+				else
+				{
+					Console.Error.WriteLine(
+						$"[LOADER][TRACE] Import#{dispatchIndex} near-call import: index={importIndex} nid={nid}");
+				}
+				break;
+			}
+
+			if (cpuContext.Memory.TryRead(target, targetBytes))
+			{
+				Console.Error.WriteLine(
+					$"[LOADER][TRACE] Import#{dispatchIndex} near-call target bytes @0x{target:X16}: " +
+					BitConverter.ToString(targetBytes.ToArray()).Replace("-", " "));
+				if (targetBytes[0] == 0xFF && targetBytes[1] == 0x25)
+				{
+					int slotRel32 = BitConverter.ToInt32(targetBytes.Slice(2, 4));
+					ulong slot = unchecked((ulong)((long)(target + 6) + slotRel32));
+					if (cpuContext.TryReadUInt64(slot, out var slotTarget))
+					{
+						Console.Error.WriteLine(
+							$"[LOADER][TRACE] Import#{dispatchIndex} near-call PLT slot: [0x{slot:X16}] = 0x{slotTarget:X16}");
+						for (int importIndex = 0; importIndex < _importEntries.Length; importIndex++)
+						{
+							if (_importEntries[importIndex].Address != slotTarget)
+							{
+								continue;
+							}
+
+							string nid = _importEntries[importIndex].Nid;
+							if (_moduleManager.TryGetExport(nid, out var export))
+							{
+								Console.Error.WriteLine(
+									$"[LOADER][TRACE] Import#{dispatchIndex} near-call PLT import: index={importIndex} {export.LibraryName}:{export.Name} ({nid})");
+							}
+							else
+							{
+								Console.Error.WriteLine(
+									$"[LOADER][TRACE] Import#{dispatchIndex} near-call PLT import: index={importIndex} nid={nid}");
+							}
+							break;
+						}
+					}
+				}
+			}
+		}
 	}
 
 	private static bool IsUnresolvedSentinel(ulong value)

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Exceptions.cs

@@ -7,6 +7,7 @@ using System.Collections.Generic;
 using System.Globalization;
 using System.Reflection;
 using System.Runtime.InteropServices;
+using System.Threading;
 using SharpEmu.Core.Cpu.Disasm;
 using SharpEmu.HLE;
 
@@ -18,7 +19,12 @@ public sealed partial class DirectExecutionBackend
 	{
 		if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_RAW_HANDLER"), "1", StringComparison.Ordinal))
 		{
-			_rawExceptionHandler = (nint)AddVectoredExceptionHandler(1u, RawVectoredHandlerPtrManaged);
+			_rawExceptionHandlerStub = CreateExceptionHandlerTrampoline(RawVectoredHandlerPtrManaged);
+			if (_rawExceptionHandlerStub == 0)
+			{
+				throw new InvalidOperationException("Failed to create raw exception handler trampoline");
+			}
+			_rawExceptionHandler = (nint)AddVectoredExceptionHandler(1u, _rawExceptionHandlerStub);
 			Console.Error.WriteLine($"[LOADER][INFO] Raw exception handler installed: 0x{_rawExceptionHandler:X16}");
 		}
 		else
@@ -28,12 +34,22 @@ public sealed partial class DirectExecutionBackend
 
 		_handlerDelegate = VectoredHandler;
 		_handlerHandle = GCHandle.Alloc(_handlerDelegate);
-		_exceptionHandler = (nint)AddVectoredExceptionHandler(1u, Marshal.GetFunctionPointerForDelegate(_handlerDelegate));
+		_exceptionHandlerStub = CreateExceptionHandlerTrampoline(Marshal.GetFunctionPointerForDelegate(_handlerDelegate));
+		if (_exceptionHandlerStub == 0)
+		{
+			throw new InvalidOperationException("Failed to create exception handler trampoline");
+		}
+		_exceptionHandler = (nint)AddVectoredExceptionHandler(1u, _exceptionHandlerStub);
 		Console.Error.WriteLine($"[LOADER][INFO] Exception handler installed: 0x{_exceptionHandler:X16}");
 
 		_unhandledFilterDelegate = UnhandledExceptionFilter;
 		_unhandledFilterHandle = GCHandle.Alloc(_unhandledFilterDelegate);
-		SetUnhandledExceptionFilter(Marshal.GetFunctionPointerForDelegate(_unhandledFilterDelegate));
+		_unhandledFilterStub = CreateExceptionHandlerTrampoline(Marshal.GetFunctionPointerForDelegate(_unhandledFilterDelegate));
+		if (_unhandledFilterStub == 0)
+		{
+			throw new InvalidOperationException("Failed to create unhandled exception filter trampoline");
+		}
+		SetUnhandledExceptionFilter(_unhandledFilterStub);
 	}
 
 	private unsafe int UnhandledExceptionFilter(void* exceptionInfo)
@@ -61,7 +77,7 @@ public sealed partial class DirectExecutionBackend
 	{
 		if (_vectoredHandlerDepth > 0)
 		{
-			Console.Error.WriteLine("[LOADER][TRACE] Nested VEH exception; passing through.");
+			LogNestedVectoredException(exceptionInfo);
 			Console.Error.Flush();
 			return 0;
 		}
@@ -84,10 +100,18 @@ public sealed partial class DirectExecutionBackend
 			ulong rip = ReadCtxU64(contextRecord, 248);
 			ulong rsp = ReadCtxU64(contextRecord, 152);
 
-			if (exceptionCode == 3221225477u && TryHandleLazyCommittedPage(exceptionRecord))
+			if (exceptionCode == 3221225477u && TryHandleLazyCommittedPage(exceptionRecord, rip, rsp))
 			{
 				return -1;
 			}
+			if (IsBenignHostDebugException(exceptionCode))
+			{
+				return -1;
+			}
+			if (exceptionCode == MSVC_CPP_EXCEPTION)
+			{
+				return 0;
+			}
 
 			switch (exceptionCode)
 			{
@@ -278,6 +302,37 @@ public sealed partial class DirectExecutionBackend
 		}
 	}
 
+	private static bool IsBenignHostDebugException(uint exceptionCode)
+	{
+		return exceptionCode is DBG_PRINTEXCEPTION_C or DBG_PRINTEXCEPTION_WIDE_C or MS_VC_THREADNAME_EXCEPTION;
+	}
+
+	private unsafe static void LogNestedVectoredException(void* exceptionInfo)
+	{
+		int count = Interlocked.Increment(ref _nestedVehTraceCount);
+		if (count > 16 && count % 128 != 0)
+		{
+			return;
+		}
+
+		try
+		{
+			EXCEPTION_POINTERS* pointers = (EXCEPTION_POINTERS*)exceptionInfo;
+			EXCEPTION_RECORD* record = pointers->ExceptionRecord;
+			void* contextRecord = pointers->ContextRecord;
+			ulong rip = contextRecord != null ? ReadCtxU64(contextRecord, 248) : 0;
+			ulong rsp = contextRecord != null ? ReadCtxU64(contextRecord, 152) : 0;
+			ulong accessType = record->NumberParameters >= 1 ? *record->ExceptionInformation : 0;
+			ulong target = record->NumberParameters >= 2 ? record->ExceptionInformation[1] : 0;
+			Console.Error.WriteLine(
+				$"[LOADER][TRACE] Nested VEH exception#{count}: code=0x{record->ExceptionCode:X8} ex=0x{(ulong)record->ExceptionAddress:X16} rip=0x{rip:X16} rsp=0x{rsp:X16} type={accessType} target=0x{target:X16}; passing through.");
+		}
+		catch
+		{
+			Console.Error.WriteLine($"[LOADER][TRACE] Nested VEH exception#{count}; passing through.");
+		}
+	}
+
 	private unsafe void LogAccessViolationTrace(ulong exceptionAddress, EXCEPTION_RECORD* exceptionRecord)
 	{
 		ulong accessType = exceptionRecord->NumberParameters >= 1 ? (*exceptionRecord->ExceptionInformation) : 0;
@@ -828,7 +883,7 @@ public sealed partial class DirectExecutionBackend
 		return true;
 	}
 
-	private unsafe static bool TryHandleLazyCommittedPage(EXCEPTION_RECORD* exceptionRecord)
+	private unsafe bool TryHandleLazyCommittedPage(EXCEPTION_RECORD* exceptionRecord, ulong rip, ulong rsp)
 	{
 		if (exceptionRecord->NumberParameters < 2)
 		{
@@ -845,6 +900,10 @@ public sealed partial class DirectExecutionBackend
 		{
 			return false;
 		}
+		if (!IsGuestOwnedLazyCommitAddress(faultAddress, out var owner))
+		{
+			return false;
+		}
 		if (VirtualQuery((void*)faultAddress, out var mbi, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0)
 		{
 			return false;
@@ -852,7 +911,7 @@ public sealed partial class DirectExecutionBackend
 
 		ulong pageBase = faultAddress & 0xFFFFFFFFFFFFF000uL;
 		uint commitProtect = ResolveLazyCommitProtection(accessType, mbi.AllocationProtect);
-		Console.Error.WriteLine($"[LOADER][TRACE] lazy-query: fault=0x{faultAddress:X16} state=0x{mbi.State:X08} base=0x{mbi.BaseAddress:X16} size=0x{mbi.RegionSize:X16} alloc=0x{mbi.AllocationProtect:X08} prot=0x{mbi.Protect:X08}");
+		Console.Error.WriteLine($"[LOADER][TRACE] lazy-query: fault=0x{faultAddress:X16} owner={owner} rip=0x{rip:X16} rsp=0x{rsp:X16} state=0x{mbi.State:X08} base=0x{mbi.BaseAddress:X16} size=0x{mbi.RegionSize:X16} alloc=0x{mbi.AllocationProtect:X08} prot=0x{mbi.Protect:X08}");
 
 		bool committed = false;
 		ulong committedBase = 0;

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Imports.cs

@@ -3,6 +3,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.Linq;
 using System.Runtime.InteropServices;
 using System.Threading;
@@ -74,7 +75,8 @@ public sealed partial class DirectExecutionBackend
 	{
 		long num = Interlocked.Increment(ref _importDispatchCount);
 		MarkExecutionProgress();
-		if (_cpuContext == null)
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null)
 		{
 			LastError = "Import dispatch called without active CPU context";
 			return 18446744071562199298uL;
@@ -91,32 +93,32 @@ public sealed partial class DirectExecutionBackend
 			Console.Error.WriteLine($"[LOADER][TRACE] Raw sentinel recoveries: {num2} (last import index={importIndex})");
 			_lastReportedRawSentinelRecoveries = num2;
 		}
-		_cpuContext.Rip = importStubEntry.Address;
-		_cpuContext[CpuRegister.Rdi] = *(ulong*)argPackPtr;
-		_cpuContext[CpuRegister.Rsi] = *(ulong*)(argPackPtr + 8);
-		_cpuContext[CpuRegister.Rdx] = *(ulong*)(argPackPtr + 16);
-		_cpuContext[CpuRegister.Rcx] = *(ulong*)(argPackPtr + 24);
-		_cpuContext[CpuRegister.R8] = *(ulong*)(argPackPtr + 32);
-		_cpuContext[CpuRegister.R9] = *(ulong*)(argPackPtr + 40);
-		_cpuContext[CpuRegister.Rbx] = *(ulong*)(argPackPtr + 48);
-		_cpuContext[CpuRegister.Rbp] = *(ulong*)(argPackPtr + 56);
-		_cpuContext[CpuRegister.R12] = *(ulong*)(argPackPtr + 64);
-		_cpuContext[CpuRegister.R13] = *(ulong*)(argPackPtr + 72);
-		_cpuContext[CpuRegister.R14] = *(ulong*)(argPackPtr + 80);
-		_cpuContext[CpuRegister.R15] = *(ulong*)(argPackPtr + 88);
-		_cpuContext[CpuRegister.Rsp] = (ulong)argPackPtr + 96uL;
-		ulong value = _cpuContext[CpuRegister.Rdi];
-		ulong value2 = _cpuContext[CpuRegister.Rsi];
-		ulong num3 = _cpuContext[CpuRegister.Rdx];
-		ulong num4 = _cpuContext[CpuRegister.Rcx];
-		ulong num5 = _cpuContext[CpuRegister.R8];
-		ulong num6 = _cpuContext[CpuRegister.R9];
-		ulong value3 = _cpuContext[CpuRegister.Rbx];
-		ulong value4 = _cpuContext[CpuRegister.Rbp];
-		ulong value5 = _cpuContext[CpuRegister.R12];
-		ulong value6 = _cpuContext[CpuRegister.R13];
-		ulong value7 = _cpuContext[CpuRegister.R14];
-		ulong value8 = _cpuContext[CpuRegister.R15];
+		cpuContext.Rip = importStubEntry.Address;
+		cpuContext[CpuRegister.Rdi] = *(ulong*)argPackPtr;
+		cpuContext[CpuRegister.Rsi] = *(ulong*)(argPackPtr + 8);
+		cpuContext[CpuRegister.Rdx] = *(ulong*)(argPackPtr + 16);
+		cpuContext[CpuRegister.Rcx] = *(ulong*)(argPackPtr + 24);
+		cpuContext[CpuRegister.R8] = *(ulong*)(argPackPtr + 32);
+		cpuContext[CpuRegister.R9] = *(ulong*)(argPackPtr + 40);
+		cpuContext[CpuRegister.Rbx] = *(ulong*)(argPackPtr + 48);
+		cpuContext[CpuRegister.Rbp] = *(ulong*)(argPackPtr + 56);
+		cpuContext[CpuRegister.R12] = *(ulong*)(argPackPtr + 64);
+		cpuContext[CpuRegister.R13] = *(ulong*)(argPackPtr + 72);
+		cpuContext[CpuRegister.R14] = *(ulong*)(argPackPtr + 80);
+		cpuContext[CpuRegister.R15] = *(ulong*)(argPackPtr + 88);
+		cpuContext[CpuRegister.Rsp] = (ulong)argPackPtr + 96uL;
+		ulong value = cpuContext[CpuRegister.Rdi];
+		ulong value2 = cpuContext[CpuRegister.Rsi];
+		ulong num3 = cpuContext[CpuRegister.Rdx];
+		ulong num4 = cpuContext[CpuRegister.Rcx];
+		ulong num5 = cpuContext[CpuRegister.R8];
+		ulong num6 = cpuContext[CpuRegister.R9];
+		ulong value3 = cpuContext[CpuRegister.Rbx];
+		ulong value4 = cpuContext[CpuRegister.Rbp];
+		ulong value5 = cpuContext[CpuRegister.R12];
+		ulong value6 = cpuContext[CpuRegister.R13];
+		ulong value7 = cpuContext[CpuRegister.R14];
+		ulong value8 = cpuContext[CpuRegister.R15];
 		ulong num7 = *(ulong*)(argPackPtr + 96);
 		if (!IsLikelyReturnAddress(num7))
 		{
@@ -133,7 +135,16 @@ public sealed partial class DirectExecutionBackend
 			}
 		}
 		TrackDistinctImportNid(importStubEntry.Nid);
+		var probeImportReturn = Environment.GetEnvironmentVariable("SHARPEMU_PROBE_IMPORT_RET");
+		if (!string.IsNullOrWhiteSpace(probeImportReturn) &&
+			(string.Equals(probeImportReturn, "*", StringComparison.Ordinal) ||
+			 string.Equals(probeImportReturn, importStubEntry.Nid, StringComparison.Ordinal)))
+		{
+			ProbeReturnRip(num7, num);
+		}
 		TrackStrlenPrelude(importStubEntry.Nid, num, num7);
+		TraceGuestContext(
+			$"import dispatch={num} nid={importStubEntry.Nid} ret=0x{num7:X16} managed={Environment.CurrentManagedThreadId} guest=0x{GuestThreadExecution.CurrentGuestThreadHandle:X16} fiber=0x{GuestThreadExecution.CurrentFiberAddress:X16} active={HasActiveExecutionThread}");
 		bool logBootstrap = string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_BOOTSTRAP"), "1", StringComparison.Ordinal);
 		if (logBootstrap && string.Equals(importStubEntry.Nid, RuntimeStubNids.BootstrapBridge, StringComparison.Ordinal))
 		{
@@ -145,9 +156,9 @@ public sealed partial class DirectExecutionBackend
 			Console.Error.WriteLine(
 				$"[LOADER][TRACE] bootstrap_call#{num}: op=0x{value:X16} sym_ptr=0x{value2:X16} sym='{symbolText}' out_ptr=0x{num3:X16} ret=0x{num7:X16}");
 		}
-		if (!_forcedGuestExit && ShouldForceGuestExitOnImportLoop(importStubEntry.Nid, num7, num, value, value2) && TryForceGuestExitToHostStub(argPackPtr, num, num7, importStubEntry.Nid))
+		if (!ActiveForcedGuestExit && ShouldForceGuestExitOnImportLoop(importStubEntry.Nid, num7, num, value, value2) && TryForceGuestExitToHostStub(argPackPtr, num, num7, importStubEntry.Nid))
 		{
-			_cpuContext[CpuRegister.Rax] = 1uL;
+			cpuContext[CpuRegister.Rax] = 1uL;
 			return 1uL;
 		}
 		bool flag0 = ShouldSuppressStrlenTrace(importStubEntry.Nid);
@@ -209,33 +220,41 @@ public sealed partial class DirectExecutionBackend
 		}
 		if (!flag0)
 		{
-			RecordRecentImportTrace($"#{num} nid={importStubEntry.Nid} ret=0x{num7:X16} rdi=0x{_cpuContext[CpuRegister.Rdi]:X16} rsi=0x{_cpuContext[CpuRegister.Rsi]:X16} rdx=0x{_cpuContext[CpuRegister.Rdx]:X16}");
+			RecordRecentImportTrace($"#{num} nid={importStubEntry.Nid} ret=0x{num7:X16} rdi=0x{cpuContext[CpuRegister.Rdi]:X16} rsi=0x{cpuContext[CpuRegister.Rsi]:X16} rdx=0x{cpuContext[CpuRegister.Rdx]:X16}");
 		}
 		if (importStubEntry.Nid == "8zTFvBIAIN8" && num <= 256)
 		{
-			Console.Error.WriteLine($"[LOADER][TRACE] memset#{num}: dst=0x{_cpuContext[CpuRegister.Rdi]:X16} val=0x{_cpuContext[CpuRegister.Rsi] & 0xFF:X2} len=0x{_cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
+			Console.Error.WriteLine($"[LOADER][TRACE] memset#{num}: dst=0x{cpuContext[CpuRegister.Rdi]:X16} val=0x{cpuContext[CpuRegister.Rsi] & 0xFF:X2} len=0x{cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
 		}
 		if (importStubEntry.Nid == "tsvEmnenz48" && num <= 64)
 		{
-			Console.Error.WriteLine($"[LOADER][TRACE] __cxa_atexit#{num}: func=0x{_cpuContext[CpuRegister.Rdi]:X16} arg=0x{_cpuContext[CpuRegister.Rsi]:X16} dso=0x{_cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
+			Console.Error.WriteLine($"[LOADER][TRACE] __cxa_atexit#{num}: func=0x{cpuContext[CpuRegister.Rdi]:X16} arg=0x{cpuContext[CpuRegister.Rsi]:X16} dso=0x{cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
 		}
 		if (importStubEntry.Nid == "bzQExy189ZI" || importStubEntry.Nid == "8G2LB+A3rzg")
 		{
-			Console.Error.WriteLine($"[LOADER][TRACE] {importStubEntry.Nid}#{num}: rdi=0x{_cpuContext[CpuRegister.Rdi]:X16} rsi=0x{_cpuContext[CpuRegister.Rsi]:X16} rdx=0x{_cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
+			Console.Error.WriteLine($"[LOADER][TRACE] {importStubEntry.Nid}#{num}: rdi=0x{cpuContext[CpuRegister.Rdi]:X16} rsi=0x{cpuContext[CpuRegister.Rsi]:X16} rdx=0x{cpuContext[CpuRegister.Rdx]:X16} ret=0x{num7:X16}");
 		}
-		if (flag || flag2 || flag3)
+		if (flag6 || flag || flag2 || flag3)
 		{
-			Console.Error.WriteLine($"[LOADER][TRACE] ImportCtx#{num}: nid={importStubEntry.Nid} ret=0x{num7:X16} rdi=0x{_cpuContext[CpuRegister.Rdi]:X16} rsi=0x{_cpuContext[CpuRegister.Rsi]:X16} rdx=0x{_cpuContext[CpuRegister.Rdx]:X16} rcx=0x{_cpuContext[CpuRegister.Rcx]:X16}");
+			Console.Error.WriteLine($"[LOADER][TRACE] ImportCtx#{num}: nid={importStubEntry.Nid} ret=0x{num7:X16} rdi=0x{cpuContext[CpuRegister.Rdi]:X16} rsi=0x{cpuContext[CpuRegister.Rsi]:X16} rdx=0x{cpuContext[CpuRegister.Rdx]:X16} rcx=0x{cpuContext[CpuRegister.Rcx]:X16}");
 			Console.Error.WriteLine($"[LOADER][TRACE] ImportNV#{num}: rbx=0x{value3:X16} rbp=0x{value4:X16} r12=0x{value5:X16} r13=0x{value6:X16} r14=0x{value7:X16} r15=0x{value8:X16}");
 			if (flag3)
 			{
-				ulong num9 = _cpuContext[CpuRegister.Rsp];
-				if (_cpuContext.TryReadUInt64(num9, out var value9) && _cpuContext.TryReadUInt64(num9 + 8, out var value10) && _cpuContext.TryReadUInt64(num9 + 16, out var value11) && _cpuContext.TryReadUInt64(num9 + 24, out var value12) && _cpuContext.TryReadUInt64(num9 + 32, out var value13) && _cpuContext.TryReadUInt64(num9 + 40, out var value14) && _cpuContext.TryReadUInt64(num9 + 48, out var value15) && _cpuContext.TryReadUInt64(num9 + 56, out var value16) && _cpuContext.TryReadUInt64(num9 + 64, out var value17))
+				ulong num9 = cpuContext[CpuRegister.Rsp];
+				if (cpuContext.TryReadUInt64(num9, out var value9) && cpuContext.TryReadUInt64(num9 + 8, out var value10) && cpuContext.TryReadUInt64(num9 + 16, out var value11) && cpuContext.TryReadUInt64(num9 + 24, out var value12) && cpuContext.TryReadUInt64(num9 + 32, out var value13) && cpuContext.TryReadUInt64(num9 + 40, out var value14) && cpuContext.TryReadUInt64(num9 + 48, out var value15) && cpuContext.TryReadUInt64(num9 + 56, out var value16) && cpuContext.TryReadUInt64(num9 + 64, out var value17))
 				{
 					Console.Error.WriteLine($"[LOADER][TRACE] ImportStackHead#{num}: rsp=0x{num9:X16} [0]=0x{value9:X16} [20]=0x{value13:X16} [40]=0x{value17:X16}");
 					Console.Error.WriteLine($"[LOADER][TRACE] ImportStack#{num}: rsp=0x{num9:X16} [0]=0x{value9:X16} [8]=0x{value10:X16} [10]=0x{value11:X16} [18]=0x{value12:X16} [20]=0x{value13:X16} [28]=0x{value14:X16} [30]=0x{value15:X16} [38]=0x{value16:X16} [40]=0x{value17:X16}");
 				}
 			}
+			if (flag6 && string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_IMPORT_FRAMES"), "1", StringComparison.Ordinal))
+			{
+				TraceImportFrameChain(cpuContext, num);
+			}
+			if (flag6 && string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_IMPORT_RECENT"), "1", StringComparison.Ordinal))
+			{
+				DumpRecentImportTrace();
+			}
 			if (flag3)
 			{
 				Console.Error.Flush();
@@ -243,6 +262,16 @@ public sealed partial class DirectExecutionBackend
 		}
 		if (importStubEntry.Nid == "Ou3iL1abvng")
 		{
+			if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_STACK_CHK"), "1", StringComparison.Ordinal))
+			{
+				var savedGuardAddress = value4 >= 0x10 ? value4 - 0x10 : 0;
+				var guardKnown = TryReadUInt64Compat(value3, out var guardValue);
+				var savedKnown = TryReadUInt64Compat(savedGuardAddress, out var savedGuardValue);
+				Console.Error.WriteLine(
+					$"[LOADER][TRACE] stack_chk_diag#{num}: ret=0x{num7:X16} guard_ptr=0x{value3:X16} " +
+					$"guard={(guardKnown ? $"0x{guardValue:X16}" : "?")} saved@0x{savedGuardAddress:X16}={(savedKnown ? $"0x{savedGuardValue:X16}" : "?")} " +
+					$"rbp=0x{value4:X16} rsp=0x{((ulong)argPackPtr + 96uL):X16}");
+			}
 			try
 			{
 				byte[] array = new byte[64];
@@ -252,23 +281,39 @@ public sealed partial class DirectExecutionBackend
 			catch
 			{
 			}
-			TryBypassStackChkFailTrap(num, num7);
 		}
 		try
 		{
 			OrbisGen2Result orbisGen2Result;
 			bool dispatchResolved = true;
-			if (string.Equals(importStubEntry.Nid, RuntimeStubNids.BootstrapBridge, StringComparison.Ordinal))
+			var previousImportCallFrame = GuestThreadExecution.EnterImportCallFrame(
+				num7,
+				(ulong)argPackPtr + 104uL,
+				ActiveGuestReturnSlotAddress);
+			try
 			{
-				orbisGen2Result = DispatchBootstrapBridge();
+				if (string.Equals(importStubEntry.Nid, RuntimeStubNids.BootstrapBridge, StringComparison.Ordinal))
+				{
+					orbisGen2Result = DispatchBootstrapBridge();
+				}
+				else if (string.Equals(importStubEntry.Nid, RuntimeStubNids.KernelDynlibDlsym, StringComparison.Ordinal))
+				{
+					orbisGen2Result = DispatchKernelDynlibDlsym();
+				}
+				else
+				{
+					dispatchResolved = _moduleManager.TryDispatch(importStubEntry.Nid, cpuContext, out orbisGen2Result);
+				}
 			}
-			else if (string.Equals(importStubEntry.Nid, RuntimeStubNids.KernelDynlibDlsym, StringComparison.Ordinal))
+			finally
 			{
-				orbisGen2Result = DispatchKernelDynlibDlsym();
+				GuestThreadExecution.RestoreImportCallFrame(previousImportCallFrame);
 			}
-			else
+			if (dispatchResolved &&
+				orbisGen2Result == OrbisGen2Result.ORBIS_GEN2_OK &&
+				string.Equals(importStubEntry.Nid, "BohYr-F7-is", StringComparison.Ordinal))
 			{
-				dispatchResolved = _moduleManager.TryDispatch(importStubEntry.Nid, _cpuContext, out orbisGen2Result);
+				RegisterPrtLazyCommitRange(value2, num3);
 			}
 			if (!dispatchResolved)
 			{
@@ -287,60 +332,87 @@ public sealed partial class DirectExecutionBackend
 					ExportedFunction export2;
 					bool value20 = _moduleManager.TryGetExport(importStubEntry.Nid, out export2);
 					Console.Error.WriteLine($"[LOADER][WARN] map_direct lookup with import nid: function={value19}, export={value20}");
-					Console.Error.WriteLine(_moduleManager.TryGetExport("L-Q3LEjIbgA", out ExportedFunction export3) ? $"[LOADER][WARN] Canonical map_direct exists as {export3.LibraryName}:{export3.Name}, target={export3.Target}, ctx_target={_cpuContext.TargetGeneration}" : "[LOADER][WARN] Canonical map_direct export lookup also missing");
+					Console.Error.WriteLine(_moduleManager.TryGetExport("L-Q3LEjIbgA", out ExportedFunction export3) ? $"[LOADER][WARN] Canonical map_direct exists as {export3.LibraryName}:{export3.Name}, target={export3.Target}, ctx_target={cpuContext.TargetGeneration}" : "[LOADER][WARN] Canonical map_direct export lookup also missing");
 				}
 			}
 			else if (orbisGen2Result != OrbisGen2Result.ORBIS_GEN2_OK)
 			{
-				Console.Error.WriteLine($"[LOADER][WARN] Import#{num} result: {orbisGen2Result} ({importStubEntry.Nid})");
+				Console.Error.WriteLine(
+					$"[LOADER][WARN] Import#{num} result: {orbisGen2Result} ({importStubEntry.Nid}) " +
+					$"rdi=0x{value:X16} rsi=0x{value2:X16} rdx=0x{num3:X16} rcx=0x{num4:X16} ret=0x{num7:X16}");
 			}
-			_cpuContext[CpuRegister.Rbx] = value3;
-			_cpuContext[CpuRegister.Rbp] = value4;
-			_cpuContext[CpuRegister.R12] = value5;
-			_cpuContext[CpuRegister.R13] = value6;
-			_cpuContext[CpuRegister.R14] = value7;
-			_cpuContext[CpuRegister.R15] = value8;
-			_cpuContext[CpuRegister.Rdi] = value;
-			_cpuContext[CpuRegister.Rsi] = value2;
+			cpuContext[CpuRegister.Rbx] = value3;
+			cpuContext[CpuRegister.Rbp] = value4;
+			cpuContext[CpuRegister.R12] = value5;
+			cpuContext[CpuRegister.R13] = value6;
+			cpuContext[CpuRegister.R14] = value7;
+			cpuContext[CpuRegister.R15] = value8;
+			cpuContext[CpuRegister.Rdi] = value;
+			cpuContext[CpuRegister.Rsi] = value2;
 			if (GuestThreadExecution.TryConsumeCurrentEntryExit(out var exitStatus, out var exitReason))
 			{
 				if (TryCompleteGuestEntryToHostStub(argPackPtr, num, num7, importStubEntry.Nid, exitReason, exitStatus))
 				{
-					_cpuContext[CpuRegister.Rax] = unchecked((ulong)exitStatus);
+					cpuContext[CpuRegister.Rax] = unchecked((ulong)exitStatus);
 				}
 				else
 				{
 					LastError = $"Failed to complete guest entry after {importStubEntry.Nid}: missing host return sentinel";
-					_cpuContext[CpuRegister.Rax] = 18446744071562199298uL;
+					cpuContext[CpuRegister.Rax] = 18446744071562199298uL;
 				}
 			}
 			if (GuestThreadExecution.TryConsumeCurrentThreadBlock(out var blockReason) &&
 				TryYieldGuestThreadToHostStub(argPackPtr, num, num7, importStubEntry.Nid, blockReason))
 			{
-				_cpuContext[CpuRegister.Rax] = 0uL;
+				cpuContext[CpuRegister.Rax] = 0uL;
 			}
 			if (flag || flag2 || flag3)
 			{
-				Console.Error.WriteLine($"[LOADER][TRACE] ImportRet#{num}: nid={importStubEntry.Nid} result={orbisGen2Result} rax=0x{_cpuContext[CpuRegister.Rax]:X16}");
+				Console.Error.WriteLine($"[LOADER][TRACE] ImportRet#{num}: nid={importStubEntry.Nid} result={orbisGen2Result} rax=0x{cpuContext[CpuRegister.Rax]:X16}");
 				if (flag3)
 				{
 					Console.Error.Flush();
 				}
 			}
-			return _cpuContext[CpuRegister.Rax];
+			return cpuContext[CpuRegister.Rax];
 		}
 		catch (Exception ex)
 		{
 			LastError = $"HLE dispatch error for {importStubEntry.Nid}: {ex.GetType().Name}: {ex.Message}";
-			_cpuContext[CpuRegister.Rax] = 18446744071562199298uL;
+			cpuContext[CpuRegister.Rax] = 18446744071562199298uL;
 			return 18446744071562199298uL;
 		}
 	}
 
+	private void TraceImportFrameChain(CpuContext context, long dispatchIndex)
+	{
+		var frame = context[CpuRegister.Rbp];
+		for (int i = 0; i < 16; i++)
+		{
+			if (!context.TryReadUInt64(frame, out var next) ||
+				!context.TryReadUInt64(frame + sizeof(ulong), out var returnRip))
+			{
+				break;
+			}
+
+			var symbol = TryFormatNearestRuntimeSymbol(returnRip, out var formatted)
+				? $" [{formatted}]"
+				: string.Empty;
+			Console.Error.WriteLine(
+				$"[LOADER][TRACE] ImportFrame#{dispatchIndex}.{i}: rbp=0x{frame:X16} ret=0x{returnRip:X16}{symbol} next=0x{next:X16}");
+			if (next <= frame || next - frame > 0x100000)
+			{
+				break;
+			}
+
+			frame = next;
+		}
+	}
+
 	private unsafe bool TryForceGuestExitToHostStub(nint argPackPtr, long dispatchIndex, ulong returnRip, string nid)
 	{
-		ulong num = _entryReturnSentinelRip;
-		if (num < 65536)
+		ulong num = ActiveEntryReturnSentinelRip;
+		if (num < 65536 || !TryPatchActiveGuestReturnSlot(num))
 		{
 			return false;
 		}
@@ -352,7 +424,7 @@ public sealed partial class DirectExecutionBackend
 		{
 			return false;
 		}
-		_forcedGuestExit = true;
+		ActiveForcedGuestExit = true;
 		LastError = $"Detected repeating import loop at import#{dispatchIndex} ({nid}) and forced guest exit.";
 		Console.Error.WriteLine($"[LOADER][ERROR] Import-loop guard fired at import#{dispatchIndex}: nid={nid} ret=0x{returnRip:X16} -> host_exit=0x{num:X16}");
 		DumpRecentImportTrace();
@@ -361,8 +433,8 @@ public sealed partial class DirectExecutionBackend
 
 	private unsafe bool TryCompleteGuestEntryToHostStub(nint argPackPtr, long dispatchIndex, ulong returnRip, string nid, string reason, int status)
 	{
-		ulong hostExit = _entryReturnSentinelRip;
-		if (hostExit < 65536)
+		ulong hostExit = ActiveEntryReturnSentinelRip;
+		if (hostExit < 65536 || !TryPatchActiveGuestReturnSlot(hostExit))
 		{
 			return false;
 		}
@@ -381,8 +453,8 @@ public sealed partial class DirectExecutionBackend
 
 	private unsafe bool TryYieldGuestThreadToHostStub(nint argPackPtr, long dispatchIndex, ulong returnRip, string nid, string reason)
 	{
-		ulong hostExit = _entryReturnSentinelRip;
-		if (hostExit < 65536)
+		ulong hostExit = ActiveEntryReturnSentinelRip;
+		if (hostExit < 65536 || !TryPatchActiveGuestReturnSlot(hostExit))
 		{
 			return false;
 		}
@@ -395,13 +467,21 @@ public sealed partial class DirectExecutionBackend
 			return false;
 		}
 
-		_guestThreadYieldRequested = true;
-		_guestThreadYieldReason = string.IsNullOrWhiteSpace(reason) ? nid : reason;
+		ActiveGuestThreadYieldRequested = true;
+		ActiveGuestThreadYieldReason = string.IsNullOrWhiteSpace(reason) ? nid : reason;
 		Console.Error.WriteLine(
-			$"[LOADER][INFO] Guest thread yield at import#{dispatchIndex}: nid={nid} ret=0x{returnRip:X16} reason={_guestThreadYieldReason}");
+			$"[LOADER][INFO] Guest thread yield at import#{dispatchIndex}: nid={nid} ret=0x{returnRip:X16} reason={ActiveGuestThreadYieldReason}");
 		return true;
 	}
 
+	private bool TryPatchActiveGuestReturnSlot(ulong hostExit)
+	{
+		ulong returnSlotAddress = ActiveGuestReturnSlotAddress;
+		return returnSlotAddress != 0 &&
+			ActiveCpuContext is not null &&
+			ActiveCpuContext.TryWriteUInt64(returnSlotAddress, hostExit);
+	}
+
 	private bool ShouldForceGuestExitOnImportLoop(string nid, ulong returnRip, long dispatchIndex, ulong arg0, ulong arg1)
 	{
 		if (dispatchIndex < 1200)
@@ -412,6 +492,11 @@ public sealed partial class DirectExecutionBackend
 		{
 			return false;
 		}
+		if (IsImportLoopGuardBoundary(nid))
+		{
+			ResetImportLoopPattern();
+			return false;
+		}
 		if (!_importNidHashCache.TryGetValue(nid, out var value))
 		{
 			value = StableHash64(nid);
@@ -424,10 +509,46 @@ public sealed partial class DirectExecutionBackend
 			{
 				_importLoopPatternHits--;
 			}
+			if (_importLoopPatternHits == 0)
+			{
+				_importLoopPatternStartTimestamp = 0;
+			}
 			return false;
 		}
+		if (_importLoopPatternStartTimestamp == 0)
+		{
+			_importLoopPatternStartTimestamp = Stopwatch.GetTimestamp();
+		}
 		_importLoopPatternHits++;
-		return _importLoopPatternHits >= 6;
+		var guardSeconds = GetImportLoopGuardSeconds();
+		if (guardSeconds <= 0 || _importLoopPatternHits < 6)
+		{
+			return false;
+		}
+
+		var elapsedTicks = Stopwatch.GetTimestamp() - _importLoopPatternStartTimestamp;
+		return elapsedTicks >= (long)(guardSeconds * Stopwatch.Frequency);
+	}
+
+	private static bool IsImportLoopGuardBoundary(string nid) =>
+		string.Equals(nid, "1jfXLRVzisc", StringComparison.Ordinal);
+
+	private void ResetImportLoopPattern()
+	{
+		_importLoopPatternHits = 0;
+		_importLoopPatternStartTimestamp = 0;
+		_importLoopSignatureCount = 0;
+		_importLoopSignatureWriteIndex = 0;
+	}
+
+	private static int GetImportLoopGuardSeconds()
+	{
+		if (int.TryParse(Environment.GetEnvironmentVariable("SHARPEMU_IMPORT_LOOP_GUARD_SECONDS"), out var seconds))
+		{
+			return Math.Max(0, seconds);
+		}
+
+		return DefaultImportLoopGuardSeconds;
 	}
 
 	private ulong BuildImportLoopSignature(ulong nidHash, ulong returnRip, ulong arg0, ulong arg1)
@@ -645,41 +766,43 @@ public sealed partial class DirectExecutionBackend
 
 	private OrbisGen2Result DispatchKernelDynlibDlsym()
 	{
-		if (_cpuContext == null)
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null)
 		{
 			return OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
 		}
-		ulong symbolNameAddress = _cpuContext[CpuRegister.Rsi];
-		ulong outputAddress = _cpuContext[CpuRegister.Rdx];
+		ulong symbolNameAddress = cpuContext[CpuRegister.Rsi];
+		ulong outputAddress = cpuContext[CpuRegister.Rdx];
 		if (!TryReadAsciiZ(symbolNameAddress, 512, out var symbolName))
 		{
-			_cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
+			cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
 		if (!TryResolveRuntimeSymbolAddress(symbolName, out var resolvedAddress))
 		{
-			_cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
+			cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
 		if (outputAddress == 0L || !TryWriteUInt64Compat(outputAddress, resolvedAddress))
 		{
-			_cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
+			cpuContext[CpuRegister.Rax] = 18446744073709551615uL;
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
-		_cpuContext[CpuRegister.Rax] = 0uL;
+		cpuContext[CpuRegister.Rax] = 0uL;
 		return OrbisGen2Result.ORBIS_GEN2_OK;
 	}
 
 	private OrbisGen2Result DispatchBootstrapBridge()
 	{
-		if (_cpuContext == null)
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null)
 		{
 			return OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
 		}
 
-		ulong bridgeHandle = _cpuContext[CpuRegister.Rdi];
-		ulong symbolNameAddress = _cpuContext[CpuRegister.Rsi];
-		ulong outputAddress = _cpuContext[CpuRegister.Rdx];
+		ulong bridgeHandle = cpuContext[CpuRegister.Rdi];
+		ulong symbolNameAddress = cpuContext[CpuRegister.Rsi];
+		ulong outputAddress = cpuContext[CpuRegister.Rdx];
 		_ = TryReadAsciiZ(symbolNameAddress, 512, out var symbolName);
 
 		OrbisGen2Result result = DispatchKernelDynlibDlsym();
@@ -691,10 +814,10 @@ public sealed partial class DirectExecutionBackend
 		if (logBootstrap)
 		{
 			Console.Error.WriteLine(
-				$"[LOADER][TRACE] bootstrap_dispatch: handle=0x{bridgeHandle:X16} symbol='{symbolName}' out=0x{outputAddress:X16} rax=0x{_cpuContext[CpuRegister.Rax]:X16}");
+				$"[LOADER][TRACE] bootstrap_dispatch: handle=0x{bridgeHandle:X16} symbol='{symbolName}' out=0x{outputAddress:X16} rax=0x{cpuContext[CpuRegister.Rax]:X16}");
 		}
 
-		if (_cpuContext[CpuRegister.Rax] == 0uL)
+		if (cpuContext[CpuRegister.Rax] == 0uL)
 		{
 			return OrbisGen2Result.ORBIS_GEN2_OK;
 		}
@@ -737,7 +860,7 @@ public sealed partial class DirectExecutionBackend
 	private bool TryReadAsciiZ(ulong address, int maxLength, out string value)
 	{
 		value = string.Empty;
-		if (_cpuContext == null || address == 0L || maxLength <= 0)
+		if (ActiveCpuContext == null || address == 0L || maxLength <= 0)
 		{
 			return false;
 		}
@@ -762,11 +885,12 @@ public sealed partial class DirectExecutionBackend
 
 	private bool TryReadByteCompat(ulong address, Span<byte> destination)
 	{
-		if (_cpuContext == null || destination.Length == 0)
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null || destination.Length == 0)
 		{
 			return false;
 		}
-		if (_cpuContext.Memory.TryRead(address, destination))
+		if (cpuContext.Memory.TryRead(address, destination))
 		{
 			return true;
 		}
@@ -781,13 +905,38 @@ public sealed partial class DirectExecutionBackend
 		}
 	}
 
-	private bool TryWriteUInt64Compat(ulong address, ulong value)
+	private bool TryReadUInt64Compat(ulong address, out ulong value)
 	{
-		if (_cpuContext == null || address == 0L)
+		value = 0;
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null || address == 0L)
 		{
 			return false;
 		}
-		if (_cpuContext.TryWriteUInt64(address, value))
+		if (cpuContext.TryReadUInt64(address, out value))
+		{
+			return true;
+		}
+		try
+		{
+			value = unchecked((ulong)Marshal.ReadInt64((nint)address));
+			return true;
+		}
+		catch
+		{
+			value = 0;
+			return false;
+		}
+	}
+
+	private bool TryWriteUInt64Compat(ulong address, ulong value)
+	{
+		var cpuContext = ActiveCpuContext;
+		if (cpuContext == null || address == 0L)
+		{
+			return false;
+		}
+		if (cpuContext.TryWriteUInt64(address, value))
 		{
 			return true;
 		}
@@ -802,65 +951,6 @@ public sealed partial class DirectExecutionBackend
 		}
 	}
 
-	private void TryBypassStackChkFailTrap(long dispatchIndex, ulong returnRip)
-	{
-		if (_cpuContext == null || returnRip < 32)
-		{
-			return;
-		}
-		try
-		{
-			byte[] array = new byte[19];
-			ulong num = returnRip - 23;
-			Marshal.Copy((nint)num, array, 0, array.Length);
-			if (array[0] != 117 || array[1] != 16 || array[2] != 72 || array[3] != 137 || array[4] != 216 || array[5] != 72 || array[6] != 131 || array[7] != 196 || array[9] != 91 || array[10] != 65 || array[11] != 92 || array[12] != 65 || array[13] != 94 || array[14] != 65 || array[15] != 95 || array[16] != 93 || array[17] != 195 || array[18] != 232)
-			{
-				return;
-			}
-			ulong value = returnRip - 21;
-			ulong address = _cpuContext[CpuRegister.Rsp];
-			if (_cpuContext.TryWriteUInt64(address, value))
-			{
-				if (_stackChkBypassSites.Add(num) && TryPatchStackChkFailBranch(num))
-				{
-					Console.Error.WriteLine($"[LOADER][WARNING] Import#{dispatchIndex}: patched stack_chk_fail tail branch at 0x{num:X16} -> NOP NOP");
-				}
-				Console.Error.WriteLine($"[LOADER][WARNING] Import#{dispatchIndex}: redirected __stack_chk_fail return to epilogue 0x{value:X16}");
-			}
-		}
-		catch
-		{
-		}
-	}
-
-	private unsafe static bool TryPatchStackChkFailBranch(ulong branchAddress)
-	{
-		uint flNewProtect = default(uint);
-		if (!VirtualProtect((void*)branchAddress, 2u, 64u, &flNewProtect))
-		{
-			return false;
-		}
-		try
-		{
-			if (Marshal.ReadByte((nint)branchAddress) != 117)
-			{
-				return false;
-			}
-			Marshal.WriteByte((nint)branchAddress, 144);
-			Marshal.WriteByte((nint)(branchAddress + 1), 144);
-			FlushInstructionCache(GetCurrentProcess(), (void*)branchAddress, 2u);
-			return true;
-		}
-		catch
-		{
-			return false;
-		}
-		finally
-		{
-			VirtualProtect((void*)branchAddress, 2u, flNewProtect, &flNewProtect);
-		}
-	}
-
 	private unsafe void TryPatchEa020eLookupCall(long dispatchIndex, ulong returnRip)
 	{
 		if (_patchedEa020eLookupCall || returnRip != 0x0000000800EA01A6uL)

src/SharpEmu.Core/Cpu/TrackedCpuMemory.cs

@@ -5,7 +5,7 @@ using SharpEmu.HLE;
 
 namespace SharpEmu.Core.Cpu;
 
-public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory
+public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemoryAllocator
 {
     private readonly ICpuMemory _inner;
 
@@ -39,4 +39,15 @@ public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory
 
         return result;
     }
+
+    public bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address)
+    {
+        if (_inner is IGuestMemoryAllocator allocator)
+        {
+            return allocator.TryAllocateGuestMemory(size, alignment, out address);
+        }
+
+        address = 0;
+        return false;
+    }
 }

src/SharpEmu.Core/Loader/SelfImage.cs

@@ -21,7 +21,10 @@ public sealed class SelfImage
         IReadOnlyList<ulong>? initializerFunctions = null,
         ulong initFunctionEntryPoint = 0,
         ulong imageBase = 0,
-        ulong procParamAddress = 0)
+        ulong procParamAddress = 0,
+        string? title = null,
+        string? titleId = null,
+        string? version = null)
     {
         ArgumentNullException.ThrowIfNull(programHeaders);
         ArgumentNullException.ThrowIfNull(mappedRegions);
@@ -38,6 +41,9 @@ public sealed class SelfImage
         InitFunctionEntryPoint = initFunctionEntryPoint;
         _imageBase = imageBase;
         ProcParamAddress = procParamAddress;
+        Title = title;
+        TitleId = titleId;
+        Version = version;
     }
 
     public bool IsSelf { get; }
@@ -63,4 +69,10 @@ public sealed class SelfImage
     public ulong EntryPoint => ElfHeader.EntryPoint + _imageBase;
 
     public ulong ProcParamAddress { get; }
+
+    public string? Title { get; }
+
+    public string? TitleId { get; }
+
+    public string? Version { get; }
 }

src/SharpEmu.Core/Loader/SelfLoader.cs

@@ -144,10 +144,9 @@ public sealed class SelfLoader : ISelfLoader
             throw new InvalidDataException("Input image is empty.");
         }
 
-        if (readParamJson)
-        {
-            TryLoadParamJson(fs, mountRoot);
-        }
+        var applicationInfo = readParamJson
+            ? TryLoadParamJson(fs, mountRoot)
+            : default;
 
         if (clearVirtualMemory)
         {
@@ -270,15 +269,20 @@ public sealed class SelfLoader : ISelfLoader
             initializerFunctions,
             initFunctionEntryPoint,
             imageBase,
-            procParamAddress);
+            procParamAddress,
+            applicationInfo.Title,
+            applicationInfo.TitleId,
+            applicationInfo.Version);
     }
 
-    private static void TryLoadParamJson(IFileSystem? fs, string? mountRoot)
+    private static (string? Title, string? TitleId, string? Version) TryLoadParamJson(
+        IFileSystem? fs,
+        string? mountRoot)
     {
         if (fs == null)
         {
             Console.WriteLine("[LOADER] param.json not found (no filesystem provided).");
-            return;
+            return default;
         }
 
         string[] possiblePaths = string.IsNullOrEmpty(mountRoot)
@@ -298,12 +302,16 @@ public sealed class SelfLoader : ISelfLoader
         if (foundPath == null)
         {
             Console.WriteLine("[LOADER] param.json not found (no root path / unknown layout).");
-            return;
+            return default;
         }
 
-        var (title, titleId, ver) = Ps5ParamJsonReader.TryReadPs5Param(fs, foundPath);
+        var applicationInfo = Ps5ParamJsonReader.TryReadPs5Param(fs, foundPath);
         Console.WriteLine($"[LOADER] Loading param.json at {foundPath}");
-        Console.WriteLine($"[LOADER] Title: {title ?? "(unknown)"}, TitleId: {titleId ?? "(unknown)"}, Version: {ver ?? "(unknown)"}");
+        Console.WriteLine(
+            $"[LOADER] Title: {applicationInfo.Title ?? "(unknown)"}, " +
+            $"TitleId: {applicationInfo.TitleId ?? "(unknown)"}, " +
+            $"Version: {applicationInfo.Version ?? "(unknown)"}");
+        return applicationInfo;
     }
 
     private static LoadContext ParseLayout(ReadOnlySpan<byte> imageData)

src/SharpEmu.Core/Memory/PhysicalVirtualMemory.cs

@@ -7,13 +7,17 @@ using SharpEmu.HLE;
 
 namespace SharpEmu.Core.Memory;
 
-public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
+public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryAllocator, IDisposable
 {
     private readonly object _gate = new();
+    private readonly object _guestAllocationGate = new();
     private readonly List<MemoryRegion> _regions = new();
     private readonly Dictionary<ulong, ProgramHeaderFlags> _pageProtections = new();
     private bool _disposed;
     private const ulong PageSize = 0x1000;
+    private const ulong GuestAllocationArenaAddress = 0x00006000_0000_0000;
+    private const ulong GuestAllocationArenaSize = 0x0100_0000;
+    private const ulong GuestAllocationArenaStartOffset = PageSize;
     private const ulong LargeDataReserveThreshold = 0x4000_0000UL; // 1 GiB
     private const ulong LazyReservePrimeBytes = 0x5000_0000UL; // 1.25 GiB
     private const ulong LazyReservePrimeChunkBytes = 0x0200_0000UL; // 32 MiB
@@ -29,6 +33,9 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
     private const uint PAGE_READWRITE = 0x04;
     private const uint PAGE_READONLY = 0x02;
 
+    private ulong _guestAllocationArenaBase;
+    private ulong _guestAllocationOffset;
+
     [DllImport("kernel32.dll", SetLastError = true)]
     private static extern void* VirtualAlloc(void* lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);
 
@@ -215,16 +222,111 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
         return actualAddress;
     }
 
+    public bool TryAllocateAtOrAbove(
+        ulong desiredAddress,
+        ulong size,
+        bool executable,
+        ulong alignment,
+        out ulong actualAddress)
+    {
+        actualAddress = 0;
+        if (size == 0)
+        {
+            return false;
+        }
+
+        var alignedSize = AlignUp(size, PageSize);
+        var effectiveAlignment = Math.Max(PageSize, alignment == 0 ? PageSize : alignment);
+        var cursor = AlignUp(desiredAddress, effectiveAlignment);
+
+        for (var attempt = 0; attempt < 0x10000; attempt++)
+        {
+            if (cursor == 0 || ulong.MaxValue - cursor < alignedSize)
+            {
+                return false;
+            }
+
+            if (TryGetOverlappingRegionEnd(cursor, alignedSize, out var overlapEnd))
+            {
+                cursor = AlignUp(overlapEnd, effectiveAlignment);
+                continue;
+            }
+
+            try
+            {
+                actualAddress = AllocateAt(cursor, alignedSize, executable, allowAlternative: false);
+                if (actualAddress == cursor)
+                {
+                    return true;
+                }
+
+                actualAddress = 0;
+            }
+            catch
+            {
+            }
+
+            cursor = AlignUp(cursor + effectiveAlignment, effectiveAlignment);
+        }
+
+        return false;
+    }
+
+    public bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address)
+    {
+        address = 0;
+        if (size == 0 || alignment == 0 || (alignment & (alignment - 1)) != 0)
+        {
+            return false;
+        }
+
+        lock (_guestAllocationGate)
+        {
+            if (_guestAllocationArenaBase == 0)
+            {
+                try
+                {
+                    _guestAllocationArenaBase = AllocateAt(
+                        GuestAllocationArenaAddress,
+                        GuestAllocationArenaSize,
+                        executable: false,
+                        allowAlternative: true);
+                    _guestAllocationOffset = GuestAllocationArenaStartOffset;
+                }
+                catch (Exception)
+                {
+                    return false;
+                }
+            }
+
+            var alignedOffset = AlignUp(_guestAllocationOffset, alignment);
+            if (alignedOffset > GuestAllocationArenaSize || size > GuestAllocationArenaSize - alignedOffset)
+            {
+                return false;
+            }
+
+            address = _guestAllocationArenaBase + alignedOffset;
+            _guestAllocationOffset = alignedOffset + size;
+            return true;
+        }
+    }
+
     public void Clear()
     {
-        lock (_gate)
+        lock (_guestAllocationGate)
         {
-            foreach (var region in _regions)
+            lock (_gate)
             {
-                VirtualFree((void*)region.VirtualAddress, 0, MEM_RELEASE);
+                foreach (var region in _regions)
+                {
+                    VirtualFree((void*)region.VirtualAddress, 0, MEM_RELEASE);
+                }
+                _regions.Clear();
+                _pageProtections.Clear();
             }
-            _regions.Clear();
-            _pageProtections.Clear();
+
+            _guestAllocationArenaBase = 0;
+            _guestAllocationOffset = 0;
         }
     }
 
@@ -480,6 +582,30 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IDisposable
         return null;
     }
 
+    private bool TryGetOverlappingRegionEnd(ulong address, ulong size, out ulong overlapEnd)
+    {
+        overlapEnd = 0;
+        if (size == 0 || ulong.MaxValue - address < size - 1)
+        {
+            return false;
+        }
+
+        var end = address + size;
+        lock (_gate)
+        {
+            foreach (var region in _regions)
+            {
+                var regionEnd = region.VirtualAddress + region.Size;
+                if (address < regionEnd && region.VirtualAddress < end)
+                {
+                    overlapEnd = Math.Max(overlapEnd, regionEnd);
+                }
+            }
+        }
+
+        return overlapEnd != 0;
+    }
+
     private static bool TryResolveRegionOffset(ulong address, ulong size, MemoryRegion region, out ulong offset)
     {
         offset = 0;

src/SharpEmu.Core/Runtime/SharpEmuRuntime.cs

@@ -135,6 +135,7 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         LastMilestoneLog = null;
         KernelModuleRegistry.Reset();
         var image = LoadImage(normalizedEbootPath);
+        VideoOutExports.ConfigureApplicationInfo(image.Title, image.TitleId, image.Version);
         RegisterLoadedModule(normalizedEbootPath, image, isMain: true, isSystemModule: false);
         KernelRuntimeCompatExports.ConfigureProcessProcParamAddress(image.ProcParamAddress);
         Console.Error.WriteLine($"[RUNTIME] Entry: 0x{image.EntryPoint:X16}");

src/SharpEmu.Core/packages.lock.json

@@ -8,17 +8,105 @@
         "resolved": "1.21.0",
         "contentHash": "dv5+81Q1TBQvVMSOOOmRcjJmvWcX3BZPZsIq31+RLc5cNft0IHAyNlkdb7ZarOWG913PyBoFDsDXoCIlKmLclg=="
       },
+      "Microsoft.DotNet.PlatformAbstractions": {
+        "type": "Transitive",
+        "resolved": "3.1.6",
+        "contentHash": "jek4XYaQ/PGUwDKKhwR8K47Uh1189PFzMeLqO83mXrXQVIpARZCcfuDedH50YDTepBkfijCZN5U/vZi++erxtg=="
+      },
+      "Microsoft.Extensions.DependencyModel": {
+        "type": "Transitive",
+        "resolved": "9.0.9",
+        "contentHash": "fNGvKct2De8ghm0Bpfq0iWthtzIWabgOTi+gJhNOPhNJIowXNEUE2eZNW/zNCzrHVA3PXg2yZ+3cWZndC2IqYA=="
+      },
+      "Silk.NET.Core": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "D7AT/nnwlB+4RZ84XY8QNGBZMJI5z9l4CSSETIJ1wCfRJzRt/341y3MRZ4HbnFz4r/IGaWOEZr86iE+0/65yyQ==",
+        "dependencies": {
+          "Microsoft.DotNet.PlatformAbstractions": "3.1.6",
+          "Microsoft.Extensions.DependencyModel": "9.0.9"
+        }
+      },
+      "Silk.NET.GLFW": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "UIs4sH57xlPUNHQ/1bt9rymPWlGy8IMDCNv86h0iM4TOA1CkIx0XM/n/tA4AReh1zQkNrvkxPEdZ3Blvy1dyXg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Ultz.Native.GLFW": "3.4.0"
+        }
+      },
+      "Silk.NET.Maths": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "r8PdIVzME8EH0qAgbmRPO87I4GfgR2j8TofT7EMuRJDf1QluoQwnVypDoFJjQ2ZBSRsGYk5unYxxogI05Ogsmw=="
+      },
+      "Silk.NET.Windowing.Common": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "ThStSinmY9KQI8DGiF5XEhkLJVnBcgRTBTzL9ijg1wMZAYuckz7ykrNw04fjRm2Gryh6tCNGbvz2XaY0efeFzg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Maths": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing.Glfw": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "aYBudKmENmvLRn9p15HbdvlQTnnXskcDfTfbYwSb/4fr263rGLwYuDw/txUEc2jihHJiWCp5+75Y7z5wTJWl7g==",
+        "dependencies": {
+          "Silk.NET.GLFW": "2.23.0",
+          "Silk.NET.Windowing.Common": "2.23.0"
+        }
+      },
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      },
       "sharpemu.hle": {
         "type": "Project"
       },
       "sharpemu.libs": {
         "type": "Project",
         "dependencies": {
-          "SharpEmu.HLE": "[1.0.0, )"
+          "SharpEmu.HLE": "[1.0.0, )",
+          "Silk.NET.Vulkan": "[2.23.0, )",
+          "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
+          "Silk.NET.Windowing": "[2.23.0, )"
         }
       },
       "sharpemu.logging": {
         "type": "Project"
+      },
+      "Silk.NET.Vulkan": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "3/irtlSWXZ3eTi8N6nelI6L34NTB8ZJHpqVMNzZx2aX7Ek9YEQ34NoQW8/Tljrtmkg8KRhHW8hKTEzZaKV8PgA==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0"
+        }
+      },
+      "Silk.NET.Vulkan.Extensions.KHR": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "uRaf4j+SmH3DumjSSSUbFg33BnsGZUyXGj93O9NgGKZSJN3OTmNmQDxRew+/KiVLcgH6qzbto8aNGZ++j9GFWg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing": {
+        "type": "CentralTransitive",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "OPNPmt/lRyUKVYrFLQXVxyATqD3MKLc1iY1oKx1/2GppgmZxVZPwN12tekrQ4C7408kgB1L5JD1Wnirqqeb2kg==",
+        "dependencies": {
+          "Silk.NET.Windowing.Common": "2.23.0",
+          "Silk.NET.Windowing.Glfw": "2.23.0"
+        }
       }
     }
   }

src/SharpEmu.HLE/GuestThreadExecution.cs

@@ -15,13 +15,59 @@ public interface IGuestThreadScheduler
     bool TryStartThread(CpuContext creatorContext, GuestThreadStartRequest request, out string? error);
 
     void Pump(CpuContext callerContext, string reason);
+
+    bool TryCallGuestFunction(
+        CpuContext callerContext,
+        ulong entryPoint,
+        ulong arg0,
+        ulong arg1,
+        ulong stackAddress,
+        ulong stackSize,
+        string reason,
+        out string? error);
+
+    bool TryCallGuestContinuation(
+        CpuContext callerContext,
+        GuestCpuContinuation continuation,
+        string reason,
+        out string? error);
 }
 
+public readonly record struct GuestImportCallFrame(
+    bool IsValid,
+    ulong ReturnRip,
+    ulong ResumeRsp,
+    ulong ReturnSlotAddress);
+
+public readonly record struct GuestCpuContinuation(
+    ulong Rip,
+    ulong Rsp,
+    ulong ReturnSlotAddress,
+    ulong Rflags,
+    ulong FsBase,
+    ulong GsBase,
+    ulong Rax,
+    ulong Rcx,
+    ulong Rdx,
+    ulong Rbx,
+    ulong Rbp,
+    ulong Rsi,
+    ulong Rdi,
+    ulong R8,
+    ulong R9,
+    ulong R12,
+    ulong R13,
+    ulong R14,
+    ulong R15);
+
 public static class GuestThreadExecution
 {
     [ThreadStatic]
     private static ulong _currentGuestThreadHandle;
 
+    [ThreadStatic]
+    private static ulong _currentFiberAddress;
+
     [ThreadStatic]
     private static string? _pendingBlockReason;
 
@@ -34,12 +80,26 @@ public static class GuestThreadExecution
     [ThreadStatic]
     private static string? _pendingEntryExitReason;
 
+    [ThreadStatic]
+    private static bool _hasCurrentImportCallFrame;
+
+    [ThreadStatic]
+    private static ulong _currentImportReturnRip;
+
+    [ThreadStatic]
+    private static ulong _currentImportResumeRsp;
+
+    [ThreadStatic]
+    private static ulong _currentImportReturnSlotAddress;
+
     public static IGuestThreadScheduler? Scheduler { get; set; }
 
     public static bool IsGuestThread => _currentGuestThreadHandle != 0;
 
     public static ulong CurrentGuestThreadHandle => _currentGuestThreadHandle;
 
+    public static ulong CurrentFiberAddress => _currentFiberAddress;
+
     public static ulong EnterGuestThread(ulong threadHandle)
     {
         var previous = _currentGuestThreadHandle;
@@ -48,6 +108,10 @@ public static class GuestThreadExecution
         _pendingEntryExit = false;
         _pendingEntryExitStatus = 0;
         _pendingEntryExitReason = null;
+        _hasCurrentImportCallFrame = false;
+        _currentImportReturnRip = 0;
+        _currentImportResumeRsp = 0;
+        _currentImportReturnSlotAddress = 0;
         return previous;
     }
 
@@ -58,6 +122,22 @@ public static class GuestThreadExecution
         _pendingEntryExit = false;
         _pendingEntryExitStatus = 0;
         _pendingEntryExitReason = null;
+        _hasCurrentImportCallFrame = false;
+        _currentImportReturnRip = 0;
+        _currentImportResumeRsp = 0;
+        _currentImportReturnSlotAddress = 0;
+    }
+
+    public static ulong EnterFiber(ulong fiberAddress)
+    {
+        var previous = _currentFiberAddress;
+        _currentFiberAddress = fiberAddress;
+        return previous;
+    }
+
+    public static void RestoreFiber(ulong previousFiberAddress)
+    {
+        _currentFiberAddress = previousFiberAddress;
     }
 
     public static bool RequestCurrentThreadBlock(string reason)
@@ -104,4 +184,45 @@ public static class GuestThreadExecution
         _pendingEntryExitReason = null;
         return true;
     }
+
+    public static GuestImportCallFrame EnterImportCallFrame(
+        ulong returnRip,
+        ulong resumeRsp,
+        ulong returnSlotAddress)
+    {
+        var previous = new GuestImportCallFrame(
+            _hasCurrentImportCallFrame,
+            _currentImportReturnRip,
+            _currentImportResumeRsp,
+            _currentImportReturnSlotAddress);
+        _hasCurrentImportCallFrame = true;
+        _currentImportReturnRip = returnRip;
+        _currentImportResumeRsp = resumeRsp;
+        _currentImportReturnSlotAddress = returnSlotAddress;
+        return previous;
+    }
+
+    public static void RestoreImportCallFrame(GuestImportCallFrame previous)
+    {
+        _hasCurrentImportCallFrame = previous.IsValid;
+        _currentImportReturnRip = previous.ReturnRip;
+        _currentImportResumeRsp = previous.ResumeRsp;
+        _currentImportReturnSlotAddress = previous.ReturnSlotAddress;
+    }
+
+    public static bool TryGetCurrentImportCallFrame(out GuestImportCallFrame frame)
+    {
+        if (!_hasCurrentImportCallFrame)
+        {
+            frame = default;
+            return false;
+        }
+
+        frame = new GuestImportCallFrame(
+            true,
+            _currentImportReturnRip,
+            _currentImportResumeRsp,
+            _currentImportReturnSlotAddress);
+        return true;
+    }
 }

src/SharpEmu.HLE/IGuestMemoryAllocator.cs

@@ -0,0 +1,9 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+public interface IGuestMemoryAllocator
+{
+    bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address);
+}

src/SharpEmu.Libs/Agc/Gen5ShaderTranslator.cs

@@ -0,0 +1,73 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using SharpEmu.Libs.VideoOut;
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.Agc;
+
+internal static class Gen5ShaderTranslator
+{
+    private static readonly uint[] FullscreenBarycentricEs =
+    [
+        0xBFA00001, 0x7E000000, 0x7E000000, 0x7E000000,
+        0x93EBFF03, 0x00080008, 0x8F6A8C6B, 0x8700FF03,
+        0x000000FF, 0x887C6A00, 0xBF900009, 0x81EA6BC0,
+        0x90FE6AC1, 0xF8000941, 0x00000000, 0x81EA00C0,
+        0xBF8CFF0F, 0x90FE6AC1, 0x36040A81, 0x2C060A81,
+        0x7E000280, 0x7E0202F2, 0xD7460002, 0x03050302,
+        0xD7460003, 0x03050303, 0x7E040B02, 0x7E060B03,
+        0xF80008CF, 0x01000302, 0xBF810000,
+    ];
+
+    private static readonly uint[] FullscreenBarycentricPs =
+    [
+        0xD52F0000, 0x00000200,
+        0xD52F0001, 0x00000602,
+        0xF8001C0F, 0x00000100,
+        0xBF810000,
+    ];
+
+    public static bool TryTranslate(
+        CpuContext ctx,
+        ulong exportShaderAddress,
+        ulong pixelShaderAddress,
+        uint psInputEna,
+        uint psInputAddr,
+        out GuestDrawKind drawKind)
+    {
+        drawKind = GuestDrawKind.None;
+        if (exportShaderAddress == 0 ||
+            pixelShaderAddress == 0 ||
+            psInputEna != 0x00000002 ||
+            psInputAddr != 0x00000002 ||
+            !MatchesProgram(ctx, exportShaderAddress, FullscreenBarycentricEs) ||
+            !MatchesProgram(ctx, pixelShaderAddress, FullscreenBarycentricPs))
+        {
+            return false;
+        }
+
+        drawKind = GuestDrawKind.FullscreenBarycentric;
+        return true;
+    }
+
+    private static bool MatchesProgram(CpuContext ctx, ulong address, ReadOnlySpan<uint> expected)
+    {
+        var bytes = new byte[expected.Length * sizeof(uint)];
+        if (!ctx.Memory.TryRead(address, bytes))
+        {
+            return false;
+        }
+
+        for (var index = 0; index < expected.Length; index++)
+        {
+            if (BinaryPrimitives.ReadUInt32LittleEndian(bytes.AsSpan(index * sizeof(uint))) != expected[index])
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}

src/SharpEmu.Libs/Ampr/AmprExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using SharpEmu.Libs.Kernel;
 using System.Buffers.Binary;
 using System.Collections.Concurrent;
 
@@ -17,8 +18,10 @@ public static class AmprExports
     private const ulong CommandBufferAux1Offset = 0x20;
     private const ulong ReadFileRecordSize = 0x30;
     private const ulong KernelEventQueueRecordSize = 0x30;
+    private const ulong WriteAddressRecordSize = 0x20;
     private const uint ReadFileRecordType = 1;
     private const uint KernelEventQueueRecordType = 2;
+    private const uint WriteAddressRecordType = 3;
     private static readonly ConcurrentDictionary<ulong, CommandBufferState> _commandBuffers = new();
 
     private sealed class CommandBufferState
@@ -284,6 +287,18 @@ public static class AmprExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "C+IEj+BsAFM",
+        ExportName = "sceAmprMeasureCommandSizeWriteAddressOnCompletion",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int MeasureCommandSizeWriteAddressOnCompletion(CpuContext ctx)
+    {
+        TraceAmpr(ctx, "measure_write_address_complete", 0, WriteAddressRecordSize, 0);
+        ctx[CpuRegister.Rax] = WriteAddressRecordSize;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "tZDDEo2tE5k",
         ExportName = "sceAmprCommandBufferGetSize",
@@ -362,6 +377,92 @@ public static class AmprExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "sJXyWHjP-F8",
+        ExportName = "sceAmprCommandBufferWriteAddressOnCompletion",
+        Target = Generation.Gen5,
+        LibraryName = "libSceAmpr")]
+    public static int CommandBufferWriteAddressOnCompletion(CpuContext ctx)
+    {
+        var commandBuffer = ctx[CpuRegister.Rdi];
+        var address = ctx[CpuRegister.Rsi];
+        var value = ctx[CpuRegister.Rdx];
+
+        if (commandBuffer == 0 || address == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!AppendWriteAddressRecord(ctx, commandBuffer, address, value))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        TraceAmpr(ctx, "write_address_complete", commandBuffer, address, value);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    public static int CompleteCommandBuffer(CpuContext ctx, ulong commandBuffer)
+    {
+        if (commandBuffer == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryGetCommandBufferState(ctx, commandBuffer, out var buffer, out _, out var state) || state is null)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ulong writeOffset;
+        lock (state)
+        {
+            writeOffset = state.WriteOffset;
+        }
+
+        var offset = 0UL;
+        while (offset < writeOffset)
+        {
+            if (!TryReadUInt32(ctx, buffer + offset, out var recordType))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            switch (recordType)
+            {
+                case ReadFileRecordType:
+                    offset += ReadFileRecordSize;
+                    break;
+
+                case KernelEventQueueRecordType:
+                    if (!CompleteKernelEventQueueRecord(ctx, buffer + offset))
+                    {
+                        return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                    }
+
+                    offset += KernelEventQueueRecordSize;
+                    break;
+
+                case WriteAddressRecordType:
+                    if (!CompleteWriteAddressRecord(ctx, buffer + offset))
+                    {
+                        return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+                    }
+
+                    offset += WriteAddressRecordSize;
+                    break;
+
+                default:
+                    TraceAmpr(ctx, "complete_unknown", commandBuffer, recordType, offset);
+                    return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+            }
+        }
+
+        TraceAmpr(ctx, "complete", commandBuffer, buffer, writeOffset);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     private static bool InitializeCommandBuffer(
         CpuContext ctx,
         ulong commandBuffer,
@@ -576,6 +677,17 @@ public static class AmprExports
         return AppendCommandBufferRecord(ctx, commandBuffer, record);
     }
 
+    private static bool AppendWriteAddressRecord(CpuContext ctx, ulong commandBuffer, ulong address, ulong value)
+    {
+        Span<byte> record = stackalloc byte[(int)WriteAddressRecordSize];
+        record.Clear();
+        BinaryPrimitives.WriteUInt32LittleEndian(record[0x00..], WriteAddressRecordType);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x08..], address);
+        BinaryPrimitives.WriteUInt64LittleEndian(record[0x10..], value);
+
+        return AppendCommandBufferRecord(ctx, commandBuffer, record);
+    }
+
     private static bool AppendCommandBufferRecord(CpuContext ctx, ulong commandBuffer, ReadOnlySpan<byte> record)
     {
         if (!TryGetCommandBufferState(ctx, commandBuffer, out _, out _, out var state) || state is null)
@@ -604,6 +716,66 @@ public static class AmprExports
         return true;
     }
 
+    private static bool CompleteKernelEventQueueRecord(CpuContext ctx, ulong recordAddress)
+    {
+        Span<byte> record = stackalloc byte[(int)KernelEventQueueRecordSize];
+        if (!ctx.Memory.TryRead(recordAddress, record))
+        {
+            return false;
+        }
+
+        var filter = unchecked((short)BinaryPrimitives.ReadUInt32LittleEndian(record[0x04..]));
+        var equeue = BinaryPrimitives.ReadUInt64LittleEndian(record[0x08..]);
+        var ident = BinaryPrimitives.ReadUInt64LittleEndian(record[0x10..]);
+        var userData = BinaryPrimitives.ReadUInt64LittleEndian(record[0x18..]);
+        var data = BinaryPrimitives.ReadUInt64LittleEndian(record[0x20..]);
+        var extra = BinaryPrimitives.ReadUInt64LittleEndian(record[0x28..]);
+
+        var queuedEvent = new KernelEventQueueCompatExports.KernelQueuedEvent(
+            ident,
+            filter,
+            0x20,
+            unchecked((uint)extra),
+            data,
+            userData);
+
+        _ = KernelEventQueueCompatExports.EnqueueEvent(equeue, queuedEvent);
+        TraceAmpr(ctx, "complete_equeue", equeue, ident, data);
+        return true;
+    }
+
+    private static bool CompleteWriteAddressRecord(CpuContext ctx, ulong recordAddress)
+    {
+        Span<byte> record = stackalloc byte[(int)WriteAddressRecordSize];
+        if (!ctx.Memory.TryRead(recordAddress, record))
+        {
+            return false;
+        }
+
+        var address = BinaryPrimitives.ReadUInt64LittleEndian(record[0x08..]);
+        var value = BinaryPrimitives.ReadUInt64LittleEndian(record[0x10..]);
+        if (!ctx.TryWriteUInt64(address, value))
+        {
+            return false;
+        }
+
+        TraceAmpr(ctx, "complete_write_address", address, value, 0);
+        return true;
+    }
+
+    private static bool TryReadUInt32(CpuContext ctx, ulong address, out uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+        return true;
+    }
+
     private static void TraceAmpr(CpuContext ctx, string operation, ulong commandBuffer, ulong arg0, ulong arg1)
     {
         if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_AMPR"), "1", StringComparison.Ordinal))

src/SharpEmu.Libs/AppContent/AppContentExports.cs

@@ -4,6 +4,7 @@
 using SharpEmu.HLE;
 using System.Buffers.Binary;
 using System.Text;
+using System.Text.Json;
 
 namespace SharpEmu.Libs.AppContent;
 
@@ -11,6 +12,8 @@ public static class AppContentExports
 {
     private const ulong BootParamAttrOffset = 4;
     private const string Temp0MountPoint = "/temp0";
+    private const uint AppParamSkuFlag = 0;
+    private const int AppParamSkuFlagFull = 3;
 
     [SysAbiExport(
         Nid = "R9lA82OraNs",
@@ -59,6 +62,41 @@ public static class AppContentExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "99b82IKXpH4",
+        ExportName = "sceAppContentAppParamGetInt",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceAppContent")]
+    public static int AppContentAppParamGetInt(CpuContext ctx)
+    {
+        var paramId = (uint)ctx[CpuRegister.Rdi];
+        var valueAddress = ctx[CpuRegister.Rsi];
+        if (valueAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        int value;
+        if (paramId == AppParamSkuFlag)
+        {
+            value = AppParamSkuFlagFull;
+        }
+        else if (!TryReadUserDefinedParam(paramId, out value))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Span<byte> valueBytes = stackalloc byte[sizeof(int)];
+        BinaryPrimitives.WriteInt32LittleEndian(valueBytes, value);
+        if (!ctx.Memory.TryWrite(valueAddress, valueBytes))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceAppContent($"app_param_get_int id={paramId} value={value}");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     [SysAbiExport(
         Nid = "buYbeLOGWmA",
         ExportName = "sceAppContentTemporaryDataMount2",
@@ -83,6 +121,69 @@ public static class AppContentExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    private static bool TryReadUserDefinedParam(uint paramId, out int value)
+    {
+        value = 0;
+        if (paramId is < 1 or > 4)
+        {
+            return false;
+        }
+
+        var app0Root = Environment.GetEnvironmentVariable("SHARPEMU_APP0_DIR");
+        if (string.IsNullOrWhiteSpace(app0Root))
+        {
+            return true;
+        }
+
+        var paramJsonPath = Path.Combine(app0Root, "sce_sys", "param.json");
+        if (!File.Exists(paramJsonPath))
+        {
+            return true;
+        }
+
+        try
+        {
+            using var stream = File.OpenRead(paramJsonPath);
+            using var document = JsonDocument.Parse(stream);
+            var propertyName = $"userDefinedParam{paramId}";
+            if (document.RootElement.TryGetProperty(propertyName, out var element) &&
+                element.TryGetInt32(out var parsedValue))
+            {
+                value = parsedValue;
+            }
+
+            return true;
+        }
+        catch (IOException)
+        {
+            return true;
+        }
+        catch (UnauthorizedAccessException)
+        {
+            return true;
+        }
+        catch (JsonException)
+        {
+            return true;
+        }
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)(int)result);
+        return (int)result;
+    }
+
+    private static void TraceAppContent(string message)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_APP_CONTENT"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine($"[LOADER][TRACE] app_content.{message}");
+    }
+
     private static string ResolveTemp0Root()
     {
         const string temp0VariableName = "SHARPEMU_TEMP0_DIR";

src/SharpEmu.Libs/CommonDialog/CommonDialogExports.cs

@@ -0,0 +1,38 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.CommonDialog;
+
+public static class CommonDialogExports
+{
+    private const int AlreadySystemInitialized = unchecked((int)0x80B80002);
+    private static int _initialized;
+
+    [SysAbiExport(
+        Nid = "uoUpLGNkygk",
+        ExportName = "sceCommonDialogInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceCommonDialog")]
+    public static int CommonDialogInitialize(CpuContext ctx)
+    {
+        var result = Interlocked.Exchange(ref _initialized, 1) == 0
+            ? 0
+            : AlreadySystemInitialized;
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    [SysAbiExport(
+        Nid = "BQ3tey0JmQM",
+        ExportName = "sceCommonDialogIsUsed",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceCommonDialog")]
+    public static int CommonDialogIsUsed(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}

src/SharpEmu.Libs/GameUpdate/GameUpdateExports.cs

@@ -0,0 +1,24 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.GameUpdate;
+
+public static class GameUpdateExports
+{
+    private static int _initialized;
+
+    [SysAbiExport(
+        Nid = "YJtKLttI9fM",
+        ExportName = "sceGameUpdateInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceGameUpdate")]
+    public static int GameUpdateInitialize(CpuContext ctx)
+    {
+        Interlocked.Exchange(ref _initialized, 1);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}

src/SharpEmu.Libs/Json/JsonExports.cs

@@ -0,0 +1,91 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Json;
+
+public static class JsonExports
+{
+    [SysAbiExport(
+        Nid = "-hJRce8wn1U",
+        ExportName = "_ZN3sce4Json12MemAllocatorC2Ev",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int MemAllocatorConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        TraceJson("MemAllocator.ctor", thisAddress, 0);
+        ctx[CpuRegister.Rax] = thisAddress;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "OcAgPxcq5Vk",
+        ExportName = "_ZN3sce4Json12MemAllocatorD2Ev",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int MemAllocatorDestructor(CpuContext ctx)
+    {
+        TraceJson("MemAllocator.dtor", ctx[CpuRegister.Rdi], 0);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "cK6bYHf-Q5E",
+        ExportName = "_ZN3sce4Json11InitializerC1Ev",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int InitializerConstructor(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        TraceJson("Initializer.ctor", thisAddress, 0);
+        ctx[CpuRegister.Rax] = thisAddress;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "RujUxbr3haM",
+        ExportName = "_ZN3sce4Json11InitializerD1Ev",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int InitializerDestructor(CpuContext ctx)
+    {
+        TraceJson("Initializer.dtor", ctx[CpuRegister.Rdi], 0);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "Cxwy7wHq4J0",
+        ExportName = "_ZN3sce4Json11Initializer10initializeEPKNS0_13InitParameterE",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceJson")]
+    public static int InitializerInitialize(CpuContext ctx)
+    {
+        var thisAddress = ctx[CpuRegister.Rdi];
+        var initParameterAddress = ctx[CpuRegister.Rsi];
+        if (thisAddress == 0)
+        {
+            ctx[CpuRegister.Rax] = unchecked((ulong)(int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        TraceJson("Initializer.initialize", thisAddress, initParameterAddress);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static void TraceJson(string operation, ulong thisAddress, ulong argument)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_JSON"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] json.{operation} this=0x{thisAddress:X16} arg=0x{argument:X16}");
+    }
+}

src/SharpEmu.Libs/Kernel/KernelAprCompatExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using SharpEmu.Libs.Ampr;
 using System.Buffers.Binary;
 using System.Collections.Concurrent;
 using System.Threading;
@@ -38,6 +39,12 @@ public static class KernelAprCompatExports
 
         _submittedCommandBuffers[submissionId] = commandBuffer;
 
+        var completionResult = AmprExports.CompleteCommandBuffer(ctx, commandBuffer);
+        if (completionResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return completionResult;
+        }
+
         if (outSubmissionId != 0 && !TryWriteUInt32(ctx, outSubmissionId, submissionId))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
@@ -93,6 +100,12 @@ public static class KernelAprCompatExports
         var submissionId = unchecked((uint)Interlocked.Increment(ref _nextSubmissionId));
         _submittedCommandBuffers[submissionId] = commandBuffer;
 
+        var completionResult = AmprExports.CompleteCommandBuffer(ctx, commandBuffer);
+        if (completionResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return completionResult;
+        }
+
         TraceApr(ctx, "submit", submissionId, commandBuffer, ctx[CpuRegister.Rsi], 0);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
@@ -114,6 +127,12 @@ public static class KernelAprCompatExports
         var submissionId = unchecked((uint)Interlocked.Increment(ref _nextSubmissionId));
         _submittedCommandBuffers[submissionId] = commandBuffer;
 
+        var completionResult = AmprExports.CompleteCommandBuffer(ctx, commandBuffer);
+        if (completionResult != (int)OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return completionResult;
+        }
+
         if (!TryWriteUInt32(ctx, outSubmissionId, submissionId))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
@@ -154,5 +173,12 @@ public static class KernelAprCompatExports
         _ = ctx.TryReadUInt64(ctx[CpuRegister.Rsp], out returnRip);
         Console.Error.WriteLine(
             $"[LOADER][TRACE] apr.{operation}: id=0x{submissionId:X8} cmd=0x{commandBuffer:X16} priority=0x{priority:X16} aux=0x{aux:X16} ret=0x{returnRip:X16}");
+        if (aux != 0 &&
+            ctx.TryReadUInt64(aux, out var result0) &&
+            ctx.TryReadUInt64(aux + sizeof(ulong), out var result1))
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][TRACE] apr.{operation}.result: addr=0x{aux:X16} q0=0x{result0:X16} q1=0x{result1:X16}");
+        }
     }
 }

src/SharpEmu.Libs/Kernel/KernelEventFlagCompatExports.cs

@@ -0,0 +1,579 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+using System.Text;
+using SharpEmu.HLE;
+using SharpEmu.Libs.Fiber;
+
+namespace SharpEmu.Libs.Kernel;
+
+public static class KernelEventFlagCompatExports
+{
+    private const int MaxEventFlagNameLength = 31;
+    private const int HostWaitPumpMilliseconds = 1;
+    private const uint AttrThreadFifo = 0x01;
+    private const uint AttrThreadPriority = 0x02;
+    private const uint AttrSingle = 0x10;
+    private const uint AttrMulti = 0x20;
+    private const uint WaitAnd = 0x01;
+    private const uint WaitOr = 0x02;
+    private const uint ClearAll = 0x10;
+    private const uint ClearPattern = 0x20;
+
+    private static readonly ConcurrentDictionary<ulong, EventFlagState> _eventFlags = new();
+    private static long _nextEventFlagHandle = 1;
+
+    private sealed class EventFlagState
+    {
+        public required string Name { get; init; }
+        public required uint Attributes { get; init; }
+        public ulong Bits { get; set; }
+        public int WaitingThreads { get; set; }
+        public object Gate { get; } = new();
+    }
+
+    [SysAbiExport(
+        Nid = "BpFoboUJoZU",
+        ExportName = "sceKernelCreateEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCreateEventFlag(CpuContext ctx)
+    {
+        var outAddress = ctx[CpuRegister.Rdi];
+        var nameAddress = ctx[CpuRegister.Rsi];
+        var attributes = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var initialPattern = ctx[CpuRegister.Rcx];
+        var optionAddress = ctx[CpuRegister.R8];
+
+        if (outAddress == 0 ||
+            nameAddress == 0 ||
+            optionAddress != 0 ||
+            !IsValidAttributes(attributes))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryReadNullTerminatedUtf8(ctx, nameAddress, MaxEventFlagNameLength + 1, out var name))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        if (Encoding.UTF8.GetByteCount(name) > MaxEventFlagNameLength)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        var handle = unchecked((ulong)Interlocked.Increment(ref _nextEventFlagHandle));
+        _eventFlags[handle] = new EventFlagState
+        {
+            Name = name,
+            Attributes = attributes,
+            Bits = initialPattern,
+        };
+
+        if (!ctx.TryWriteUInt64(outAddress, handle))
+        {
+            _eventFlags.TryRemove(handle, out _);
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceEventFlag($"create handle=0x{handle:X16} name='{name}' attr=0x{attributes:X2} bits=0x{initialPattern:X16}");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "8mql9OcQnd4",
+        ExportName = "sceKernelDeleteEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelDeleteEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        if (!_eventFlags.TryRemove(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        lock (state.Gate)
+        {
+            Monitor.PulseAll(state.Gate);
+        }
+
+        TraceEventFlag($"delete handle=0x{handle:X16} name='{state.Name}'");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "IOnSvHzqu6A",
+        ExportName = "sceKernelSetEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelSetEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var pattern = ctx[CpuRegister.Rsi];
+        var returnRip = GetCurrentReturnRip();
+        if (!_eventFlags.TryGetValue(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        lock (state.Gate)
+        {
+            state.Bits |= pattern;
+            Monitor.PulseAll(state.Gate);
+            TraceEventFlag($"set handle=0x{handle:X16} pattern=0x{pattern:X16} bits=0x{state.Bits:X16} ret=0x{returnRip:X16}");
+        }
+
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "7uhBFWRAS60",
+        ExportName = "sceKernelClearEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelClearEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var pattern = ctx[CpuRegister.Rsi];
+        if (!_eventFlags.TryGetValue(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        lock (state.Gate)
+        {
+            state.Bits &= pattern;
+            TraceEventFlag($"clear handle=0x{handle:X16} mask=0x{pattern:X16} bits=0x{state.Bits:X16}");
+        }
+
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "9lvj5DjHZiA",
+        ExportName = "sceKernelPollEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelPollEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var pattern = ctx[CpuRegister.Rsi];
+        var waitMode = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var resultAddress = ctx[CpuRegister.Rcx];
+
+        if (!_eventFlags.TryGetValue(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (pattern == 0 || !IsValidWaitMode(waitMode))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (state.Gate)
+        {
+            if (!TryWriteResultPattern(ctx, resultAddress, state.Bits))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            if (!IsSatisfied(state.Bits, pattern, waitMode))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY);
+            }
+
+            ApplyClearMode(state, pattern, waitMode);
+            TraceEventFlag($"poll handle=0x{handle:X16} pattern=0x{pattern:X16} mode=0x{waitMode:X2} bits=0x{state.Bits:X16}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "JTvBflhYazQ",
+        ExportName = "sceKernelWaitEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelWaitEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var pattern = ctx[CpuRegister.Rsi];
+        var waitMode = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var resultAddress = ctx[CpuRegister.Rcx];
+        var timeoutAddress = ctx[CpuRegister.R8];
+        var returnRip = GetCurrentReturnRip();
+
+        if (!_eventFlags.TryGetValue(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (pattern == 0 || !IsValidWaitMode(waitMode))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        uint timeoutUsec = 0;
+        if (timeoutAddress != 0 && !TryReadUInt32(ctx, timeoutAddress, out timeoutUsec))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        Monitor.Enter(state.Gate);
+        try
+        {
+            if (TryCompleteSatisfiedWait(ctx, state, pattern, waitMode, out var immediateWaitResult))
+            {
+                return SetReturn(ctx, immediateWaitResult);
+            }
+
+            if (timeoutAddress != 0)
+            {
+                _ = TryWriteUInt32(ctx, timeoutAddress, 0);
+                _ = TryWriteResultPattern(ctx, resultAddress, state.Bits);
+                TraceEventFlag($"wait-timeout handle=0x{handle:X16} pattern=0x{pattern:X16} timeout={timeoutUsec} ret=0x{returnRip:X16}");
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT);
+            }
+
+            var currentGuestThread = GuestThreadExecution.CurrentGuestThreadHandle;
+            var currentFiber = FiberExports.GetCurrentFiberAddressForDiagnostics(ctx);
+            var managedThread = Environment.CurrentManagedThreadId;
+            var requestedBlock = GuestThreadExecution.RequestCurrentThreadBlock("sceKernelWaitEventFlag");
+            TraceEventFlag($"wait-unsatisfied handle=0x{handle:X16} pattern=0x{pattern:X16} bits=0x{state.Bits:X16} guest_thread=0x{currentGuestThread:X16} fiber=0x{currentFiber:X16} managed={managedThread} block={requestedBlock} ret=0x{returnRip:X16} frames={FormatFrameChain(ctx)}");
+            TraceEventFlag($"wait-object handle=0x{handle:X16} name='{state.Name}' {FormatGuestWaitObject(ctx)}");
+            if (!requestedBlock)
+            {
+                var scheduler = GuestThreadExecution.Scheduler;
+                if (scheduler is null)
+                {
+                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_TRY_AGAIN);
+                }
+
+                state.WaitingThreads++;
+                TraceEventFlag($"wait-pump handle=0x{handle:X16} pattern=0x{pattern:X16} waiters={state.WaitingThreads} guest_thread=0x{currentGuestThread:X16} fiber=0x{currentFiber:X16} managed={managedThread} ret=0x{returnRip:X16}");
+                var releaseWaiter = true;
+                try
+                {
+                    while (true)
+                    {
+                        Monitor.Exit(state.Gate);
+                        try
+                        {
+                            scheduler.Pump(ctx, "sceKernelWaitEventFlag");
+                        }
+                        finally
+                        {
+                            Monitor.Enter(state.Gate);
+                        }
+
+                        if (TryCompleteSatisfiedWait(ctx, state, pattern, waitMode, out var pumpedWaitResult))
+                        {
+                            state.WaitingThreads = Math.Max(0, state.WaitingThreads - 1);
+                            releaseWaiter = false;
+                            TraceEventFlag($"wait-wake handle=0x{handle:X16} pattern=0x{pattern:X16} bits=0x{state.Bits:X16} waiters={state.WaitingThreads} ret=0x{returnRip:X16}");
+                            return SetReturn(ctx, pumpedWaitResult);
+                        }
+
+                        Monitor.Wait(state.Gate, HostWaitPumpMilliseconds);
+                    }
+                }
+                finally
+                {
+                    if (releaseWaiter)
+                    {
+                        state.WaitingThreads = Math.Max(0, state.WaitingThreads - 1);
+                    }
+                }
+            }
+
+            state.WaitingThreads++;
+            TraceEventFlag($"wait-block handle=0x{handle:X16} pattern=0x{pattern:X16} waiters={state.WaitingThreads} guest_thread=0x{currentGuestThread:X16} fiber=0x{currentFiber:X16} managed={managedThread} ret=0x{returnRip:X16}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+        finally
+        {
+            Monitor.Exit(state.Gate);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "PZku4ZrXJqg",
+        ExportName = "sceKernelCancelEventFlag",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCancelEventFlag(CpuContext ctx)
+    {
+        var handle = ctx[CpuRegister.Rdi];
+        var setPattern = ctx[CpuRegister.Rsi];
+        var waiterCountAddress = ctx[CpuRegister.Rdx];
+        if (!_eventFlags.TryGetValue(handle, out var state))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        lock (state.Gate)
+        {
+            if (waiterCountAddress != 0 &&
+                !TryWriteUInt32(ctx, waiterCountAddress, unchecked((uint)state.WaitingThreads)))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            state.Bits = setPattern;
+            state.WaitingThreads = 0;
+            Monitor.PulseAll(state.Gate);
+            TraceEventFlag($"cancel handle=0x{handle:X16} bits=0x{setPattern:X16}");
+        }
+
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private static bool IsValidAttributes(uint attributes)
+    {
+        var queueMode = attributes & 0x0F;
+        var threadMode = attributes & 0xF0;
+        return (queueMode is 0 or AttrThreadFifo or AttrThreadPriority) &&
+            (threadMode is 0 or AttrSingle or AttrMulti) &&
+            (attributes & ~0x33u) == 0;
+    }
+
+    private static bool IsValidWaitMode(uint waitMode)
+    {
+        var condition = waitMode & 0x0F;
+        var clearMode = waitMode & 0xF0;
+        return condition is WaitAnd or WaitOr &&
+            clearMode is 0 or ClearAll or ClearPattern &&
+            (waitMode & ~0x33u) == 0;
+    }
+
+    private static bool IsSatisfied(ulong bits, ulong pattern, uint waitMode) =>
+        (waitMode & 0x0F) == WaitAnd
+            ? (bits & pattern) == pattern
+            : (bits & pattern) != 0;
+
+    private static void ApplyClearMode(EventFlagState state, ulong pattern, uint waitMode)
+    {
+        switch (waitMode & 0xF0)
+        {
+            case ClearAll:
+                state.Bits = 0;
+                break;
+            case ClearPattern:
+                state.Bits &= ~pattern;
+                break;
+        }
+    }
+
+    private static bool TryCompleteSatisfiedWait(
+        CpuContext ctx,
+        EventFlagState state,
+        ulong pattern,
+        uint waitMode,
+        out OrbisGen2Result result)
+    {
+        result = OrbisGen2Result.ORBIS_GEN2_OK;
+        if (!IsSatisfied(state.Bits, pattern, waitMode))
+        {
+            return false;
+        }
+
+        if (!TryWriteResultPattern(ctx, ctx[CpuRegister.Rcx], state.Bits))
+        {
+            result = OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            return true;
+        }
+
+        ApplyClearMode(state, pattern, waitMode);
+        return true;
+    }
+
+    private static bool TryWriteResultPattern(CpuContext ctx, ulong address, ulong bits) =>
+        address == 0 || ctx.TryWriteUInt64(address, bits);
+
+    private static bool TryReadUInt32(CpuContext ctx, ulong address, out uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryReadUInt64(CpuContext ctx, ulong address, out ulong value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ulong)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt64LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryReadByte(CpuContext ctx, ulong address, out byte value)
+    {
+        Span<byte> buffer = stackalloc byte[1];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = buffer[0];
+        return true;
+    }
+
+    private static bool TryWriteUInt32(CpuContext ctx, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static bool TryReadNullTerminatedUtf8(CpuContext ctx, ulong address, int capacity, out string value)
+    {
+        var bytes = new byte[capacity];
+        for (var index = 0; index < bytes.Length; index++)
+        {
+            Span<byte> current = stackalloc byte[1];
+            if (!ctx.Memory.TryRead(address + (ulong)index, current))
+            {
+                value = string.Empty;
+                return false;
+            }
+
+            if (current[0] == 0)
+            {
+                value = Encoding.UTF8.GetString(bytes, 0, index);
+                return true;
+            }
+
+            bytes[index] = current[0];
+        }
+
+        value = Encoding.UTF8.GetString(bytes);
+        return true;
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        var value = (int)result;
+        ctx[CpuRegister.Rax] = unchecked((ulong)value);
+        return value;
+    }
+
+    private static void TraceEventFlag(string message)
+    {
+        if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_EVENT_FLAG"), "1", StringComparison.Ordinal))
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] event_flag.{message}");
+        }
+    }
+
+    private static ulong GetCurrentReturnRip() =>
+        GuestThreadExecution.TryGetCurrentImportCallFrame(out var frame)
+            ? frame.ReturnRip
+            : 0UL;
+
+    private static string FormatFrameChain(CpuContext ctx)
+    {
+        Span<ulong> returns = stackalloc ulong[4];
+        var count = 0;
+        var frame = ctx[CpuRegister.Rbp];
+        for (var index = 0; index < returns.Length && frame != 0; index++)
+        {
+            if (!ctx.TryReadUInt64(frame, out var nextFrame) ||
+                !ctx.TryReadUInt64(frame + sizeof(ulong), out var returnAddress))
+            {
+                break;
+            }
+
+            returns[count++] = returnAddress;
+            if (nextFrame <= frame)
+            {
+                break;
+            }
+
+            frame = nextFrame;
+        }
+
+        return count switch
+        {
+            0 => "none",
+            1 => $"0x{returns[0]:X16}",
+            2 => $"0x{returns[0]:X16},0x{returns[1]:X16}",
+            3 => $"0x{returns[0]:X16},0x{returns[1]:X16},0x{returns[2]:X16}",
+            _ => $"0x{returns[0]:X16},0x{returns[1]:X16},0x{returns[2]:X16},0x{returns[3]:X16}",
+        };
+    }
+
+    private static string FormatGuestWaitObject(CpuContext ctx)
+    {
+        var r12 = ctx[CpuRegister.R12];
+        var r13 = ctx[CpuRegister.R13];
+        var objectAddress = r12 != 0
+            ? r12
+            : r13 >= 0xA8
+                ? r13 - 0xA8
+                : 0;
+
+        var builder = new StringBuilder(256);
+        builder.Append($"r12=0x{r12:X16} r13=0x{r13:X16}");
+        if (objectAddress == 0)
+        {
+            return builder.ToString();
+        }
+
+        builder.Append($" obj=0x{objectAddress:X16}");
+        AppendUInt32(builder, ctx, objectAddress + 0x58, "o58");
+        AppendUInt32(builder, ctx, objectAddress + 0x5C, "o5C");
+        AppendUInt64(builder, ctx, objectAddress + 0x60, "o60");
+        AppendByte(builder, ctx, objectAddress + 0x6C, "state6C");
+        AppendByte(builder, ctx, objectAddress + 0x6D, "o6D");
+        AppendByte(builder, ctx, objectAddress + 0xA0, "waitA0");
+        AppendByte(builder, ctx, objectAddress + 0xA1, "stateA1");
+        AppendByte(builder, ctx, objectAddress + 0xA2, "oA2");
+        AppendUInt64(builder, ctx, objectAddress + 0xA8, "eventA8");
+        if (r13 != 0)
+        {
+            AppendUInt64(builder, ctx, r13, "r13_0");
+            AppendUInt64(builder, ctx, r13 + 8, "r13_8");
+        }
+
+        return builder.ToString();
+    }
+
+    private static void AppendByte(StringBuilder builder, CpuContext ctx, ulong address, string name)
+    {
+        if (TryReadByte(ctx, address, out var value))
+        {
+            builder.Append($" {name}=0x{value:X2}");
+        }
+    }
+
+    private static void AppendUInt32(StringBuilder builder, CpuContext ctx, ulong address, string name)
+    {
+        if (TryReadUInt32(ctx, address, out var value))
+        {
+            builder.Append($" {name}=0x{value:X8}");
+        }
+    }
+
+    private static void AppendUInt64(StringBuilder builder, CpuContext ctx, ulong address, string name)
+    {
+        if (TryReadUInt64(ctx, address, out var value))
+        {
+            builder.Append($" {name}=0x{value:X16}");
+        }
+    }
+}

src/SharpEmu.Libs/Kernel/KernelEventQueueCompatExports.cs

@@ -9,10 +9,21 @@ namespace SharpEmu.Libs.Kernel;
 
 public static class KernelEventQueueCompatExports
 {
+    private const int KernelEventSize = 0x20;
+
     private static readonly object _eventQueueGate = new();
     private static readonly HashSet<ulong> _eventQueues = new();
+    private static readonly Dictionary<ulong, LinkedList<KernelQueuedEvent>> _pendingEvents = new();
     private static long _nextEventQueueHandle = 1;
 
+    public readonly record struct KernelQueuedEvent(
+        ulong Ident,
+        short Filter,
+        ushort Flags,
+        uint Fflags,
+        ulong Data,
+        ulong UserData);
+
     [SysAbiExport(
         Nid = "D0OdFMjp46I",
         ExportName = "sceKernelCreateEqueue",
@@ -30,6 +41,7 @@ public static class KernelEventQueueCompatExports
         lock (_eventQueueGate)
         {
             _eventQueues.Add(handle);
+            _pendingEvents[handle] = new LinkedList<KernelQueuedEvent>();
         }
 
         if (!ctx.TryWriteUInt64(outAddress, handle))
@@ -52,6 +64,7 @@ public static class KernelEventQueueCompatExports
         lock (_eventQueueGate)
         {
             _eventQueues.Remove(handle);
+            _pendingEvents.Remove(handle);
         }
 
         TraceEventQueue(ctx, "delete", handle);
@@ -165,23 +178,168 @@ public static class KernelEventQueueCompatExports
         LibraryName = "libKernel")]
     public static int KernelWaitEqueue(CpuContext ctx)
     {
+        var handle = ctx[CpuRegister.Rdi];
+        var eventsAddress = ctx[CpuRegister.Rsi];
+        var eventCapacity = (int)Math.Min(ctx[CpuRegister.Rdx], int.MaxValue);
         var outCountAddress = ctx[CpuRegister.Rcx];
         var timeoutAddress = ctx[CpuRegister.R8];
-        if (outCountAddress != 0 && !TryWriteUInt32(ctx, outCountAddress, 0))
+
+        var deliveredCount = DequeueEvents(ctx, handle, eventsAddress, eventCapacity);
+        if (outCountAddress != 0 && !TryWriteUInt32(ctx, outCountAddress, (uint)deliveredCount))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        if (timeoutAddress == 0 && GuestThreadExecution.RequestCurrentThreadBlock("sceKernelWaitEqueue"))
+        if (deliveredCount > 0)
         {
-            TraceEventQueue(ctx, "wait-block", ctx[CpuRegister.Rdi]);
+            TraceEventQueue(ctx, "wait-deliver", handle);
             return (int)OrbisGen2Result.ORBIS_GEN2_OK;
         }
 
-        TraceEventQueue(ctx, "wait", ctx[CpuRegister.Rdi]);
+        if (timeoutAddress == 0 && GuestThreadExecution.RequestCurrentThreadBlock("sceKernelWaitEqueue"))
+        {
+            TraceEventQueue(ctx, "wait-block", handle);
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        TraceEventQueue(ctx, "wait", handle);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    public static bool IsValidEqueue(ulong handle)
+    {
+        lock (_eventQueueGate)
+        {
+            return _eventQueues.Contains(handle);
+        }
+    }
+
+    public static bool EnqueueEvent(ulong handle, KernelQueuedEvent queuedEvent)
+    {
+        lock (_eventQueueGate)
+        {
+            if (!_eventQueues.Contains(handle))
+            {
+                return false;
+            }
+
+            if (!_pendingEvents.TryGetValue(handle, out var queue))
+            {
+                queue = new LinkedList<KernelQueuedEvent>();
+                _pendingEvents[handle] = queue;
+            }
+
+            queue.AddLast(queuedEvent);
+            return true;
+        }
+    }
+
+    public static bool TriggerDisplayEvent(
+        ulong handle,
+        ulong ident,
+        short filter,
+        ulong eventHint,
+        ulong userData)
+    {
+        lock (_eventQueueGate)
+        {
+            if (!_eventQueues.Contains(handle))
+            {
+                return false;
+            }
+
+            if (!_pendingEvents.TryGetValue(handle, out var events))
+            {
+                events = new LinkedList<KernelQueuedEvent>();
+                _pendingEvents[handle] = events;
+            }
+
+            LinkedListNode<KernelQueuedEvent>? pendingNode = null;
+            for (var node = events.First; node is not null; node = node.Next)
+            {
+                if (node.Value.Ident == ident && node.Value.Filter == filter)
+                {
+                    pendingNode = node;
+                    break;
+                }
+            }
+
+            var count = 1UL;
+            if (pendingNode is not null)
+            {
+                count = Math.Min(((pendingNode.Value.Data >> 12) & 0xFUL) + 1, 0xFUL);
+            }
+
+            var timeBits = unchecked((ulong)Environment.TickCount64) & 0xFFFUL;
+            var eventData = timeBits | (count << 12) | (eventHint & 0xFFFF_FFFF_FFFF_0000UL);
+            var triggeredEvent = new KernelQueuedEvent(
+                ident,
+                filter,
+                0x20,
+                0,
+                eventData,
+                userData);
+
+            if (pendingNode is not null)
+            {
+                pendingNode.Value = triggeredEvent;
+            }
+            else
+            {
+                events.AddLast(triggeredEvent);
+            }
+
+            return true;
+        }
+    }
+
+    private static int DequeueEvents(CpuContext ctx, ulong handle, ulong eventsAddress, int eventCapacity)
+    {
+        if (eventsAddress == 0 || eventCapacity <= 0)
+        {
+            return 0;
+        }
+
+        KernelQueuedEvent[] events;
+        lock (_eventQueueGate)
+        {
+            if (!_pendingEvents.TryGetValue(handle, out var queue) || queue.Count == 0)
+            {
+                return 0;
+            }
+
+            var count = Math.Min(eventCapacity, queue.Count);
+            events = new KernelQueuedEvent[count];
+            for (var i = 0; i < count; i++)
+            {
+                events[i] = queue.First!.Value;
+                queue.RemoveFirst();
+            }
+        }
+
+        for (var i = 0; i < events.Length; i++)
+        {
+            if (!WriteKernelEvent(ctx, eventsAddress + ((ulong)i * KernelEventSize), events[i]))
+            {
+                return i;
+            }
+        }
+
+        return events.Length;
+    }
+
+    private static bool WriteKernelEvent(CpuContext ctx, ulong address, KernelQueuedEvent queuedEvent)
+    {
+        Span<byte> eventBytes = stackalloc byte[KernelEventSize];
+        BinaryPrimitives.WriteUInt64LittleEndian(eventBytes[0x00..], queuedEvent.Ident);
+        BinaryPrimitives.WriteInt16LittleEndian(eventBytes[0x08..], queuedEvent.Filter);
+        BinaryPrimitives.WriteUInt16LittleEndian(eventBytes[0x0A..], queuedEvent.Flags);
+        BinaryPrimitives.WriteUInt32LittleEndian(eventBytes[0x0C..], queuedEvent.Fflags);
+        BinaryPrimitives.WriteUInt64LittleEndian(eventBytes[0x10..], queuedEvent.Data);
+        BinaryPrimitives.WriteUInt64LittleEndian(eventBytes[0x18..], queuedEvent.UserData);
+        return ctx.Memory.TryWrite(address, eventBytes);
+    }
+
     private static void TraceEventQueue(CpuContext ctx, string operation, ulong handle)
     {
         if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_EQUEUE"), "1", StringComparison.Ordinal))

src/SharpEmu.Libs/Kernel/KernelMemoryCompatExports.cs

@@ -3,6 +3,7 @@
 
 using SharpEmu.HLE;
 using SharpEmu.Libs.Ampr;
+using System.Buffers;
 using System.Buffers.Binary;
 using System.Text;
 using System.Threading;
@@ -38,6 +39,13 @@ public static class KernelMemoryCompatExports
     private const int OrbisKernelBatchMapEntryProtectionOffset = 24;
     private const int OrbisKernelBatchMapEntryTypeOffset = 25;
     private const int OrbisKernelBatchMapEntryOperationOffset = 28;
+    private const ulong OrbisPageSize = 0x4000;
+    private const int OrbisProtCpuRead = 0x01;
+    private const int OrbisProtCpuWrite = 0x02;
+    private const int OrbisProtCpuExec = 0x04;
+    private const int OrbisProtGpuRead = 0x10;
+    private const int OrbisProtGpuWrite = 0x20;
+    private const int OrbisProtCpuReadWrite = OrbisProtCpuRead | OrbisProtCpuWrite;
     private const int SeekSet = 0;
     private const int SeekCur = 1;
     private const int SeekEnd = 2;
@@ -47,14 +55,15 @@ public static class KernelMemoryCompatExports
     private const int OrbisVirtualQueryInfoSize = 72;
     private const int OrbisKernelMaximumNameLength = 32;
     private const uint MemCommit = 0x1000;
-    private const uint PageNoAccess = 0x01;
-    private const uint PageReadOnly = 0x02;
-    private const uint PageReadWrite = 0x04;
-    private const uint PageWriteCopy = 0x08;
-    private const uint PageExecuteRead = 0x20;
-    private const uint PageExecuteReadWrite = 0x40;
-    private const uint PageExecuteWriteCopy = 0x80;
-    private const uint PageGuard = 0x100;
+    private const uint HostPageNoAccess = 0x01;
+    private const uint HostPageReadOnly = 0x02;
+    private const uint HostPageReadWrite = 0x04;
+    private const uint HostPageWriteCopy = 0x08;
+    private const uint HostPageExecute = 0x10;
+    private const uint HostPageExecuteRead = 0x20;
+    private const uint HostPageExecuteReadWrite = 0x40;
+    private const uint HostPageExecuteWriteCopy = 0x80;
+    private const uint HostPageGuard = 0x100;
     private const int Enomem = 12;
     private const int Einval = 22;
     private const int Erange = 34;
@@ -121,6 +130,10 @@ public static class KernelMemoryCompatExports
     [DllImport("kernel32.dll", SetLastError = true)]
     private static extern nuint VirtualQuery(nint lpAddress, out MemoryBasicInformation lpBuffer, nuint dwLength);
 
+    [DllImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool VirtualProtect(nint lpAddress, nuint dwSize, uint flNewProtect, out uint lpflOldProtect);
+
     private sealed class OpenDirectory
     {
         public required string Path { get; init; }
@@ -130,9 +143,59 @@ public static class KernelMemoryCompatExports
 
     private readonly record struct DirectAllocation(ulong Start, ulong Length, int MemoryType);
     private readonly record struct LibcHeapAllocation(nint BaseAddress, nuint Size, nuint Alignment);
-    private readonly record struct MappedRegion(ulong Address, ulong Length, int Protection, bool IsFlexible, ulong DirectStart);
+    private readonly record struct MappedRegion(ulong Address, ulong Length, int Protection, bool IsFlexible, bool IsDirect, ulong DirectStart);
     private readonly record struct BatchMapEntry(ulong Start, ulong Offset, ulong Length, byte Protection, byte Type, int Operation);
 
+    internal static bool TryAllocateHleData(
+        CpuContext ctx,
+        ulong length,
+        ulong alignment,
+        out ulong address)
+    {
+        address = 0;
+        if (length == 0 || length > int.MaxValue)
+        {
+            return false;
+        }
+
+        var mappedLength = AlignUp(length, 0x1000UL);
+        var effectiveAlignment = Math.Max(alignment, 0x1000UL);
+        lock (_memoryGate)
+        {
+            var desiredAddress = AlignUp(
+                _nextVirtualAddress == 0 ? 0x1_0000_0000UL : _nextVirtualAddress,
+                effectiveAlignment);
+            if (!TryReserveGuestVirtualRange(ctx, desiredAddress, mappedLength, OrbisProtCpuReadWrite, effectiveAlignment, out address) ||
+                address == 0)
+            {
+                return false;
+            }
+
+            _nextVirtualAddress = Math.Max(_nextVirtualAddress, address + mappedLength);
+            _mappedRegions[address] = new MappedRegion(
+                address,
+                mappedLength,
+                OrbisProtCpuReadWrite,
+                IsFlexible: false,
+                IsDirect: false,
+                DirectStart: 0);
+        }
+
+        var zeroes = new byte[(int)Math.Min(mappedLength, (ulong)MemsetChunkSize)];
+        for (ulong offset = 0; offset < mappedLength;)
+        {
+            var chunkLength = (int)Math.Min((ulong)zeroes.Length, mappedLength - offset);
+            if (!ctx.Memory.TryWrite(address + offset, zeroes.AsSpan(0, chunkLength)))
+            {
+                return false;
+            }
+
+            offset += (ulong)chunkLength;
+        }
+
+        return true;
+    }
+
     [SysAbiExport(
         Nid = "8zTFvBIAIN8",
         ExportName = "memset",
@@ -535,7 +598,6 @@ public static class KernelMemoryCompatExports
             ulong NextGpArg() => vaCursor.NextGpArg();
             double NextFloatArg() => vaCursor.NextFloatArg();
             rendered = FormatString(ctx, format, NextGpArg, NextFloatArg);
-            vaCursor.Commit();
         }
 
         Console.Write(rendered);
@@ -1238,6 +1300,13 @@ public static class KernelMemoryCompatExports
         LibraryName = "libKernel")]
     public static int KernelCloseUnderscore(CpuContext ctx) => KernelCloseCore(ctx, unchecked((int)ctx[CpuRegister.Rdi]));
 
+    [SysAbiExport(
+        Nid = "bY-PO6JhzhQ",
+        ExportName = "close",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixClose(CpuContext ctx) => KernelCloseCore(ctx, unchecked((int)ctx[CpuRegister.Rdi]));
+
     [SysAbiExport(
         Nid = "UK2Tl2DWUns",
         ExportName = "sceKernelClose",
@@ -1444,6 +1513,65 @@ public static class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "AqBioC2vF3I",
+        ExportName = "read",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixRead(CpuContext ctx) => KernelReadUnderscore(ctx);
+
+    [SysAbiExport(
+        Nid = "Cg4srZ6TKbU",
+        ExportName = "sceKernelRead",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelRead(CpuContext ctx) => KernelReadUnderscore(ctx);
+
+    [SysAbiExport(
+        Nid = "Oy6IpwgtYOk",
+        ExportName = "lseek",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixLseek(CpuContext ctx)
+    {
+        var result = KernelLseekCore(
+            unchecked((int)ctx[CpuRegister.Rdi]),
+            unchecked((long)ctx[CpuRegister.Rsi]),
+            unchecked((int)ctx[CpuRegister.Rdx]),
+            out var position);
+
+        if (result != OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            ctx[CpuRegister.Rax] = ulong.MaxValue;
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        }
+
+        ctx[CpuRegister.Rax] = unchecked((ulong)position);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "oib76F-12fk",
+        ExportName = "sceKernelLseek",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelLseek(CpuContext ctx)
+    {
+        var result = KernelLseekCore(
+            unchecked((int)ctx[CpuRegister.Rdi]),
+            unchecked((long)ctx[CpuRegister.Rsi]),
+            unchecked((int)ctx[CpuRegister.Rdx]),
+            out var position);
+
+        if (result != OrbisGen2Result.ORBIS_GEN2_OK)
+        {
+            return (int)result;
+        }
+
+        ctx[CpuRegister.Rax] = unchecked((ulong)position);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "taRWhTJFTgE",
         ExportName = "sceKernelGetdirentries",
@@ -1474,6 +1602,58 @@ public static class KernelMemoryCompatExports
             0);
     }
 
+    private static OrbisGen2Result KernelLseekCore(int fd, long offset, int whence, out long position)
+    {
+        position = -1;
+
+        FileStream? stream;
+        lock (_fdGate)
+        {
+            _openFiles.TryGetValue(fd, out stream);
+        }
+
+        if (stream is null)
+        {
+            LogIoTrace("lseek", $"fd:{fd}", $"offset={offset} whence={whence} result=badfd");
+            return OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
+        SeekOrigin origin;
+        switch (whence)
+        {
+            case SeekSet:
+                origin = SeekOrigin.Begin;
+                break;
+            case SeekCur:
+                origin = SeekOrigin.Current;
+                break;
+            case SeekEnd:
+                origin = SeekOrigin.End;
+                break;
+            default:
+                LogIoTrace("lseek", stream.Name, $"fd={fd} offset={offset} whence={whence} result=invalid_whence");
+                return OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        try
+        {
+            position = stream.Seek(offset, origin);
+        }
+        catch (IOException ex)
+        {
+            LogIoTrace("lseek", stream.Name, $"fd={fd} offset={offset} whence={whence} result=io_error ex={ex.Message}");
+            return OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+        catch (ArgumentException ex)
+        {
+            LogIoTrace("lseek", stream.Name, $"fd={fd} offset={offset} whence={whence} result=invalid ex={ex.Message}");
+            return OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        LogIoTrace("lseek", stream.Name, $"fd={fd} offset={offset} whence={whence} pos={position}");
+        return OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "FxVZqBAA7ks",
         ExportName = "_write",
@@ -1532,6 +1712,20 @@ public static class KernelMemoryCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "FN4gaPmuFV8",
+        ExportName = "write",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixWrite(CpuContext ctx) => KernelWriteUnderscore(ctx);
+
+    [SysAbiExport(
+        Nid = "4wSze92BhLI",
+        ExportName = "sceKernelWrite",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelWrite(CpuContext ctx) => KernelWriteUnderscore(ctx);
+
     [SysAbiExport(
         Nid = "lLMT9vJAck0",
         ExportName = "clock_gettime",
@@ -2048,7 +2242,7 @@ public static class KernelMemoryCompatExports
             }
             else
             {
-                reserved = TryReserveGuestVirtualRange(ctx, desiredAddress, length, protection, out mappedAddress);
+                reserved = TryReserveGuestVirtualRange(ctx, desiredAddress, length, protection, effectiveAlignment, out mappedAddress);
             }
             if (ShouldTraceDirectMemory())
             {
@@ -2075,7 +2269,13 @@ public static class KernelMemoryCompatExports
             }
 
             _nextVirtualAddress = Math.Max(_nextVirtualAddress, mappedAddress + length);
-            _mappedRegions[mappedAddress] = new MappedRegion(mappedAddress, length, protection, IsFlexible: false, DirectStart: directMemoryStart);
+            _mappedRegions[mappedAddress] = new MappedRegion(
+                mappedAddress,
+                length,
+                protection,
+                IsFlexible: false,
+                IsDirect: true,
+                DirectStart: directMemoryStart);
         }
 
         if (!ctx.TryWriteUInt64(inOutAddressPointer, mappedAddress))
@@ -2131,7 +2331,7 @@ public static class KernelMemoryCompatExports
             {
                 mappedAddress = requestedAddress;
             }
-            else if (!TryReserveGuestVirtualRange(ctx, desiredAddress, length, protection, out mappedAddress))
+            else if (!TryReserveGuestVirtualRange(ctx, desiredAddress, length, protection, OrbisPageSize, out mappedAddress))
             {
                 mappedAddress = requestedAddress != 0 && fixedMapping
                     ? requestedAddress
@@ -2148,7 +2348,13 @@ public static class KernelMemoryCompatExports
 
             _nextVirtualAddress = Math.Max(_nextVirtualAddress, mappedAddress + length);
             _allocatedFlexibleBytes = Math.Min(FlexibleMemorySizeBytes, _allocatedFlexibleBytes + length);
-            _mappedRegions[mappedAddress] = new MappedRegion(mappedAddress, length, protection, IsFlexible: true, DirectStart: 0);
+            _mappedRegions[mappedAddress] = new MappedRegion(
+                mappedAddress,
+                length,
+                protection,
+                IsFlexible: true,
+                IsDirect: false,
+                DirectStart: 0);
         }
 
         if (!ctx.TryWriteUInt64(inOutAddressPointer, mappedAddress))
@@ -2247,8 +2453,7 @@ public static class KernelMemoryCompatExports
                 return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
             }
 
-            if (region.DirectStart != 0 &&
-                _directAllocations.TryGetValue(region.DirectStart, out var allocation))
+            if (region.IsDirect && TryFindDirectAllocationLocked(region.DirectStart, out var allocation))
             {
                 memoryType = allocation.MemoryType;
             }
@@ -2266,7 +2471,7 @@ public static class KernelMemoryCompatExports
             stateFlags |= 0x01u;
         }
 
-        if (region.DirectStart != 0)
+        if (region.IsDirect)
         {
             stateFlags |= 0x02u;
         }
@@ -2280,7 +2485,7 @@ public static class KernelMemoryCompatExports
         BinaryPrimitives.WriteInt32LittleEndian(payload[28..32], memoryType);
         payload[32] = unchecked((byte)stateFlags);
 
-        var name = region.DirectStart != 0
+        var name = region.IsDirect
             ? "direct"
             : region.IsFlexible
                 ? "flexible"
@@ -2398,12 +2603,19 @@ public static class KernelMemoryCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
+        if (!TryNormalizeProtectRange(address, length, out var alignedAddress, out var alignedLength))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryProtectHostRange(alignedAddress, alignedLength, protection))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
         lock (_memoryGate)
         {
-            if (!TryApplyMappedRegionProtectionLocked(address, length, protection))
-            {
-                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
-            }
+            _ = TryApplyMappedRegionProtectionLocked(alignedAddress, alignedLength, protection);
         }
 
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
@@ -2425,12 +2637,19 @@ public static class KernelMemoryCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
+        if (!TryNormalizeProtectRange(address, length, out var alignedAddress, out var alignedLength))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        if (!TryProtectHostRange(alignedAddress, alignedLength, protection))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
+        }
+
         lock (_memoryGate)
         {
-            if (!TryApplyMappedRegionProtectionLocked(address, length, protection, memoryType))
-            {
-                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
-            }
+            _ = TryApplyMappedRegionProtectionLocked(alignedAddress, alignedLength, protection, memoryType);
         }
 
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
@@ -2502,7 +2721,6 @@ public static class KernelMemoryCompatExports
         ulong NextGpArg() => vaCursor.NextGpArg();
         double NextFloatArg() => vaCursor.NextFloatArg();
         var rendered = FormatString(ctx, format, NextGpArg, NextFloatArg);
-        vaCursor.Commit();
 
         var outputBytes = Encoding.UTF8.GetBytes(rendered);
         return WriteSnprintfOutput(ctx, destination, bufferSize, outputBytes);
@@ -2549,7 +2767,6 @@ public static class KernelMemoryCompatExports
             ulong NextGpArg() => vaCursor.NextGpArg();
             double NextFloatArg() => vaCursor.NextFloatArg();
             rendered = FormatString(ctx, format, NextGpArg, NextFloatArg);
-            vaCursor.Commit();
         }
 
         TraceWidePrintf(ctx, "vswprintf", destination, bufferSize, format, rendered);
@@ -3333,13 +3550,6 @@ public static class KernelMemoryCompatExports
                 : 0.0;
         }
 
-        public void Commit()
-        {
-            _ = TryWriteUInt32Compat(_ctx, _vaListAddress + 0, _gpOffset);
-            _ = TryWriteUInt32Compat(_ctx, _vaListAddress + 4, _fpOffset);
-            _ = TryWriteUInt64Compat(_ctx, _vaListAddress + 8, _overflowArgArea);
-        }
-
         public uint GpOffset => _gpOffset;
 
         public uint FpOffset => _fpOffset;
@@ -3394,6 +3604,7 @@ public static class KernelMemoryCompatExports
         ulong desiredAddress,
         ulong length,
         int protection,
+        ulong alignment,
         out ulong mappedAddress)
     {
         mappedAddress = 0;
@@ -3406,40 +3617,51 @@ public static class KernelMemoryCompatExports
         {
             object memoryObject = ctx.Memory;
             MethodInfo? allocateAt = null;
+            MethodInfo? allocateAtOrAbove = null;
             var allocateAtHasAllowAlternativeArg = false;
             for (var depth = 0; depth < 4; depth++)
             {
                 foreach (var candidate in memoryObject.GetType().GetMethods(BindingFlags.Public | BindingFlags.Instance))
                 {
-                    if (!string.Equals(candidate.Name, "AllocateAt", StringComparison.Ordinal))
-                    {
-                        continue;
-                    }
-
                     var parameters = candidate.GetParameters();
-                    if (parameters.Length == 3 &&
-                        parameters[0].ParameterType == typeof(ulong) &&
-                        parameters[1].ParameterType == typeof(ulong) &&
-                        parameters[2].ParameterType == typeof(bool))
-                    {
-                        allocateAt = candidate;
-                        allocateAtHasAllowAlternativeArg = false;
-                        break;
-                    }
-
-                    if (parameters.Length == 4 &&
+                    if (string.Equals(candidate.Name, "TryAllocateAtOrAbove", StringComparison.Ordinal) &&
+                        parameters.Length == 5 &&
                         parameters[0].ParameterType == typeof(ulong) &&
                         parameters[1].ParameterType == typeof(ulong) &&
                         parameters[2].ParameterType == typeof(bool) &&
-                        parameters[3].ParameterType == typeof(bool))
+                        parameters[3].ParameterType == typeof(ulong) &&
+                        parameters[4].ParameterType == typeof(ulong).MakeByRefType())
+                    {
+                        allocateAtOrAbove = candidate;
+                    }
+                    else if (string.Equals(candidate.Name, "AllocateAt", StringComparison.Ordinal))
+                    {
+                        if (parameters.Length == 3 &&
+                            parameters[0].ParameterType == typeof(ulong) &&
+                            parameters[1].ParameterType == typeof(ulong) &&
+                            parameters[2].ParameterType == typeof(bool))
+                        {
+                            allocateAt = candidate;
+                            allocateAtHasAllowAlternativeArg = false;
+                        }
+                        else if (parameters.Length == 4 &&
+                            parameters[0].ParameterType == typeof(ulong) &&
+                            parameters[1].ParameterType == typeof(ulong) &&
+                            parameters[2].ParameterType == typeof(bool) &&
+                            parameters[3].ParameterType == typeof(bool))
+                        {
+                            allocateAt = candidate;
+                            allocateAtHasAllowAlternativeArg = true;
+                        }
+                    }
+
+                    if (allocateAtOrAbove is not null && allocateAt is not null)
                     {
-                        allocateAt = candidate;
-                        allocateAtHasAllowAlternativeArg = true;
                         break;
                     }
                 }
 
-                if (allocateAt is not null)
+                if (allocateAtOrAbove is not null || allocateAt is not null)
                 {
                     break;
                 }
@@ -3459,15 +3681,27 @@ public static class KernelMemoryCompatExports
                 memoryObject = innerValue;
             }
 
+            var executable = (protection & OrbisProtCpuExec) != 0;
+            if (allocateAtOrAbove is not null)
+            {
+                var searchArgs = new object[] { desiredAddress, length, executable, alignment, 0UL };
+                var searchResult = allocateAtOrAbove.Invoke(memoryObject, searchArgs);
+                if (searchResult is bool trueValue && trueValue &&
+                    searchArgs[4] is ulong searchedAddress && searchedAddress != 0)
+                {
+                    mappedAddress = searchedAddress;
+                    return true;
+                }
+            }
+
             if (allocateAt is null)
             {
                 Console.Error.WriteLine($"[LOADER][TRACE] reserve range: AllocateAt missing on {ctx.Memory.GetType().FullName}");
                 return false;
             }
 
-            var executable = (protection & 0x04) != 0;
             var invokeArgs = allocateAtHasAllowAlternativeArg
-                ? new object[] { desiredAddress, length, executable, true }
+                ? new object[] { desiredAddress, length, executable, false }
                 : new object[] { desiredAddress, length, executable };
             var result = allocateAt.Invoke(memoryObject, invokeArgs);
             if (result is not ulong allocated || allocated == 0)
@@ -3567,13 +3801,13 @@ public static class KernelMemoryCompatExports
         var devlogAppRoot = ResolveDevlogAppRoot();
         if (guestPath.StartsWith("/devlog/app/", StringComparison.OrdinalIgnoreCase))
         {
-            var relative = guestPath["/devlog/app/".Length..].Replace('/', Path.DirectorySeparatorChar);
+            var relative = NormalizeMountRelativePath(guestPath["/devlog/app/".Length..]);
             return Path.Combine(devlogAppRoot, relative);
         }
 
         if (guestPath.StartsWith("devlog/app/", StringComparison.OrdinalIgnoreCase))
         {
-            var relative = guestPath["devlog/app/".Length..].Replace('/', Path.DirectorySeparatorChar);
+            var relative = NormalizeMountRelativePath(guestPath["devlog/app/".Length..]);
             return Path.Combine(devlogAppRoot, relative);
         }
 
@@ -3586,7 +3820,7 @@ public static class KernelMemoryCompatExports
         var temp0Root = ResolveTemp0Root();
         if (guestPath.StartsWith("/temp0/", StringComparison.OrdinalIgnoreCase))
         {
-            var relative = guestPath["/temp0/".Length..].Replace('/', Path.DirectorySeparatorChar);
+            var relative = NormalizeMountRelativePath(guestPath["/temp0/".Length..]);
             return Path.Combine(temp0Root, relative);
         }
 
@@ -3595,6 +3829,25 @@ public static class KernelMemoryCompatExports
             return temp0Root;
         }
 
+        var hostappRoot = ResolveHostappRoot();
+        if (guestPath.StartsWith("/hostapp/", StringComparison.OrdinalIgnoreCase))
+        {
+            var relative = NormalizeMountRelativePath(guestPath["/hostapp/".Length..]);
+            return Path.Combine(hostappRoot, relative);
+        }
+
+        if (guestPath.StartsWith("hostapp/", StringComparison.OrdinalIgnoreCase))
+        {
+            var relative = NormalizeMountRelativePath(guestPath["hostapp/".Length..]);
+            return Path.Combine(hostappRoot, relative);
+        }
+
+        if (string.Equals(guestPath, "/hostapp", StringComparison.OrdinalIgnoreCase) ||
+            string.Equals(guestPath, "hostapp", StringComparison.OrdinalIgnoreCase))
+        {
+            return hostappRoot;
+        }
+
         var app0Root = Environment.GetEnvironmentVariable("SHARPEMU_APP0_DIR");
         if (!string.IsNullOrWhiteSpace(app0Root))
         {
@@ -3606,13 +3859,13 @@ public static class KernelMemoryCompatExports
 
             if (guestPath.StartsWith("/app0/", StringComparison.OrdinalIgnoreCase))
             {
-                var relative = guestPath["/app0/".Length..].Replace('/', Path.DirectorySeparatorChar);
+                var relative = NormalizeMountRelativePath(guestPath["/app0/".Length..]);
                 return Path.Combine(app0Root, relative);
             }
 
             if (guestPath.StartsWith("app0/", StringComparison.OrdinalIgnoreCase))
             {
-                var relative = guestPath["app0/".Length..].Replace('/', Path.DirectorySeparatorChar);
+                var relative = NormalizeMountRelativePath(guestPath["app0/".Length..]);
                 return Path.Combine(app0Root, relative);
             }
 
@@ -3628,6 +3881,14 @@ public static class KernelMemoryCompatExports
         return guestPath;
     }
 
+    private static string NormalizeMountRelativePath(string relativePath)
+    {
+        return relativePath
+            .TrimStart('/', '\\')
+            .Replace('/', Path.DirectorySeparatorChar)
+            .Replace('\\', Path.DirectorySeparatorChar);
+    }
+
     private static string ResolveDevlogAppRoot()
     {
         var configuredRoot = Environment.GetEnvironmentVariable("SHARPEMU_DEVLOG_APP_DIR");
@@ -3670,6 +3931,25 @@ public static class KernelMemoryCompatExports
         return root;
     }
 
+    private static string ResolveHostappRoot()
+    {
+        const string hostappVariableName = "SHARPEMU_HOSTAPP_DIR";
+        var configuredRoot = Environment.GetEnvironmentVariable(hostappVariableName);
+        string root;
+        if (!string.IsNullOrWhiteSpace(configuredRoot))
+        {
+            root = Path.GetFullPath(configuredRoot);
+        }
+        else
+        {
+            root = Path.GetFullPath(Path.Combine(Environment.CurrentDirectory, "logs", "hostapp"));
+            Environment.SetEnvironmentVariable(hostappVariableName, root);
+        }
+
+        Directory.CreateDirectory(root);
+        return root;
+    }
+
     private static void EnsureOpenParentDirectoryExists(string guestPath, string hostPath, int flags)
     {
         if (string.IsNullOrWhiteSpace(hostPath))
@@ -3694,6 +3974,16 @@ public static class KernelMemoryCompatExports
     }
 
     private static bool TryReadCString(CpuContext ctx, ulong address, ulong maxLength, out byte[] bytes)
+    {
+        return TryReadBytesUntilNull(ctx, address, maxLength, 1_048_576, out bytes);
+    }
+
+    private static bool TryReadBytesUntilNull(
+        CpuContext ctx,
+        ulong address,
+        ulong maxLength,
+        int hardLimit,
+        out byte[] bytes)
     {
         bytes = Array.Empty<byte>();
         if (address == 0)
@@ -3701,26 +3991,65 @@ public static class KernelMemoryCompatExports
             return false;
         }
 
-        var limit = (int)Math.Min(maxLength, 1_048_576UL);
-        var buffer = new List<byte>(Math.Min(limit, 256));
-        Span<byte> one = stackalloc byte[1];
-        for (var i = 0; i < limit; i++)
+        var limit = (int)Math.Min(maxLength, (ulong)Math.Max(0, hardLimit));
+        if (limit == 0)
         {
-            if (!TryReadCompat(ctx, address + (ulong)i, one))
+            return true;
+        }
+
+        const int maxChunkSize = 4096;
+        var chunk = GC.AllocateUninitializedArray<byte>(Math.Min(maxChunkSize, limit));
+        var writer = new ArrayBufferWriter<byte>(Math.Min(limit, 256));
+        ulong offset = 0;
+        while (offset < (ulong)limit)
+        {
+            var current = address + offset;
+            if (current < address)
+            {
+                return false;
+            }
+
+            var pageRemaining = maxChunkSize - (int)(current & (maxChunkSize - 1));
+            var remaining = (int)Math.Min((ulong)limit - offset, (ulong)Math.Min(chunk.Length, pageRemaining));
+            var span = chunk.AsSpan(0, remaining);
+            if (TryReadCompat(ctx, current, span))
+            {
+                var nulIndex = span.IndexOf((byte)0);
+                var copyLength = nulIndex >= 0 ? nulIndex : remaining;
+                if (copyLength > 0)
+                {
+                    span[..copyLength].CopyTo(writer.GetSpan(copyLength));
+                    writer.Advance(copyLength);
+                }
+
+                if (nulIndex >= 0)
+                {
+                    bytes = writer.WrittenSpan.ToArray();
+                    return true;
+                }
+
+                offset += (ulong)remaining;
+                continue;
+            }
+
+            Span<byte> one = stackalloc byte[1];
+            if (!TryReadCompat(ctx, current, one))
             {
                 return false;
             }
 
             if (one[0] == 0)
             {
-                bytes = buffer.ToArray();
+                bytes = writer.WrittenSpan.ToArray();
                 return true;
             }
 
-            buffer.Add(one[0]);
+            one.CopyTo(writer.GetSpan(1));
+            writer.Advance(1);
+            offset++;
         }
 
-        bytes = buffer.ToArray();
+        bytes = writer.WrittenSpan.ToArray();
         return true;
     }
 
@@ -3900,25 +4229,12 @@ public static class KernelMemoryCompatExports
             return false;
         }
 
-        var buffer = new List<byte>(Math.Min(maxLength, 256));
-        Span<byte> one = stackalloc byte[1];
-        for (var i = 0; i < maxLength; i++)
+        if (!TryReadBytesUntilNull(ctx, address, (ulong)maxLength, maxLength, out var bytes))
         {
-            if (!TryReadCompat(ctx, address + (ulong)i, one))
-            {
-                return false;
-            }
-
-            if (one[0] == 0)
-            {
-                value = Encoding.UTF8.GetString(buffer.ToArray());
-                return true;
-            }
-
-            buffer.Add(one[0]);
+            return false;
         }
 
-        value = Encoding.UTF8.GetString(buffer.ToArray());
+        value = Encoding.UTF8.GetString(bytes);
         return true;
     }
 
@@ -4231,23 +4547,171 @@ public static class KernelMemoryCompatExports
         int protection,
         int? memoryType = null)
     {
-        if (!_mappedRegions.TryGetValue(address, out var region) || region.Length != length)
+        if (length == 0 || !TryAddU64(address, length, out var endAddress))
         {
             return false;
         }
 
-        _mappedRegions[address] = region with { Protection = protection };
-
-        if (memoryType.HasValue &&
-            region.DirectStart != 0 &&
-            _directAllocations.TryGetValue(region.DirectStart, out var allocation))
+        var affected = new List<MappedRegion>();
+        var cursor = address;
+        foreach (var region in _mappedRegions.Values.OrderBy(static region => region.Address))
         {
-            _directAllocations[region.DirectStart] = allocation with { MemoryType = memoryType.Value };
+            if (!TryAddU64(region.Address, region.Length, out var regionEnd) || regionEnd <= cursor)
+            {
+                continue;
+            }
+
+            if (region.Address > cursor)
+            {
+                return false;
+            }
+
+            affected.Add(region);
+            cursor = regionEnd >= endAddress ? endAddress : regionEnd;
+            if (cursor == endAddress)
+            {
+                break;
+            }
+        }
+
+        if (cursor != endAddress)
+        {
+            return false;
+        }
+
+        foreach (var region in affected)
+        {
+            _mappedRegions.Remove(region.Address);
+        }
+
+        foreach (var region in affected)
+        {
+            var regionEnd = region.Address + region.Length;
+            var protectStart = Math.Max(region.Address, address);
+            var protectEnd = Math.Min(regionEnd, endAddress);
+
+            if (region.Address < protectStart)
+            {
+                AddMappedRegionSliceLocked(region, region.Address, protectStart, region.Protection);
+            }
+
+            AddMappedRegionSliceLocked(region, protectStart, protectEnd, protection);
+
+            if (protectEnd < regionEnd)
+            {
+                AddMappedRegionSliceLocked(region, protectEnd, regionEnd, region.Protection);
+            }
+
+            if (memoryType.HasValue && region.IsDirect && TryFindDirectAllocationLocked(region.DirectStart, out var allocation))
+            {
+                _directAllocations[allocation.Start] = allocation with { MemoryType = memoryType.Value };
+            }
         }
 
         return true;
     }
 
+    private static void AddMappedRegionSliceLocked(
+        MappedRegion source,
+        ulong start,
+        ulong end,
+        int protection)
+    {
+        if (end <= start)
+        {
+            return;
+        }
+
+        var directStart = source.IsDirect
+            ? unchecked(source.DirectStart + (start - source.Address))
+            : 0UL;
+
+        _mappedRegions[start] = source with
+        {
+            Address = start,
+            Length = end - start,
+            Protection = protection,
+            DirectStart = directStart,
+        };
+    }
+
+    private static bool TryFindDirectAllocationLocked(ulong directStart, out DirectAllocation allocation)
+    {
+        foreach (var candidate in _directAllocations.Values)
+        {
+            if (!TryAddU64(candidate.Start, candidate.Length, out var candidateEnd))
+            {
+                continue;
+            }
+
+            if (directStart >= candidate.Start && directStart < candidateEnd)
+            {
+                allocation = candidate;
+                return true;
+            }
+        }
+
+        allocation = default;
+        return false;
+    }
+
+    private static bool TryNormalizeProtectRange(
+        ulong address,
+        ulong length,
+        out ulong alignedAddress,
+        out ulong alignedLength)
+    {
+        alignedAddress = 0;
+        alignedLength = 0;
+        if (length == 0 || !TryAddU64(address, length, out var endAddress))
+        {
+            return false;
+        }
+
+        alignedAddress = AlignDown(address, OrbisPageSize);
+        var alignedEnd = AlignUp(endAddress, OrbisPageSize);
+        alignedLength = alignedEnd - alignedAddress;
+        return alignedLength != 0;
+    }
+
+    private static bool TryProtectHostRange(ulong address, ulong length, int orbisProtection)
+    {
+        if (length == 0 || length > nuint.MaxValue)
+        {
+            return false;
+        }
+
+        var hostProtection = ResolveHostProtection(orbisProtection);
+        if (!VirtualProtect((nint)address, (nuint)length, hostProtection, out _))
+        {
+            return false;
+        }
+
+        return true;
+    }
+
+    private static uint ResolveHostProtection(int orbisProtection)
+    {
+        var read = (orbisProtection & (OrbisProtCpuRead | OrbisProtGpuRead)) != 0;
+        var write = (orbisProtection & (OrbisProtCpuWrite | OrbisProtGpuWrite)) != 0;
+        var execute = (orbisProtection & OrbisProtCpuExec) != 0;
+
+        if (execute)
+        {
+            return write
+                ? HostPageExecuteReadWrite
+                : read
+                    ? HostPageExecuteRead
+                    : HostPageExecute;
+        }
+
+        return write
+            ? HostPageReadWrite
+            : read
+                ? HostPageReadOnly
+                : HostPageNoAccess;
+    }
+
     private static bool TryFindVirtualQueryRegionLocked(ulong queryAddress, bool findNext, out MappedRegion region)
     {
         region = default;
@@ -4802,13 +5266,13 @@ public static class KernelMemoryCompatExports
 
     private static bool HasRequiredProtection(uint protect, bool writeAccess)
     {
-        if ((protect & (PageNoAccess | PageGuard)) != 0)
+        if ((protect & (HostPageNoAccess | HostPageGuard)) != 0)
         {
             return false;
         }
 
-        const uint readableMask = PageReadOnly | PageReadWrite | PageWriteCopy | PageExecuteRead | PageExecuteReadWrite | PageExecuteWriteCopy;
-        const uint writableMask = PageReadWrite | PageWriteCopy | PageExecuteReadWrite | PageExecuteWriteCopy;
+        const uint readableMask = HostPageReadOnly | HostPageReadWrite | HostPageWriteCopy | HostPageExecuteRead | HostPageExecuteReadWrite | HostPageExecuteWriteCopy;
+        const uint writableMask = HostPageReadWrite | HostPageWriteCopy | HostPageExecuteReadWrite | HostPageExecuteWriteCopy;
         var expected = writeAccess ? writableMask : readableMask;
         return (protect & expected) != 0;
     }
@@ -5128,6 +5592,17 @@ public static class KernelMemoryCompatExports
         return (value + mask) & ~mask;
     }
 
+    private static ulong AlignDown(ulong value, ulong alignment)
+    {
+        if (alignment <= 1)
+        {
+            return value;
+        }
+
+        var mask = alignment - 1;
+        return value & ~mask;
+    }
+
     private static bool TryAddU64(ulong left, ulong right, out ulong sum)
     {
         sum = left + right;

src/SharpEmu.Libs/Kernel/KernelPthreadCompatExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using System.Buffers.Binary;
 using System.Threading;
 using System.Diagnostics.CodeAnalysis;
 
@@ -15,19 +16,20 @@ public static class KernelPthreadCompatExports
     private const int MutexTypeNormal = 3;
     private const int MutexTypeAdaptiveNp = 4;
     private const ulong StaticAdaptiveMutexInitializer = 1;
-    private const ulong SyntheticMutexHandleBase = 0x00006000_0000_0000;
-    private const ulong SyntheticMutexAttrHandleBase = 0x00006001_0000_0000;
-    private const ulong SyntheticCondHandleBase = 0x00006002_0000_0000;
+    private const int MutexObjectSize = 0x100;
+    private const int MutexAttrObjectSize = 0x40;
+    private const int CondObjectSize = 0x100;
     private const int DefaultSpuriousCondWakeMilliseconds = 1;
+    private const int PthreadOnceUninitialized = 0;
+    private const int PthreadOnceInProgress = 1;
+    private const int PthreadOnceDone = 2;
 
     private static readonly object _stateGate = new();
     private static readonly Dictionary<ulong, PthreadMutexState> _mutexStates = new();
     private static readonly Dictionary<ulong, PthreadMutexAttrState> _mutexAttrStates = new();
     private static readonly Dictionary<ulong, PthreadCondState> _condStates = new();
+    private static readonly Dictionary<ulong, object> _onceGates = new();
     private static readonly HashSet<ulong> _condAttrStates = new();
-    private static long _nextSyntheticMutexHandleId = 1;
-    private static long _nextSyntheticMutexAttrHandleId = 1;
-    private static long _nextSyntheticCondHandleId = 1;
 
     private sealed class PthreadMutexState
     {
@@ -60,6 +62,13 @@ public static class KernelPthreadCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "EotR8a3ASf4",
+        ExportName = "pthread_self",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixPthreadSelf(CpuContext ctx) => PthreadSelf(ctx);
+
     [SysAbiExport(
         Nid = "3PtV6p3QNX4",
         ExportName = "scePthreadEqual",
@@ -343,6 +352,93 @@ public static class KernelPthreadCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "14bOACANTBo",
+        ExportName = "scePthreadOnce",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadOnce(CpuContext ctx)
+    {
+        var onceAddress = ctx[CpuRegister.Rdi];
+        var initRoutine = ctx[CpuRegister.Rsi];
+        if (onceAddress == 0 || initRoutine == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryReadInt32(ctx, onceAddress, out var onceValue))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        if (onceValue == PthreadOnceDone)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+
+        var gate = GetPthreadOnceGate(onceAddress);
+        var shouldCall = false;
+        lock (gate)
+        {
+            if (!TryReadInt32(ctx, onceAddress, out onceValue))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            while (onceValue == PthreadOnceInProgress)
+            {
+                Monitor.Wait(gate, TimeSpan.FromMilliseconds(1));
+                if (!TryReadInt32(ctx, onceAddress, out onceValue))
+                {
+                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+            }
+
+            if (onceValue != PthreadOnceDone)
+            {
+                if (!TryWriteInt32(ctx, onceAddress, PthreadOnceInProgress))
+                {
+                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+
+                shouldCall = true;
+            }
+        }
+
+        if (shouldCall)
+        {
+            var scheduler = GuestThreadExecution.Scheduler;
+            string? error = null;
+            if (scheduler is null ||
+                !scheduler.TryCallGuestFunction(ctx, initRoutine, 0, 0, 0, 0, "pthread_once", out error))
+            {
+                lock (gate)
+                {
+                    _ = TryWriteInt32(ctx, onceAddress, PthreadOnceUninitialized);
+                    Monitor.PulseAll(gate);
+                }
+
+                TracePthreadOnce(onceAddress, initRoutine, "failed", error);
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_TRY_AGAIN);
+            }
+
+            lock (gate)
+            {
+                if (!TryWriteInt32(ctx, onceAddress, PthreadOnceDone))
+                {
+                    _ = TryWriteInt32(ctx, onceAddress, PthreadOnceUninitialized);
+                    Monitor.PulseAll(gate);
+                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+
+                Monitor.PulseAll(gate);
+            }
+        }
+
+        TracePthreadOnce(onceAddress, initRoutine, shouldCall ? "call" : "done", null);
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
     private static int PthreadMutexInitCore(CpuContext ctx, ulong mutexAddress, ulong attrAddress)
     {
         if (mutexAddress == 0)
@@ -357,14 +453,34 @@ public static class KernelPthreadCompatExports
             Protocol = attr.Protocol,
         };
 
-        var syntheticHandle = AllocateSyntheticHandle(SyntheticMutexHandleBase, ref _nextSyntheticMutexHandleId);
+        if (!TryAllocateOpaqueObject(ctx, MutexObjectSize, out var handle))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+        if (!InitializeMutexObject(ctx, handle, state))
+        {
+            state.Semaphore.Dispose();
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
         lock (_stateGate)
         {
             _mutexStates[mutexAddress] = state;
-            _mutexStates[syntheticHandle] = state;
+            _mutexStates[handle] = state;
+        }
+
+        if (!ctx.TryWriteUInt64(mutexAddress, handle))
+        {
+            lock (_stateGate)
+            {
+                _mutexStates.Remove(mutexAddress);
+                _mutexStates.Remove(handle);
+            }
+
+            state.Semaphore.Dispose();
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        _ = ctx.TryWriteUInt64(mutexAddress, syntheticHandle);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
@@ -533,14 +649,34 @@ public static class KernelPthreadCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        var syntheticHandle = AllocateSyntheticHandle(SyntheticMutexAttrHandleBase, ref _nextSyntheticMutexAttrHandleId);
-        lock (_stateGate)
+        if (!TryAllocateOpaqueObject(ctx, MutexAttrObjectSize, out var handle))
         {
-            _mutexAttrStates[attrAddress] = new PthreadMutexAttrState(MutexTypeDefault, 0);
-            _mutexAttrStates[syntheticHandle] = new PthreadMutexAttrState(MutexTypeDefault, 0);
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var initialState = new PthreadMutexAttrState(MutexTypeDefault, 0);
+        if (!WriteMutexAttrObject(ctx, handle, initialState))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        lock (_stateGate)
+        {
+            _mutexAttrStates[attrAddress] = initialState;
+            _mutexAttrStates[handle] = initialState;
+        }
+
+        if (!ctx.TryWriteUInt64(attrAddress, handle))
+        {
+            lock (_stateGate)
+            {
+                _mutexAttrStates.Remove(attrAddress);
+                _mutexAttrStates.Remove(handle);
+            }
+
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        _ = ctx.TryWriteUInt64(attrAddress, syntheticHandle);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
@@ -572,6 +708,7 @@ public static class KernelPthreadCompatExports
         }
 
         var resolvedAddress = ResolveMutexAttrHandle(ctx, attrAddress);
+        PthreadMutexAttrState updatedState;
         lock (_stateGate)
         {
             if (!_mutexAttrStates.TryGetValue(resolvedAddress, out var state))
@@ -579,14 +716,17 @@ public static class KernelPthreadCompatExports
                 state = new PthreadMutexAttrState(MutexTypeDefault, 0);
             }
 
-            _mutexAttrStates[resolvedAddress] = state with { Type = NormalizeMutexType(type) };
+            updatedState = state with { Type = NormalizeMutexType(type) };
+            _mutexAttrStates[resolvedAddress] = updatedState;
             if (resolvedAddress != attrAddress)
             {
-                _mutexAttrStates[attrAddress] = _mutexAttrStates[resolvedAddress];
+                _mutexAttrStates[attrAddress] = updatedState;
             }
         }
 
-        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        return WriteMutexAttrObject(ctx, resolvedAddress, updatedState)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
     }
 
     private static int PthreadMutexattrSetprotocolCore(CpuContext ctx, ulong attrAddress, int protocol)
@@ -597,6 +737,7 @@ public static class KernelPthreadCompatExports
         }
 
         var resolvedAddress = ResolveMutexAttrHandle(ctx, attrAddress);
+        PthreadMutexAttrState updatedState;
         lock (_stateGate)
         {
             if (!_mutexAttrStates.TryGetValue(resolvedAddress, out var state))
@@ -604,14 +745,17 @@ public static class KernelPthreadCompatExports
                 state = new PthreadMutexAttrState(MutexTypeDefault, 0);
             }
 
-            _mutexAttrStates[resolvedAddress] = state with { Protocol = protocol };
+            updatedState = state with { Protocol = protocol };
+            _mutexAttrStates[resolvedAddress] = updatedState;
             if (resolvedAddress != attrAddress)
             {
-                _mutexAttrStates[attrAddress] = _mutexAttrStates[resolvedAddress];
+                _mutexAttrStates[attrAddress] = updatedState;
             }
         }
 
-        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        return WriteMutexAttrObject(ctx, resolvedAddress, updatedState)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
     }
 
     private static ulong ResolveMutexHandle(CpuContext ctx, ulong mutexAddress)
@@ -703,14 +847,6 @@ public static class KernelPthreadCompatExports
             return 0;
         }
 
-        lock (_stateGate)
-        {
-            if (_mutexAttrStates.ContainsKey(attrAddress))
-            {
-                return attrAddress;
-            }
-        }
-
         if (ctx.TryReadUInt64(attrAddress, out var pointedHandle) && pointedHandle != 0)
         {
             lock (_stateGate)
@@ -722,6 +858,14 @@ public static class KernelPthreadCompatExports
             }
         }
 
+        lock (_stateGate)
+        {
+            if (_mutexAttrStates.ContainsKey(attrAddress))
+            {
+                return attrAddress;
+            }
+        }
+
         return attrAddress;
     }
 
@@ -816,23 +960,60 @@ public static class KernelPthreadCompatExports
         }
 
         var createdState = new PthreadCondState();
-        var syntheticHandle = AllocateSyntheticHandle(SyntheticCondHandleBase, ref _nextSyntheticCondHandleId);
+        if (!TryAllocateOpaqueObject(ctx, CondObjectSize, out var handle))
+        {
+            return false;
+        }
+
         lock (_stateGate)
         {
             _condStates[condAddress] = createdState;
-            _condStates[syntheticHandle] = createdState;
+            _condStates[handle] = createdState;
         }
 
-        _ = ctx.TryWriteUInt64(condAddress, syntheticHandle);
-        resolvedAddress = syntheticHandle;
+        if (!ctx.TryWriteUInt64(condAddress, handle))
+        {
+            lock (_stateGate)
+            {
+                _condStates.Remove(condAddress);
+                _condStates.Remove(handle);
+            }
+
+            return false;
+        }
+
+        resolvedAddress = handle;
         state = createdState;
         return true;
     }
 
-    private static ulong AllocateSyntheticHandle(ulong baseAddress, ref long nextId)
+    private static bool TryAllocateOpaqueObject(CpuContext ctx, int size, out ulong address)
     {
-        var id = unchecked((ulong)Interlocked.Increment(ref nextId));
-        return baseAddress + (id << 4);
+        address = 0;
+        if (ctx.Memory is not IGuestMemoryAllocator allocator ||
+            !allocator.TryAllocateGuestMemory((ulong)size, alignment: 0x10, out address))
+        {
+            return false;
+        }
+
+        Span<byte> initialData = stackalloc byte[size];
+        initialData.Clear();
+        return ctx.Memory.TryWrite(address, initialData);
+    }
+
+    private static bool InitializeMutexObject(CpuContext ctx, ulong address, PthreadMutexState state) =>
+        TryWriteUInt32(ctx, address + 0x20, unchecked((uint)state.Type)) &&
+        TryWriteUInt32(ctx, address + 0x3C, unchecked((uint)state.Protocol));
+
+    private static bool WriteMutexAttrObject(CpuContext ctx, ulong address, PthreadMutexAttrState state) =>
+        TryWriteUInt32(ctx, address, unchecked((uint)state.Type)) &&
+        TryWriteUInt32(ctx, address + 4, unchecked((uint)state.Protocol));
+
+    private static bool TryWriteUInt32(CpuContext ctx, ulong address, uint value)
+    {
+        Span<byte> bytes = stackalloc byte[sizeof(uint)];
+        BitConverter.TryWriteBytes(bytes, value);
+        return ctx.Memory.TryWrite(address, bytes);
     }
 
     private static int PthreadCondInitCore(CpuContext ctx, ulong condAddress)
@@ -842,15 +1023,29 @@ public static class KernelPthreadCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
         }
 
-        var syntheticHandle = AllocateSyntheticHandle(SyntheticCondHandleBase, ref _nextSyntheticCondHandleId);
+        if (!TryAllocateOpaqueObject(ctx, CondObjectSize, out var handle))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
         lock (_stateGate)
         {
             var state = new PthreadCondState();
             _condStates[condAddress] = state;
-            _condStates[syntheticHandle] = state;
+            _condStates[handle] = state;
+        }
+
+        if (!ctx.TryWriteUInt64(condAddress, handle))
+        {
+            lock (_stateGate)
+            {
+                _condStates.Remove(condAddress);
+                _condStates.Remove(handle);
+            }
+
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        _ = ctx.TryWriteUInt64(condAddress, syntheticHandle);
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
@@ -1040,6 +1235,46 @@ public static class KernelPthreadCompatExports
         };
     }
 
+    private static object GetPthreadOnceGate(ulong onceAddress)
+    {
+        lock (_stateGate)
+        {
+            if (!_onceGates.TryGetValue(onceAddress, out var gate))
+            {
+                gate = new object();
+                _onceGates[onceAddress] = gate;
+            }
+
+            return gate;
+        }
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)(int)result);
+        return (int)result;
+    }
+
+    private static bool TryReadInt32(CpuContext ctx, ulong address, out int value)
+    {
+        Span<byte> bytes = stackalloc byte[sizeof(int)];
+        if (!ctx.Memory.TryRead(address, bytes))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadInt32LittleEndian(bytes);
+        return true;
+    }
+
+    private static bool TryWriteInt32(CpuContext ctx, ulong address, int value)
+    {
+        Span<byte> bytes = stackalloc byte[sizeof(int)];
+        BinaryPrimitives.WriteInt32LittleEndian(bytes, value);
+        return ctx.Memory.TryWrite(address, bytes);
+    }
+
     private static bool CreateImplicitMutexState(CpuContext ctx, ulong mutexAddress, int type, out ulong resolvedAddress, [NotNullWhen(true)] out PthreadMutexState? state)
     {
         var createdState = new PthreadMutexState
@@ -1047,7 +1282,19 @@ public static class KernelPthreadCompatExports
             Type = type,
         };
 
-        var syntheticHandle = AllocateSyntheticHandle(SyntheticMutexHandleBase, ref _nextSyntheticMutexHandleId);
+        if (!TryAllocateOpaqueObject(ctx, MutexObjectSize, out var handle))
+        {
+            resolvedAddress = 0;
+            state = null;
+            return false;
+        }
+        if (!InitializeMutexObject(ctx, handle, createdState))
+        {
+            resolvedAddress = 0;
+            state = null;
+            return false;
+        }
+
         lock (_stateGate)
         {
             if (_mutexStates.TryGetValue(mutexAddress, out state))
@@ -1056,18 +1303,30 @@ public static class KernelPthreadCompatExports
                 return true;
             }
 
-            if (_mutexStates.TryGetValue(syntheticHandle, out state))
+            if (_mutexStates.TryGetValue(handle, out state))
             {
-                resolvedAddress = syntheticHandle;
+                resolvedAddress = handle;
                 return true;
             }
 
             _mutexStates[mutexAddress] = createdState;
-            _mutexStates[syntheticHandle] = createdState;
+            _mutexStates[handle] = createdState;
         }
 
-        _ = ctx.TryWriteUInt64(mutexAddress, syntheticHandle);
-        resolvedAddress = syntheticHandle;
+        if (!ctx.TryWriteUInt64(mutexAddress, handle))
+        {
+            lock (_stateGate)
+            {
+                _mutexStates.Remove(mutexAddress);
+                _mutexStates.Remove(handle);
+            }
+
+            resolvedAddress = 0;
+            state = null;
+            return false;
+        }
+
+        resolvedAddress = handle;
         state = createdState;
         return true;
     }
@@ -1084,6 +1343,18 @@ public static class KernelPthreadCompatExports
             $"[LOADER][TRACE] pthread_self: stale_rdi=0x{ctx[CpuRegister.Rdi]:X16} thread=0x{currentThreadHandle:X16} tid=0x{currentThreadId:X16}");
     }
 
+    private static void TracePthreadOnce(ulong onceAddress, ulong initRoutine, string operation, string? error)
+    {
+        if (!ShouldTracePthread())
+        {
+            return;
+        }
+
+        var suffix = string.IsNullOrWhiteSpace(error) ? string.Empty : $" error={error}";
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] pthread_once_{operation}: once=0x{onceAddress:X16} init=0x{initRoutine:X16}{suffix}");
+    }
+
     private static void TracePthreadMutex(CpuContext ctx, string operation, ulong mutexAddress, ulong resolvedAddress, PthreadMutexState? state, ulong currentThreadId, int result)
     {
         if (!ShouldTracePthread())

src/SharpEmu.Libs/Kernel/KernelPthreadExtendedCompatExports.cs

@@ -185,6 +185,35 @@ public static class KernelPthreadExtendedCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "rcrVFJsQWRY",
+        ExportName = "scePthreadGetaffinity",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadGetaffinity(CpuContext ctx)
+    {
+        var thread = ctx[CpuRegister.Rdi];
+        var outMaskAddress = ctx[CpuRegister.Rsi];
+        if (thread == 0 || outMaskAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        ulong affinityMask;
+        lock (_stateGate)
+        {
+            affinityMask = GetOrCreateThreadStateLocked(thread).AffinityMask;
+        }
+
+        if (!ctx.TryWriteUInt64(outMaskAddress, affinityMask))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "1tKyG7RlMJo",
         ExportName = "scePthreadGetprio",
@@ -489,6 +518,37 @@ public static class KernelPthreadExtendedCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "-quPa4SEJUw",
+        ExportName = "scePthreadAttrGetstack",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PthreadAttrGetstack(CpuContext ctx)
+    {
+        var attrAddress = ctx[CpuRegister.Rdi];
+        var outStackAddressPointer = ctx[CpuRegister.Rsi];
+        var outStackSizeAddress = ctx[CpuRegister.Rdx];
+        if (attrAddress == 0 || outStackAddressPointer == 0 || outStackSizeAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        PthreadAttrState state;
+        lock (_stateGate)
+        {
+            state = GetOrCreateAttrStateLocked(attrAddress);
+        }
+
+        if (!ctx.TryWriteUInt64(outStackAddressPointer, state.StackAddress) ||
+            !ctx.TryWriteUInt64(outStackSizeAddress, state.StackSize))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "-fA+7ZlGDQs",
         ExportName = "scePthreadAttrGetstacksize",

src/SharpEmu.Libs/Kernel/KernelRuntimeCompatExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using SharpEmu.Libs.Fiber;
 using System.Buffers.Binary;
 using System.Collections.Generic;
 using System.Diagnostics;
@@ -25,12 +26,15 @@ public static class KernelRuntimeCompatExports
     private const ulong TlsNewReplaceOffset = 0x300;
     private const int MallocReplaceSize = 0x70;
     private const int NewReplaceSize = 0x68;
+    private const int OrbisTimesecSize = sizeof(long) + sizeof(uint) + sizeof(uint);
     private const ulong ModuleInfoHandleOffset = 0x108;
     private const ulong ModuleInfoNameOffset = 0x10;
     private const int ModuleInfoNameMaxBytes = 64;
     private const ulong DefaultKernelTscFrequency = 10_000_000UL;
     private const ulong PrtAreaStartAddress = 0x0000001000000000UL;
     private const ulong PrtAreaSize = 0x000000EC00000000UL;
+    private const int MapFlagFixed = 0x10;
+    private const ulong DefaultVirtualRangeAlignment = 0x4000UL;
     private const int AioInitParamSize = 0x3C;
     private const uint MemCommit = 0x1000;
     private const uint MemReserve = 0x2000;
@@ -52,6 +56,7 @@ public static class KernelRuntimeCompatExports
     private static readonly object _prtApertureGate = new();
     private static readonly (ulong Base, ulong Size)[] _prtApertures = new (ulong Base, ulong Size)[3];
     private static int _stackChkFailCount;
+    private static long _usleepTraceCount;
 
     [UnmanagedFunctionPointer(CallingConvention.Cdecl)]
     private delegate ulong RdtscDelegate();
@@ -64,33 +69,81 @@ public static class KernelRuntimeCompatExports
     public static int KernelUsleep(CpuContext ctx)
     {
         var micros = ctx[CpuRegister.Rdi];
+        TraceUsleepSpin(ctx, micros);
         if (micros == 0)
         {
             ctx[CpuRegister.Rax] = 0;
             return (int)OrbisGen2Result.ORBIS_GEN2_OK;
         }
 
-        var sleepMilliseconds = (int)Math.Min(micros / 1000UL, int.MaxValue);
-        if (sleepMilliseconds > 0)
-        {
-            Thread.Sleep(sleepMilliseconds);
-        }
+        GuestThreadExecution.Scheduler?.Pump(ctx, "sceKernelUsleep");
 
-        var remainingMicros = micros % 1000UL;
-        if (remainingMicros > 0)
+        if (micros < 1000)
         {
-            var targetTicks = (long)((double)remainingMicros * Stopwatch.Frequency / 1_000_000.0);
-            var spin = Stopwatch.StartNew();
-            while (spin.ElapsedTicks < targetTicks)
-            {
-                Thread.SpinWait(16);
-            }
+            Thread.Yield();
+        }
+        else
+        {
+            var sleepMilliseconds = (int)Math.Min((micros + 999UL) / 1000UL, int.MaxValue);
+            Thread.Sleep(sleepMilliseconds);
         }
 
         ctx[CpuRegister.Rax] = 0;
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    private static void TraceUsleepSpin(CpuContext ctx, ulong micros)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_USLEEP"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        var count = Interlocked.Increment(ref _usleepTraceCount);
+        if (count > 32 && count % 10000 != 0)
+        {
+            return;
+        }
+
+        var rbx = ctx[CpuRegister.Rbx];
+        var r12 = ctx[CpuRegister.R12];
+        var r13 = ctx[CpuRegister.R13];
+        var lockAddress = rbx == 0 ? 0 : rbx + 0xF78;
+        var lockText = "unreadable";
+        if (lockAddress != 0 && ctx.TryReadUInt64(lockAddress, out var lockValue))
+        {
+            lockText = $"0x{lockValue:X16}";
+        }
+
+        var schedulerText = "unreadable";
+        if (r12 != 0 && ctx.TryReadUInt64(r12 + 8, out var schedulerAddress))
+        {
+            schedulerText = $"0x{schedulerAddress:X16}";
+        }
+
+        var waitValueText = "unreadable";
+        if (r13 != 0 && ctx.TryReadUInt64(r13, out var waitValue))
+        {
+            waitValueText = $"0x{waitValue:X16}";
+        }
+
+        var callerReturnText = "unreadable";
+        var rbp = ctx[CpuRegister.Rbp];
+        if (rbp != 0 && ctx.TryReadUInt64(rbp + 8, out var callerReturn))
+        {
+            callerReturnText = $"0x{callerReturn:X16}";
+        }
+
+        var returnRip = GuestThreadExecution.TryGetCurrentImportCallFrame(out var frame)
+            ? frame.ReturnRip
+            : 0UL;
+        var thread = GuestThreadExecution.CurrentGuestThreadHandle;
+        var fiber = FiberExports.GetCurrentFiberAddressForDiagnostics(ctx);
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] usleep#{count}: usec={micros} ret=0x{returnRip:X16} caller={callerReturnText} thread=0x{thread:X16} fiber=0x{fiber:X16} rbx=0x{rbx:X16} lock@+F78=0x{lockAddress:X16}:{lockText} r12=0x{r12:X16} scheduler@+8={schedulerText} r13=0x{r13:X16}:{waitValueText} r14=0x{ctx[CpuRegister.R14]:X16} r15=0x{ctx[CpuRegister.R15]:X16}");
+    }
+
     [SysAbiExport(
         Nid = "QBi7HCK03hw",
         ExportName = "sceKernelClockGettime",
@@ -156,6 +209,37 @@ public static class KernelRuntimeCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "n88vx3C5nW8",
+        ExportName = "gettimeofday",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int PosixGettimeofday(CpuContext ctx)
+    {
+        var timeAddress = ctx[CpuRegister.Rdi];
+        var timezoneAddress = ctx[CpuRegister.Rsi];
+        var now = DateTimeOffset.UtcNow;
+        var seconds = now.ToUnixTimeSeconds();
+        var microseconds = (now.Ticks % TimeSpan.TicksPerSecond) / 10;
+
+        if (timeAddress != 0 &&
+            (!ctx.TryWriteUInt64(timeAddress, unchecked((ulong)seconds)) ||
+             !ctx.TryWriteUInt64(timeAddress + sizeof(long), unchecked((ulong)microseconds))))
+        {
+            return -1;
+        }
+
+        if (timezoneAddress != 0 &&
+            (!TryWriteInt32(ctx, timezoneAddress, 0) ||
+             !TryWriteInt32(ctx, timezoneAddress + sizeof(int), 0)))
+        {
+            return -1;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return 0;
+    }
+
     [SysAbiExport(
         Nid = "-2IRUCO--PM",
         ExportName = "sceKernelReadTsc",
@@ -552,6 +636,17 @@ public static class KernelRuntimeCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "jh+8XiK4LeE",
+        ExportName = "sceKernelIsAddressSanitizerEnabled",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelIsAddressSanitizerEnabled(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "ca7v6Cxulzs",
         ExportName = "sceKernelSetGPO",
@@ -590,7 +685,7 @@ public static class KernelRuntimeCompatExports
     {
         var inOutAddressPointer = ctx[CpuRegister.Rdi];
         var length = ctx[CpuRegister.Rsi];
-        var _flags = ctx[CpuRegister.Rdx];
+        var flags = unchecked((int)ctx[CpuRegister.Rdx]);
         var alignment = ctx[CpuRegister.Rcx];
         if (inOutAddressPointer == 0 || length == 0)
         {
@@ -602,7 +697,8 @@ public static class KernelRuntimeCompatExports
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
         }
 
-        var effectiveAlignment = alignment == 0 ? 0x10000UL : alignment;
+        var effectiveAlignment = alignment == 0 ? DefaultVirtualRangeAlignment : alignment;
+        var fixedMapping = (flags & MapFlagFixed) != 0;
         ulong desiredAddress;
         lock (_stateGate)
         {
@@ -611,13 +707,13 @@ public static class KernelRuntimeCompatExports
                 : AlignUp(_nextReservedVirtualBase, effectiveAlignment);
         }
 
-        if (!TryReserveVirtualRange(ctx, desiredAddress, length, out var mappedAddress))
+        if (!TryReserveVirtualRange(ctx, desiredAddress, length, effectiveAlignment, allowSearch: !fixedMapping, out var mappedAddress))
         {
             return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND;
         }
 
         Console.Error.WriteLine(
-            $"[LOADER][TRACE] reserve_virtual_range: req=0x{requestedAddress:X16} desired=0x{desiredAddress:X16} mapped=0x{mappedAddress:X16} len=0x{length:X16}");
+            $"[LOADER][TRACE] reserve_virtual_range: req=0x{requestedAddress:X16} desired=0x{desiredAddress:X16} mapped=0x{mappedAddress:X16} len=0x{length:X16} flags=0x{flags:X8} align=0x{effectiveAlignment:X16}");
 
         if (!ctx.TryWriteUInt64(inOutAddressPointer, mappedAddress))
         {
@@ -901,14 +997,12 @@ public static class KernelRuntimeCompatExports
     public static int StackCheckFail(CpuContext ctx)
     {
         var count = Interlocked.Increment(ref _stackChkFailCount);
-        if (count <= 8)
-        {
-            Console.Error.WriteLine(
-                $"[LOADER][WARNING] __stack_chk_fail recovery#{count}: rip=0x{ctx.Rip:X16} rdi=0x{ctx[CpuRegister.Rdi]:X16}");
-        }
-
-        ctx[CpuRegister.Rax] = 0;
-        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+        Console.Error.WriteLine(
+            $"[LOADER][ERROR] __stack_chk_fail#{count}: rip=0x{ctx.Rip:X16} rdi=0x{ctx[CpuRegister.Rdi]:X16}");
+        var result = (int)OrbisGen2Result.ORBIS_GEN2_ERROR_CPU_TRAP;
+        GuestThreadExecution.RequestCurrentEntryExit("__stack_chk_fail", result);
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
     }
 
     [SysAbiExport(
@@ -1024,6 +1118,111 @@ public static class KernelRuntimeCompatExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "-o5uEDpN+oY",
+        ExportName = "sceKernelConvertUtcToLocaltime",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelConvertUtcToLocaltime(CpuContext ctx)
+    {
+        var utcSeconds = unchecked((long)ctx[CpuRegister.Rdi]);
+        var localTimeAddress = ctx[CpuRegister.Rsi];
+        var timesecAddress = ctx[CpuRegister.Rdx];
+        var dstSecondsAddress = ctx[CpuRegister.Rcx];
+
+        if (localTimeAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var utc = DateTimeOffset.FromUnixTimeSeconds(utcSeconds);
+        var local = TimeZoneInfo.ConvertTime(utc, TimeZoneInfo.Local);
+        var offset = local.Offset;
+        var localSeconds = utcSeconds + (long)offset.TotalSeconds;
+        var dstSeconds = TimeZoneInfo.Local.IsDaylightSavingTime(local.DateTime)
+            ? (uint)Math.Max(0, TimeZoneInfo.Local.GetAdjustmentRules()
+                .Where(rule => rule.DateStart <= local.Date && rule.DateEnd >= local.Date)
+                .Select(rule => rule.DaylightDelta.TotalSeconds)
+                .DefaultIfEmpty(0)
+                .Max())
+            : 0u;
+        var westSeconds = unchecked((uint)(int)offset.TotalSeconds);
+
+        if (!ctx.TryWriteUInt64(localTimeAddress, unchecked((ulong)localSeconds)))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (timesecAddress != 0)
+        {
+            Span<byte> timesec = stackalloc byte[OrbisTimesecSize];
+            BinaryPrimitives.WriteInt64LittleEndian(timesec, utcSeconds);
+            BinaryPrimitives.WriteUInt32LittleEndian(timesec.Slice(sizeof(long), sizeof(uint)), westSeconds);
+            BinaryPrimitives.WriteUInt32LittleEndian(timesec.Slice(sizeof(long) + sizeof(uint), sizeof(uint)), dstSeconds);
+            if (!ctx.Memory.TryWrite(timesecAddress, timesec))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+        }
+
+        if (dstSecondsAddress != 0 && !ctx.TryWriteUInt64(dstSecondsAddress, dstSeconds))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "0NTHN1NKONI",
+        ExportName = "sceKernelConvertLocaltimeToUtc",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelConvertLocaltimeToUtc(CpuContext ctx)
+    {
+        var localSeconds = unchecked((long)ctx[CpuRegister.Rdi]);
+        var utcTimeAddress = ctx[CpuRegister.Rdx];
+        var timezoneAddress = ctx[CpuRegister.Rcx];
+        var dstSecondsAddress = ctx[CpuRegister.R8];
+
+        if (timezoneAddress == 0)
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT;
+        }
+
+        var localDate = DateTimeOffset.FromUnixTimeSeconds(localSeconds).DateTime;
+        var offset = TimeZoneInfo.Local.GetUtcOffset(localDate);
+        var utcSeconds = localSeconds - (long)offset.TotalSeconds;
+        var dstSeconds = TimeZoneInfo.Local.IsDaylightSavingTime(localDate)
+            ? (int)Math.Max(0, TimeZoneInfo.Local.GetAdjustmentRules()
+                .Where(rule => rule.DateStart <= localDate.Date && rule.DateEnd >= localDate.Date)
+                .Select(rule => rule.DaylightDelta.TotalSeconds)
+                .DefaultIfEmpty(0)
+                .Max())
+            : 0;
+        var minutesWest = unchecked((int)-offset.TotalMinutes);
+
+        if (!TryWriteInt32(ctx, timezoneAddress, minutesWest) ||
+            !TryWriteInt32(ctx, timezoneAddress + sizeof(int), dstSeconds / 60))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (utcTimeAddress != 0 && !ctx.TryWriteUInt64(utcTimeAddress, unchecked((ulong)utcSeconds)))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (dstSecondsAddress != 0 && !TryWriteInt32(ctx, dstSecondsAddress, dstSeconds))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
     [SysAbiExport(
         Nid = "vYU8P9Td2Zo",
         ExportName = "sceKernelAioInitializeImpl",
@@ -1488,7 +1687,13 @@ public static class KernelRuntimeCompatExports
     [DllImport("kernel32.dll", SetLastError = true)]
     private static extern nint VirtualAlloc(nint lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);
 
-    private static bool TryReserveVirtualRange(CpuContext ctx, ulong desiredAddress, ulong length, out ulong mappedAddress)
+    private static bool TryReserveVirtualRange(
+        CpuContext ctx,
+        ulong desiredAddress,
+        ulong length,
+        ulong alignment,
+        bool allowSearch,
+        out ulong mappedAddress)
     {
         mappedAddress = 0;
         if (length == 0)
@@ -1500,40 +1705,51 @@ public static class KernelRuntimeCompatExports
         {
             object memoryObject = ctx.Memory;
             MethodInfo? allocateAt = null;
+            MethodInfo? allocateAtOrAbove = null;
             var allocateAtHasAllowAlternativeArg = false;
             for (var depth = 0; depth < 4; depth++)
             {
                 foreach (var candidate in memoryObject.GetType().GetMethods(BindingFlags.Public | BindingFlags.Instance))
                 {
-                    if (!string.Equals(candidate.Name, "AllocateAt", StringComparison.Ordinal))
-                    {
-                        continue;
-                    }
-
                     var parameters = candidate.GetParameters();
-                    if (parameters.Length == 3 &&
-                        parameters[0].ParameterType == typeof(ulong) &&
-                        parameters[1].ParameterType == typeof(ulong) &&
-                        parameters[2].ParameterType == typeof(bool))
-                    {
-                        allocateAt = candidate;
-                        allocateAtHasAllowAlternativeArg = false;
-                        break;
-                    }
-
-                    if (parameters.Length == 4 &&
+                    if (string.Equals(candidate.Name, "TryAllocateAtOrAbove", StringComparison.Ordinal) &&
+                        parameters.Length == 5 &&
                         parameters[0].ParameterType == typeof(ulong) &&
                         parameters[1].ParameterType == typeof(ulong) &&
                         parameters[2].ParameterType == typeof(bool) &&
-                        parameters[3].ParameterType == typeof(bool))
+                        parameters[3].ParameterType == typeof(ulong) &&
+                        parameters[4].ParameterType == typeof(ulong).MakeByRefType())
+                    {
+                        allocateAtOrAbove = candidate;
+                    }
+                    else if (string.Equals(candidate.Name, "AllocateAt", StringComparison.Ordinal))
+                    {
+                        if (parameters.Length == 3 &&
+                            parameters[0].ParameterType == typeof(ulong) &&
+                            parameters[1].ParameterType == typeof(ulong) &&
+                            parameters[2].ParameterType == typeof(bool))
+                        {
+                            allocateAt = candidate;
+                            allocateAtHasAllowAlternativeArg = false;
+                        }
+                        else if (parameters.Length == 4 &&
+                            parameters[0].ParameterType == typeof(ulong) &&
+                            parameters[1].ParameterType == typeof(ulong) &&
+                            parameters[2].ParameterType == typeof(bool) &&
+                            parameters[3].ParameterType == typeof(bool))
+                        {
+                            allocateAt = candidate;
+                            allocateAtHasAllowAlternativeArg = true;
+                        }
+                    }
+
+                    if (allocateAtOrAbove is not null && allocateAt is not null)
                     {
-                        allocateAt = candidate;
-                        allocateAtHasAllowAlternativeArg = true;
                         break;
                     }
                 }
 
-                if (allocateAt is not null)
+                if (allocateAtOrAbove is not null || allocateAt is not null)
                 {
                     break;
                 }
@@ -1553,6 +1769,18 @@ public static class KernelRuntimeCompatExports
                 memoryObject = innerValue;
             }
 
+            if (allowSearch && allocateAtOrAbove is not null)
+            {
+                var searchArgs = new object[] { desiredAddress, length, false, alignment, 0UL };
+                var searchResult = allocateAtOrAbove.Invoke(memoryObject, searchArgs);
+                if (searchResult is bool trueValue && trueValue &&
+                    searchArgs[4] is ulong searchedAddress && searchedAddress != 0)
+                {
+                    mappedAddress = searchedAddress;
+                    return true;
+                }
+            }
+
             if (allocateAt is null)
             {
                 Console.Error.WriteLine($"[LOADER][TRACE] reserve_virtual_range: AllocateAt missing on {ctx.Memory.GetType().FullName}");
@@ -1560,7 +1788,7 @@ public static class KernelRuntimeCompatExports
             }
 
             var invokeArgs = allocateAtHasAllowAlternativeArg
-                ? new object[] { desiredAddress, length, false, true }
+                ? new object[] { desiredAddress, length, false, false }
                 : new object[] { desiredAddress, length, false };
             var result = allocateAt.Invoke(memoryObject, invokeArgs);
             if (result is not ulong allocated || allocated == 0)

src/SharpEmu.Libs/Kernel/KernelSemaphoreCompatExports.cs

@@ -0,0 +1,318 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Buffers.Binary;
+using System.Collections.Concurrent;
+using System.Text;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Kernel;
+
+public static class KernelSemaphoreCompatExports
+{
+    private const int MaxSemaphoreNameLength = 128;
+    private static readonly ConcurrentDictionary<uint, KernelSemaphoreState> _semaphores = new();
+    private static int _nextSemaphoreHandle = 1;
+
+    private sealed class KernelSemaphoreState
+    {
+        public required string Name { get; init; }
+        public required int InitialCount { get; init; }
+        public required int MaxCount { get; init; }
+        public int Count { get; set; }
+        public int WaitingThreads { get; set; }
+        public object Gate { get; } = new();
+    }
+
+    [SysAbiExport(
+        Nid = "188x57JYp0g",
+        ExportName = "sceKernelCreateSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCreateSema(CpuContext ctx)
+    {
+        var semaphoreAddress = ctx[CpuRegister.Rdi];
+        var nameAddress = ctx[CpuRegister.Rsi];
+        var attr = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var initialCount = unchecked((int)ctx[CpuRegister.Rcx]);
+        var maxCount = unchecked((int)ctx[CpuRegister.R8]);
+        var optionAddress = ctx[CpuRegister.R9];
+
+        if (semaphoreAddress == 0 ||
+            nameAddress == 0 ||
+            attr > 2 ||
+            initialCount < 0 ||
+            maxCount <= 0 ||
+            initialCount > maxCount ||
+            optionAddress != 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryReadNullTerminatedUtf8(ctx, nameAddress, MaxSemaphoreNameLength, out var name))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        var handle = unchecked((uint)Interlocked.Increment(ref _nextSemaphoreHandle));
+        if (handle == 0)
+        {
+            handle = unchecked((uint)Interlocked.Increment(ref _nextSemaphoreHandle));
+        }
+
+        _semaphores[handle] = new KernelSemaphoreState
+        {
+            Name = name,
+            InitialCount = initialCount,
+            MaxCount = maxCount,
+            Count = initialCount,
+        };
+
+        if (!TryWriteUInt32(ctx, semaphoreAddress, handle))
+        {
+            _semaphores.TryRemove(handle, out _);
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceSemaphore($"create handle=0x{handle:X8} name='{name}' attr=0x{attr:X} init={initialCount} max={maxCount}");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "Zxa0VhQVTsk",
+        ExportName = "sceKernelWaitSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelWaitSema(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var needCount = unchecked((int)ctx[CpuRegister.Rsi]);
+        var timeoutAddress = ctx[CpuRegister.Rdx];
+
+        if (!_semaphores.TryGetValue(handle, out var semaphore))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (needCount < 1 || needCount > semaphore.MaxCount)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (semaphore.Gate)
+        {
+            if (semaphore.Count >= needCount)
+            {
+                semaphore.Count -= needCount;
+                TraceSemaphore($"wait handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+            }
+
+            if (timeoutAddress != 0)
+            {
+                if (!TryReadUInt32(ctx, timeoutAddress, out _))
+                {
+                    return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+                }
+
+                _ = TryWriteUInt32(ctx, timeoutAddress, 0);
+                TraceSemaphore($"wait-timeout handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_TIMED_OUT);
+            }
+
+            if (!GuestThreadExecution.RequestCurrentThreadBlock("sceKernelWaitSema"))
+            {
+                TraceSemaphore($"wait-would-block handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_TRY_AGAIN);
+            }
+
+            semaphore.WaitingThreads++;
+            TraceSemaphore($"wait-block handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "12wOHk8ywb0",
+        ExportName = "sceKernelPollSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelPollSema(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var needCount = unchecked((int)ctx[CpuRegister.Rsi]);
+
+        if (!_semaphores.TryGetValue(handle, out var semaphore))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (needCount < 1 || needCount > semaphore.MaxCount)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (semaphore.Gate)
+        {
+            if (semaphore.Count < needCount)
+            {
+                TraceSemaphore($"poll-busy handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_BUSY);
+            }
+
+            semaphore.Count -= needCount;
+            TraceSemaphore($"poll handle=0x{handle:X8} name='{semaphore.Name}' need={needCount} count={semaphore.Count}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "4czppHBiriw",
+        ExportName = "sceKernelSignalSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelSignalSema(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var signalCount = unchecked((int)ctx[CpuRegister.Rsi]);
+
+        if (!_semaphores.TryGetValue(handle, out var semaphore))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (signalCount <= 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (semaphore.Gate)
+        {
+            if (semaphore.Count > semaphore.MaxCount - signalCount)
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+            }
+
+            semaphore.Count += signalCount;
+            TraceSemaphore($"signal handle=0x{handle:X8} name='{semaphore.Name}' signal={signalCount} count={semaphore.Count} waiters={semaphore.WaitingThreads}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "4DM06U2BNEY",
+        ExportName = "sceKernelCancelSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelCancelSema(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var setCount = unchecked((int)ctx[CpuRegister.Rsi]);
+        var waitingThreadsAddress = ctx[CpuRegister.Rdx];
+
+        if (!_semaphores.TryGetValue(handle, out var semaphore))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        if (setCount > semaphore.MaxCount)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        lock (semaphore.Gate)
+        {
+            if (waitingThreadsAddress != 0 && !TryWriteUInt32(ctx, waitingThreadsAddress, unchecked((uint)semaphore.WaitingThreads)))
+            {
+                return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+            }
+
+            semaphore.Count = setCount < 0 ? semaphore.InitialCount : setCount;
+            semaphore.WaitingThreads = 0;
+            TraceSemaphore($"cancel handle=0x{handle:X8} name='{semaphore.Name}' set={setCount} count={semaphore.Count}");
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+        }
+    }
+
+    [SysAbiExport(
+        Nid = "R1Jvn8bSCW8",
+        ExportName = "sceKernelDeleteSema",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libKernel")]
+    public static int KernelDeleteSema(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        if (!_semaphores.TryRemove(handle, out var semaphore))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_FOUND);
+        }
+
+        TraceSemaphore($"delete handle=0x{handle:X8} name='{semaphore.Name}'");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        var value = (int)result;
+        ctx[CpuRegister.Rax] = unchecked((ulong)value);
+        return value;
+    }
+
+    private static bool TryReadUInt32(CpuContext ctx, ulong address, out uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryWriteUInt32(CpuContext ctx, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static bool TryReadNullTerminatedUtf8(CpuContext ctx, ulong address, int maxLength, out string value)
+    {
+        value = string.Empty;
+        if (address == 0 || maxLength <= 0)
+        {
+            return false;
+        }
+
+        var bytes = new byte[Math.Min(maxLength, 4096)];
+        for (var i = 0; i < bytes.Length; i++)
+        {
+            Span<byte> current = stackalloc byte[1];
+            if (!ctx.Memory.TryRead(address + (ulong)i, current))
+            {
+                return false;
+            }
+
+            if (current[0] == 0)
+            {
+                value = Encoding.UTF8.GetString(bytes, 0, i);
+                return true;
+            }
+
+            bytes[i] = current[0];
+        }
+
+        value = Encoding.UTF8.GetString(bytes);
+        return true;
+    }
+
+    private static void TraceSemaphore(string message)
+    {
+        if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_SEMA"), "1", StringComparison.Ordinal))
+        {
+            Console.Error.WriteLine($"[LOADER][TRACE] sema.{message}");
+        }
+    }
+}

src/SharpEmu.Libs/Network/Http2Exports.cs

@@ -0,0 +1,79 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Collections.Concurrent;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Network;
+
+public static class Http2Exports
+{
+    private const int Http2ErrorInvalidId = unchecked((int)0x80436004);
+    private const int Http2ErrorInvalidArgument = unchecked((int)0x80436016);
+
+    private static readonly ConcurrentDictionary<int, Http2Context> _contexts = new();
+    private static int _nextContextId;
+
+    private sealed record Http2Context(int NetId, int SslId, ulong PoolSize, int MaxRequests);
+
+    [SysAbiExport(
+        Nid = "3JCe3lCbQ8A",
+        ExportName = "sceHttp2Init",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceHttp2")]
+    public static int Http2Init(CpuContext ctx)
+    {
+        var netId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var sslId = unchecked((int)ctx[CpuRegister.Rsi]);
+        var poolSize = ctx[CpuRegister.Rdx];
+        var maxRequests = unchecked((int)ctx[CpuRegister.Rcx]);
+
+        if (poolSize == 0 || maxRequests <= 0)
+        {
+            return SetReturn(ctx, Http2ErrorInvalidArgument);
+        }
+
+        var id = Interlocked.Increment(ref _nextContextId);
+        _contexts[id] = new Http2Context(netId, sslId, poolSize, maxRequests);
+
+        TraceHttp2("init", id, unchecked((ulong)netId), unchecked((ulong)sslId), poolSize, unchecked((ulong)maxRequests));
+        ctx[CpuRegister.Rax] = unchecked((ulong)id);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "YiBUtz-pGkc",
+        ExportName = "sceHttp2Term",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceHttp2")]
+    public static int Http2Term(CpuContext ctx)
+    {
+        var id = unchecked((int)ctx[CpuRegister.Rdi]);
+        if (!_contexts.TryRemove(id, out _))
+        {
+            return SetReturn(ctx, Http2ErrorInvalidId);
+        }
+
+        TraceHttp2("term", id, 0, 0, 0, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    private static void TraceHttp2(string operation, int id, ulong arg0, ulong arg1, ulong arg2, ulong arg3)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_HTTP2"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] http2.{operation} id={id} arg0=0x{arg0:X16} arg1=0x{arg1:X16} arg2=0x{arg2:X16} arg3=0x{arg3:X16}");
+    }
+}

src/SharpEmu.Libs/Network/NetCtlExports.cs

@@ -0,0 +1,20 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Network;
+
+public static class NetCtlExports
+{
+    [SysAbiExport(
+        Nid = "gky0+oaNM4k",
+        ExportName = "sceNetCtlInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNetCtl")]
+    public static int NetCtlInit(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}

src/SharpEmu.Libs/Network/NetExports.cs

@@ -0,0 +1,140 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Collections.Concurrent;
+using System.Text;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Network;
+
+public static class NetExports
+{
+    private const int NetErrorBadFileDescriptor = unchecked((int)0x80410109);
+    private const int NetErrorInvalidArgument = unchecked((int)0x80410116);
+    private const int MaxNameLength = 256;
+
+    private static readonly ConcurrentDictionary<int, NetPool> _pools = new();
+    private static int _nextPoolId;
+    private static bool _initialized;
+
+    private sealed record NetPool(string Name, int Size, int Flags);
+
+    [SysAbiExport(
+        Nid = "Nlev7Lg8k3A",
+        ExportName = "sceNetInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNet")]
+    public static int NetInit(CpuContext ctx)
+    {
+        _initialized = true;
+        TraceNet("init", 0, 0, 0, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "cTGkc6-TBlI",
+        ExportName = "sceNetTerm",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNet")]
+    public static int NetTerm(CpuContext ctx)
+    {
+        _initialized = false;
+        _pools.Clear();
+        TraceNet("term", 0, 0, 0, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "dgJBaeJnGpo",
+        ExportName = "sceNetPoolCreate",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNet")]
+    public static int NetPoolCreate(CpuContext ctx)
+    {
+        var nameAddress = ctx[CpuRegister.Rdi];
+        var size = unchecked((int)ctx[CpuRegister.Rsi]);
+        var flags = unchecked((int)ctx[CpuRegister.Rdx]);
+
+        if (size <= 0)
+        {
+            return SetReturn(ctx, NetErrorInvalidArgument);
+        }
+
+        var name = TryReadUtf8Z(ctx, nameAddress, MaxNameLength, out var value)
+            ? value
+            : string.Empty;
+
+        var id = Interlocked.Increment(ref _nextPoolId);
+        _pools[id] = new NetPool(name, size, flags);
+
+        TraceNet("pool.create", id, unchecked((ulong)size), unchecked((ulong)flags), _initialized ? 1UL : 0UL);
+        ctx[CpuRegister.Rax] = unchecked((ulong)id);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "K7RlrTkI-mw",
+        ExportName = "sceNetPoolDestroy",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNet")]
+    public static int NetPoolDestroy(CpuContext ctx)
+    {
+        var id = unchecked((int)ctx[CpuRegister.Rdi]);
+        if (!_pools.TryRemove(id, out _))
+        {
+            return SetReturn(ctx, NetErrorBadFileDescriptor);
+        }
+
+        TraceNet("pool.destroy", id, 0, 0, _initialized ? 1UL : 0UL);
+        return SetReturn(ctx, 0);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    private static bool TryReadUtf8Z(CpuContext ctx, ulong address, int maxLength, out string value)
+    {
+        value = string.Empty;
+        if (address == 0)
+        {
+            return true;
+        }
+
+        Span<byte> one = stackalloc byte[1];
+        var bytes = new byte[maxLength];
+        var count = 0;
+        for (; count < maxLength; count++)
+        {
+            if (!ctx.Memory.TryRead(address + (ulong)count, one))
+            {
+                return false;
+            }
+
+            if (one[0] == 0)
+            {
+                break;
+            }
+
+            bytes[count] = one[0];
+        }
+
+        value = Encoding.UTF8.GetString(bytes, 0, count);
+        return true;
+    }
+
+    private static void TraceNet(string operation, int id, ulong arg0, ulong arg1, ulong arg2)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_NET"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] net.{operation} id={id} arg0=0x{arg0:X16} arg1=0x{arg1:X16} arg2=0x{arg2:X16}");
+    }
+}

src/SharpEmu.Libs/Network/SslExports.cs

@@ -0,0 +1,87 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Collections.Concurrent;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Network;
+
+public static class SslExports
+{
+    private const int SslErrorInvalidId = unchecked((int)0x8095F006);
+    private const int SslErrorOutOfSize = unchecked((int)0x8095F008);
+
+    private static readonly ConcurrentDictionary<int, SslContext> _contexts = new();
+    private static int _nextContextId;
+
+    private sealed record SslContext(ulong PoolSize);
+
+    [SysAbiExport(
+        Nid = "hdpVEUDFW3s",
+        ExportName = "sceSslInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSsl")]
+    public static int SslInit(CpuContext ctx)
+    {
+        var poolSize = ctx[CpuRegister.Rdi];
+        if (poolSize == 0)
+        {
+            return SetReturn(ctx, SslErrorOutOfSize);
+        }
+
+        var id = Interlocked.Increment(ref _nextContextId);
+        _contexts[id] = new SslContext(poolSize);
+
+        TraceSsl("init", id, poolSize);
+        ctx[CpuRegister.Rax] = unchecked((ulong)id);
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "0K1yQ6Lv-Yc",
+        ExportName = "sceSslTerm",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSsl")]
+    public static int SslTerm(CpuContext ctx)
+    {
+        var id = unchecked((int)ctx[CpuRegister.Rdi]);
+        if (!_contexts.TryRemove(id, out _))
+        {
+            return SetReturn(ctx, SslErrorInvalidId);
+        }
+
+        TraceSsl("term", id, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "viRXSHZYd0c",
+        ExportName = "sceSslClose",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSsl")]
+    public static int SslClose(CpuContext ctx)
+    {
+        var id = unchecked((int)ctx[CpuRegister.Rdi]);
+        TraceSsl("close", id, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    private static void TraceSsl(string operation, int id, ulong arg0)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_SSL"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] ssl.{operation} id={id} arg0=0x{arg0:X16}");
+    }
+}

src/SharpEmu.Libs/Np/NpManagerExports.cs

@@ -0,0 +1,67 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Np;
+
+public static class NpManagerExports
+{
+    private const int NpTitleIdSize = 16;
+    private const int NpTitleSecretSize = 128;
+
+    [SysAbiExport(
+        Nid = "Ec63y59l9tw",
+        ExportName = "sceNpSetNpTitleId",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpManager")]
+    public static int NpSetNpTitleId(CpuContext ctx)
+    {
+        var titleIdAddress = ctx[CpuRegister.Rdi];
+        var titleSecretAddress = ctx[CpuRegister.Rsi];
+        if (titleIdAddress == 0 || titleSecretAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Span<byte> titleId = stackalloc byte[NpTitleIdSize];
+        Span<byte> titleSecret = stackalloc byte[NpTitleSecretSize];
+        if (!ctx.Memory.TryRead(titleIdAddress, titleId) ||
+            !ctx.Memory.TryRead(titleSecretAddress, titleSecret))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        TraceNp($"set_np_title_id title='{ReadTitleId(titleId)}'");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)(int)result);
+        return (int)result;
+    }
+
+    private static string ReadTitleId(ReadOnlySpan<byte> bytes)
+    {
+        var length = 0;
+        while (length < 12 && length < bytes.Length && bytes[length] != 0)
+        {
+            length++;
+        }
+
+        return length == 0
+            ? string.Empty
+            : System.Text.Encoding.ASCII.GetString(bytes[..length]);
+    }
+
+    private static void TraceNp(string message)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_NP"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine($"[LOADER][TRACE] np.{message}");
+    }
+}

src/SharpEmu.Libs/Np/NpWebApi2Exports.cs

@@ -0,0 +1,65 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Np;
+
+public static class NpWebApi2Exports
+{
+    private const int NpWebApi2ErrorInvalidArgument = unchecked((int)0x80553402);
+
+    private static int _initialized;
+
+    [SysAbiExport(
+        Nid = "+o9816YQhqQ",
+        ExportName = "sceNpWebApi2Initialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpWebApi2")]
+    public static int NpWebApi2Initialize(CpuContext ctx)
+    {
+        var httpContextId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var poolSize = ctx[CpuRegister.Rsi];
+
+        if (httpContextId <= 0 || poolSize == 0)
+        {
+            return SetReturn(ctx, NpWebApi2ErrorInvalidArgument);
+        }
+
+        Interlocked.Exchange(ref _initialized, 1);
+        TraceNpWebApi2("init", httpContextId, poolSize);
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "bEvXpcEk200",
+        ExportName = "sceNpWebApi2Terminate",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpWebApi2")]
+    public static int NpWebApi2Terminate(CpuContext ctx)
+    {
+        var libraryContextId = unchecked((int)ctx[CpuRegister.Rdi]);
+        Interlocked.Exchange(ref _initialized, 0);
+        TraceNpWebApi2("term", libraryContextId, 0);
+        return SetReturn(ctx, 0);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+
+    private static void TraceNpWebApi2(string operation, int id, ulong arg0)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_NP_WEB_API2"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][TRACE] npwebapi2.{operation} id={id} arg0=0x{arg0:X16} initialized={Volatile.Read(ref _initialized)}");
+    }
+}

src/SharpEmu.Libs/NpGameIntent/NpGameIntentExports.cs

@@ -0,0 +1,24 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.NpGameIntent;
+
+public static class NpGameIntentExports
+{
+    private static int _initialized;
+
+    [SysAbiExport(
+        Nid = "m87BHxt-H60",
+        ExportName = "sceNpGameIntentInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceNpGameIntent")]
+    public static int NpGameIntentInitialize(CpuContext ctx)
+    {
+        Interlocked.Exchange(ref _initialized, 1);
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+}

src/SharpEmu.Libs/Pad/PadExports.cs

@@ -0,0 +1,158 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Buffers.Binary;
+using System.Diagnostics;
+
+namespace SharpEmu.Libs.Pad;
+
+public static class PadExports
+{
+    private const int OrbisPadErrorInvalidHandle = unchecked((int)0x80920003);
+    private const int OrbisPadErrorNotInitialized = unchecked((int)0x80920005);
+    private const int OrbisPadErrorDeviceNotConnected = unchecked((int)0x80920007);
+    private const int OrbisPadErrorDeviceNoHandle = unchecked((int)0x80920008);
+    private const int PrimaryUserId = 1;
+    private const int StandardPortType = 0;
+    private const int PrimaryPadHandle = 1;
+    private const int ControllerInformationSize = 0x1C;
+    private const int PadDataSize = 0x78;
+
+    private static bool _initialized;
+
+    [SysAbiExport(
+        Nid = "hv1luiJrqQM",
+        ExportName = "scePadInit",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePad")]
+    public static int PadInit(CpuContext ctx)
+    {
+        _initialized = true;
+        return SetReturn(ctx, 0);
+    }
+
+    [SysAbiExport(
+        Nid = "xk0AcarP3V4",
+        ExportName = "scePadOpen",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePad")]
+    public static int PadOpen(CpuContext ctx)
+    {
+        var userId = unchecked((int)ctx[CpuRegister.Rdi]);
+        var type = unchecked((int)ctx[CpuRegister.Rsi]);
+        var index = unchecked((int)ctx[CpuRegister.Rdx]);
+        var parameterAddress = ctx[CpuRegister.Rcx];
+        if (!_initialized)
+        {
+            return SetReturn(ctx, OrbisPadErrorNotInitialized);
+        }
+
+        if (userId == -1)
+        {
+            return SetReturn(ctx, OrbisPadErrorDeviceNoHandle);
+        }
+
+        if (userId != PrimaryUserId || type != StandardPortType || index != 0 || parameterAddress != 0)
+        {
+            return SetReturn(ctx, OrbisPadErrorDeviceNotConnected);
+        }
+
+        return SetReturn(ctx, PrimaryPadHandle);
+    }
+
+    [SysAbiExport(
+        Nid = "clVvL4ZDntw",
+        ExportName = "scePadSetMotionSensorState",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePad")]
+    public static int PadSetMotionSensorState(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        return handle == PrimaryPadHandle
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, OrbisPadErrorInvalidHandle);
+    }
+
+    [SysAbiExport(
+        Nid = "gjP9-KQzoUk",
+        ExportName = "scePadGetControllerInformation",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePad")]
+    public static int PadGetControllerInformation(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        var informationAddress = ctx[CpuRegister.Rsi];
+        if (handle != PrimaryPadHandle)
+        {
+            return SetReturn(ctx, OrbisPadErrorInvalidHandle);
+        }
+
+        if (informationAddress == 0)
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Span<byte> information = stackalloc byte[ControllerInformationSize];
+        BinaryPrimitives.WriteSingleLittleEndian(information[0x00..], 44.86f);
+        BinaryPrimitives.WriteUInt16LittleEndian(information[0x04..], 1920);
+        BinaryPrimitives.WriteUInt16LittleEndian(information[0x06..], 943);
+        information[0x08] = 30;
+        information[0x09] = 30;
+        information[0x0A] = StandardPortType;
+        information[0x0B] = 1;
+        information[0x0C] = 1;
+        BinaryPrimitives.WriteInt32LittleEndian(information[0x10..], 0);
+
+        return ctx.Memory.TryWrite(informationAddress, information)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    [SysAbiExport(
+        Nid = "YndgXqQVV7c",
+        ExportName = "scePadReadState",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePad")]
+    public static int PadReadState(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        var dataAddress = ctx[CpuRegister.Rsi];
+        if (handle != PrimaryPadHandle)
+        {
+            return SetReturn(ctx, OrbisPadErrorInvalidHandle);
+        }
+
+        if (dataAddress == 0)
+        {
+            return SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Span<byte> data = stackalloc byte[PadDataSize];
+        data.Clear();
+        data[0x04] = 128;
+        data[0x05] = 128;
+        data[0x06] = 128;
+        data[0x07] = 128;
+        BinaryPrimitives.WriteSingleLittleEndian(data[0x18..], 1.0f);
+        data[0x4C] = 1;
+        var timestampTicks = Stopwatch.GetTimestamp();
+        var timestampMicroseconds =
+            ((ulong)(timestampTicks / Stopwatch.Frequency) * 1_000_000UL) +
+            ((ulong)(timestampTicks % Stopwatch.Frequency) * 1_000_000UL / (ulong)Stopwatch.Frequency);
+        BinaryPrimitives.WriteUInt64LittleEndian(
+            data[0x50..],
+            timestampMicroseconds);
+        data[0x68] = 1;
+
+        return ctx.Memory.TryWrite(dataAddress, data)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/PlayGo/PlayGoExports.cs

@@ -3,6 +3,7 @@
 
 using SharpEmu.HLE;
 using System.Buffers.Binary;
+using System.Text.RegularExpressions;
 
 namespace SharpEmu.Libs.PlayGo;
 
@@ -14,15 +15,35 @@ public static class PlayGoExports
     private const int OrbisPlayGoErrorBadHandle = unchecked((int)0x80B20009);
     private const int OrbisPlayGoErrorBadPointer = unchecked((int)0x80B2000A);
     private const int OrbisPlayGoErrorBadSize = unchecked((int)0x80B2000B);
+    private const int OrbisPlayGoErrorBadChunkId = unchecked((int)0x80B2000C);
     private const int OrbisPlayGoErrorNotSupportPlayGo = unchecked((int)0x80B2000E);
+    private const int OrbisPlayGoErrorBadLocus = unchecked((int)0x80B20010);
     private const ulong PlayGoInitBufAddrOffset = 0;
     private const ulong PlayGoInitBufSizeOffset = 8;
     private const uint PlayGoMinimumInitBufferSize = 0x200000;
     private const uint PlayGoHandle = 1;
+    private const int PlayGoLocusNotDownloaded = 0;
+    private const int PlayGoLocusLocalSlow = 2;
+    private const int PlayGoLocusLocalFast = 3;
+    private const int PlayGoInstallSpeedSuspended = 0;
+    private const int PlayGoInstallSpeedTrickle = 1;
+    private const int PlayGoInstallSpeedFull = 2;
+    private const uint MaxPlayGoQueryEntries = 0x4000;
+
+    private static readonly Regex ChunkIdPattern = new(
+        @"<chunk\s+[^>]*\bid\s*=\s*""(?<id>\d+)""",
+        RegexOptions.CultureInvariant);
+
+    private static readonly Regex DefaultChunkPattern = new(
+        @"default_chunk\s*=\s*""(?<id>\d+)""",
+        RegexOptions.CultureInvariant);
 
     private static readonly object _stateGate = new();
     private static bool _initialized;
-    private static bool _hasPlayGoData;
+    private static bool _opened;
+    private static PlayGoMetadata _metadata = PlayGoMetadata.Empty;
+    private static int _installSpeed = PlayGoInstallSpeedTrickle;
+    private static ulong _languageMask = ulong.MaxValue;
 
     [SysAbiExport(
         Nid = "ts6GlZOKRrE",
@@ -67,7 +88,10 @@ public static class PlayGoExports
                 return OrbisPlayGoErrorAlreadyInitialized;
             }
 
-            _hasPlayGoData = HasPlayGoChunkData();
+            _metadata = LoadPlayGoMetadata();
+            _installSpeed = PlayGoInstallSpeedTrickle;
+            _languageMask = ulong.MaxValue;
+            _opened = false;
             _initialized = true;
         }
 
@@ -100,10 +124,12 @@ public static class PlayGoExports
                 return OrbisPlayGoErrorNotInitialized;
             }
 
-            if (!_hasPlayGoData)
+            if (!_metadata.Available)
             {
                 return OrbisPlayGoErrorNotSupportPlayGo;
             }
+
+            _opened = true;
         }
 
         Span<byte> handleBytes = stackalloc byte[sizeof(uint)];
@@ -132,7 +158,8 @@ public static class PlayGoExports
             }
 
             _initialized = false;
-            _hasPlayGoData = false;
+            _opened = false;
+            _metadata = PlayGoMetadata.Empty;
         }
 
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
@@ -157,20 +184,567 @@ public static class PlayGoExports
             {
                 return OrbisPlayGoErrorBadHandle;
             }
+
+            _opened = false;
         }
 
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
-    private static bool HasPlayGoChunkData()
+    [SysAbiExport(
+        Nid = "73fF1MFU8hA",
+        ExportName = "scePlayGoGetChunkId",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetChunkId(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var outChunkIdList = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var outEntries = ctx[CpuRegister.Rcx];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (outEntries == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (outChunkIdList != 0 && numberOfEntries == 0)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        ushort[] chunkIds;
+        lock (_stateGate)
+        {
+            chunkIds = _metadata.ChunkIds;
+        }
+
+        var availableEntries = chunkIds.Length == 0 ? 1u : (uint)chunkIds.Length;
+        if (outChunkIdList == 0)
+        {
+            return TryWriteUInt32(ctx, outEntries, availableEntries)
+                ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+                : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        var entriesToWrite = Math.Min(numberOfEntries, availableEntries);
+        if (entriesToWrite > MaxPlayGoQueryEntries)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        for (uint i = 0; i < entriesToWrite; i++)
+        {
+            var chunkId = chunkIds.Length == 0 ? (ushort)0 : chunkIds[i];
+            if (!TryWriteUInt16(ctx, outChunkIdList + (i * sizeof(ushort)), chunkId))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+        }
+
+        return TryWriteUInt32(ctx, outEntries, entriesToWrite)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "v6EZ-YWRdMs",
+        ExportName = "scePlayGoGetEta",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetEta(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var chunkIds = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var outEta = ctx[CpuRegister.Rcx];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (chunkIds == 0 || outEta == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (numberOfEntries == 0 || numberOfEntries > MaxPlayGoQueryEntries)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        return ValidateChunkIds(ctx, chunkIds, numberOfEntries) is { } chunkError && chunkError != 0
+            ? chunkError
+            : TryWriteInt64(ctx, outEta, 0)
+                ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+                : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "rvBSfTimejE",
+        ExportName = "scePlayGoGetInstallSpeed",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetInstallSpeed(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var outSpeed = ctx[CpuRegister.Rsi];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (outSpeed == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        int speed;
+        lock (_stateGate)
+        {
+            speed = _installSpeed;
+        }
+
+        return TryWriteInt32(ctx, outSpeed, speed)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "3OMbYZBaa50",
+        ExportName = "scePlayGoGetLanguageMask",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetLanguageMask(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var outLanguageMask = ctx[CpuRegister.Rsi];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (outLanguageMask == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        ulong languageMask;
+        lock (_stateGate)
+        {
+            languageMask = _languageMask;
+        }
+
+        return ctx.TryWriteUInt64(outLanguageMask, languageMask)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "uWIYLFkkwqk",
+        ExportName = "scePlayGoGetLocus",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetLocus(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var chunkIds = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var outLoci = ctx[CpuRegister.Rcx];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (chunkIds == 0 || outLoci == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (numberOfEntries == 0 || numberOfEntries > MaxPlayGoQueryEntries)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        var loci = new byte[numberOfEntries];
+        for (uint i = 0; i < numberOfEntries; i++)
+        {
+            if (!TryReadUInt16(ctx, chunkIds + (i * sizeof(ushort)), out var chunkId))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            if (!IsKnownChunkId(chunkId))
+            {
+                loci[i] = PlayGoLocusNotDownloaded;
+                return ctx.Memory.TryWrite(outLoci, loci)
+                    ? OrbisPlayGoErrorBadChunkId
+                    : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            loci[i] = PlayGoLocusLocalFast;
+        }
+
+        return ctx.Memory.TryWrite(outLoci, loci)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "-RJWNMK3fC8",
+        ExportName = "scePlayGoGetProgress",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetProgress(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var chunkIds = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var outProgress = ctx[CpuRegister.Rcx];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (chunkIds == 0 || outProgress == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (numberOfEntries == 0 || numberOfEntries > MaxPlayGoQueryEntries)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        var chunkError = ValidateChunkIds(ctx, chunkIds, numberOfEntries);
+        if (chunkError != 0)
+        {
+            return chunkError;
+        }
+
+        Span<byte> progress = stackalloc byte[sizeof(ulong) * 2];
+        BinaryPrimitives.WriteUInt64LittleEndian(progress, 0);
+        BinaryPrimitives.WriteUInt64LittleEndian(progress[sizeof(ulong)..], 0);
+        return ctx.Memory.TryWrite(outProgress, progress)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "Nn7zKwnA5q0",
+        ExportName = "scePlayGoGetToDoList",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoGetToDoList(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var outTodoList = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var outEntries = ctx[CpuRegister.Rcx];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (outTodoList == 0 || outEntries == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (numberOfEntries == 0)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        return TryWriteUInt32(ctx, outEntries, 0)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    [SysAbiExport(
+        Nid = "-Q1-u1a7p0g",
+        ExportName = "scePlayGoPrefetch",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoPrefetch(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var chunkIds = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+        var minimumLocus = unchecked((int)ctx[CpuRegister.Rcx]);
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (chunkIds == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        if (numberOfEntries == 0 || numberOfEntries > MaxPlayGoQueryEntries)
+        {
+            return OrbisPlayGoErrorBadSize;
+        }
+
+        if (minimumLocus is not PlayGoLocusNotDownloaded and not PlayGoLocusLocalSlow and not PlayGoLocusLocalFast)
+        {
+            return OrbisPlayGoErrorBadLocus;
+        }
+
+        return ValidateChunkIds(ctx, chunkIds, numberOfEntries) is { } chunkError && chunkError != 0
+            ? chunkError
+            : (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "4AAcTU9R3XM",
+        ExportName = "scePlayGoSetInstallSpeed",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoSetInstallSpeed(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var speed = unchecked((int)ctx[CpuRegister.Rsi]);
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (speed is not PlayGoInstallSpeedSuspended and not PlayGoInstallSpeedTrickle and not PlayGoInstallSpeedFull)
+        {
+            return OrbisPlayGoErrorInvalidArgument;
+        }
+
+        lock (_stateGate)
+        {
+            _installSpeed = speed;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "LosLlHOpNqQ",
+        ExportName = "scePlayGoSetLanguageMask",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoSetLanguageMask(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var languageMask = ctx[CpuRegister.Rsi];
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        lock (_stateGate)
+        {
+            _languageMask = languageMask;
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "gUPGiOQ1tmQ",
+        ExportName = "scePlayGoSetToDoList",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libScePlayGo")]
+    public static int PlayGoSetToDoList(CpuContext ctx)
+    {
+        var handle = unchecked((uint)ctx[CpuRegister.Rdi]);
+        var todoList = ctx[CpuRegister.Rsi];
+        var numberOfEntries = unchecked((uint)ctx[CpuRegister.Rdx]);
+
+        var validation = ValidateHandle(handle);
+        if (validation != 0)
+        {
+            return validation;
+        }
+
+        if (todoList == 0)
+        {
+            return OrbisPlayGoErrorBadPointer;
+        }
+
+        return numberOfEntries == 0
+            ? OrbisPlayGoErrorBadSize
+            : (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static int ValidateHandle(uint handle)
+    {
+        lock (_stateGate)
+        {
+            if (!_initialized)
+            {
+                return OrbisPlayGoErrorNotInitialized;
+            }
+
+            if (handle != PlayGoHandle || !_opened)
+            {
+                return OrbisPlayGoErrorBadHandle;
+            }
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static int ValidateChunkIds(CpuContext ctx, ulong chunkIds, uint numberOfEntries)
+    {
+        for (uint i = 0; i < numberOfEntries; i++)
+        {
+            if (!TryReadUInt16(ctx, chunkIds + (i * sizeof(ushort)), out var chunkId))
+            {
+                return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+            }
+
+            if (!IsKnownChunkId(chunkId))
+            {
+                return OrbisPlayGoErrorBadChunkId;
+            }
+        }
+
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static bool IsKnownChunkId(ushort chunkId)
+    {
+        lock (_stateGate)
+        {
+            return _metadata.ChunkIds.Length == 0 || Array.BinarySearch(_metadata.ChunkIds, chunkId) >= 0;
+        }
+    }
+
+    private static PlayGoMetadata LoadPlayGoMetadata()
     {
         var app0Root = Environment.GetEnvironmentVariable("SHARPEMU_APP0_DIR");
         if (string.IsNullOrWhiteSpace(app0Root))
         {
+            return PlayGoMetadata.Empty;
+        }
+
+        var playGoDat = Path.Combine(app0Root, "sce_sys", "playgo-chunk.dat");
+        var scenarioJson = Path.Combine(app0Root, "sce_sys", "playgo-scenario.json");
+        var chunkDefsXml = Path.Combine(app0Root, "playgo-chunkdefs.xml");
+
+        var hasMetadata = File.Exists(playGoDat) || File.Exists(scenarioJson) || File.Exists(chunkDefsXml);
+        if (!hasMetadata)
+        {
+            return PlayGoMetadata.Empty;
+        }
+
+        var chunkIds = LoadChunkIds(chunkDefsXml);
+        return new PlayGoMetadata(true, chunkIds);
+    }
+
+    private static ushort[] LoadChunkIds(string chunkDefsXml)
+    {
+        if (!File.Exists(chunkDefsXml))
+        {
+            return Array.Empty<ushort>();
+        }
+
+        try
+        {
+            var xml = File.ReadAllText(chunkDefsXml);
+            var chunkIds = new HashSet<ushort>();
+            AddChunkIds(xml, DefaultChunkPattern, chunkIds);
+            AddChunkIds(xml, ChunkIdPattern, chunkIds);
+
+            var sorted = chunkIds.ToArray();
+            Array.Sort(sorted);
+            return sorted;
+        }
+        catch (IOException)
+        {
+            return Array.Empty<ushort>();
+        }
+        catch (UnauthorizedAccessException)
+        {
+            return Array.Empty<ushort>();
+        }
+    }
+
+    private static void AddChunkIds(string xml, Regex pattern, HashSet<ushort> chunkIds)
+    {
+        foreach (Match match in pattern.Matches(xml))
+        {
+            if (ushort.TryParse(match.Groups["id"].Value, out var chunkId))
+            {
+                chunkIds.Add(chunkId);
+            }
+        }
+    }
+
+    private static bool TryReadUInt16(CpuContext ctx, ulong address, out ushort value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ushort)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
             return false;
         }
 
-        var hostPath = Path.Combine(app0Root, "sce_sys", "playgo-chunk.dat");
-        return File.Exists(hostPath);
+        value = BinaryPrimitives.ReadUInt16LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryWriteUInt16(CpuContext ctx, ulong address, ushort value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ushort)];
+        BinaryPrimitives.WriteUInt16LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static bool TryWriteUInt32(CpuContext ctx, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static bool TryWriteInt32(CpuContext ctx, ulong address, int value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(int)];
+        BinaryPrimitives.WriteInt32LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private static bool TryWriteInt64(CpuContext ctx, ulong address, long value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(long)];
+        BinaryPrimitives.WriteInt64LittleEndian(buffer, value);
+        return ctx.Memory.TryWrite(address, buffer);
+    }
+
+    private sealed record PlayGoMetadata(bool Available, ushort[] ChunkIds)
+    {
+        public static readonly PlayGoMetadata Empty = new(false, Array.Empty<ushort>());
     }
 }

src/SharpEmu.Libs/Share/ShareExports.cs

@@ -0,0 +1,112 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Text;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Libs.Share;
+
+public static class ShareExports
+{
+    private const int MaxContentParamBytes = 4096;
+
+    private static int _initialized;
+    private static string _contentParam = string.Empty;
+
+    [SysAbiExport(
+        Nid = "nBDD66kiFW8",
+        ExportName = "sceShareInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceShareUtility")]
+    public static int ShareInitialize(CpuContext ctx)
+    {
+        var memorySize = ctx[CpuRegister.Rdi];
+        var priority = unchecked((int)ctx[CpuRegister.Rsi]);
+        var affinityMask = ctx[CpuRegister.Rdx];
+        if (memorySize == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        Interlocked.Exchange(ref _initialized, 1);
+
+        TraceShare($"initialize memory=0x{memorySize:X} priority={priority} affinity=0x{affinityMask:X}");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    [SysAbiExport(
+        Nid = "7QZtURYnXG4",
+        ExportName = "sceShareSetContentParam",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceShareUtility")]
+    public static int ShareSetContentParam(CpuContext ctx)
+    {
+        var contentParamAddress = ctx[CpuRegister.Rdi];
+        if (contentParamAddress == 0)
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_INVALID_ARGUMENT);
+        }
+
+        if (!TryReadNullTerminatedUtf8(ctx, contentParamAddress, MaxContentParamBytes, out var contentParam))
+        {
+            return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+        }
+
+        _contentParam = contentParam;
+        if (Volatile.Read(ref _initialized) == 0)
+        {
+            TraceShare("set_content_param before initialize");
+        }
+
+        TraceShare($"set_content_param len={contentParam.Length} preview='{FormatTraceString(contentParam)}'");
+        return SetReturn(ctx, OrbisGen2Result.ORBIS_GEN2_OK);
+    }
+
+    private static int SetReturn(CpuContext ctx, OrbisGen2Result result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)(int)result);
+        return (int)result;
+    }
+
+    private static bool TryReadNullTerminatedUtf8(CpuContext ctx, ulong address, int maxLength, out string value)
+    {
+        Span<byte> bytes = stackalloc byte[maxLength];
+        Span<byte> one = stackalloc byte[1];
+        for (var index = 0; index < maxLength; index++)
+        {
+            if (!ctx.Memory.TryRead(address + (ulong)index, one))
+            {
+                value = string.Empty;
+                return false;
+            }
+
+            if (one[0] == 0)
+            {
+                value = Encoding.UTF8.GetString(bytes[..index]);
+                return true;
+            }
+
+            bytes[index] = one[0];
+        }
+
+        value = string.Empty;
+        return false;
+    }
+
+    private static string FormatTraceString(string value)
+    {
+        var normalized = value.Replace("\r", "\\r", StringComparison.Ordinal).Replace("\n", "\\n", StringComparison.Ordinal);
+        return normalized.Length <= 120 ? normalized : string.Concat(normalized.AsSpan(0, 120), "...");
+    }
+
+    private static void TraceShare(string message)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_SHARE"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine($"[LOADER][TRACE] share.{message}");
+    }
+}

src/SharpEmu.Libs/SharpEmu.Libs.csproj

@@ -8,6 +8,12 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <ProjectReference Include="..\SharpEmu.HLE\SharpEmu.HLE.csproj" />
   </ItemGroup>
 
+  <ItemGroup>
+    <PackageReference Include="Silk.NET.Vulkan" />
+    <PackageReference Include="Silk.NET.Vulkan.Extensions.KHR" />
+    <PackageReference Include="Silk.NET.Windowing" />
+  </ItemGroup>
+
   <PropertyGroup>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
   </PropertyGroup>

src/SharpEmu.Libs/SystemService/SystemServiceExports.cs

@@ -0,0 +1,65 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.SystemService;
+
+public static class SystemServiceExports
+{
+    private const int OrbisSystemServiceErrorParameter = unchecked((int)0x80A10003);
+    private const int SystemServiceStatusSize = 0x0C;
+    private const int DisplaySafeAreaInfoSize = sizeof(float) + 128;
+
+    [SysAbiExport(
+        Nid = "rPo6tV8D9bM",
+        ExportName = "sceSystemServiceGetStatus",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSystemService")]
+    public static int SystemServiceGetStatus(CpuContext ctx)
+    {
+        var statusAddress = ctx[CpuRegister.Rdi];
+        if (statusAddress == 0)
+        {
+            return SetReturn(ctx, OrbisSystemServiceErrorParameter);
+        }
+
+        Span<byte> status = stackalloc byte[SystemServiceStatusSize];
+        status.Clear();
+        BinaryPrimitives.WriteInt32LittleEndian(status, 0);
+        status[0x06] = 1;
+
+        return ctx.Memory.TryWrite(statusAddress, status)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    [SysAbiExport(
+        Nid = "1n37q1Bvc5Y",
+        ExportName = "sceSystemServiceGetDisplaySafeAreaInfo",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceSystemService")]
+    public static int SystemServiceGetDisplaySafeAreaInfo(CpuContext ctx)
+    {
+        var infoAddress = ctx[CpuRegister.Rdi];
+        if (infoAddress == 0)
+        {
+            return SetReturn(ctx, OrbisSystemServiceErrorParameter);
+        }
+
+        Span<byte> info = stackalloc byte[DisplaySafeAreaInfoSize];
+        info.Clear();
+        BinaryPrimitives.WriteSingleLittleEndian(info, 1.0f);
+
+        return ctx.Memory.TryWrite(infoAddress, info)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/UserService/UserServiceExports.cs

@@ -0,0 +1,79 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE;
+using System.Buffers.Binary;
+
+namespace SharpEmu.Libs.UserService;
+
+public static class UserServiceExports
+{
+    private const int OrbisUserServiceErrorInvalidArgument = unchecked((int)0x80960005);
+    private const int PrimaryUserId = 1;
+    private const int InvalidUserId = -1;
+
+    [SysAbiExport(
+        Nid = "j3YMu1MVNNo",
+        ExportName = "sceUserServiceInitialize",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceUserService")]
+    public static int UserServiceInitialize(CpuContext ctx)
+    {
+        ctx[CpuRegister.Rax] = 0;
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "CdWp0oHWGr0",
+        ExportName = "sceUserServiceGetInitialUser",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceUserService")]
+    public static int UserServiceGetInitialUser(CpuContext ctx)
+    {
+        var userIdAddress = ctx[CpuRegister.Rdi];
+        if (userIdAddress == 0)
+        {
+            return SetReturn(ctx, OrbisUserServiceErrorInvalidArgument);
+        }
+
+        return TryWriteInt32(ctx, userIdAddress, PrimaryUserId)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    [SysAbiExport(
+        Nid = "fPhymKNvK-A",
+        ExportName = "sceUserServiceGetLoginUserIdList",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceUserService")]
+    public static int UserServiceGetLoginUserIdList(CpuContext ctx)
+    {
+        var userIdListAddress = ctx[CpuRegister.Rdi];
+        if (userIdListAddress == 0)
+        {
+            return SetReturn(ctx, OrbisUserServiceErrorInvalidArgument);
+        }
+
+        Span<byte> userIds = stackalloc byte[sizeof(int) * 4];
+        BinaryPrimitives.WriteInt32LittleEndian(userIds[0x00..], PrimaryUserId);
+        BinaryPrimitives.WriteInt32LittleEndian(userIds[0x04..], InvalidUserId);
+        BinaryPrimitives.WriteInt32LittleEndian(userIds[0x08..], InvalidUserId);
+        BinaryPrimitives.WriteInt32LittleEndian(userIds[0x0C..], InvalidUserId);
+        return ctx.Memory.TryWrite(userIdListAddress, userIds)
+            ? SetReturn(ctx, 0)
+            : SetReturn(ctx, (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT);
+    }
+
+    private static bool TryWriteInt32(CpuContext ctx, ulong address, int value)
+    {
+        Span<byte> bytes = stackalloc byte[sizeof(int)];
+        BinaryPrimitives.WriteInt32LittleEndian(bytes, value);
+        return ctx.Memory.TryWrite(address, bytes);
+    }
+
+    private static int SetReturn(CpuContext ctx, int result)
+    {
+        ctx[CpuRegister.Rax] = unchecked((ulong)result);
+        return result;
+    }
+}

src/SharpEmu.Libs/VideoOut/VideoOutExports.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using SharpEmu.HLE;
+using SharpEmu.Libs.Kernel;
 using System.Buffers.Binary;
 using System.Diagnostics.CodeAnalysis;
 using System.Threading;
@@ -15,28 +16,109 @@ public static class VideoOutExports
     private const int OrbisVideoOutErrorResourceBusy = unchecked((int)0x80290009);
     private const int OrbisVideoOutErrorInvalidIndex = unchecked((int)0x8029000A);
     private const int OrbisVideoOutErrorInvalidHandle = unchecked((int)0x8029000B);
+    private const int OrbisVideoOutErrorInvalidEventQueue = unchecked((int)0x8029000C);
+    private const int OrbisVideoOutErrorInvalidEvent = unchecked((int)0x8029000D);
     private const int OrbisVideoOutErrorInvalidOption = unchecked((int)0x8029001A);
     private const int SceVideoOutBusTypeMain = 0;
     private const int SceVideoOutBufferAttributeOptionNone = 0;
+    private const int SceVideoOutTilingModeLinear = 1;
     private const int MaxOpenPorts = 4;
     private const int MaxDisplayBuffers = 16;
-    private const int VideoOutBufferAttributeSize = 0x24;
+    private const int MaxDisplayBufferGroups = 4;
+    private const int MaxFrameDumps = 8;
+    private const int VideoOutBufferAttributeSize = 0x28;
     private const int VideoOutBufferAttribute2Size = 0x50;
     private const int VideoOutBuffersEntrySize = 0x20;
+    private const ulong SceVideoOutPixelFormatA8R8G8B8Srgb = 0x80000000;
+    private const ulong SceVideoOutPixelFormatA8B8G8R8Srgb = 0x80002200;
+    private const ulong SceVideoOutPixelFormatA2R10G10B10 = 0x88060000;
+    private const ulong SceVideoOutPixelFormatA2R10G10B10Srgb = 0x88000000;
+    private const ulong SceVideoOutPixelFormatA2R10G10B10Bt2020Pq = 0x88740000;
+    private const ulong SceVideoOutInternalEventFlip = 0x6;
+    private const short OrbisKernelEventFilterVideoOut = -13;
 
     private static readonly object _stateGate = new();
+    private static readonly object _frameDumpGate = new();
     private static readonly Dictionary<int, VideoOutPortState> _ports = new();
+    private static readonly Dictionary<(int Handle, int BufferIndex, ulong Address), ulong> _lastFrameFingerprints = new();
     private static int _nextHandle = 1;
+    private static int _frameDumpCount;
+    private static long _nextFrameDumpIndex;
+    private static string _windowTitle = "SharpEmu VideoOut";
+
+    public static void ConfigureApplicationInfo(string? title, string? titleId, string? version)
+    {
+        var parts = new List<string>();
+        if (!string.IsNullOrWhiteSpace(title))
+        {
+            parts.Add(title.Trim());
+        }
+
+        if (!string.IsNullOrWhiteSpace(titleId))
+        {
+            parts.Add($"[{titleId.Trim()}]");
+        }
+
+        var application = parts.Count == 0 ? "VideoOut" : string.Join(' ', parts);
+        var versionSuffix = string.IsNullOrWhiteSpace(version) ? string.Empty : $" v{version.Trim()}";
+        lock (_stateGate)
+        {
+            _windowTitle = $"SharpEmu - {application}{versionSuffix}";
+        }
+    }
+
+    internal static string GetWindowTitle()
+    {
+        lock (_stateGate)
+        {
+            return _windowTitle;
+        }
+    }
 
     private sealed class VideoOutPortState
     {
         public required int Handle { get; init; }
         public int FlipRate { get; set; }
         public ulong VblankCount { get; set; }
-        public int NextSetId { get; set; } = 1;
-        public HashSet<int> RegisteredSetIds { get; } = new();
+        public ulong FlipCount { get; set; }
+        public int CurrentBuffer { get; set; } = -1;
+        public VideoOutBufferGroup?[] Groups { get; } = new VideoOutBufferGroup?[MaxDisplayBufferGroups];
+        public VideoOutBufferSlot[] BufferSlots { get; } = CreateBufferSlots();
+        public List<FlipEventRegistration> FlipEvents { get; } = new();
     }
 
+    private sealed class VideoOutBufferGroup
+    {
+        public required int Index { get; init; }
+        public required BufferAttribute Attribute { get; init; }
+    }
+
+    private sealed class VideoOutBufferSlot
+    {
+        public int GroupIndex { get; set; } = -1;
+        public ulong AddressLeft { get; set; }
+        public ulong AddressRight { get; set; }
+    }
+
+    private readonly record struct FlipEventRegistration(ulong Equeue, ulong UserData);
+
+    private readonly record struct BufferAttribute(
+        ulong PixelFormat,
+        uint TilingMode,
+        uint AspectRatio,
+        uint Width,
+        uint Height,
+        uint PitchInPixel,
+        ulong Option);
+
+    internal readonly record struct DisplayBufferInfo(
+        ulong Address,
+        ulong PixelFormat,
+        uint TilingMode,
+        uint Width,
+        uint Height,
+        uint PitchInPixel);
+
     [SysAbiExport(
         Nid = "Up36PTk687E",
         ExportName = "sceVideoOutOpen",
@@ -136,6 +218,174 @@ public static class VideoOutExports
         return (int)OrbisGen2Result.ORBIS_GEN2_OK;
     }
 
+    [SysAbiExport(
+        Nid = "HXzjK9yI30k",
+        ExportName = "sceVideoOutAddFlipEvent",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceVideoOut")]
+    public static int VideoOutAddFlipEvent(CpuContext ctx)
+    {
+        var equeue = ctx[CpuRegister.Rdi];
+        var handle = unchecked((int)ctx[CpuRegister.Rsi]);
+        var userData = ctx[CpuRegister.Rdx];
+        if (!TryGetPort(handle, out var port))
+        {
+            return OrbisVideoOutErrorInvalidHandle;
+        }
+
+        if (!KernelEventQueueCompatExports.IsValidEqueue(equeue))
+        {
+            return OrbisVideoOutErrorInvalidEventQueue;
+        }
+
+        lock (_stateGate)
+        {
+            var existingIndex = port.FlipEvents.FindIndex(registration => registration.Equeue == equeue);
+            if (existingIndex >= 0)
+            {
+                port.FlipEvents[existingIndex] = new FlipEventRegistration(equeue, userData);
+            }
+            else
+            {
+                port.FlipEvents.Add(new FlipEventRegistration(equeue, userData));
+            }
+        }
+
+        TraceVideoOut($"videoout.add_flip_event eq=0x{equeue:X16} handle={handle} udata=0x{userData:X16}");
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    [SysAbiExport(
+        Nid = "U46NwOiJpys",
+        ExportName = "sceVideoOutSubmitFlip",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceVideoOut")]
+    public static int VideoOutSubmitFlip(CpuContext ctx)
+    {
+        var handle = unchecked((int)ctx[CpuRegister.Rdi]);
+        var bufferIndex = unchecked((int)ctx[CpuRegister.Rsi]);
+        var flipMode = unchecked((int)ctx[CpuRegister.Rdx]);
+        var flipArg = unchecked((long)ctx[CpuRegister.Rcx]);
+        return SubmitFlip(ctx, handle, bufferIndex, flipMode, flipArg);
+    }
+
+    [SysAbiExport(
+        Nid = "U2JJtSqNKZI",
+        ExportName = "sceVideoOutGetEventId",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceVideoOut")]
+    public static int VideoOutGetEventId(CpuContext ctx)
+    {
+        var eventAddress = ctx[CpuRegister.Rdi];
+        if (eventAddress == 0)
+        {
+            return OrbisVideoOutErrorInvalidAddress;
+        }
+
+        if (!ctx.TryReadUInt64(eventAddress, out var ident) ||
+            !TryReadInt16(ctx, eventAddress + 0x08, out var filter))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (filter != OrbisKernelEventFilterVideoOut || ident != SceVideoOutInternalEventFlip)
+        {
+            return OrbisVideoOutErrorInvalidEvent;
+        }
+
+        return 0;
+    }
+
+    [SysAbiExport(
+        Nid = "rWUTcKdkUzQ",
+        ExportName = "sceVideoOutGetEventData",
+        Target = Generation.Gen4 | Generation.Gen5,
+        LibraryName = "libSceVideoOut")]
+    public static int VideoOutGetEventData(CpuContext ctx)
+    {
+        var eventAddress = ctx[CpuRegister.Rdi];
+        var dataAddress = ctx[CpuRegister.Rsi];
+        if (eventAddress == 0 || dataAddress == 0)
+        {
+            return OrbisVideoOutErrorInvalidAddress;
+        }
+
+        if (!ctx.TryReadUInt64(eventAddress, out var ident) ||
+            !TryReadInt16(ctx, eventAddress + 0x08, out var filter) ||
+            !ctx.TryReadUInt64(eventAddress + 0x10, out var data))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        if (filter != OrbisKernelEventFilterVideoOut || ident != SceVideoOutInternalEventFlip)
+        {
+            return OrbisVideoOutErrorInvalidEvent;
+        }
+
+        var decodedData = unchecked((ulong)(unchecked((long)data) >> 16));
+        return ctx.TryWriteUInt64(dataAddress, decodedData)
+            ? (int)OrbisGen2Result.ORBIS_GEN2_OK
+            : (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+    }
+
+    public static int SubmitFlipFromAgc(CpuContext ctx, int handle, int bufferIndex, int flipMode, long flipArg) =>
+        SubmitFlip(ctx, handle, bufferIndex, flipMode, flipArg);
+
+    internal static void SubmitHostRgbaFrame(ReadOnlySpan<byte> rgbaFrame, uint width, uint height)
+    {
+        if (rgbaFrame.Length != checked((int)(width * height * 4)))
+        {
+            return;
+        }
+
+        var bgraFrame = new byte[rgbaFrame.Length];
+        for (var offset = 0; offset < rgbaFrame.Length; offset += 4)
+        {
+            bgraFrame[offset + 0] = rgbaFrame[offset + 2];
+            bgraFrame[offset + 1] = rgbaFrame[offset + 1];
+            bgraFrame[offset + 2] = rgbaFrame[offset + 0];
+            bgraFrame[offset + 3] = rgbaFrame[offset + 3];
+        }
+
+        VulkanVideoPresenter.Submit(bgraFrame, width, height);
+    }
+
+    internal static bool TryGetDisplayBufferInfo(int handle, int bufferIndex, out DisplayBufferInfo info)
+    {
+        info = default;
+        if (bufferIndex < 0 || bufferIndex >= MaxDisplayBuffers)
+        {
+            return false;
+        }
+
+        lock (_stateGate)
+        {
+            if (!_ports.TryGetValue(handle, out var port))
+            {
+                return false;
+            }
+
+            var slot = port.BufferSlots[bufferIndex];
+            if (slot.AddressLeft == 0 ||
+                slot.GroupIndex < 0 ||
+                slot.GroupIndex >= port.Groups.Length ||
+                port.Groups[slot.GroupIndex] is not { } group)
+            {
+                return false;
+            }
+
+            var attribute = group.Attribute;
+            info = new DisplayBufferInfo(
+                slot.AddressLeft,
+                attribute.PixelFormat,
+                attribute.TilingMode,
+                attribute.Width,
+                attribute.Height,
+                attribute.PitchInPixel);
+            return true;
+        }
+    }
+
     [SysAbiExport(
         Nid = "MTxxrOCeSig",
         ExportName = "sceVideoOutSetWindowModeMargins",
@@ -173,9 +423,23 @@ public static class VideoOutExports
 
         lock (_stateGate)
         {
-            return port.RegisteredSetIds.Remove(attributeIndex)
-                ? (int)OrbisGen2Result.ORBIS_GEN2_OK
-                : OrbisVideoOutErrorInvalidValue;
+            if (attributeIndex >= port.Groups.Length || port.Groups[attributeIndex] is null)
+            {
+                return OrbisVideoOutErrorInvalidValue;
+            }
+
+            port.Groups[attributeIndex] = null;
+            foreach (var slot in port.BufferSlots)
+            {
+                if (slot.GroupIndex == attributeIndex)
+                {
+                    slot.GroupIndex = -1;
+                    slot.AddressLeft = 0;
+                    slot.AddressRight = 0;
+                }
+            }
+
+            return (int)OrbisGen2Result.ORBIS_GEN2_OK;
         }
     }
 
@@ -292,16 +556,21 @@ public static class VideoOutExports
             return OrbisVideoOutErrorInvalidValue;
         }
 
+        if (!TryReadBufferAttribute(ctx, attributeAddress, false, out var attribute))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        Span<ulong> addresses = stackalloc ulong[Math.Min(bufferNum, MaxDisplayBuffers)];
         for (var i = 0; i < bufferNum; i++)
         {
-            if (!ctx.TryReadUInt64(addressesAddress + ((ulong)i * 8), out _))
+            if (!ctx.TryReadUInt64(addressesAddress + ((ulong)i * 8), out addresses[i]))
             {
                 return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
             }
         }
 
-        var setId = AllocateBufferSet(port);
-        return setId;
+        return RegisterBufferRange(port, startIndex, addresses[..bufferNum], attribute);
     }
 
     [SysAbiExport(
@@ -348,34 +617,460 @@ public static class VideoOutExports
             return OrbisVideoOutErrorInvalidValue;
         }
 
+        if (!TryReadBufferAttribute(ctx, attributeAddress, true, out var attribute))
+        {
+            return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
+        }
+
+        Span<ulong> addresses = stackalloc ulong[Math.Min(bufferNum, MaxDisplayBuffers)];
         for (var i = 0; i < bufferNum; i++)
         {
             var entryAddress = buffersAddress + ((ulong)i * VideoOutBuffersEntrySize);
-            if (!ctx.TryReadUInt64(entryAddress + 0x00, out _) ||
+            if (!ctx.TryReadUInt64(entryAddress + 0x00, out addresses[i]) ||
                 !ctx.TryReadUInt64(entryAddress + 0x08, out _))
             {
                 return (int)OrbisGen2Result.ORBIS_GEN2_ERROR_MEMORY_FAULT;
             }
         }
 
-        lock (_stateGate)
-        {
-            port.RegisteredSetIds.Add(setIndex);
-        }
-
-        return setIndex;
+        var groupIndex = RegisterBufferRange(port, bufferIndexStart, addresses[..bufferNum], attribute, setIndex);
+        return groupIndex < 0 ? groupIndex : setIndex;
     }
 
-    private static int AllocateBufferSet(VideoOutPortState port)
+    private static int SubmitFlip(CpuContext ctx, int handle, int bufferIndex, int flipMode, long flipArg)
+    {
+        if (!TryGetPort(handle, out var port))
+        {
+            return OrbisVideoOutErrorInvalidHandle;
+        }
+
+        if (bufferIndex < -1 || bufferIndex >= MaxDisplayBuffers)
+        {
+            return OrbisVideoOutErrorInvalidIndex;
+        }
+
+        ulong eventHint;
+        List<FlipEventRegistration> flipEvents;
+        lock (_stateGate)
+        {
+            if (bufferIndex != -1 && port.BufferSlots[bufferIndex].GroupIndex < 0)
+            {
+                return OrbisVideoOutErrorInvalidIndex;
+            }
+
+            port.CurrentBuffer = bufferIndex;
+            port.FlipCount++;
+            eventHint = SceVideoOutInternalEventFlip |
+                ((unchecked((ulong)flipArg) & 0x0000_FFFF_FFFF_FFFFUL) << 16);
+            flipEvents = new List<FlipEventRegistration>(port.FlipEvents);
+        }
+
+        if (string.Equals(
+                Environment.GetEnvironmentVariable("SHARPEMU_DUMP_VIDEOOUT"),
+                "1",
+                StringComparison.Ordinal))
+        {
+            _ = TryDumpFrame(ctx, port, bufferIndex, flipMode, flipArg);
+        }
+
+        foreach (var flipEvent in flipEvents)
+        {
+            _ = KernelEventQueueCompatExports.TriggerDisplayEvent(
+                flipEvent.Equeue,
+                SceVideoOutInternalEventFlip,
+                OrbisKernelEventFilterVideoOut,
+                eventHint,
+                flipEvent.UserData);
+        }
+
+        TraceVideoOut($"videoout.submit_flip handle={handle} index={bufferIndex} mode={flipMode} arg={flipArg} events={flipEvents.Count}");
+        return (int)OrbisGen2Result.ORBIS_GEN2_OK;
+    }
+
+    private static int RegisterBufferRange(VideoOutPortState port, int startIndex, ReadOnlySpan<ulong> addresses, BufferAttribute attribute, int requestedGroupIndex = -1)
     {
         lock (_stateGate)
         {
-            var setId = port.NextSetId++;
-            port.RegisteredSetIds.Add(setId);
-            return setId;
+            var groupIndex = requestedGroupIndex >= 0 ? requestedGroupIndex : FindFreeGroupIndex(port);
+            if (groupIndex < 0 || groupIndex >= MaxDisplayBufferGroups)
+            {
+                return OrbisVideoOutErrorInvalidValue;
+            }
+
+            if (port.Groups[groupIndex] is not null)
+            {
+                return OrbisVideoOutErrorResourceBusy;
+            }
+
+            for (var i = 0; i < addresses.Length; i++)
+            {
+                if (port.BufferSlots[startIndex + i].GroupIndex >= 0)
+                {
+                    return OrbisVideoOutErrorResourceBusy;
+                }
+            }
+
+            port.Groups[groupIndex] = new VideoOutBufferGroup
+            {
+                Index = groupIndex,
+                Attribute = attribute,
+            };
+
+            for (var i = 0; i < addresses.Length; i++)
+            {
+                var slot = port.BufferSlots[startIndex + i];
+                slot.GroupIndex = groupIndex;
+                slot.AddressLeft = addresses[i];
+                slot.AddressRight = 0;
+            }
+
+            TraceVideoOut(
+                $"videoout.register_buffers handle={port.Handle} group={groupIndex} start={startIndex} count={addresses.Length} fmt=0x{attribute.PixelFormat:X} tile={attribute.TilingMode} {attribute.Width}x{attribute.Height} pitch={attribute.PitchInPixel}");
+            return groupIndex;
         }
     }
 
+    private static int FindFreeGroupIndex(VideoOutPortState port)
+    {
+        for (var i = 0; i < port.Groups.Length; i++)
+        {
+            if (port.Groups[i] is null)
+            {
+                return i;
+            }
+        }
+
+        return -1;
+    }
+
+    private static bool TryReadBufferAttribute(CpuContext ctx, ulong attributeAddress, bool attribute2, out BufferAttribute attribute)
+    {
+        attribute = default;
+        if (!TryReadUInt32(ctx, attributeAddress + 0x04, out var tilingMode) ||
+            !TryReadUInt32(ctx, attributeAddress + 0x0C, out var width) ||
+            !TryReadUInt32(ctx, attributeAddress + 0x10, out var height))
+        {
+            return false;
+        }
+
+        if (attribute2)
+        {
+            if (!ctx.TryReadUInt64(attributeAddress + 0x18, out var option) ||
+                !ctx.TryReadUInt64(attributeAddress + 0x20, out var pixelFormat))
+            {
+                return false;
+            }
+
+            attribute = new BufferAttribute(NormalizePixelFormat(pixelFormat), tilingMode, 0, width, height, width, option);
+            return true;
+        }
+
+        if (!TryReadUInt32(ctx, attributeAddress + 0x00, out var pixelFormat32) ||
+            !TryReadUInt32(ctx, attributeAddress + 0x08, out var aspectRatio) ||
+            !TryReadUInt32(ctx, attributeAddress + 0x14, out var pitchInPixel) ||
+            !TryReadUInt32(ctx, attributeAddress + 0x18, out var option32))
+        {
+            return false;
+        }
+
+        attribute = new BufferAttribute(NormalizePixelFormat(pixelFormat32), tilingMode, aspectRatio, width, height, pitchInPixel, option32);
+        return true;
+    }
+
+    private static bool TryDumpFrame(CpuContext ctx, VideoOutPortState port, int bufferIndex, int flipMode, long flipArg)
+    {
+        if (bufferIndex < 0)
+        {
+            return false;
+        }
+
+        VideoOutBufferSlot slot;
+        VideoOutBufferGroup? group;
+        lock (_stateGate)
+        {
+            slot = port.BufferSlots[bufferIndex];
+            group = slot.GroupIndex >= 0 && slot.GroupIndex < port.Groups.Length
+                ? port.Groups[slot.GroupIndex]
+                : null;
+        }
+
+        if (group is null || slot.AddressLeft == 0)
+        {
+            return false;
+        }
+
+        var attribute = group.Attribute;
+        if (attribute.Width == 0 || attribute.Height == 0 || attribute.Width > 8192 || attribute.Height > 8192)
+        {
+            return false;
+        }
+
+        var bytesPerPixel = GetBytesPerPixel(attribute.PixelFormat);
+        if (bytesPerPixel == 0)
+        {
+            return DumpRawFrame(ctx, port.Handle, slot.AddressLeft, attribute, bufferIndex, flipMode, flipArg, "unsupported-format");
+        }
+
+        var pitch = attribute.PitchInPixel == 0 ? attribute.Width : attribute.PitchInPixel;
+        var rowBytes = checked((int)(pitch * bytesPerPixel));
+        var visibleRowBytes = checked((int)(attribute.Width * bytesPerPixel));
+        var frameBytes = checked((ulong)rowBytes * attribute.Height);
+        if (frameBytes > 256UL * 1024UL * 1024UL)
+        {
+            return false;
+        }
+
+        lock (_frameDumpGate)
+        {
+            if (_frameDumpCount >= MaxFrameDumps)
+            {
+                return false;
+            }
+        }
+
+        const ulong fnvOffsetBasis = 14695981039346656037UL;
+        const ulong fnvPrime = 1099511628211UL;
+        var fingerprint = fnvOffsetBasis;
+        var row = new byte[rowBytes];
+        for (uint y = 0; y < attribute.Height; y++)
+        {
+            if (!ctx.Memory.TryRead(slot.AddressLeft + ((ulong)y * (ulong)rowBytes), row))
+            {
+                return false;
+            }
+
+            foreach (var value in row.AsSpan(0, visibleRowBytes))
+            {
+                fingerprint = (fingerprint ^ value) * fnvPrime;
+            }
+        }
+
+        var fingerprintKey = (port.Handle, bufferIndex, slot.AddressLeft);
+        lock (_frameDumpGate)
+        {
+            if (_lastFrameFingerprints.TryGetValue(fingerprintKey, out var previousFingerprint) &&
+                previousFingerprint == fingerprint)
+            {
+                return false;
+            }
+
+            if (_frameDumpCount >= MaxFrameDumps)
+            {
+                return false;
+            }
+
+            _lastFrameFingerprints[fingerprintKey] = fingerprint;
+            _frameDumpCount++;
+        }
+
+        var rgb = new byte[checked((int)(attribute.Width * attribute.Height * 3))];
+        var rgbOffset = 0;
+        for (uint y = 0; y < attribute.Height; y++)
+        {
+            if (!ctx.Memory.TryRead(slot.AddressLeft + ((ulong)y * (ulong)rowBytes), row))
+            {
+                return false;
+            }
+
+            ConvertRowToRgb(row.AsSpan(0, visibleRowBytes), rgb.AsSpan(rgbOffset, (int)attribute.Width * 3), attribute.PixelFormat);
+            rgbOffset += (int)attribute.Width * 3;
+        }
+
+        var frameIndex = Interlocked.Increment(ref _nextFrameDumpIndex);
+        var basePath = GetFrameDumpBasePath(frameIndex, port.Handle, bufferIndex);
+        WriteBmp(basePath + ".bmp", attribute.Width, attribute.Height, rgb);
+        WriteFrameMetadata(basePath + ".txt", slot.AddressLeft, attribute, bufferIndex, flipMode, flipArg, "bmp-linear-read", fingerprint);
+        TraceVideoOut($"videoout.dump_frame path={basePath}.bmp addr=0x{slot.AddressLeft:X16} {attribute.Width}x{attribute.Height} fmt=0x{attribute.PixelFormat:X} fingerprint=0x{fingerprint:X16}");
+        return true;
+    }
+
+    private static bool DumpRawFrame(CpuContext ctx, int handle, ulong address, BufferAttribute attribute, int bufferIndex, int flipMode, long flipArg, string reason)
+    {
+        var bytesPerPixel = Math.Max(GetBytesPerPixel(attribute.PixelFormat), 4u);
+        var pitch = attribute.PitchInPixel == 0 ? attribute.Width : attribute.PitchInPixel;
+        var byteCount = checked((ulong)pitch * attribute.Height * bytesPerPixel);
+        if (byteCount == 0 || byteCount > 256UL * 1024UL * 1024UL)
+        {
+            return false;
+        }
+
+        var bytes = new byte[(int)byteCount];
+        if (!ctx.Memory.TryRead(address, bytes))
+        {
+            return false;
+        }
+
+        var fingerprint = ComputeFingerprint(bytes);
+        var fingerprintKey = (handle, bufferIndex, address);
+        lock (_frameDumpGate)
+        {
+            if ((_lastFrameFingerprints.TryGetValue(fingerprintKey, out var previousFingerprint) &&
+                 previousFingerprint == fingerprint) ||
+                _frameDumpCount >= MaxFrameDumps)
+            {
+                return false;
+            }
+
+            _lastFrameFingerprints[fingerprintKey] = fingerprint;
+            _frameDumpCount++;
+        }
+
+        var frameIndex = Interlocked.Increment(ref _nextFrameDumpIndex);
+        var basePath = GetFrameDumpBasePath(frameIndex, handle, bufferIndex);
+        File.WriteAllBytes(basePath + ".raw", bytes);
+        WriteFrameMetadata(basePath + ".txt", address, attribute, bufferIndex, flipMode, flipArg, reason, fingerprint);
+        TraceVideoOut($"videoout.dump_frame path={basePath}.raw addr=0x{address:X16} bytes={byteCount} reason={reason} fingerprint=0x{fingerprint:X16}");
+        return true;
+    }
+
+    private static ulong ComputeFingerprint(ReadOnlySpan<byte> bytes)
+    {
+        const ulong fnvOffsetBasis = 14695981039346656037UL;
+        const ulong fnvPrime = 1099511628211UL;
+        var fingerprint = fnvOffsetBasis;
+        foreach (var value in bytes)
+        {
+            fingerprint = (fingerprint ^ value) * fnvPrime;
+        }
+
+        return fingerprint;
+    }
+
+    private static uint GetBytesPerPixel(ulong pixelFormat) =>
+        pixelFormat is SceVideoOutPixelFormatA8R8G8B8Srgb or
+            SceVideoOutPixelFormatA8B8G8R8Srgb or
+            SceVideoOutPixelFormatA2R10G10B10 or
+            SceVideoOutPixelFormatA2R10G10B10Srgb or
+            SceVideoOutPixelFormatA2R10G10B10Bt2020Pq
+            ? 4u
+            : 0u;
+
+    private static ulong NormalizePixelFormat(ulong pixelFormat)
+    {
+        if (GetBytesPerPixel(pixelFormat) != 0)
+        {
+            return pixelFormat;
+        }
+
+        var low = (uint)(pixelFormat & 0xFFFF_FFFFUL);
+        if (GetBytesPerPixel(low) != 0)
+        {
+            return low;
+        }
+
+        var high = (uint)(pixelFormat >> 32);
+        if (GetBytesPerPixel(high) != 0)
+        {
+            return high;
+        }
+
+        var packed = high | (low >> 16);
+        return GetBytesPerPixel(packed) != 0 ? packed : pixelFormat;
+    }
+
+    private static void ConvertRowToRgb(ReadOnlySpan<byte> source, Span<byte> destination, ulong pixelFormat)
+    {
+        var dst = 0;
+        for (var src = 0; src + 3 < source.Length; src += 4)
+        {
+            if (pixelFormat == SceVideoOutPixelFormatA8B8G8R8Srgb)
+            {
+                destination[dst++] = source[src + 0];
+                destination[dst++] = source[src + 1];
+                destination[dst++] = source[src + 2];
+            }
+            else if (pixelFormat is SceVideoOutPixelFormatA2R10G10B10 or SceVideoOutPixelFormatA2R10G10B10Srgb or SceVideoOutPixelFormatA2R10G10B10Bt2020Pq)
+            {
+                var value = BinaryPrimitives.ReadUInt32LittleEndian(source[src..(src + 4)]);
+                destination[dst++] = (byte)(((value >> 20) & 0x3FF) >> 2);
+                destination[dst++] = (byte)(((value >> 10) & 0x3FF) >> 2);
+                destination[dst++] = (byte)((value & 0x3FF) >> 2);
+            }
+            else
+            {
+                destination[dst++] = source[src + 2];
+                destination[dst++] = source[src + 1];
+                destination[dst++] = source[src + 0];
+            }
+        }
+    }
+
+    private static string GetFrameDumpBasePath(long frameIndex, int handle, int bufferIndex)
+    {
+        var directory = GetLogsDirectory();
+        Directory.CreateDirectory(directory);
+        return Path.Combine(directory, $"videoout_frame_{frameIndex:D4}_h{handle}_b{bufferIndex}");
+    }
+
+    private static string GetLogsDirectory()
+    {
+        var current = new DirectoryInfo(AppContext.BaseDirectory);
+        while (current is not null)
+        {
+            if (File.Exists(Path.Combine(current.FullName, "SharpEmu.slnx")))
+            {
+                return Path.Combine(current.FullName, "logs");
+            }
+
+            current = current.Parent;
+        }
+
+        return Path.Combine(Directory.GetCurrentDirectory(), "logs");
+    }
+
+    private static void WriteBmp(string path, uint width, uint height, byte[] rgb)
+    {
+        var rowStride = checked((int)(((width * 3u) + 3u) & ~3u));
+        var pixelBytes = checked(rowStride * (int)height);
+        var fileSize = 54 + pixelBytes;
+        using var stream = File.Create(path);
+        Span<byte> header = stackalloc byte[54];
+        header[0] = (byte)'B';
+        header[1] = (byte)'M';
+        BinaryPrimitives.WriteUInt32LittleEndian(header[0x02..], (uint)fileSize);
+        BinaryPrimitives.WriteUInt32LittleEndian(header[0x0A..], 54);
+        BinaryPrimitives.WriteUInt32LittleEndian(header[0x0E..], 40);
+        BinaryPrimitives.WriteInt32LittleEndian(header[0x12..], (int)width);
+        BinaryPrimitives.WriteInt32LittleEndian(header[0x16..], -(int)height);
+        BinaryPrimitives.WriteUInt16LittleEndian(header[0x1A..], 1);
+        BinaryPrimitives.WriteUInt16LittleEndian(header[0x1C..], 24);
+        BinaryPrimitives.WriteUInt32LittleEndian(header[0x22..], (uint)pixelBytes);
+        stream.Write(header);
+
+        var row = new byte[rowStride];
+        var sourceStride = (int)width * 3;
+        var heightInt = (int)height;
+        var widthInt = (int)width;
+        for (var y = 0; y < heightInt; y++)
+        {
+            row.AsSpan().Clear();
+            var src = rgb.AsSpan(y * sourceStride, sourceStride);
+            for (var x = 0; x < widthInt; x++)
+            {
+                row[(x * 3) + 0] = src[(x * 3) + 2];
+                row[(x * 3) + 1] = src[(x * 3) + 1];
+                row[(x * 3) + 2] = src[(x * 3) + 0];
+            }
+
+            stream.Write(row);
+        }
+    }
+
+    private static void WriteFrameMetadata(
+        string path,
+        ulong address,
+        BufferAttribute attribute,
+        int bufferIndex,
+        int flipMode,
+        long flipArg,
+        string kind,
+        ulong fingerprint)
+    {
+        File.WriteAllText(
+            path,
+            $"kind={kind}\naddress=0x{address:X16}\nbuffer_index={bufferIndex}\nflip_mode={flipMode}\nflip_arg={flipArg}\nfingerprint=0x{fingerprint:X16}\npixel_format=0x{attribute.PixelFormat:X}\ntiling_mode={attribute.TilingMode}\nwidth={attribute.Width}\nheight={attribute.Height}\npitch_in_pixel={attribute.PitchInPixel}\noption=0x{attribute.Option:X}\n");
+    }
+
     private static bool IsValidBufferRange(int startIndex, int bufferNum)
     {
         return startIndex >= 0 &&
@@ -393,6 +1088,17 @@ public static class VideoOutExports
         }
     }
 
+    private static VideoOutBufferSlot[] CreateBufferSlots()
+    {
+        var slots = new VideoOutBufferSlot[MaxDisplayBuffers];
+        for (var i = 0; i < slots.Length; i++)
+        {
+            slots[i] = new VideoOutBufferSlot();
+        }
+
+        return slots;
+    }
+
     private static bool TryReadStackUInt32(CpuContext ctx, int stackIndex, out uint value)
     {
         var address = ctx[CpuRegister.Rsp] + 0x08 + ((ulong)stackIndex * 0x08);
@@ -406,4 +1112,40 @@ public static class VideoOutExports
         value = BinaryPrimitives.ReadUInt32LittleEndian(buffer);
         return true;
     }
+
+    private static bool TryReadUInt32(CpuContext ctx, ulong address, out uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadUInt32LittleEndian(buffer);
+        return true;
+    }
+
+    private static bool TryReadInt16(CpuContext ctx, ulong address, out short value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(short)];
+        if (!ctx.Memory.TryRead(address, buffer))
+        {
+            value = 0;
+            return false;
+        }
+
+        value = BinaryPrimitives.ReadInt16LittleEndian(buffer);
+        return true;
+    }
+
+    private static void TraceVideoOut(string message)
+    {
+        if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_VIDEOOUT"), "1", StringComparison.Ordinal))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine($"[LOADER][TRACE] {message}");
+    }
 }

src/SharpEmu.Libs/packages.lock.json

@@ -2,6 +2,91 @@
   "version": 2,
   "dependencies": {
     "net10.0": {
+      "Silk.NET.Vulkan": {
+        "type": "Direct",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "3/irtlSWXZ3eTi8N6nelI6L34NTB8ZJHpqVMNzZx2aX7Ek9YEQ34NoQW8/Tljrtmkg8KRhHW8hKTEzZaKV8PgA==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0"
+        }
+      },
+      "Silk.NET.Vulkan.Extensions.KHR": {
+        "type": "Direct",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "uRaf4j+SmH3DumjSSSUbFg33BnsGZUyXGj93O9NgGKZSJN3OTmNmQDxRew+/KiVLcgH6qzbto8aNGZ++j9GFWg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Vulkan": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing": {
+        "type": "Direct",
+        "requested": "[2.23.0, )",
+        "resolved": "2.23.0",
+        "contentHash": "OPNPmt/lRyUKVYrFLQXVxyATqD3MKLc1iY1oKx1/2GppgmZxVZPwN12tekrQ4C7408kgB1L5JD1Wnirqqeb2kg==",
+        "dependencies": {
+          "Silk.NET.Windowing.Common": "2.23.0",
+          "Silk.NET.Windowing.Glfw": "2.23.0"
+        }
+      },
+      "Microsoft.DotNet.PlatformAbstractions": {
+        "type": "Transitive",
+        "resolved": "3.1.6",
+        "contentHash": "jek4XYaQ/PGUwDKKhwR8K47Uh1189PFzMeLqO83mXrXQVIpARZCcfuDedH50YDTepBkfijCZN5U/vZi++erxtg=="
+      },
+      "Microsoft.Extensions.DependencyModel": {
+        "type": "Transitive",
+        "resolved": "9.0.9",
+        "contentHash": "fNGvKct2De8ghm0Bpfq0iWthtzIWabgOTi+gJhNOPhNJIowXNEUE2eZNW/zNCzrHVA3PXg2yZ+3cWZndC2IqYA=="
+      },
+      "Silk.NET.Core": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "D7AT/nnwlB+4RZ84XY8QNGBZMJI5z9l4CSSETIJ1wCfRJzRt/341y3MRZ4HbnFz4r/IGaWOEZr86iE+0/65yyQ==",
+        "dependencies": {
+          "Microsoft.DotNet.PlatformAbstractions": "3.1.6",
+          "Microsoft.Extensions.DependencyModel": "9.0.9"
+        }
+      },
+      "Silk.NET.GLFW": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "UIs4sH57xlPUNHQ/1bt9rymPWlGy8IMDCNv86h0iM4TOA1CkIx0XM/n/tA4AReh1zQkNrvkxPEdZ3Blvy1dyXg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Ultz.Native.GLFW": "3.4.0"
+        }
+      },
+      "Silk.NET.Maths": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "r8PdIVzME8EH0qAgbmRPO87I4GfgR2j8TofT7EMuRJDf1QluoQwnVypDoFJjQ2ZBSRsGYk5unYxxogI05Ogsmw=="
+      },
+      "Silk.NET.Windowing.Common": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "ThStSinmY9KQI8DGiF5XEhkLJVnBcgRTBTzL9ijg1wMZAYuckz7ykrNw04fjRm2Gryh6tCNGbvz2XaY0efeFzg==",
+        "dependencies": {
+          "Silk.NET.Core": "2.23.0",
+          "Silk.NET.Maths": "2.23.0"
+        }
+      },
+      "Silk.NET.Windowing.Glfw": {
+        "type": "Transitive",
+        "resolved": "2.23.0",
+        "contentHash": "aYBudKmENmvLRn9p15HbdvlQTnnXskcDfTfbYwSb/4fr263rGLwYuDw/txUEc2jihHJiWCp5+75Y7z5wTJWl7g==",
+        "dependencies": {
+          "Silk.NET.GLFW": "2.23.0",
+          "Silk.NET.Windowing.Common": "2.23.0"
+        }
+      },
+      "Ultz.Native.GLFW": {
+        "type": "Transitive",
+        "resolved": "3.4.0",
+        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
+      },
       "sharpemu.hle": {
         "type": "Project"
       }