Cover Linux aligned mapping retention

* [Core] Add POSIX native execution and PS5 SELF support

Extend the native backend, guest TLS, fixed-address memory, and loader paths needed by PS5 titles on Windows, Linux, and macOS. Keep workstation GC so high-core-count hosts do not reserve over fixed guest image bases.

* [HLE] Expand PS5 service and media compatibility

Add the kernel, threading, save-data, networking, audio, video-codec, font, dialog, and service exports required by newer PS5 software. Preserve every SysAbi NID currently registered by main while adding the compatibility surface used by ASTRO BOT.

* [AGC/Vulkan] Extend Gen5 shader and presentation support

Expand PM4 handling, Gen5 shader translation, MRT and packed export support, guest image tracking, depth initialization, texture aliasing, and Vulkan presentation. Add the performance overlay and address-filtered diagnostics used to validate ASTRO BOT with original shaders.

* [Core] Align static TLS reservation across hosts

* [Pad] Align primary user ID with UserService

* [Gpu] Preserve runtime scalar buffers across renderer seam

* [AGC] Restore omitted command helper exports

* [Vulkan] Reuse primary views for promoted MRT targets

* [Vulkan] Preserve scratch storage bindings in compute dispatches

.github/workflows/pr-build-links.yml

@@ -0,0 +1,120 @@
+# Copyright (C) 2026 SharpEmu Emulator Project
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+# Posts (and keeps updated) a single PR comment linking the per-platform build
+# artifacts once "Build and Release" finishes.
+#
+# This is a workflow_run workflow on purpose: PRs from forks run "Build and
+# Release" with a read-only GITHUB_TOKEN and cannot comment. workflow_run runs
+# afterwards in the base-repo context with a read-write token and does not check
+# out untrusted fork code, so it can comment safely. Because of that, GitHub only
+# triggers it from the copy on the default branch — it does nothing until merged
+# to main.
+name: PR Build Links
+
+on:
+  workflow_run:
+    workflows: ["Build and Release"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  actions: read
+  pull-requests: write
+
+jobs:
+  comment:
+    name: Post artifact links
+    runs-on: ubuntu-latest
+    # Only for successful PR builds — artifacts exist only when the build passed.
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    steps:
+      - name: Post or update the artifact-links comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const run = context.payload.workflow_run;
+            const { owner, repo } = context.repo;
+
+            // Resolve the PR. Same-repo PRs are in workflow_run.pull_requests, but
+            // fork PRs leave it empty AND their head commit is not on a base-repo
+            // branch, so listPullRequestsAssociatedWithCommit misses them too. Match
+            // the open PR by its head "owner:branch" instead, which works for forks.
+            let prNumber;
+            if (run.pull_requests && run.pull_requests.length > 0) {
+              prNumber = run.pull_requests[0].number;
+            } else {
+              let candidates = [];
+              const headOwner = run.head_repository && run.head_repository.owner
+                ? run.head_repository.owner.login
+                : null;
+              if (headOwner && run.head_branch) {
+                const byHead = await github.rest.pulls.list({
+                  owner, repo, state: 'open',
+                  head: `${headOwner}:${run.head_branch}`, per_page: 10,
+                });
+                candidates = byHead.data;
+              }
+              if (candidates.length === 0) {
+                const byCommit = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                  owner, repo, commit_sha: run.head_sha,
+                });
+                candidates = byCommit.data.filter(pr => pr.state === 'open');
+              }
+              if (candidates.length === 0) {
+                core.info('No open PR for this build; nothing to comment.');
+                return;
+              }
+              prNumber = candidates[0].number;
+            }
+
+            // Collect the per-platform artifacts the build produced.
+            const artifacts = await github.paginate(
+              github.rest.actions.listWorkflowRunArtifacts,
+              { owner, repo, run_id: run.id, per_page: 100 },
+            );
+            const platforms = [
+              { key: 'win-x64', label: 'Windows (win-x64)' },
+              { key: 'linux-x64', label: 'Linux (linux-x64)' },
+              { key: 'osx-x64', label: 'macOS (osx-x64)' },
+            ];
+            const rows = [];
+            for (const platform of platforms) {
+              const artifact = artifacts.find(a => a.name.includes(platform.key));
+              if (!artifact) {
+                continue;
+              }
+              const url = `https://github.com/${owner}/${repo}/actions/runs/${run.id}/artifacts/${artifact.id}`;
+              rows.push(`| ${platform.label} | [\`${artifact.name}\`](${url}) |`);
+            }
+            if (rows.length === 0) {
+              core.info('No platform artifacts on this run; nothing to comment.');
+              return;
+            }
+
+            const marker = '<!-- pr-build-links -->';
+            const body = [
+              marker,
+              `### 📦 Build artifacts — \`${run.head_sha.substring(0, 7)}\``,
+              '',
+              '| Platform | Download |',
+              '| --- | --- |',
+              ...rows,
+              '',
+              `From [build run #${run.run_number}](${run.html_url}). ` +
+                'Downloads require a GitHub login and expire after 90 days.',
+            ].join('\n');
+
+            // Upsert one comment so repeated builds refresh it in place.
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner, repo, issue_number: prNumber, per_page: 100,
+            });
+            const existing = comments.find(c => c.body && c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number: prNumber, body });
+            }

.github/workflows/workflow.yml

@@ -34,29 +34,31 @@ jobs:
     name: Init
     runs-on: ubuntu-latest
     outputs:
-      archive-name: ${{ steps.vars.outputs.archive-name }}
-      artifact-name: ${{ steps.vars.outputs.artifact-name }}
       release-name: ${{ steps.vars.outputs.release-name }}
       release-tag: ${{ steps.vars.outputs.release-tag }}
+      safe-ref: ${{ steps.vars.outputs.safe-ref }}
       short-sha: ${{ steps.vars.outputs.short-sha }}
+      version: ${{ steps.vars.outputs.version }}
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
       - name: Compute workflow variables
         id: vars
         shell: bash
         run: |
           short_sha="${GITHUB_SHA::7}"
           safe_ref="$(echo "${GITHUB_REF_NAME}" | tr '[:upper:]' '[:lower:]' | sed 's#[^a-z0-9._-]#-#g')"
-          archive_name="sharpemu-win64-${short_sha}.zip"
-          artifact_name="sharpemu-win64-${short_sha}"
-          release_tag="win64-${safe_ref}-${short_sha}"
-          release_name="SharpEmu win64 ${short_sha}"
+          version="$(python3 -c 'import sys, xml.etree.ElementTree as ET; version = ET.parse("Directory.Build.props").getroot().findtext(".//SharpEmuVersion"); sys.exit("Directory.Build.props is missing SharpEmuVersion") if not version or not version.strip() else print(version.strip())')"
+          release_tag="v${version}"
+          release_name="SharpEmu v${version}"
 
           {
             echo "short-sha=${short_sha}"
-            echo "archive-name=${archive_name}"
-            echo "artifact-name=${artifact_name}"
+            echo "safe-ref=${safe_ref}"
             echo "release-tag=${release_tag}"
             echo "release-name=${release_name}"
+            echo "version=${version}"
           } >> "$GITHUB_OUTPUT"
 
   reuse:
@@ -92,14 +94,23 @@ jobs:
           cache: true
           cache-dependency-path: |
             Directory.Packages.props
-            src/**/packages.lock.json
+            Directory.Build.props
 
       - name: Restore solution
-        run: dotnet restore SharpEmu.slnx --locked-mode
+        run: dotnet restore SharpEmu.slnx
 
       - name: Build solution
         run: dotnet build SharpEmu.slnx -c Release --no-restore
 
+      # Runs every test project in the solution; a test failure fails the build, as
+      # does an aerolib.bin generation failure in the build step above (the MSBuild
+      # task logs an error and returns false).
+      - name: Run tests
+        run: dotnet test SharpEmu.slnx -c Release --no-build --verbosity normal
+
+      - name: Validate synthetic shaders
+        run: dotnet run --project tools/SharpEmu.Tools.ShaderDump/SharpEmu.Tools.ShaderDump.csproj -c Release -- artifacts/shader-dump
+
       - name: Publish win-x64 CLI
         run: dotnet publish src/SharpEmu.CLI/SharpEmu.CLI.csproj -c Release -r win-x64 --self-contained true --no-restore -p:PublishDir="${env:PUBLISH_DIR}"
 
@@ -107,7 +118,8 @@ jobs:
         run: |
           New-Item -ItemType Directory -Path $env:RELEASE_DIR -Force | Out-Null
 
-          $archivePath = Join-Path $env:RELEASE_DIR "${{ needs.init.outputs.archive-name }}"
+          $archiveName = "sharpemu-${{ needs.init.outputs.version }}-win-x64.zip"
+          $archivePath = Join-Path $env:RELEASE_DIR $archiveName
           if (Test-Path $archivePath) {
             Remove-Item $archivePath -Force
           }
@@ -117,8 +129,72 @@ jobs:
       - name: Upload build artifact
         uses: actions/upload-artifact@v7
         with:
-          name: ${{ needs.init.outputs.artifact-name }}
-          path: ${{ env.RELEASE_DIR }}\${{ needs.init.outputs.archive-name }}
+          name: sharpemu-win-x64-${{ needs.init.outputs.short-sha }}
+          path: ${{ env.RELEASE_DIR }}\sharpemu-${{ needs.init.outputs.version }}-win-x64.zip
+          if-no-files-found: error
+
+  build-posix:
+    name: Build ${{ matrix.rid }}
+    needs:
+      - init
+      - reuse
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            rid: linux-x64
+          - os: macos-latest
+            rid: osx-x64
+    env:
+      DOTNET_NOLOGO: true
+      NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
+      PUBLISH_DIR: ${{ github.workspace }}/artifacts/publish/${{ matrix.rid }}
+      RELEASE_DIR: ${{ github.workspace }}/artifacts/release
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup .NET SDK
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: 10.0.103
+          cache: true
+          cache-dependency-path: |
+            Directory.Packages.props
+            Directory.Build.props
+
+      - name: Restore solution
+        run: dotnet restore SharpEmu.slnx
+
+      - name: Build solution
+        run: dotnet build SharpEmu.slnx -c Release --no-restore
+
+      # Also runs on Linux/macOS: the aerolib.bin MSBuild task does platform-sensitive
+      # path handling, so a cross-platform generation regression surfaces here.
+      - name: Run tests
+        run: dotnet test SharpEmu.slnx -c Release --no-build --verbosity normal
+
+      - name: Publish ${{ matrix.rid }} CLI
+        run: dotnet publish src/SharpEmu.CLI/SharpEmu.CLI.csproj -c Release -r ${{ matrix.rid }} --self-contained true --no-restore -p:PublishDir="$PUBLISH_DIR"
+
+      - name: Stage MoltenVK next to the build
+        if: matrix.rid == 'osx-x64'
+        run: scripts/fetch-macos-moltenvk.sh "$PUBLISH_DIR"
+
+      - name: Create release archive
+        run: |
+          mkdir -p "$RELEASE_DIR"
+          # tar keeps the executable bit, which zip would drop.
+          tar -czf "$RELEASE_DIR/sharpemu-${{ needs.init.outputs.version }}-${{ matrix.rid }}.tar.gz" \
+            -C "$PUBLISH_DIR" .
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: sharpemu-${{ matrix.rid }}-${{ needs.init.outputs.short-sha }}
+          path: ${{ env.RELEASE_DIR }}/sharpemu-${{ needs.init.outputs.version }}-${{ matrix.rid }}.tar.gz
           if-no-files-found: error
 
   release:
@@ -126,35 +202,55 @@ jobs:
     needs:
       - init
       - build
+      - build-posix
     if: github.event_name == 'workflow_dispatch' || (github.event_name == 'push' && github.ref == 'refs/heads/main')
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
-      - name: Download build artifact
+      - name: Download build artifacts
         uses: actions/download-artifact@v8
         with:
-          name: ${{ needs.init.outputs.artifact-name }}
           path: release
 
       - name: Create or update release
         shell: bash
         env:
-          ARCHIVE_NAME: ${{ needs.init.outputs.archive-name }}
           GH_REPO: ${{ github.repository }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_NAME: ${{ needs.init.outputs.release-name }}
           RELEASE_TAG: ${{ needs.init.outputs.release-tag }}
+          VERSION: ${{ needs.init.outputs.version }}
         run: |
-          asset_path="release/${ARCHIVE_NAME}"
-          notes="Automated Windows build for commit ${GITHUB_SHA}."
+          mapfile -t assets < <(find release -type f \( -name '*.zip' -o -name '*.tar.gz' \) | sort)
+          if [ "${#assets[@]}" -eq 0 ]; then
+            echo "No release assets found." >&2
+            exit 1
+          fi
+
+          notes="Automated SharpEmu v${VERSION} build for commit ${GITHUB_SHA}."
 
           if gh release view "${RELEASE_TAG}" >/dev/null 2>&1; then
-            gh release upload "${RELEASE_TAG}" "${asset_path}" --clobber
+            gh release upload "${RELEASE_TAG}" "${assets[@]}" --clobber
             gh release edit "${RELEASE_TAG}" --title "${RELEASE_NAME}" --notes "${notes}"
           else
-            gh release create "${RELEASE_TAG}" "${asset_path}" \
+            gh release create "${RELEASE_TAG}" "${assets[@]}" \
               --title "${RELEASE_NAME}" \
               --notes "${notes}" \
               --target "${GITHUB_SHA}"
           fi
+
+          keep=()
+          for asset_path in "${assets[@]}"; do
+            keep+=("$(basename "${asset_path}")")
+          done
+          mapfile -t release_assets < <(gh release view "${RELEASE_TAG}" --json assets --jq '.assets[].name' | sort)
+          for asset in "${release_assets[@]}"; do
+            case "${asset}" in
+              sharpemu-${VERSION}-*.zip|sharpemu-${VERSION}-*.tar.gz)
+                if ! printf '%s\n' "${keep[@]}" | grep -Fxq "${asset}"; then
+                  gh release delete-asset "${RELEASE_TAG}" "${asset}" --yes
+                fi
+                ;;
+            esac
+          done

Directory.Build.props

@@ -9,7 +9,8 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
+    <SharpEmuVersion>0.0.1</SharpEmuVersion>
+    <Version>$(SharpEmuVersion)</Version>
 
     <RepoRoot>$([MSBuild]::NormalizeDirectory('$(MSBuildThisFileDirectory)'))</RepoRoot>
 

Directory.Packages.props

@@ -12,11 +12,18 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <PackageVersion Include="Avalonia.Fonts.Inter" Version="11.3.18" />
     <PackageVersion Include="Avalonia.Themes.Fluent" Version="11.3.18" />
     <PackageVersion Include="Iced" Version="1.21.0" />
+    <PackageVersion Include="Microsoft.Build.Framework" Version="17.14.8" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="3.11.0" />
+    <PackageVersion Include="Microsoft.CodeAnalysis.CSharp" Version="4.12.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
+    <PackageVersion Include="Silk.NET.Input" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.EXT" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Vulkan.Extensions.KHR" Version="2.23.0" />
     <PackageVersion Include="Silk.NET.Windowing" Version="2.23.0" />
     <!-- Transitive of Avalonia.Desktop; pinned to fix GHSA-xrw6-gwf8-vvr9 -->
     <PackageVersion Include="Tmds.DBus.Protocol" Version="0.21.3" />
+    <PackageVersion Include="xunit" Version="2.9.3" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="3.1.1" />
   </ItemGroup>
-</Project>
+</Project>

README.md

@@ -23,10 +23,11 @@ SPDX-License-Identifier: GPL-2.0-or-later
   <strong>Join our Discord for development updates, compatibility discussions, support, and community chat.</strong>
 </p>
 
----
-
-> [!WARNING]  
-> Currently the primary development target is Windows.
+---
+
+> [!NOTE]  
+> SharpEmu supports Windows x64, Linux x64, and macOS x64. Apple Silicon Macs
+> can run the macOS x64 build through Rosetta 2.
 
 > [!WARNING]  
 > SharpEmu is an experimental PS5 emulator developed from scratch in C#. The current focus is on accuracy and infrastructure setup rather than game-specific compatibility.
@@ -59,30 +60,49 @@ Current capabilities include:
 
 Some games have reached like `sceVideoOut` and AGC stages.
 
-Currently the project primarily targets Windows. Cross-platform support (Linux and macOS) is planned, but development is currently focused on Windows to simplify early-stage debugging and iteration.
-
-## Using
-
-* Build or Publish project or download in release tab.
-* Open Powershell.
-  * Run Emulator GUI.
-  * Or command: `.\SharpEmu "eboot.bin" 2>&1 | Tee-Object -FilePath "log.txt"`
+SharpEmu supports Windows, Linux, and macOS hosts. Video output uses Vulkan on
+Windows and Linux, and MoltenVK on macOS. Platform support is still experimental,
+so compatibility and performance vary by game, operating system, and GPU driver.
+
+## Using
+
+Download the release archive for your operating system, extract it, and launch
+SharpEmu with the path to a legally obtained game's `eboot.bin`.
+
+Windows PowerShell:
+
+```powershell
+.\SharpEmu.exe "C:\path\to\game\eboot.bin" 2>&1 |
+  Tee-Object -FilePath "SharpEmu.log"
+```
+
+Linux and macOS:
+
+```bash
+chmod +x ./SharpEmu
+
+./SharpEmu "/path/to/game/eboot.bin" 2>&1 |
+  tee SharpEmu.log
+```
+
+A Vulkan-capable GPU and current graphics driver are required. The macOS
+release includes the MoltenVK Vulkan implementation.
 
 ## Games Tested
 
 * **Demon's Souls Remake**
-  * [Demon's Souls [PPSA01341]](https://github.com/par274/sharpemu/issues/2)
+  * [Demon's Souls [PPSA01341]](https://github.com/sharpemu/sharpemu/issues/2)
   * Demon's Souls is now video loop. Shaders are ready to be converted to SPIR-V/Vulkan. We are continuing our work on this.
   ![DeS videoOut submit first frame](./.github/images/des-videoout-shaders.jpg)
 
 * **Poppy Playtime Chapter 1**
-  * [Poppy Playtime Chapter 1 [PPSA20591]](https://github.com/par274/sharpemu/issues/3)
+  * [Poppy Playtime Chapter 1 [PPSA20591]](https://github.com/sharpemu/sharpemu/issues/3)
 
 * **SILENT HILL: The Short Message**
-  * [SILENT HILL: The Short Message [PPSA10112]](https://github.com/par274/sharpemu/issues/4)
+  * [SILENT HILL: The Short Message [PPSA10112]](https://github.com/sharpemu/sharpemu/issues/4)
 
 * **Dreaming Sarah**
-  * [Dreaming Sarah [PPSA02929]](https://github.com/par274/sharpemu/issues/9)
+  * [Dreaming Sarah [PPSA02929]](https://github.com/sharpemu/sharpemu/issues/9)
   * Real texture rendering for this game;
   ![Splash texture](./.github/images/dreaming-sarah.jpg)
 
@@ -94,8 +114,8 @@ Currently the project primarily targets Windows. Cross-platform support (Linux a
 
 ## Build
 
-1. Install the **.NET SDK**.
-2. Clone the repository: `git clone https://github.com/par274/sharpemu.git`
+1. Install the .NET SDK version specified in [`global.json`](./global.json).
+2. Clone the repository: `git clone https://github.com/sharpemu/sharpemu.git`
 3. Open the solution file (`SharpEmu.slnx`) in **VSCode**.
 4. Build the project: `dotnet build` or `dotnet publish`
 5. Build artifacts will be located in the `artifacts` directory.
@@ -121,7 +141,7 @@ Provided valuable references for filesystem handling and low-level C# implementa
 
 # License
 
-- [**GPL-2.0 license**](https://github.com/par274/sharpemu/blob/main/LICENSE)
+- [**GPL-2.0 license**](https://github.com/sharpemu/sharpemu/blob/main/LICENSE)
 
 ## Contributing
 

REUSE.toml

@@ -5,9 +5,7 @@ path = [
     "REUSE.toml",
     "nuget.config",
     "global.json",
-    "**/packages.lock.json",
     "scripts/ps5_names.txt",
-    "src/SharpEmu.HLE/Aerolib/aerolib.bin",
     "src/SharpEmu.GUI/Languages/**",
     "_logs/**",
     ".github/images/**",

SharpEmu.slnx

@@ -11,5 +11,12 @@ SPDX-License-Identifier: GPL-2.0-or-later
     <Project Path="src/SharpEmu.HLE/SharpEmu.HLE.csproj" />
     <Project Path="src/SharpEmu.Libs/SharpEmu.Libs.csproj" />
     <Project Path="src/SharpEmu.Logging/SharpEmu.Logging.csproj" />
+    <Project Path="src/SharpEmu.ShaderCompiler/SharpEmu.ShaderCompiler.csproj" />
+    <Project Path="src/SharpEmu.ShaderCompiler.Vulkan/SharpEmu.ShaderCompiler.Vulkan.csproj" />
+    <Project Path="src/SharpEmu.SourceGenerators/SharpEmu.SourceGenerators.csproj" />
+  </Folder>
+  <Folder Name="/tests/">
+    <Project Path="tests/SharpEmu.Libs.Tests/SharpEmu.Libs.Tests.csproj" />
+    <Project Path="tests/SharpEmu.SourceGenerators.Tests/SharpEmu.SourceGenerators.Tests.csproj" />
   </Folder>
 </Solution>

docs/bink2-bridge.md

@@ -0,0 +1,46 @@
+<!--
+Copyright (C) 2026 SharpEmu Emulator Project
+SPDX-License-Identifier: GPL-2.0-or-later
+-->
+
+# Bink 2 bridge
+
+Demon's Souls plays Bink 2 (.bk2) files through a Bink implementation linked
+directly into eboot.bin. It does not use libSceVideodec, therefore an HLE video
+decoder cannot observe or replace those frames.
+
+SharpEmu observes successful guest .bk2 opens and, when a Bink bridge is
+available, presents its decoded BGRA frames at the normal guest-flip boundary.
+This preserves the game's own timing and lets the host Vulkan presenter display
+the movie without trying to execute the PS5-specific Bink GPU decode path.
+
+Without an adapter, Bink movies are skipped by default: their open call returns
+not-found so games that mark cinematics as optional progress to their next
+state instead of waiting on an empty Bink GPU texture.
+
+Set SHARPEMU_BINK_MODE=dummy to retain the open and show a built-in,
+non-decoded placeholder frame. This requires no SDK, but is a visual diagnostic
+only; it does not decode the movie or alter its game logic. Set
+SHARPEMU_BINK_MODE=native to force native bridge mode.
+
+## Supplying the adapter
+
+Bink 2 is proprietary. Obtain a compatible Mac Bink 2 SDK from RAD Game Tools,
+then compile sharpemu_bink2_bridge.c against the SDK's bink.h and Mac library.
+The adapter deliberately contains only a three-function C ABI so the managed
+emulator never depends on RAD's private binary ABI.
+
+Place the resulting libsharpemu_bink2_bridge.dylib next to the SharpEmu
+executable, or point to it explicitly:
+
+    SHARPEMU_BINK2_BRIDGE=/absolute/path/libsharpemu_bink2_bridge.dylib \
+      ./SharpEmu /path/to/eboot.bin
+
+The expected exports are sharpemu_bink2_open_utf8,
+sharpemu_bink2_decode_next_bgra, and sharpemu_bink2_close. The supplied
+adapter opens one movie, exposes BGRA pixels, and advances after each decoded
+frame. The managed side validates dimensions and retains ownership of the
+destination buffer.
+
+If the bridge is absent in native mode, SharpEmu logs one informational line
+and retains the existing guest rendering path.

native/bink2-bridge/sharpemu_bink2_bridge.c

@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2026 SharpEmu Emulator Project
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Build this small adapter with a licensed RAD Bink 2 SDK. The SDK and its
+ * headers are not distributed by SharpEmu. See docs/bink2-bridge.md.
+ */
+
+#include <stdint.h>
+#include "bink.h"
+
+typedef struct sharpemu_bink2_info {
+  uint32_t width;
+  uint32_t height;
+  uint32_t frames_per_second_numerator;
+  uint32_t frames_per_second_denominator;
+} sharpemu_bink2_info;
+
+int sharpemu_bink2_open_utf8(const char *path, HBINK *movie, sharpemu_bink2_info *info) {
+  HBINK bink;
+  if (!path || !movie || !info) return 0;
+
+  bink = BinkOpen(path, 0);
+  if (!bink) return 0;
+
+  *movie = bink;
+  info->width = bink->Width;
+  info->height = bink->Height;
+  info->frames_per_second_numerator = bink->FrameRate;
+  info->frames_per_second_denominator = bink->FrameRateDiv;
+  return 1;
+}
+
+int sharpemu_bink2_decode_next_bgra(HBINK movie, uint8_t *destination,
+                                    uint32_t stride, uint32_t destination_bytes) {
+  uint64_t needed;
+  if (!movie || !destination || stride < movie->Width * 4) return 0;
+  needed = (uint64_t)stride * movie->Height;
+  if (needed > destination_bytes) return 0;
+
+  /* Async Bink I/O has not filled the next frame yet; retry on the next host present. */
+  if (BinkWait(movie)) return 0;
+  BinkDoFrame(movie);
+  BinkCopyToBuffer(movie, destination, stride, movie->Height, 0, 0, BINKSURFACE32RA);
+  BinkNextFrame(movie);
+  return 1;
+}
+
+void sharpemu_bink2_close(HBINK movie) {
+  if (movie) BinkClose(movie);
+}

scripts/fetch-macos-moltenvk.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Copyright (C) 2026 SharpEmu Emulator Project
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Downloads the official (universal x86_64+arm64) MoltenVK dylib and stages
+# it next to a SharpEmu build as libvulkan.1.dylib. The macOS build runs as
+# an x86-64 process under Rosetta 2, so Homebrew's arm64-only Vulkan
+# libraries cannot be used; the presenter looks for this app-local copy.
+#
+# Usage: scripts/fetch-macos-moltenvk.sh [output-dir]
+#        (default output: artifacts/bin/Debug/net10.0/osx-x64)
+set -euo pipefail
+
+MVK_VERSION="${MVK_VERSION:-v1.4.0}"
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OUT_DIR="${1:-$REPO_ROOT/artifacts/bin/Debug/net10.0/osx-x64}"
+
+if [[ ! -d "$OUT_DIR" ]]; then
+  echo "output directory does not exist: $OUT_DIR (build first?)" >&2
+  exit 2
+fi
+
+WORK_DIR="$(mktemp -d)"
+trap 'rm -rf "$WORK_DIR"' EXIT
+
+echo ">> Downloading MoltenVK $MVK_VERSION..."
+curl -sL -o "$WORK_DIR/mvk.tar" \
+  "https://github.com/KhronosGroup/MoltenVK/releases/download/$MVK_VERSION/MoltenVK-macos.tar"
+tar -xf "$WORK_DIR/mvk.tar" -C "$WORK_DIR" \
+  MoltenVK/MoltenVK/dynamic/dylib/macOS/libMoltenVK.dylib
+
+DYLIB="$WORK_DIR/MoltenVK/MoltenVK/dynamic/dylib/macOS/libMoltenVK.dylib"
+file "$DYLIB" | grep -q x86_64 || { echo "downloaded dylib lacks x86_64 slice" >&2; exit 3; }
+
+cp "$DYLIB" "$OUT_DIR/libMoltenVK.dylib"
+cp "$DYLIB" "$OUT_DIR/libvulkan.1.dylib"
+echo ">> Staged libMoltenVK.dylib + libvulkan.1.dylib in $OUT_DIR"

scripts/generate_aerolib_binary.py

@@ -1,54 +0,0 @@
-# Copyright (C) 2026 SharpEmu Emulator Project
-# SPDX-License-Identifier: GPL-2.0-or-later
-
-#!/usr/bin/env python3
-
-import hashlib
-import struct
-from base64 import b64encode as base64enc
-from binascii import unhexlify as uhx
-from pathlib import Path
-
-NAMES = 'scripts/ps5_names.txt'
-OUTPUT = 'src/SharpEmu.HLE/Aerolib/aerolib.bin'
-
-def name2nid(name):
-    symbol = hashlib.sha1(name.encode() + uhx('518D64A635DED8C1E6B039B1C3E55230')).digest()
-    id_val = struct.unpack('<Q', symbol[:8])[0]
-    nid = base64enc(uhx('%016x' % id_val), b'+-').rstrip(b'=')
-    return nid.decode('utf-8')
-
-def generate():
-    names_path = Path(NAMES)
-    output_path = Path(OUTPUT)
-
-    entries = []
-    with open(names_path, 'r', encoding='utf-8') as f:
-        for line in f:
-            name = line.strip()
-            if name:
-                nid = name2nid(name)
-                entries.append((nid, name))
-
-    print(f"Found {len(entries)} entries")
-
-    data = bytearray()
-    data.extend(struct.pack('<I', len(entries)))
-
-    for nid, name in entries:
-        nid_bytes = nid.encode('utf-8')
-        name_bytes = name.encode('utf-8')
-        data.append(len(nid_bytes))
-        data.extend(nid_bytes)
-        data.extend(struct.pack('<H', len(name_bytes)))
-        data.extend(name_bytes)
-
-    output_path.parent.mkdir(parents=True, exist_ok=True)
-    with open(output_path, 'wb') as f:
-        f.write(data)
-
-    print(f"Generated: {output_path} ({len(data):,} bytes)")
-    print(f"Total entries: {len(entries)}")
-
-if __name__ == "__main__":
-    generate()

scripts/ps5_names.txt

@@ -154449,3 +154449,9 @@ vector_str_substr
 WTFAnnotateBenignRaceSized
 WTFAnnotateHappensAfter
 WTFAnnotateHappensBefore
+_sceUlobjmgrRegisterObject
+_sceUlobjmgrUnregisterObject
+sceNpEAAccessInitialize
+sceNpEAAccessTerminate
+sceNpHasEAAccessSubscription
+sceNpHasEAAccessSubscriptionAbortRequest

scripts/test-linux-docker.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Copyright (C) 2026 SharpEmu Emulator Project
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Smoke-tests the linux-x64 build inside an amd64 container. Useful from any
+# host (including Apple Silicon, where Docker runs the amd64 image under
+# emulation) to confirm the cross-platform layer keeps working on Linux.
+#
+# Usage: scripts/test-linux-docker.sh /path/to/eboot.bin
+set -euo pipefail
+
+GAME_PATH="${1:-}"
+if [[ -z "$GAME_PATH" || ! -f "$GAME_PATH" ]]; then
+  echo "usage: $0 <path-to-eboot.bin>" >&2
+  exit 2
+fi
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+GAME_DIR="$(cd "$(dirname "$GAME_PATH")" && pwd)"
+GAME_FILE="$(basename "$GAME_PATH")"
+PUBLISH_DIR="$REPO_ROOT/artifacts/publish/SharpEmu.CLI/Debug/net10.0/linux-x64"
+
+echo ">> Publishing linux-x64 self-contained build..."
+dotnet publish "$REPO_ROOT/src/SharpEmu.CLI" \
+  -c Debug -r linux-x64 --self-contained -p:PublishSingleFile=false
+
+echo ">> Running inside linux/amd64 container..."
+docker run --rm --platform linux/amd64 \
+  -v "$PUBLISH_DIR":/app:ro \
+  -v "$GAME_DIR":/game:ro \
+  mcr.microsoft.com/dotnet/runtime-deps:10.0 \
+  /app/SharpEmu --log-level=info "/game/$GAME_FILE"

src/SharpEmu.CLI/Program.cs

@@ -5,6 +5,7 @@ using SharpEmu.Core.Runtime;
 using SharpEmu.Core.Cpu;
 using SharpEmu.GUI;
 using SharpEmu.HLE;
+using SharpEmu.Libs.VideoOut;
 using SharpEmu.Logging;
 using System.Runtime.InteropServices;
 using System.Text;
@@ -44,6 +45,11 @@ internal static partial class Program
     [STAThread]
     private static int Main(string[] args)
     {
+        // Avoid blocking full collections while guest and render threads are
+        // running, and establish the GC mode before the runtime reserves the
+        // fixed guest address-space window.
+        System.Runtime.GCSettings.LatencyMode = System.Runtime.GCLatencyMode.SustainedLowLatency;
+
         try
         {
             return Run(args);
@@ -74,6 +80,142 @@ internal static partial class Program
             TryEnableConsoleFileMirror(earlyLogFilePath);
         }
 
+        if (!CheckHostArchitecture())
+        {
+            return 5;
+        }
+
+        if (OperatingSystem.IsMacOS() || OperatingSystem.IsLinux())
+        {
+            if (OperatingSystem.IsMacOS())
+            {
+                ConfigureMoltenVkDefaults();
+                PreloadMacVulkanLoader();
+            }
+
+            // GLFW requires window creation and event processing on the
+            // process main thread: AppKit demands it on macOS, and X11 has a
+            // single event queue that must be serviced from the main thread
+            // (a window created and polled off it may never map, which showed
+            // as a running game with no visible window on Linux). Emulation
+            // moves to a worker thread and the main thread services the window
+            // work the video presenter posts. Windows keeps a per-thread event
+            // queue, so its window stays on the presenter's own thread.
+            var exitCode = 0;
+            HostMainThread.Enable();
+            var emulation = new Thread(() =>
+            {
+                try
+                {
+                    exitCode = RunEmulator(args, isMitigatedChild);
+                }
+                finally
+                {
+                    HostMainThread.Shutdown();
+                }
+            }, 32 * 1024 * 1024)
+            {
+                Name = "SharpEmu Emulation",
+            };
+            emulation.Start();
+            HostMainThread.Pump();
+            emulation.Join();
+            return exitCode;
+        }
+
+        return RunEmulator(args, isMitigatedChild);
+    }
+
+    /// <summary>
+    /// The supported host execution model, checked before any emulation
+    /// starts: the CPU backend executes guest x86-64 code natively, so the
+    /// host process must be x86-64 — win-x64/linux-x64 on x64 hardware, or
+    /// osx-x64 under Rosetta 2 on Apple Silicon (Rosetta translates the
+    /// whole process, so it still reports as X64 here). An arm64 process
+    /// (e.g. the osx-arm64 build) can browse the GUI but cannot run games;
+    /// failing up front distinguishes that from MoltenVK, signal-handler,
+    /// or guest-memory startup problems.
+    /// </summary>
+    private static bool CheckHostArchitecture()
+    {
+        if (RuntimeInformation.ProcessArchitecture == Architecture.X64)
+        {
+            return true;
+        }
+
+        Console.Error.WriteLine(
+            $"[LOADER][ERROR] Unsupported process architecture " +
+            $"{RuntimeInformation.ProcessArchitecture}: guest code executes " +
+            "natively, so SharpEmu must run as an x86-64 process.");
+        if (OperatingSystem.IsMacOS())
+        {
+            Console.Error.WriteLine(
+                "[LOADER][ERROR] On Apple Silicon, use the osx-x64 build under " +
+                "Rosetta 2 (install with: softwareupdate --install-rosetta).");
+        }
+
+        return false;
+    }
+
+    /// <summary>
+    /// Applies MoltenVK performance defaults before the Vulkan loader is
+    /// loaded. Existing user-provided values always take precedence.
+    /// </summary>
+    private static void ConfigureMoltenVkDefaults()
+    {
+        try
+        {
+            _ = MacSetEnv("MVK_CONFIG_SYNCHRONOUS_QUEUE_SUBMITS", "0", 0);
+            _ = MacSetEnv("MVK_CONFIG_SHOULD_MAXIMIZE_CONCURRENT_COMPILATION", "1", 0);
+            _ = MacSetEnv("MVK_CONFIG_USE_METAL_ARGUMENT_BUFFERS", "1", 0);
+            _ = MacSetEnv("MVK_CONFIG_RESUME_LOST_DEVICE", "1", 0);
+        }
+        catch (Exception exception)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][WARN] Failed to set MoltenVK defaults: {exception.Message}");
+        }
+    }
+
+    /// <summary>
+    /// Makes a Vulkan loader visible to GLFW's dlopen("libvulkan.1.dylib").
+    /// Homebrew's Vulkan libraries are arm64-only and cannot load into this
+    /// x86-64 (Rosetta 2) process, so a universal libMoltenVK.dylib placed
+    /// next to the executable (named libvulkan.1.dylib) is preloaded here;
+    /// dyld then resolves GLFW's bare-name dlopen to the loaded image.
+    /// </summary>
+    private static void PreloadMacVulkanLoader()
+    {
+        var candidates = new[]
+        {
+            Path.Combine(AppContext.BaseDirectory, "libvulkan.1.dylib"),
+            Path.Combine(AppContext.BaseDirectory, "libMoltenVK.dylib"),
+            Path.Combine(
+                Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
+                ".sharpemu", "x64lib", "libvulkan.1.dylib"),
+        };
+        foreach (var candidate in candidates)
+        {
+            if (File.Exists(candidate) && NativeLibrary.TryLoad(candidate, out _))
+            {
+                Console.Error.WriteLine($"[LOADER][INFO] Vulkan loader preloaded: {candidate}");
+                return;
+            }
+        }
+
+        if (NativeLibrary.TryLoad("libvulkan.1.dylib", out _))
+        {
+            return;
+        }
+
+        Console.Error.WriteLine(
+            "[LOADER][WARN] No x86-64 Vulkan loader found; video output will be unavailable. " +
+            "Place a universal libMoltenVK.dylib (from the MoltenVK releases) next to SharpEmu " +
+            "as libvulkan.1.dylib.");
+    }
+
+    private static int RunEmulator(string[] args, bool isMitigatedChild)
+    {
         Console.Error.WriteLine($"[DEBUG] SharpEmu starting with {args.Length} args");
 
         if (!isMitigatedChild && TryRunMitigatedChild(args, out var childExitCode))
@@ -111,8 +253,16 @@ internal static partial class Program
         using var runtime = SharpEmuRuntime.CreateDefault(runtimeOptions);
 
         OrbisGen2Result result;
+        ConsoleCancelEventHandler? cancelHandler = null;
         try
         {
+            cancelHandler = (_, eventArgs) =>
+            {
+                eventArgs.Cancel = true;
+                VideoOutExports.NotifyHostInterrupt();
+            };
+            Console.CancelKeyPress += cancelHandler;
+
             Console.Error.WriteLine($"[DEBUG] Running: {ebootPath}");
             result = runtime.Run(ebootPath);
             Console.Error.WriteLine($"[DEBUG] Result: {result}");
@@ -123,6 +273,13 @@ internal static partial class Program
             Log.Error("SharpEmu failed to run.", ex);
             return 3;
         }
+        finally
+        {
+            if (cancelHandler is not null)
+            {
+                Console.CancelKeyPress -= cancelHandler;
+            }
+        }
 
         Log.Info($"SharpEmu execution completed. Result={result} (0x{(int)result:X8})");
         if (!string.IsNullOrWhiteSpace(runtime.LastSessionSummary))
@@ -1188,4 +1345,7 @@ internal static partial class Program
         uint creationDisposition,
         uint flagsAndAttributes,
         nint templateFile);
+
+    [DllImport("libSystem", EntryPoint = "setenv")]
+    private static extern int MacSetEnv(string name, string value, int overwrite);
 }

src/SharpEmu.CLI/SharpEmu.CLI.csproj

@@ -16,19 +16,34 @@ SPDX-License-Identifier: GPL-2.0-or-later
          console window; CLI mode re-attaches to the parent terminal's console. -->
     <OutputType>WinExe</OutputType>
     <AssemblyName>SharpEmu</AssemblyName>
-    <RuntimeIdentifiers>win-x64;linux-x64;osx-arm64</RuntimeIdentifiers>
+    <!-- osx-x64 is the macOS target: the CPU backend executes guest x86-64
+         natively, so on Apple Silicon it runs under Rosetta 2. -->
+    <RuntimeIdentifiers>win-x64;linux-x64;osx-x64;osx-arm64</RuntimeIdentifiers>
     <SelfContained>true</SelfContained>
     <PublishSingleFile>true</PublishSingleFile>
     <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
     <EnableCompressionInSingleFile>true</EnableCompressionInSingleFile>
     <ImplicitUsings>enable</ImplicitUsings>
     <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
-    <Version>0.0.1</Version>
-    <ServerGarbageCollection>true</ServerGarbageCollection>
+    <!-- Server GC reserves one large heap range per logical processor. On
+         high-core-count hosts those ranges can overlap fixed PS5 image bases
+         before the guest address space is established. Workstation GC avoids
+         that collision and keeps the emulator's required mappings available. -->
+    <ServerGarbageCollection>false</ServerGarbageCollection>
     <ConcurrentGarbageCollection>true</ConcurrentGarbageCollection>
     <TieredPGO>true</TieredPGO>
   </PropertyGroup>
 
+  <!-- Background GC's write-watch revisit calls FlushProcessWriteBuffers,
+       which on macOS uses thread_get_register_pointer_values; under Rosetta 2
+       that Mach call can stall indefinitely on threads executing translated
+       guest code, wedging the whole runtime (every allocating thread then
+       blocks behind the never-finishing GC). Non-concurrent GC never takes
+       that path. Windows and Linux keep concurrent GC. -->
+  <PropertyGroup Condition="$([System.String]::Copy('$(RuntimeIdentifier)').StartsWith('osx'))">
+    <ConcurrentGarbageCollection>false</ConcurrentGarbageCollection>
+  </PropertyGroup>
+
   <PropertyGroup Condition="'$(Configuration)' == 'Release'">
     <GenerateDocumentationFile>false</GenerateDocumentationFile>
     <DebugType>none</DebugType>
@@ -63,7 +78,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
   <Target Name="KeepGlfwOutsideSingleFile" AfterTargets="ComputeResolvedFilesToPublishList">
     <ItemGroup>
       <_GlfwPublishFiles Include="@(ResolvedFileToPublish)"
-                         Condition="$([System.String]::Copy('%(ResolvedFileToPublish.Filename)').StartsWith('glfw'))" />
+                         Condition="$([System.String]::Copy('%(ResolvedFileToPublish.Filename)').StartsWith('glfw')) Or $([System.String]::Copy('%(ResolvedFileToPublish.Filename)').StartsWith('libglfw'))" />
       <ResolvedFileToPublish Remove="@(_GlfwPublishFiles)" />
       <ResolvedFileToPublish Include="@(_GlfwPublishFiles)">
         <ExcludeFromSingleFile>true</ExcludeFromSingleFile>

src/SharpEmu.CLI/packages.lock.json

@@ -1,491 +0,0 @@
-{
-  "version": 2,
-  "dependencies": {
-    "net10.0": {
-      "Microsoft.NET.ILLink.Tasks": {
-        "type": "Direct",
-        "requested": "[10.0.3, )",
-        "resolved": "10.0.3",
-        "contentHash": "0B6nZyCHWXnvmlB559oduOspVdNOnpNXPjhpWVMovLPAsDVG7A4jJR9rzECf67JUzxP8/ee/wA8clwIzJcWNFA=="
-      },
-      "Avalonia.Angle.Windows.Natives": {
-        "type": "Transitive",
-        "resolved": "2.1.25547.20250602",
-        "contentHash": "ZL0VLc4s9rvNNFt19Pxm5UNAkmKNylugAwJPX9ulXZ6JWs/l6XZihPWWTyezaoNOVyEPU8YbURtW7XMAtqXH5A=="
-      },
-      "Avalonia.BuildServices": {
-        "type": "Transitive",
-        "resolved": "11.3.2",
-        "contentHash": "qHDToxto1e3hci5YqbG9n0Ty8mlp3zBUN5wT66wKqaDVzXyQ0do3EnRILd4Ke9jpvsktaPpgE0YjEk7hornryQ=="
-      },
-      "Avalonia.FreeDesktop": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "aUwv8BNruRUOaUfMu4U3uibIUS60/rSHgGOhd8zBkLkpxY3JFJvgRbeq5ZzHIyKXCuKi18PO00YHAgCarp3wdw==",
-        "dependencies": {
-          "Avalonia": "11.3.18",
-          "Tmds.DBus.Protocol": "0.21.3"
-        }
-      },
-      "Avalonia.Native": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "8g53DROFW6wVJAnTsE1Iu5bdZO5r0oqxbdbMQODs1QDYCK2IU/y/x/vQVKCYOvqxl4tXkzU9tExv8XqSGPWthQ==",
-        "dependencies": {
-          "Avalonia": "11.3.18"
-        }
-      },
-      "Avalonia.Remote.Protocol": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "vw+6ZfgTuu72dA9aVWn6u56t2nrBd5MoMU0wo/qI9XJAl/c0oYYphIvwLvJP1JorubQY4UE3d0ac8ULBhrGBiA=="
-      },
-      "Avalonia.Skia": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "/B4aXmNRNjG8I5U/a1xJI+bIi0XO6DDzS3mBrIKlVnJRY2CyZiUeESRQXLnIU77Z9TvqkUROs+D47s085YjFtA==",
-        "dependencies": {
-          "Avalonia": "11.3.18",
-          "HarfBuzzSharp": "8.3.1.1",
-          "HarfBuzzSharp.NativeAssets.Linux": "8.3.1.1",
-          "HarfBuzzSharp.NativeAssets.WebAssembly": "8.3.1.1",
-          "SkiaSharp": "2.88.9",
-          "SkiaSharp.NativeAssets.Linux": "2.88.9",
-          "SkiaSharp.NativeAssets.WebAssembly": "2.88.9"
-        }
-      },
-      "Avalonia.Win32": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "eioUHkM2PeLPETd1aEks3rvb9plbba6buIrNdrqCpwE/qgHKUjvRNBd5mUQfAbGgTLiAes524gB8uUMDhrsJVQ==",
-        "dependencies": {
-          "Avalonia": "11.3.18",
-          "Avalonia.Angle.Windows.Natives": "2.1.25547.20250602"
-        }
-      },
-      "Avalonia.X11": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "m4Ki/G5Dovnq+6QzfS0iGbK8V77Q6oTjToMLOB0CxPCCrl3Oxywh6kIjuGJDPaN6kopMmjxlNShyQf+vPYL+JA==",
-        "dependencies": {
-          "Avalonia": "11.3.18",
-          "Avalonia.FreeDesktop": "11.3.18",
-          "Avalonia.Skia": "11.3.18"
-        }
-      },
-      "HarfBuzzSharp": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "tLZN66oe/uiRPTZfrCU4i8ScVGwqHNh5MHrXj0yVf4l7Mz0FhTGnQ71RGySROTmdognAs0JtluHkL41pIabWuQ==",
-        "dependencies": {
-          "HarfBuzzSharp.NativeAssets.Win32": "8.3.1.1",
-          "HarfBuzzSharp.NativeAssets.macOS": "8.3.1.1"
-        }
-      },
-      "HarfBuzzSharp.NativeAssets.Linux": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "3EZ1mpIiKWRLL5hUYA82ZHteeDIVaEA/Z0rA/wU6tjx6crcAkJnBPwDXZugBSfo8+J3EznvRJf49uMsqYfKrHg=="
-      },
-      "HarfBuzzSharp.NativeAssets.macOS": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "jbtCsgftcaFLCA13tVKo5iWdElJScrulLTKJre36O4YQTIlwDtPPqhRZNk+Y0vv4D1gxbscasGRucUDfS44ofQ=="
-      },
-      "HarfBuzzSharp.NativeAssets.WebAssembly": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "loJweK2u/mH/3C2zBa0ggJlITIszOkK64HLAZB7FUT670dTg965whLFYHDQo69NmC4+d9UN0icLC9VHidXaVCA=="
-      },
-      "HarfBuzzSharp.NativeAssets.Win32": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "UsJtQsfAJoFDZrXc4hCUfRPMqccfKZ0iumJ/upcUjz/cmsTgVFGNEL5yaJWmkqsuFYdMWbj/En5/kS4PFl9hBA=="
-      },
-      "MicroCom.Runtime": {
-        "type": "Transitive",
-        "resolved": "0.11.0",
-        "contentHash": "MEnrZ3UIiH40hjzMDsxrTyi8dtqB5ziv3iBeeU4bXsL/7NLSal9F1lZKpK+tfBRnUoDSdtcW3KufE4yhATOMCA=="
-      },
-      "Microsoft.DotNet.PlatformAbstractions": {
-        "type": "Transitive",
-        "resolved": "3.1.6",
-        "contentHash": "jek4XYaQ/PGUwDKKhwR8K47Uh1189PFzMeLqO83mXrXQVIpARZCcfuDedH50YDTepBkfijCZN5U/vZi++erxtg=="
-      },
-      "Microsoft.Extensions.DependencyModel": {
-        "type": "Transitive",
-        "resolved": "9.0.9",
-        "contentHash": "fNGvKct2De8ghm0Bpfq0iWthtzIWabgOTi+gJhNOPhNJIowXNEUE2eZNW/zNCzrHVA3PXg2yZ+3cWZndC2IqYA=="
-      },
-      "Silk.NET.Core": {
-        "type": "Transitive",
-        "resolved": "2.23.0",
-        "contentHash": "D7AT/nnwlB+4RZ84XY8QNGBZMJI5z9l4CSSETIJ1wCfRJzRt/341y3MRZ4HbnFz4r/IGaWOEZr86iE+0/65yyQ==",
-        "dependencies": {
-          "Microsoft.DotNet.PlatformAbstractions": "3.1.6",
-          "Microsoft.Extensions.DependencyModel": "9.0.9"
-        }
-      },
-      "Silk.NET.GLFW": {
-        "type": "Transitive",
-        "resolved": "2.23.0",
-        "contentHash": "UIs4sH57xlPUNHQ/1bt9rymPWlGy8IMDCNv86h0iM4TOA1CkIx0XM/n/tA4AReh1zQkNrvkxPEdZ3Blvy1dyXg==",
-        "dependencies": {
-          "Silk.NET.Core": "2.23.0",
-          "Ultz.Native.GLFW": "3.4.0"
-        }
-      },
-      "Silk.NET.Maths": {
-        "type": "Transitive",
-        "resolved": "2.23.0",
-        "contentHash": "r8PdIVzME8EH0qAgbmRPO87I4GfgR2j8TofT7EMuRJDf1QluoQwnVypDoFJjQ2ZBSRsGYk5unYxxogI05Ogsmw=="
-      },
-      "Silk.NET.Windowing.Common": {
-        "type": "Transitive",
-        "resolved": "2.23.0",
-        "contentHash": "ThStSinmY9KQI8DGiF5XEhkLJVnBcgRTBTzL9ijg1wMZAYuckz7ykrNw04fjRm2Gryh6tCNGbvz2XaY0efeFzg==",
-        "dependencies": {
-          "Silk.NET.Core": "2.23.0",
-          "Silk.NET.Maths": "2.23.0"
-        }
-      },
-      "Silk.NET.Windowing.Glfw": {
-        "type": "Transitive",
-        "resolved": "2.23.0",
-        "contentHash": "aYBudKmENmvLRn9p15HbdvlQTnnXskcDfTfbYwSb/4fr263rGLwYuDw/txUEc2jihHJiWCp5+75Y7z5wTJWl7g==",
-        "dependencies": {
-          "Silk.NET.GLFW": "2.23.0",
-          "Silk.NET.Windowing.Common": "2.23.0"
-        }
-      },
-      "SkiaSharp": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "3MD5VHjXXieSHCleRLuaTXmL2pD0mB7CcOB1x2kA1I4bhptf4e3R27iM93264ZYuAq6mkUyX5XbcxnZvMJYc1Q==",
-        "dependencies": {
-          "SkiaSharp.NativeAssets.Win32": "2.88.9",
-          "SkiaSharp.NativeAssets.macOS": "2.88.9"
-        }
-      },
-      "SkiaSharp.NativeAssets.Linux": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "cWSaJKVPWAaT/WIn9c8T5uT/l4ETwHxNJTkEOtNKjphNo8AW6TF9O32aRkxqw3l8GUdUo66Bu7EiqtFh/XG0Zg==",
-        "dependencies": {
-          "SkiaSharp": "2.88.9"
-        }
-      },
-      "SkiaSharp.NativeAssets.macOS": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "Nv5spmKc4505Ep7oUoJ5vp3KweFpeNqxpyGDWyeEPTX2uR6S6syXIm3gj75dM0YJz7NPvcix48mR5laqs8dPuA=="
-      },
-      "SkiaSharp.NativeAssets.WebAssembly": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "kt06RccBHSnAs2wDYdBSfsjIDbY3EpsOVqnlDgKdgvyuRA8ZFDaHRdWNx1VHjGgYzmnFCGiTJBnXFl5BqGwGnA=="
-      },
-      "SkiaSharp.NativeAssets.Win32": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "wb2kYgU7iy84nQLYZwMeJXixvK++GoIuECjU4ECaUKNuflyRlJKyiRhN1MAHswvlvzuvkrjRWlK0Za6+kYQK7w=="
-      },
-      "Ultz.Native.GLFW": {
-        "type": "Transitive",
-        "resolved": "3.4.0",
-        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
-      },
-      "sharpemu.core": {
-        "type": "Project",
-        "dependencies": {
-          "Iced": "[1.21.0, )",
-          "SharpEmu.HLE": "[1.0.0, )",
-          "SharpEmu.Libs": "[1.0.0, )",
-          "SharpEmu.Logging": "[1.0.0, )"
-        }
-      },
-      "sharpemu.gui": {
-        "type": "Project",
-        "dependencies": {
-          "Avalonia": "[11.3.18, )",
-          "Avalonia.Desktop": "[11.3.18, )",
-          "Avalonia.Fonts.Inter": "[11.3.18, )",
-          "Avalonia.Themes.Fluent": "[11.3.18, )",
-          "SharpEmu.Logging": "[1.0.0, )",
-          "Tmds.DBus.Protocol": "[0.21.3, )"
-        }
-      },
-      "sharpemu.hle": {
-        "type": "Project",
-        "dependencies": {
-          "SharpEmu.Logging": "[1.0.0, )"
-        }
-      },
-      "sharpemu.libs": {
-        "type": "Project",
-        "dependencies": {
-          "SharpEmu.HLE": "[1.0.0, )",
-          "Silk.NET.Vulkan": "[2.23.0, )",
-          "Silk.NET.Vulkan.Extensions.EXT": "[2.23.0, )",
-          "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
-          "Silk.NET.Windowing": "[2.23.0, )"
-        }
-      },
-      "sharpemu.logging": {
-        "type": "Project"
-      },
-      "Avalonia": {
-        "type": "CentralTransitive",
-        "requested": "[11.3.18, )",
-        "resolved": "11.3.18",
-        "contentHash": "2C4UxhWUObWGgYKWic1x5BMMWGJP6SElb91WeOxs+X/iR26rtkqpxFFwwo50FXS9AyYnHfk8QKXDEfe7oT/kZA==",
-        "dependencies": {
-          "Avalonia.BuildServices": "11.3.2",
-          "Avalonia.Remote.Protocol": "11.3.18",
-          "MicroCom.Runtime": "0.11.0"
-        }
-      },
-      "Avalonia.Desktop": {
-        "type": "CentralTransitive",
-        "requested": "[11.3.18, )",
-        "resolved": "11.3.18",
-        "contentHash": "bilMPa5vYiis6fbNovb6esKytBnOCEGojBa1XFegLCRHCP6g6PvZwS0XF/YOAGkENRlHG8dI7lohOpQ9bIkq1g==",
-        "dependencies": {
-          "Avalonia": "11.3.18",
-          "Avalonia.Native": "11.3.18",
-          "Avalonia.Skia": "11.3.18",
-          "Avalonia.Win32": "11.3.18",
-          "Avalonia.X11": "11.3.18"
-        }
-      },
-      "Avalonia.Fonts.Inter": {
-        "type": "CentralTransitive",
-        "requested": "[11.3.18, )",
-        "resolved": "11.3.18",
-        "contentHash": "27u6hB3Y2Ue586yjfeVakberY73VNQXtuKwe/P927XG1QPlhsfmOyifLHDDpSHG85Zl1x/Xv9IZ3+tk9FnjcZQ==",
-        "dependencies": {
-          "Avalonia": "11.3.18"
-        }
-      },
-      "Avalonia.Themes.Fluent": {
-        "type": "CentralTransitive",
-        "requested": "[11.3.18, )",
-        "resolved": "11.3.18",
-        "contentHash": "+Q/TJoynD0zNuu5w2gD+xcTl7GNKJFxlPYAndRLs/mTDrNbbsvv/271WyIysbMPsXSjCyBDp7RCZzQkpD6x5Bg==",
-        "dependencies": {
-          "Avalonia": "11.3.18"
-        }
-      },
-      "Iced": {
-        "type": "CentralTransitive",
-        "requested": "[1.21.0, )",
-        "resolved": "1.21.0",
-        "contentHash": "dv5+81Q1TBQvVMSOOOmRcjJmvWcX3BZPZsIq31+RLc5cNft0IHAyNlkdb7ZarOWG913PyBoFDsDXoCIlKmLclg=="
-      },
-      "Silk.NET.Vulkan": {
-        "type": "CentralTransitive",
-        "requested": "[2.23.0, )",
-        "resolved": "2.23.0",
-        "contentHash": "3/irtlSWXZ3eTi8N6nelI6L34NTB8ZJHpqVMNzZx2aX7Ek9YEQ34NoQW8/Tljrtmkg8KRhHW8hKTEzZaKV8PgA==",
-        "dependencies": {
-          "Silk.NET.Core": "2.23.0"
-        }
-      },
-      "Silk.NET.Vulkan.Extensions.EXT": {
-        "type": "CentralTransitive",
-        "requested": "[2.23.0, )",
-        "resolved": "2.23.0",
-        "contentHash": "+Oth189ksRiL6HvGCwIdnsYHawqrbO8y49u1H61z3wsfcHhQZeVDYe/wF5LD7fk3NcdgDvwFD3mLm1QWhdZySw==",
-        "dependencies": {
-          "Silk.NET.Core": "2.23.0",
-          "Silk.NET.Vulkan": "2.23.0"
-        }
-      },
-      "Silk.NET.Vulkan.Extensions.KHR": {
-        "type": "CentralTransitive",
-        "requested": "[2.23.0, )",
-        "resolved": "2.23.0",
-        "contentHash": "uRaf4j+SmH3DumjSSSUbFg33BnsGZUyXGj93O9NgGKZSJN3OTmNmQDxRew+/KiVLcgH6qzbto8aNGZ++j9GFWg==",
-        "dependencies": {
-          "Silk.NET.Core": "2.23.0",
-          "Silk.NET.Vulkan": "2.23.0"
-        }
-      },
-      "Silk.NET.Windowing": {
-        "type": "CentralTransitive",
-        "requested": "[2.23.0, )",
-        "resolved": "2.23.0",
-        "contentHash": "OPNPmt/lRyUKVYrFLQXVxyATqD3MKLc1iY1oKx1/2GppgmZxVZPwN12tekrQ4C7408kgB1L5JD1Wnirqqeb2kg==",
-        "dependencies": {
-          "Silk.NET.Windowing.Common": "2.23.0",
-          "Silk.NET.Windowing.Glfw": "2.23.0"
-        }
-      },
-      "Tmds.DBus.Protocol": {
-        "type": "CentralTransitive",
-        "requested": "[0.21.3, )",
-        "resolved": "0.21.3",
-        "contentHash": "hDwB8WsQoyALQKqIbwzS68UKdlnafDm4T/DkO/JrA/YIneP/rKv96SxYPVXeh3FP4i/SXfShrYftKLtciJAIlw=="
-      }
-    },
-    "net10.0/linux-x64": {
-      "Avalonia.Angle.Windows.Natives": {
-        "type": "Transitive",
-        "resolved": "2.1.25547.20250602",
-        "contentHash": "ZL0VLc4s9rvNNFt19Pxm5UNAkmKNylugAwJPX9ulXZ6JWs/l6XZihPWWTyezaoNOVyEPU8YbURtW7XMAtqXH5A=="
-      },
-      "Avalonia.Native": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "8g53DROFW6wVJAnTsE1Iu5bdZO5r0oqxbdbMQODs1QDYCK2IU/y/x/vQVKCYOvqxl4tXkzU9tExv8XqSGPWthQ==",
-        "dependencies": {
-          "Avalonia": "11.3.18"
-        }
-      },
-      "HarfBuzzSharp.NativeAssets.Linux": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "3EZ1mpIiKWRLL5hUYA82ZHteeDIVaEA/Z0rA/wU6tjx6crcAkJnBPwDXZugBSfo8+J3EznvRJf49uMsqYfKrHg=="
-      },
-      "HarfBuzzSharp.NativeAssets.macOS": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "jbtCsgftcaFLCA13tVKo5iWdElJScrulLTKJre36O4YQTIlwDtPPqhRZNk+Y0vv4D1gxbscasGRucUDfS44ofQ=="
-      },
-      "HarfBuzzSharp.NativeAssets.Win32": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "UsJtQsfAJoFDZrXc4hCUfRPMqccfKZ0iumJ/upcUjz/cmsTgVFGNEL5yaJWmkqsuFYdMWbj/En5/kS4PFl9hBA=="
-      },
-      "SkiaSharp.NativeAssets.Linux": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "cWSaJKVPWAaT/WIn9c8T5uT/l4ETwHxNJTkEOtNKjphNo8AW6TF9O32aRkxqw3l8GUdUo66Bu7EiqtFh/XG0Zg==",
-        "dependencies": {
-          "SkiaSharp": "2.88.9"
-        }
-      },
-      "SkiaSharp.NativeAssets.macOS": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "Nv5spmKc4505Ep7oUoJ5vp3KweFpeNqxpyGDWyeEPTX2uR6S6syXIm3gj75dM0YJz7NPvcix48mR5laqs8dPuA=="
-      },
-      "SkiaSharp.NativeAssets.Win32": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "wb2kYgU7iy84nQLYZwMeJXixvK++GoIuECjU4ECaUKNuflyRlJKyiRhN1MAHswvlvzuvkrjRWlK0Za6+kYQK7w=="
-      },
-      "Ultz.Native.GLFW": {
-        "type": "Transitive",
-        "resolved": "3.4.0",
-        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
-      }
-    },
-    "net10.0/osx-arm64": {
-      "Avalonia.Angle.Windows.Natives": {
-        "type": "Transitive",
-        "resolved": "2.1.25547.20250602",
-        "contentHash": "ZL0VLc4s9rvNNFt19Pxm5UNAkmKNylugAwJPX9ulXZ6JWs/l6XZihPWWTyezaoNOVyEPU8YbURtW7XMAtqXH5A=="
-      },
-      "Avalonia.Native": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "8g53DROFW6wVJAnTsE1Iu5bdZO5r0oqxbdbMQODs1QDYCK2IU/y/x/vQVKCYOvqxl4tXkzU9tExv8XqSGPWthQ==",
-        "dependencies": {
-          "Avalonia": "11.3.18"
-        }
-      },
-      "HarfBuzzSharp.NativeAssets.Linux": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "3EZ1mpIiKWRLL5hUYA82ZHteeDIVaEA/Z0rA/wU6tjx6crcAkJnBPwDXZugBSfo8+J3EznvRJf49uMsqYfKrHg=="
-      },
-      "HarfBuzzSharp.NativeAssets.macOS": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "jbtCsgftcaFLCA13tVKo5iWdElJScrulLTKJre36O4YQTIlwDtPPqhRZNk+Y0vv4D1gxbscasGRucUDfS44ofQ=="
-      },
-      "HarfBuzzSharp.NativeAssets.Win32": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "UsJtQsfAJoFDZrXc4hCUfRPMqccfKZ0iumJ/upcUjz/cmsTgVFGNEL5yaJWmkqsuFYdMWbj/En5/kS4PFl9hBA=="
-      },
-      "SkiaSharp.NativeAssets.Linux": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "cWSaJKVPWAaT/WIn9c8T5uT/l4ETwHxNJTkEOtNKjphNo8AW6TF9O32aRkxqw3l8GUdUo66Bu7EiqtFh/XG0Zg==",
-        "dependencies": {
-          "SkiaSharp": "2.88.9"
-        }
-      },
-      "SkiaSharp.NativeAssets.macOS": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "Nv5spmKc4505Ep7oUoJ5vp3KweFpeNqxpyGDWyeEPTX2uR6S6syXIm3gj75dM0YJz7NPvcix48mR5laqs8dPuA=="
-      },
-      "SkiaSharp.NativeAssets.Win32": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "wb2kYgU7iy84nQLYZwMeJXixvK++GoIuECjU4ECaUKNuflyRlJKyiRhN1MAHswvlvzuvkrjRWlK0Za6+kYQK7w=="
-      },
-      "Ultz.Native.GLFW": {
-        "type": "Transitive",
-        "resolved": "3.4.0",
-        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
-      }
-    },
-    "net10.0/win-x64": {
-      "Avalonia.Angle.Windows.Natives": {
-        "type": "Transitive",
-        "resolved": "2.1.25547.20250602",
-        "contentHash": "ZL0VLc4s9rvNNFt19Pxm5UNAkmKNylugAwJPX9ulXZ6JWs/l6XZihPWWTyezaoNOVyEPU8YbURtW7XMAtqXH5A=="
-      },
-      "Avalonia.Native": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "8g53DROFW6wVJAnTsE1Iu5bdZO5r0oqxbdbMQODs1QDYCK2IU/y/x/vQVKCYOvqxl4tXkzU9tExv8XqSGPWthQ==",
-        "dependencies": {
-          "Avalonia": "11.3.18"
-        }
-      },
-      "HarfBuzzSharp.NativeAssets.Linux": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "3EZ1mpIiKWRLL5hUYA82ZHteeDIVaEA/Z0rA/wU6tjx6crcAkJnBPwDXZugBSfo8+J3EznvRJf49uMsqYfKrHg=="
-      },
-      "HarfBuzzSharp.NativeAssets.macOS": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "jbtCsgftcaFLCA13tVKo5iWdElJScrulLTKJre36O4YQTIlwDtPPqhRZNk+Y0vv4D1gxbscasGRucUDfS44ofQ=="
-      },
-      "HarfBuzzSharp.NativeAssets.Win32": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "UsJtQsfAJoFDZrXc4hCUfRPMqccfKZ0iumJ/upcUjz/cmsTgVFGNEL5yaJWmkqsuFYdMWbj/En5/kS4PFl9hBA=="
-      },
-      "SkiaSharp.NativeAssets.Linux": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "cWSaJKVPWAaT/WIn9c8T5uT/l4ETwHxNJTkEOtNKjphNo8AW6TF9O32aRkxqw3l8GUdUo66Bu7EiqtFh/XG0Zg==",
-        "dependencies": {
-          "SkiaSharp": "2.88.9"
-        }
-      },
-      "SkiaSharp.NativeAssets.macOS": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "Nv5spmKc4505Ep7oUoJ5vp3KweFpeNqxpyGDWyeEPTX2uR6S6syXIm3gj75dM0YJz7NPvcix48mR5laqs8dPuA=="
-      },
-      "SkiaSharp.NativeAssets.Win32": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "wb2kYgU7iy84nQLYZwMeJXixvK++GoIuECjU4ECaUKNuflyRlJKyiRhN1MAHswvlvzuvkrjRWlK0Za6+kYQK7w=="
-      },
-      "Ultz.Native.GLFW": {
-        "type": "Transitive",
-        "resolved": "3.4.0",
-        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
-      }
-    }
-  }
-}

src/SharpEmu.Core/Cpu/CpuDispatcher.cs

@@ -7,29 +7,33 @@ using SharpEmu.Core.Cpu.Native;
 using SharpEmu.Core.Loader;
 using SharpEmu.Core.Memory;
 using SharpEmu.HLE;
-using SharpEmu.Logging;
 
 namespace SharpEmu.Core.Cpu;
 
 public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
 {
-    private static readonly SharpEmuLogger Log = SharpEmuLog.For("Dispatcher");
-
     private enum EntryFrameKind
     {
         ProcessEntry,
         ModuleInitializer,
     }
 
-    private const ulong StackBaseAddress = 0x7FFF_F000_0000UL;
+    // The top of the x86-64 user address space (0x7FFD..0x7FFF) is only
+    // freely mappable on Windows; on macOS/Linux it hosts the dyld shared
+    // cache / vdso and (under Rosetta 2) the translator runtime, so POSIX
+    // hosts use the equivalent layout one slot lower at 0x6FFx.
+    private static readonly ulong StackBaseAddress = OperatingSystem.IsWindows() ? 0x7FFF_F000_0000UL : 0x6FFF_F000_0000UL;
     private const ulong StackSize = 0x0020_0000UL;
-    private const ulong TlsBaseAddress = 0x7FFE_0000_0000UL;
+    private static readonly ulong TlsBaseAddress = OperatingSystem.IsWindows() ? 0x7FFE_0000_0000UL : 0x6FFE_0000_0000UL;
     private const ulong TlsSize = 0x0001_0000UL;
-    private const ulong TlsPrefixSize = 0x0000_1000UL;
-    private const ulong BootstrapStubBaseAddress = 0x7FFD_F000_0000UL;
-    private const ulong BootstrapPayloadBaseAddress = 0x7FFD_E000_0000UL;
-    private const ulong DynlibFallbackStubBaseAddress = 0x7FFD_D000_0000UL;
-    private const ulong ReturnToHostStubBaseAddress = 0x7FFD_C000_0000UL;
+    // The static TLS blocks live at negative offsets from the TCB (FreeBSD
+    // amd64 variant II). Keep every host in sync with GuestTlsTemplate's
+    // startup reservation; PS5 modules routinely reach beyond one host page.
+    private const ulong TlsPrefixSize = GuestTlsTemplate.StartupStaticTlsReservation;
+    private static readonly ulong BootstrapStubBaseAddress = OperatingSystem.IsWindows() ? 0x7FFD_F000_0000UL : 0x6FFD_F000_0000UL;
+    private static readonly ulong BootstrapPayloadBaseAddress = OperatingSystem.IsWindows() ? 0x7FFD_E000_0000UL : 0x6FFD_E000_0000UL;
+    private static readonly ulong DynlibFallbackStubBaseAddress = OperatingSystem.IsWindows() ? 0x7FFD_D000_0000UL : 0x6FFD_D000_0000UL;
+    private static readonly ulong ReturnToHostStubBaseAddress = OperatingSystem.IsWindows() ? 0x7FFD_C000_0000UL : 0x6FFD_C000_0000UL;
     private const ulong BootstrapRegionSize = 0x0000_1000UL;
     private const ulong ReturnToHostStubStride = 0x0100_0000UL;
     private const ulong BootstrapPayloadResultOffset = 0x28UL;
@@ -83,8 +87,8 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         string processImageName = "eboot.bin",
         CpuExecutionOptions executionOptions = default)
     {
-        Log.Debug("=== DispatchEntry START ===");
-        Log.Debug($"entryPoint=0x{entryPoint:X16}, generation={generation}");
+        Console.Error.WriteLine("[DISPATCHER] === DispatchEntry START ===");
+        Console.Error.WriteLine($"[DISPATCHER] entryPoint=0x{entryPoint:X16}, generation={generation}");
 
         try
         {
@@ -92,7 +96,8 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         }
         catch (Exception ex)
         {
-            Log.Critical($"FATAL EXCEPTION in DispatchEntry: {ex.GetType().Name}: {ex.Message}", ex);
+            Console.Error.WriteLine($"[DISPATCHER] FATAL EXCEPTION in DispatchEntry: {ex.GetType().Name}: {ex.Message}");
+            Console.Error.WriteLine($"[DISPATCHER] Stack trace: {ex.StackTrace}");
             throw;
         }
     }
@@ -105,8 +110,8 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         string moduleName = "module",
         CpuExecutionOptions executionOptions = default)
     {
-        Log.Debug("=== DispatchModuleInitializer START ===");
-        Log.Debug($"moduleInit=0x{entryPoint:X16}, generation={generation}, module={moduleName}");
+        Console.Error.WriteLine("[DISPATCHER] === DispatchModuleInitializer START ===");
+        Console.Error.WriteLine($"[DISPATCHER] moduleInit=0x{entryPoint:X16}, generation={generation}, module={moduleName}");
 
         try
         {
@@ -121,7 +126,8 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         }
         catch (Exception ex)
         {
-            Log.Critical($"FATAL EXCEPTION in DispatchModuleInitializer: {ex.GetType().Name}: {ex.Message}", ex);
+            Console.Error.WriteLine($"[DISPATCHER] FATAL EXCEPTION in DispatchModuleInitializer: {ex.GetType().Name}: {ex.Message}");
+            Console.Error.WriteLine($"[DISPATCHER] Stack trace: {ex.StackTrace}");
             throw;
         }
     }
@@ -135,7 +141,7 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         CpuExecutionOptions executionOptions = default,
         EntryFrameKind frameKind = EntryFrameKind.ProcessEntry)
     {
-        Log.Debug("DispatchEntryCore STARTING...");
+        Console.Error.WriteLine("[DISPATCHER] DispatchEntryCore STARTING...");
 
         LastEntryPoint = entryPoint;
         LastTrapInfo = null;
@@ -307,7 +313,7 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
             LastMilestoneLog,
             Environment.NewLine,
             $"CpuEngine native-only failed: {backendError}");
-        Log.Error($"Native backend FAILED: {backendError}");
+        Console.Error.WriteLine($"[DISPATCHER] Native backend FAILED: {backendError}");
         return FailEarly(
             OrbisGen2Result.ORBIS_GEN2_ERROR_NOT_IMPLEMENTED,
             CpuExitReason.NativeBackendUnavailable);
@@ -366,11 +372,19 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
 
     private static bool InitializeTls(CpuContext context, ulong tlsBase)
     {
-        return context.TryWriteUInt64(tlsBase - 0xF0, 0) &&
-               context.TryWriteUInt64(tlsBase + 0x00, tlsBase) &&
-               context.TryWriteUInt64(tlsBase + 0x10, tlsBase) &&
-               context.TryWriteUInt64(tlsBase + 0x28, 0xC0DEC0DECAFEBABEUL) &&
-               context.TryWriteUInt64(tlsBase + 0x60, tlsBase);
+        if (!context.TryWriteUInt64(tlsBase - 0xF0, 0) ||
+            !context.TryWriteUInt64(tlsBase + 0x00, tlsBase) ||
+            !context.TryWriteUInt64(tlsBase + 0x10, tlsBase) ||
+            !context.TryWriteUInt64(tlsBase + 0x28, 0xC0DEC0DECAFEBA00UL) ||
+            !context.TryWriteUInt64(tlsBase + 0x60, tlsBase))
+        {
+            return false;
+        }
+
+        // Seed the static TLS block below the thread pointer with the main
+        // module's initialized thread-locals (variant II layout).
+        SharpEmu.HLE.GuestTlsTemplate.SeedThreadBlock(context, tlsBase);
+        return true;
     }
 
     private static bool InitializeGuestFrameChainSentinel(CpuContext context)
@@ -396,35 +410,54 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         ulong programExitHandlerAddress)
     {
         var imageName = string.IsNullOrWhiteSpace(processImageName) ? "eboot.bin" : processImageName;
-        var encodedNameLength = Encoding.UTF8.GetByteCount(imageName);
-        Span<byte> argv0Buffer = encodedNameLength + 1 <= 512
-            ? stackalloc byte[encodedNameLength + 1]
-            : new byte[encodedNameLength + 1];
-        if (Encoding.UTF8.GetBytes(imageName.AsSpan(), argv0Buffer) != encodedNameLength)
+        var arguments = new List<string>(3) { imageName };
+        var configuredArguments = Environment.GetEnvironmentVariable("SHARPEMU_GUEST_ARGS");
+        if (!string.IsNullOrWhiteSpace(configuredArguments))
         {
-            return false;
+            // The PS5 entry-parameter ABI exposes three inline argv pointers.
+            // Two compatibility arguments are therefore safe without changing
+            // the fixed 0x20-byte structure expected by existing titles.
+            var compatibilityArguments = configuredArguments.Split(
+                (char[]?)null,
+                StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+            arguments.AddRange(compatibilityArguments.Take(2));
         }
 
-        argv0Buffer[encodedNameLength] = 0;
         var cursor = context[CpuRegister.Rsp];
-
-        var argv0Address = AlignDown(cursor - (ulong)argv0Buffer.Length, 16);
-        if (!context.Memory.TryWrite(argv0Address, argv0Buffer))
+        var argumentAddresses = new ulong[arguments.Count];
+        for (var index = arguments.Count - 1; index >= 0; index--)
         {
-            return false;
+            var encoded = Encoding.UTF8.GetBytes(arguments[index] + '\0');
+            cursor = AlignDown(cursor - (ulong)encoded.Length, 16);
+            if (!context.Memory.TryWrite(cursor, encoded))
+            {
+                return false;
+            }
+
+            argumentAddresses[index] = cursor;
         }
 
         const ulong entryParamsSize = 0x20;
-        var entryParamsAddress = AlignDown(argv0Address - entryParamsSize, 16);
-        if (!context.TryWriteUInt32(entryParamsAddress + 0x00, 1) ||
-            !context.TryWriteUInt32(entryParamsAddress + 0x04, 0) ||
-            !context.TryWriteUInt64(entryParamsAddress + 0x08, argv0Address) ||
-            !context.TryWriteUInt64(entryParamsAddress + 0x10, 0) ||
-            !context.TryWriteUInt64(entryParamsAddress + 0x18, 0))
+        var entryParamsAddress = AlignDown(cursor - entryParamsSize, 16);
+        if (!TryWriteUInt32(context, entryParamsAddress + 0x00, (uint)arguments.Count) ||
+            !TryWriteUInt32(context, entryParamsAddress + 0x04, 0) ||
+            !context.TryWriteUInt64(entryParamsAddress + 0x08, argumentAddresses[0]) ||
+            !context.TryWriteUInt64(
+                entryParamsAddress + 0x10,
+                argumentAddresses.Length > 1 ? argumentAddresses[1] : 0) ||
+            !context.TryWriteUInt64(
+                entryParamsAddress + 0x18,
+                argumentAddresses.Length > 2 ? argumentAddresses[2] : 0))
         {
             return false;
         }
 
+        if (arguments.Count > 1)
+        {
+            Console.Error.WriteLine(
+                $"[DISPATCHER] Guest arguments: {string.Join(' ', arguments.Skip(1))}");
+        }
+
         var entryStackPointer = entryParamsAddress - sizeof(ulong);
         if (!context.TryWriteUInt64(entryStackPointer, 0))
         {
@@ -457,6 +490,13 @@ public sealed class CpuDispatcher : ICpuDispatcher, IDisposable
         return value & ~(alignment - 1);
     }
 
+    private static bool TryWriteUInt32(CpuContext context, ulong address, uint value)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(uint)];
+        BinaryPrimitives.WriteUInt32LittleEndian(buffer, value);
+        return context.Memory.TryWrite(address, buffer);
+    }
+
     private static string BuildEntryFrameDiagnostic(
         ulong entryPoint,
         CpuContext context,

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Diagnostics.cs

@@ -7,6 +7,7 @@ using System.Collections.Generic;
 using System.Linq;
 using System.Runtime.InteropServices;
 using System.Threading;
+using SharpEmu.Core.Cpu.Disasm;
 using SharpEmu.HLE;
 using SharpEmu.Logging;
 
@@ -16,6 +17,55 @@ public sealed partial class DirectExecutionBackend
 {
 	private static readonly ConcurrentDictionary<ulong, byte> _knownExecutablePages = new();
 
+	private static readonly bool _perfHleHistogram =
+		string.Equals(System.Environment.GetEnvironmentVariable("SHARPEMU_PERF_HLE"), "1", System.StringComparison.Ordinal);
+	private static readonly System.Collections.Concurrent.ConcurrentDictionary<string, long> _perfHleCounts = new();
+	private static long _perfHleTotal;
+	private static long _perfHleDispatchTicks;
+
+	private static void RecordPerfHleDispatchTime(long ticks)
+	{
+		var total = System.Threading.Interlocked.Add(ref _perfHleDispatchTicks, ticks);
+		var calls = System.Threading.Interlocked.Read(ref _perfHleTotal);
+		if (calls > 0 && calls % 500000 == 0)
+		{
+			var avgUs = (double)total / System.Diagnostics.Stopwatch.Frequency * 1_000_000.0 / calls;
+			System.Console.Error.WriteLine($"[PERF][HLE] managed_dispatch_avg={avgUs:F3}us total_managed_s={(double)total / System.Diagnostics.Stopwatch.Frequency:F2}");
+		}
+	}
+
+	private static readonly bool _perfHleNoDict =
+		string.Equals(System.Environment.GetEnvironmentVariable("SHARPEMU_PERF_HLE_NODICT"), "1", System.StringComparison.Ordinal);
+
+	private static void RecordPerfHleCall(string name)
+	{
+		var total = System.Threading.Interlocked.Increment(ref _perfHleTotal);
+		if (!_perfHleNoDict)
+		{
+			_perfHleCounts.AddOrUpdate(name, 1, static (_, v) => v + 1);
+		}
+
+		if (total % 500000 == 0 && !_perfHleNoDict)
+		{
+			// Snapshot via foreach (a safe moving enumerator) before sorting.
+			// LINQ over a ConcurrentDictionary uses ICollection.CopyTo, which
+			// throws ArgumentException if another thread adds a key between the
+			// Count read and the copy — that exception was being swallowed into
+			// a CPU_TRAP return and crashing the guest.
+			var snapshot = new System.Collections.Generic.List<System.Collections.Generic.KeyValuePair<string, long>>(_perfHleCounts.Count + 16);
+			foreach (var kvp in _perfHleCounts)
+			{
+				snapshot.Add(kvp);
+			}
+
+			var top = snapshot
+				.OrderByDescending(kvp => kvp.Value)
+				.Take(20)
+				.Select(kvp => $"{kvp.Key}={kvp.Value}");
+			System.Console.Error.WriteLine($"[PERF][HLE] total={total} top: {string.Join(", ", top)}");
+		}
+	}
+
 	private void RecordRecentImportTrace(
 		long dispatchIndex,
 		string nid,
@@ -24,101 +74,40 @@ public sealed partial class DirectExecutionBackend
 		ulong arg1,
 		ulong arg2)
 	{
-		_recentImportTrace[_recentImportTraceWriteIndex] = new RecentImportTraceEntry(
+		var trace = _recentImportTrace;
+		trace[_recentImportTraceWriteIndex] = new RecentImportTraceEntry(
 			dispatchIndex,
 			nid,
 			returnRip,
 			arg0,
 			arg1,
-			arg2);
-		_recentImportTraceWriteIndex = (_recentImportTraceWriteIndex + 1) % _recentImportTrace.Length;
-		if (_recentImportTraceCount < _recentImportTrace.Length)
+			arg2,
+			GuestThreadExecution.CurrentGuestThreadHandle,
+			Environment.CurrentManagedThreadId);
+		_recentImportTraceWriteIndex = (_recentImportTraceWriteIndex + 1) % trace.Length;
+		if (_recentImportTraceCount < trace.Length)
 		{
 			_recentImportTraceCount++;
 		}
 	}
 
-	private void RecordDeferredBootstrapTrace(
-		long dispatchIndex,
-		ulong op,
-		ulong symbolPointer,
-		ulong outputPointer,
-		ulong returnRip)
-	{
-		lock (_deferredBootstrapTraceGate)
-		{
-			_deferredBootstrapTrace[_deferredBootstrapTraceWriteIndex] = new DeferredBootstrapTraceEntry(
-				dispatchIndex,
-				op,
-				symbolPointer,
-				outputPointer,
-				returnRip);
-			_deferredBootstrapTraceWriteIndex =
-				(_deferredBootstrapTraceWriteIndex + 1) % _deferredBootstrapTrace.Length;
-			if (_deferredBootstrapTraceCount < _deferredBootstrapTrace.Length)
-			{
-				_deferredBootstrapTraceCount++;
-			}
-		}
-	}
-
-	private void DrainDeferredBootstrapTraces()
-	{
-		if (!_logBootstrap)
-		{
-			return;
-		}
-
-		DeferredBootstrapTraceEntry[] pending;
-		lock (_deferredBootstrapTraceGate)
-		{
-			if (_deferredBootstrapTraceCount == 0)
-			{
-				return;
-			}
-
-			pending = new DeferredBootstrapTraceEntry[_deferredBootstrapTraceCount];
-			var readIndex = (_deferredBootstrapTraceWriteIndex - _deferredBootstrapTraceCount +
-				_deferredBootstrapTrace.Length) % _deferredBootstrapTrace.Length;
-			for (var i = 0; i < _deferredBootstrapTraceCount; i++)
-			{
-				pending[i] = _deferredBootstrapTrace[(readIndex + i) % _deferredBootstrapTrace.Length];
-			}
-
-			_deferredBootstrapTraceCount = 0;
-		}
-
-		foreach (var entry in pending)
-		{
-			var symbolText = "<unreadable>";
-			if (TryReadAsciiZ(entry.SymbolPointer, 256, out var sym))
-			{
-				symbolText = sym;
-			}
-
-			Console.Error.WriteLine(
-				$"[LOADER][TRACE] bootstrap_call#{entry.DispatchIndex}: op=0x{entry.Op:X16} " +
-				$"sym_ptr=0x{entry.SymbolPointer:X16} sym='{symbolText}' " +
-				$"out_ptr=0x{entry.OutputPointer:X16} ret=0x{entry.ReturnRip:X16}");
-		}
-	}
-
 	private void DumpRecentImportTrace()
 	{
-		if (_recentImportTraceCount == 0)
+		var trace = _recentImportTrace;
+		if (trace is null || _recentImportTraceCount == 0)
 		{
 			return;
 		}
-		Log.Info($"   Recent import calls ({_recentImportTraceCount}):");
-		int num = (_recentImportTraceWriteIndex - _recentImportTraceCount + _recentImportTrace.Length) % _recentImportTrace.Length;
+		Log.Info($"   Recent import calls for managed={Environment.CurrentManagedThreadId} guest=0x{GuestThreadExecution.CurrentGuestThreadHandle:X16} ({_recentImportTraceCount}):");
+		int num = (_recentImportTraceWriteIndex - _recentImportTraceCount + trace.Length) % trace.Length;
 		for (int i = 0; i < _recentImportTraceCount; i++)
 		{
-			int num2 = (num + i) % _recentImportTrace.Length;
-			var entry = _recentImportTrace[num2];
+			int num2 = (num + i) % trace.Length;
+			var entry = trace[num2];
 			if (!string.IsNullOrEmpty(entry.Nid))
 			{
 				Log.Info(
-					$"     #{entry.DispatchIndex} nid={entry.Nid} ret=0x{entry.ReturnRip:X16} " +
+					$"     #{entry.DispatchIndex} managed={entry.ManagedThreadId} guest=0x{entry.GuestThreadHandle:X16} nid={entry.Nid} ret=0x{entry.ReturnRip:X16} " +
 					$"rdi=0x{entry.Arg0:X16} rsi=0x{entry.Arg1:X16} rdx=0x{entry.Arg2:X16}");
 			}
 		}
@@ -184,6 +173,50 @@ public sealed partial class DirectExecutionBackend
 		{
 			return;
 		}
+		const int preludeSize = 192;
+		Span<byte> prelude = stackalloc byte[preludeSize];
+		if (returnRip >= preludeSize && cpuContext.Memory.TryRead(returnRip - preludeSize, prelude))
+		{
+			Console.Error.WriteLine(
+				$"[LOADER][TRACE] Import#{dispatchIndex} pre-return bytes @0x{returnRip - preludeSize:X16}: " +
+				BitConverter.ToString(prelude.ToArray()).Replace("-", " "));
+
+			List<DecodedInst>? bestCallChain = null;
+			var preludeAddress = returnRip - preludeSize;
+			for (var startOffset = 0; startOffset < preludeSize; startOffset++)
+			{
+				var cursor = preludeAddress + (ulong)startOffset;
+				var candidate = new List<DecodedInst>();
+				while (cursor < returnRip && candidate.Count < 96 &&
+					IcedDecoder.TryReadGuestBytes(cpuContext.Memory, cursor, 15, out var instructionBytes) &&
+					IcedDecoder.TryDecode(cursor, instructionBytes, out var instruction) &&
+					instruction.Length > 0 &&
+					cursor + (ulong)instruction.Length <= returnRip)
+				{
+					candidate.Add(instruction);
+					cursor += (ulong)instruction.Length;
+				}
+
+				if (cursor == returnRip &&
+					candidate.Count > 0 &&
+					string.Equals(candidate[^1].Mnemonic, "Call", StringComparison.OrdinalIgnoreCase) &&
+					(bestCallChain is null || candidate.Count > bestCallChain.Count))
+				{
+					bestCallChain = candidate;
+				}
+			}
+
+			if (bestCallChain is not null)
+			{
+				Console.Error.WriteLine($"[LOADER][TRACE] Import#{dispatchIndex} pre-return disassembly:");
+				foreach (var instruction in bestCallChain.TakeLast(32))
+				{
+					Console.Error.WriteLine(
+						$"[LOADER][TRACE]   0x{instruction.Rip:X16}: {instruction.Text} " +
+						$"bytes={IcedDecoder.FormatBytes(instruction.Bytes)}");
+				}
+			}
+		}
 		Span<byte> destination = stackalloc byte[128];
 		if (!cpuContext.Memory.TryRead(returnRip, destination))
 		{
@@ -235,15 +268,14 @@ public sealed partial class DirectExecutionBackend
 			ulong callRip = returnRip + (ulong)i;
 			ulong target = unchecked((ulong)((long)(callRip + 5) + rel32));
 			Log.Debug($"Import#{dispatchIndex} near-call @{callRip:X16}: target=0x{target:X16}");
-			var importEntries = _importEntries;
-			for (int importIndex = 0; importIndex < importEntries.Length; importIndex++)
+			for (int importIndex = 0; importIndex < _importEntries.Length; importIndex++)
 			{
-				if (importEntries[importIndex].Address != target)
+				if (_importEntries[importIndex].Address != target)
 				{
 					continue;
 				}
 
-				string nid = importEntries[importIndex].Nid;
+				string nid = _importEntries[importIndex].Nid;
 				if (_moduleManager.TryGetExport(nid, out var export))
 				{
 					Log.Debug(
@@ -270,14 +302,14 @@ public sealed partial class DirectExecutionBackend
 					{
 						Log.Debug(
 							$"Import#{dispatchIndex} near-call PLT slot: [0x{slot:X16}] = 0x{slotTarget:X16}");
-						for (int importIndex = 0; importIndex < importEntries.Length; importIndex++)
+						for (int importIndex = 0; importIndex < _importEntries.Length; importIndex++)
 						{
-							if (importEntries[importIndex].Address != slotTarget)
+							if (_importEntries[importIndex].Address != slotTarget)
 							{
 								continue;
 							}
 
-							string nid = importEntries[importIndex].Nid;
+							string nid = _importEntries[importIndex].Nid;
 							if (_moduleManager.TryGetExport(nid, out var export))
 							{
 								Log.Debug(
@@ -301,6 +333,28 @@ public sealed partial class DirectExecutionBackend
 		return value == 65534 || value == 4294967294u || value == 18446744073709551614uL;
 	}
 
+	private static ulong ParseOptionalHexAddress(string? value)
+	{
+		if (string.IsNullOrWhiteSpace(value))
+		{
+			return 0;
+		}
+
+		var text = value.Trim();
+		if (text.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+		{
+			text = text[2..];
+		}
+
+		return ulong.TryParse(
+			text,
+			System.Globalization.NumberStyles.HexNumber,
+			System.Globalization.CultureInfo.InvariantCulture,
+			out var address)
+			? address
+			: 0;
+	}
+
 	private static bool IsPlausibleReturnAddress(ulong address)
 	{
 		return address >= 12884901888L && address < 17592186044416L && !IsUnresolvedSentinel(address);

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.Exceptions.cs

@@ -17,9 +17,17 @@ public sealed partial class DirectExecutionBackend
 {
 	private const ulong LazyCommitWindowBytes = 0x0200_0000UL;
 	private static int _lazyCommitTraceCount;
+	private static int _guestAllocatorHoleRecoveries;
+	private static int _auxiliaryThreadExecuteFaultRecoveries;
 
 	private unsafe void SetupExceptionHandler()
 	{
+		if (!OperatingSystem.IsWindows())
+		{
+			SetupPosixExceptionHandler();
+			return;
+		}
+
 		if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_RAW_HANDLER"), "1", StringComparison.Ordinal))
 		{
 			_rawExceptionHandlerStub = CreateExceptionHandlerTrampoline(RawVectoredHandlerPtrManaged);
@@ -102,20 +110,24 @@ public sealed partial class DirectExecutionBackend
 
 			ulong rip = ReadCtxU64(contextRecord, 248);
 			ulong rsp = ReadCtxU64(contextRecord, 152);
-
-			// Thread-mode probe: a hardware exception raised while this thread is inside
-			// the managed import gateway means the VEH->managed reentry happened from
-			// cooperative GC mode — a ReversePInvokeBadTransition candidate.
-			if (LogThreadMode && _threadModeGatewayDepth > 0)
+			if (TryRecoverGuestInt41(exceptionCode, contextRecord, rip))
 			{
-				TraceThreadMode(
-					$"veh_in_gateway code=0x{exceptionCode:X8} rip=0x{rip:X16} gateway_depth={_threadModeGatewayDepth}");
+				return -1;
+			}
+			if (TryRecoverAuxiliaryThreadExecuteFault(exceptionRecord, contextRecord, rip))
+			{
+				return -1;
 			}
 
 			if (exceptionCode == 3221225477u && TryHandleLazyCommittedPage(exceptionRecord, rip, rsp))
 			{
 				return -1;
 			}
+			if (exceptionCode == 3221225477u &&
+				TryRecoverGuestAllocatorHole(exceptionRecord, contextRecord, rip))
+			{
+				return -1;
+			}
 			if (IsBenignHostDebugException(exceptionCode))
 			{
 				return -1;
@@ -161,6 +173,35 @@ public sealed partial class DirectExecutionBackend
 			Console.Error.WriteLine($"[LOADER][INFO]   Code: 0x{exceptionCode:X8}");
 			Console.Error.WriteLine($"[LOADER][INFO]   Exception Address: 0x{exceptionAddress:X16}");
 			Console.Error.WriteLine($"[LOADER][INFO]   RIP: 0x{rip:X16}");
+			Console.Error.WriteLine(
+				$"[LOADER][INFO]   Host thread: managed={Environment.CurrentManagedThreadId} " +
+				$"name='{Thread.CurrentThread.Name ?? "<unnamed>"}'");
+			if (_activeGuestThreadState is { } activeGuestThread)
+			{
+				Console.Error.WriteLine(
+					$"[LOADER][INFO]   Guest thread: handle=0x{activeGuestThread.ThreadHandle:X16} " +
+					$"name='{activeGuestThread.Name}' state={activeGuestThread.State} " +
+					$"last_import={activeGuestThread.LastImportNid ?? "<none>"} " +
+					$"last_ret=0x{activeGuestThread.LastReturnRip:X16}");
+				Console.Error.WriteLine(
+					$"[LOADER][INFO]   Last import registers: " +
+					$"rax=0x{Volatile.Read(ref activeGuestThread.LastImportRax):X16} " +
+					$"result_valid={Volatile.Read(ref activeGuestThread.LastImportResultValid) != 0} " +
+					$"rdi=0x{activeGuestThread.LastImportRdi:X16} " +
+					$"rsi=0x{activeGuestThread.LastImportRsi:X16} " +
+					$"rdx=0x{activeGuestThread.LastImportRdx:X16} " +
+					$"rcx=0x{activeGuestThread.LastImportRcx:X16} " +
+					$"r8=0x{activeGuestThread.LastImportR8:X16} " +
+					$"r9=0x{activeGuestThread.LastImportR9:X16}");
+				Console.Error.WriteLine(
+					$"[LOADER][INFO]   Last import stack args: " +
+					$"0=0x{activeGuestThread.LastImportStack0:X16} " +
+					$"1=0x{activeGuestThread.LastImportStack1:X16} " +
+					$"2=0x{activeGuestThread.LastImportStack2:X16} " +
+					$"3=0x{activeGuestThread.LastImportStack3:X16} " +
+					$"4=0x{activeGuestThread.LastImportStack4:X16} " +
+					$"5=0x{activeGuestThread.LastImportStack5:X16}");
+			}
 			if (TryFormatNearestRuntimeSymbol(rip, out string symbol))
 			{
 				Console.Error.WriteLine("[LOADER][INFO]   RIP symbol: " + symbol);
@@ -205,20 +246,50 @@ public sealed partial class DirectExecutionBackend
 
 			}
 
-			try
+			Console.Error.WriteLine("[LOADER][INFO]   Stack qwords (RSP..):");
+			for (int i = 0; i < 16; i++)
 			{
-				Console.Error.WriteLine("[LOADER][INFO]   Stack qwords (RSP..):");
-				for (int i = 0; i < 16; i++)
+				ulong stackAddr = rsp + (ulong)(i * 8);
+				if (!TryReadHostQword(stackAddr, out ulong value))
 				{
-					ulong stackAddr = rsp + (ulong)(i * 8);
-					ulong value = (ulong)Marshal.ReadInt64((nint)stackAddr);
-					Console.Error.WriteLine($"[LOADER][INFO]     [rsp+0x{i * 8:X2}] @0x{stackAddr:X16} = 0x{value:X16}");
+					Console.Error.WriteLine("[LOADER][WARNING]   Could not read stack qwords.");
+					break;
+				}
+				Console.Error.WriteLine($"[LOADER][INFO]     [rsp+0x{i * 8:X2}] @0x{stackAddr:X16} = 0x{value:X16}");
+			}
+
+			if (string.Equals(
+					Environment.GetEnvironmentVariable("SHARPEMU_DUMP_FAULT_STACK_WINDOW"),
+					"1",
+					StringComparison.Ordinal))
+			{
+				Console.Error.WriteLine("[LOADER][INFO]   Full fault stack window (RSP-0x300..RSP+0x100):");
+				var windowStart = rsp >= 0x300 ? rsp - 0x300 : 0;
+				for (var stackAddr = windowStart; stackAddr < rsp + 0x100; stackAddr += 8)
+				{
+					if (!TryReadHostQword(stackAddr, out var value))
+					{
+						continue;
+					}
+
+					var relative = unchecked((long)(stackAddr - rsp));
+					var relativeText = relative >= 0
+						? $"+0x{relative:X}"
+						: $"-0x{-relative:X}";
+					var symbolText = TryFormatNearestRuntimeSymbol(value, out var stackSymbol)
+						? $" [{stackSymbol}]"
+						: string.Empty;
+					Console.Error.WriteLine(
+						$"[LOADER][INFO]     [rsp{relativeText}] " +
+						$"@0x{stackAddr:X16} = 0x{value:X16}{symbolText}");
 				}
 			}
-			catch
-			{
-				Console.Error.WriteLine("[LOADER][WARNING]   Could not read stack qwords.");
-			}
+
+			DumpPointerWindow("fault-register-rbx", rbx, 0x60);
+			DumpPointerWindow("fault-register-rsi", rsi, 0x60);
+			DumpPointerWindow("fault-register-rdi", rdi, 0x60);
+			DumpPointerWindow("fault-register-r13", r13, 0x60);
+			DumpPointerWindow("fault-register-r14", r14, 0x60);
 
 			try
 			{
@@ -226,12 +297,15 @@ public sealed partial class DirectExecutionBackend
 				ulong frame = rbp;
 				for (int i = 0; i < 12; i++)
 				{
-					if (frame < 140733193388032L || frame > 140737488355327L)
+					if (frame < 0x10000)
 					{
 						break;
 					}
-					ulong next = (ulong)Marshal.ReadInt64((nint)frame);
-					ulong ret = (ulong)Marshal.ReadInt64((nint)(frame + 8));
+					if (!TryReadHostQword(frame, out ulong next) || !TryReadHostQword(frame + 8, out ulong ret))
+					{
+						Console.Error.WriteLine("[LOADER][WARNING]   Could not walk RBP frame chain.");
+						break;
+					}
 					string extra = TryFormatNearestRuntimeSymbol(ret, out string retSym) ? $" [{retSym}]" : string.Empty;
 					Console.Error.WriteLine($"[LOADER][INFO]     frame#{i}: rbp=0x{frame:X16} ret=0x{ret:X16}{extra} next=0x{next:X16}");
 					if (next <= frame)
@@ -254,10 +328,9 @@ public sealed partial class DirectExecutionBackend
 					Console.Error.WriteLine("[LOADER][ERROR]     - Guest code called an unmapped import");
 					Console.Error.WriteLine("[LOADER][ERROR]     - Guest code accessed unmapped memory");
 					Console.Error.WriteLine("[LOADER][ERROR]     - Need to implement HLE for this NID");
-					try
+					byte[] code = new byte[16];
+					if (TryReadHostBytes(rip, code))
 					{
-						byte[] code = new byte[16];
-						Marshal.Copy((nint)rip, code, 0, code.Length);
 						Console.Error.WriteLine("[LOADER][INFO]   Code at RIP: " + BitConverter.ToString(code).Replace("-", " "));
 						if (code[0] == 100)
 						{
@@ -273,25 +346,46 @@ public sealed partial class DirectExecutionBackend
 							Console.Error.WriteLine($"[LOADER][INFO]   RBP: 0x{rbp:X16} (mod 16 = {rbp % 16})");
 							Console.Error.WriteLine($"[LOADER][INFO]   RSP: 0x{rsp:X16} (mod 16 = {rsp % 16})");
 						}
-						if (rip > 16)
+						byte[] before = new byte[16];
+						if (rip > 16 && TryReadHostBytes(rip - 16, before))
 						{
-							byte[] before = new byte[16];
-							Marshal.Copy((nint)(rip - 16), before, 0, before.Length);
 							Console.Error.WriteLine("[LOADER][INFO]   Code before RIP: " + BitConverter.ToString(before).Replace("-", " "));
 						}
-						if (rip > 32)
+						byte[] window = new byte[64];
+						if (rip > 32 && TryReadHostBytes(rip - 32, window))
 						{
-							byte[] window = new byte[64];
-							Marshal.Copy((nint)(rip - 32), window, 0, window.Length);
 							Console.Error.WriteLine("[LOADER][INFO]   Code window [RIP-0x20..]: " + BitConverter.ToString(window).Replace("-", " "));
 						}
+						for (var stackIndex = 0; stackIndex < 16; stackIndex++)
+						{
+							byte[] stackSlot = new byte[8];
+							if (!TryReadHostBytes(rsp + (ulong)(stackIndex * 8), stackSlot))
+							{
+								continue;
+							}
+							var candidate = BitConverter.ToUInt64(stackSlot);
+							if (candidate < _entryPoint || candidate >= _entryPoint + 0x10000000 || candidate < 24)
+							{
+								continue;
+							}
+							byte[] callSiteWindow = new byte[48];
+							if (TryReadHostBytes(candidate - 24, callSiteWindow))
+							{
+								Console.Error.WriteLine(
+									$"[LOADER][INFO]   Stack guest-code candidate [rsp+0x{stackIndex * 8:X2}]=0x{candidate:X16}, bytes [-0x18..]: " +
+									BitConverter.ToString(callSiteWindow).Replace("-", " "));
+							}
+						}
 					}
-					catch
+					else
 					{
 						Console.Error.WriteLine("[LOADER][ERROR]   Could not read code at RIP");
 					}
 					DumpRecentImportTrace();
-					DumpGuestDisasmDiagnostics(rip, rbp);
+					DumpGuestDisasmDiagnostics(rip, rbp, rsp);
+					DumpGuestRegisterWindowDiagnostics(
+						rax, rbx, rcx, rdx, rsi, rdi, rbp, rsp,
+						r8, r9, r10, r11, r12, r13, r14, r15);
 					DumpGuestReferenceDiagnostics();
 					DumpGuestPointerWindowDiagnostics();
 					break;
@@ -299,8 +393,20 @@ public sealed partial class DirectExecutionBackend
 					Console.Error.WriteLine("[LOADER][WARNING]   Type: Breakpoint (int3)");
 					Console.Error.WriteLine("[LOADER][WARNING]   Unexpected breakpoint in direct-bridge mode");
 					break;
+				case 1073741845u:
+					Console.Error.WriteLine("[LOADER][ERROR]   Type: Abort (SIGABRT)");
+					DumpRecentImportTrace();
+					DumpGuestDisasmDiagnostics(rip, rbp, rsp);
+					break;
 				case 3221225501u:
 					Console.Error.WriteLine("[LOADER][INFO]   Type: Illegal Instruction");
+					byte[] illegalCode = new byte[16];
+					if (TryReadHostBytes(rip, illegalCode))
+					{
+						Console.Error.WriteLine("[LOADER][INFO]   Code at RIP: " + BitConverter.ToString(illegalCode).Replace("-", " "));
+					}
+					DumpRecentImportTrace();
+					DumpGuestDisasmDiagnostics(rip, rbp, rsp);
 					break;
 			}
 
@@ -314,6 +420,108 @@ public sealed partial class DirectExecutionBackend
 		}
 	}
 
+	private unsafe bool TryRecoverAuxiliaryThreadExecuteFault(
+		EXCEPTION_RECORD* exceptionRecord,
+		void* contextRecord,
+		ulong rip)
+	{
+		if (exceptionRecord->ExceptionCode != 3221225477u ||
+			rip >= 0x0000000800000000UL ||
+			_activeGuestThreadState is not { Name: "tbb_thead" } activeThread)
+		{
+			return false;
+		}
+
+		var hostExit = ActiveEntryReturnSentinelRip;
+		if (hostExit < 0x10000)
+		{
+			hostExit = unchecked((ulong)_guestReturnStub);
+		}
+		if (hostExit < 0x10000)
+		{
+			Console.Error.WriteLine(
+				$"[LOADER][WARN] Could not recover auxiliary TBB execute fault: target=0x{rip:X16} " +
+				$"active_exit=0x{ActiveEntryReturnSentinelRip:X16} guest_return_stub=0x{unchecked((ulong)_guestReturnStub):X16}");
+			return false;
+		}
+
+		_ = TryPatchActiveGuestReturnSlot(hostExit);
+		WriteCtxU64(contextRecord, 120, 0);
+		WriteCtxU64(contextRecord, 248, hostExit);
+		var recovery = Interlocked.Increment(ref _auxiliaryThreadExecuteFaultRecoveries);
+		Console.Error.WriteLine(
+			$"[LOADER][WARN] Recovered auxiliary TBB execute fault #{recovery}: " +
+			$"thread=0x{activeThread.ThreadHandle:X16} target=0x{rip:X16} -> host_exit=0x{hostExit:X16}");
+		return true;
+	}
+
+	private unsafe bool TryRecoverGuestInt41(uint exceptionCode, void* contextRecord, ulong rip)
+	{
+		if (!_ignoreGuestInt41 || exceptionCode != 3221225477u || rip < 0x10000)
+		{
+			return false;
+		}
+
+		byte[] opcode = new byte[2];
+		if (!TryReadHostBytes(rip, opcode) || opcode[0] != 0xCD || opcode[1] != 0x41)
+		{
+			return false;
+		}
+
+		var count = Interlocked.Increment(ref _ignoredGuestInt41Count);
+		WriteCtxU64(contextRecord, 248, rip + 2);
+		if (count <= 16 || count % 65536 == 0)
+		{
+			Console.Error.WriteLine(
+				$"[LOADER][WARN] Ignored guest int 0x41 trap #{count} at 0x{rip:X16} (SHARPEMU_IGNORE_INT41=1)");
+			Console.Error.Flush();
+		}
+		return true;
+	}
+
+	private unsafe static bool TryRecoverGuestAllocatorHole(
+		EXCEPTION_RECORD* exceptionRecord,
+		void* contextRecord,
+		ulong rip)
+	{
+		if (string.Equals(
+				Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_GUEST_ALLOCATOR_HOLE_RECOVERY"),
+				"1",
+				StringComparison.Ordinal) ||
+			exceptionRecord->NumberParameters < 2 ||
+			exceptionRecord->ExceptionInformation[0] != 0 ||
+			exceptionRecord->ExceptionInformation[1] != 8 ||
+			ReadCtxU64(contextRecord, CTX_RDI) != 0 ||
+			rip < 0x10000)
+		{
+			return false;
+		}
+
+		// Demon's Souls occasionally leaves an empty payload in a locked pool
+		// tree node. The allocator dereferences payload+8 before reaching its
+		// existing empty-pool fallback. Match the instruction stream instead of
+		// a title-specific absolute address, then resume at that fallback so the
+		// lock is released and the allocator can try its next backing pool.
+		const ulong allocatorHoleSignature = 0x634CFF568D08778BUL;
+		if (*(ulong*)rip != allocatorHoleSignature || *((byte*)rip + 8) != 0xF2)
+		{
+			return false;
+		}
+
+		const ulong emptyPoolFallbackDelta = 0x8E;
+		WriteCtxU64(contextRecord, CTX_RIP, rip + emptyPoolFallbackDelta);
+		var recovery = Interlocked.Increment(ref _guestAllocatorHoleRecoveries);
+		if (recovery <= 16 || (recovery & (recovery - 1)) == 0)
+		{
+			Console.Error.WriteLine(
+				$"[LOADER][WARN] Guest allocator empty-node adapter recovery #{recovery}: " +
+				$"rip=0x{rip:X16} -> 0x{rip + emptyPoolFallbackDelta:X16}");
+			Console.Error.Flush();
+		}
+
+		return true;
+	}
+
 	private static bool IsBenignHostDebugException(uint exceptionCode)
 	{
 		return exceptionCode is DBG_PRINTEXCEPTION_C or DBG_PRINTEXCEPTION_WIDE_C or MS_VC_THREADNAME_EXCEPTION;
@@ -393,7 +601,7 @@ public sealed partial class DirectExecutionBackend
 		}
 	}
 
-	private void DumpGuestDisasmDiagnostics(ulong rip, ulong rbp)
+	private void DumpGuestDisasmDiagnostics(ulong rip, ulong rbp, ulong rsp)
 	{
 		if (!string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_DISASM"), "1", StringComparison.Ordinal))
 		{
@@ -405,12 +613,20 @@ public sealed partial class DirectExecutionBackend
 			DumpGuestInstructionStream("fault-prelude", rip - 0x20, 24);
 		}
 
+		// Optimized guest code frequently omits frame pointers. The return
+		// address at RSP is then more useful than an RBP walk and identifies the
+		// exact call site that supplied the faulting arguments.
+		if (TryReadHostQword(rsp, out var stackReturn) && stackReturn >= 0x60)
+		{
+			DumpGuestInstructionStream("stack-return-prelude", stackReturn - 0x60, 40);
+		}
+
 		try
 		{
 			ulong frame = rbp;
 			for (int i = 0; i < 3; i++)
 			{
-				if (frame < 140733193388032L || frame > 140737488355327L)
+				if (frame < 0x10000)
 				{
 					break;
 				}
@@ -554,6 +770,55 @@ public sealed partial class DirectExecutionBackend
 		}
 	}
 
+	private void DumpGuestRegisterWindowDiagnostics(
+		ulong rax,
+		ulong rbx,
+		ulong rcx,
+		ulong rdx,
+		ulong rsi,
+		ulong rdi,
+		ulong rbp,
+		ulong rsp,
+		ulong r8,
+		ulong r9,
+		ulong r10,
+		ulong r11,
+		ulong r12,
+		ulong r13,
+		ulong r14,
+		ulong r15)
+	{
+		if (!string.Equals(
+				Environment.GetEnvironmentVariable("SHARPEMU_LOG_REGISTER_WINDOWS"),
+				"1",
+				StringComparison.Ordinal))
+		{
+			return;
+		}
+
+		// A register can be the only surviving reference to the object or
+		// argument array that caused a native guest fault. Capture a compact
+		// window while the process is alive so the post-mortem log can
+		// distinguish an absent object from a partially initialized one.
+		var registers = new (string Name, ulong Value)[]
+		{
+			("rax", rax), ("rbx", rbx), ("rcx", rcx), ("rdx", rdx),
+			("rsi", rsi), ("rdi", rdi), ("rbp", rbp), ("rsp", rsp),
+			("r8", r8), ("r9", r9), ("r10", r10), ("r11", r11),
+			("r12", r12), ("r13", r13), ("r14", r14), ("r15", r15),
+		};
+		var seen = new HashSet<ulong>();
+		foreach (var (name, value) in registers)
+		{
+			if (value < 0x10000 || !seen.Add(value))
+			{
+				continue;
+			}
+
+			DumpPointerWindow($"register-{name}", value, 0x80);
+		}
+	}
+
 	private void ScanExecutableRegionForTargetReferences(
 		ulong regionBase,
 		ulong regionEnd,
@@ -821,6 +1086,61 @@ public sealed partial class DirectExecutionBackend
 		}
 	}
 
+	private static bool TryReadHostQword(ulong address, out ulong value)
+	{
+		if (!OperatingSystem.IsWindows())
+		{
+			// A stray read inside the signal handler would raise a nested
+			// SIGSEGV and kill the process before diagnostics finish, so
+			// probe the region table instead of relying on try/catch.
+			return TryReadStackU64(address, out value);
+		}
+
+		value = 0;
+		try
+		{
+			value = (ulong)Marshal.ReadInt64((nint)address);
+			return true;
+		}
+		catch
+		{
+			return false;
+		}
+	}
+
+	private unsafe static bool TryReadHostBytes(ulong address, byte[] buffer)
+	{
+		if (address < 65536)
+		{
+			return false;
+		}
+
+		if (!OperatingSystem.IsWindows())
+		{
+			// See TryReadHostQword: probe every touched page before reading.
+			ulong end = address + (ulong)buffer.Length;
+			for (ulong page = address & 0xFFFFFFFFFFFFF000uL; page < end; page += 4096)
+			{
+				if (VirtualQuery((void*)page, out var mbi, (nuint)sizeof(MEMORY_BASIC_INFORMATION64)) == 0 ||
+					mbi.State != MEM_COMMIT ||
+					!IsReadableProtection(mbi.Protect))
+				{
+					return false;
+				}
+			}
+		}
+
+		try
+		{
+			Marshal.Copy((nint)address, buffer, 0, buffer.Length);
+			return true;
+		}
+		catch
+		{
+			return false;
+		}
+	}
+
 	private string FormatPointerWithNearestSymbol(ulong value)
 	{
 		string text = $"0x{value:X16}";

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.NativeWorker.cs

@@ -92,7 +92,10 @@ public sealed partial class DirectExecutionBackend
 
 	private NativeGuestExecutor? RentNativeGuestExecutor()
 	{
-		if (NativeGuestWorkersDisabled)
+		// NativeGuestExecutor emits a Win32 wait loop and creates it with
+		// kernel32!CreateThread. POSIX hosts use the established inline entry
+		// path until the worker loop has a pthread/eventfd implementation.
+		if (!OperatingSystem.IsWindows() || NativeGuestWorkersDisabled)
 		{
 			return null;
 		}
@@ -185,8 +188,20 @@ public sealed partial class DirectExecutionBackend
 		private static nint _exitThreadAddress;
 
 		private readonly DirectExecutionBackend _backend;
-		private readonly AutoResetEvent _workAvailable = new(false);
-		private readonly AutoResetEvent _workCompleted = new(false);
+		// Windows uses AutoResetEvent (its SafeWaitHandle is a real kernel
+		// event the emitted loop can wait on); POSIX uses worker-event
+		// semaphores shared the same way via PosixHostStubs.
+		private readonly AutoResetEvent? _workAvailable;
+		private readonly AutoResetEvent? _workCompleted;
+		private nint _workSemaphore;
+		private nint _doneSemaphore;
+
+		// RunPrologue/RunEpilogue compile to the host ABI (SysV on POSIX); the
+		// emitted loop calls them with Win64 registers, so POSIX routes the
+		// calls through register-shuffling thunks (shared by all workers).
+		private static nint _posixPrologueThunk;
+		private static nint _posixEpilogueThunk;
+		private static readonly object PosixThunkGate = new();
 		private GCHandle _selfHandle;
 		private void* _controlBlock;
 		private void* _loopStub;
@@ -225,6 +240,11 @@ public sealed partial class DirectExecutionBackend
 		private NativeGuestExecutor(DirectExecutionBackend backend)
 		{
 			_backend = backend;
+			if (OperatingSystem.IsWindows())
+			{
+				_workAvailable = new AutoResetEvent(false);
+				_workCompleted = new AutoResetEvent(false);
+			}
 		}
 
 		public static NativeGuestExecutor? TryCreate(DirectExecutionBackend backend)
@@ -276,8 +296,34 @@ public sealed partial class DirectExecutionBackend
 			var prologuePtr = (nint)(delegate* unmanaged<nint, nint>)&RunPrologue;
 			var epiloguePtr = (nint)(delegate* unmanaged<nint, int, void>)&RunEpilogue;
 			var executorHandle = GCHandle.ToIntPtr(_selfHandle);
-			var workHandle = _workAvailable.SafeWaitHandle.DangerousGetHandle();
-			var doneHandle = _workCompleted.SafeWaitHandle.DangerousGetHandle();
+			nint workHandle;
+			nint doneHandle;
+			if (OperatingSystem.IsWindows())
+			{
+				workHandle = _workAvailable!.SafeWaitHandle.DangerousGetHandle();
+				doneHandle = _workCompleted!.SafeWaitHandle.DangerousGetHandle();
+			}
+			else
+			{
+				lock (PosixThunkGate)
+				{
+					if (_posixPrologueThunk == 0)
+					{
+						_posixPrologueThunk = PosixHostStubs.CreateWin64ToSysVThunk(prologuePtr);
+						_posixEpilogueThunk = PosixHostStubs.CreateWin64ToSysVThunk(epiloguePtr);
+					}
+				}
+				prologuePtr = _posixPrologueThunk;
+				epiloguePtr = _posixEpilogueThunk;
+				_workSemaphore = PosixHostStubs.CreateWorkerEvent();
+				_doneSemaphore = PosixHostStubs.CreateWorkerEvent();
+				if (_workSemaphore == 0 || _doneSemaphore == 0)
+				{
+					return false;
+				}
+				workHandle = _workSemaphore;
+				doneHandle = _doneSemaphore;
+			}
 
 			byte* code = (byte*)_loopStub;
 			int offset = 0;
@@ -397,8 +443,8 @@ public sealed partial class DirectExecutionBackend
 			_runYieldRequested = false;
 			_runYieldReason = null;
 			_runForcedExit = false;
-			_workAvailable.Set();
-			_workCompleted.WaitOne();
+			SignalWorkAvailable();
+			WaitWorkCompleted();
 			_runContext = null;
 			_runState = null;
 			yieldRequested = _runYieldRequested;
@@ -411,6 +457,28 @@ public sealed partial class DirectExecutionBackend
 			return _runNativeResult;
 		}
 
+		private void SignalWorkAvailable()
+		{
+			if (_workAvailable is not null)
+			{
+				_workAvailable.Set();
+				return;
+			}
+
+			_ = PosixHostStubs.SignalWorkerEvent(_workSemaphore);
+		}
+
+		private void WaitWorkCompleted()
+		{
+			if (_workCompleted is not null)
+			{
+				_workCompleted.WaitOne();
+				return;
+			}
+
+			_ = PosixHostStubs.WaitWorkerEvent(_doneSemaphore, -1);
+		}
+
 		[UnmanagedCallersOnly]
 		private static nint RunPrologue(nint executorHandle)
 		{
@@ -540,7 +608,7 @@ public sealed partial class DirectExecutionBackend
 			}
 			try
 			{
-				_workAvailable.Set();
+				SignalWorkAvailable();
 			}
 			catch (ObjectDisposedException)
 			{
@@ -575,8 +643,18 @@ public sealed partial class DirectExecutionBackend
 			{
 				_selfHandle.Free();
 			}
-			_workAvailable.Dispose();
-			_workCompleted.Dispose();
+			_workAvailable?.Dispose();
+			_workCompleted?.Dispose();
+			if (_workSemaphore != 0)
+			{
+				PosixHostStubs.DestroyWorkerEvent(_workSemaphore);
+				_workSemaphore = 0;
+			}
+			if (_doneSemaphore != 0)
+			{
+				PosixHostStubs.DestroyWorkerEvent(_doneSemaphore);
+				_doneSemaphore = 0;
+			}
 		}
 	}
 }

src/SharpEmu.Core/Cpu/Native/DirectExecutionBackend.PosixSignals.cs

@@ -0,0 +1,409 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System;
+using System.Runtime.InteropServices;
+using System.Threading;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Core.Cpu.Native;
+
+public sealed unsafe partial class DirectExecutionBackend
+{
+	// POSIX bridge for the Windows vectored-exception-handler logic. A
+	// sigaction(SIGSEGV/SIGBUS/SIGILL) handler rebuilds the EXCEPTION_POINTERS
+	// view the shared handlers expect (Win64 CONTEXT register offsets) from
+	// the signal's mcontext, runs the same recovery chain the VEH path uses
+	// (unresolved-import trap sentinels, demand-paging of lazily-committed
+	// guest pages, fault diagnostics), and writes register changes back into
+	// the mcontext so sigreturn resumes the repaired guest. Unrecovered
+	// faults are forwarded to the previously installed handler so the .NET
+	// runtime keeps turning its own faults into managed exceptions.
+
+	private const int PosixSigIll = 4;
+	private const int PosixSigTrap = 5;
+	private const int PosixSigAbort = 6;
+	private const int PosixSigSegv = 11;
+	private static readonly int PosixSigBus = OperatingSystem.IsMacOS() ? 10 : 7;
+
+	// struct sigaction: the handler pointer leads on both platforms; Darwin
+	// packs { handler(8), mask(4), flags(4) }, Linux glibc/musl packs
+	// { handler(8), mask(128), flags(4), restorer(8) }.
+	private static readonly int PosixSigactionSize = OperatingSystem.IsMacOS() ? 16 : 152;
+	private static readonly int PosixSigactionFlagsOffset = OperatingSystem.IsMacOS() ? 12 : 136;
+
+	private static readonly int PosixSaSigInfo = OperatingSystem.IsMacOS() ? 0x0040 : 0x0004;
+	private static readonly int PosixSaNoDefer = OperatingSystem.IsMacOS() ? 0x0010 : 0x40000000;
+
+	// siginfo_t.si_addr: Darwin { signo, errno, code, pid, uid, status, addr },
+	// Linux { signo, errno, code, pad32, addr }.
+	private static readonly int PosixSigInfoAddressOffset = OperatingSystem.IsMacOS() ? 24 : 16;
+
+	// Darwin ucontext_t stores a pointer to __darwin_mcontext64 at +48; the
+	// general registers live in its __ss thread state after the 16-byte
+	// exception state. Linux glibc embeds mcontext_t inline at +40 with the
+	// registers in gregs[23]. Rosetta 2 delivers the regular x86-64 layout
+	// to translated processes.
+	private const int DarwinUcontextMcontextOffset = 48;
+	private const int DarwinMcontextErrOffset = 4;
+	private const int DarwinMcontextFaultAddressOffset = 8;
+	private const int LinuxUcontextGregsOffset = 40;
+	private const int LinuxGregsErrOffset = 19 * 8;
+
+	// Byte offsets of the general registers relative to GetPosixRegisterBase,
+	// ordered to match the contiguous Win64 CONTEXT block CTX_RAX..CTX_RIP
+	// (rax, rcx, rdx, rbx, rsp, rbp, rsi, rdi, r8..r15, rip). Verified
+	// against the x86-64 platform headers.
+	private static readonly int[] PosixRegisterOffsets = OperatingSystem.IsMacOS()
+		? new[] { 16, 32, 40, 24, 72, 64, 56, 48, 80, 88, 96, 104, 112, 120, 128, 136, 144 }
+		: new[] { 104, 112, 96, 88, 120, 80, 72, 64, 0, 8, 16, 24, 32, 40, 48, 56, 128 };
+
+	private static DirectExecutionBackend? _posixSignalBackend;
+	private static bool _posixSignalHandlersInstalled;
+	private static bool _posixRawRecoveryEnabled;
+	private static bool _posixSignalWarmup;
+	private static readonly nint[] _posixPreviousActions = new nint[32];
+	private static int _posixSignalTraceCount;
+	private static long _perfSignalCount;
+	private static readonly bool _perfSignalCounter =
+		string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_PERF_MEM"), "1", StringComparison.Ordinal);
+
+	[ThreadStatic]
+	private static int _posixSignalHandlerDepth;
+
+	private void SetupPosixExceptionHandler()
+	{
+		if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_POSIX_SIGNALS"), "1", StringComparison.Ordinal))
+		{
+			Console.Error.WriteLine("[LOADER][WARN] POSIX signal exception bridge disabled by SHARPEMU_DISABLE_POSIX_SIGNALS=1; guest faults will not be recovered.");
+			return;
+		}
+
+		_posixSignalBackend = this;
+		if (_posixSignalHandlersInstalled)
+		{
+			return;
+		}
+
+		_posixRawRecoveryEnabled = !string.Equals(
+			Environment.GetEnvironmentVariable("SHARPEMU_DISABLE_RAW_HANDLER"), "1", StringComparison.Ordinal);
+		if (!_posixRawRecoveryEnabled)
+		{
+			Console.Error.WriteLine("[LOADER][INFO] Raw sentinel recovery disabled by SHARPEMU_DISABLE_RAW_HANDLER=1");
+		}
+
+		WarmUpPosixSignalPath();
+		SharpEmu.HLE.GuestImageWriteTracker.WarmUp();
+
+		if (!InstallPosixSignalHandler(PosixSigSegv) ||
+			!InstallPosixSignalHandler(PosixSigBus) ||
+			!InstallPosixSignalHandler(PosixSigIll) ||
+			!InstallPosixSignalHandler(PosixSigTrap) ||
+			!InstallPosixSignalHandler(PosixSigAbort))
+		{
+			throw new InvalidOperationException("Failed to install POSIX fault signal handlers");
+		}
+
+		_posixSignalHandlersInstalled = true;
+		Console.Error.WriteLine("[LOADER][INFO] POSIX signal exception bridge installed (SIGSEGV/SIGBUS/SIGILL)");
+	}
+
+	/// <summary>
+	/// Runs the signal-recovery path once with fabricated inputs before the
+	/// handlers are installed. The first entry into the handler must not
+	/// require JIT compilation (a fault can interrupt arbitrary runtime
+	/// states), and under Rosetta 2 the signal trampoline cannot enter x86
+	/// code that has never been executed (and therefore never translated): a
+	/// cold handler is silently never invoked and the faulting instruction
+	/// retries forever.
+	/// </summary>
+	private void WarmUpPosixSignalPath()
+	{
+		byte* fakeUcontext = stackalloc byte[512];
+		new Span<byte>(fakeUcontext, 512).Clear();
+		byte* fakeMcontext = stackalloc byte[512];
+		new Span<byte>(fakeMcontext, 512).Clear();
+		if (OperatingSystem.IsMacOS())
+		{
+			*(byte**)(fakeUcontext + DarwinUcontextMcontextOffset) = fakeMcontext;
+		}
+
+		_posixSignalWarmup = true;
+		try
+		{
+			((delegate* unmanaged<int, nint, nint, void>)&HandlePosixSignal)(PosixSigSegv, 0, (nint)fakeUcontext);
+
+			// Warm the branches the fabricated fault above skips without
+			// spamming diagnostics: the benign-exception path through
+			// VectoredHandler, the lazy-commit probe (fault address 0 bails
+			// out immediately), and the chain helper (signal 0 has no saved
+			// action and sigaction(0, ...) fails with EINVAL).
+			EXCEPTION_RECORD record = default;
+			record.ExceptionCode = DBG_PRINTEXCEPTION_C;
+			byte* contextRecord = stackalloc byte[Win64ContextSize];
+			new Span<byte>(contextRecord, Win64ContextSize).Clear();
+			EXCEPTION_POINTERS pointers;
+			pointers.ExceptionRecord = &record;
+			pointers.ContextRecord = contextRecord;
+			_ = VectoredHandler(&pointers);
+
+			record.ExceptionCode = 3221225477u;
+			record.NumberParameters = 2;
+			// 0x70000 is never guest-owned, so this walks the vmem region
+			// scan and the PRT range check, then bails out silently.
+			record.ExceptionInformation[1] = 0x70000;
+			_ = TryHandleLazyCommittedPage(&record, 0, 0);
+			ChainPreviousPosixAction(0, 0, 0);
+		}
+		finally
+		{
+			_posixSignalWarmup = false;
+		}
+	}
+
+	private static bool InstallPosixSignalHandler(int signal)
+	{
+		byte* action = stackalloc byte[PosixSigactionSize];
+		new Span<byte>(action, PosixSigactionSize).Clear();
+		*(nint*)action = (nint)(delegate* unmanaged<int, nint, nint, void>)&HandlePosixSignal;
+		// No SA_ONSTACK: the runtime's alternate stacks are far too small for
+		// the recovery/diagnostic path (JIT compilation of cold handler code
+		// can run inside the signal frame). Guest faults deliver onto the 2MB
+		// guest stack, host faults onto the regular thread stack — the same
+		// stacks Windows dispatches exceptions on.
+		*(int*)(action + PosixSigactionFlagsOffset) = PosixSaSigInfo | PosixSaNoDefer;
+
+		var previous = (byte*)NativeMemory.AllocZeroed((nuint)PosixSigactionSize);
+		if (sigaction(signal, action, previous) != 0)
+		{
+			NativeMemory.Free(previous);
+			Console.Error.WriteLine($"[LOADER][ERROR] sigaction({signal}) failed: errno={Marshal.GetLastPInvokeError()}");
+			return false;
+		}
+
+		_posixPreviousActions[signal] = (nint)previous;
+		return true;
+	}
+
+	[UnmanagedCallersOnly]
+	private static void HandlePosixSignal(int signal, nint siginfo, nint ucontext)
+	{
+		if (_posixSignalHandlerDepth > 0)
+		{
+			// A fault inside our own fault handler (diagnostics touched an
+			// unmapped address): restore the default action and return so the
+			// re-executed instruction terminates the process.
+			RestoreDefaultPosixAction(signal);
+			return;
+		}
+
+		_posixSignalHandlerDepth++;
+		if (_perfSignalCounter)
+		{
+			var n = Interlocked.Increment(ref _perfSignalCount);
+			if (n % 100000 == 0)
+			{
+				Console.Error.WriteLine($"[PERF][MEM] posix_faults={n}");
+			}
+		}
+		try
+		{
+			// Guest-image write tracking runs first: it only needs the fault
+			// address (safe for host and guest threads alike) and must resume
+			// the faulting write immediately after restoring write access.
+			if (signal != PosixSigIll &&
+				siginfo != 0 &&
+				SharpEmu.HLE.GuestImageWriteTracker.TryHandleWriteFault(
+					*(ulong*)((byte*)siginfo + PosixSigInfoAddressOffset)))
+			{
+				return;
+			}
+
+			if (TryHandlePosixFault(signal, siginfo, ucontext))
+			{
+				return;
+			}
+		}
+		catch
+		{
+			// A managed exception must never unwind out of a signal frame.
+		}
+		finally
+		{
+			_posixSignalHandlerDepth--;
+		}
+
+		ChainPreviousPosixAction(signal, siginfo, ucontext);
+	}
+
+	private static bool TryHandlePosixFault(int signal, nint siginfo, nint ucontext)
+	{
+		byte* registers = GetPosixRegisterBase(ucontext);
+		if (registers == null)
+		{
+			return false;
+		}
+
+		byte* contextRecord = stackalloc byte[Win64ContextSize];
+		new Span<byte>(contextRecord, Win64ContextSize).Clear();
+		int[] offsets = PosixRegisterOffsets;
+		for (int i = 0; i < offsets.Length; i++)
+		{
+			WriteCtxU64(contextRecord, CTX_RAX + i * 8, *(ulong*)(registers + offsets[i]));
+		}
+
+		EXCEPTION_RECORD record = default;
+		record.ExceptionAddress = (void*)ReadCtxU64(contextRecord, CTX_RIP);
+		if (signal == PosixSigIll)
+		{
+			record.ExceptionCode = 3221225501u;
+		}
+		else if (signal == PosixSigTrap)
+		{
+			record.ExceptionCode = 2147483651u;
+		}
+		else if (signal == PosixSigAbort)
+		{
+			record.ExceptionCode = 1073741845u;
+		}
+		else
+		{
+			ulong faultAddress = GetPosixFaultAddress(siginfo, registers);
+			record.ExceptionCode = 3221225477u;
+			record.NumberParameters = 2;
+			record.ExceptionInformation[0] = GetPosixAccessType(registers, faultAddress, ReadCtxU64(contextRecord, CTX_RIP));
+			record.ExceptionInformation[1] = faultAddress;
+		}
+
+		EXCEPTION_POINTERS pointers;
+		pointers.ExceptionRecord = &record;
+		pointers.ContextRecord = contextRecord;
+
+		int traceIndex = _posixSignalWarmup ? 0 : Interlocked.Increment(ref _posixSignalTraceCount);
+		bool traceSignal = traceIndex > 0 && (traceIndex <= 16 || traceIndex % 1024 == 0 ||
+			string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_POSIX_SIGNALS"), "1", StringComparison.Ordinal));
+		if (traceSignal)
+		{
+			Console.Error.WriteLine(
+				$"[LOADER][TRACE] posix-signal#{traceIndex}: sig={signal} rip=0x{ReadCtxU64(contextRecord, CTX_RIP):X16} " +
+				$"fault=0x{record.ExceptionInformation[1]:X16} access={record.ExceptionInformation[0]} rsp=0x{ReadCtxU64(contextRecord, CTX_RSP):X16}");
+			Console.Error.Flush();
+		}
+
+		// Sentinel recovery runs first: on Windows both vectored handlers see
+		// every fault anyway, and recovering here avoids dumping the full
+		// VectoredHandler diagnostics for each recoverable trap.
+		int disposition = 0;
+		if (_posixRawRecoveryEnabled)
+		{
+			disposition = TryRecoverUnresolvedSentinel(&pointers);
+		}
+		if (disposition != -1 && !_posixSignalWarmup && _posixSignalBackend is { } backend)
+		{
+			disposition = backend.VectoredHandler(&pointers);
+		}
+		if (traceSignal)
+		{
+			Console.Error.WriteLine(
+				$"[LOADER][TRACE] posix-signal#{traceIndex}: recovered={disposition == -1} new_rip=0x{ReadCtxU64(contextRecord, CTX_RIP):X16}");
+			Console.Error.Flush();
+		}
+		if (disposition != -1 && !_posixSignalWarmup)
+		{
+			return false;
+		}
+
+		for (int i = 0; i < offsets.Length; i++)
+		{
+			*(ulong*)(registers + offsets[i]) = ReadCtxU64(contextRecord, CTX_RAX + i * 8);
+		}
+		return true;
+	}
+
+	private static byte* GetPosixRegisterBase(nint ucontext)
+	{
+		if (ucontext == 0)
+		{
+			return null;
+		}
+
+		if (OperatingSystem.IsMacOS())
+		{
+			return *(byte**)((byte*)ucontext + DarwinUcontextMcontextOffset);
+		}
+
+		return (byte*)ucontext + LinuxUcontextGregsOffset;
+	}
+
+	private static ulong GetPosixFaultAddress(nint siginfo, byte* registers)
+	{
+		ulong address = siginfo != 0 ? *(ulong*)((byte*)siginfo + PosixSigInfoAddressOffset) : 0;
+		if (address == 0 && OperatingSystem.IsMacOS())
+		{
+			address = *(ulong*)(registers + DarwinMcontextFaultAddressOffset);
+		}
+
+		return address;
+	}
+
+	private static ulong GetPosixAccessType(byte* registers, ulong faultAddress, ulong rip)
+	{
+		// x86 page-fault error code: bit 1 = write access, bit 4 = instruction
+		// fetch. Fall back to comparing the fault address against RIP when
+		// the error code is not populated (e.g. under Rosetta 2 translation).
+		ulong error = OperatingSystem.IsMacOS()
+			? *(uint*)(registers + DarwinMcontextErrOffset)
+			: *(ulong*)(registers + LinuxGregsErrOffset);
+		if ((error & 0x10) != 0)
+		{
+			return 8;
+		}
+		if ((error & 0x2) != 0)
+		{
+			return 1;
+		}
+
+		return faultAddress != 0 && faultAddress == rip ? 8u : 0u;
+	}
+
+	private static void RestoreDefaultPosixAction(int signal)
+	{
+		byte* action = stackalloc byte[PosixSigactionSize];
+		new Span<byte>(action, PosixSigactionSize).Clear();
+		_ = sigaction(signal, action, null);
+	}
+
+	private static void ChainPreviousPosixAction(int signal, nint siginfo, nint ucontext)
+	{
+		byte* previous = (uint)signal < (uint)_posixPreviousActions.Length
+			? (byte*)_posixPreviousActions[signal]
+			: null;
+		nint handler = previous != null ? *(nint*)previous : 0;
+		if (handler == 0)
+		{
+			// SIG_DFL (or nothing saved): reinstate the default action and
+			// return, so re-executing the faulting instruction terminates the
+			// process with the original fault context intact.
+			RestoreDefaultPosixAction(signal);
+			return;
+		}
+		if (handler == 1)
+		{
+			// SIG_IGN
+			return;
+		}
+
+		int flags = *(int*)(previous + PosixSigactionFlagsOffset);
+		if ((flags & PosixSaSigInfo) != 0)
+		{
+			((delegate* unmanaged<int, nint, nint, void>)handler)(signal, siginfo, ucontext);
+		}
+		else
+		{
+			((delegate* unmanaged<int, void>)handler)(signal);
+		}
+	}
+
+	[DllImport("libc", SetLastError = true)]
+	private static extern int sigaction(int signum, void* act, void* oldact);
+}

src/SharpEmu.Core/Cpu/Native/NullHostFaultHandling.cs

@@ -0,0 +1,49 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using SharpEmu.HLE.Host;
+
+namespace SharpEmu.Core.Cpu.Native;
+
+/// <summary>
+/// Placeholder for hosts whose fault bridge is installed directly by the
+/// execution backend. POSIX uses its sigaction bridge and never calls these
+/// Windows-shaped registration methods.
+/// </summary>
+internal sealed class NullHostFaultHandling : IHostFaultHandling
+{
+    public static NullHostFaultHandling Instance { get; } = new();
+
+    private NullHostFaultHandling()
+    {
+    }
+
+    public nint CreateHandlerThunk(nint managedCallback, uint hostRspSwitchTlsSlot, nint tlsGetValueAddress)
+    {
+        _ = managedCallback;
+        _ = hostRspSwitchTlsSlot;
+        _ = tlsGetValueAddress;
+        return 0;
+    }
+
+    public void FreeThunk(nint thunk)
+    {
+        _ = thunk;
+    }
+
+    public nint AddFirstChanceHandler(nint thunk)
+    {
+        _ = thunk;
+        return 0;
+    }
+
+    public void RemoveHandler(nint handle)
+    {
+        _ = handle;
+    }
+
+    public void SetUnhandledFilter(nint thunk)
+    {
+        _ = thunk;
+    }
+}

src/SharpEmu.Core/Cpu/Native/PosixHostStubs.cs

@@ -0,0 +1,425 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+using SharpEmu.HLE;
+
+namespace SharpEmu.Core.Cpu.Native;
+
+/// <summary>
+/// POSIX replacements for the kernel32 helpers the native backend embeds in
+/// emitted x86-64 code. Every stub exposed here follows the Win64 calling
+/// convention the emitted call sites were written for (first argument in
+/// ECX, result in RAX, Win64 non-volatile registers preserved), so the
+/// emission code stays identical across platforms.
+/// </summary>
+internal static unsafe class PosixHostStubs
+{
+    private static readonly object Gate = new();
+    private static bool _initialized;
+    private static nint _tlsGetValueStub;
+    private static nint _queryPerformanceCounterStub;
+    private static nint _switchToThreadStub;
+    private static nint _sleepStub;
+
+    public static nint TlsGetValueStubAddress
+    {
+        get { EnsureInitialized(); return _tlsGetValueStub; }
+    }
+
+    public static nint QueryPerformanceCounterStubAddress
+    {
+        get { EnsureInitialized(); return _queryPerformanceCounterStub; }
+    }
+
+    public static nint SwitchToThreadStubAddress
+    {
+        get { EnsureInitialized(); return _switchToThreadStub; }
+    }
+
+    public static nint SleepStubAddress
+    {
+        get { EnsureInitialized(); return _sleepStub; }
+    }
+
+    public static nint CreateWorkerEvent()
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            return dispatch_semaphore_create(0);
+        }
+
+        var semaphore = Marshal.AllocHGlobal(64);
+        if (sem_init(semaphore, 0, 0) != 0)
+        {
+            Marshal.FreeHGlobal(semaphore);
+            return 0;
+        }
+
+        return semaphore;
+    }
+
+    public static bool SignalWorkerEvent(nint handle)
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            _ = dispatch_semaphore_signal(handle);
+            return true;
+        }
+
+        return sem_post(handle) == 0;
+    }
+
+    public static bool WaitWorkerEvent(nint handle, int timeoutMilliseconds)
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            if (timeoutMilliseconds < 0)
+            {
+                return dispatch_semaphore_wait(handle, ulong.MaxValue) == 0;
+            }
+
+            var deadline = dispatch_time(0, timeoutMilliseconds * 1_000_000L);
+            return dispatch_semaphore_wait(handle, deadline) == 0;
+        }
+
+        if (timeoutMilliseconds < 0)
+        {
+            while (sem_wait(handle) != 0)
+            {
+            }
+
+            return true;
+        }
+
+        var deadlineTicks = Environment.TickCount64 + timeoutMilliseconds;
+        while (sem_trywait(handle) != 0)
+        {
+            if (Environment.TickCount64 >= deadlineTicks)
+            {
+                return false;
+            }
+
+            Thread.Sleep(1);
+        }
+
+        return true;
+    }
+
+    public static void DestroyWorkerEvent(nint handle)
+    {
+        if (handle == 0)
+        {
+            return;
+        }
+
+        if (OperatingSystem.IsMacOS())
+        {
+            dispatch_release(handle);
+            return;
+        }
+
+        _ = sem_destroy(handle);
+        Marshal.FreeHGlobal(handle);
+    }
+
+    /// <summary>Allocates a pthread TLS key, mirroring kernel32!TlsAlloc.</summary>
+    public static uint TlsAlloc()
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            nuint key;
+            return pthread_key_create_mac(&key, 0) == 0 ? (uint)key : uint.MaxValue;
+        }
+
+        uint key32;
+        return pthread_key_create_linux(&key32, 0) == 0 ? key32 : uint.MaxValue;
+    }
+
+    public static bool TlsFree(uint key)
+    {
+        return OperatingSystem.IsMacOS()
+            ? pthread_key_delete_mac((nuint)key) == 0
+            : pthread_key_delete_linux(key) == 0;
+    }
+
+    public static bool TlsSetValue(uint key, nint value)
+    {
+        return OperatingSystem.IsMacOS()
+            ? pthread_setspecific_mac((nuint)key, value) == 0
+            : pthread_setspecific_linux(key, value) == 0;
+    }
+
+    public static nint TlsGetValue(uint key)
+    {
+        return OperatingSystem.IsMacOS()
+            ? pthread_getspecific_mac((nuint)key)
+            : pthread_getspecific_linux(key);
+    }
+
+    /// <summary>Stable numeric id of the calling thread (kernel32!GetCurrentThreadId).</summary>
+    public static uint GetCurrentThreadId()
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            ulong tid;
+            return pthread_threadid_np(0, &tid) == 0 ? unchecked((uint)tid) : 0u;
+        }
+
+        return unchecked((uint)gettid());
+    }
+
+    /// <summary>
+    /// Wraps a managed callback (compiled for the SysV ABI on POSIX .NET) in a
+    /// thunk that accepts up to four integer arguments in the Win64 ABI the
+    /// emitted x86-64 call sites use. Win64 passes args in rcx/rdx/r8/r9 and
+    /// treats rdi/rsi as non-volatile; SysV expects rdi/rsi/rdx/rcx and
+    /// clobbers them, so the thunk saves rdi/rsi, shuffles the registers, keeps
+    /// the stack 16-byte aligned for the call, and forwards the rax result.
+    /// </summary>
+    public static nint CreateWin64ToSysVThunk(nint sysvTarget)
+    {
+        var page = (byte*)HostMemory.Alloc(
+            null,
+            4096,
+            HostMemory.MEM_COMMIT | HostMemory.MEM_RESERVE,
+            HostMemory.PAGE_EXECUTE_READWRITE);
+        if (page == null)
+        {
+            throw new OutOfMemoryException("Failed to allocate Win64->SysV thunk page");
+        }
+
+        var offset = 0;
+        Emit(page, ref offset, 0x57);                   // push rdi
+        Emit(page, ref offset, 0x56);                   // push rsi
+        Emit(page, ref offset, 0x48, 0x89, 0xCF);       // mov rdi, rcx
+        Emit(page, ref offset, 0x48, 0x89, 0xD6);       // mov rsi, rdx
+        Emit(page, ref offset, 0x4C, 0x89, 0xC2);       // mov rdx, r8
+        Emit(page, ref offset, 0x4C, 0x89, 0xC9);       // mov rcx, r9
+        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08); // sub rsp, 8 (realign to 16)
+        EmitMovRaxImm64(page, ref offset, sysvTarget);  // mov rax, target
+        Emit(page, ref offset, 0xFF, 0xD0);             // call rax
+        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08); // add rsp, 8
+        Emit(page, ref offset, 0x5E);                   // pop rsi
+        Emit(page, ref offset, 0x5F);                   // pop rdi
+        Emit(page, ref offset, 0xC3);                   // ret
+
+        if (!HostMemory.Protect(page, 4096, HostMemory.PAGE_EXECUTE_READ, out _))
+        {
+            throw new InvalidOperationException("Failed to protect Win64->SysV thunk page");
+        }
+
+        HostMemory.FlushInstructionCache(page, (nuint)offset);
+        return (nint)page;
+    }
+
+    private static void EnsureInitialized()
+    {
+        if (_initialized)
+        {
+            return;
+        }
+
+        lock (Gate)
+        {
+            if (_initialized)
+            {
+                return;
+            }
+
+            BuildStubs();
+            _initialized = true;
+        }
+    }
+
+    private static void BuildStubs()
+    {
+        var page = (byte*)HostMemory.Alloc(
+            null,
+            4096,
+            HostMemory.MEM_COMMIT | HostMemory.MEM_RESERVE,
+            HostMemory.PAGE_EXECUTE_READWRITE);
+        if (page == null)
+        {
+            throw new OutOfMemoryException("Failed to allocate POSIX host helper stub page");
+        }
+
+        var offset = 0;
+        _tlsGetValueStub = EmitTlsGetValue(page, ref offset);
+        _queryPerformanceCounterStub = EmitQueryPerformanceCounter(page, ref offset);
+        _switchToThreadStub = EmitSwitchToThread(page, ref offset);
+        _sleepStub = EmitSleep(page, ref offset);
+
+        if (!HostMemory.Protect(page, 4096, HostMemory.PAGE_EXECUTE_READ, out _))
+        {
+            throw new InvalidOperationException("Failed to protect POSIX host helper stub page");
+        }
+
+        HostMemory.FlushInstructionCache(page, (nuint)offset);
+    }
+
+    private static nint EmitTlsGetValue(byte* page, ref int offset)
+    {
+        var start = (nint)(page + offset);
+        if (OperatingSystem.IsMacOS())
+        {
+            // On macOS x86-64 pthread keys index the gs-based thread specific
+            // data array directly, so TlsGetValue(index in ecx) collapses to a
+            // single load that clobbers nothing but RAX.
+            Emit(page, ref offset, 0x89, 0xC8);                                     // mov eax, ecx
+            Emit(page, ref offset, 0x65, 0x48, 0x8B, 0x04, 0xC5, 0, 0, 0, 0);       // mov rax, gs:[rax*8]
+            Emit(page, ref offset, 0xC3);                                           // ret
+            return start;
+        }
+
+        // Linux: call pthread_getspecific, preserving the registers that are
+        // volatile in SysV but non-volatile in Win64 (rsi, rdi).
+        var pthreadGetSpecific = ResolveLibcExport("pthread_getspecific");
+        Emit(page, ref offset, 0x56);                                               // push rsi
+        Emit(page, ref offset, 0x57);                                               // push rdi
+        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                             // sub rsp, 8
+        Emit(page, ref offset, 0x89, 0xCF);                                         // mov edi, ecx
+        EmitMovRaxImm64(page, ref offset, pthreadGetSpecific);                      // mov rax, imm64
+        Emit(page, ref offset, 0xFF, 0xD0);                                         // call rax
+        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08);                             // add rsp, 8
+        Emit(page, ref offset, 0x5F);                                               // pop rdi
+        Emit(page, ref offset, 0x5E);                                               // pop rsi
+        Emit(page, ref offset, 0xC3);                                               // ret
+        return start;
+    }
+
+    private static nint EmitQueryPerformanceCounter(byte* page, ref int offset)
+    {
+        // BOOL QueryPerformanceCounter(LARGE_INTEGER* out in rcx): the emitted
+        // consumers only need a monotonically increasing counter, which rdtsc
+        // provides without leaving Win64-safe registers.
+        var start = (nint)(page + offset);
+        Emit(page, ref offset, 0x0F, 0x31);                                         // rdtsc
+        Emit(page, ref offset, 0x48, 0xC1, 0xE2, 0x20);                             // shl rdx, 32
+        Emit(page, ref offset, 0x48, 0x09, 0xD0);                                   // or rax, rdx
+        Emit(page, ref offset, 0x48, 0x89, 0x01);                                   // mov [rcx], rax
+        Emit(page, ref offset, 0xB8, 0x01, 0x00, 0x00, 0x00);                       // mov eax, 1
+        Emit(page, ref offset, 0xC3);                                               // ret
+        return start;
+    }
+
+    private static nint EmitSwitchToThread(byte* page, ref int offset)
+    {
+        var schedYield = ResolveLibcExport("sched_yield");
+        var start = (nint)(page + offset);
+        Emit(page, ref offset, 0x56);                                               // push rsi
+        Emit(page, ref offset, 0x57);                                               // push rdi
+        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                             // sub rsp, 8
+        EmitMovRaxImm64(page, ref offset, schedYield);                              // mov rax, imm64
+        Emit(page, ref offset, 0xFF, 0xD0);                                         // call rax
+        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08);                             // add rsp, 8
+        Emit(page, ref offset, 0x5F);                                               // pop rdi
+        Emit(page, ref offset, 0x5E);                                               // pop rsi
+        Emit(page, ref offset, 0xB8, 0x01, 0x00, 0x00, 0x00);                       // mov eax, 1
+        Emit(page, ref offset, 0xC3);                                               // ret
+        return start;
+    }
+
+    private static nint EmitSleep(byte* page, ref int offset)
+    {
+        // void Sleep(DWORD milliseconds in ecx) -> usleep(microseconds in edi).
+        var usleep = ResolveLibcExport("usleep");
+        var start = (nint)(page + offset);
+        Emit(page, ref offset, 0x56);                                               // push rsi
+        Emit(page, ref offset, 0x57);                                               // push rdi
+        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                             // sub rsp, 8
+        Emit(page, ref offset, 0x89, 0xCF);                                         // mov edi, ecx
+        Emit(page, ref offset, 0x81, 0xFF, 0xFF, 0x0F, 0x00, 0x00);                 // cmp edi, 0xFFF
+        Emit(page, ref offset, 0x76, 0x05);                                         // jbe +5
+        Emit(page, ref offset, 0xBF, 0xFF, 0x0F, 0x00, 0x00);                       // mov edi, 0xFFF (cap at ~4s)
+        Emit(page, ref offset, 0x69, 0xFF, 0xE8, 0x03, 0x00, 0x00);                 // imul edi, edi, 1000
+        EmitMovRaxImm64(page, ref offset, usleep);                                  // mov rax, imm64
+        Emit(page, ref offset, 0xFF, 0xD0);                                         // call rax
+        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08);                             // add rsp, 8
+        Emit(page, ref offset, 0x5F);                                               // pop rdi
+        Emit(page, ref offset, 0x5E);                                               // pop rsi
+        Emit(page, ref offset, 0xC3);                                               // ret
+        return start;
+    }
+
+    private static nint ResolveLibcExport(string name)
+    {
+        var libc = NativeLibrary.Load(OperatingSystem.IsMacOS() ? "libSystem.dylib" : "libc.so.6");
+        return NativeLibrary.GetExport(libc, name);
+    }
+
+    private static void Emit(byte* page, ref int offset, params byte[] bytes)
+    {
+        foreach (var value in bytes)
+        {
+            page[offset++] = value;
+        }
+    }
+
+    private static void EmitMovRaxImm64(byte* page, ref int offset, nint value)
+    {
+        Emit(page, ref offset, 0x48, 0xB8);
+        *(long*)(page + offset) = value;
+        offset += sizeof(long);
+    }
+
+    [DllImport("libc", EntryPoint = "pthread_key_create", SetLastError = true)]
+    private static extern int pthread_key_create_mac(nuint* key, nint destructor);
+
+    [DllImport("libc", EntryPoint = "pthread_key_create", SetLastError = true)]
+    private static extern int pthread_key_create_linux(uint* key, nint destructor);
+
+    [DllImport("libc", EntryPoint = "pthread_key_delete")]
+    private static extern int pthread_key_delete_mac(nuint key);
+
+    [DllImport("libc", EntryPoint = "pthread_key_delete")]
+    private static extern int pthread_key_delete_linux(uint key);
+
+    [DllImport("libc", EntryPoint = "pthread_setspecific")]
+    private static extern int pthread_setspecific_mac(nuint key, nint value);
+
+    [DllImport("libc", EntryPoint = "pthread_setspecific")]
+    private static extern int pthread_setspecific_linux(uint key, nint value);
+
+    [DllImport("libc", EntryPoint = "pthread_getspecific")]
+    private static extern nint pthread_getspecific_mac(nuint key);
+
+    [DllImport("libc", EntryPoint = "pthread_getspecific")]
+    private static extern nint pthread_getspecific_linux(uint key);
+
+    [DllImport("libc")]
+    private static extern int pthread_threadid_np(nint thread, ulong* threadId);
+
+    [DllImport("libc")]
+    private static extern int gettid();
+
+    [DllImport("libc")]
+    private static extern nint dispatch_semaphore_create(long value);
+
+    [DllImport("libc")]
+    private static extern nint dispatch_semaphore_signal(nint semaphore);
+
+    [DllImport("libc")]
+    private static extern nint dispatch_semaphore_wait(nint semaphore, ulong timeout);
+
+    [DllImport("libc")]
+    private static extern ulong dispatch_time(ulong when, long deltaNanoseconds);
+
+    [DllImport("libc")]
+    private static extern void dispatch_release(nint handle);
+
+    [DllImport("libc")]
+    private static extern int sem_init(nint semaphore, int shared, uint value);
+
+    [DllImport("libc")]
+    private static extern int sem_post(nint semaphore);
+
+    [DllImport("libc")]
+    private static extern int sem_wait(nint semaphore);
+
+    [DllImport("libc")]
+    private static extern int sem_trywait(nint semaphore);
+
+    [DllImport("libc")]
+    private static extern int sem_destroy(nint semaphore);
+}

src/SharpEmu.Core/Cpu/Native/StubManager.cs

@@ -194,11 +194,11 @@ public sealed unsafe class StubManager : IDisposable
         _stubAddresses.Clear();
     }
 
-    [DllImport("kernel32.dll", SetLastError = true)]
-    private static extern void* VirtualAlloc(void* lpAddress, nuint dwSize, AllocationType flAllocationType, MemoryProtection flProtect);
+    private static void* VirtualAlloc(void* lpAddress, nuint dwSize, AllocationType flAllocationType, MemoryProtection flProtect) =>
+        HostMemory.Alloc(lpAddress, dwSize, (uint)flAllocationType, (uint)flProtect);
 
-    [DllImport("kernel32.dll", SetLastError = true)]
-    private static extern bool VirtualFree(void* lpAddress, nuint dwSize, FreeType dwFreeType);
+    private static bool VirtualFree(void* lpAddress, nuint dwSize, FreeType dwFreeType) =>
+        HostMemory.Free(lpAddress, dwSize, (uint)dwFreeType);
 
     [Flags]
     private enum AllocationType : uint

src/SharpEmu.Core/Cpu/Native/Windows/Win64ContextOffsets.cs

@@ -0,0 +1,33 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.Core.Cpu.Native.Windows;
+
+/// <summary>
+/// Byte offsets into the Win64 CONTEXT record delivered to vectored exception
+/// handlers. The handlers read/write guest registers directly at these offsets
+/// (no managed CONTEXT struct exists); a future POSIX backend gets a sibling
+/// class for its mcontext layout.
+/// </summary>
+internal static class Win64ContextOffsets
+{
+    public const int Size = 0x4D0;
+    public const int Mxcsr = 52;
+    public const int Rax = 120;
+    public const int Rcx = 128;
+    public const int Rdx = 136;
+    public const int Rbx = 144;
+    public const int Rsp = 152;
+    public const int Rbp = 160;
+    public const int Rsi = 168;
+    public const int Rdi = 176;
+    public const int R8 = 184;
+    public const int R9 = 192;
+    public const int R10 = 200;
+    public const int R11 = 208;
+    public const int R12 = 216;
+    public const int R13 = 224;
+    public const int R14 = 232;
+    public const int R15 = 240;
+    public const int Rip = 248;
+}

src/SharpEmu.Core/Cpu/Native/Windows/WindowsFaultCodes.cs

@@ -0,0 +1,24 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.Core.Cpu.Native.Windows;
+
+/// <summary>
+/// Windows NTSTATUS exception codes and EXCEPTION_RECORD access-type values the
+/// fault handlers filter on. Values are the same numbers the handlers previously
+/// compared as bare literals; only the spelling changed.
+/// </summary>
+internal static class WindowsFaultCodes
+{
+    public const uint AccessViolation = 0xC0000005u;         // 3221225477
+    public const uint Breakpoint = 0x80000003u;              // 2147483651
+    public const uint IllegalInstruction = 0xC000001Du;      // 3221225501
+    public const uint FastFail = 0xC0000409u;                // 3221226505
+    public const uint StackOverflow = 0xC00000FDu;
+    public const uint ClrManagedException = 0xE0434352u;
+
+    // EXCEPTION_RECORD.ExceptionInformation[0] for access violations.
+    public const ulong AccessRead = 0;
+    public const ulong AccessWrite = 1;
+    public const ulong AccessExecute = 8;
+}

src/SharpEmu.Core/Cpu/Native/Windows/WindowsFaultHandling.cs

@@ -0,0 +1,191 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+using SharpEmu.HLE.Host;
+
+namespace SharpEmu.Core.Cpu.Native.Windows;
+
+/// <summary>
+/// Vectored-exception-handler installation and the handler pre-filter thunk.
+/// The thunk is inherently Windows-shaped (TEB stack-limit reads via gs:,
+/// NTSTATUS pre-filtering, Win64 calling convention) and moved here whole from
+/// DirectExecutionBackend; a POSIX backend supplies a sibling built around
+/// sigaction/sigaltstack instead.
+/// </summary>
+internal sealed unsafe partial class WindowsFaultHandling : IHostFaultHandling
+{
+    private readonly IHostMemory _memory;
+
+    public WindowsFaultHandling(IHostMemory memory)
+    {
+        _memory = memory;
+    }
+
+    public nint CreateHandlerThunk(nint managedCallback, uint hostRspSwitchTlsSlot, nint tlsGetValueAddress)
+    {
+        const uint stubSize = 256u;
+        void* ptr = (void*)_memory.Allocate(0, stubSize, HostPageProtection.ReadWriteExecute);
+        if (ptr == null)
+        {
+            return 0;
+        }
+
+        byte* code = (byte*)ptr;
+        int offset = 0;
+        // Native pre-filter: these exception codes are raised while the thread can be in
+        // cooperative GC mode (a C# throw is RaiseException(0xE0434352) on the throwing
+        // thread; FailFast/stack-overflow arrive mid-runtime-failure). Entering the managed
+        // handler then trips the CLR's reverse-P/Invoke check and kills the process with
+        // "Invalid Program: attempted to call a UnmanagedCallersOnly method from managed
+        // code" — this is why no managed throw (even one with a catch handler) ever
+        // survived inside the emulator. Continue the handler search without touching
+        // managed code; the CLR's own VEH handles its exceptions. MSVC C++ exceptions
+        // (Vulkan drivers, host CRT) are excluded too: the managed handler only ever
+        // returned CONTINUE_SEARCH for them.
+        ReadOnlySpan<uint> nonManagedExceptionCodes =
+            [WindowsFaultCodes.ClrManagedException, 0xE06D7363u, WindowsFaultCodes.FastFail, WindowsFaultCodes.StackOverflow];
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x01); // mov rax, [rcx] (ExceptionRecord*)
+        EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x00);                                   // mov eax, [rax] (ExceptionCode)
+        var passJumpOffsets = stackalloc int[nonManagedExceptionCodes.Length];
+        for (int i = 0; i < nonManagedExceptionCodes.Length; i++)
+        {
+            EmitByte(code, ref offset, 0x3D);                                                                 // cmp eax, imm32
+            EmitUInt32(code, ref offset, nonManagedExceptionCodes[i]);
+            EmitByte(code, ref offset, 0x74);                                                                 // je pass
+            passJumpOffsets[i] = offset;
+            EmitByte(code, ref offset, 0x00);
+        }
+        EmitByte(code, ref offset, 0xEB); EmitByte(code, ref offset, 0x03);                                   // jmp over pass block
+        int passOffset = offset;
+        EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0);                                   // pass: xor eax, eax (EXCEPTION_CONTINUE_SEARCH)
+        EmitByte(code, ref offset, 0xC3);                                                                     // ret
+        for (int i = 0; i < nonManagedExceptionCodes.Length; i++)
+        {
+            code[passJumpOffsets[i]] = checked((byte)(passOffset - (passJumpOffsets[i] + 1)));
+        }
+        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x54); // push r12
+        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x55); // push r13
+        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE4); // mov r12, rsp
+        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xCD); // mov r13, rcx
+        EmitByte(code, ref offset, 0x65); EmitByte(code, ref offset, 0x48); // mov rax, gs:[8]
+        EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x04); EmitByte(code, ref offset, 0x25);
+        EmitUInt32(code, ref offset, 8u);
+        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x39); EmitByte(code, ref offset, 0xC4); // cmp r12, rax
+        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x83); // jae guestStack
+        int aboveStackJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+        EmitByte(code, ref offset, 0x65); EmitByte(code, ref offset, 0x48); // mov rax, gs:[0x10]
+        EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x04); EmitByte(code, ref offset, 0x25);
+        EmitUInt32(code, ref offset, 0x10u);
+        EmitByte(code, ref offset, 0x49); EmitByte(code, ref offset, 0x39); EmitByte(code, ref offset, 0xC4); // cmp r12, rax
+        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x82); // jb guestStack
+        int belowStackJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE9); // mov rcx, r13
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+        *(nint*)(code + offset) = managedCallback;
+        offset += sizeof(nint);
+        EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0xE9);
+        int hostRestoreJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+
+        int guestStackOffset = offset;
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0xB9);
+        EmitUInt32(code, ref offset, hostRspSwitchTlsSlot);
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+        *(nint*)(code + offset) = tlsGetValueAddress;
+        offset += sizeof(nint);
+        EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x85); EmitByte(code, ref offset, 0xC0); // test rax, rax
+        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
+        int missingTlsJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x8B); EmitByte(code, ref offset, 0x18); // mov r11, [rax]
+        EmitByte(code, ref offset, 0x4D); EmitByte(code, ref offset, 0x85); EmitByte(code, ref offset, 0xDB); // test r11, r11
+        EmitByte(code, ref offset, 0x0F); EmitByte(code, ref offset, 0x84);
+        int missingHostStackJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xDC); // mov rsp, r11
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xEC); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE9); // mov rcx, r13
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0xB8);
+        *(nint*)(code + offset) = managedCallback;
+        offset += sizeof(nint);
+        EmitByte(code, ref offset, 0xFF); EmitByte(code, ref offset, 0xD0);
+        EmitByte(code, ref offset, 0x48); EmitByte(code, ref offset, 0x83); EmitByte(code, ref offset, 0xC4); EmitByte(code, ref offset, 0x28);
+        EmitByte(code, ref offset, 0xE9);
+        int guestRestoreJump = offset;
+        EmitUInt32(code, ref offset, 0u);
+
+        int passThroughOffset = offset;
+        EmitByte(code, ref offset, 0x31); EmitByte(code, ref offset, 0xC0); // xor eax, eax
+        int restoreOffset = offset;
+        EmitByte(code, ref offset, 0x4C); EmitByte(code, ref offset, 0x89); EmitByte(code, ref offset, 0xE4); // mov rsp, r12
+        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5D);
+        EmitByte(code, ref offset, 0x41); EmitByte(code, ref offset, 0x5C);
+        EmitByte(code, ref offset, 0xC3);
+
+        *(int*)(code + aboveStackJump) = guestStackOffset - (aboveStackJump + sizeof(int));
+        *(int*)(code + belowStackJump) = guestStackOffset - (belowStackJump + sizeof(int));
+        *(int*)(code + hostRestoreJump) = restoreOffset - (hostRestoreJump + sizeof(int));
+        *(int*)(code + missingTlsJump) = passThroughOffset - (missingTlsJump + sizeof(int));
+        *(int*)(code + missingHostStackJump) = passThroughOffset - (missingHostStackJump + sizeof(int));
+        *(int*)(code + guestRestoreJump) = restoreOffset - (guestRestoreJump + sizeof(int));
+
+        if (!_memory.Protect((ulong)ptr, stubSize, HostPageProtection.ReadExecute, out _))
+        {
+            Console.Error.WriteLine($"[LOADER][ERROR] VirtualProtect failed for exception handler trampoline at 0x{(nint)ptr:X16}");
+            _ = _memory.Free((ulong)ptr);
+            return 0;
+        }
+        _memory.FlushInstructionCache((ulong)ptr, (ulong)offset);
+        return (nint)ptr;
+    }
+
+    public void FreeThunk(nint thunk)
+    {
+        _ = _memory.Free((ulong)thunk);
+    }
+
+    public nint AddFirstChanceHandler(nint thunk)
+    {
+        return (nint)AddVectoredExceptionHandler(1u, thunk);
+    }
+
+    public void RemoveHandler(nint handle)
+    {
+        _ = RemoveVectoredExceptionHandler((void*)handle);
+    }
+
+    public void SetUnhandledFilter(nint thunk)
+    {
+        _ = SetUnhandledExceptionFilter(thunk);
+    }
+
+    private static void EmitByte(byte* code, ref int offset, byte value)
+    {
+        code[offset++] = value;
+    }
+
+    private static void EmitUInt32(byte* code, ref int offset, uint value)
+    {
+        *(uint*)(code + offset) = value;
+        offset += sizeof(uint);
+    }
+
+    [LibraryImport("kernel32.dll")]
+    private static partial void* AddVectoredExceptionHandler(uint first, IntPtr handler);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial uint RemoveVectoredExceptionHandler(void* handle);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial IntPtr SetUnhandledExceptionFilter(IntPtr lpTopLevelExceptionFilter);
+}

src/SharpEmu.Core/Cpu/TrackedCpuMemory.cs

@@ -5,7 +5,7 @@ using SharpEmu.HLE;
 
 namespace SharpEmu.Core.Cpu;
 
-public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemoryAllocator
+public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemoryAllocator, ICpuMemoryWrapper
 {
     private readonly ICpuMemory _inner;
 
@@ -50,4 +50,9 @@ public sealed class TrackedCpuMemory : ICpuMemory, ITrackedCpuMemory, IGuestMemo
         address = 0;
         return false;
     }
+
+    public bool TryFreeGuestMemory(ulong address)
+    {
+        return _inner is IGuestMemoryAllocator allocator && allocator.TryFreeGuestMemory(address);
+    }
 }

src/SharpEmu.Core/Loader/ProgramHeader.cs

@@ -48,6 +48,8 @@ public enum ProgramHeaderType : uint
 
     Tls = 7,
 
+    GnuEhFrame = 0x6474E550,
+
     SceRela = 0x60000000,
 
     SceProcParam = 0x61000001,

src/SharpEmu.Core/Loader/SelfImage.cs

@@ -24,7 +24,10 @@ public sealed class SelfImage
         ulong procParamAddress = 0,
         string? title = null,
         string? titleId = null,
-        string? version = null)
+        string? version = null,
+        uint tlsModuleId = 0,
+        ulong tlsMemorySize = 0,
+        ulong tlsStaticOffset = 0)
     {
         ArgumentNullException.ThrowIfNull(programHeaders);
         ArgumentNullException.ThrowIfNull(mappedRegions);
@@ -44,6 +47,9 @@ public sealed class SelfImage
         Title = title;
         TitleId = titleId;
         Version = version;
+        TlsModuleId = tlsModuleId;
+        TlsMemorySize = tlsMemorySize;
+        TlsStaticOffset = tlsStaticOffset;
     }
 
     public bool IsSelf { get; }
@@ -75,4 +81,11 @@ public sealed class SelfImage
     public string? TitleId { get; }
 
     public string? Version { get; }
+
+    public uint TlsModuleId { get; }
+
+    public ulong TlsMemorySize { get; }
+
+    /// <summary>Variant II distance from the thread pointer to this module's static TLS base.</summary>
+    public ulong TlsStaticOffset { get; }
 }

src/SharpEmu.Core/Loader/SelfLoader.cs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 using System.Buffers.Binary;
+using System.Diagnostics;
 using System.Runtime.CompilerServices;
 using System.Runtime.InteropServices;
 using System.Text;
@@ -10,13 +11,11 @@ using SharpEmu.Core;
 using SharpEmu.Core.Cpu;
 using SharpEmu.Core.Memory;
 using SharpEmu.HLE;
-using SharpEmu.Logging;
 
 namespace SharpEmu.Core.Loader;
 
 public sealed class SelfLoader : ISelfLoader
 {
-    private static readonly SharpEmuLogger Log = SharpEmuLog.For("Loader");
     private const uint SelfMagic = 0x4F153D1D;
     private const ulong SelfSegmentFlag = 0x800;
     private const int PageSize = 0x1000;
@@ -56,11 +55,22 @@ public sealed class SelfLoader : ISelfLoader
     private const long DtSceSymTab = 0x61000039;
     private const long DtSceSymTabSize = 0x6100003F;
 
+    private const uint RelocationTypeNone = 0;
     private const uint RelocationTypeAbsolute64 = 1;
+    private const uint RelocationTypePc32 = 2;
+    private const uint RelocationTypePlt32 = 4;
     private const uint RelocationTypeGlobalData = 6;
     private const uint RelocationTypeJumpSlot = 7;
     private const uint RelocationTypeRelative = 8;
-    private const uint RelocationTypeTlsModuleId = 16;
+    private const uint RelocationTypeUnsigned32 = 10;
+    private const uint RelocationTypeSigned32 = 11;
+    private const uint RelocationTypeTlsModuleId = 16;   // R_X86_64_DTPMOD64
+    private const uint RelocationTypeTlsDtpOff64 = 17;    // R_X86_64_DTPOFF64
+    private const uint RelocationTypeTlsTpOff64 = 18;     // R_X86_64_TPOFF64
+    private const uint RelocationTypePc64 = 24;
+    private const uint RelocationTypeSize32 = 32;
+    private const uint RelocationTypeSize64 = 33;
+    private const uint RelocationTypeRelative64 = 38;
     private const ulong Ps5MainImageBase = 0x0000000800000000UL;
     private const ulong Ps4MainImageBase = 0x0000000000400000UL;
     private const ulong Ps5ModuleSearchStart = 0x0000000804000000UL;
@@ -86,6 +96,11 @@ public sealed class SelfLoader : ISelfLoader
     private static readonly int SelfSegmentSize = Unsafe.SizeOf<SelfSegment>();
     private static readonly int ProgramHeaderSize = Unsafe.SizeOf<ProgramHeader>();
 
+    static SelfLoader()
+    {
+        RunRelocationSelfChecks();
+    }
+
     public SelfImage Load(ReadOnlySpan<byte> imageData, IVirtualMemory virtualMemory)
     {
         return Load(imageData, virtualMemory, fs: null, mountRoot: null);
@@ -154,16 +169,22 @@ public sealed class SelfLoader : ISelfLoader
         {
             virtualMemory.Clear();
             _nextTlsModuleId = 1;
+            GuestTlsTemplate.Reset();
         }
 
-        var tlsModuleId = _nextTlsModuleId == 0 ? 1u : _nextTlsModuleId;
-        Log.Debug($"TLS load_start clear={clearVirtualMemory} next={_nextTlsModuleId} assigned={tlsModuleId}");
-
         var loadContext = ParseLayout(imageData);
         var elfHeader = ReadUnmanaged<ElfHeader>(imageData, loadContext.ElfOffset);
         ValidateElfHeader(elfHeader);
 
         var programHeaders = ParseProgramHeaders(imageData, loadContext, elfHeader);
+        var hasTlsSegment = TryGetProgramHeader(programHeaders, ProgramHeaderType.Tls, out var processTlsHeader, out _) &&
+            processTlsHeader.MemorySize != 0;
+        var tlsModuleId = hasTlsSegment
+            ? (_nextTlsModuleId == 0 ? 1u : _nextTlsModuleId)
+            : 0u;
+        Console.Error.WriteLine(
+            $"[LOADER][TLS] load_start clear={clearVirtualMemory} next={_nextTlsModuleId} " +
+            $"assigned={tlsModuleId} has_pt_tls={hasTlsSegment}");
 
         var totalImageSize = CalculateTotalImageSize(programHeaders);
         Console.WriteLine($"Total image size needed: 0x{totalImageSize:X} ({totalImageSize} bytes)");
@@ -196,6 +217,13 @@ public sealed class SelfLoader : ISelfLoader
         }
 
         MapLoadSegments(imageData, loadContext, programHeaders, virtualMemory, imageBase);
+        // Register every module before relocations so DTPMOD/DTPOFF/TPOFF use
+        // the module's real PT_TLS identity and Variant II static offset.
+        var tlsInfo = RegisterModuleTlsTemplate(
+            programHeaders,
+            virtualMemory,
+            imageBase,
+            tlsModuleId);
         var importStubs = ResolveAndPatchImportStubs(
             imageData,
             loadContext,
@@ -253,11 +281,11 @@ public sealed class SelfLoader : ISelfLoader
             Console.WriteLine($"[LOADER] PH[{i}]: type={ph.HeaderType}, vaddr=0x{ph.VirtualAddress:X16} -> 0x{ph.VirtualAddress + imageBase:X16}, memsz=0x{ph.MemorySize:X}");
         }
 
-        if (_nextTlsModuleId == tlsModuleId && _nextTlsModuleId < uint.MaxValue)
+        if (tlsModuleId != 0 && _nextTlsModuleId == tlsModuleId && _nextTlsModuleId < uint.MaxValue)
         {
             _nextTlsModuleId++;
         }
-        Log.Debug($"TLS load_done assigned={tlsModuleId} next={_nextTlsModuleId}");
+        Console.Error.WriteLine($"[LOADER][TLS] load_done assigned={tlsModuleId} next={_nextTlsModuleId}");
 
         return new SelfImage(
             loadContext.IsSelf,
@@ -274,7 +302,10 @@ public sealed class SelfLoader : ISelfLoader
             procParamAddress,
             applicationInfo.Title,
             applicationInfo.TitleId,
-            applicationInfo.Version);
+            applicationInfo.Version,
+            tlsModuleId,
+            tlsInfo.MemorySize,
+            tlsInfo.StaticOffset);
     }
 
     private static (string? Title, string? TitleId, string? Version) TryLoadParamJson(
@@ -345,6 +376,21 @@ public sealed class SelfLoader : ISelfLoader
             return new LoadContext(IsSelf: true, elfOffset, selfHeader.FileSize, segments);
         }
 
+        // Not a recognized (fake-signed) SELF. Only a bare, decrypted ELF is
+        // acceptable here; anything else — most commonly a still-encrypted
+        // retail eboot — must be reported clearly rather than failing later
+        // with an opaque "not a valid ELF header" message.
+        const uint ElfMagicBigEndian = 0x7F454C46; // "\x7fELF"
+        var leadingWord = BinaryPrimitives.ReadUInt32BigEndian(imageData[..sizeof(uint)]);
+        if (leadingWord != ElfMagicBigEndian)
+        {
+            throw new InvalidDataException(
+                $"Image is neither a decrypted ELF nor a recognized fake-signed SELF " +
+                $"(leading bytes 0x{leadingWord:X8}). This is almost certainly a still-encrypted " +
+                $"retail eboot — SharpEmu has no decryption keys and requires a decrypted / " +
+                $"fake-signed (fSELF) image.");
+        }
+
         return new LoadContext(IsSelf: false, ElfOffset: 0, SelfFileSize: 0, Array.Empty<SelfSegment>());
     }
 
@@ -405,15 +451,15 @@ public sealed class SelfLoader : ISelfLoader
 
             var virtualAddress = header.VirtualAddress + imageBase;
 
-            Log.Debug($"Segment {index}: VAddr=0x{virtualAddress:X16}, FileSize=0x{header.FileSize:X}, MemSize=0x{header.MemorySize:X}, Align=0x{header.Alignment:X}");
+            Console.Error.WriteLine($"[LOADER] Segment {index}: VAddr=0x{virtualAddress:X16}, FileSize=0x{header.FileSize:X}, MemSize=0x{header.MemorySize:X}, Align=0x{header.Alignment:X}");
             if (header.Alignment > 1)
             {
                 var vaddrMod = virtualAddress % header.Alignment;
                 var offsetMod = header.Offset % header.Alignment;
                 if (vaddrMod != offsetMod)
                 {
-                    Log.Warning(
-                        $"Segment {index} ELF alignment mismatch! " +
+                    Console.Error.WriteLine(
+                        $"[LOADER] WARNING: Segment {index} ELF alignment mismatch! " +
                         $"VAddr=0x{virtualAddress:X}, Offset=0x{header.Offset:X}, Align=0x{header.Alignment:X}, " +
                         $"VAddr%Align=0x{vaddrMod:X}, Offset%Align=0x{offsetMod:X}");
                 }
@@ -456,6 +502,43 @@ public sealed class SelfLoader : ISelfLoader
         return 0;
     }
 
+    private static ModuleTlsInfo RegisterModuleTlsTemplate(
+        IReadOnlyList<ProgramHeader> programHeaders,
+        IVirtualMemory virtualMemory,
+        ulong imageBase,
+        uint tlsModuleId)
+    {
+        if (!TryGetProgramHeader(programHeaders, ProgramHeaderType.Tls, out var tlsHeader, out _) ||
+            tlsHeader.MemorySize == 0)
+        {
+            return default;
+        }
+
+        // tdata (initialized) bytes come from the mapped segment; tbss is the
+        // implicitly-zero remainder up to MemorySize.
+        var fileSize = (int)Math.Min(tlsHeader.FileSize, tlsHeader.MemorySize);
+        var initImage = fileSize > 0 ? new byte[fileSize] : [];
+        if (fileSize > 0 &&
+            !virtualMemory.TryRead(imageBase + tlsHeader.VirtualAddress, initImage))
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][TLS] Failed to read TLS init image at 0x{imageBase + tlsHeader.VirtualAddress:X}; seeding zeros.");
+            initImage = [];
+        }
+
+        var staticOffset = GuestTlsTemplate.RegisterModule(
+            tlsModuleId,
+            initImage,
+            tlsHeader.MemorySize,
+            tlsHeader.Alignment,
+            tlsHeader.VirtualAddress);
+        Console.Error.WriteLine(
+            $"[LOADER][TLS] Module {tlsModuleId} TLS template: memsz=0x{tlsHeader.MemorySize:X} " +
+            $"filesz=0x{tlsHeader.FileSize:X} align=0x{tlsHeader.Alignment:X} " +
+            $"static_offset=0x{staticOffset:X} total_static=0x{GuestTlsTemplate.StaticTlsSize:X}");
+        return new ModuleTlsInfo(tlsHeader.MemorySize, staticOffset);
+    }
+
     private static IReadOnlyDictionary<ulong, string> ResolveAndPatchImportStubs(
         ReadOnlySpan<byte> imageData,
         LoadContext loadContext,
@@ -535,12 +618,17 @@ public sealed class SelfLoader : ISelfLoader
         uint maxSymbolIndex = 0;
         foreach (var relocation in relocations)
         {
+            if (relocation.Type == RelocationTypeNone)
+            {
+                continue;
+            }
+
             if (!IsSupportedRelocationType(relocation.Type))
             {
                 continue;
             }
 
-            if (relocation.Type is RelocationTypeRelative or RelocationTypeTlsModuleId)
+            if (relocation.Type is RelocationTypeNone or RelocationTypeRelative or RelocationTypeRelative64 or RelocationTypeTlsModuleId)
             {
                 continue;
             }
@@ -624,13 +712,16 @@ public sealed class SelfLoader : ISelfLoader
 
         importedRelocations = BuildImportedRelocations(descriptors);
 
-        var stubsByAddress = CreateImportStubMapping(virtualMemory, orderedImportNids);
+        var stubImportNids = orderedImportNids
+            .Where(nid => ShouldCreateImportStub(nid, descriptors, moduleManager))
+            .ToArray();
+        var stubsByAddress = CreateImportStubMapping(virtualMemory, stubImportNids);
         Console.WriteLine($"[LOADER] Created {stubsByAddress.Count} import stubs");
 
-        int printCount = Math.Min(10, orderedImportNids.Count);
+        int printCount = Math.Min(10, stubImportNids.Length);
         for (int i = 0; i < printCount; i++)
         {
-            var nid = orderedImportNids[i];
+            var nid = stubImportNids[i];
             var addr = stubsByAddress.First(x => x.Value == nid).Key;
         }
 
@@ -654,45 +745,65 @@ public sealed class SelfLoader : ISelfLoader
 
         foreach (var descriptor in descriptors)
         {
-            ulong targetValue;
+            ulong symbolValue;
             if (descriptor.ImportNid is null)
             {
-                targetValue = AddSigned(descriptor.SymbolValue, descriptor.Addend);
+                symbolValue = descriptor.SymbolValue;
             }
             else
             {
-                if (!addressesByNid.TryGetValue(descriptor.ImportNid, out var stubAddress))
+                if (addressesByNid.TryGetValue(descriptor.ImportNid, out var stubAddress))
                 {
-                    throw new InvalidOperationException($"Import stub not found for NID '{descriptor.ImportNid}'.");
+                    symbolValue = stubAddress;
                 }
-
-                targetValue = AddSigned(stubAddress, descriptor.Addend);
-            }
-
-            if (targetValue < 0x1000)
-            {
-                if (descriptor.ValueKind == RelocationValueKind.TlsModuleId)
+                else if (descriptor.IsWeak)
                 {
-                    Log.Debug(
-                        $"Patching DTPMOD64 at 0x{descriptor.TargetAddress:X} with module id 0x{targetValue:X}");
+                    // ELF unresolved weak definitions use S=0. They must not
+                    // receive a trap import stub, which would turn a permitted
+                    // null test into a call to an unresolved-import handler.
+                    symbolValue = 0;
                 }
                 else
                 {
-                    Log.Warning($"!!! CRITICAL !!! Patching address 0x{descriptor.TargetAddress:X} with INVALID value 0x{targetValue:X} for NID {descriptor.ImportNid ?? "(null)"}");
-                    Log.Warning($"  SymbolValue=0x{descriptor.SymbolValue:X}, Addend=0x{descriptor.Addend:X}, StubAddress=0x{(addressesByNid.TryGetValue(descriptor.ImportNid ?? "", out var sa) ? sa : 0):X}");
+                    throw new InvalidOperationException($"Import stub not found for NID '{descriptor.ImportNid}'.");
                 }
             }
 
-            if (!TryWriteUInt64(virtualMemory, descriptor.TargetAddress, targetValue))
+            var targetValue = ComputeRelocationValue(descriptor, symbolValue);
+
+            if (targetValue < 0x1000 && descriptor.ValueKind is
+                RelocationValueKind.TlsOffset or
+                RelocationValueKind.PcRelative or
+                RelocationValueKind.SymbolSize)
             {
-                throw new InvalidDataException($"Failed to patch relocation at 0x{descriptor.TargetAddress:X16}.");
+                // A TLS offset (TPOFF64/DTPOFF64) is a signed displacement, not a
+                // mapped address, so a small or negative value here is expected.
+            }
+            else if (targetValue < 0x1000 && !descriptor.IsWeak)
+            {
+                if (descriptor.ValueKind == RelocationValueKind.TlsModuleId)
+                {
+                    Console.Error.WriteLine(
+                        $"[LOADER][TLS] Patching DTPMOD64 at 0x{descriptor.TargetAddress:X} with module id 0x{targetValue:X}");
+                }
+                else
+                {
+                    Console.Error.WriteLine($"[LOADER] !!! CRITICAL !!! Patching address 0x{descriptor.TargetAddress:X} with INVALID value 0x{targetValue:X} for NID {descriptor.ImportNid ?? "(null)"}");
+                    Console.Error.WriteLine($"[LOADER]   SymbolValue=0x{descriptor.SymbolValue:X}, Addend=0x{descriptor.Addend:X}, StubAddress=0x{(addressesByNid.TryGetValue(descriptor.ImportNid ?? "", out var sa) ? sa : 0):X}");
+                }
+            }
+
+            if (!TryWriteRelocationValue(virtualMemory, descriptor, targetValue, out var writeError))
+            {
+                throw new InvalidDataException(
+                    $"Failed to patch relocation at 0x{descriptor.TargetAddress:X16}: {writeError}");
             }
 
             if (descriptor.TargetAddress >= 0x00000008030FC300UL &&
                 descriptor.TargetAddress <= 0x00000008030FC3F0UL)
             {
-                Log.Debug(
-                    $"[RELOC] target=0x{descriptor.TargetAddress:X16} value=0x{targetValue:X16} addend=0x{descriptor.Addend:X} nid={(descriptor.ImportNid ?? "<sym>")}");
+                Console.Error.WriteLine(
+                    $"[LOADER][RELOC] target=0x{descriptor.TargetAddress:X16} value=0x{targetValue:X16} addend=0x{descriptor.Addend:X} nid={(descriptor.ImportNid ?? "<sym>")}");
             }
         }
 
@@ -785,29 +896,36 @@ public sealed class SelfLoader : ISelfLoader
         {
             if (IsFocusRelocationOffset(relocation.Offset, imageBase))
             {
-                Log.Debug(
-                    $"[FOCUS][SCAN] off=0x{relocation.Offset:X16} type={relocation.Type} sym={relocation.SymbolIndex} addend=0x{relocation.Addend:X}");
+                Console.Error.WriteLine(
+                    $"[LOADER][FOCUS][SCAN] off=0x{relocation.Offset:X16} type={relocation.Type} sym={relocation.SymbolIndex} addend=0x{relocation.Addend:X}");
             }
 
             if (!IsSupportedRelocationType(relocation.Type))
             {
-                if (IsFocusRelocationOffset(relocation.Offset, imageBase))
+                // Surface unsupported relocation types loudly instead of
+                // skipping silently: TLS-relative (17/18), COPY (5), and
+                // IRELATIVE/ifunc (37) leave their targets unrelocated, which
+                // manifests later as reads of zero or calls into address 0.
+                ReportUnsupportedRelocation(relocation.Type, relocation.Offset, imageBase);
+                if (relocation.Type is 5 or 37)
                 {
-                    Log.Debug($"[FOCUS][SKIP] unsupported type={relocation.Type}");
+                    throw new NotSupportedException(
+                        $"Relocation type {relocation.Type} requires deferred runtime-linker processing.");
                 }
                 continue;
             }
 
-            if (!TryResolveMappedAddress(virtualMemory, relocation.Offset, imageBase, sizeof(ulong), out var targetAddress))
+            var relocationWriteSize = GetRelocationWriteSize(relocation.Type);
+            if (!TryResolveMappedAddress(virtualMemory, relocation.Offset, imageBase, relocationWriteSize, out var targetAddress))
             {
                 if (IsFocusRelocationOffset(relocation.Offset, imageBase))
                 {
-                    Log.Debug("[FOCUS][SKIP] target address not mapped");
+                    Console.Error.WriteLine("[LOADER][FOCUS][SKIP] target address not mapped");
                 }
                 continue;
             }
 
-            if (relocation.Type == RelocationTypeRelative)
+            if (relocation.Type is RelocationTypeRelative or RelocationTypeRelative64)
             {
                 descriptors.Add(new RelocationDescriptor(
                     targetAddress,
@@ -821,7 +939,12 @@ public sealed class SelfLoader : ISelfLoader
 
             if (relocation.Type == RelocationTypeTlsModuleId)
             {
-                var dtpmodValue = tlsModuleId == 0 ? 1u : tlsModuleId;
+                if (tlsModuleId == 0)
+                {
+                    throw new InvalidDataException(
+                        $"R_X86_64_DTPMOD64 at 0x{targetAddress:X16} references a module without PT_TLS.");
+                }
+                var dtpmodValue = tlsModuleId;
                 descriptors.Add(new RelocationDescriptor(
                     targetAddress,
                     0,
@@ -842,50 +965,100 @@ public sealed class SelfLoader : ISelfLoader
             {
                 if (targetAddress >= FocusRelocGuestStart && targetAddress <= FocusRelocGuestEnd)
                 {
-                    Log.Debug($"[FOCUS][SKIP] symbol read failed index={symbolIndex}");
+                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] symbol read failed index={symbolIndex}");
                 }
                 continue;
             }
 
-            var addend = relocation.Type is RelocationTypeGlobalData or RelocationTypeJumpSlot ? 0 : relocation.Addend;
-            var symbolBind = GetSymbolBind(symbol.Info);
-            if (symbolBind == SymbolBindLocal)
+            if (relocation.Type is RelocationTypeTlsDtpOff64 or RelocationTypeTlsTpOff64)
             {
-                var symbolAddress = ResolveMappedAddressOrFallback(virtualMemory, symbol.Value, imageBase);
-                if (symbolAddress == 0)
+                // Variant II static TLS: the module block sits at
+                // [tp - blockSize, tp). DTPOFF64 is the module-relative offset
+                // (st_value + addend); TPOFF64 is that offset expressed relative
+                // to the thread pointer, i.e. minus the aligned block size.
+                var tlsSymbolOffset = AddSigned(symbol.Value, relocation.Addend);
+                if (!GuestTlsTemplate.TryGetStaticOffset(tlsModuleId, out var moduleStaticOffset))
                 {
-                    Log.Warning(
-                        $"Skipping local relocation with invalid symbol value 0x{symbol.Value:X} " +
-                        $"at target 0x{targetAddress:X16}, type={relocation.Type}, sym={symbolIndex}");
+                    Console.Error.WriteLine(
+                        $"[LOADER][TLS] Missing PT_TLS registration for module {tlsModuleId}; " +
+                        $"cannot apply relocation {relocation.Type} at 0x{targetAddress:X16}.");
+                    continue;
                 }
-
+                var tlsValue = relocation.Type == RelocationTypeTlsTpOff64
+                    ? unchecked(tlsSymbolOffset - moduleStaticOffset)
+                    : tlsSymbolOffset;
                 descriptors.Add(new RelocationDescriptor(
                     targetAddress,
-                    addend,
+                    0,
                     null,
-                    symbolAddress,
-                    RelocationValueKind.Pointer,
+                    tlsValue,
+                    RelocationValueKind.TlsOffset,
                     IsDataImport: false));
                 continue;
             }
 
+            var symbolBind = GetSymbolBind(symbol.Info);
+            if (symbolIndex == 0)
+            {
+                descriptors.Add(CreateSymbolRelocationDescriptor(
+                    relocation,
+                    targetAddress,
+                    symbol,
+                    symbolAddress: 0,
+                    importNid: null,
+                    isWeak: false));
+                continue;
+            }
+
+            if (symbolBind == SymbolBindLocal)
+            {
+                var symbolAddress = relocation.Type is RelocationTypeSize32 or RelocationTypeSize64
+                    ? 0
+                    : ResolveMappedAddressOrFallback(virtualMemory, symbol.Value, imageBase);
+                if (symbolAddress == 0)
+                {
+                    if (relocation.Type is not (RelocationTypeSize32 or RelocationTypeSize64))
+                    {
+                        Console.Error.WriteLine(
+                            $"[LOADER] Skipping local relocation with invalid symbol value 0x{symbol.Value:X} " +
+                            $"at target 0x{targetAddress:X16}, type={relocation.Type}, sym={symbolIndex}");
+                        continue;
+                    }
+                }
+
+                descriptors.Add(CreateSymbolRelocationDescriptor(
+                    relocation,
+                    targetAddress,
+                    symbol,
+                    symbolAddress,
+                    importNid: null,
+                    isWeak: false));
+                continue;
+            }
+
             if (symbol.Value != 0)
             {
-                var symbolAddress = ResolveMappedAddressOrFallback(virtualMemory, symbol.Value, imageBase);
+                var symbolAddress = relocation.Type is RelocationTypeSize32 or RelocationTypeSize64
+                    ? 0
+                    : ResolveMappedAddressOrFallback(virtualMemory, symbol.Value, imageBase);
                 if (symbolAddress == 0)
                 {
-                    Log.Warning(
-                        $"Skipping relocation with invalid symbol value 0x{symbol.Value:X} " +
-                        $"at target 0x{targetAddress:X16}, type={relocation.Type}, sym={symbolIndex}");
+                    if (relocation.Type is not (RelocationTypeSize32 or RelocationTypeSize64))
+                    {
+                        Console.Error.WriteLine(
+                            $"[LOADER] Skipping relocation with invalid symbol value 0x{symbol.Value:X} " +
+                            $"at target 0x{targetAddress:X16}, type={relocation.Type}, sym={symbolIndex}");
+                        continue;
+                    }
                 }
 
-                descriptors.Add(new RelocationDescriptor(
+                descriptors.Add(CreateSymbolRelocationDescriptor(
+                    relocation,
                     targetAddress,
-                    addend,
-                    null,
+                    symbol,
                     symbolAddress,
-                    RelocationValueKind.Pointer,
-                    IsDataImport: false));
+                    importNid: null,
+                    isWeak: false));
                 continue;
             }
 
@@ -893,16 +1066,26 @@ public sealed class SelfLoader : ISelfLoader
             {
                 if (targetAddress >= FocusRelocGuestStart && targetAddress <= FocusRelocGuestEnd)
                 {
-                    Log.Debug($"[FOCUS][SKIP] bind={symbolBind} not importable");
+                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] bind={symbolBind} not importable");
                 }
                 continue;
             }
 
             if (!TryReadNullTerminatedAscii(stringTable, symbol.NameOffset, out var symbolName))
             {
+                if (symbolBind == SymbolBindWeak)
+                {
+                    descriptors.Add(CreateSymbolRelocationDescriptor(
+                        relocation,
+                        targetAddress,
+                        symbol,
+                        symbolAddress: 0,
+                        importNid: null,
+                        isWeak: true));
+                }
                 if (targetAddress >= FocusRelocGuestStart && targetAddress <= FocusRelocGuestEnd)
                 {
-                    Log.Debug($"[FOCUS][SKIP] symbol name read failed offset={symbol.NameOffset}");
+                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] symbol name read failed offset={symbol.NameOffset}");
                 }
                 continue;
             }
@@ -910,6 +1093,16 @@ public sealed class SelfLoader : ISelfLoader
             var nid = ExtractNid(symbolName);
             if (string.IsNullOrWhiteSpace(nid))
             {
+                if (symbolBind == SymbolBindWeak)
+                {
+                    descriptors.Add(CreateSymbolRelocationDescriptor(
+                        relocation,
+                        targetAddress,
+                        symbol,
+                        symbolAddress: 0,
+                        importNid: null,
+                        isWeak: true));
+                }
                 continue;
             }
 
@@ -918,16 +1111,74 @@ public sealed class SelfLoader : ISelfLoader
                 orderedImportNids.Add(nid);
             }
 
-            descriptors.Add(new RelocationDescriptor(
+            descriptors.Add(CreateSymbolRelocationDescriptor(
+                relocation,
                 targetAddress,
-                addend,
-                nid,
-                0,
-                RelocationValueKind.Pointer,
-                IsDataImport: GetSymbolType(symbol.Info) == SymbolTypeObject));
+                symbol,
+                symbolAddress: 0,
+                importNid: nid,
+                isWeak: symbolBind == SymbolBindWeak));
         }
     }
 
+    private static RelocationDescriptor CreateSymbolRelocationDescriptor(
+        ElfRelocation relocation,
+        ulong targetAddress,
+        ElfSymbol symbol,
+        ulong symbolAddress,
+        string? importNid,
+        bool isWeak)
+    {
+        var valueKind = relocation.Type switch
+        {
+            RelocationTypePc32 or RelocationTypePlt32 or RelocationTypePc64 => RelocationValueKind.PcRelative,
+            RelocationTypeSize32 or RelocationTypeSize64 => RelocationValueKind.SymbolSize,
+            _ => RelocationValueKind.Pointer,
+        };
+        var writeKind = relocation.Type switch
+        {
+            RelocationTypePc32 or RelocationTypePlt32 or RelocationTypeSigned32 => RelocationWriteKind.Int32,
+            RelocationTypeUnsigned32 or RelocationTypeSize32 => RelocationWriteKind.UInt32,
+            _ => RelocationWriteKind.UInt64,
+        };
+        var symbolValue = valueKind == RelocationValueKind.SymbolSize
+            ? symbol.Size
+            : symbolAddress;
+        var addend = relocation.Type is RelocationTypeGlobalData or RelocationTypeJumpSlot
+            ? 0
+            : relocation.Addend;
+        return new RelocationDescriptor(
+            targetAddress,
+            addend,
+            importNid,
+            symbolValue,
+            valueKind,
+            IsDataImport: GetSymbolType(symbol.Info) == SymbolTypeObject,
+            writeKind,
+            isWeak);
+    }
+
+    private static bool ShouldCreateImportStub(
+        string nid,
+        IReadOnlyList<RelocationDescriptor> descriptors,
+        IModuleManager? moduleManager)
+    {
+        for (var i = 0; i < descriptors.Count; i++)
+        {
+            var descriptor = descriptors[i];
+            if (!string.Equals(descriptor.ImportNid, nid, StringComparison.Ordinal))
+            {
+                continue;
+            }
+            if (!descriptor.IsWeak || moduleManager?.TryGetExport(nid, out _) == true)
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     private static void RegisterRuntimeSymbolsAndHooks(
         ReadOnlySpan<byte> imageData,
         LoadContext loadContext,
@@ -950,8 +1201,8 @@ public sealed class SelfLoader : ISelfLoader
 
         if (sectionSymbols > 0 || dynamicSymbols > 0)
         {
-            Log.Info(
-                $"Runtime symbol index populated: section={sectionSymbols}, dynamic={dynamicSymbols}, total={runtimeSymbols.Count}");
+            Console.Error.WriteLine(
+                $"[LOADER] Runtime symbol index populated: section={sectionSymbols}, dynamic={dynamicSymbols}, total={runtimeSymbols.Count}");
         }
     }
 
@@ -1025,8 +1276,8 @@ public sealed class SelfLoader : ISelfLoader
 
         if (preInitializers.Count != 0 || initializers.Count != 0)
         {
-            Log.Info(
-                $"Initializers discovered: preinit={preInitializers.Count}, init={initializers.Count}");
+            Console.Error.WriteLine(
+                $"[LOADER] Initializers discovered: preinit={preInitializers.Count}, init={initializers.Count}");
         }
     }
 
@@ -1409,8 +1660,8 @@ public sealed class SelfLoader : ISelfLoader
 
         var requiredBytes = checked((ulong)orderedImportNids.Count * ImportStubSlotSize);
         var mapSize = AlignUp(Math.Max(requiredBytes, (ulong)PageSize), PageSize);
-        Log.Debug(
-            $"CreateImportStubMapping: nids={orderedImportNids.Count}, required=0x{requiredBytes:X}, map_size=0x{mapSize:X}");
+        Console.Error.WriteLine(
+            $"[LOADER] CreateImportStubMapping: nids={orderedImportNids.Count}, required=0x{requiredBytes:X}, map_size=0x{mapSize:X}");
         if (mapSize > int.MaxValue)
         {
             throw new NotSupportedException("Import stub mapping exceeds 2 GB and is not supported.");
@@ -1682,11 +1933,51 @@ public sealed class SelfLoader : ISelfLoader
     private static bool IsSupportedRelocationType(uint relocationType)
     {
         return relocationType is
+            RelocationTypeNone or
             RelocationTypeAbsolute64 or
+            RelocationTypePc32 or
+            RelocationTypePlt32 or
             RelocationTypeGlobalData or
             RelocationTypeJumpSlot or
             RelocationTypeRelative or
-            RelocationTypeTlsModuleId;
+            RelocationTypeUnsigned32 or
+            RelocationTypeSigned32 or
+            RelocationTypeTlsModuleId or
+            RelocationTypeTlsDtpOff64 or
+            RelocationTypeTlsTpOff64 or
+            RelocationTypePc64 or
+            RelocationTypeSize32 or
+            RelocationTypeSize64 or
+            RelocationTypeRelative64;
+    }
+
+    private static readonly HashSet<uint> _reportedUnsupportedRelocationTypes = new();
+
+    private static void ReportUnsupportedRelocation(uint relocationType, ulong offset, ulong imageBase)
+    {
+        // Report each distinct unsupported type once to keep the log useful.
+        lock (_reportedUnsupportedRelocationTypes)
+        {
+            if (!_reportedUnsupportedRelocationTypes.Add(relocationType))
+            {
+                if (IsFocusRelocationOffset(offset, imageBase))
+                {
+                    Console.Error.WriteLine($"[LOADER][FOCUS][SKIP] unsupported type={relocationType}");
+                }
+
+                return;
+            }
+        }
+
+        var name = relocationType switch
+        {
+            5 => "R_X86_64_COPY",
+            37 => "R_X86_64_IRELATIVE (ifunc)",
+            _ => "unknown",
+        };
+        Console.Error.WriteLine(
+            $"[LOADER][ERROR] Unsupported relocation type {relocationType} ({name}) rejected " +
+            $"(first at off=0x{offset:X16}); COPY requires dependency symbol storage and IRELATIVE requires resolver execution.");
     }
 
     private static ulong DetermineRequestedImageBase(
@@ -1842,16 +2133,16 @@ public sealed class SelfLoader : ISelfLoader
         tableBytes = GC.AllocateUninitializedArray<byte>((int)size);
 
         var guestAddr = location + imageBase;
-        Log.Debug($"TryLoadTableBytes: trying guest address 0x{guestAddr:X}");
+        Console.Error.WriteLine($"[LOADER] TryLoadTableBytes: trying guest address 0x{guestAddr:X}");
         if (virtualMemory.TryRead(guestAddr, tableBytes))
         {
-            Log.Debug($"TryLoadTableBytes: loaded from guest memory at 0x{guestAddr:X}");
+            Console.Error.WriteLine($"[LOADER] TryLoadTableBytes: loaded from guest memory at 0x{guestAddr:X}");
             return true;
         }
 
         if (virtualMemory.TryRead(location, tableBytes))
         {
-            Log.Debug($"TryLoadTableBytes: loaded from absolute guest address 0x{location:X}");
+            Console.Error.WriteLine($"[LOADER] TryLoadTableBytes: loaded from absolute guest address 0x{location:X}");
             return true;
         }
 
@@ -1859,11 +2150,11 @@ public sealed class SelfLoader : ISelfLoader
         {
             var slice = elfData.Slice((int)location, (int)size);
             tableBytes = slice.ToArray();
-            Log.Debug($"TryLoadTableBytes: loaded from elfData as file offset at 0x{location:X}");
+            Console.Error.WriteLine($"[LOADER] TryLoadTableBytes: loaded from elfData as file offset at 0x{location:X}");
             return true;
         }
 
-        Log.Warning($"TryLoadTableBytes: FAILED for location 0x{location:X}");
+        Console.Error.WriteLine($"[LOADER] TryLoadTableBytes: FAILED for location 0x{location:X}");
         tableBytes = Array.Empty<byte>();
         return false;
     }
@@ -1920,17 +2211,17 @@ public sealed class SelfLoader : ISelfLoader
 
     private static ulong ResolveMappedAddressOrFallback(IVirtualMemory virtualMemory, ulong address, ulong imageBase)
     {
-        Log.Debug($"ResolveMappedAddressOrFallback addr=0x{address:X} imageBase=0x{imageBase:X16}");
+        Console.Error.WriteLine($"[LOADER][TEST] ResolveMappedAddressOrFallback addr=0x{address:X} imageBase=0x{imageBase:X16}");
 
         if (address == 0)
         {
-            Log.Debug("-> return 0 (null)");
+            Console.Error.WriteLine("[LOADER][TEST] -> return 0 (null)");
             return 0;
         }
 
         if (TryResolveMappedAddress(virtualMemory, address, imageBase, 1, out var resolved))
         {
-            Log.Debug($"-> resolved raw 0x{resolved:X16}");
+            Console.Error.WriteLine($"[LOADER][TEST] -> resolved raw 0x{resolved:X16}");
             return resolved;
         }
 
@@ -1939,18 +2230,18 @@ public sealed class SelfLoader : ISelfLoader
             var rebased = address + imageBase;
             if (TryResolveMappedAddress(virtualMemory, rebased, imageBase, 1, out var resolvedRebased))
             {
-                Log.Debug($"-> resolved rebased 0x{resolvedRebased:X16}");
+                Console.Error.WriteLine($"[LOADER][TEST] -> resolved rebased 0x{resolvedRebased:X16}");
                 return resolvedRebased;
             }
         }
 
         if (address < 0x10000)
         {
-            Log.Debug($"-> reject small 0x{address:X}");
+            Console.Error.WriteLine($"[LOADER][TEST] -> reject small 0x{address:X}");
             return 0;
         }
 
-        Log.Debug($"-> fallback raw 0x{address:X}");
+        Console.Error.WriteLine($"[LOADER][TEST] -> fallback raw 0x{address:X}");
         return address;
     }
 
@@ -2040,6 +2331,106 @@ public sealed class SelfLoader : ISelfLoader
         return virtualMemory.TryWrite(address, buffer);
     }
 
+    private static ulong ComputeRelocationValue(RelocationDescriptor descriptor, ulong resolvedSymbolValue)
+    {
+        var baseValue = descriptor.ValueKind == RelocationValueKind.SymbolSize
+            ? descriptor.SymbolValue
+            : resolvedSymbolValue;
+        var value = AddSigned(baseValue, descriptor.Addend);
+        return descriptor.ValueKind == RelocationValueKind.PcRelative
+            ? unchecked(value - descriptor.TargetAddress)
+            : value;
+    }
+
+    private static bool TryWriteRelocationValue(
+        IVirtualMemory virtualMemory,
+        RelocationDescriptor descriptor,
+        ulong value,
+        out string? error)
+    {
+        Span<byte> buffer = stackalloc byte[sizeof(ulong)];
+        var length = sizeof(ulong);
+        switch (descriptor.WriteKind)
+        {
+            case RelocationWriteKind.UInt64:
+                BinaryPrimitives.WriteUInt64LittleEndian(buffer, value);
+                break;
+
+            case RelocationWriteKind.UInt32:
+                if (value > uint.MaxValue)
+                {
+                    error = $"value 0x{value:X16} overflows an unsigned 32-bit relocation";
+                    return false;
+                }
+                BinaryPrimitives.WriteUInt32LittleEndian(buffer, (uint)value);
+                length = sizeof(uint);
+                break;
+
+            case RelocationWriteKind.Int32:
+                var signedValue = unchecked((long)value);
+                if (signedValue is < int.MinValue or > int.MaxValue)
+                {
+                    error = $"value {signedValue} overflows a signed 32-bit relocation";
+                    return false;
+                }
+                BinaryPrimitives.WriteInt32LittleEndian(buffer, (int)signedValue);
+                length = sizeof(int);
+                break;
+
+            default:
+                error = $"unknown relocation write kind {descriptor.WriteKind}";
+                return false;
+        }
+
+        error = virtualMemory.TryWrite(descriptor.TargetAddress, buffer[..length])
+            ? null
+            : "target memory is not writable";
+        return error is null;
+    }
+
+    private static int GetRelocationWriteSize(uint relocationType)
+    {
+        return relocationType is
+            RelocationTypePc32 or
+            RelocationTypePlt32 or
+            RelocationTypeUnsigned32 or
+            RelocationTypeSigned32 or
+            RelocationTypeSize32
+                ? sizeof(uint)
+                : sizeof(ulong);
+    }
+
+    [Conditional("DEBUG")]
+    private static void RunRelocationSelfChecks()
+    {
+        var pc32 = new RelocationDescriptor(
+            TargetAddress: 0x1000,
+            Addend: -4,
+            ImportNid: null,
+            SymbolValue: 0x1800,
+            RelocationValueKind.PcRelative,
+            IsDataImport: false,
+            RelocationWriteKind.Int32);
+        Debug.Assert(
+            unchecked((long)ComputeRelocationValue(pc32, pc32.SymbolValue)) == 0x7FC,
+            "R_X86_64_PC32 did not apply S + A - P.");
+
+        var weak = new RelocationDescriptor(
+            TargetAddress: 0x2000,
+            Addend: 7,
+            ImportNid: "weak",
+            SymbolValue: 0,
+            RelocationValueKind.Pointer,
+            IsDataImport: false,
+            IsWeak: true);
+        Debug.Assert(
+            ComputeRelocationValue(weak, resolvedSymbolValue: 0) == 7,
+            "An unresolved weak relocation did not use S=0.");
+        Debug.Assert(
+            !ShouldCreateImportStub("weak", [weak], moduleManager: null),
+            "An unresolved weak symbol incorrectly received a trap import stub.");
+    }
+
     private static ulong AlignUp(ulong value, ulong alignment)
     {
         var mask = alignment - 1;
@@ -2248,6 +2639,16 @@ public sealed class SelfLoader : ISelfLoader
         {
             throw new InvalidDataException($"Unsupported ELF program header entry size: {header.ProgramHeaderEntrySize}.");
         }
+
+        // The CPU backend executes guest instructions natively, so a non
+        // x86-64 image can only fail deep in execution with an opaque SIGILL.
+        // Catch it here with an actionable message. (EM_X86_64 == 62.)
+        const ushort ElfMachineX86_64 = 62;
+        if (header.Machine != ElfMachineX86_64)
+        {
+            throw new InvalidDataException(
+                $"Unsupported ELF machine type 0x{header.Machine:X4}; SharpEmu only runs x86-64 (EM_X86_64) images.");
+        }
     }
 
     private static unsafe T ReadUnmanaged<T>(ReadOnlySpan<byte> source, int offset)
@@ -2328,10 +2729,25 @@ public sealed class SelfLoader : ISelfLoader
         public uint Type => (uint)(Info & uint.MaxValue);
     }
 
+    private readonly record struct ModuleTlsInfo(ulong MemorySize, ulong StaticOffset);
+
     private enum RelocationValueKind : byte
     {
         Pointer = 0,
-        TlsModuleId = 1
+        TlsModuleId = 1,
+        // A pre-computed TLS offset written verbatim (TPOFF64/DTPOFF64). Unlike
+        // Pointer it is a signed displacement, not a mapped address, so it is
+        // patched as-is without the low-address validity warning.
+        TlsOffset = 2,
+        PcRelative = 3,
+        SymbolSize = 4,
+    }
+
+    private enum RelocationWriteKind : byte
+    {
+        UInt64 = 0,
+        UInt32 = 1,
+        Int32 = 2,
     }
 
     private readonly record struct RelocationDescriptor(
@@ -2340,7 +2756,9 @@ public sealed class SelfLoader : ISelfLoader
         string? ImportNid,
         ulong SymbolValue,
         RelocationValueKind ValueKind,
-        bool IsDataImport);
+        bool IsDataImport,
+        RelocationWriteKind WriteKind = RelocationWriteKind.UInt64,
+        bool IsWeak = false);
 
     private enum SelfSegmentResolveStatus
     {

src/SharpEmu.Core/Memory/PhysicalVirtualMemory.cs

@@ -4,11 +4,12 @@
 using System.Runtime.InteropServices;
 using SharpEmu.Core.Loader;
 using SharpEmu.HLE;
+using SharpEmu.HLE.Host;
 using SharpEmu.Logging;
 
 namespace SharpEmu.Core.Memory;
 
-public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryAllocator, IDisposable
+public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryAllocator, IGuestAddressSpace, IDisposable
 {
     private static readonly SharpEmuLogger Log = SharpEmuLog.For("VMEM");
 
@@ -28,41 +29,127 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
     private const ulong DefaultLazyReservePrimeBytes = 0x0400_0000UL; // 64 MiB
     private const ulong LazyReservePrimeChunkBytes = 0x0200_0000UL; // 32 MiB
 
-    private const uint MEM_COMMIT = 0x1000;
-    private const uint MEM_RESERVE = 0x2000;
-    private const uint MEM_RELEASE = 0x8000;
+    // Raw Windows PAGE_* values retained for the internal region/protection
+    // bookkeeping: regions and saved old-protection values always carry the raw
+    // value of the host platform in use, and these classification helpers only
+    // ever see values this class itself assigned (see IHostMemory.ProtectRaw).
     private const uint PAGE_EXECUTE_READ = 0x20;
     private const uint PAGE_EXECUTE_READWRITE = 0x40;
     private const uint PAGE_EXECUTE = 0x10;
     private const uint PAGE_EXECUTE_WRITECOPY = 0x80;
-    private const uint PAGE_NOACCESS = 0x01;
     private const uint PAGE_READWRITE = 0x04;
     private const uint PAGE_READONLY = 0x02;
 
+    private readonly IHostMemory _hostMemory;
     private ulong _guestAllocationArenaBase;
-    private ulong _guestAllocationOffset;
+    private readonly SortedDictionary<ulong, ulong> _guestAllocationFreeRanges = new();
+    private readonly Dictionary<ulong, (ulong Offset, ulong Size)> _guestAllocations = new();
     private static readonly ulong LazyReservePrimeBytes = ResolveLazyReservePrimeBytes();
 
-    [DllImport("kernel32.dll", SetLastError = true)]
-    private static extern void* VirtualAlloc(void* lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);
+    public PhysicalVirtualMemory(IHostMemory? hostMemory = null)
+    {
+        _hostMemory = hostMemory ?? CrossPlatformHostMemory.Instance;
+    }
 
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool VirtualFree(void* lpAddress, nuint dwSize, uint dwFreeType);
+    private sealed class CrossPlatformHostMemory : IHostMemory
+    {
+        public static readonly CrossPlatformHostMemory Instance = new();
 
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool VirtualProtect(void* lpAddress, nuint dwSize, uint flNewProtect, out uint lpflOldProtect);
+        public ulong Allocate(ulong desiredAddress, ulong size, HostPageProtection protection) =>
+            unchecked((ulong)HostMemory.Alloc(
+                (void*)desiredAddress,
+                (nuint)size,
+                HostMemory.MEM_RESERVE | HostMemory.MEM_COMMIT,
+                ToRawProtection(protection)));
 
-    [DllImport("kernel32.dll")]
-    private static extern nuint VirtualQuery(void* lpAddress, out MemoryBasicInformation64 lpBuffer, nuint dwLength);
+        public ulong Reserve(ulong desiredAddress, ulong size, HostPageProtection protection) =>
+            unchecked((ulong)HostMemory.Alloc(
+                (void*)desiredAddress,
+                (nuint)size,
+                HostMemory.MEM_RESERVE,
+                ToRawProtection(protection)));
 
-    [DllImport("kernel32.dll")]
-    private static extern void* GetCurrentProcess();
+        public bool Commit(ulong address, ulong size, HostPageProtection protection) =>
+            HostMemory.Alloc(
+                (void*)address,
+                (nuint)size,
+                HostMemory.MEM_COMMIT,
+                ToRawProtection(protection)) != null;
 
-    [DllImport("kernel32.dll", SetLastError = true)]
-    [return: MarshalAs(UnmanagedType.Bool)]
-    private static extern bool FlushInstructionCache(void* hProcess, void* lpBaseAddress, nuint dwSize);
+        public bool Free(ulong address) =>
+            HostMemory.Free((void*)address, 0, HostMemory.MEM_RELEASE);
+
+        public bool Protect(
+            ulong address,
+            ulong size,
+            HostPageProtection protection,
+            out uint rawOldProtection) =>
+            HostMemory.Protect(
+                (void*)address,
+                (nuint)size,
+                ToRawProtection(protection),
+                out rawOldProtection);
+
+        public bool ProtectRaw(
+            ulong address,
+            ulong size,
+            uint rawProtection,
+            out uint rawOldProtection) =>
+            HostMemory.Protect((void*)address, (nuint)size, rawProtection, out rawOldProtection);
+
+        public bool Query(ulong address, out HostRegionInfo info)
+        {
+            if (HostMemory.Query((void*)address, out var raw) == 0)
+            {
+                info = default;
+                return false;
+            }
+
+            var state = raw.State switch
+            {
+                HostMemory.MEM_FREE_STATE => HostRegionState.Free,
+                HostMemory.MEM_RESERVE => HostRegionState.Reserved,
+                _ => HostRegionState.Committed,
+            };
+
+            info = new HostRegionInfo(
+                raw.BaseAddress,
+                raw.AllocationBase,
+                raw.RegionSize,
+                state,
+                raw.State,
+                FromRawProtection(raw.Protect),
+                raw.Protect,
+                raw.AllocationProtect);
+            return true;
+        }
+
+        public void FlushInstructionCache(ulong address, ulong size) =>
+            HostMemory.FlushInstructionCache((void*)address, (nuint)size);
+
+        private static uint ToRawProtection(HostPageProtection protection) => protection switch
+        {
+            HostPageProtection.NoAccess => HostMemory.PAGE_NOACCESS,
+            HostPageProtection.ReadOnly => HostMemory.PAGE_READONLY,
+            HostPageProtection.ReadWrite => HostMemory.PAGE_READWRITE,
+            HostPageProtection.Execute => HostMemory.PAGE_EXECUTE,
+            HostPageProtection.ReadExecute => HostMemory.PAGE_EXECUTE_READ,
+            HostPageProtection.ReadWriteExecute => HostMemory.PAGE_EXECUTE_READWRITE,
+            HostPageProtection.ExecuteWriteCopy => 0x80,
+            _ => HostMemory.PAGE_NOACCESS,
+        };
+
+        private static HostPageProtection FromRawProtection(uint protection) => protection switch
+        {
+            HostMemory.PAGE_READONLY => HostPageProtection.ReadOnly,
+            HostMemory.PAGE_READWRITE => HostPageProtection.ReadWrite,
+            HostMemory.PAGE_EXECUTE => HostPageProtection.Execute,
+            HostMemory.PAGE_EXECUTE_READ => HostPageProtection.ReadExecute,
+            HostMemory.PAGE_EXECUTE_READWRITE => HostPageProtection.ReadWriteExecute,
+            0x80 => HostPageProtection.ExecuteWriteCopy,
+            _ => HostPageProtection.NoAccess,
+        };
+    }
 
     public bool TryAllocateAtExact(ulong desiredAddress, ulong size, bool executable, out ulong actualAddress)
     {
@@ -74,17 +161,17 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
         var alignedSize = (size + 0xFFF) & ~0xFFFUL;
         var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
-        var allocationType = MEM_COMMIT | MEM_RESERVE;
-        var result = VirtualAlloc((void*)desiredAddress, (nuint)alignedSize, allocationType, protection);
-        if (result == null)
+        var hostProtection = executable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
+        var result = _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
+        if (result == 0)
         {
             return false;
         }
 
-        actualAddress = (ulong)result;
+        actualAddress = result;
         if (actualAddress != desiredAddress)
         {
-            VirtualFree(result, 0, MEM_RELEASE);
+            _hostMemory.Free(result);
             actualAddress = 0;
             return false;
         }
@@ -119,33 +206,33 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         var alignedSize = (size + 0xFFF) & ~0xFFFUL;
 
         var protection = executable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
-        var allocationType = MEM_COMMIT | MEM_RESERVE;
+        var hostProtection = executable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
         var reservedOnly = false;
         var preferReserveOnly = !executable &&
             alignedSize >= LargeDataReserveThreshold &&
             alignedSize > FullCommitRegionLimit;
 
-        void* result = null;
+        ulong result = 0;
         if (preferReserveOnly)
         {
-            result = VirtualAlloc((void*)desiredAddress, (nuint)alignedSize, MEM_RESERVE, PAGE_READWRITE);
-            if (result == null && allowAlternative)
+            result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
+            if (result == 0 && allowAlternative)
             {
-                result = VirtualAlloc(null, (nuint)alignedSize, MEM_RESERVE, PAGE_READWRITE);
+                result = _hostMemory.Reserve(0, alignedSize, HostPageProtection.ReadWrite);
             }
 
-            if (result != null)
+            if (result != 0)
             {
                 reservedOnly = true;
             }
         }
 
-        if (result == null)
+        if (result == 0)
         {
-            result = VirtualAlloc((void*)desiredAddress, (nuint)alignedSize, allocationType, protection);
+            result = _hostMemory.Allocate(desiredAddress, alignedSize, hostProtection);
         }
 
-        if (result == null)
+        if (result == 0)
         {
             if (!allowAlternative)
             {
@@ -153,32 +240,32 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             }
 
             TraceVmem($"Could not allocate at 0x{desiredAddress:X16}, trying any address...");
-            result = VirtualAlloc(null, (nuint)alignedSize, allocationType, protection);
+            result = _hostMemory.Allocate(0, alignedSize, hostProtection);
 
-            if (result == null)
+            if (result == 0)
             {
                 if (!executable)
                 {
-                    result = VirtualAlloc((void*)desiredAddress, (nuint)alignedSize, MEM_RESERVE, PAGE_READWRITE);
-                    if (result == null && allowAlternative)
+                    result = _hostMemory.Reserve(desiredAddress, alignedSize, HostPageProtection.ReadWrite);
+                    if (result == 0 && allowAlternative)
                     {
-                        result = VirtualAlloc(null, (nuint)alignedSize, MEM_RESERVE, PAGE_READWRITE);
+                        result = _hostMemory.Reserve(0, alignedSize, HostPageProtection.ReadWrite);
                     }
 
-                    if (result != null)
+                    if (result != 0)
                     {
                         reservedOnly = true;
                     }
                 }
 
-                if (result == null)
+                if (result == 0)
                 {
                     throw new OutOfMemoryException($"Failed to allocate {alignedSize} bytes of virtual memory");
                 }
             }
         }
 
-        var actualAddress = (ulong)result;
+        var actualAddress = result;
 
         var lazyPrimeState = "n/a";
         if (reservedOnly)
@@ -191,9 +278,8 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 {
                     var remaining = primeBytes - committedBytes;
                     var chunkBytes = Math.Min(remaining, LazyReservePrimeChunkBytes);
-                    var commitAddress = (void*)(actualAddress + committedBytes);
-                    var committed = VirtualAlloc(commitAddress, (nuint)chunkBytes, MEM_COMMIT, PAGE_READWRITE);
-                    if (committed == null)
+                    var commitAddress = actualAddress + committedBytes;
+                    if (!_hostMemory.Commit(commitAddress, chunkBytes, HostPageProtection.ReadWrite))
                     {
                         break;
                     }
@@ -263,6 +349,35 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         var requestedCursor = AlignUp(desiredAddress, effectiveAlignment);
         var cursor = GetAllocationSearchCursor(desiredAddress, requestedCursor, effectiveAlignment, executable);
 
+        // macOS needs alignment over-allocation; Linux uses exact-address search.
+        if (OperatingSystem.IsMacOS())
+        {
+            var reserveSize = effectiveAlignment > PageSize
+                ? alignedSize + effectiveAlignment
+                : alignedSize;
+            try
+            {
+                var posixAddress = AllocateAt(cursor, reserveSize, executable, allowAlternative: true);
+                if (posixAddress != 0)
+                {
+                    var alignedBase = AlignUp(posixAddress, effectiveAlignment);
+                    if (alignedBase + alignedSize <= posixAddress + reserveSize)
+                    {
+                        actualAddress = alignedBase;
+                        UpdateAllocationSearchCursor(desiredAddress, effectiveAlignment, executable, alignedBase + alignedSize);
+                        return true;
+                    }
+
+                    ReleaseUntrackedAllocation(posixAddress);
+                }
+            }
+            catch
+            {
+            }
+
+            return false;
+        }
+
         for (var attempt = 0; attempt < 0x10000; attempt++)
         {
             if (cursor == 0 || ulong.MaxValue - cursor < alignedSize)
@@ -276,19 +391,10 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 continue;
             }
 
-            try
-            {
-                actualAddress = AllocateAt(cursor, alignedSize, executable, allowAlternative: false);
-                if (actualAddress == cursor)
-                {
-                    UpdateAllocationSearchCursor(desiredAddress, effectiveAlignment, executable, actualAddress + alignedSize);
-                    return true;
-                }
-
-                actualAddress = 0;
-            }
-            catch
+            if (TryAllocateAtExact(cursor, alignedSize, executable, out actualAddress))
             {
+                UpdateAllocationSearchCursor(desiredAddress, effectiveAlignment, executable, actualAddress + alignedSize);
+                return true;
             }
 
             cursor = AlignUp(cursor + effectiveAlignment, effectiveAlignment);
@@ -297,6 +403,28 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         return false;
     }
 
+    private void ReleaseUntrackedAllocation(ulong address)
+    {
+        _gate.EnterWriteLock();
+        try
+        {
+            for (var i = 0; i < _regions.Count; i++)
+            {
+                if (_regions[i].VirtualAddress == address)
+                {
+                    _regions.RemoveAt(i);
+                    break;
+                }
+            }
+        }
+        finally
+        {
+            _gate.ExitWriteLock();
+        }
+
+        _hostMemory.Free(address);
+    }
+
     public bool TryAllocateGuestMemory(ulong size, ulong alignment, out ulong address)
     {
         address = 0;
@@ -316,7 +444,9 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                         GuestAllocationArenaSize,
                         executable: false,
                         allowAlternative: true);
-                    _guestAllocationOffset = GuestAllocationArenaStartOffset;
+                    _guestAllocationFreeRanges.Add(
+                        GuestAllocationArenaStartOffset,
+                        GuestAllocationArenaSize - GuestAllocationArenaStartOffset);
                 }
                 catch (Exception)
                 {
@@ -324,18 +454,128 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 }
             }
 
-            var alignedOffset = AlignUp(_guestAllocationOffset, alignment);
-            if (alignedOffset > GuestAllocationArenaSize || size > GuestAllocationArenaSize - alignedOffset)
+            ulong rangeOffset = 0;
+            ulong rangeSize = 0;
+            ulong alignedOffset = 0;
+            var found = false;
+            foreach (var range in _guestAllocationFreeRanges)
+            {
+                alignedOffset = AlignUp(range.Key, alignment);
+                if (alignedOffset >= range.Key &&
+                    alignedOffset - range.Key <= range.Value &&
+                    size <= range.Value - (alignedOffset - range.Key))
+                {
+                    rangeOffset = range.Key;
+                    rangeSize = range.Value;
+                    found = true;
+                    break;
+                }
+            }
+
+            if (!found)
             {
                 return false;
             }
 
+            _guestAllocationFreeRanges.Remove(rangeOffset);
+            if (alignedOffset > rangeOffset)
+            {
+                _guestAllocationFreeRanges.Add(rangeOffset, alignedOffset - rangeOffset);
+            }
+
+            var allocationEnd = alignedOffset + size;
+            var rangeEnd = rangeOffset + rangeSize;
+            if (allocationEnd < rangeEnd)
+            {
+                _guestAllocationFreeRanges.Add(allocationEnd, rangeEnd - allocationEnd);
+            }
+
             address = _guestAllocationArenaBase + alignedOffset;
-            _guestAllocationOffset = alignedOffset + size;
+            _guestAllocations.Add(address, (alignedOffset, size));
             return true;
         }
     }
 
+    public bool TryFreeGuestMemory(ulong address)
+    {
+        lock (_guestAllocationGate)
+        {
+            if (!_guestAllocations.Remove(address, out var allocation))
+            {
+                return false;
+            }
+
+            var freeOffset = allocation.Offset;
+            var freeSize = allocation.Size;
+            ulong? previousOffset = null;
+            ulong? nextOffset = null;
+
+            foreach (var range in _guestAllocationFreeRanges)
+            {
+                if (range.Key < freeOffset)
+                {
+                    previousOffset = range.Key;
+                    continue;
+                }
+
+                nextOffset = range.Key;
+                break;
+            }
+
+            if (previousOffset is { } previous &&
+                previous + _guestAllocationFreeRanges[previous] == freeOffset)
+            {
+                freeOffset = previous;
+                freeSize += _guestAllocationFreeRanges[previous];
+                _guestAllocationFreeRanges.Remove(previous);
+            }
+
+            if (nextOffset is { } next && freeOffset + freeSize == next)
+            {
+                freeSize += _guestAllocationFreeRanges[next];
+                _guestAllocationFreeRanges.Remove(next);
+            }
+
+            _guestAllocationFreeRanges.Add(freeOffset, freeSize);
+            return true;
+        }
+    }
+
+    public bool TryProtect(ulong address, ulong size, GuestPageProtection protection)
+    {
+        if (size == 0)
+        {
+            return false;
+        }
+
+        return _hostMemory.Protect(address, size, ResolveProtection(protection), out _);
+    }
+
+    // Reproduces the decomposition KernelMemoryCompatExports.ResolveHostProtection
+    // performed before this seam existed; the Windows backend maps each case back
+    // to the identical PAGE_* value.
+    private static HostPageProtection ResolveProtection(GuestPageProtection protection)
+    {
+        var read = (protection & GuestPageProtection.Read) != 0;
+        var write = (protection & GuestPageProtection.Write) != 0;
+        var execute = (protection & GuestPageProtection.Execute) != 0;
+
+        if (execute)
+        {
+            return write
+                ? HostPageProtection.ReadWriteExecute
+                : read
+                    ? HostPageProtection.ReadExecute
+                    : HostPageProtection.Execute;
+        }
+
+        return write
+            ? HostPageProtection.ReadWrite
+            : read
+                ? HostPageProtection.ReadOnly
+                : HostPageProtection.NoAccess;
+    }
+
     public void Clear()
     {
         lock (_guestAllocationGate)
@@ -345,7 +585,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             {
                 foreach (var region in _regions)
                 {
-                    VirtualFree((void*)region.VirtualAddress, 0, MEM_RELEASE);
+                    _hostMemory.Free(region.VirtualAddress);
                 }
                 _regions.Clear();
                 _pageProtections.Clear();
@@ -360,7 +600,8 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             }
 
             _guestAllocationArenaBase = 0;
-            _guestAllocationOffset = 0;
+            _guestAllocationFreeRanges.Clear();
+            _guestAllocations.Clear();
         }
     }
 
@@ -419,46 +660,67 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
     private void ApplySegmentProtection(ulong mapStart, ulong mapEnd, ProgramHeaderFlags flags)
     {
+        var runStart = mapStart;
+        var runFlags = ProgramHeaderFlags.None;
+        var hasRun = false;
+
         for (var pageAddress = mapStart; pageAddress < mapEnd; pageAddress += PageSize)
         {
             _pageProtections.TryGetValue(pageAddress, out var existingFlags);
             var mergedFlags = existingFlags | flags;
             _pageProtections[pageAddress] = mergedFlags;
-            SetProtection(pageAddress, PageSize, mergedFlags);
+
+            if (!hasRun)
+            {
+                runStart = pageAddress;
+                runFlags = mergedFlags;
+                hasRun = true;
+            }
+            else if (mergedFlags != runFlags)
+            {
+                SetProtection(runStart, pageAddress - runStart, runFlags);
+                runStart = pageAddress;
+                runFlags = mergedFlags;
+            }
+        }
+
+        if (hasRun)
+        {
+            SetProtection(runStart, mapEnd - runStart, runFlags);
         }
     }
 
     private void SetProtection(ulong address, ulong size, ProgramHeaderFlags flags)
     {
-        uint protection;
+        HostPageProtection protection;
 
         if (flags == ProgramHeaderFlags.None)
         {
-            protection = PAGE_NOACCESS;
+            protection = HostPageProtection.NoAccess;
         }
         else if ((flags & ProgramHeaderFlags.Execute) != 0)
         {
             protection = (flags & ProgramHeaderFlags.Write) != 0
-                ? PAGE_EXECUTE_READWRITE
-                : PAGE_EXECUTE_READ;
+                ? HostPageProtection.ReadWriteExecute
+                : HostPageProtection.ReadExecute;
         }
         else if ((flags & ProgramHeaderFlags.Write) != 0)
         {
-            protection = PAGE_READWRITE;
+            protection = HostPageProtection.ReadWrite;
         }
         else
         {
-            protection = PAGE_READONLY;
+            protection = HostPageProtection.ReadOnly;
         }
 
-        if (!VirtualProtect((void*)address, (nuint)size, protection, out _))
+        if (!_hostMemory.Protect(address, size, protection, out _))
         {
             throw new InvalidOperationException($"Failed to set memory protection at 0x{address:X16}");
         }
 
         if ((flags & ProgramHeaderFlags.Execute) != 0)
         {
-            FlushInstructionCache(GetCurrentProcess(), (void*)address, (nuint)size);
+            _hostMemory.FlushInstructionCache(address, size);
         }
     }
 
@@ -730,7 +992,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 return true;
             }
 
-            if (!VirtualProtect(destPtr, (nuint)source.Length, PAGE_EXECUTE_READWRITE, out var oldProtect))
+            if (!_hostMemory.Protect((ulong)destPtr, (ulong)source.Length, HostPageProtection.ReadWriteExecute, out var oldProtect))
             {
                 return false;
             }
@@ -744,10 +1006,10 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
             }
             finally
             {
-                VirtualProtect(destPtr, (nuint)source.Length, oldProtect, out _);
+                _hostMemory.ProtectRaw((ulong)destPtr, (ulong)source.Length, oldProtect, out _);
                 if (IsExecutableProtection(oldProtect))
                 {
-                    FlushInstructionCache(GetCurrentProcess(), destPtr, (nuint)source.Length);
+                    _hostMemory.FlushInstructionCache((ulong)destPtr, (ulong)source.Length);
                 }
             }
 
@@ -769,9 +1031,14 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         _gate.EnterReadLock();
         try
         {
-            return FindRegion(virtualAddress, 1) is not null
-                ? (void*)virtualAddress
-                : null;
+            var region = FindRegion(virtualAddress, 1);
+            if (region is null ||
+                (region.IsReservedOnly && !EnsureRangeCommitted(virtualAddress, 1, region)))
+            {
+                return null;
+            }
+
+            return (void*)virtualAddress;
         }
         finally
         {
@@ -973,12 +1240,12 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         return protection is PAGE_READWRITE or PAGE_EXECUTE_READWRITE;
     }
 
-    private static uint GetCommitProtection(MemoryRegion region)
+    private static HostPageProtection GetCommitProtection(MemoryRegion region)
     {
-        return region.IsExecutable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
+        return region.IsExecutable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
     }
 
-    private static unsafe bool EnsureRangeCommitted(ulong address, ulong size, MemoryRegion region)
+    private bool EnsureRangeCommitted(ulong address, ulong size, MemoryRegion region)
     {
         if (size == 0 || !region.IsReservedOnly)
         {
@@ -992,7 +1259,7 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         var pageAddress = startPage;
         while (pageAddress < endPage)
         {
-            if (VirtualQuery((void*)pageAddress, out var info, (nuint)sizeof(MemoryBasicInformation64)) == 0)
+            if (!_hostMemory.Query(pageAddress, out var info))
             {
                 return false;
             }
@@ -1006,19 +1273,19 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
                 return false;
             }
 
-            if (info.State == MEM_COMMIT)
+            if (info.State == HostRegionState.Committed)
             {
                 pageAddress = rangeEnd;
                 continue;
             }
 
-            if (info.State != MEM_RESERVE)
+            if (info.State != HostRegionState.Reserved)
             {
                 return false;
             }
 
             var commitSize = rangeEnd - pageAddress;
-            if (VirtualAlloc((void*)pageAddress, (nuint)commitSize, MEM_COMMIT, commitProtection) == null)
+            if (!_hostMemory.Commit(pageAddress, commitSize, commitProtection))
             {
                 return false;
             }
@@ -1039,11 +1306,11 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
 
         var startPage = AlignDown(address, PageSize);
         var endPage = AlignUp(address + size, PageSize);
-        var temporaryProtection = region.IsExecutable ? PAGE_EXECUTE_READWRITE : PAGE_READWRITE;
+        var temporaryProtection = region.IsExecutable ? HostPageProtection.ReadWriteExecute : HostPageProtection.ReadWrite;
 
         for (var pageAddress = startPage; pageAddress < endPage; pageAddress += PageSize)
         {
-            if (!VirtualProtect((void*)pageAddress, (nuint)PageSize, temporaryProtection, out var oldProtection))
+            if (!_hostMemory.Protect(pageAddress, PageSize, temporaryProtection, out var oldProtection))
             {
                 RestorePageProtections(touchedPages);
                 touchedPages.Clear();
@@ -1056,11 +1323,11 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         return true;
     }
 
-    private static void RestorePageProtections(List<(ulong Address, uint Protection)> touchedPages)
+    private void RestorePageProtections(List<(ulong Address, uint Protection)> touchedPages)
     {
         foreach (var (pageAddress, protection) in touchedPages)
         {
-            VirtualProtect((void*)pageAddress, (nuint)PageSize, protection, out _);
+            _hostMemory.ProtectRaw(pageAddress, PageSize, protection, out _);
         }
     }
 
@@ -1117,16 +1384,4 @@ public sealed unsafe class PhysicalVirtualMemory : IVirtualMemory, IGuestMemoryA
         public uint Protection { get; set; }
     }
 
-    private struct MemoryBasicInformation64
-    {
-        public ulong BaseAddress;
-        public ulong AllocationBase;
-        public uint AllocationProtect;
-        public uint Alignment1;
-        public ulong RegionSize;
-        public uint State;
-        public uint Protect;
-        public uint Type;
-        public uint Alignment2;
-    }
 }

src/SharpEmu.Core/Memory/VirtualMemory.cs

@@ -41,15 +41,14 @@ public sealed class VirtualMemory : IVirtualMemory
 
         lock (_gate)
         {
-            foreach (var existing in _regions)
+            var insertionIndex = FindInsertionIndex(virtualAddress);
+            if ((insertionIndex > 0 && virtualAddress < _regions[insertionIndex - 1].EndAddress) ||
+                (insertionIndex < _regions.Count && endAddress > _regions[insertionIndex].Region.VirtualAddress))
             {
-                if (virtualAddress < existing.EndAddress && endAddress > existing.Region.VirtualAddress)
-                {
-                    throw new InvalidOperationException("Attempted to map an overlapping virtual memory region.");
-                }
+                throw new InvalidOperationException("Attempted to map an overlapping virtual memory region.");
             }
 
-            _regions.Add(new MappedRegion(
+            _regions.Insert(insertionIndex, new MappedRegion(
                 new VirtualMemoryRegion(virtualAddress, memorySize, fileOffset, (ulong)fileData.Length, protection),
                 endAddress,
                 backingMemory));
@@ -74,12 +73,12 @@ public sealed class VirtualMemory : IVirtualMemory
     {
         lock (_gate)
         {
-            if (!TryResolveRegion(virtualAddress, destination.Length, out var region, out var offset))
+            if (!TryValidateRange(virtualAddress, destination.Length, ProgramHeaderFlags.Read, out var regionIndex))
             {
                 return false;
             }
 
-            region.BackingMemory.AsSpan(offset, destination.Length).CopyTo(destination);
+            CopyFromRegions(virtualAddress, destination, regionIndex);
             return true;
         }
     }
@@ -88,39 +87,127 @@ public sealed class VirtualMemory : IVirtualMemory
     {
         lock (_gate)
         {
-            if (!TryResolveRegion(virtualAddress, source.Length, out var region, out var offset))
+            if (!TryValidateRange(virtualAddress, source.Length, ProgramHeaderFlags.Write, out var regionIndex))
             {
                 return false;
             }
 
-            source.CopyTo(region.BackingMemory.AsSpan(offset, source.Length));
+            CopyToRegions(virtualAddress, source, regionIndex);
             return true;
         }
     }
 
-    private bool TryResolveRegion(ulong virtualAddress, int length, out MappedRegion region, out int offset)
+    private bool TryValidateRange(
+        ulong virtualAddress,
+        int length,
+        ProgramHeaderFlags requiredProtection,
+        out int regionIndex)
     {
-        foreach (var candidate in _regions)
+        regionIndex = FindContainingRegionIndex(virtualAddress);
+        if (regionIndex < 0)
         {
-            if (virtualAddress < candidate.Region.VirtualAddress || virtualAddress >= candidate.EndAddress)
-            {
-                continue;
-            }
-
-            var candidateOffset = checked((int)(virtualAddress - candidate.Region.VirtualAddress));
-            if (candidateOffset + length > candidate.BackingMemory.Length)
-            {
-                break;
-            }
-
-            region = candidate;
-            offset = candidateOffset;
-            return true;
+            return false;
         }
 
-        region = default;
-        offset = 0;
-        return false;
+        var currentAddress = virtualAddress;
+        var remaining = length;
+        var currentIndex = regionIndex;
+        while (true)
+        {
+            if (currentIndex >= _regions.Count)
+            {
+                return false;
+            }
+
+            var region = _regions[currentIndex];
+            if (currentAddress < region.Region.VirtualAddress ||
+                currentAddress >= region.EndAddress ||
+                (region.Region.Protection & requiredProtection) == 0)
+            {
+                return false;
+            }
+
+            if (remaining == 0)
+            {
+                return true;
+            }
+
+            var available = region.EndAddress - currentAddress;
+            var chunkLength = (int)Math.Min((ulong)remaining, available);
+            remaining -= chunkLength;
+            if (remaining == 0)
+            {
+                return true;
+            }
+
+            currentAddress += (ulong)chunkLength;
+            currentIndex++;
+        }
+    }
+
+    private int FindContainingRegionIndex(ulong virtualAddress)
+    {
+        var insertionIndex = FindInsertionIndex(virtualAddress);
+        if (insertionIndex < _regions.Count &&
+            _regions[insertionIndex].Region.VirtualAddress == virtualAddress)
+        {
+            return insertionIndex;
+        }
+
+        var candidateIndex = insertionIndex - 1;
+        return candidateIndex >= 0 && virtualAddress < _regions[candidateIndex].EndAddress
+            ? candidateIndex
+            : -1;
+    }
+
+    private void CopyFromRegions(ulong virtualAddress, Span<byte> destination, int regionIndex)
+    {
+        var copied = 0;
+        var currentAddress = virtualAddress;
+        while (copied < destination.Length)
+        {
+            var region = _regions[regionIndex++];
+            var regionOffset = checked((int)(currentAddress - region.Region.VirtualAddress));
+            var chunkLength = Math.Min(destination.Length - copied, region.BackingMemory.Length - regionOffset);
+            region.BackingMemory.AsSpan(regionOffset, chunkLength).CopyTo(destination[copied..]);
+            copied += chunkLength;
+            currentAddress += (ulong)chunkLength;
+        }
+    }
+
+    private void CopyToRegions(ulong virtualAddress, ReadOnlySpan<byte> source, int regionIndex)
+    {
+        var copied = 0;
+        var currentAddress = virtualAddress;
+        while (copied < source.Length)
+        {
+            var region = _regions[regionIndex++];
+            var regionOffset = checked((int)(currentAddress - region.Region.VirtualAddress));
+            var chunkLength = Math.Min(source.Length - copied, region.BackingMemory.Length - regionOffset);
+            source.Slice(copied, chunkLength).CopyTo(region.BackingMemory.AsSpan(regionOffset, chunkLength));
+            copied += chunkLength;
+            currentAddress += (ulong)chunkLength;
+        }
+    }
+
+    private int FindInsertionIndex(ulong virtualAddress)
+    {
+        var lower = 0;
+        var upper = _regions.Count;
+        while (lower < upper)
+        {
+            var middle = lower + ((upper - lower) / 2);
+            if (_regions[middle].Region.VirtualAddress < virtualAddress)
+            {
+                lower = middle + 1;
+            }
+            else
+            {
+                upper = middle;
+            }
+        }
+
+        return lower;
     }
 
     private readonly record struct MappedRegion(VirtualMemoryRegion Region, ulong EndAddress, byte[] BackingMemory);

src/SharpEmu.Core/Runtime/SharpEmuRuntime.cs

@@ -11,20 +11,17 @@ using SharpEmu.Libs.VideoOut;
 using SharpEmu.Libs.Kernel;
 using SharpEmu.Libs.AppContent;
 using SharpEmu.Libs.SaveData;
-using SharpEmu.Logging;
+using SharpEmu.Libs.Fiber;
 using System.Buffers.Binary;
 using System.Collections.Generic;
 using System.Linq;
 using System.Text;
-using System.IO;
 
 namespace SharpEmu.Core.Runtime;
 
 public sealed class SharpEmuRuntime : ISharpEmuRuntime
 {
-    private static readonly SharpEmuLogger Log = SharpEmuLog.For("Runtime");
-
-    private readonly record struct LoadedModuleImage(string Path, SelfImage Image);
+    private readonly record struct LoadedModuleImage(string Path, SelfImage Image, int Handle, bool StartAtBoot);
 
     private static readonly HashSet<string> PreloadSkipModules = new(StringComparer.OrdinalIgnoreCase)
     {
@@ -83,7 +80,9 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             ImportTraceLimit = Math.Max(0, options.ImportTraceLimit),
         };
         var moduleManager = new ModuleManager();
-        moduleManager.RegisterFromAssembly(typeof(KernelExports).Assembly, Generation.Gen4 | Generation.Gen5, Aerolib.Instance);
+        // The compile-time generated registry (SharpEmu.SourceGenerators) is the sole
+        // registration source; content tests in SharpEmu.Libs.Tests pin its invariants.
+        moduleManager.RegisterExports(SharpEmu.Generated.SysAbiExportRegistry.CreateExports(Generation.Gen4 | Generation.Gen5));
         moduleManager.Freeze();
 
         var virtualMemory = new PhysicalVirtualMemory();
@@ -131,20 +130,20 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
     {
         var normalizedEbootPath = Path.GetFullPath(ebootPath);
         using var app0Binding = BindApp0Root(normalizedEbootPath);
-        Log.Info($"Loading: {ebootPath}");
+        Console.Error.WriteLine($"[RUNTIME] Loading: {ebootPath}");
         LastExecutionDiagnostics = null;
         LastExecutionTrace = null;
         LastSessionSummary = null;
         LastBasicBlockTrace = null;
         LastMilestoneLog = null;
+        FiberExports.ResetRuntimeState();
         KernelModuleRegistry.Reset();
         var image = LoadImage(normalizedEbootPath);
-        VideoOutExports.ConfigureApplicationInfo(image.Title, image.TitleId, image.Version, BuildInfo.CommitSha);
+        VideoOutExports.ConfigureApplicationInfo(image.Title, image.TitleId, image.Version);
         SaveDataExports.ConfigureApplicationInfo(image.TitleId);
-        LogAppBundleInfo(normalizedEbootPath, image);
-        RegisterLoadedModule(normalizedEbootPath, image, isMain: true, isSystemModule: false);
+        _ = RegisterLoadedModule(normalizedEbootPath, image, isMain: true, isSystemModule: false);
         KernelRuntimeCompatExports.ConfigureProcessProcParamAddress(image.ProcParamAddress);
-        Log.Info($"Entry: 0x{image.EntryPoint:X16}");
+        Console.Error.WriteLine($"[RUNTIME] Entry: 0x{image.EntryPoint:X16}");
         var generation = image.ElfHeader.AbiVersion == 2 ? Generation.Gen5 : Generation.Gen4;
         var activeImportStubs = new Dictionary<ulong, string>(image.ImportStubs);
         var activeRuntimeSymbols = new Dictionary<string, ulong>(image.RuntimeSymbols, StringComparer.Ordinal);
@@ -167,7 +166,7 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             processImageName);
         if (initializerResult is { } failedInitializerResult)
         {
-            Log.Error($"Initializer dispatch failed: {failedInitializerResult}");
+            Console.Error.WriteLine($"[RUNTIME] Initializer dispatch failed: {failedInitializerResult}");
             LastExecutionTrace = _cpuDispatcher.LastImportResolutionTrace;
             LastMilestoneLog = _cpuDispatcher.LastMilestoneLog;
             LastSessionSummary = BuildSessionSummary(_cpuDispatcher.LastSessionSummary);
@@ -175,8 +174,8 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             return failedInitializerResult;
         }
 
-        Log.Info($"Dispatching, gen: {generation}");
-        Log.Debug($"About to call DispatchEntry with entryPoint=0x{image.EntryPoint:X16}");
+        Console.Error.WriteLine($"[RUNTIME] Dispatching, gen: {generation}");
+        Console.Error.WriteLine($"[RUNTIME] About to call DispatchEntry with entryPoint=0x{image.EntryPoint:X16}");
 
         var result = _cpuDispatcher.DispatchEntry(
             image.EntryPoint,
@@ -186,8 +185,8 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             processImageName,
             _cpuExecutionOptions);
 
-        Log.Info($"DispatchEntry returned: {result}");
-        Log.Info($"Dispatch result: {result}");
+        Console.Error.WriteLine($"[RUNTIME] DispatchEntry returned: {result}");
+        Console.Error.WriteLine($"[RUNTIME] Dispatch result: {result}");
         LastExecutionTrace = _cpuDispatcher.LastImportResolutionTrace;
         LastMilestoneLog = _cpuDispatcher.LastMilestoneLog;
         LastSessionSummary = BuildSessionSummary(_cpuDispatcher.LastSessionSummary);
@@ -358,66 +357,6 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         return result;
     }
 
-    private static void LogAppBundleInfo(string ebootPath, SelfImage image)
-    {
-        var executableName = Path.GetFileName(ebootPath);
-        if (string.IsNullOrWhiteSpace(executableName))
-        {
-            executableName = "eboot.bin";
-        }
-
-        var displayName = string.IsNullOrWhiteSpace(image.Title) ? "(unknown)" : image.Title!.Trim();
-        var titleId = string.IsNullOrWhiteSpace(image.TitleId) ? "(unknown)" : image.TitleId!.Trim();
-        var version = string.IsNullOrWhiteSpace(image.Version) ? "(unknown)" : image.Version!.Trim();
-        var contentId = ResolveContentId(Path.GetDirectoryName(ebootPath)) ?? "(unknown)";
-
-        var builder = new StringBuilder();
-        builder.AppendLine("App bundle info:");
-        builder.AppendLine($"- Display name: {displayName}");
-        builder.AppendLine($"- Version: {version}");
-        builder.AppendLine($"- Title ID: {titleId}");
-        builder.AppendLine($"- Content ID: {contentId}");
-        builder.AppendLine($"- Executable: {executableName}");
-        builder.Append("- Platform: PlayStation 5");
-        Log.Info(builder.ToString());
-    }
-
-    private static string? ResolveContentId(string? bundleRoot)
-    {
-        if (string.IsNullOrEmpty(bundleRoot))
-        {
-            return null;
-        }
-
-        foreach (var candidate in new[]
-        {
-            Path.Combine(bundleRoot, "sce_sys", "param.json"),
-            Path.Combine(bundleRoot, "param.json"),
-        })
-        {
-            if (!File.Exists(candidate))
-            {
-                continue;
-            }
-
-            try
-            {
-                using var doc = System.Text.Json.JsonDocument.Parse(File.ReadAllBytes(candidate));
-                if (doc.RootElement.TryGetProperty("contentId", out var contentId))
-                {
-                    return contentId.GetString();
-                }
-            }
-            catch (Exception ex) when (ex is IOException or System.Text.Json.JsonException)
-            {
-            }
-
-            break;
-        }
-
-        return null;
-    }
-
     private static App0BindingScope? BindApp0Root(string normalizedEbootPath)
     {
         const string app0VariableName = "SHARPEMU_APP0_DIR";
@@ -432,6 +371,20 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             return null;
         }
 
+        // Dump tools commonly place decrypted executables in an app0/decrypted
+        // sidecar while leaving Unity data in the parent app0 directory. Keep
+        // loading code/modules beside the decrypted eboot, but mount /app0 at
+        // the content-bearing parent so boot.config, metadata and assets resolve.
+        if (string.Equals(Path.GetFileName(app0Root), "decrypted", StringComparison.OrdinalIgnoreCase))
+        {
+            var parentRoot = Path.GetDirectoryName(app0Root);
+            if (!string.IsNullOrWhiteSpace(parentRoot) &&
+                Directory.Exists(Path.Combine(parentRoot, "Media")))
+            {
+                app0Root = parentRoot;
+            }
+        }
+
         Environment.SetEnvironmentVariable(app0VariableName, app0Root);
         return new App0BindingScope(app0VariableName);
     }
@@ -477,6 +430,56 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         return null;
     }
 
+    private bool TryGetEhFrameInfo(
+        SelfImage image,
+        ulong imageSize,
+        out ulong ehFrameHeaderAddress,
+        out ulong ehFrameAddress,
+        out ulong ehFrameSize)
+    {
+        ehFrameHeaderAddress = 0;
+        ehFrameAddress = 0;
+        ehFrameSize = 0;
+        var imageBase = image.EntryPoint >= image.ElfHeader.EntryPoint
+            ? image.EntryPoint - image.ElfHeader.EntryPoint
+            : 0UL;
+        for (var i = 0; i < image.ProgramHeaders.Count; i++)
+        {
+            var header = image.ProgramHeaders[i];
+            if (header.HeaderType != ProgramHeaderType.GnuEhFrame || header.MemorySize < 8)
+            {
+                continue;
+            }
+
+            var headerAddress = imageBase + header.VirtualAddress;
+            Span<byte> ehHeader = stackalloc byte[8];
+            if (!_virtualMemory.TryRead(headerAddress, ehHeader) ||
+                ehHeader[0] != 1 ||
+                ehHeader[1] != 0x1B)
+            {
+                continue;
+            }
+
+            var relativeOffset = BinaryPrimitives.ReadInt32LittleEndian(ehHeader[4..]);
+            ehFrameHeaderAddress = headerAddress;
+            ehFrameAddress = unchecked((ulong)((long)headerAddress + 4 + relativeOffset));
+            if (ehFrameAddress < 0x10000)
+            {
+                continue;
+            }
+
+            var relativeEhFrameAddress = ehFrameAddress - imageBase;
+            ehFrameSize = header.VirtualAddress > relativeEhFrameAddress
+                ? header.VirtualAddress - relativeEhFrameAddress
+                : imageSize > header.VirtualAddress
+                    ? imageSize - header.VirtualAddress
+                    : 0;
+            return true;
+        }
+
+        return false;
+    }
+
     private OrbisGen2Result? RunPreloadedModuleInitializers(
         IReadOnlyList<LoadedModuleImage> loadedModuleImages,
         Generation generation,
@@ -486,20 +489,30 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         for (var i = 0; i < loadedModuleImages.Count; i++)
         {
             var loadedModule = loadedModuleImages[i];
+            if (!loadedModule.StartAtBoot)
+            {
+                continue;
+            }
+
             var initEntryPoint = loadedModule.Image.InitFunctionEntryPoint;
             if (initEntryPoint < 0x10000)
             {
                 continue;
             }
 
+            if (!KernelModuleRegistry.TryBeginModuleStart(loadedModule.Handle, out _))
+            {
+                continue;
+            }
+
             var moduleName = Path.GetFileName(loadedModule.Path);
             if (string.IsNullOrWhiteSpace(moduleName))
             {
                 moduleName = $"module#{i}";
             }
 
-            Log.Info(
-                $"Starting module {moduleName}: dt_init=0x{initEntryPoint:X16}");
+            Console.Error.WriteLine(
+                $"[RUNTIME] Starting module {moduleName}: dt_init=0x{initEntryPoint:X16}");
 
             var result = _cpuDispatcher.DispatchModuleInitializer(
                 initEntryPoint,
@@ -508,10 +521,13 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
                 activeRuntimeSymbols,
                 moduleName,
                 _cpuExecutionOptions);
+            KernelModuleRegistry.CompleteModuleStart(
+                loadedModule.Handle,
+                result == OrbisGen2Result.ORBIS_GEN2_OK);
             if (result != OrbisGen2Result.ORBIS_GEN2_OK)
             {
-                Log.Error(
-                    $"Module start failed: {moduleName} -> {result}");
+                Console.Error.WriteLine(
+                    $"[RUNTIME] Module start failed: {moduleName} -> {result}");
                 return result;
             }
         }
@@ -532,8 +548,8 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             return null;
         }
 
-        Log.Info(
-            $"Running initializers for {label}: preinit={image.PreInitializerFunctions.Count}, init={image.InitializerFunctions.Count}");
+        Console.Error.WriteLine(
+            $"[RUNTIME] Running initializers for {label}: preinit={image.PreInitializerFunctions.Count}, init={image.InitializerFunctions.Count}");
 
         var result = RunInitializerList(
             $"{label}:preinit",
@@ -572,8 +588,8 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
                 continue;
             }
 
-            Log.Debug(
-                $"  Initializer {label}[{i}] -> 0x{initializerAddress:X16}");
+            Console.Error.WriteLine(
+                $"[RUNTIME]   Initializer {label}[{i}] -> 0x{initializerAddress:X16}");
 
             var result = _cpuDispatcher.DispatchEntry(
                 initializerAddress,
@@ -605,12 +621,17 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
 
         var moduleDirectories = new[]
         {
-            Path.Combine(ebootDirectory, "sce_module"),
-            Path.Combine(ebootDirectory, "sce_modules"),
-            Path.Combine(ebootDirectory, "Media", "Modules"),
+            (Path: Path.Combine(ebootDirectory, "sce_module"), StartAtBoot: true),
+            (Path: Path.Combine(ebootDirectory, "sce_modules"), StartAtBoot: true),
+            (Path: Path.Combine(ebootDirectory, "Media", "Modules"), StartAtBoot: true),
+            // Unity native plugins are loaded later through sceKernelLoadStartModule. Map
+            // them up front so the HLE loader can return a real module handle and dlsym
+            // can resolve their exports, but defer DT_INIT until the guest requests them.
+            (Path: Path.Combine(ebootDirectory, "Media", "Plugins"), StartAtBoot: false),
         }
-        .Distinct(StringComparer.OrdinalIgnoreCase)
-        .Where(Directory.Exists)
+        .GroupBy(entry => entry.Path, StringComparer.OrdinalIgnoreCase)
+        .Select(group => group.First())
+        .Where(entry => Directory.Exists(entry.Path))
         .ToArray();
 
         if (moduleDirectories.Length == 0)
@@ -620,28 +641,30 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
 
         var allModulePaths = moduleDirectories
             .SelectMany(directory => Directory
-                .EnumerateFiles(directory)
-                .OrderBy(path => path, StringComparer.OrdinalIgnoreCase))
-            .Where(path =>
+                .EnumerateFiles(directory.Path)
+                .OrderBy(path => path, StringComparer.OrdinalIgnoreCase)
+                .Select(path => (Path: path, directory.StartAtBoot)))
+            .Where(entry =>
             {
-                var extension = Path.GetExtension(path);
+                var extension = Path.GetExtension(entry.Path);
                 return string.Equals(extension, ".prx", StringComparison.OrdinalIgnoreCase) ||
                        string.Equals(extension, ".sprx", StringComparison.OrdinalIgnoreCase);
             })
-            .Distinct(StringComparer.OrdinalIgnoreCase)
+            .GroupBy(entry => entry.Path, StringComparer.OrdinalIgnoreCase)
+            .Select(group => group.First())
             .ToArray();
 
         var modulePaths = allModulePaths
-            .Where(ShouldPreloadModule)
+            .Where(entry => ShouldPreloadModule(entry.Path))
             .ToArray();
         var skippedModules = allModulePaths
-            .Where(path => !ShouldPreloadModule(path))
-            .Select(Path.GetFileName)
+            .Where(entry => !ShouldPreloadModule(entry.Path))
+            .Select(entry => Path.GetFileName(entry.Path))
             .Where(name => !string.IsNullOrWhiteSpace(name))
             .ToArray();
         if (skippedModules.Length > 0)
         {
-            Log.Info($"Skipping {skippedModules.Length} core module(s): {string.Join(", ", skippedModules)}");
+            Console.Error.WriteLine($"[RUNTIME] Skipping {skippedModules.Length} core module(s): {string.Join(", ", skippedModules)}");
         }
 
         if (modulePaths.Length == 0)
@@ -649,14 +672,15 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             return loadedImages;
         }
 
-        Log.Debug($"Module search directories: {string.Join(", ", moduleDirectories)}");
-        Log.Info($"Loading {modulePaths.Length} module(s)...");
+        Console.Error.WriteLine($"[RUNTIME] Module search directories: {string.Join(", ", moduleDirectories.Select(entry => entry.Path))}");
+        Console.Error.WriteLine($"[RUNTIME] Loading {modulePaths.Length} module(s)...");
         var loadedModules = 0;
         var failedModules = 0;
         var mergedImportCount = 0;
         var mergedSymbolCount = 0;
-        foreach (var modulePath in modulePaths)
+        foreach (var moduleEntry in modulePaths)
         {
+            var modulePath = moduleEntry.Path;
             try
             {
                 var fileInfo = new FileInfo(modulePath);
@@ -681,25 +705,52 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
 
                 mergedImportCount += MergeImportStubs(importStubs, moduleImage.ImportStubs, modulePath);
                 mergedSymbolCount += MergeRuntimeSymbols(runtimeSymbols, moduleImage.RuntimeSymbols);
-                RegisterLoadedModule(modulePath, moduleImage, isMain: false, isSystemModule: false);
-                loadedImages.Add(new LoadedModuleImage(modulePath, moduleImage));
+                InstallNativePluginCompatibilityHooks(importStubs, moduleImage, modulePath);
+                var moduleHandle = RegisterLoadedModule(modulePath, moduleImage, isMain: false, isSystemModule: false);
+                var moduleName = Path.GetFileName(modulePath);
+                var startAtBoot = moduleEntry.StartAtBoot ||
+                    string.Equals(moduleName, "libfmod.prx", StringComparison.OrdinalIgnoreCase) ||
+                    string.Equals(moduleName, "libfmodstudio.prx", StringComparison.OrdinalIgnoreCase);
+                loadedImages.Add(new LoadedModuleImage(modulePath, moduleImage, moduleHandle, startAtBoot));
                 loadedModules++;
 
-                Log.Info(
-                    $"Loaded module {Path.GetFileName(modulePath)}: entry=0x{moduleImage.EntryPoint:X16}, imports={moduleImage.ImportStubs.Count}, symbols={moduleImage.RuntimeSymbols.Count}");
+                Console.Error.WriteLine(
+                    $"[RUNTIME] Loaded module {Path.GetFileName(modulePath)}: entry=0x{moduleImage.EntryPoint:X16}, imports={moduleImage.ImportStubs.Count}, symbols={moduleImage.RuntimeSymbols.Count}");
             }
             catch (Exception ex)
             {
                 failedModules++;
-                Log.Error($"Module load failed: {modulePath} ({ex.GetType().Name}: {ex.Message})", ex);
+                Console.Error.WriteLine($"[RUNTIME] Module load failed: {modulePath} ({ex.GetType().Name}: {ex.Message})");
             }
         }
 
-        Log.Info(
-            $"Module preload summary: loaded={loadedModules}, failed={failedModules}, merged_imports={mergedImportCount}, merged_symbols={mergedSymbolCount}");
+        Console.Error.WriteLine(
+            $"[RUNTIME] Module preload summary: loaded={loadedModules}, failed={failedModules}, merged_imports={mergedImportCount}, merged_symbols={mergedSymbolCount}");
         return loadedImages;
     }
 
+    private static void InstallNativePluginCompatibilityHooks(
+        IDictionary<ulong, string> importStubs,
+        SelfImage moduleImage,
+        string modulePath)
+    {
+        if (!string.Equals(Path.GetFileName(modulePath), "libfmod.prx", StringComparison.OrdinalIgnoreCase))
+        {
+            return;
+        }
+
+        ReadOnlySpan<string> compatibilityNids = ["uPLTdl3psGk"];
+        foreach (var nid in compatibilityNids)
+        {
+            if (moduleImage.RuntimeSymbols.TryGetValue(nid, out var address) && address >= 0x10000)
+            {
+                importStubs[address] = nid;
+                Console.Error.WriteLine(
+                    $"[RUNTIME] Installed FMOD compatibility hook: {nid} -> 0x{address:X16}");
+            }
+        }
+    }
+
     private void RebindImportedDataSymbols(
         SelfImage mainImage,
         IReadOnlyList<LoadedModuleImage> loadedModuleImages,
@@ -716,8 +767,8 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
 
         if (rebound != 0 || unresolved != 0)
         {
-            Log.Info(
-                $"Imported data rebind: rebound={rebound}, unresolved={unresolved}");
+            Console.Error.WriteLine(
+                $"[RUNTIME] Imported data rebind: rebound={rebound}, unresolved={unresolved}");
         }
     }
 
@@ -749,8 +800,8 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             {
                 if (logRebind)
                 {
-                    Log.Warning(
-                        $"Imported data unresolved: nid={relocation.Nid} target=0x{relocation.TargetAddress:X16} addend=0x{unchecked((ulong)relocation.Addend):X16}");
+                    Console.Error.WriteLine(
+                        $"[RUNTIME] Imported data unresolved: nid={relocation.Nid} target=0x{relocation.TargetAddress:X16} addend=0x{unchecked((ulong)relocation.Addend):X16}");
                 }
 
                 unresolved++;
@@ -762,8 +813,8 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             {
                 if (logRebind)
                 {
-                    Log.Error(
-                        $"Imported data write-failed: nid={relocation.Nid} target=0x{relocation.TargetAddress:X16} value=0x{reboundValue:X16}");
+                    Console.Error.WriteLine(
+                        $"[RUNTIME] Imported data write-failed: nid={relocation.Nid} target=0x{relocation.TargetAddress:X16} value=0x{reboundValue:X16}");
                 }
 
                 unresolved++;
@@ -772,8 +823,8 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
 
             if (logRebind)
             {
-                Log.Debug(
-                    $"Imported data rebound: nid={relocation.Nid} target=0x{relocation.TargetAddress:X16} value=0x{reboundValue:X16}");
+                Console.Error.WriteLine(
+                    $"[RUNTIME] Imported data rebound: nid={relocation.Nid} target=0x{relocation.TargetAddress:X16} value=0x{reboundValue:X16}");
             }
 
             rebound++;
@@ -809,8 +860,8 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             {
                 if (!string.Equals(existingNid, nid, StringComparison.Ordinal))
                 {
-                    Log.Warning(
-                        $"Import stub conflict at 0x{address:X16}: keep={existingNid}, skip={nid} ({Path.GetFileName(modulePath)})");
+                    Console.Error.WriteLine(
+                        $"[RUNTIME] Import stub conflict at 0x{address:X16}: keep={existingNid}, skip={nid} ({Path.GetFileName(modulePath)})");
                 }
 
                 continue;
@@ -904,7 +955,7 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
         return !PreloadSkipModules.Contains(fileName);
     }
 
-    private static void RegisterLoadedModule(string modulePath, SelfImage image, bool isMain, bool isSystemModule)
+    private int RegisterLoadedModule(string modulePath, SelfImage image, bool isMain, bool isSystemModule)
     {
         if (!TryComputeImageRange(image, out var baseAddress, out var size))
         {
@@ -912,15 +963,27 @@ public sealed class SharpEmuRuntime : ISharpEmuRuntime
             size = 0;
         }
 
+        _ = TryGetEhFrameInfo(
+            image,
+            size,
+            out var ehFrameHeaderAddress,
+            out var ehFrameAddress,
+            out var ehFrameSize);
         var handle = KernelModuleRegistry.RegisterModule(
             modulePath,
             baseAddress,
             size,
             image.EntryPoint,
+            image.InitFunctionEntryPoint,
+            ehFrameHeaderAddress,
+            ehFrameAddress,
+            ehFrameSize,
             isMain,
             isSystemModule);
-        Log.Info(
-            $"Registered module handle={handle} name={Path.GetFileName(modulePath)} base=0x{baseAddress:X16} size=0x{size:X16}");
+        KernelModuleRegistry.RegisterModuleSymbols(handle, image.RuntimeSymbols);
+        Console.Error.WriteLine(
+            $"[RUNTIME] Registered module handle={handle} name={Path.GetFileName(modulePath)} base=0x{baseAddress:X16} size=0x{size:X16}");
+        return handle;
     }
 
     private static bool TryComputeImageRange(SelfImage image, out ulong baseAddress, out ulong size)

src/SharpEmu.Core/packages.lock.json

@@ -1,127 +0,0 @@
-{
-  "version": 2,
-  "dependencies": {
-    "net10.0": {
-      "Iced": {
-        "type": "Direct",
-        "requested": "[1.21.0, )",
-        "resolved": "1.21.0",
-        "contentHash": "dv5+81Q1TBQvVMSOOOmRcjJmvWcX3BZPZsIq31+RLc5cNft0IHAyNlkdb7ZarOWG913PyBoFDsDXoCIlKmLclg=="
-      },
-      "Microsoft.DotNet.PlatformAbstractions": {
-        "type": "Transitive",
-        "resolved": "3.1.6",
-        "contentHash": "jek4XYaQ/PGUwDKKhwR8K47Uh1189PFzMeLqO83mXrXQVIpARZCcfuDedH50YDTepBkfijCZN5U/vZi++erxtg=="
-      },
-      "Microsoft.Extensions.DependencyModel": {
-        "type": "Transitive",
-        "resolved": "9.0.9",
-        "contentHash": "fNGvKct2De8ghm0Bpfq0iWthtzIWabgOTi+gJhNOPhNJIowXNEUE2eZNW/zNCzrHVA3PXg2yZ+3cWZndC2IqYA=="
-      },
-      "Silk.NET.Core": {
-        "type": "Transitive",
-        "resolved": "2.23.0",
-        "contentHash": "D7AT/nnwlB+4RZ84XY8QNGBZMJI5z9l4CSSETIJ1wCfRJzRt/341y3MRZ4HbnFz4r/IGaWOEZr86iE+0/65yyQ==",
-        "dependencies": {
-          "Microsoft.DotNet.PlatformAbstractions": "3.1.6",
-          "Microsoft.Extensions.DependencyModel": "9.0.9"
-        }
-      },
-      "Silk.NET.GLFW": {
-        "type": "Transitive",
-        "resolved": "2.23.0",
-        "contentHash": "UIs4sH57xlPUNHQ/1bt9rymPWlGy8IMDCNv86h0iM4TOA1CkIx0XM/n/tA4AReh1zQkNrvkxPEdZ3Blvy1dyXg==",
-        "dependencies": {
-          "Silk.NET.Core": "2.23.0",
-          "Ultz.Native.GLFW": "3.4.0"
-        }
-      },
-      "Silk.NET.Maths": {
-        "type": "Transitive",
-        "resolved": "2.23.0",
-        "contentHash": "r8PdIVzME8EH0qAgbmRPO87I4GfgR2j8TofT7EMuRJDf1QluoQwnVypDoFJjQ2ZBSRsGYk5unYxxogI05Ogsmw=="
-      },
-      "Silk.NET.Windowing.Common": {
-        "type": "Transitive",
-        "resolved": "2.23.0",
-        "contentHash": "ThStSinmY9KQI8DGiF5XEhkLJVnBcgRTBTzL9ijg1wMZAYuckz7ykrNw04fjRm2Gryh6tCNGbvz2XaY0efeFzg==",
-        "dependencies": {
-          "Silk.NET.Core": "2.23.0",
-          "Silk.NET.Maths": "2.23.0"
-        }
-      },
-      "Silk.NET.Windowing.Glfw": {
-        "type": "Transitive",
-        "resolved": "2.23.0",
-        "contentHash": "aYBudKmENmvLRn9p15HbdvlQTnnXskcDfTfbYwSb/4fr263rGLwYuDw/txUEc2jihHJiWCp5+75Y7z5wTJWl7g==",
-        "dependencies": {
-          "Silk.NET.GLFW": "2.23.0",
-          "Silk.NET.Windowing.Common": "2.23.0"
-        }
-      },
-      "Ultz.Native.GLFW": {
-        "type": "Transitive",
-        "resolved": "3.4.0",
-        "contentHash": "Iy22JopynbOJ32vA0lBhFEzGi65GQJBuJHYBYRBpydrDpNoTiHnjIXfA65Gu+8qsOr/ZEoIF8r9aHCgAXuO6DA=="
-      },
-      "sharpemu.hle": {
-        "type": "Project",
-        "dependencies": {
-          "SharpEmu.Logging": "[1.0.0, )"
-        }
-      },
-      "sharpemu.libs": {
-        "type": "Project",
-        "dependencies": {
-          "SharpEmu.HLE": "[1.0.0, )",
-          "Silk.NET.Vulkan": "[2.23.0, )",
-          "Silk.NET.Vulkan.Extensions.EXT": "[2.23.0, )",
-          "Silk.NET.Vulkan.Extensions.KHR": "[2.23.0, )",
-          "Silk.NET.Windowing": "[2.23.0, )"
-        }
-      },
-      "sharpemu.logging": {
-        "type": "Project"
-      },
-      "Silk.NET.Vulkan": {
-        "type": "CentralTransitive",
-        "requested": "[2.23.0, )",
-        "resolved": "2.23.0",
-        "contentHash": "3/irtlSWXZ3eTi8N6nelI6L34NTB8ZJHpqVMNzZx2aX7Ek9YEQ34NoQW8/Tljrtmkg8KRhHW8hKTEzZaKV8PgA==",
-        "dependencies": {
-          "Silk.NET.Core": "2.23.0"
-        }
-      },
-      "Silk.NET.Vulkan.Extensions.EXT": {
-        "type": "CentralTransitive",
-        "requested": "[2.23.0, )",
-        "resolved": "2.23.0",
-        "contentHash": "+Oth189ksRiL6HvGCwIdnsYHawqrbO8y49u1H61z3wsfcHhQZeVDYe/wF5LD7fk3NcdgDvwFD3mLm1QWhdZySw==",
-        "dependencies": {
-          "Silk.NET.Core": "2.23.0",
-          "Silk.NET.Vulkan": "2.23.0"
-        }
-      },
-      "Silk.NET.Vulkan.Extensions.KHR": {
-        "type": "CentralTransitive",
-        "requested": "[2.23.0, )",
-        "resolved": "2.23.0",
-        "contentHash": "uRaf4j+SmH3DumjSSSUbFg33BnsGZUyXGj93O9NgGKZSJN3OTmNmQDxRew+/KiVLcgH6qzbto8aNGZ++j9GFWg==",
-        "dependencies": {
-          "Silk.NET.Core": "2.23.0",
-          "Silk.NET.Vulkan": "2.23.0"
-        }
-      },
-      "Silk.NET.Windowing": {
-        "type": "CentralTransitive",
-        "requested": "[2.23.0, )",
-        "resolved": "2.23.0",
-        "contentHash": "OPNPmt/lRyUKVYrFLQXVxyATqD3MKLc1iY1oKx1/2GppgmZxVZPwN12tekrQ4C7408kgB1L5JD1Wnirqqeb2kg==",
-        "dependencies": {
-          "Silk.NET.Windowing.Common": "2.23.0",
-          "Silk.NET.Windowing.Glfw": "2.23.0"
-        }
-      }
-    }
-  }
-}

src/SharpEmu.GUI/GuiSettings.cs

@@ -48,6 +48,9 @@ public sealed class GuiSettings
     /// <summary>Publish launcher/game status to Discord Rich Presence.</summary>
     public bool DiscordRichPresence { get; set; } = true;
 
+    /// <summary>Names of SHARPEMU_* switches set to "1" in the emulator's environment at launch.</summary>
+    public List<string> EnvironmentToggles { get; set; } = new();
+
     /// <summary>
     /// Discord application ID used for Rich Presence; the default is the
     /// SharpEmu application. Override to rebrand what Discord shows as

src/SharpEmu.GUI/Languages/br.json

@@ -0,0 +1,146 @@
+{
+  "_languageName": "Português (Brasil)",
+
+  "Page.Library": "Biblioteca",
+  "Page.Options": "Opções",
+  "Page.GameCount.One": "1 Jogo",
+  "Page.GameCount.Other": "{0} jogos",
+
+  "Library.SearchWatermark": "Pesquisar na biblioteca…",
+  "Library.AddFolder": "＋ Adicionar pasta",
+  "Library.Rescan": "⟳ Atualizar biblioteca",
+  "Library.OpenFile": "Abrir arquivo…",
+
+  "Library.Context.Launch": "Jogar",
+  "Library.Context.OpenFolder": "Abrir pasta do jogo",
+  "Library.Context.CopyPath": "Copiar o caminho",
+  "Library.Context.CopyTitleId": "Copiar ID do título",
+  "Library.Context.Remove": "Remover da biblioteca",
+
+  "Library.Empty.Title": "Sua biblioteca está vazia",
+  "Library.Empty.Hint": "Adicione uma pasta contendo seus jogos para começar.",
+  "Library.Empty.SearchTitle": "Nenhum jogo corresponde à sua busca",
+  "Library.Empty.SearchHint": "Nada na biblioteca corresponde a “{0}”.",
+  "Library.Empty.AddFolder": "＋ Adicionar pasta do jogo",
+
+  "Library.Loading": "Carregando biblioteca…",
+
+  "Options.General": "Opções Gerais",
+  "Options.Env.Tab": "Ambiente",
+  "Options.Section.Environment": "VARIÁVEIS DE AMBIENTE",
+  "Options.Env.Desc": "Variáveis de ambiente passadas ao emulador durante a inicialização.",
+  "Options.Env.Bthid.Desc": "Informa o Bluetooth HID como indisponível para títulos cujo middleware de volante/FFB fica verificando indefinidamente.\nNormalmente, deixe desativado. Alguns títulos travam quando a inicialização falha.",
+  "Options.Env.LoopGuard.Desc": "Não força o encerramento de títulos que repetem a mesma chamada por tempo excessivo.\nExperimente esta opção se um jogo fechar sozinho durante o carregamento.",
+  "Options.Env.VkValidation.Desc": "Ativa as camadas de validação do Vulkan para depuração de GPU.\nLento. Requer que o Vulkan SDK esteja instalado.",
+  "Options.Env.DumpSpirv.Desc": "Extrai os shaders AGC e suas traduções SPIR-V para a pasta shader-dumps.\nUse ao reportar bugs de shader ou renderização.",
+  "Options.Env.LogDirectMemory.Desc": "Registra alocações de memória direta e falhas no console.\nUse quando um jogo aborta ou fecha durante a inicialização (boot).",
+  "Options.Env.LogNp.Desc": "Registra chamadas da biblioteca NP (PlayStation Network) no console.",
+  "Options.Section.Emulation": "EMULAÇÃO",
+  "Options.Section.Logging": "LOGS",
+  "Options.Section.Launcher": "INICIALIZADOR",
+
+  "Options.CpuEngine.Label": "Motor da CPU",
+  "Options.CpuEngine.Desc": "Motor de execução usado para executar o código do jogo.",
+  "Options.CpuEngine.Native": "Nativo",
+
+  "Options.Strict.Label": "Resolução estrita de bibliotecas dinâmicas",
+  "Options.Strict.Desc": "Interrompe a inicialização caso um símbolo importado não possa ser vinculado.",
+
+  "Options.LogLevel.Label": "Nível de log",
+  "Options.LogLevel.Desc": "Nível de detalhamento das mensagens exibidas no console do emulador.",
+  "Options.LogLevel.Trace": "Trace",
+  "Options.LogLevel.Debug": "Debug",
+  "Options.LogLevel.Info": "Info",
+  "Options.LogLevel.Warning": "Warning",
+  "Options.LogLevel.Error": "Error",
+  "Options.LogLevel.Critical": "Critical",
+
+  "Options.TraceImports.Label": "Limite de rastreamento de importações",
+  "Options.TraceImports.Desc": "Rastreia as primeiras N importações de cada módulo (0 = desativado).",
+
+  "Options.LogToFile.Label": "Salvar log em arquivo",
+  "Options.LogToFile.Desc": "Copia a saída do emulador para um arquivo de log.",
+
+  "Options.LogFilePath.Label": "Caminho do arquivo de log",
+  "Options.LogFilePath.Default": "Nenhum caminho definido — logs vão para user/logs na pasta do emulador.",
+  "Options.LogFilePath.Select": "Selecionar…",
+
+  "Options.OverrideLogFile.Label": "Sobrescrever arquivo de log",
+  "Options.OverrideLogFile.Desc": "Use o caminho exato do arquivo em vez de adicionar o ID do título e o log de data e hora.",
+
+  "Options.TitleMusic.Label": "Música de prévia",
+  "Options.TitleMusic.Desc": "Reproduz em loop a música de prévia do jogo selecionado na biblioteca.",
+
+  "Options.Discord.Label": "Status do Discord",
+  "Options.Discord.Desc": "Exibir o jogo em execução no seu perfil do Discord.",
+
+  "Options.Language.Label": "Idioma do emulador",
+  "Options.Language.Desc": "Idioma usado em toda a interface do emulador. A alteração é aplicada imediatamente.",
+
+  "Common.On": "Ativado",
+  "Common.Off": "Desativado",
+
+  "Console.Title": "CONSOLE",
+  "Console.SearchWatermark": "Pesquisar...",
+  "Console.AutoScroll": "Rolagem automática",
+  "Console.Split": "Dividir",
+  "Console.Copy": "Copiar",
+  "Console.Clear": "Limpar",
+  "Console.WindowTitle": "Console do SharpEmu",
+
+  "Launch.NoGameSelected": "Nenhum jogo selecionado",
+  "Launch.NoGameHint": "Selecione um jogo na biblioteca ou abra um arquivo eboot.bin diretamente.",
+  "Launch.Idle": "Ocioso",
+  "Launch.Console": "≡ Console",
+  "Launch.Launch": "▶  Iniciar",
+  "Launch.Stop": "■  Parar",
+  "Launch.Running": "Em execução — {0}",
+  "Launch.Stopping": "Encerrando…",
+  "Launch.Exited": "Encerrado com código {0} ({1})",
+  "Launch.ExeNotFound": "Executável do SharpEmu não encontrado. Compile primeiro o projeto SharpEmu.CLI (dotnet build).",
+  "Launch.LogFile": "Arquivo de log: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "Falha ao iniciar o emulador: {0}",
+  "Launch.ProcessExited": "O processo foi encerrado com código {0} ({1}).",
+
+  "Exit.Ok": "OK",
+  "Exit.InvalidArguments": "argumentos inválidos",
+  "Exit.EbootNotFound": "eboot.bin não encontrado",
+  "Exit.RuntimeException": "exceção em tempo de execução",
+  "Exit.EmulationError": "erro de emulação",
+  "Exit.Unknown": "desconhecido",
+
+  "Status.EmulatorLocating": "Emulador: localizando…",
+  "Status.EmulatorPath": "Emulador: {0}",
+  "Status.EmulatorNotFound": "Emulador: executável do SharpEmu não encontrado — compile o SharpEmu.CLI primeiro.",
+  "Status.ScanningLibrary": "Verificando biblioteca…",
+  "Status.AddFolderPrompt": "Adicione uma pasta de jogos para preencher a biblioteca.",
+  "Status.LibraryScanned": "Biblioteca verificada: {0} jogo(s) em {1} pasta(s).",
+  "Status.CouldNotOpenFolder": "Não foi possível abrir a pasta: {0}",
+  "Status.CopiedToClipboard": "{0} copiado para a área de transferência.",
+  "Status.RemovedFromLibrary": "“{0}” removido da biblioteca. Adicione novamente sua pasta para restaurá-lo.",
+  "Status.Running": "Executando {0}",
+  "Status.Stopping": "Encerrando…",
+  "Status.Idle": "Ocioso",
+
+  "Clipboard.Path": "Caminho",
+  "Clipboard.TitleId": "ID do título",
+
+  "Discord.Playing": "Jogando {0}",
+  "Discord.Browsing": "Navegando pela biblioteca",
+
+  "Dialog.ChooseGameFolder": "Escolha uma pasta contendo jogos",
+  "Dialog.OpenExecutable": "Abrir um executável para iniciar",
+  "Dialog.PsExecutables": "Executáveis de PS",
+  "Dialog.SaveLogFile": "Selecione onde salvar o arquivo de log",
+  "Dialog.PlainTextFiles": "Arquivos de texto simples",
+  "Dialog.LogFiles": "Arquivos de log",
+
+  "Options.About" : "Sobre",
+  "About.Github.Label": "GitHub",
+  "About.Github.Desc": "Código-fonte, problemas e desenvolvimento do projeto.",
+  "About.Discord.Label": "Discord",
+  "About.Discord.Desc": "Participe da comunidade, obtenha suporte e acompanhe o desenvolvimento.",
+  "About.GithubButton": "Contribua no GitHub!",
+  "About.DiscordButton": "Entre no nosso Discord!"
+}

src/SharpEmu.GUI/Languages/de.json

@@ -20,7 +20,7 @@
   "Library.Empty.Title": "Deine Bibliothek ist leer",
   "Library.Empty.Hint": "Füge einen Ordner mit deinen Spielen hinzu, um zu beginnen.",
   "Library.Empty.SearchTitle": "Keine Spiele gefunden",
-  "Library.Empty.SearchHint": "Nichts in der Bibliothek entspricht "{0}".",
+  "Library.Empty.SearchHint": "Nichts in der Bibliothek entspricht “{0}”.",
   "Library.Empty.AddFolder": "＋ Spielordner hinzufügen",
 
   "Library.Loading": "Bibliothek wird geladen…",
@@ -109,7 +109,7 @@
   "Status.LibraryScanned": "Bibliothek gescannt: {0} Spiel(e) in {1} Ordner(n).",
   "Status.CouldNotOpenFolder": "Ordner konnte nicht geöffnet werden: {0}",
   "Status.CopiedToClipboard": "{0} in die Zwischenablage kopiert.",
-  "Status.RemovedFromLibrary": ""{0}" wurde aus der Bibliothek entfernt. Füge den Ordner erneut hinzu, um es wiederherzustellen.",
+  "Status.RemovedFromLibrary": "“{0}” wurde aus der Bibliothek entfernt. Füge den Ordner erneut hinzu, um es wiederherzustellen.",
   "Status.Running": "Läuft {0}",
   "Status.Stopping": "Wird gestoppt…",
   "Status.Idle": "Bereit",

src/SharpEmu.GUI/Languages/en.json

@@ -26,6 +26,15 @@
   "Library.Loading": "Loading library…",
 
   "Options.General": "General",
+  "Options.Env.Tab": "Environment",
+  "Options.Section.Environment": "ENVIRONMENT VARIABLES",
+  "Options.Env.Desc": "Switches passed to the emulator as environment variables at launch.",
+  "Options.Env.Bthid.Desc": "Report Bluetooth HID as unavailable for titles whose wheel/FFB middleware polls forever.\nLeave off normally. Some titles freeze when init fails.",
+  "Options.Env.LoopGuard.Desc": "Do not force quit titles that repeat the same call for too long.\nTry this when a game exits on its own while loading.",
+  "Options.Env.VkValidation.Desc": "Enable Vulkan validation layers for GPU debugging.\nSlow. Requires the Vulkan SDK to be installed.",
+  "Options.Env.DumpSpirv.Desc": "Dump AGC shaders and their SPIR-V translations to the shader-dumps folder.\nUse when reporting shader or rendering bugs.",
+  "Options.Env.LogDirectMemory.Desc": "Log direct memory allocations and failures to the console.\nUse when a game aborts or exits during boot.",
+  "Options.Env.LogNp.Desc": "Log NP (PlayStation Network) library calls to the console.",
   "Options.Section.Emulation": "EMULATION",
   "Options.Section.Logging": "LOGGING",
   "Options.Section.Launcher": "LAUNCHER",
@@ -125,5 +134,13 @@
   "Dialog.PsExecutables": "PS executables",
   "Dialog.SaveLogFile": "Select where to save the Log file",
   "Dialog.PlainTextFiles": "Plain Text Files",
-  "Dialog.LogFiles": "Log Files"
+  "Dialog.LogFiles": "Log Files",
+
+  "Options.About" : "About",
+  "About.Github.Label": "GitHub",
+  "About.Github.Desc": "Source code, issues and project development.",
+  "About.Discord.Label": "Discord",
+  "About.Discord.Desc": "Join the community, get support and follow development.",
+  "About.GithubButton": "Contribute in GitHub!",
+  "About.DiscordButton": "Join our Discord!"
 }

src/SharpEmu.GUI/Languages/es.json

@@ -125,5 +125,13 @@
   "Dialog.PsExecutables": "Ejecutables de PS",
   "Dialog.SaveLogFile": "Selecciona dónde guardar el archivo de Logs",
   "Dialog.PlainTextFiles": "Archivos en texto plano",
-  "Dialog.LogFiles": "Archivos de Log"
+  "Dialog.LogFiles": "Archivos de Log",
+
+  "Options.About" : "Informacion",
+  "About.Github.Label": "GitHub",
+  "About.Github.Desc": "Código fuente, issues y desarrollo del proyecto.",
+  "About.Discord.Label": "Discord",
+  "About.Discord.Desc": "Únete a la comunidad, recibe soporte y sigue el desarrollo.",
+  "About.GithubButton": "Contribuye en GitHub!",
+  "About.DiscordButton": "Únete a nuestro Discord!"
 }

src/SharpEmu.GUI/Languages/fr.json

@@ -26,6 +26,15 @@
   "Library.Loading": "Chargement de la bibliothèque…",
 
   "Options.General": "Général",
+  "Options.Env.Tab": "Environnement",
+  "Options.Section.Environment": "VARIABLES D’ENVIRONNEMENT",
+  "Options.Env.Desc": "Paramètres passés à l’émulateur comme variables d’environnement au lancement.",
+  "Options.Env.Bthid.Desc": "Signaler le HID Bluetooth comme indisponible pour les titres dont le middleware volant/FFB interroge indéfiniment.\nLaissez désactivé normalement. Certains titres se bloquent si l’initialisation échoue.",
+  "Options.Env.LoopGuard.Desc": "Ne pas forcer la fermeture des titres qui répètent le même appel trop longtemps.\nEssayez ceci quand un jeu se ferme tout seul pendant le chargement.",
+  "Options.Env.VkValidation.Desc": "Activer les couches de validation Vulkan pour le débogage GPU.\nRalentit. Nécessite l’installation du Vulkan SDK.",
+  "Options.Env.DumpSpirv.Desc": "Exporter les shaders AGC et leurs traductions SPIR-V dans le dossier shader-dumps.\nÀ utiliser pour signaler des bugs de shader ou de rendu.",
+  "Options.Env.LogDirectMemory.Desc": "Journaliser les allocations de mémoire directe et les échecs dans la console.\nÀ utiliser quand un jeu plante ou se ferme pendant le démarrage.",
+  "Options.Env.LogNp.Desc": "Journaliser les appels de la bibliothèque NP (PlayStation Network) dans la console.",
   "Options.Section.Emulation": "ÉMULATION",
   "Options.Section.Logging": "JOURNALISATION",
   "Options.Section.Launcher": "LANCEUR",
@@ -125,5 +134,13 @@
   "Dialog.PsExecutables": "Exécutables PlayStation",
   "Dialog.SaveLogFile": "Choisir l’emplacement du fichier journal",
   "Dialog.PlainTextFiles": "Fichiers texte brut",
-  "Dialog.LogFiles": "Fichiers journaux"
+  "Dialog.LogFiles": "Fichiers journaux",
+
+  "Options.About": "À propos",
+  "About.Github.Label": "GitHub",
+  "About.Github.Desc": "Code source, issues et développement du projet.",
+  "About.Discord.Label": "Discord",
+  "About.Discord.Desc": "Rejoignez la communauté, obtenez de l’aide et suivez le développement.",
+  "About.GithubButton": "Contribuer sur GitHub !",
+  "About.DiscordButton": "Rejoindre notre Discord !"
 }

src/SharpEmu.GUI/Languages/hu.json

@@ -0,0 +1,146 @@
+{
+  "_languageName": "Hungarian",
+
+  "Page.Library": "Könyvtár",
+  "Page.Options": "Beállítások",
+  "Page.GameCount.One": "1 játék",
+  "Page.GameCount.Other": "{0} játékok",
+
+  "Library.SearchWatermark": "Keresés a könyvtárban",
+  "Library.AddFolder": "＋ Mappa hozzáadása",
+  "Library.Rescan": "⟳ Újrakeresés",
+  "Library.OpenFile": "Fájl megnyitása…",
+
+  "Library.Context.Launch": "Inditás",
+  "Library.Context.OpenFolder": "Játékmappa megnyitása",
+  "Library.Context.CopyPath": "Elérési út másolása",
+  "Library.Context.CopyTitleId": "Cím ID másolása",
+  "Library.Context.Remove": "Eltávolítás a Könyvtárból",
+
+  "Library.Empty.Title": "A könyvtárad üres",
+  "Library.Empty.Hint": "Add meg a játékaidat tartalmazó mappát a kezdáshez.",
+  "Library.Empty.SearchTitle": "Nincs találat a elemre",
+  "Library.Empty.SearchHint": "A könyvtárban nincs olyan elem, amely egyezne a „{0}” kifejezéssel.",
+  "Library.Empty.AddFolder": "＋ Játékmappa hozzáadása",
+
+  "Library.Loading": "Könyvtár betöltése",
+
+  "Options.General": "Általános",
+  "Options.Env.Tab": "Környezet",
+  "Options.Section.Environment": "KÖRNYEZETI VÁLTOZÓK",
+  "Options.Env.Desc": "Indításkor környezeti változóként az emulátorhoz átadott kapcsolók.",
+  "Options.Env.Bthid.Desc": "Jelenti, amely címeknél a Bluetooth HID nem elérhető, amelyeknél a kormány/FFB-közbenső szoftver végtelenül lekérdezi az adatokat.\nNormál esetben hagyja ki. Egyes címek lefagyanak, ha az inicializálás sikertelen.",
+  "Options.Env.LoopGuard.Desc": "Ne erőltesse a kilépést azoknál a címeknél, amelyek túl sokáig ismételnek ugyanazt a hívást.\nPróbálja ki ezt, ha egy játék betöltés közben magától kilép.",
+  "Options.Env.VkValidation.Desc": "Engedélyezze a Vulkan-érvényesítési rétegeket a GPU hibakereséshez.\nLassú. A Vulkan SDK telepítését igényli.",
+  "Options.Env.DumpSpirv.Desc": "Az AGC-shaderek és azok SPIR-V-fordításainak mentése a shader-dumps mappába.\nHasználd shader- vagy renderelési hibák jelentésekor.",
+  "Options.Env.LogDirectMemory.Desc": "A közvetlen memóriaallokációk és hibák naplózása a konzolra.\nHasználd, ha egy játék a rendszerindítás során megszakad vagy kilép.",
+  "Options.Env.LogNp.Desc": "Az NP (PlayStation Network) könyvtárhívásokat naplózza a konzolra.",
+  "Options.Section.Emulation": "EMULÁCIÓ",
+  "Options.Section.Logging": "LOGOLÁS",
+  "Options.Section.Launcher": "INDITÓ",
+
+  "Options.CpuEngine.Label": "CPU motor",
+  "Options.CpuEngine.Desc": "A játék kódjának futtatásához használt végrehajtó motor.",
+  "Options.CpuEngine.Native": "Natív",
+
+  "Options.Strict.Label": "Szigorú dynlib felbontás",
+  "Options.Strict.Desc": "Indítás megszakítása, ha egy importált szimbólum nem oldható fel.",
+
+  "Options.LogLevel.Label": "Naplózási szint",
+  "Options.LogLevel.Desc": "Az emulátor konzol kimenetének részletessége.",
+  "Options.LogLevel.Trace": "Trace",
+  "Options.LogLevel.Debug": "Debug",
+  "Options.LogLevel.Info": "Információ",
+  "Options.LogLevel.Warning": "Figyelmeztetés",
+  "Options.LogLevel.Error": "Hiba",
+  "Options.LogLevel.Critical": "Kritikus",
+
+  "Options.TraceImports.Label": "Import trace limit",
+  "Options.TraceImports.Desc": "Az első N darab import nyomon követése modulonként (0 = ki).",
+
+  "Options.LogToFile.Label": "Naplozás fájlba",
+  "Options.LogToFile.Desc": "Az emulátor kimenetének tükrözése egy log fájlba.",
+
+  "Options.LogFilePath.Label": "Naplófájl elérési útja",
+  "Options.LogFilePath.Default": "Nincs egyéni út — a logok az emulátor melletti user/logs mappába kerülnek.",
+  "Options.LogFilePath.Select": "Kiválasztás…",
+
+  "Options.OverrideLogFile.Label": "Naplófájl felülírása",
+  "Options.OverrideLogFile.Desc": "A pontos fájlútvonal használata a cím ID és időbélyeg hozzáfűzése helyett.",
+
+  "Options.TitleMusic.Label": "Címzene",
+  "Options.TitleMusic.Desc": "A kiválasztott játék előnézeti zenéjének ismétlése a könyvtárban.",
+
+  "Options.Discord.Label": "Discord jelenlét",
+  "Options.Discord.Desc": "A futó játék megjelenítése a Discord profilodon.",
+
+  "Options.Language.Label": "Emulátor nyelve",
+  "Options.Language.Desc": "Az indítóban használt nyelv. Azonnal érvénybe lép.",
+
+  "Common.On": "Be",
+  "Common.Off": "Ki",
+
+  "Console.Title": "KONZOL",
+  "Console.SearchWatermark": "Keresés...",
+  "Console.AutoScroll": "Automatikus görgetés",
+  "Console.Split": "Felosztás",
+  "Console.Copy": "Másolás",
+  "Console.Clear": "Törlés",
+  "Console.WindowTitle": "SharpEmu Konzol",
+
+  "Launch.NoGameSelected": "Nincs játék kiválasztva",
+  "Launch.NoGameHint": "Válassz egy játékot a könyvtárból, vagy nyiss meg közvetlenül egy eboot.bin fájlt.",
+  "Launch.Idle": "Tétlen",
+  "Launch.Console": "≡ Konzol",
+  "Launch.Launch": "▶  Inditás",
+  "Launch.Stop": "■  Leállítás",
+  "Launch.Running": "Fut — {0}",
+  "Launch.Stopping": "Leállítás…",
+  "Launch.Exited": "Kilépett a következő kóddal: {0} ({1})",
+  "Launch.ExeNotFound": "A SharpEmu futtatható fájl nem található. Előbb építsd fel a SharpEmu.CLI projektet (dotnet build).",
+  "Launch.LogFile": "Naplófájl: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "Nem sikerült elindítani az emulátort: {0}",
+  "Launch.ProcessExited": "A folyamat kilépett a következő kóddal: {0} ({1}).",
+
+  "Exit.Ok": "OK",
+  "Exit.InvalidArguments": "nemérvényes argumentumok",
+  "Exit.EbootNotFound": "eboot nem található",
+  "Exit.RuntimeException": "runtime exception",
+  "Exit.EmulationError": "emulációs hiba",
+  "Exit.Unknown": "ismeretlen",
+
+  "Status.EmulatorLocating": "Emulátor: keresés…",
+  "Status.EmulatorPath": "Emulátor: {0}",
+  "Status.EmulatorNotFound": "Emulátor: a SharpEmu futtatható fájl nem található — előbb építsd fel a SharpEmu.CLI-t.",
+  "Status.ScanningLibrary": "Könyvtár beolvasása…",
+  "Status.AddFolderPrompt": "Adj hozzá egy játékmappát a könyvtár feltöltéséhez.",
+  "Status.LibraryScanned": "Könyvtár beolvasva: {0} játék {1} mappában.",
+  "Status.CouldNotOpenFolder": "Nem sikerült megnyitni a mappát: {0}",
+  "Status.CopiedToClipboard": "{0} másolva a vágólapra.",
+  "Status.RemovedFromLibrary": "„{0}” eltávolítva a könyvtárból. A visszaállításához add hozzá újra a mappáját.",
+  "Status.Running": "Fut {0}",
+  "Status.Stopping": "Leállítás…",
+  "Status.Idle": "Nyugodt",
+
+  "Clipboard.Path": "Út",
+  "Clipboard.TitleId": "Cím ID",
+
+  "Discord.Playing": "Játékban {0}",
+  "Discord.Browsing": "Böngéssz a könyvtárban",
+
+  "Dialog.ChooseGameFolder": "Válassz egy mappát ami a játékaidat tartalmazza",
+  "Dialog.OpenExecutable": "Futtatható fájl megnyitása az indításhoz",
+  "Dialog.PsExecutables": "PS futtatható fájlok",
+  "Dialog.SaveLogFile": "Válaszd ki, hogy hova szeretnéd menteni a napló fájlokat",
+  "Dialog.PlainTextFiles": "Egyszerű szöveges fájlok",
+  "Dialog.LogFiles": "Naplózási fájlok",
+
+  "Options.About" : "Erről",
+  "About.Github.Label": "GitHub",
+  "About.Github.Desc": "Forrás kód, hibajelentések és a projekt fejlesztése.",
+  "About.Discord.Label": "Discord",
+  "About.Discord.Desc": "Csatlakozz a közösséghe, kérj segítéget és kövesd nyomon a fejlesztést.",
+  "About.GithubButton": "Járulj hozzá GitHubon!",
+  "About.DiscordButton": "Csatlakozz a Discordunhoz!"
+}

src/SharpEmu.GUI/Languages/ja.json

@@ -0,0 +1,129 @@
+{
+  "_languageName": "日本語",
+
+  "Page.Library": "ライブラリ",
+  "Page.Options": "オプション",
+  "Page.GameCount.One": "ゲーム 1本",
+  "Page.GameCount.Other": "ゲーム {0}本",
+
+  "Library.SearchWatermark": "ライブラリを検索…",
+  "Library.AddFolder": "＋ フォルダーを追加",
+  "Library.Rescan": "⟳ 再スキャン",
+  "Library.OpenFile": "ファイルを開く…",
+
+  "Library.Context.Launch": "起動",
+  "Library.Context.OpenFolder": "ゲームフォルダーを開く",
+  "Library.Context.CopyPath": "パスをコピー",
+  "Library.Context.CopyTitleId": "ゲームIDをコピー",
+  "Library.Context.Remove": "ライブラリから削除",
+
+  "Library.Empty.Title": "ライブラリが空です",
+  "Library.Empty.Hint": "開始するには、ゲームが含まれるフォルダーを追加してください。",
+  "Library.Empty.SearchTitle": "検索条件に一致するゲームが見つかりません",
+  "Library.Empty.SearchHint": "ライブラリに「{0}」と一致する項目はありません。",
+  "Library.Empty.AddFolder": "＋ ゲームフォルダーを追加",
+
+  "Library.Loading": "ライブラリを読み込み中…",
+
+  "Options.General": "一般",
+  "Options.Section.Emulation": "エミュレーション",
+  "Options.Section.Logging": "ロギング",
+  "Options.Section.Launcher": "ランチャー",
+
+  "Options.CpuEngine.Label": "CPUエンジン",
+  "Options.CpuEngine.Desc": "ゲームコードを実行するために使用される実行エンジン。",
+  "Options.CpuEngine.Native": "ネイティブ",
+
+  "Options.Strict.Label": "厳格な動的ライブラリ解決",
+  "Options.Strict.Desc": "インポートされたシンボルが解決できない場合、起動を中断します。",
+
+  "Options.LogLevel.Label": "ログレベル",
+  "Options.LogLevel.Desc": "エミュレータコンソールに表示されるメッセージの詳細度。",
+  "Options.LogLevel.Trace": "トレース",
+  "Options.LogLevel.Debug": "デバッグ",
+  "Options.LogLevel.Info": "情報",
+  "Options.LogLevel.Warning": "警告",
+  "Options.LogLevel.Error": "エラー",
+  "Options.LogLevel.Critical": "致命的なエラー",
+
+  "Options.TraceImports.Label": "インポートトレース制限",
+  "Options.TraceImports.Desc": "各モジュールの最初のN個のインポートをトレースします（0 = 無効）。",
+
+  "Options.LogToFile.Label": "ファイルに保存",
+  "Options.LogToFile.Desc": "エミュレータの出力をログファイルにコピーします。",
+
+  "Options.LogFilePath.Label": "ログファイルのパス",
+  "Options.LogFilePath.Default": "カスタムパスなし — ログはエミュレータと同じ場所の user/logs フォルダーに保存されます。",
+  "Options.LogFilePath.Select": "選択…",
+
+  "Options.OverrideLogFile.Label": "ログファイルを上書き",
+  "Options.OverrideLogFile.Desc": "ゲームIDやタイムスタンプを追加せず、指定されたパスをそのまま使用します。",
+
+  "Options.TitleMusic.Label": "ゲーム内音楽",
+  "Options.TitleMusic.Desc": "ライブラリで選択したゲームのプレビュー音楽をループ再生します。",
+
+  "Options.Discord.Label": "Discordステータス表示",
+  "Options.Discord.Desc": "現在プレイ中のゲームをDiscordのプロフィールに表示します。",
+
+  "Options.Language.Label": "エミュレータの言語",
+  "Options.Language.Desc": "ランチャー全体で使用される言語。変更はすぐに適用されます。",
+
+  "Common.On": "オン",
+  "Common.Off": "オフ",
+
+  "Console.Title": "コンソール",
+  "Console.SearchWatermark": "検索…",
+  "Console.AutoScroll": "自動スクロール",
+  "Console.Split": "ウィンドウを分離",
+  "Console.Copy": "コピー",
+  "Console.Clear": "消去",
+  "Console.WindowTitle": "SharpEmu コンソール",
+
+  "Launch.NoGameSelected": "ゲームが選択されていません",
+  "Launch.NoGameHint": "ライブラリからゲームを選択するか、eboot.bin ファイルを直接開いてください。",
+  "Launch.Idle": "待機中",
+  "Launch.Console": "≡ コンソール",
+  "Launch.Launch": "▶  起動",
+  "Launch.Stop": "■  停止",
+  "Launch.Running": "実行中 — {0}",
+  "Launch.Stopping": "停止中…",
+  "Launch.Exited": "プロセスがコード {0} ({1}) で終了しました",
+  "Launch.ExeNotFound": "SharpEmuの実行ファイルが見つかりません。先に SharpEmu.CLI プロジェクトをビルドしてください（dotnet build）。",
+  "Launch.LogFile": "ログファイル: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "エミュレータを起動できませんでした: {0}",
+  "Launch.ProcessExited": "プロセスがコード {0} ({1}) で終了しました。",
+
+  "Exit.Ok": "OK",
+  "Exit.InvalidArguments": "無効な引数",
+  "Exit.EbootNotFound": "eboot が見つかりません",
+  "Exit.RuntimeException": "ランタイム例外",
+  "Exit.EmulationError": "エミュレーションエラー",
+  "Exit.Unknown": "不明",
+
+  "Status.EmulatorLocating": "エミュレータ: 位置を検索中…",
+  "Status.EmulatorPath": "エミュレータ: {0}",
+  "Status.EmulatorNotFound": "エミュレータ: SharpEmuの実行ファイルが見つかりません — 先に SharpEmu.CLI をビルドしてください。",
+  "Status.ScanningLibrary": "ライブラリをスキャン中…",
+  "Status.AddFolderPrompt": "ライブラリに表示するゲームフォルダーを追加してください。",
+  "Status.LibraryScanned": "ライブラリのスキャン完了: {1} 個のフォルダーから {0} 本のゲームを検出。",
+  "Status.CouldNotOpenFolder": "フォルダーを開けませんでした: {0}",
+  "Status.CopiedToClipboard": "「{0}」をクリップボードにコピーしました。",
+  "Status.RemovedFromLibrary": "「{0}」がライブラリから削除されました。復元するにはフォルダーを再追加してください。",
+  "Status.Running": "{0} を実行中",
+  "Status.Stopping": "停止中…",
+  "Status.Idle": "待機中",
+
+  "Clipboard.Path": "パス",
+  "Clipboard.TitleId": "ゲームID",
+
+  "Discord.Playing": "{0} をプレイ中",
+  "Discord.Browsing": "ライブラリを閲覧中",
+
+  "Dialog.ChooseGameFolder": "ゲームが含まれるフォルダーを選択",
+  "Dialog.OpenExecutable": "起動する実行ファイルを開く",
+  "Dialog.PsExecutables": "PlayStation 実行ファイル",
+  "Dialog.SaveLogFile": "ログファイルの保存先を選択",
+  "Dialog.PlainTextFiles": "プレーンテキストファイル",
+  "Dialog.LogFiles": "ログファイル"
+}

src/SharpEmu.GUI/Languages/ko.json

@@ -0,0 +1,129 @@
+{
+  "_languageName": "한국어",
+
+  "Page.Library": "라이브러리",
+  "Page.Options": "옵션",
+  "Page.GameCount.One": "게임 1개",
+  "Page.GameCount.Other": "게임 {0}개",
+
+  "Library.SearchWatermark": "라이브러리 검색…",
+  "Library.AddFolder": "＋ 폴더 추가",
+  "Library.Rescan": "⟳ 다시 스캔",
+  "Library.OpenFile": "파일 열기…",
+
+  "Library.Context.Launch": "실행",
+  "Library.Context.OpenFolder": "게임 폴더 열기",
+  "Library.Context.CopyPath": "경로 복사",
+  "Library.Context.CopyTitleId": "게임 ID 복사",
+  "Library.Context.Remove": "라이브러리에서 제거",
+
+  "Library.Empty.Title": "라이브러리가 비어 있습니다",
+  "Library.Empty.Hint": "시작하려면 게임이 포함된 폴더를 추가하세요.",
+  "Library.Empty.SearchTitle": "검색 결과와 일치하는 게임이 없습니다",
+  "Library.Empty.SearchHint": "라이브러리에 '{0}'와(과) 일치하는 항목이 없습니다.",
+  "Library.Empty.AddFolder": "＋ 게임 폴더 추가",
+
+  "Library.Loading": "라이브러리 불러오는 중…",
+
+  "Options.General": "일반",
+  "Options.Section.Emulation": "에뮬레이션",
+  "Options.Section.Logging": "로깅",
+  "Options.Section.Launcher": "런처",
+
+  "Options.CpuEngine.Label": "CPU 엔진",
+  "Options.CpuEngine.Desc": "게임 코드를 실행하는 데 사용되는 실행 엔진입니다.",
+  "Options.CpuEngine.Native": "네이티브",
+
+  "Options.Strict.Label": "엄격한 동적 라이브러리 해석",
+  "Options.Strict.Desc": "가져온 심볼을 해석할 수 없는 경우 실행을 중단합니다.",
+
+  "Options.LogLevel.Label": "로그 수준",
+  "Options.LogLevel.Desc": "에뮬레이터 콘솔에 표시할 메시지의 세부 정보 수준입니다.",
+  "Options.LogLevel.Trace": "트레이스",
+  "Options.LogLevel.Debug": "디버그",
+  "Options.LogLevel.Info": "정보",
+  "Options.LogLevel.Warning": "경고",
+  "Options.LogLevel.Error": "오류",
+  "Options.LogLevel.Critical": "치명적 오류",
+
+  "Options.TraceImports.Label": "가져오기 트레이스 한도",
+  "Options.TraceImports.Desc": "각 모듈의 처음 N개 가져오기를 트레이스합니다 (0 = 비활성화).",
+
+  "Options.LogToFile.Label": "파일로 저장",
+  "Options.LogToFile.Desc": "에뮬레이터 출력을 로그 파일에 복사합니다.",
+
+  "Options.LogFilePath.Label": "로그 파일 경로",
+  "Options.LogFilePath.Default": "사용자 지정 경로 없음 — 로그는 에뮬레이터 옆의 user/logs 폴더에 저장됩니다.",
+  "Options.LogFilePath.Select": "선택…",
+
+  "Options.OverrideLogFile.Label": "로그 파일 덮어쓰기",
+  "Options.OverrideLogFile.Desc": "게임 ID와 타임스탬프를 추가하는 대신 정확히 이 경로를 사용합니다.",
+
+  "Options.TitleMusic.Label": "게임 음악",
+  "Options.TitleMusic.Desc": "라이브러리에서 선택한 게임의 미리보기 음악을 반복 재생합니다.",
+
+  "Options.Discord.Label": "디스코드 상태 표시",
+  "Options.Discord.Desc": "디스코드 프로필에 현재 실행 중인 게임을 표시합니다.",
+
+  "Options.Language.Label": "에뮬레이터 언어",
+  "Options.Language.Desc": "런처 전체에 사용되는 언어입니다. 변경 사항은 즉시 적용됩니다.",
+
+  "Common.On": "켬",
+  "Common.Off": "끔",
+
+  "Console.Title": "콘솔",
+  "Console.SearchWatermark": "검색…",
+  "Console.AutoScroll": "자동 스크롤",
+  "Console.Split": "창 분리",
+  "Console.Copy": "복사",
+  "Console.Clear": "지우기",
+  "Console.WindowTitle": "SharpEmu 콘솔",
+
+  "Launch.NoGameSelected": "선택된 게임 없음",
+  "Launch.NoGameHint": "라이브러리에서 게임을 선택하거나 eboot.bin 파일을 직접 여세요.",
+  "Launch.Idle": "대기 중",
+  "Launch.Console": "≡ 콘솔",
+  "Launch.Launch": "▶  실행",
+  "Launch.Stop": "■  중지",
+  "Launch.Running": "실행 중 — {0}",
+  "Launch.Stopping": "중지 중…",
+  "Launch.Exited": "프로세스가 코드 {0} ({1})(으)로 종료되었습니다",
+  "Launch.ExeNotFound": "SharpEmu 실행 파일을 찾을 수 없습니다. 먼저 SharpEmu.CLI 프로젝트를 컴파일하세요 (dotnet build).",
+  "Launch.LogFile": "로그 파일: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "에뮬레이터를 시작할 수 없습니다: {0}",
+  "Launch.ProcessExited": "프로세스가 코드 {0} ({1})(으)로 종료되었습니다.",
+
+  "Exit.Ok": "확인",
+  "Exit.InvalidArguments": "잘못된 인수",
+  "Exit.EbootNotFound": "eboot을 찾을 수 없음",
+  "Exit.RuntimeException": "런타임 예외",
+  "Exit.EmulationError": "에뮬레이션 오류",
+  "Exit.Unknown": "알 수 없음",
+
+  "Status.EmulatorLocating": "에뮬레이터: 위치 검색 중…",
+  "Status.EmulatorPath": "에뮬레이터: {0}",
+  "Status.EmulatorNotFound": "에뮬레이터: SharpEmu 실행 파일을 찾을 수 없습니다 — 먼저 SharpEmu.CLI를 컴파일하세요.",
+  "Status.ScanningLibrary": "라이브러리 스캔 중…",
+  "Status.AddFolderPrompt": "라이브러리를 채우려면 게임 폴더를 추가하세요.",
+  "Status.LibraryScanned": "라이브러리 스캔 완료: {1}개 폴더에서 {0}개 게임 발견.",
+  "Status.CouldNotOpenFolder": "폴더를 열 수 없습니다: {0}",
+  "Status.CopiedToClipboard": "{0}이(가) 클립보드에 복사되었습니다.",
+  "Status.RemovedFromLibrary": "'{0}'이(가) 라이브러리에서 제거되었습니다. 복구하려면 폴더를 다시 추가하세요.",
+  "Status.Running": "{0} 실행 중",
+  "Status.Stopping": "중지 중…",
+  "Status.Idle": "대기 중",
+
+  "Clipboard.Path": "경로",
+  "Clipboard.TitleId": "게임 ID",
+
+  "Discord.Playing": "{0} 플레이 중",
+  "Discord.Browsing": "라이브러리 둘러보는 중",
+
+  "Dialog.ChooseGameFolder": "게임이 포함된 폴더 선택",
+  "Dialog.OpenExecutable": "실행할 파일 열기",
+  "Dialog.PsExecutables": "PlayStation 실행 파일",
+  "Dialog.SaveLogFile": "로그 파일 저장 위치 선택",
+  "Dialog.PlainTextFiles": "일반 텍스트 파일",
+  "Dialog.LogFiles": "로그 파일"
+}

src/SharpEmu.GUI/Languages/nl.json

@@ -0,0 +1,129 @@
+{
+  "_languageName": "Nederlands",
+
+  "Page.Library": "Bibliotheek",
+  "Page.Options": "Opties",
+  "Page.GameCount.One": "1 game",
+  "Page.GameCount.Other": "{0} games",
+
+  "Library.SearchWatermark": "Zoeken in bibliotheek…",
+  "Library.AddFolder": "＋ Map toevoegen",
+  "Library.Rescan": "⟳ Opnieuw scannen",
+  "Library.OpenFile": "Bestand openen…",
+
+  "Library.Context.Launch": "Starten",
+  "Library.Context.OpenFolder": "Gamemap openen",
+  "Library.Context.CopyPath": "Pad kopiëren",
+  "Library.Context.CopyTitleId": "Titel-ID kopiëren",
+  "Library.Context.Remove": "Verwijderen uit bibliotheek",
+
+  "Library.Empty.Title": "Je bibliotheek is leeg",
+  "Library.Empty.Hint": "Voeg een map met je games toe om te beginnen.",
+  "Library.Empty.SearchTitle": "Geen games komen overeen met je zoekopdracht",
+  "Library.Empty.SearchHint": "Niets in de bibliotheek komt overeen met “{0}”.",
+  "Library.Empty.AddFolder": "＋ Gamemap toevoegen",
+
+  "Library.Loading": "Bibliotheek laden…",
+
+  "Options.General": "Algemeen",
+  "Options.Section.Emulation": "EMULATIE",
+  "Options.Section.Logging": "LOGGING",
+  "Options.Section.Launcher": "LAUNCHER",
+
+  "Options.CpuEngine.Label": "CPU-engine",
+  "Options.CpuEngine.Desc": "Engine die wordt gebruikt om gamecode uit te voeren.",
+  "Options.CpuEngine.Native": "Native",
+
+  "Options.Strict.Label": "Strikte dynlib-resolutie",
+  "Options.Strict.Desc": "Laat het opstarten mislukken wanneer een geïmporteerd symbool niet kan worden opgelost.",
+
+  "Options.LogLevel.Label": "Logniveau",
+  "Options.LogLevel.Desc": "Uitgebreidheid van de console-uitvoer van de emulator.",
+  "Options.LogLevel.Trace": "Trace",
+  "Options.LogLevel.Debug": "Debug",
+  "Options.LogLevel.Info": "Info",
+  "Options.LogLevel.Warning": "Waarschuwing",
+  "Options.LogLevel.Error": "Fout",
+  "Options.LogLevel.Critical": "Kritiek",
+
+  "Options.TraceImports.Label": "Tracelimiet voor imports",
+  "Options.TraceImports.Desc": "Traceer de eerste N imports per module (0 = uit).",
+
+  "Options.LogToFile.Label": "Loggen naar bestand",
+  "Options.LogToFile.Desc": "Stuur de uitvoer van de emulator ook naar een logbestand.",
+
+  "Options.LogFilePath.Label": "Pad naar logbestand",
+  "Options.LogFilePath.Default": "Geen aangepast pad — logs komen terecht in user/logs naast de emulator.",
+  "Options.LogFilePath.Select": "Selecteren…",
+
+  "Options.OverrideLogFile.Label": "Logbestand overschrijven",
+  "Options.OverrideLogFile.Desc": "Gebruik het exacte bestandspad in plaats van de titel-ID en tijdstempel toe te voegen.",
+
+  "Options.TitleMusic.Label": "Titelmuziek",
+  "Options.TitleMusic.Desc": "Herhaal de voorbeeldmuziek van de geselecteerde game in de bibliotheek.",
+
+  "Options.Discord.Label": "Discord-aanwezigheid",
+  "Options.Discord.Desc": "Toon de actieve game op je Discord-profiel.",
+
+  "Options.Language.Label": "Taal van de emulator",
+  "Options.Language.Desc": "Taal die in de hele launcher wordt gebruikt. Wordt direct toegepast.",
+
+  "Common.On": "Aan",
+  "Common.Off": "Uit",
+
+  "Console.Title": "CONSOLE",
+  "Console.SearchWatermark": "Zoeken...",
+  "Console.AutoScroll": "Automatisch scrollen",
+  "Console.Split": "Splitsen",
+  "Console.Copy": "Kopiëren",
+  "Console.Clear": "Wissen",
+  "Console.WindowTitle": "SharpEmu-console",
+
+  "Launch.NoGameSelected": "Geen game geselecteerd",
+  "Launch.NoGameHint": "Kies een game uit de bibliotheek, of open direct een eboot.bin-bestand.",
+  "Launch.Idle": "Inactief",
+  "Launch.Console": "≡ Console",
+  "Launch.Launch": "▶  Starten",
+  "Launch.Stop": "■  Stoppen",
+  "Launch.Running": "Actief — {0}",
+  "Launch.Stopping": "Stoppen…",
+  "Launch.Exited": "Afgesloten met code {0} ({1})",
+  "Launch.ExeNotFound": "SharpEmu-uitvoerbaar bestand niet gevonden. Bouw eerst het SharpEmu.CLI-project (dotnet build).",
+  "Launch.LogFile": "Logbestand: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "Starten van de emulator mislukt: {0}",
+  "Launch.ProcessExited": "Proces afgesloten met code {0} ({1}).",
+
+  "Exit.Ok": "OK",
+  "Exit.InvalidArguments": "ongeldige argumenten",
+  "Exit.EbootNotFound": "eboot niet gevonden",
+  "Exit.RuntimeException": "runtime-uitzondering",
+  "Exit.EmulationError": "emulatiefout",
+  "Exit.Unknown": "onbekend",
+
+  "Status.EmulatorLocating": "Emulator: zoeken…",
+  "Status.EmulatorPath": "Emulator: {0}",
+  "Status.EmulatorNotFound": "Emulator: SharpEmu-uitvoerbaar bestand niet gevonden — bouw eerst SharpEmu.CLI.",
+  "Status.ScanningLibrary": "Bibliotheek scannen…",
+  "Status.AddFolderPrompt": "Voeg een gamemap toe om de bibliotheek te vullen.",
+  "Status.LibraryScanned": "Bibliotheek gescand: {0} game(s) in {1} map(pen).",
+  "Status.CouldNotOpenFolder": "Kan map niet openen: {0}",
+  "Status.CopiedToClipboard": "{0} gekopieerd naar klembord.",
+  "Status.RemovedFromLibrary": "“{0}” verwijderd uit de bibliotheek. Voeg de map opnieuw toe om dit te herstellen.",
+  "Status.Running": "Actief {0}",
+  "Status.Stopping": "Stoppen…",
+  "Status.Idle": "Inactief",
+
+  "Clipboard.Path": "Pad",
+  "Clipboard.TitleId": "Titel-ID",
+
+  "Discord.Playing": "Speelt {0}",
+  "Discord.Browsing": "Bladert door de bibliotheek",
+
+  "Dialog.ChooseGameFolder": "Kies een map met games",
+  "Dialog.OpenExecutable": "Open een uitvoerbaar bestand om te starten",
+  "Dialog.PsExecutables": "PS-uitvoerbare bestanden",
+  "Dialog.SaveLogFile": "Selecteer waar het logbestand moet worden opgeslagen",
+  "Dialog.PlainTextFiles": "Platte tekstbestanden",
+  "Dialog.LogFiles": "Logbestanden"
+}

src/SharpEmu.GUI/Languages/pt.json

@@ -0,0 +1,146 @@
+{
+  "_languageName": "Português (Portugal)",
+
+  "Page.Library": "Biblioteca",
+  "Page.Options": "Opções",
+  "Page.GameCount.One": "1 jogo",
+  "Page.GameCount.Other": "{0} jogos",
+
+  "Library.SearchWatermark": "Pesquisar biblioteca…",
+  "Library.AddFolder": "＋ Adicionar pasta",
+  "Library.Rescan": "⟳ Reanalisar",
+  "Library.OpenFile": "Abrir ficheiro…",
+
+  "Library.Context.Launch": "Iniciar",
+  "Library.Context.OpenFolder": "Abrir pasta do jogo",
+  "Library.Context.CopyPath": "Copiar caminho",
+  "Library.Context.CopyTitleId": "Copiar ID do título",
+  "Library.Context.Remove": "Remover da biblioteca",
+
+  "Library.Empty.Title": "A sua biblioteca está vazia",
+  "Library.Empty.Hint": "Adicione uma pasta com os seus jogos para começar.",
+  "Library.Empty.SearchTitle": "Nenhum jogo corresponde à sua pesquisa",
+  "Library.Empty.SearchHint": "Nada na biblioteca corresponde a “{0}”.",
+  "Library.Empty.AddFolder": "＋ Adicionar pasta de jogos",
+
+  "Library.Loading": "A carregar biblioteca…",
+
+  "Options.General": "Geral",
+  "Options.Env.Tab": "Ambiente",
+  "Options.Section.Environment": "VARIÁVEIS DE AMBIENTE",
+  "Options.Env.Desc": "Switches passados ao emulador como variáveis de ambiente no arranque.",
+  "Options.Env.Bthid.Desc": "Reporta o Bluetooth HID como indisponível para títulos cujo middleware de volante/FFB fica à espera indefinidamente.\nDeixe desativado normalmente. Alguns títulos bloqueiam quando a inicialização falha.",
+  "Options.Env.LoopGuard.Desc": "Não force o encerramento de títulos que repetem a mesma chamada durante demasiado tempo.\nExperimente isto quando um jogo fecha sozinho durante o carregamento.",
+  "Options.Env.VkValidation.Desc": "Ativa as camadas de validação do Vulkan para depuração da GPU.\nLento. Requer que o Vulkan SDK esteja instalado.",
+  "Options.Env.DumpSpirv.Desc": "Extrai os shaders AGC e as respetivas traduções SPIR-V para a pasta shader-dumps.\nUtilize ao reportar problemas de shaders ou renderização.",
+  "Options.Env.LogDirectMemory.Desc": "Regista alocações de memória direta e falhas na consola.\nUtilize quando um jogo aborta ou fecha durante o arranque.",
+  "Options.Env.LogNp.Desc": "Regista chamadas da biblioteca NP (PlayStation Network) na consola.",
+  "Options.Section.Emulation": "EMULAÇÃO",
+  "Options.Section.Logging": "REGISTOS",
+  "Options.Section.Launcher": "LANÇADOR",
+
+  "Options.CpuEngine.Label": "Motor de CPU",
+  "Options.CpuEngine.Desc": "Motor de execução utilizado para correr o código do jogo.",
+  "Options.CpuEngine.Native": "Nativo",
+
+  "Options.Strict.Label": "Resolução estrita de dynlib",
+  "Options.Strict.Desc": "Falha o arranque quando um símbolo importado não pode ser resolvido.",
+
+  "Options.LogLevel.Label": "Nível de registo",
+  "Options.LogLevel.Desc": "Nível de detalhe da saída da consola do emulador.",
+  "Options.LogLevel.Trace": "Rastreio",
+  "Options.LogLevel.Debug": "Depuração",
+  "Options.LogLevel.Info": "Informação",
+  "Options.LogLevel.Warning": "Aviso",
+  "Options.LogLevel.Error": "Erro",
+  "Options.LogLevel.Critical": "Crítico",
+
+  "Options.TraceImports.Label": "Limite de rastreio de importações",
+  "Options.TraceImports.Desc": "Rastreia as primeiras N importações por módulo (0 = desativado).",
+
+  "Options.LogToFile.Label": "Registar para ficheiro",
+  "Options.LogToFile.Desc": "Duplicar a saída do emulador para um ficheiro de registo.",
+
+  "Options.LogFilePath.Label": "Caminho do ficheiro de registo",
+  "Options.LogFilePath.Default": "Sem caminho personalizado — os registos vão para user/logs junto ao emulador.",
+  "Options.LogFilePath.Select": "Selecionar…",
+
+  "Options.OverrideLogFile.Label": "Substituir ficheiro de registo",
+  "Options.OverrideLogFile.Desc": "Utilizar o caminho de ficheiro exato em vez de acrescentar o ID do título e a hora.",
+
+  "Options.TitleMusic.Label": "Música do título",
+  "Options.TitleMusic.Desc": "Repetir em loop a música de pré-visualização do jogo selecionado na biblioteca.",
+
+  "Options.Discord.Label": "Presença no Discord",
+  "Options.Discord.Desc": "Mostrar o jogo em execução no seu perfil do Discord.",
+
+  "Options.Language.Label": "Idioma do emulador",
+  "Options.Language.Desc": "Idioma utilizado em todo o lançador. Aplica-se de imediato.",
+
+  "Common.On": "Ativado",
+  "Common.Off": "Desativado",
+
+  "Console.Title": "CONSOLA",
+  "Console.SearchWatermark": "Pesquisar...",
+  "Console.AutoScroll": "Deslocamento automático",
+  "Console.Split": "Dividir",
+  "Console.Copy": "Copiar",
+  "Console.Clear": "Limpar",
+  "Console.WindowTitle": "Consola do SharpEmu",
+
+  "Launch.NoGameSelected": "Nenhum jogo selecionado",
+  "Launch.NoGameHint": "Escolha um jogo da biblioteca ou abra um eboot.bin diretamente.",
+  "Launch.Idle": "Inativo",
+  "Launch.Console": "≡ Consola",
+  "Launch.Launch": "▶  Iniciar",
+  "Launch.Stop": "■  Parar",
+  "Launch.Running": "Em execução — {0}",
+  "Launch.Stopping": "A parar…",
+  "Launch.Exited": "Terminou com o código {0} ({1})",
+  "Launch.ExeNotFound": "Executável do SharpEmu não encontrado. Compile primeiro o projeto SharpEmu.CLI (dotnet build).",
+  "Launch.LogFile": "Ficheiro de registo: {0}",
+  "Launch.Command": "$ SharpEmu {0}",
+  "Launch.StartFailed": "Falha ao iniciar o emulador: {0}",
+  "Launch.ProcessExited": "O processo terminou com o código {0} ({1}).",
+
+  "Exit.Ok": "OK",
+  "Exit.InvalidArguments": "argumentos inválidos",
+  "Exit.EbootNotFound": "eboot não encontrado",
+  "Exit.RuntimeException": "exceção em tempo de execução",
+  "Exit.EmulationError": "erro de emulação",
+  "Exit.Unknown": "desconhecido",
+
+  "Status.EmulatorLocating": "Emulador: a localizar…",
+  "Status.EmulatorPath": "Emulador: {0}",
+  "Status.EmulatorNotFound": "Emulador: executável do SharpEmu não encontrado — compile primeiro o SharpEmu.CLI.",
+  "Status.ScanningLibrary": "A analisar biblioteca…",
+  "Status.AddFolderPrompt": "Adicione uma pasta de jogos para preencher a biblioteca.",
+  "Status.LibraryScanned": "Biblioteca analisada: {0} jogo(s) em {1} pasta(s).",
+  "Status.CouldNotOpenFolder": "Não foi possível abrir a pasta: {0}",
+  "Status.CopiedToClipboard": "{0} copiado para a área de transferência.",
+  "Status.RemovedFromLibrary": "“{0}” removido da biblioteca. Adicione novamente a pasta para o restaurar.",
+  "Status.Running": "A executar {0}",
+  "Status.Stopping": "A parar…",
+  "Status.Idle": "Inativo",
+
+  "Clipboard.Path": "Caminho",
+  "Clipboard.TitleId": "ID do título",
+
+  "Discord.Playing": "A jogar {0}",
+  "Discord.Browsing": "A navegar na biblioteca",
+
+  "Dialog.ChooseGameFolder": "Escolha uma pasta com jogos",
+  "Dialog.OpenExecutable": "Abrir um executável para iniciar",
+  "Dialog.PsExecutables": "Executáveis PS",
+  "Dialog.SaveLogFile": "Selecione onde guardar o ficheiro de registo",
+  "Dialog.PlainTextFiles": "Ficheiros de Texto Simples",
+  "Dialog.LogFiles": "Ficheiros de Registo",
+
+  "Options.About" : "Sobre",
+  "About.Github.Label": "GitHub",
+  "About.Github.Desc": "Código-fonte, problemas e desenvolvimento do projeto.",
+  "About.Discord.Label": "Discord",
+  "About.Discord.Desc": "Junte-se à comunidade, obtenha suporte e acompanhe o desenvolvimento.",
+  "About.GithubButton": "Contribua no GitHub!",
+  "About.DiscordButton": "Junte-se ao nosso Discord!"
+}

src/SharpEmu.GUI/Localization.cs

@@ -22,6 +22,8 @@ public sealed class Localization
     private const string EmbeddedResourceSuffix = ".json";
 
     private Dictionary<string, string> _strings = new();
+    private Dictionary<string, string> _fallbackStrings = new();
+
 
     private Localization()
     {
@@ -32,7 +34,16 @@ public sealed class Localization
 
     public string CurrentCode { get; private set; } = "en";
 
-    public string Get(string key) => _strings.TryGetValue(key, out var value) ? value : key;
+    public string Get(string key)
+    {
+        if (_strings.TryGetValue(key, out var value))
+            return value;
+
+        if (_fallbackStrings.TryGetValue(key, out var fallbackValue))
+            return fallbackValue;
+
+        return key;
+    }
 
     public string Format(string key, params object?[] args) => string.Format(Get(key), args);
 
@@ -74,13 +85,46 @@ public sealed class Localization
     }
 
     /// <summary>Loads a language by code (e.g. "en"): a loose override file first, then the embedded copy.</summary>
+    /// english is the fallback language
     public void Load(string code)
     {
-        if (!TryLoadLooseFile(code) && !TryLoadEmbedded(code) &&
-            !string.Equals(code, "en", StringComparison.OrdinalIgnoreCase))
+        if (_fallbackStrings.Count == 0 && !string.Equals(code, "en", StringComparison.OrdinalIgnoreCase))
         {
-            _ = TryLoadLooseFile("en") || TryLoadEmbedded("en");
+            if (!TryLoadLooseFile("en", out var fallback) && !TryLoadEmbedded("en", out fallback))
+            {
+                fallback = new Dictionary<string, string>();
+            }
+            _fallbackStrings = fallback;
         }
+        else if (string.Equals(code, "en", StringComparison.OrdinalIgnoreCase))
+        {
+            if (TryLoadLooseFile("en", out var enDict) || TryLoadEmbedded("en", out enDict))
+            {
+                _strings = enDict;
+                _fallbackStrings = enDict;
+            }
+            else
+            {
+                _strings = new Dictionary<string, string>();
+                _fallbackStrings = new Dictionary<string, string>();
+            }
+            CurrentCode = "en";
+            return;
+        }
+
+        // Load the requested language
+        if (TryLoadLooseFile(code, out var loaded) || TryLoadEmbedded(code, out loaded))
+        {
+            _strings = loaded;
+        }
+        else
+        {
+            if (_fallbackStrings.Count > 0)
+                _strings = new Dictionary<string, string>(_fallbackStrings);
+            else
+                _strings = new Dictionary<string, string>();
+        }
+        CurrentCode = code;
     }
 
     private static IEnumerable<string> EmbeddedLanguageCodes()
@@ -149,16 +193,64 @@ public sealed class Localization
         }
     }
 
-    private bool TryLoad(string code, string json)
+    private bool TryLoadLooseFile(string code, out Dictionary<string, string> result)
+    {
+        result = new Dictionary<string, string>();
+        try
+        {
+            var path = Path.Combine(LanguagesDirectory, $"{code}.json");
+            if (!File.Exists(path))
+                return false;
+
+            var json = File.ReadAllText(path);
+            return TryLoad(json, out result);
+        }
+        catch (Exception)
+        {
+            return false;
+        }
+    }
+
+    private bool TryLoadEmbedded(string code, out Dictionary<string, string> result)
+    {
+        result = new Dictionary<string, string>();
+        try
+        {
+            using var stream = OpenEmbeddedLanguageStream(code);
+            if (stream is null)
+                return false;
+
+            using var reader = new StreamReader(stream);
+            var json = reader.ReadToEnd();
+            return TryLoad(json, out result);
+        }
+        catch (Exception)
+        {
+            return false;
+        }
+    }
+
+    private static bool TryLoad(string json, out Dictionary<string, string> result)
     {
         var loaded = JsonSerializer.Deserialize<Dictionary<string, string>>(json);
         if (loaded is null)
         {
+            result = new Dictionary<string, string>();
             return false;
         }
 
-        _strings = loaded;
-        CurrentCode = code;
+        result = loaded;
         return true;
     }
-}
+    
+    private bool TryLoad(string code, string json)
+    {
+        if (TryLoad(json, out var dict))
+        {
+            _strings = dict;
+            CurrentCode = code;
+            return true;
+        }
+        return false;
+    }
+}

src/SharpEmu.GUI/MainWindow.axaml

@@ -317,6 +317,154 @@ SPDX-License-Identifier: GPL-2.0-or-later
                       </Grid>
                     </StackPanel>
                   </Border>
+                  <Border Classes="card">
+                    <StackPanel Spacing="14">
+                      <TextBlock x:Name="AboutSectionTitle"
+                                Classes="sectionTitle"
+                                Text="ABOUT" />
+                      
+                      <!--Github-->
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel Grid.Column="0"
+                                      Orientation="Horizontal"
+                                      Spacing="8"
+                                      VerticalAlignment="Center">
+                          <Image Source="avares://SharpEmu.GUI/Assets/github.png"
+                                    Width="20"
+                                    Height="20"
+                                    VerticalAlignment="Center" />
+                          <StackPanel VerticalAlignment="Center"
+                                          Spacing="2">
+                            <TextBlock x:Name="GithubLabel"
+                                            Text="GitHub"
+                                            FontSize="13" />
+                            <TextBlock x:Name="GithubDesc"
+                                            Text="Source code, issues and project development."
+                                            FontSize="11"
+                                            Foreground="{StaticResource MutedBrush}"
+                                            TextWrapping="Wrap" />
+                          </StackPanel>
+                        </StackPanel>
+
+                        <Button Grid.Column="1"
+                                x:Name="GithubButton"
+                                Classes="ghost"
+                                Content="Open"
+                                VerticalAlignment="Center" />
+                      </Grid>
+
+                      <!--Discord-->
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel Grid.Column="0"
+                                        Orientation="Horizontal"
+                                        Spacing="8"
+                                        VerticalAlignment="Center">
+                          <Image Source="avares://SharpEmu.GUI/Assets/discord.png"
+                                  Width="20"
+                                  Height="20"
+                                  VerticalAlignment="Center" />
+                          <StackPanel VerticalAlignment="Center"
+                                      Spacing="2">
+                            <TextBlock x:Name="DiscordServerLabel"
+                                      Text="Discord"
+                                      FontSize="13" />
+                            <TextBlock x:Name="DiscordServerDesc"
+                                      Text="Join the community, get support and follow development."
+                                      FontSize="11"
+                                      Foreground="{StaticResource MutedBrush}"
+                                      TextWrapping="Wrap" />
+                          </StackPanel>
+                        </StackPanel>
+
+                        <Button Grid.Column="1"
+                                x:Name="DiscordButton"
+                                Classes="ghost"
+                                Content="Join"
+                                VerticalAlignment="Center" />
+                      </Grid>
+                    </StackPanel>
+                  </Border>
+                </StackPanel>
+              </ScrollViewer>
+            </TabItem>
+            <TabItem x:Name="EnvTabItem" Header="Environment" FontSize="15">
+              <ScrollViewer>
+                <StackPanel Margin="0,14,0,16" Spacing="16" MaxWidth="1280" HorizontalAlignment="Left">
+
+                  <Border Classes="card">
+                    <StackPanel Spacing="14">
+                      <TextBlock x:Name="EnvSectionTitle" Classes="sectionTitle" Text="ENVIRONMENT VARIABLES" />
+                      <TextBlock x:Name="EnvDesc"
+                                 Text="Switches passed to the emulator as environment variables at launch."
+                                 FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_BTHID_UNAVAILABLE" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvBthidDesc"
+                                     Text="Report Bluetooth HID as unavailable for titles whose wheel/FFB middleware polls forever.&#10;Leave off normally. Some titles freeze when init fails."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvBthidToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_DISABLE_IMPORT_LOOP_GUARD" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvLoopGuardDesc"
+                                     Text="Do not force quit titles that repeat the same call for too long.&#10;Try this when a game exits on its own while loading."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvLoopGuardToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_VK_VALIDATION" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvVkValidationDesc"
+                                     Text="Enable Vulkan validation layers for GPU debugging.&#10;Slow. Requires the Vulkan SDK to be installed."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvVkValidationToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_DUMP_SPIRV" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvDumpSpirvDesc"
+                                     Text="Dump AGC shaders and their SPIR-V translations to the shader-dumps folder.&#10;Use when reporting shader or rendering bugs."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvDumpSpirvToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_LOG_DIRECT_MEMORY" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvLogDirectMemoryDesc"
+                                     Text="Log direct memory allocations and failures to the console.&#10;Use when a game aborts or exits during boot."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvLogDirectMemoryToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+
+                      <Grid ColumnDefinitions="*,Auto">
+                        <StackPanel VerticalAlignment="Center" Spacing="2" Margin="0,0,16,0">
+                          <TextBlock Text="SHARPEMU_LOG_NP" FontSize="13" FontFamily="Consolas,monospace" />
+                          <TextBlock x:Name="EnvLogNpDesc"
+                                     Text="Log NP (PlayStation Network) library calls to the console."
+                                     FontSize="11" Foreground="{StaticResource MutedBrush}" TextWrapping="Wrap" />
+                        </StackPanel>
+                        <ToggleSwitch Grid.Column="1" x:Name="EnvLogNpToggle" OnContent="On" OffContent="Off"
+                                      VerticalAlignment="Center" />
+                      </Grid>
+                    </StackPanel>
+                  </Border>
 
                 </StackPanel>
               </ScrollViewer>

src/SharpEmu.GUI/MainWindow.axaml.cs

@@ -12,7 +12,8 @@ using Avalonia.Platform;
 using Avalonia.Platform.Storage;
 using Avalonia.Threading;
 using Avalonia.VisualTree;
-using SharpEmu.Libs.Pad;
+using SharpEmu.HLE.Host;
+using SharpEmu.HLE.Host.Windows;
 using SharpEmu.Logging;
 using System.Collections.Concurrent;
 using System.Collections.ObjectModel;
@@ -33,6 +34,12 @@ public partial class MainWindow : Window
     private static readonly IBrush WarningLineBrush = new SolidColorBrush(Color.Parse("#E8B341"));
     private static readonly IBrush ErrorLineBrush = new SolidColorBrush(Color.Parse("#F2777C"));
     private static readonly IBrush SuccessLineBrush = new SolidColorBrush(Color.Parse("#63D489"));
+    private static readonly StringComparer FilePathComparer = OperatingSystem.IsWindows()
+        ? StringComparer.OrdinalIgnoreCase
+        : StringComparer.Ordinal;
+    private static readonly StringComparison FilePathComparison = OperatingSystem.IsWindows()
+        ? StringComparison.OrdinalIgnoreCase
+        : StringComparison.Ordinal;
 
     private readonly List<GameEntry> _allGames = new();
     private readonly ObservableCollection<GameEntry> _visibleGames = new();
@@ -62,7 +69,7 @@ public partial class MainWindow : Window
 
     // Controller navigation state.
     private readonly DispatcherTimer _gamepadTimer;
-    private uint _previousPadButtons;
+    private HostGamepadButtons _previousPadButtons;
     private long _navLeftNextAt;
     private long _navRightNextAt;
     private long _navUpNextAt;
@@ -125,6 +132,18 @@ public partial class MainWindow : Window
             UpdateDiscordPresence();
         };
         SelectLogFilePathButton.Click += async (_, _) => await SelectLogFilePathAsync();
+        EnvBthidToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_BTHID_UNAVAILABLE", EnvBthidToggle.IsChecked == true);
+        EnvLoopGuardToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD", EnvLoopGuardToggle.IsChecked == true);
+        EnvVkValidationToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_VK_VALIDATION", EnvVkValidationToggle.IsChecked == true);
+        EnvDumpSpirvToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_DUMP_SPIRV", EnvDumpSpirvToggle.IsChecked == true);
+        EnvLogDirectMemoryToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_LOG_DIRECT_MEMORY", EnvLogDirectMemoryToggle.IsChecked == true);
+        EnvLogNpToggle.IsCheckedChanged += (_, _) =>
+            SetEnvironmentToggle("SHARPEMU_LOG_NP", EnvLogNpToggle.IsChecked == true);
         LanguageBox.SelectionChanged += (_, _) => OnLanguageChanged();
 
         GameList.AddHandler(ContextRequestedEvent, OnGameContextRequested, RoutingStrategies.Tunnel);
@@ -139,14 +158,33 @@ public partial class MainWindow : Window
         Opened += async (_, _) => await OnOpenedAsync();
         Closing += (_, _) => OnWindowClosing();
 
-        DualSenseReader.EnsureStarted();
-        XInputReader.EnsureStarted();
+        WindowsDualSenseReader.EnsureStarted();
+        WindowsXInputReader.EnsureStarted();
         _gamepadTimer = new DispatcherTimer
         {
             Interval = TimeSpan.FromMilliseconds(50),
         };
         _gamepadTimer.Tick += (_, _) => PollGamepad();
         _gamepadTimer.Start();
+
+
+        GithubButton.Click += (_, _) =>
+        {
+            Process.Start(new ProcessStartInfo
+            {
+                FileName = "https://github.com/sharpemu/sharpemu",
+                UseShellExecute = true
+            });
+        };
+
+        DiscordButton.Click += (_, _) =>
+        {
+            Process.Start(new ProcessStartInfo
+            {
+                FileName = "https://discord.com/invite/6GejPEDqpc",
+                UseShellExecute = true
+            });
+        };
     }
 
     /// <summary>
@@ -193,9 +231,9 @@ public partial class MainWindow : Window
     private void PollGamepad()
     {
         // DualSense wins when both are connected; XInput covers Xbox pads.
-        if (!DualSenseReader.TryGetState(out var pad) && !XInputReader.TryGetState(out pad))
+        if (!WindowsDualSenseReader.TryGetState(out var pad) && !WindowsXInputReader.TryGetState(out pad))
         {
-            _previousPadButtons = 0;
+            _previousPadButtons = HostGamepadButtons.None;
             return;
         }
 
@@ -208,12 +246,12 @@ public partial class MainWindow : Window
         }
 
         var shoulderPressed = pad.Buttons & ~_previousPadButtons;
-        if ((shoulderPressed & OrbisPadButton.L1) != 0)
+        if ((shoulderPressed & HostGamepadButtons.L1) != 0)
         {
             SetActivePage(0);
         }
 
-        if ((shoulderPressed & OrbisPadButton.R1) != 0)
+        if ((shoulderPressed & HostGamepadButtons.R1) != 0)
         {
             SetActivePage(1);
         }
@@ -225,10 +263,10 @@ public partial class MainWindow : Window
         }
 
         var now = Environment.TickCount64;
-        var left = (pad.Buttons & 0x0080) != 0 || pad.LeftX < 64;
-        var right = (pad.Buttons & 0x0020) != 0 || pad.LeftX > 192;
-        var up = (pad.Buttons & 0x0010) != 0 || pad.LeftY < 64;
-        var down = (pad.Buttons & 0x0040) != 0 || pad.LeftY > 192;
+        var left = (pad.Buttons & HostGamepadButtons.Left) != 0 || pad.LeftX < 64;
+        var right = (pad.Buttons & HostGamepadButtons.Right) != 0 || pad.LeftX > 192;
+        var up = (pad.Buttons & HostGamepadButtons.Up) != 0 || pad.LeftY < 64;
+        var down = (pad.Buttons & HostGamepadButtons.Down) != 0 || pad.LeftY > 192;
 
         if (ShouldNavigate(left, ref _navLeftNextAt, now))
         {
@@ -251,12 +289,12 @@ public partial class MainWindow : Window
         }
 
         var pressed = pad.Buttons & ~_previousPadButtons;
-        if ((pressed & 0x4000) != 0) // Cross
+        if ((pressed & HostGamepadButtons.Cross) != 0)
         {
             LaunchSelected();
         }
 
-        if ((pressed & 0x2000) != 0) // Circle
+        if ((pressed & HostGamepadButtons.Circle) != 0)
         {
             StopEmulator();
         }
@@ -384,6 +422,15 @@ public partial class MainWindow : Window
         LoadingStateText.Text = loc.Get("Library.Loading");
 
         GeneralTabItem.Header = loc.Get("Options.General");
+        EnvTabItem.Header = loc.Get("Options.Env.Tab");
+        EnvSectionTitle.Text = loc.Get("Options.Section.Environment");
+        EnvDesc.Text = loc.Get("Options.Env.Desc");
+        EnvBthidDesc.Text = loc.Get("Options.Env.Bthid.Desc");
+        EnvLoopGuardDesc.Text = loc.Get("Options.Env.LoopGuard.Desc");
+        EnvVkValidationDesc.Text = loc.Get("Options.Env.VkValidation.Desc");
+        EnvDumpSpirvDesc.Text = loc.Get("Options.Env.DumpSpirv.Desc");
+        EnvLogDirectMemoryDesc.Text = loc.Get("Options.Env.LogDirectMemory.Desc");
+        EnvLogNpDesc.Text = loc.Get("Options.Env.LogNp.Desc");
         EmulationSectionTitle.Text = loc.Get("Options.Section.Emulation");
         LoggingSectionTitle.Text = loc.Get("Options.Section.Logging");
         LauncherSectionTitle.Text = loc.Get("Options.Section.Launcher");
@@ -443,6 +490,14 @@ public partial class MainWindow : Window
         LaunchButton.Content = loc.Get("Launch.Launch");
         StopButton.Content = loc.Get("Launch.Stop");
 
+        AboutSectionTitle.Text = loc.Get("Options.About");
+        GithubLabel.Text = loc.Get("About.Github.Label");
+        GithubDesc.Text = loc.Get("About.Github.Desc");
+        DiscordServerLabel.Text = loc.Get("About.Discord.Label");
+        DiscordServerDesc.Text = loc.Get("About.Discord.Desc");
+        GithubButton.Content = loc.Get("About.GithubButton");
+        DiscordButton.Content = loc.Get("About.DiscordButton");
+
         UpdateEmptyStateTexts();
         UpdateSelectedGameTexts();
     }
@@ -557,9 +612,34 @@ public partial class MainWindow : Window
         OverrideLogFileToggle.IsChecked = _settings.OverrideLogFile;
         TitleMusicToggle.IsChecked = _settings.PlayTitleMusic;
         DiscordToggle.IsChecked = _settings.DiscordRichPresence;
+        EnvBthidToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_BTHID_UNAVAILABLE");
+        EnvLoopGuardToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_DISABLE_IMPORT_LOOP_GUARD");
+        EnvVkValidationToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_VK_VALIDATION");
+        EnvDumpSpirvToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_DUMP_SPIRV");
+        EnvLogDirectMemoryToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_LOG_DIRECT_MEMORY");
+        EnvLogNpToggle.IsChecked = _settings.EnvironmentToggles.Contains("SHARPEMU_LOG_NP");
         UpdateLogFilePathText();
     }
 
+    // Environment variables set on this process at the previous launch; children
+    // inherit the process environment, so stale names must be cleared explicitly.
+    private readonly HashSet<string> _appliedEnvironmentVariables = new(StringComparer.OrdinalIgnoreCase);
+
+    private void SetEnvironmentToggle(string name, bool enabled)
+    {
+        if (enabled)
+        {
+            if (!_settings.EnvironmentToggles.Contains(name))
+            {
+                _settings.EnvironmentToggles.Add(name);
+            }
+        }
+        else
+        {
+            _settings.EnvironmentToggles.Remove(name);
+        }
+    }
+
     private string SelectedLogLevel()
     {
         return LogLevelBox.SelectedIndex switch
@@ -653,7 +733,7 @@ public partial class MainWindow : Window
         }
 
         var changed = false;
-        if (!_settings.GameFolders.Contains(path, StringComparer.OrdinalIgnoreCase))
+        if (!_settings.GameFolders.Contains(path, FilePathComparer))
         {
             _settings.GameFolders.Add(path);
             changed = true;
@@ -663,7 +743,7 @@ public partial class MainWindow : Window
         // games beneath it that were removed from the library earlier.
         var prefix = Path.TrimEndingDirectorySeparator(path) + Path.DirectorySeparatorChar;
         changed |= _settings.ExcludedGames.RemoveAll(excluded =>
-            excluded.StartsWith(prefix, StringComparison.OrdinalIgnoreCase)) > 0;
+            excluded.StartsWith(prefix, FilePathComparison)) > 0;
 
         if (changed)
         {
@@ -676,7 +756,7 @@ public partial class MainWindow : Window
     private async Task RescanLibraryAsync()
     {
         var folders = _settings.GameFolders.ToArray();
-        var excluded = new HashSet<string>(_settings.ExcludedGames, StringComparer.OrdinalIgnoreCase);
+        var excluded = new HashSet<string>(_settings.ExcludedGames, FilePathComparer);
         StatusBarRight.Text = Localization.Instance.Get("Status.ScanningLibrary");
         EmptyState.IsVisible = false;
         LoadingState.IsVisible = true;
@@ -794,7 +874,7 @@ public partial class MainWindow : Window
     private static List<GameEntry> ScanFolders(IReadOnlyList<string> folders, IReadOnlySet<string> excludedPaths)
     {
         var games = new List<GameEntry>();
-        var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var seen = new HashSet<string>(FilePathComparer);
         var enumeration = new EnumerationOptions
         {
             IgnoreInaccessible = true,
@@ -1058,13 +1138,13 @@ public partial class MainWindow : Window
             return;
         }
 
-        if (!_settings.ExcludedGames.Contains(game.Path, StringComparer.OrdinalIgnoreCase))
+        if (!_settings.ExcludedGames.Contains(game.Path, FilePathComparer))
         {
             _settings.ExcludedGames.Add(game.Path);
             _settings.Save();
         }
 
-        _allGames.RemoveAll(g => string.Equals(g.Path, game.Path, StringComparison.OrdinalIgnoreCase));
+        _allGames.RemoveAll(g => string.Equals(g.Path, game.Path, FilePathComparison));
         GameList.SelectedItem = null;
         RefreshVisibleGames();
         StatusBarRight.Text = Localization.Instance.Format("Status.RemovedFromLibrary", game.Name);
@@ -1088,7 +1168,7 @@ public partial class MainWindow : Window
         }
 
         if (selectedPath is not null &&
-            _visibleGames.FirstOrDefault(g => g.Path.Equals(selectedPath, StringComparison.OrdinalIgnoreCase))
+            _visibleGames.FirstOrDefault(g => g.Path.Equals(selectedPath, FilePathComparison))
                 is { } reselected)
         {
             GameList.SelectedItem = reselected;
@@ -1375,6 +1455,24 @@ public partial class MainWindow : Window
             Localization.Instance.Format("Launch.Command", string.Join(' ', arguments)),
             DimLineBrush);
 
+        // Apply the enabled switches to this process; both emulator launch paths
+        // (CreateProcessW and Process.Start) inherit it. Clear switches turned
+        // off since the previous launch.
+        foreach (var staleName in _appliedEnvironmentVariables)
+        {
+            if (!_settings.EnvironmentToggles.Contains(staleName))
+            {
+                Environment.SetEnvironmentVariable(staleName, null);
+            }
+        }
+
+        _appliedEnvironmentVariables.Clear();
+        foreach (var name in _settings.EnvironmentToggles)
+        {
+            Environment.SetEnvironmentVariable(name, "1");
+            _appliedEnvironmentVariables.Add(name);
+        }
+
         var emulator = new EmulatorProcess();
         emulator.OutputReceived += (line, isError) => _pendingLines.Enqueue((line, isError));
         emulator.Exited += code => Dispatcher.UIThread.Post(() => OnEmulatorExited(code));
@@ -1395,7 +1493,7 @@ public partial class MainWindow : Window
         _isRunning = true;
         _runningGameName = displayName;
         _runningGameTitleId = _allGames
-            .FirstOrDefault(game => game.Path.Equals(ebootPath, StringComparison.OrdinalIgnoreCase))?
+            .FirstOrDefault(game => game.Path.Equals(ebootPath, FilePathComparison))?
             .TitleId;
         _runningSinceUnixSeconds = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
         StatusDot.Fill = SuccessLineBrush;
@@ -1472,6 +1570,7 @@ public partial class MainWindow : Window
             2 => "Exit.EbootNotFound",
             3 => "Exit.RuntimeException",
             4 => "Exit.EmulationError",
+            -1073741819 => "Exit.EmulationError",
             _ => "Exit.Unknown",
         };
         var meaning = Localization.Instance.Get(meaningKey);

src/SharpEmu.GUI/SharpEmu.GUI.csproj

@@ -9,7 +9,9 @@ SPDX-License-Identifier: GPL-2.0-or-later
        the executable is started without arguments. -->
   <PropertyGroup>
     <GenerateDocumentationFile>false</GenerateDocumentationFile>
-    <Version>0.0.1</Version>
+    <!-- Required by the source-generated LibraryImport stubs in the linked
+         controller readers below. -->
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
   </PropertyGroup>
 
   <!-- Dependency-free; provides the BuildInfo provenance shown in the
@@ -28,6 +30,8 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
   <ItemGroup>
     <AvaloniaResource Include="..\..\assets\images\SharpEmu.ico" Link="Assets/SharpEmu.ico" />
+    <AvaloniaResource Include="..\..\assets\images\github.png" Link="Assets/github.png" />
+    <AvaloniaResource Include="..\..\assets\images\discord.png" Link="Assets/discord.png" />
   </ItemGroup>
 
   <ItemGroup>
@@ -39,14 +43,14 @@ SPDX-License-Identifier: GPL-2.0-or-later
 
 
   <!-- The controller readers (DualSense raw HID + Xbox XInput) are shared
-       with the emulator's pad HLE. They are dependency-free, so they are
-       compiled in directly rather than pulling a reference to all of
-       SharpEmu.Libs into the launcher. -->
+       with the emulator's host input backend. They are dependency-free, so
+       they are compiled in directly rather than pulling a reference to all
+       of SharpEmu.HLE into the launcher. -->
   <ItemGroup>
-    <Compile Include="..\SharpEmu.Libs\Pad\PadState.cs" Link="Input/PadState.cs" />
-    <Compile Include="..\SharpEmu.Libs\Pad\HidNative.cs" Link="Input/HidNative.cs" />
-    <Compile Include="..\SharpEmu.Libs\Pad\DualSenseReader.cs" Link="Input/DualSenseReader.cs" />
-    <Compile Include="..\SharpEmu.Libs\Pad\XInputReader.cs" Link="Input/XInputReader.cs" />
+    <Compile Include="..\SharpEmu.HLE\Host\HostGamepadState.cs" Link="Input/HostGamepadState.cs" />
+    <Compile Include="..\SharpEmu.HLE\Host\Windows\WindowsHidNative.cs" Link="Input/WindowsHidNative.cs" />
+    <Compile Include="..\SharpEmu.HLE\Host\Windows\WindowsDualSenseReader.cs" Link="Input/WindowsDualSenseReader.cs" />
+    <Compile Include="..\SharpEmu.HLE\Host\Windows\WindowsXInputReader.cs" Link="Input/WindowsXInputReader.cs" />
   </ItemGroup>
 
 </Project>

src/SharpEmu.GUI/packages.lock.json

@@ -1,189 +0,0 @@
-{
-  "version": 2,
-  "dependencies": {
-    "net10.0": {
-      "Avalonia": {
-        "type": "Direct",
-        "requested": "[11.3.18, )",
-        "resolved": "11.3.18",
-        "contentHash": "2C4UxhWUObWGgYKWic1x5BMMWGJP6SElb91WeOxs+X/iR26rtkqpxFFwwo50FXS9AyYnHfk8QKXDEfe7oT/kZA==",
-        "dependencies": {
-          "Avalonia.BuildServices": "11.3.2",
-          "Avalonia.Remote.Protocol": "11.3.18",
-          "MicroCom.Runtime": "0.11.0"
-        }
-      },
-      "Avalonia.Desktop": {
-        "type": "Direct",
-        "requested": "[11.3.18, )",
-        "resolved": "11.3.18",
-        "contentHash": "bilMPa5vYiis6fbNovb6esKytBnOCEGojBa1XFegLCRHCP6g6PvZwS0XF/YOAGkENRlHG8dI7lohOpQ9bIkq1g==",
-        "dependencies": {
-          "Avalonia": "11.3.18",
-          "Avalonia.Native": "11.3.18",
-          "Avalonia.Skia": "11.3.18",
-          "Avalonia.Win32": "11.3.18",
-          "Avalonia.X11": "11.3.18"
-        }
-      },
-      "Avalonia.Fonts.Inter": {
-        "type": "Direct",
-        "requested": "[11.3.18, )",
-        "resolved": "11.3.18",
-        "contentHash": "27u6hB3Y2Ue586yjfeVakberY73VNQXtuKwe/P927XG1QPlhsfmOyifLHDDpSHG85Zl1x/Xv9IZ3+tk9FnjcZQ==",
-        "dependencies": {
-          "Avalonia": "11.3.18"
-        }
-      },
-      "Avalonia.Themes.Fluent": {
-        "type": "Direct",
-        "requested": "[11.3.18, )",
-        "resolved": "11.3.18",
-        "contentHash": "+Q/TJoynD0zNuu5w2gD+xcTl7GNKJFxlPYAndRLs/mTDrNbbsvv/271WyIysbMPsXSjCyBDp7RCZzQkpD6x5Bg==",
-        "dependencies": {
-          "Avalonia": "11.3.18"
-        }
-      },
-      "Tmds.DBus.Protocol": {
-        "type": "Direct",
-        "requested": "[0.21.3, )",
-        "resolved": "0.21.3",
-        "contentHash": "hDwB8WsQoyALQKqIbwzS68UKdlnafDm4T/DkO/JrA/YIneP/rKv96SxYPVXeh3FP4i/SXfShrYftKLtciJAIlw=="
-      },
-      "Avalonia.Angle.Windows.Natives": {
-        "type": "Transitive",
-        "resolved": "2.1.25547.20250602",
-        "contentHash": "ZL0VLc4s9rvNNFt19Pxm5UNAkmKNylugAwJPX9ulXZ6JWs/l6XZihPWWTyezaoNOVyEPU8YbURtW7XMAtqXH5A=="
-      },
-      "Avalonia.BuildServices": {
-        "type": "Transitive",
-        "resolved": "11.3.2",
-        "contentHash": "qHDToxto1e3hci5YqbG9n0Ty8mlp3zBUN5wT66wKqaDVzXyQ0do3EnRILd4Ke9jpvsktaPpgE0YjEk7hornryQ=="
-      },
-      "Avalonia.FreeDesktop": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "aUwv8BNruRUOaUfMu4U3uibIUS60/rSHgGOhd8zBkLkpxY3JFJvgRbeq5ZzHIyKXCuKi18PO00YHAgCarp3wdw==",
-        "dependencies": {
-          "Avalonia": "11.3.18",
-          "Tmds.DBus.Protocol": "0.21.3"
-        }
-      },
-      "Avalonia.Native": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "8g53DROFW6wVJAnTsE1Iu5bdZO5r0oqxbdbMQODs1QDYCK2IU/y/x/vQVKCYOvqxl4tXkzU9tExv8XqSGPWthQ==",
-        "dependencies": {
-          "Avalonia": "11.3.18"
-        }
-      },
-      "Avalonia.Remote.Protocol": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "vw+6ZfgTuu72dA9aVWn6u56t2nrBd5MoMU0wo/qI9XJAl/c0oYYphIvwLvJP1JorubQY4UE3d0ac8ULBhrGBiA=="
-      },
-      "Avalonia.Skia": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "/B4aXmNRNjG8I5U/a1xJI+bIi0XO6DDzS3mBrIKlVnJRY2CyZiUeESRQXLnIU77Z9TvqkUROs+D47s085YjFtA==",
-        "dependencies": {
-          "Avalonia": "11.3.18",
-          "HarfBuzzSharp": "8.3.1.1",
-          "HarfBuzzSharp.NativeAssets.Linux": "8.3.1.1",
-          "HarfBuzzSharp.NativeAssets.WebAssembly": "8.3.1.1",
-          "SkiaSharp": "2.88.9",
-          "SkiaSharp.NativeAssets.Linux": "2.88.9",
-          "SkiaSharp.NativeAssets.WebAssembly": "2.88.9"
-        }
-      },
-      "Avalonia.Win32": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "eioUHkM2PeLPETd1aEks3rvb9plbba6buIrNdrqCpwE/qgHKUjvRNBd5mUQfAbGgTLiAes524gB8uUMDhrsJVQ==",
-        "dependencies": {
-          "Avalonia": "11.3.18",
-          "Avalonia.Angle.Windows.Natives": "2.1.25547.20250602"
-        }
-      },
-      "Avalonia.X11": {
-        "type": "Transitive",
-        "resolved": "11.3.18",
-        "contentHash": "m4Ki/G5Dovnq+6QzfS0iGbK8V77Q6oTjToMLOB0CxPCCrl3Oxywh6kIjuGJDPaN6kopMmjxlNShyQf+vPYL+JA==",
-        "dependencies": {
-          "Avalonia": "11.3.18",
-          "Avalonia.FreeDesktop": "11.3.18",
-          "Avalonia.Skia": "11.3.18"
-        }
-      },
-      "HarfBuzzSharp": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "tLZN66oe/uiRPTZfrCU4i8ScVGwqHNh5MHrXj0yVf4l7Mz0FhTGnQ71RGySROTmdognAs0JtluHkL41pIabWuQ==",
-        "dependencies": {
-          "HarfBuzzSharp.NativeAssets.Win32": "8.3.1.1",
-          "HarfBuzzSharp.NativeAssets.macOS": "8.3.1.1"
-        }
-      },
-      "HarfBuzzSharp.NativeAssets.Linux": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "3EZ1mpIiKWRLL5hUYA82ZHteeDIVaEA/Z0rA/wU6tjx6crcAkJnBPwDXZugBSfo8+J3EznvRJf49uMsqYfKrHg=="
-      },
-      "HarfBuzzSharp.NativeAssets.macOS": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "jbtCsgftcaFLCA13tVKo5iWdElJScrulLTKJre36O4YQTIlwDtPPqhRZNk+Y0vv4D1gxbscasGRucUDfS44ofQ=="
-      },
-      "HarfBuzzSharp.NativeAssets.WebAssembly": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "loJweK2u/mH/3C2zBa0ggJlITIszOkK64HLAZB7FUT670dTg965whLFYHDQo69NmC4+d9UN0icLC9VHidXaVCA=="
-      },
-      "HarfBuzzSharp.NativeAssets.Win32": {
-        "type": "Transitive",
-        "resolved": "8.3.1.1",
-        "contentHash": "UsJtQsfAJoFDZrXc4hCUfRPMqccfKZ0iumJ/upcUjz/cmsTgVFGNEL5yaJWmkqsuFYdMWbj/En5/kS4PFl9hBA=="
-      },
-      "MicroCom.Runtime": {
-        "type": "Transitive",
-        "resolved": "0.11.0",
-        "contentHash": "MEnrZ3UIiH40hjzMDsxrTyi8dtqB5ziv3iBeeU4bXsL/7NLSal9F1lZKpK+tfBRnUoDSdtcW3KufE4yhATOMCA=="
-      },
-      "SkiaSharp": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "3MD5VHjXXieSHCleRLuaTXmL2pD0mB7CcOB1x2kA1I4bhptf4e3R27iM93264ZYuAq6mkUyX5XbcxnZvMJYc1Q==",
-        "dependencies": {
-          "SkiaSharp.NativeAssets.Win32": "2.88.9",
-          "SkiaSharp.NativeAssets.macOS": "2.88.9"
-        }
-      },
-      "SkiaSharp.NativeAssets.Linux": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "cWSaJKVPWAaT/WIn9c8T5uT/l4ETwHxNJTkEOtNKjphNo8AW6TF9O32aRkxqw3l8GUdUo66Bu7EiqtFh/XG0Zg==",
-        "dependencies": {
-          "SkiaSharp": "2.88.9"
-        }
-      },
-      "SkiaSharp.NativeAssets.macOS": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "Nv5spmKc4505Ep7oUoJ5vp3KweFpeNqxpyGDWyeEPTX2uR6S6syXIm3gj75dM0YJz7NPvcix48mR5laqs8dPuA=="
-      },
-      "SkiaSharp.NativeAssets.WebAssembly": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "kt06RccBHSnAs2wDYdBSfsjIDbY3EpsOVqnlDgKdgvyuRA8ZFDaHRdWNx1VHjGgYzmnFCGiTJBnXFl5BqGwGnA=="
-      },
-      "SkiaSharp.NativeAssets.Win32": {
-        "type": "Transitive",
-        "resolved": "2.88.9",
-        "contentHash": "wb2kYgU7iy84nQLYZwMeJXixvK++GoIuECjU4ECaUKNuflyRlJKyiRhN1MAHswvlvzuvkrjRWlK0Za6+kYQK7w=="
-      },
-      "sharpemu.logging": {
-        "type": "Project"
-      }
-    }
-  }
-}

src/SharpEmu.HLE/CpuContext.cs

@@ -1,6 +1,7 @@
 // Copyright (C) 2026 SharpEmu Emulator Project
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+using System.Buffers;
 using System.Buffers.Binary;
 using System.Text;
 
@@ -25,6 +26,12 @@ public sealed class CpuContext(ICpuMemory memory, Generation generation)
 
     public ulong GsBase { get; set; }
 
+    /// <summary>x87 control word observed at the current guest boundary.</summary>
+    public ushort FpuControlWord { get; set; } = 0x037F;
+
+    /// <summary>MXCSR observed at the current guest boundary.</summary>
+    public uint Mxcsr { get; set; } = 0x1F80;
+
     public ulong this[CpuRegister register]
     {
         get => _registers[(int)register];
@@ -238,23 +245,63 @@ public sealed class CpuContext(ICpuMemory memory, Generation generation)
             return false;
         }
 
-        var bytes = new byte[capacity];
-        for (var index = 0; index < bytes.Length; index++)
+        const int StackBufferLength = 512;
+        const int ReadChunkLength = 128;
+        var rented = capacity > StackBufferLength ? ArrayPool<byte>.Shared.Rent(capacity) : null;
+        Span<byte> bytes = rented is null ? stackalloc byte[StackBufferLength] : rented;
+        try
         {
-            if (!Memory.TryRead(address + (ulong)index, bytes.AsSpan(index, 1)))
+            var length = 0;
+            while (length < capacity)
             {
-                return false;
+                // Bulk-read in bounded chunks rather than the full capacity: the string
+                // may end just before unmapped memory, and overreading past the
+                // terminator by more than a chunk could fault where the old
+                // byte-by-byte loop succeeded.
+                var chunk = Math.Min(ReadChunkLength, capacity - length);
+                var span = bytes.Slice(length, chunk);
+                if (Memory.TryRead(address + (ulong)length, span))
+                {
+                    var terminator = span.IndexOf((byte)0);
+                    if (terminator >= 0)
+                    {
+                        value = Encoding.UTF8.GetString(bytes[..(length + terminator)]);
+                        return true;
+                    }
+
+                    length += chunk;
+                    continue;
+                }
+
+                // The chunk touches an unreadable range; fall back to per-byte reads so a
+                // terminator sitting before the bad byte still yields the string.
+                for (var i = 0; i < chunk; i++)
+                {
+                    if (!Memory.TryRead(address + (ulong)(length + i), bytes.Slice(length + i, 1)))
+                    {
+                        return false;
+                    }
+
+                    if (bytes[length + i] == 0)
+                    {
+                        value = Encoding.UTF8.GetString(bytes[..(length + i)]);
+                        return true;
+                    }
+                }
+
+                length += chunk;
             }
 
-            if (bytes[index] == 0)
+            value = Encoding.UTF8.GetString(bytes[..capacity]);
+            return true;
+        }
+        finally
+        {
+            if (rented is not null)
             {
-                value = Encoding.UTF8.GetString(bytes, 0, index);
-                return true;
+                ArrayPool<byte>.Shared.Return(rented);
             }
         }
-
-        value = Encoding.UTF8.GetString(bytes);
-        return true;
     }
 
     public bool PushUInt64(ulong value)

src/SharpEmu.HLE/GuestCStringAttribute.cs

@@ -0,0 +1,20 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Marks a string parameter of a [SysAbiExport] handler as a guest null-terminated
+/// UTF-8 pointer. The generated thunk reads the string from the argument register's
+/// address (bounded by <see cref="MaxLength"/>) before invoking the handler, and
+/// returns ORBIS_GEN2_ERROR_MEMORY_FAULT to the guest when the read fails — including
+/// a null pointer, matching TryReadNullTerminatedUtf8's contract.
+/// </summary>
+[AttributeUsage(AttributeTargets.Parameter, Inherited = false, AllowMultiple = false)]
+public sealed class GuestCStringAttribute : Attribute
+{
+    public GuestCStringAttribute(int maxLength) => MaxLength = maxLength;
+
+    /// <summary>Upper bound in bytes for the guest read, terminator included.</summary>
+    public int MaxLength { get; }
+}

src/SharpEmu.HLE/GuestImageWriteTracker.cs

@@ -0,0 +1,613 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Globalization;
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Detects guest CPU writes into memory that backs a host GPU image. On PS5
+/// render targets alias unified memory, so games freely mix CPU writes and GPU
+/// draws on the same surface (Chowdren titles memset their fog layers every
+/// frame). Host GPU images are separate storage, so the video backend needs to
+/// know when the guest CPU rewrote a surface to re-upload it. Ranges are
+/// write-protected; the first write faults, the fault handler restores write
+/// access and marks the range dirty, and the video backend consumes the dirty
+/// flag once per flip and re-arms protection after re-uploading.
+/// </summary>
+public static unsafe class GuestImageWriteTracker
+{
+    private const int ProtRead = 0x1;
+    private const int ProtWrite = 0x2;
+    private const int ClockMonotonicRaw = 4;
+
+    private sealed class TrackedRange
+    {
+        public ulong Address;
+        public ulong ByteCount;
+        public ulong Start;
+        public ulong End;
+        public int Dirty;
+        public int Armed;
+        public int FirstCpuWriteSeen;
+        public int PendingFirstCpuWrite;
+        public bool TraceLifetime;
+        public long SourceSequence;
+        public long FirstCpuWriteTraceSequence;
+        public long FirstCpuWriteTimestampNanoseconds;
+        public ulong FirstCpuWriteAddress;
+        public ulong FirstCpuWritePage;
+        public string Source = "unspecified";
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct Timespec
+    {
+        public long Seconds;
+        public long Nanoseconds;
+    }
+
+    private static readonly object _gate = new();
+    private static readonly Dictionary<ulong, TrackedRange> _rangesByAddress = new();
+
+    // Snapshot array read lock-free from the signal handler; rebuilt on every
+    // mutation under the gate. Signal handlers must not take managed locks.
+    private static TrackedRange[] _rangeSnapshot = [];
+
+    private static readonly bool _enabled = !OperatingSystem.IsWindows() &&
+        Environment.GetEnvironmentVariable("SHARPEMU_GUEST_IMAGE_CPU_SYNC") != "0";
+    private static readonly (bool Wildcard, ulong[] Addresses) _lifetimeTraceFilter =
+        ParseAddressList(Environment.GetEnvironmentVariable("SHARPEMU_TRACE_GUEST_IMAGE_ADDRS"));
+    private static readonly (bool Wildcard, string[] Sources) _lifetimeSourceTraceFilter =
+        ParseSourceList(Environment.GetEnvironmentVariable("SHARPEMU_TRACE_GUEST_MEMORY_LIFETIME"));
+    private static readonly bool _lifetimeTraceEnabled =
+        _lifetimeTraceFilter.Wildcard ||
+        _lifetimeTraceFilter.Addresses.Length != 0 ||
+        _lifetimeSourceTraceFilter.Wildcard ||
+        _lifetimeSourceTraceFilter.Sources.Length != 0;
+    private static readonly long _lifetimeTraceEpochNanoseconds =
+        _enabled && _lifetimeTraceEnabled ? GetMonotonicNanoseconds() : 0;
+    private static long _lifetimeTraceSequence;
+
+    [DllImport("libc", EntryPoint = "mprotect", SetLastError = true)]
+    private static extern int Mprotect(nint address, nuint length, int protection);
+
+    [DllImport("libc", EntryPoint = "clock_gettime", SetLastError = false)]
+    private static extern int ClockGetTime(int clockId, Timespec* time);
+
+    public static bool Enabled => _enabled;
+
+    /// <summary>
+    /// Exercises the fault-handling path once outside signal context so every
+    /// branch is JIT-compiled (and, under Rosetta 2, translated) before a real
+    /// fault arrives — a cold signal path is silently never entered there.
+    /// </summary>
+    public static void WarmUp()
+    {
+        if (!_enabled)
+        {
+            return;
+        }
+
+        var scratch = NativeMemory.AllocZeroed(4096);
+        try
+        {
+            // Warm the timestamp P/Invoke used by the signal-safe scalar
+            // capture path before a real protected-page write reaches it.
+            _ = GetMonotonicNanoseconds();
+            var address = (ulong)scratch;
+            Track(address, 4096);
+            _ = TryHandleWriteFault(address);
+            _ = ConsumeDirty(address);
+            Untrack(address);
+        }
+        finally
+        {
+            NativeMemory.Free(scratch);
+        }
+    }
+
+    /// <summary>Registers a range and arms write protection on it.</summary>
+    public static void Track(
+        ulong address,
+        ulong byteCount,
+        long sourceSequence = 0,
+        string source = "unspecified")
+    {
+        if (!_enabled || address == 0 || byteCount == 0)
+        {
+            return;
+        }
+
+        var (start, length) = PageAlign(address, byteCount);
+        lock (_gate)
+        {
+            _rangesByAddress.TryGetValue(address, out var range);
+            if (range is not null &&
+                (range.Start != start ||
+                 range.End != start + length ||
+                 range.ByteCount != byteCount))
+            {
+                // Never resize an object that is still reachable from the
+                // signal handler's lock-free snapshot. Retire it and publish
+                // a fresh immutable range.
+                DisarmLocked(range, "replace-range");
+                _rangesByAddress.Remove(address);
+                range = null;
+            }
+
+            if (range is null)
+            {
+                range = new TrackedRange
+                {
+                    Address = address,
+                    ByteCount = byteCount,
+                    Start = start,
+                    End = start + length,
+                    TraceLifetime =
+                        ShouldTraceRange(start, start + length) || ShouldTraceSource(source),
+                    SourceSequence = sourceSequence,
+                    Source = source,
+                };
+                _rangesByAddress[address] = range;
+                RebuildSnapshotLocked();
+            }
+            else
+            {
+                FlushPendingFirstCpuWrite(range);
+            }
+
+            range.SourceSequence = sourceSequence;
+            range.Source = source;
+            range.TraceLifetime =
+                ShouldTraceRange(range.Start, range.End) || ShouldTraceSource(source);
+            ArmLocked(range, "arm");
+        }
+    }
+
+    public static void Untrack(ulong address)
+    {
+        if (!_enabled)
+        {
+            return;
+        }
+
+        lock (_gate)
+        {
+            if (_rangesByAddress.TryGetValue(address, out var range))
+            {
+                DisarmLocked(range, "untrack");
+                _rangesByAddress.Remove(address);
+                RebuildSnapshotLocked();
+            }
+        }
+    }
+
+    /// <summary>
+    /// Returns true when the guest CPU wrote the range since the last call,
+    /// clearing the flag. The caller re-arms via <see cref="Rearm"/> after it
+    /// finished reading the guest bytes.
+    /// </summary>
+    public static bool ConsumeDirty(ulong address)
+    {
+        if (!_enabled)
+        {
+            return false;
+        }
+
+        lock (_gate)
+        {
+            if (!_rangesByAddress.TryGetValue(address, out var range))
+            {
+                return false;
+            }
+
+            FlushPendingFirstCpuWrite(range);
+            return Interlocked.Exchange(ref range.Dirty, 0) != 0;
+        }
+    }
+
+    /// <summary>
+    /// Non-consuming variant of <see cref="ConsumeDirty"/>: reports whether
+    /// the range has been written since it was last re-armed, leaving the
+    /// flag for the owner that evicts and re-uploads.
+    /// </summary>
+    public static bool PeekDirty(ulong address)
+    {
+        if (!_enabled)
+        {
+            return false;
+        }
+
+        lock (_gate)
+        {
+            if (!_rangesByAddress.TryGetValue(address, out var range))
+            {
+                return false;
+            }
+
+            FlushPendingFirstCpuWrite(range);
+            return Volatile.Read(ref range.Dirty) != 0;
+        }
+    }
+
+    public static void Rearm(ulong address)
+    {
+        if (!_enabled)
+        {
+            return;
+        }
+
+        lock (_gate)
+        {
+            if (_rangesByAddress.TryGetValue(address, out var range))
+            {
+                ArmLocked(range, "rearm");
+            }
+        }
+    }
+
+    /// <summary>
+    /// Prepares pages touched by a managed HLE memory write. Native guest
+    /// stores fault and enter <see cref="TryHandleWriteFault"/> through the
+    /// POSIX signal bridge, but a managed Buffer.MemoryCopy into a protected
+    /// page is surfaced by the runtime as a fatal AccessViolation instead of
+    /// a resumable guest fault. Visit every page in the write span up front so
+    /// all overlapping texture owners are dirtied and made writable.
+    /// </summary>
+    public static void NotifyManagedWrite(ulong address, ulong byteCount)
+    {
+        if (!_enabled || address == 0 || byteCount == 0)
+        {
+            return;
+        }
+
+        var end = address > ulong.MaxValue - byteCount
+            ? ulong.MaxValue
+            : address + byteCount;
+        var candidate = address;
+        while (candidate < end)
+        {
+            _ = TryHandleWriteFault(candidate);
+            var nextPage = (candidate & ~0xFFFUL) + 0x1000UL;
+            if (nextPage <= candidate)
+            {
+                break;
+            }
+            candidate = nextPage;
+        }
+    }
+
+    /// <summary>
+    /// Flushes scalar first-write records captured by the POSIX signal handler.
+    /// Call only from ordinary managed execution, never from signal context.
+    /// </summary>
+    public static void FlushPendingDiagnostics()
+    {
+        if (!_enabled || !_lifetimeTraceEnabled)
+        {
+            return;
+        }
+
+        lock (_gate)
+        {
+            foreach (var range in _rangesByAddress.Values)
+            {
+                FlushPendingFirstCpuWrite(range);
+            }
+        }
+    }
+
+    /// <summary>
+    /// Signal-handler entry: if the fault address lies in a tracked, armed
+    /// range, restore write access, mark the range dirty, and return true so
+    /// the faulting write can be retried. Must not allocate or lock.
+    /// </summary>
+    public static bool TryHandleWriteFault(ulong faultAddress)
+    {
+        if (!_enabled || faultAddress == 0)
+        {
+            return false;
+        }
+
+        var ranges = Volatile.Read(ref _rangeSnapshot);
+        var writableStart = ulong.MaxValue;
+        var writableEnd = 0UL;
+        for (var index = 0; index < ranges.Length; index++)
+        {
+            var range = ranges[index];
+            if (faultAddress < range.Start || faultAddress >= range.End)
+            {
+                continue;
+            }
+
+            writableStart = Math.Min(writableStart, range.Start);
+            writableEnd = Math.Max(writableEnd, range.End);
+        }
+
+        if (writableStart == ulong.MaxValue)
+        {
+            return false;
+        }
+
+        // Ranges are page-aligned and may overlap (font atlases and other
+        // suballocations commonly share pages). Unprotecting one range also
+        // makes every overlapping tracked page writable. Expand to the full
+        // transitive overlap and dirty/disarm every owner, otherwise only the
+        // first dictionary entry observes the write and the others retain a
+        // stale cached texture indefinitely.
+        var expanded = true;
+        while (expanded)
+        {
+            expanded = false;
+            for (var index = 0; index < ranges.Length; index++)
+            {
+                var range = ranges[index];
+                if (range.Start >= writableEnd || range.End <= writableStart)
+                {
+                    continue;
+                }
+
+                var start = Math.Min(writableStart, range.Start);
+                var end = Math.Max(writableEnd, range.End);
+                if (start != writableStart || end != writableEnd)
+                {
+                    writableStart = start;
+                    writableEnd = end;
+                    expanded = true;
+                }
+            }
+        }
+
+        var needsUnprotect = false;
+        for (var index = 0; index < ranges.Length; index++)
+        {
+            var range = ranges[index];
+            if (range.Start < writableEnd && range.End > writableStart &&
+                Volatile.Read(ref range.Armed) != 0)
+            {
+                needsUnprotect = true;
+                break;
+            }
+        }
+
+        if (needsUnprotect &&
+            Mprotect(
+                (nint)writableStart,
+                (nuint)(writableEnd - writableStart),
+                ProtRead | ProtWrite) != 0)
+        {
+            return false;
+        }
+
+        for (var index = 0; index < ranges.Length; index++)
+        {
+            var range = ranges[index];
+            if (range.Start >= writableEnd || range.End <= writableStart)
+            {
+                continue;
+            }
+
+            var wasArmed = Interlocked.Exchange(ref range.Armed, 0) != 0;
+            if (wasArmed &&
+                range.TraceLifetime &&
+                Interlocked.CompareExchange(ref range.FirstCpuWriteSeen, 1, 0) == 0)
+            {
+                // Signal context: capture preallocated scalar fields only.
+                // Formatting and I/O are deferred to a locked safe path.
+                range.FirstCpuWriteTraceSequence =
+                    Interlocked.Increment(ref _lifetimeTraceSequence);
+                range.FirstCpuWriteTimestampNanoseconds = GetMonotonicNanoseconds();
+                range.FirstCpuWriteAddress = faultAddress;
+                range.FirstCpuWritePage = faultAddress & ~0xFFFUL;
+                Volatile.Write(ref range.PendingFirstCpuWrite, 1);
+                Volatile.Write(ref range.FirstCpuWriteSeen, 2);
+            }
+
+            Volatile.Write(ref range.Dirty, 1);
+        }
+
+        return true;
+    }
+
+    private static void ArmLocked(TrackedRange range, string operation)
+    {
+        FlushPendingFirstCpuWrite(range);
+        if (Interlocked.Exchange(ref range.Armed, 1) == 1)
+        {
+            return;
+        }
+
+        // A new publication/rearm starts a new first-write lifetime.
+        Volatile.Write(ref range.FirstCpuWriteSeen, 0);
+        var failed = Mprotect(
+            (nint)range.Start,
+            (nuint)(range.End - range.Start),
+            ProtRead) != 0;
+        if (failed)
+        {
+            Volatile.Write(ref range.Armed, 0);
+        }
+
+        if (range.TraceLifetime)
+        {
+            TraceLifetime(
+                range,
+                failed ? $"{operation}-failed-errno-{Marshal.GetLastPInvokeError()}" : operation);
+        }
+    }
+
+    private static void DisarmLocked(TrackedRange range, string operation)
+    {
+        FlushPendingFirstCpuWrite(range);
+        var wasArmed = Interlocked.Exchange(ref range.Armed, 0) == 1;
+        if (wasArmed)
+        {
+            _ = Mprotect(
+                (nint)range.Start,
+                (nuint)(range.End - range.Start),
+                ProtRead | ProtWrite);
+        }
+
+        if (range.TraceLifetime)
+        {
+            TraceLifetime(range, wasArmed ? operation : $"{operation}-already-disarmed");
+        }
+    }
+
+    private static void RebuildSnapshotLocked()
+    {
+        _rangeSnapshot = _rangesByAddress.Values.ToArray();
+    }
+
+    private static (ulong Start, ulong Length) PageAlign(ulong address, ulong byteCount)
+    {
+        const ulong pageMask = 0xFFFUL;
+        var start = address & ~pageMask;
+        var end = (address + byteCount + pageMask) & ~pageMask;
+        return (start, end - start);
+    }
+
+    private static bool ShouldTraceRange(ulong start, ulong end)
+    {
+        if (_lifetimeTraceFilter.Wildcard)
+        {
+            return true;
+        }
+
+        var addresses = _lifetimeTraceFilter.Addresses;
+        for (var index = 0; index < addresses.Length; index++)
+        {
+            if (addresses[index] >= start && addresses[index] < end)
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static (bool Wildcard, ulong[] Addresses) ParseAddressList(string? addresses)
+    {
+        if (string.IsNullOrWhiteSpace(addresses))
+        {
+            return (false, []);
+        }
+
+        var parsedAddresses = new List<ulong>();
+        foreach (var token in addresses.Split(
+                     [',', ';', ' ', '\t'],
+                     StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+        {
+            if (token == "*")
+            {
+                return (true, []);
+            }
+
+            var span = token.AsSpan();
+            if (span.StartsWith("0x", StringComparison.OrdinalIgnoreCase))
+            {
+                span = span[2..];
+            }
+
+            if (ulong.TryParse(span, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out var parsed))
+            {
+                parsedAddresses.Add(parsed);
+            }
+        }
+
+        return (false, parsedAddresses.ToArray());
+    }
+
+    private static bool ShouldTraceSource(string source)
+    {
+        if (_lifetimeSourceTraceFilter.Wildcard)
+        {
+            return true;
+        }
+
+        return Array.IndexOf(_lifetimeSourceTraceFilter.Sources, source) >= 0;
+    }
+
+    private static (bool Wildcard, string[] Sources) ParseSourceList(string? sources)
+    {
+        if (string.IsNullOrWhiteSpace(sources))
+        {
+            return (false, []);
+        }
+
+        var parsedSources = new List<string>();
+        foreach (var token in sources.Split(
+                     [',', ';'],
+                     StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries))
+        {
+            if (token == "*")
+            {
+                return (true, []);
+            }
+
+            parsedSources.Add(token);
+        }
+
+        return (false, parsedSources.ToArray());
+    }
+
+    private static void FlushPendingFirstCpuWrite(TrackedRange range)
+    {
+        var spin = new SpinWait();
+        while (Volatile.Read(ref range.FirstCpuWriteSeen) == 1)
+        {
+            spin.SpinOnce();
+        }
+
+        if (!range.TraceLifetime || Interlocked.Exchange(ref range.PendingFirstCpuWrite, 0) == 0)
+        {
+            return;
+        }
+
+        TraceLifetime(
+            range,
+            "first-cpu-write-disarm",
+            range.FirstCpuWriteAddress,
+            range.FirstCpuWritePage,
+            range.FirstCpuWriteTraceSequence,
+            range.FirstCpuWriteTimestampNanoseconds);
+    }
+
+    private static void TraceLifetime(
+        TrackedRange range,
+        string operation,
+        ulong faultAddress = 0,
+        ulong faultPage = 0,
+        long traceSequence = 0,
+        long timestampNanoseconds = 0)
+    {
+        if (traceSequence == 0)
+        {
+            traceSequence = Interlocked.Increment(ref _lifetimeTraceSequence);
+        }
+
+        if (timestampNanoseconds == 0)
+        {
+            timestampNanoseconds = GetMonotonicNanoseconds();
+        }
+
+        var elapsedMilliseconds =
+            (timestampNanoseconds - _lifetimeTraceEpochNanoseconds) / 1_000_000.0;
+        Console.Error.WriteLine(
+            $"[WT][LIFETIME] seq={traceSequence} t_ms={elapsedMilliseconds:F3} " +
+            $"event={operation} source_seq={range.SourceSequence} source='{range.Source}' " +
+            $"requested=0x{range.Address:X16}+0x{range.ByteCount:X} " +
+            $"range=0x{range.Start:X16}..0x{range.End:X16} " +
+            $"fault=0x{faultAddress:X16} page=0x{faultPage:X16}");
+    }
+
+    private static long GetMonotonicNanoseconds()
+    {
+        Timespec time;
+        return ClockGetTime(ClockMonotonicRaw, &time) == 0
+            ? unchecked((time.Seconds * 1_000_000_000L) + time.Nanoseconds)
+            : 0;
+    }
+}

src/SharpEmu.HLE/GuestPageProtection.cs

@@ -0,0 +1,13 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+[Flags]
+public enum GuestPageProtection
+{
+    None = 0,
+    Read = 1,
+    Write = 2,
+    Execute = 4,
+}

src/SharpEmu.HLE/GuestThreadExecution.cs

@@ -23,10 +23,32 @@ public readonly record struct GuestThreadSnapshot(
     ulong LastReturnRip,
     string? BlockReason);
 
+/// <summary>
+/// Continuation state for a blocked guest thread, replacing the closure pair a blocking
+/// wait used to allocate. TryWake runs under the scheduler's guest-thread gate and
+/// returns true when the waiter has a final result and the thread should be re-readied;
+/// false leaves it parked. Resume runs later on the woken thread outside that gate, and
+/// its return value becomes the guest's RAX for the resumed call.
+/// </summary>
+public interface IGuestThreadBlockWaiter
+{
+    int Resume();
+
+    bool TryWake();
+}
+
 public interface IGuestThreadScheduler
 {
     bool SupportsGuestContextTransfer { get; }
 
+    /// <summary>
+    /// Associates a pthread identity created on the primary guest executor
+    /// with its live CPU context. Primary execution does not pass through
+    /// TryStartThread, but kernel exception delivery must still be able to
+    /// target it.
+    /// </summary>
+    void RegisterGuestThreadContext(ulong threadHandle, CpuContext context);
+
     bool TryStartThread(CpuContext creatorContext, GuestThreadStartRequest request, out string? error);
 
     bool TryJoinThread(
@@ -39,6 +61,19 @@ public interface IGuestThreadScheduler
 
     int WakeBlockedThreads(string wakeKey, int maxCount = int.MaxValue);
 
+    /// <summary>
+    /// Applies a new guest scheduling priority to a live thread, mapping it
+    /// onto the host thread if one is running. Returns false when the thread
+    /// handle is unknown.
+    /// </summary>
+    bool TrySetGuestThreadPriority(ulong guestThreadHandle, int guestPriority);
+
+    /// <summary>
+    /// Records a new affinity mask for a guest thread and re-applies it to
+    /// the host thread where the platform supports it.
+    /// </summary>
+    bool TrySetGuestThreadAffinity(ulong guestThreadHandle, ulong affinityMask);
+
     IReadOnlyList<GuestThreadSnapshot> SnapshotThreads();
 
     bool TryCallGuestFunction(
@@ -51,11 +86,36 @@ public interface IGuestThreadScheduler
         string reason,
         out string? error);
 
+    bool TryCallGuestFunction(
+        CpuContext callerContext,
+        ulong entryPoint,
+        ulong arg0,
+        ulong arg1,
+        ulong arg2,
+        ulong stackAddress,
+        ulong stackSize,
+        string reason,
+        out ulong returnValue,
+        out string? error);
+
     bool TryCallGuestContinuation(
         CpuContext callerContext,
         GuestCpuContinuation continuation,
         string reason,
         out string? error);
+
+    /// <summary>
+    /// Asynchronously invokes an installed kernel exception handler as the
+    /// target guest thread. This is used by IL2CPP's stop-the-world collector:
+    /// the handler acknowledges suspension and may remain blocked until the
+    /// collecting thread resumes it.
+    /// </summary>
+    bool TryRaiseGuestException(
+        CpuContext callerContext,
+        ulong threadHandle,
+        ulong handler,
+        int exceptionType,
+        out string? error);
 }
 
 public readonly record struct GuestImportCallFrame(
@@ -80,13 +140,34 @@ public readonly record struct GuestCpuContinuation(
     ulong Rdi,
     ulong R8,
     ulong R9,
+    ulong R10,
+    ulong R11,
     ulong R12,
     ulong R13,
     ulong R14,
-    ulong R15);
+    ulong R15,
+    ushort FpuControlWord,
+    uint Mxcsr,
+    bool RestoreFullFpuState);
 
 public static class GuestThreadExecution
 {
+    private sealed class DelegateGuestThreadBlockWaiter : IGuestThreadBlockWaiter
+    {
+        private readonly Func<int> _resume;
+        private readonly Func<bool> _tryWake;
+
+        public DelegateGuestThreadBlockWaiter(Func<int> resume, Func<bool> tryWake)
+        {
+            _resume = resume;
+            _tryWake = tryWake;
+        }
+
+        public int Resume() => _resume();
+
+        public bool TryWake() => _tryWake();
+    }
+
     [ThreadStatic]
     private static ulong _currentGuestThreadHandle;
 
@@ -106,10 +187,7 @@ public static class GuestThreadExecution
     private static string? _pendingBlockWakeKey;
 
     [ThreadStatic]
-    private static Func<int>? _pendingBlockResumeHandler;
-
-    [ThreadStatic]
-    private static Func<bool>? _pendingBlockWakeHandler;
+    private static IGuestThreadBlockWaiter? _pendingBlockWaiter;
 
     [ThreadStatic]
     private static long _pendingBlockDeadlineTimestamp;
@@ -157,8 +235,7 @@ public static class GuestThreadExecution
         _pendingBlockContinuationValid = false;
         _pendingBlockContinuation = default;
         _pendingBlockWakeKey = null;
-        _pendingBlockResumeHandler = null;
-        _pendingBlockWakeHandler = null;
+        _pendingBlockWaiter = null;
         _pendingBlockDeadlineTimestamp = 0;
         _pendingEntryExit = false;
         _pendingEntryExitValue = 0;
@@ -179,8 +256,7 @@ public static class GuestThreadExecution
         _pendingBlockContinuationValid = false;
         _pendingBlockContinuation = default;
         _pendingBlockWakeKey = null;
-        _pendingBlockResumeHandler = null;
-        _pendingBlockWakeHandler = null;
+        _pendingBlockWaiter = null;
         _pendingBlockDeadlineTimestamp = 0;
         _pendingEntryExit = false;
         _pendingEntryExitValue = 0;
@@ -211,8 +287,7 @@ public static class GuestThreadExecution
         CpuContext? context,
         string reason,
         string? wakeKey = null,
-        Func<int>? resumeHandler = null,
-        Func<bool>? wakeHandler = null,
+        IGuestThreadBlockWaiter? waiter = null,
         long blockDeadlineTimestamp = 0)
     {
         if (!IsGuestThread)
@@ -222,8 +297,7 @@ public static class GuestThreadExecution
 
         _pendingBlockReason = string.IsNullOrWhiteSpace(reason) ? "guest_thread_blocked" : reason;
         _pendingBlockWakeKey = string.IsNullOrWhiteSpace(wakeKey) ? _pendingBlockReason : wakeKey;
-        _pendingBlockResumeHandler = resumeHandler;
-        _pendingBlockWakeHandler = wakeHandler;
+        _pendingBlockWaiter = waiter;
         _pendingBlockDeadlineTimestamp = blockDeadlineTimestamp;
         if (context is not null && TryCaptureCurrentBlockContinuation(context, out var continuation))
         {
@@ -239,6 +313,23 @@ public static class GuestThreadExecution
         return true;
     }
 
+    // Compatibility bridge for exports that still describe blocked work as a
+    // resume/wake delegate pair. New hot paths should provide an
+    // IGuestThreadBlockWaiter directly to avoid allocating closures.
+    public static bool RequestCurrentThreadBlock(
+        CpuContext? context,
+        string reason,
+        string? wakeKey,
+        Func<int> resumeHandler,
+        Func<bool> wakeHandler,
+        long blockDeadlineTimestamp = 0) =>
+        RequestCurrentThreadBlock(
+            context,
+            reason,
+            wakeKey,
+            new DelegateGuestThreadBlockWaiter(resumeHandler, wakeHandler),
+            blockDeadlineTimestamp);
+
     public static bool TryConsumeCurrentThreadBlock(out string reason)
     {
         return TryConsumeCurrentThreadBlock(out reason, out _, out _);
@@ -255,7 +346,6 @@ public static class GuestThreadExecution
             out hasContinuation,
             out _,
             out _,
-            out _,
             out _);
     }
 
@@ -264,19 +354,50 @@ public static class GuestThreadExecution
         out GuestCpuContinuation continuation,
         out bool hasContinuation,
         out string wakeKey,
-        out Func<int>? resumeHandler,
-        out Func<bool>? wakeHandler)
+        out IGuestThreadBlockWaiter? waiter)
     {
         return TryConsumeCurrentThreadBlock(
             out reason,
             out continuation,
             out hasContinuation,
             out wakeKey,
-            out resumeHandler,
-            out wakeHandler,
+            out waiter,
             out _);
     }
 
+    public static bool TryConsumeCurrentThreadBlock(
+        out string reason,
+        out GuestCpuContinuation continuation,
+        out bool hasContinuation,
+        out string wakeKey,
+        out IGuestThreadBlockWaiter? waiter,
+        out long blockDeadlineTimestamp)
+    {
+        reason = _pendingBlockReason ?? string.Empty;
+        if (string.IsNullOrEmpty(reason))
+        {
+            continuation = default;
+            hasContinuation = false;
+            wakeKey = string.Empty;
+            waiter = null;
+            blockDeadlineTimestamp = 0;
+            return false;
+        }
+
+        continuation = _pendingBlockContinuation;
+        hasContinuation = _pendingBlockContinuationValid;
+        wakeKey = _pendingBlockWakeKey ?? reason;
+        waiter = _pendingBlockWaiter;
+        blockDeadlineTimestamp = _pendingBlockDeadlineTimestamp;
+        _pendingBlockReason = null;
+        _pendingBlockContinuation = default;
+        _pendingBlockContinuationValid = false;
+        _pendingBlockWakeKey = null;
+        _pendingBlockWaiter = null;
+        _pendingBlockDeadlineTimestamp = 0;
+        return true;
+    }
+
     public static bool TryConsumeCurrentThreadBlock(
         out string reason,
         out GuestCpuContinuation continuation,
@@ -286,32 +407,16 @@ public static class GuestThreadExecution
         out Func<bool>? wakeHandler,
         out long blockDeadlineTimestamp)
     {
-        reason = _pendingBlockReason ?? string.Empty;
-        if (string.IsNullOrEmpty(reason))
-        {
-            continuation = default;
-            hasContinuation = false;
-            wakeKey = string.Empty;
-            resumeHandler = null;
-            wakeHandler = null;
-            blockDeadlineTimestamp = 0;
-            return false;
-        }
-
-        continuation = _pendingBlockContinuation;
-        hasContinuation = _pendingBlockContinuationValid;
-        wakeKey = _pendingBlockWakeKey ?? reason;
-        resumeHandler = _pendingBlockResumeHandler;
-        wakeHandler = _pendingBlockWakeHandler;
-        blockDeadlineTimestamp = _pendingBlockDeadlineTimestamp;
-        _pendingBlockReason = null;
-        _pendingBlockContinuation = default;
-        _pendingBlockContinuationValid = false;
-        _pendingBlockWakeKey = null;
-        _pendingBlockResumeHandler = null;
-        _pendingBlockWakeHandler = null;
-        _pendingBlockDeadlineTimestamp = 0;
-        return true;
+        var consumed = TryConsumeCurrentThreadBlock(
+            out reason,
+            out continuation,
+            out hasContinuation,
+            out wakeKey,
+            out var waiter,
+            out blockDeadlineTimestamp);
+        resumeHandler = waiter is null ? null : waiter.Resume;
+        wakeHandler = waiter is null ? null : waiter.TryWake;
+        return consumed;
     }
 
     public static long ComputeDeadlineTimestamp(TimeSpan timeout)
@@ -360,10 +465,15 @@ public static class GuestThreadExecution
             context[CpuRegister.Rdi],
             context[CpuRegister.R8],
             context[CpuRegister.R9],
+            context[CpuRegister.R10],
+            context[CpuRegister.R11],
             context[CpuRegister.R12],
             context[CpuRegister.R13],
             context[CpuRegister.R14],
-            context[CpuRegister.R15]);
+            context[CpuRegister.R15],
+            context.FpuControlWord,
+            context.Mxcsr,
+            RestoreFullFpuState: false);
         return true;
     }
 

src/SharpEmu.HLE/GuestTlsTemplate.cs

@@ -0,0 +1,442 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+using System.Diagnostics;
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Process-wide registry of ELF PT_TLS templates and per-thread dynamic thread
+/// vectors. AMD64 uses TLS Variant II: startup/static module blocks precede the
+/// thread pointer, while modules introduced after a thread was initialized are
+/// represented by separately allocated DTV entries.
+/// </summary>
+public static class GuestTlsTemplate
+{
+    // Must match CpuDispatcher/DirectExecutionBackend's mapped prefix. PS5
+    // modules can require more than one host page of Variant II static TLS;
+    // Dreaming Sarah's startup image, for example, reaches 0x1870 bytes.
+    public const ulong StartupStaticTlsReservation = 0x10000UL;
+    private static readonly object _gate = new();
+    private static readonly SortedDictionary<ulong, ModuleTemplate> _modules = new();
+    private static readonly Dictionary<ulong, ThreadDtv> _threadDtvs = new();
+    private static ulong _staticTlsSize;
+    private static ulong _maximumAlignment = 1;
+    private static ulong _generation;
+
+    static GuestTlsTemplate()
+    {
+        RunTlsLayoutSelfChecks();
+    }
+
+    private sealed class ModuleTemplate
+    {
+        public required ulong ModuleId { get; init; }
+        public required byte[] InitImage { get; init; }
+        public required ulong MemorySize { get; init; }
+        public required ulong Alignment { get; init; }
+        public required ulong AlignmentBias { get; init; }
+        public required ulong StaticOffset { get; init; }
+    }
+
+    private sealed class ThreadDtv
+    {
+        public ulong Generation { get; set; }
+        public Dictionary<ulong, DtvEntry> Entries { get; } = new();
+        public nint DtvAllocationBase { get; set; }
+        public ulong DtvAddress { get; set; }
+    }
+
+    private sealed class DtvEntry
+    {
+        public required ulong Address { get; init; }
+        public nint AllocationBase { get; init; }
+    }
+
+    /// <summary>Main executable's initialized PT_TLS bytes.</summary>
+    public static byte[] InitImage
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _modules.TryGetValue(1, out var module)
+                    ? (byte[])module.InitImage.Clone()
+                    : [];
+            }
+        }
+    }
+
+    /// <summary>Aligned size of the main executable's static TLS block.</summary>
+    public static ulong BlockSize
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _modules.TryGetValue(1, out var module)
+                    ? module.StaticOffset
+                    : 0;
+            }
+        }
+    }
+
+    /// <summary>Main executable's PT_TLS alignment.</summary>
+    public static ulong Alignment
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _modules.TryGetValue(1, out var module)
+                    ? module.Alignment
+                    : 1;
+            }
+        }
+    }
+
+    /// <summary>Total Variant II static TLS span required below the TCB.</summary>
+    public static ulong StaticTlsSize
+    {
+        get { lock (_gate) { return _staticTlsSize; } }
+    }
+
+    /// <summary>Largest PT_TLS alignment required by the registered modules.</summary>
+    public static ulong MaximumAlignment
+    {
+        get { lock (_gate) { return _maximumAlignment; } }
+    }
+
+    /// <summary>Current DTV generation, incremented for every registered module.</summary>
+    public static ulong Generation
+    {
+        get { lock (_gate) { return _generation; } }
+    }
+
+    /// <summary>
+    /// Backwards-compatible main-module registration entry point.
+    /// </summary>
+    public static void Set(ReadOnlySpan<byte> initImage, ulong memorySize, ulong alignment)
+    {
+        Reset();
+        RegisterModule(1, initImage, memorySize, alignment, alignmentBias: 0);
+    }
+
+    /// <summary>
+    /// Registers one module's PT_TLS template and allocates its Variant II
+    /// static offset. Modules must be registered in loader module-ID order.
+    /// </summary>
+    public static ulong RegisterModule(
+        ulong moduleId,
+        ReadOnlySpan<byte> initImage,
+        ulong memorySize,
+        ulong alignment,
+        ulong alignmentBias = 0)
+    {
+        if (moduleId == 0)
+        {
+            throw new ArgumentOutOfRangeException(nameof(moduleId));
+        }
+
+        var normalizedAlignment = alignment == 0 ? 1 : alignment;
+        if ((normalizedAlignment & (normalizedAlignment - 1)) != 0)
+        {
+            throw new InvalidDataException($"PT_TLS alignment 0x{alignment:X} is not a power of two.");
+        }
+        if (memorySize > int.MaxValue || (ulong)initImage.Length > memorySize)
+        {
+            throw new InvalidDataException("PT_TLS template size is invalid or exceeds the supported process limit.");
+        }
+
+        lock (_gate)
+        {
+            if (_modules.TryGetValue(moduleId, out var existing))
+            {
+                if (existing.MemorySize != memorySize ||
+                    existing.Alignment != normalizedAlignment ||
+                    existing.AlignmentBias != alignmentBias ||
+                    !existing.InitImage.AsSpan().SequenceEqual(initImage))
+                {
+                    throw new InvalidOperationException($"TLS module {moduleId} was registered with a different template.");
+                }
+
+                return existing.StaticOffset;
+            }
+
+            // FreeBSD/AMD64 Variant II: choose the smallest offset satisfying
+            // offset - previous >= size and (-offset) % align == p_vaddr % align.
+            var staticOffset = CalculateStaticOffset(
+                _staticTlsSize,
+                memorySize,
+                normalizedAlignment,
+                alignmentBias);
+            if (staticOffset > StartupStaticTlsReservation)
+            {
+                throw new InvalidOperationException(
+                    $"Static TLS requires 0x{staticOffset:X} bytes, but startup maps only " +
+                    $"0x{StartupStaticTlsReservation:X} bytes below the thread pointer.");
+            }
+            _modules.Add(moduleId, new ModuleTemplate
+            {
+                ModuleId = moduleId,
+                InitImage = initImage.ToArray(),
+                MemorySize = memorySize,
+                Alignment = normalizedAlignment,
+                AlignmentBias = alignmentBias,
+                StaticOffset = staticOffset,
+            });
+            _staticTlsSize = staticOffset;
+            _maximumAlignment = Math.Max(_maximumAlignment, normalizedAlignment);
+            _generation++;
+            return staticOffset;
+        }
+    }
+
+    /// <summary>Returns the static TP-relative block offset for a module.</summary>
+    public static bool TryGetStaticOffset(ulong moduleId, out ulong staticOffset)
+    {
+        lock (_gate)
+        {
+            if (_modules.TryGetValue(moduleId, out var module))
+            {
+                staticOffset = module.StaticOffset;
+                return true;
+            }
+        }
+
+        staticOffset = 0;
+        return false;
+    }
+
+    /// <summary>Clears all module templates and frees dynamic DTV blocks.</summary>
+    public static void Reset()
+    {
+        lock (_gate)
+        {
+            foreach (var dtv in _threadDtvs.Values)
+            {
+                FreeDynamicEntries(dtv);
+            }
+
+            _threadDtvs.Clear();
+            _modules.Clear();
+            _staticTlsSize = 0;
+            _maximumAlignment = 1;
+            _generation++;
+        }
+    }
+
+    /// <summary>
+    /// Initializes every currently registered startup TLS block for a thread
+    /// and records their addresses in that thread's DTV.
+    /// </summary>
+    public static void SeedThreadBlock(CpuContext context, ulong threadPointer)
+    {
+        ArgumentNullException.ThrowIfNull(context);
+        if (threadPointer == 0)
+        {
+            return;
+        }
+
+        lock (_gate)
+        {
+            if (_threadDtvs.Remove(threadPointer, out var oldDtv))
+            {
+                FreeDynamicEntries(oldDtv);
+            }
+
+            var dtv = new ThreadDtv();
+            _threadDtvs.Add(threadPointer, dtv);
+            foreach (var module in _modules.Values)
+            {
+                dtv.Entries[module.ModuleId] = CreateStaticOrDynamicEntry(context, threadPointer, module);
+            }
+            RebuildGuestDtv(context, threadPointer, dtv);
+        }
+    }
+
+    /// <summary>
+    /// Implements the DTV lookup used by <c>__tls_get_addr</c>. Unknown module
+    /// IDs and offsets outside the module's TLS image are rejected with zero.
+    /// </summary>
+    public static ulong ResolveAddress(CpuContext context, ulong moduleId, ulong offset)
+    {
+        ArgumentNullException.ThrowIfNull(context);
+        if (context.FsBase == 0 || moduleId == 0)
+        {
+            return 0;
+        }
+
+        lock (_gate)
+        {
+            if (!_modules.TryGetValue(moduleId, out var module) || offset >= module.MemorySize)
+            {
+                return 0;
+            }
+
+            if (!_threadDtvs.TryGetValue(context.FsBase, out var dtv))
+            {
+                dtv = new ThreadDtv();
+                _threadDtvs.Add(context.FsBase, dtv);
+                foreach (var startupModule in _modules.Values)
+                {
+                    dtv.Entries[startupModule.ModuleId] = CreateStaticOrDynamicEntry(context, context.FsBase, startupModule);
+                }
+                RebuildGuestDtv(context, context.FsBase, dtv);
+            }
+
+            var entryAdded = false;
+            if (!dtv.Entries.TryGetValue(moduleId, out var entry))
+            {
+                // This module appeared after the thread's startup TLS layout was
+                // seeded. Model rtld's lazy DTV allocation instead of assuming
+                // unused space exists below the already-live thread pointer.
+                entry = CreateDynamicEntry(module);
+                dtv.Entries.Add(moduleId, entry);
+                entryAdded = true;
+            }
+
+            if (entryAdded || dtv.Generation != _generation)
+            {
+                RebuildGuestDtv(context, context.FsBase, dtv);
+            }
+
+            return checked(entry.Address + offset);
+        }
+    }
+
+    private static DtvEntry CreateStaticOrDynamicEntry(
+        CpuContext context,
+        ulong threadPointer,
+        ModuleTemplate module)
+    {
+        if (threadPointer >= module.StaticOffset)
+        {
+            var address = threadPointer - module.StaticOffset;
+            var zeroImage = module.MemorySize == 0 ? [] : new byte[(int)module.MemorySize];
+            if ((zeroImage.Length == 0 || context.Memory.TryWrite(address, zeroImage)) &&
+                (module.InitImage.Length == 0 || context.Memory.TryWrite(address, module.InitImage)))
+            {
+                return new DtvEntry { Address = address };
+            }
+        }
+
+        return CreateDynamicEntry(module);
+    }
+
+    private static DtvEntry CreateDynamicEntry(ModuleTemplate module)
+    {
+        var size = Math.Max(1UL, module.MemorySize);
+        var allocationSize = checked(size + module.Alignment - 1);
+        if (allocationSize > int.MaxValue)
+        {
+            throw new OutOfMemoryException("TLS module allocation exceeds the supported host allocation size.");
+        }
+
+        var allocationBase = Marshal.AllocHGlobal((int)allocationSize);
+        var alignedAddress = AlignUp(unchecked((ulong)allocationBase), module.Alignment);
+        Marshal.Copy(new byte[(int)size], 0, unchecked((nint)alignedAddress), (int)size);
+        if (module.InitImage.Length != 0)
+        {
+            Marshal.Copy(module.InitImage, 0, unchecked((nint)alignedAddress), module.InitImage.Length);
+        }
+
+        return new DtvEntry
+        {
+            Address = alignedAddress,
+            AllocationBase = allocationBase,
+        };
+    }
+
+    private static void FreeDynamicEntries(ThreadDtv dtv)
+    {
+        foreach (var entry in dtv.Entries.Values)
+        {
+            if (entry.AllocationBase != 0)
+            {
+                Marshal.FreeHGlobal(entry.AllocationBase);
+            }
+        }
+        if (dtv.DtvAllocationBase != 0)
+        {
+            Marshal.FreeHGlobal(dtv.DtvAllocationBase);
+            dtv.DtvAllocationBase = 0;
+            dtv.DtvAddress = 0;
+        }
+    }
+
+    private static void RebuildGuestDtv(CpuContext context, ulong threadPointer, ThreadDtv dtv)
+    {
+        var maximumModuleId = _modules.Count == 0 ? 0UL : _modules.Keys.Max();
+        var byteSize = checked(2UL * sizeof(ulong) + maximumModuleId * sizeof(ulong));
+        if (byteSize > int.MaxValue)
+        {
+            throw new OutOfMemoryException("Guest DTV exceeds the supported host allocation size.");
+        }
+
+        var newAllocation = Marshal.AllocHGlobal((int)Math.Max((ulong)sizeof(ulong) * 2, byteSize));
+        var newAddress = unchecked((ulong)newAllocation);
+        Marshal.Copy(new byte[(int)Math.Max((ulong)sizeof(ulong) * 2, byteSize)], 0, newAllocation, (int)Math.Max((ulong)sizeof(ulong) * 2, byteSize));
+        Marshal.WriteInt64(newAllocation, 0, unchecked((long)_generation));
+        Marshal.WriteInt64(newAllocation, sizeof(ulong), unchecked((long)maximumModuleId));
+        foreach (var (moduleId, entry) in dtv.Entries)
+        {
+            var slotOffset = checked((int)(2UL * sizeof(ulong) + (moduleId - 1) * sizeof(ulong)));
+            Marshal.WriteInt64(newAllocation, slotOffset, unchecked((long)entry.Address));
+        }
+
+        if (!context.TryWriteUInt64(threadPointer + sizeof(ulong), newAddress))
+        {
+            Marshal.FreeHGlobal(newAllocation);
+            throw new InvalidOperationException("Failed to install the guest DTV pointer in the thread control block.");
+        }
+
+        if (dtv.DtvAllocationBase != 0)
+        {
+            Marshal.FreeHGlobal(dtv.DtvAllocationBase);
+        }
+        dtv.DtvAllocationBase = newAllocation;
+        dtv.DtvAddress = newAddress;
+        dtv.Generation = _generation;
+    }
+
+    private static ulong AlignUp(ulong value, ulong alignment)
+    {
+        var mask = alignment - 1;
+        return checked((value + mask) & ~mask);
+    }
+
+    private static ulong CalculateStaticOffset(
+        ulong previousOffset,
+        ulong size,
+        ulong alignment,
+        ulong alignmentBias)
+    {
+        var result = checked(previousOffset + size + alignment - 1);
+        return result - ((result + alignmentBias) & (alignment - 1));
+    }
+
+    [Conditional("DEBUG")]
+    private static void RunTlsLayoutSelfChecks()
+    {
+        var firstOffset = RegisterModule(1, [0x11, 0x22], 0x20, 0x10, 0);
+        var secondOffset = RegisterModule(2, [0x7A], 0x18, 0x20, 8);
+        Debug.Assert(firstOffset == 0x20, "First Variant II TLS offset is incorrect.");
+        Debug.Assert(secondOffset >= firstOffset + 0x18, "TLS modules overlap in the static layout.");
+        Debug.Assert((unchecked(0UL - secondOffset) & 0x1F) == 8, "PT_TLS virtual-address congruence was not preserved.");
+
+        var lateEntry = CreateDynamicEntry(_modules[2]);
+        try
+        {
+            Debug.Assert(lateEntry.AllocationBase != 0, "A late TLS module did not receive a dynamic DTV block.");
+            Debug.Assert(Marshal.ReadByte(unchecked((nint)lateEntry.Address)) == 0x7A, "Late-module tdata was not initialized.");
+            Debug.Assert(Marshal.ReadByte(unchecked((nint)lateEntry.Address + 1)) == 0, "Late-module tbss was not zero initialized.");
+        }
+        finally
+        {
+            Marshal.FreeHGlobal(lateEntry.AllocationBase);
+            Reset();
+        }
+    }
+}

src/SharpEmu.HLE/HleDataSymbols.cs

@@ -13,7 +13,9 @@ public static class HleDataSymbols
     private const string LibcNeedFlagNid = "P330P3dFF68";
     private const string LibcInternalNeedFlagNid = "ZT4ODD2Ts9o";
     private const int ProgNameMaxBytes = 511;
-    private const ulong StackChkGuardValue = 0xC0DEC0DECAFEBABEUL;
+    // Terminator canaries reserve the low byte as NUL. Keep the process data
+    // symbol and every per-thread TLS copy byte-for-byte identical.
+    private const ulong StackChkGuardValue = 0xC0DEC0DECAFEBA00UL;
 
     private static readonly object _gate = new();
     private static readonly nint _stackChkGuardAddress = Allocate(sizeof(ulong) * 2);

src/SharpEmu.HLE/Host/HostCapturedRegisters.cs

@@ -0,0 +1,18 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// General-purpose register snapshot of a suspended thread, produced by
+/// <see cref="IHostThreading.TryCaptureThreadRegisters"/>. Registers are named
+/// after the guest ISA (x86-64), which every supported host executes natively.
+/// </summary>
+public readonly record struct HostCapturedRegisters(
+    ulong Rip,
+    ulong Rsp,
+    ulong Rbp,
+    ulong Rax,
+    ulong Rbx,
+    ulong Rcx,
+    ulong Rdx);

src/SharpEmu.HLE/Host/HostGamepadState.cs

@@ -0,0 +1,46 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Host-neutral gamepad button flags. Named after the PlayStation layout the guest API
+/// exposes, but the numeric values are the seam's own — the HLE pad exports translate
+/// them to SCE_PAD_BUTTON bits, so guest ABI values never leak into host backends.
+/// </summary>
+[Flags]
+public enum HostGamepadButtons : uint
+{
+    None = 0,
+    Up = 1 << 0,
+    Down = 1 << 1,
+    Left = 1 << 2,
+    Right = 1 << 3,
+    Cross = 1 << 4,
+    Circle = 1 << 5,
+    Square = 1 << 6,
+    Triangle = 1 << 7,
+    L1 = 1 << 8,
+    R1 = 1 << 9,
+    L2 = 1 << 10,
+    R2 = 1 << 11,
+    L3 = 1 << 12,
+    R3 = 1 << 13,
+    Options = 1 << 14,
+    TouchPad = 1 << 15,
+}
+
+/// <summary>
+/// Snapshot of one host gamepad: sticks are 0..255 with 128 centered and Y growing
+/// downward; triggers 0..255. Unmanaged on purpose so per-frame polls can stackalloc
+/// snapshot buffers.
+/// </summary>
+public readonly record struct HostGamepadState(
+    bool Connected,
+    HostGamepadButtons Buttons,
+    byte LeftX,
+    byte LeftY,
+    byte RightX,
+    byte RightY,
+    byte LeftTrigger,
+    byte RightTrigger);

src/SharpEmu.HLE/Host/HostPageProtection.cs

@@ -0,0 +1,20 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Platform-neutral page protection. Values intentionally enumerate the exact
+/// combinations the emulator uses today so each maps 1:1 onto a single native
+/// protection constant (PAGE_* on Windows, PROT_* elsewhere).
+/// </summary>
+public enum HostPageProtection
+{
+    NoAccess,
+    ReadOnly,
+    ReadWrite,
+    Execute,
+    ReadExecute,
+    ReadWriteExecute,
+    ExecuteWriteCopy,
+}

src/SharpEmu.HLE/Host/HostPlatform.cs

@@ -0,0 +1,42 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+using SharpEmu.HLE.Host.Posix;
+using SharpEmu.HLE.Host.Windows;
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Process-wide access point for the host platform backend. Static HLE export
+/// classes (which cannot receive constructor injection) resolve host primitives
+/// through <see cref="Current"/>; injectable components should instead accept an
+/// <see cref="IHostPlatform"/> and merely default to this.
+/// </summary>
+public static class HostPlatform
+{
+    private static readonly Lazy<IHostPlatform> Instance = new(Create);
+
+    public static IHostPlatform Current => Instance.Value;
+
+    private static IHostPlatform Create()
+    {
+        // The Windows backend executes guest x86-64 natively and emits x86-64
+        // stubs, so a native ARM64 process must be rejected here rather than
+        // crash undefined later (x64 processes under emulation report X64).
+        if (OperatingSystem.IsWindows() && RuntimeInformation.ProcessArchitecture == Architecture.X64)
+        {
+            return new WindowsHostPlatform();
+        }
+
+        if ((OperatingSystem.IsLinux() || OperatingSystem.IsMacOS()) &&
+            RuntimeInformation.ProcessArchitecture == Architecture.X64)
+        {
+            return new PosixHostPlatform();
+        }
+
+        throw new PlatformNotSupportedException(
+            "SharpEmu native guest execution requires an x86-64 process on Windows, Linux, or macOS. " +
+            "On Apple Silicon, use the osx-x64 build under Rosetta 2.");
+    }
+}

src/SharpEmu.HLE/Host/HostRegionInfo.cs

@@ -0,0 +1,20 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Result of <see cref="IHostMemory.Query"/>. The Raw* fields carry the
+/// untranslated OS values so call sites migrated from direct VirtualQuery use
+/// keep comparing (and logging) the exact native words they did before;
+/// <see cref="State"/> and <see cref="Protection"/> are neutral views.
+/// </summary>
+public readonly record struct HostRegionInfo(
+    ulong BaseAddress,
+    ulong AllocationBase,
+    ulong RegionSize,
+    HostRegionState State,
+    uint RawState,
+    HostPageProtection Protection,
+    uint RawProtection,
+    uint RawAllocationProtection);

src/SharpEmu.HLE/Host/HostRegionState.cs

@@ -0,0 +1,11 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+public enum HostRegionState
+{
+    Free,
+    Reserved,
+    Committed,
+}

src/SharpEmu.HLE/Host/HostRuntimeFunction.cs

@@ -0,0 +1,21 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Host functions whose addresses the execution engine bakes into emitted
+/// stubs (spin-waits, worker run loops, TLS reads). Enum-keyed rather than a
+/// free-form name lookup: each platform's emitters need their own specific
+/// functions, and this set is exactly what the current emitters consume.
+/// </summary>
+public enum HostRuntimeFunction
+{
+    TlsGetValue,
+    QueryPerformanceCounter,
+    SwitchToThread,
+    Sleep,
+    WaitForSingleObject,
+    SetEvent,
+    ExitThread,
+}

src/SharpEmu.HLE/Host/IHostAudioOutput.cs

@@ -0,0 +1,23 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Host audio-output device access. The HLE audio exports convert guest submissions to
+/// interleaved stereo 16-bit PCM (the format every backend accepts) and feed them through
+/// streams opened here; everything device-specific — queueing, backpressure, native
+/// buffer lifetime — lives behind <see cref="IHostAudioStream"/>.
+/// </summary>
+public interface IHostAudioOutput
+{
+    /// <summary>Backend identifier for diagnostics (e.g. "winmm").</summary>
+    string BackendName { get; }
+
+    /// <summary>
+    /// Opens an interleaved stereo 16-bit PCM output stream at the given sample rate.
+    /// Throws when the host has no usable output device; callers degrade to a silent
+    /// port and pace the guest instead.
+    /// </summary>
+    IHostAudioStream OpenStereoPcm16Stream(uint sampleRate);
+}

src/SharpEmu.HLE/Host/IHostAudioStream.cs

@@ -0,0 +1,18 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// One open host audio output stream. Submissions are interleaved stereo 16-bit PCM at
+/// the sample rate the stream was opened with.
+/// </summary>
+public interface IHostAudioStream : IDisposable
+{
+    /// <summary>
+    /// Submits one buffer. May block briefly while the device drains its queue (this is
+    /// what paces the guest's audio loop); returns false when the stream cannot accept
+    /// audio, in which case the caller paces the guest itself.
+    /// </summary>
+    bool Submit(ReadOnlySpan<byte> stereoPcm16);
+}

src/SharpEmu.HLE/Host/IHostFaultHandling.cs

@@ -0,0 +1,32 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Installation mechanics for the process-wide fault interception the execution
+/// engine relies on to catch guest faults. Deliberately thin: the managed
+/// handlers keep receiving the platform's raw exception data, and the emitted
+/// pre-filter thunk is an opaque per-platform unit. Implementations live next
+/// to the execution backend (SharpEmu.Core), not behind HostPlatform.Current.
+/// </summary>
+public interface IHostFaultHandling
+{
+    /// <summary>
+    /// Emits the native thunk that wraps a managed fault handler: it pre-filters
+    /// exception codes that must never enter managed code and, when the fault
+    /// happened on a guest stack, switches to the host stack saved in
+    /// <paramref name="hostRspSwitchTlsSlot"/> before the call. Returns 0 on failure.
+    /// </summary>
+    nint CreateHandlerThunk(nint managedCallback, uint hostRspSwitchTlsSlot, nint tlsGetValueAddress);
+
+    void FreeThunk(nint thunk);
+
+    /// <summary>Installs a first-chance handler ahead of existing ones; returns a removal handle (0 on failure).</summary>
+    nint AddFirstChanceHandler(nint thunk);
+
+    void RemoveHandler(nint handle);
+
+    /// <summary>Installs the last-resort filter; pass 0 to clear.</summary>
+    void SetUnhandledFilter(nint thunk);
+}

src/SharpEmu.HLE/Host/IHostInput.cs

@@ -0,0 +1,44 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Host input devices: gamepad state snapshots, force-feedback/lightbar sinks, and the
+/// keyboard-fallback queries. Which physical readers exist (DualSense over raw HID,
+/// XInput, evdev, ...) is a backend detail; merge policy between devices and the
+/// keyboard lives in the HLE pad exports.
+/// </summary>
+public interface IHostInput
+{
+    /// <summary>Starts the background device readers once; safe to call repeatedly.</summary>
+    void EnsureStarted();
+
+    /// <summary>
+    /// Fills <paramref name="destination"/> with snapshots of currently connected
+    /// gamepads and returns how many were written (0 when none are connected).
+    /// </summary>
+    int GetGamepadStates(Span<HostGamepadState> destination);
+
+    /// <summary>Human-readable name of the first connected gamepad, or null.</summary>
+    string? DescribeConnectedGamepad();
+
+    /// <summary>Sets rumble on all connected gamepads; large = strong/left motor.</summary>
+    void SetRumble(byte largeMotor, byte smallMotor);
+
+    /// <summary>
+    /// Approximates per-trigger vibration on gamepads without independent trigger
+    /// actuators; null leaves that trigger's current value unchanged.
+    /// </summary>
+    void SetTriggerRumble(byte? leftTrigger, byte? rightTrigger);
+
+    void SetLightbar(byte red, byte green, byte blue);
+
+    void ResetLightbar();
+
+    /// <summary>True when a window of this process has keyboard focus.</summary>
+    bool IsHostWindowFocused();
+
+    /// <summary>Windows virtual-key code semantics; other backends translate.</summary>
+    bool IsKeyDown(int virtualKey);
+}

src/SharpEmu.HLE/Host/IHostMemory.cs

@@ -0,0 +1,48 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Host page-allocation primitives used by the native execution engine.
+/// Allocate/Reserve/Commit are deliberately separate members (rather than a
+/// flags parameter) so every call site maps 1:1 onto the exact native call it
+/// replaced, keeping the Windows behavior byte-for-byte identical.
+/// </summary>
+public interface IHostMemory
+{
+    /// <summary>
+    /// Reserves and commits pages in one step. <paramref name="desiredAddress"/> of 0
+    /// lets the OS choose the address. Returns the base address, or 0 on failure.
+    /// The OS may satisfy the request at a different address than desired; callers
+    /// that require an exact placement must check the result themselves.
+    /// </summary>
+    ulong Allocate(ulong desiredAddress, ulong size, HostPageProtection protection);
+
+    /// <summary>Reserves address space without committing pages (lazy regions).</summary>
+    ulong Reserve(ulong desiredAddress, ulong size, HostPageProtection protection);
+
+    /// <summary>Commits pages inside a previously reserved range (fault-path lazy commit).</summary>
+    bool Commit(ulong address, ulong size, HostPageProtection protection);
+
+    /// <summary>Releases an entire allocation or reservation by its base address.</summary>
+    bool Free(ulong address);
+
+    /// <summary>
+    /// Changes protection on committed pages. <paramref name="rawOldProtection"/> is the
+    /// untranslated previous OS protection value (see <see cref="HostRegionInfo.RawProtection"/>).
+    /// </summary>
+    bool Protect(ulong address, ulong size, HostPageProtection protection, out uint rawOldProtection);
+
+    /// <summary>
+    /// Restores a raw protection value previously returned by <see cref="Protect"/> or
+    /// <see cref="Query"/> on this same platform. Raw values are opaque to callers and
+    /// must never cross platforms; this exists so save/restore protection sequences
+    /// round-trip OS-specific modifier bits the neutral enum cannot represent.
+    /// </summary>
+    bool ProtectRaw(ulong address, ulong size, uint rawProtection, out uint rawOldProtection);
+
+    bool Query(ulong address, out HostRegionInfo info);
+
+    void FlushInstructionCache(ulong address, ulong size);
+}

src/SharpEmu.HLE/Host/IHostPlatform.cs

@@ -0,0 +1,23 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Aggregates the host-OS primitives the native execution engine depends on.
+/// Each supported platform provides one implementation; consumers reach the
+/// process-wide instance through <see cref="HostPlatform.Current"/> or accept
+/// one by injection.
+/// </summary>
+public interface IHostPlatform
+{
+    IHostMemory Memory { get; }
+
+    IHostThreading Threading { get; }
+
+    IHostSymbolResolver Symbols { get; }
+
+    IHostAudioOutput Audio { get; }
+
+    IHostInput Input { get; }
+}

src/SharpEmu.HLE/Host/IHostSymbolResolver.cs

@@ -0,0 +1,10 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+public interface IHostSymbolResolver
+{
+    /// <summary>Returns the native address of the function, or 0 if unavailable.</summary>
+    nint GetAddress(HostRuntimeFunction function);
+}

src/SharpEmu.HLE/Host/IHostThreading.cs

@@ -0,0 +1,51 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host;
+
+/// <summary>
+/// Raw host thread and native-TLS primitives for the execution engine. Guest
+/// code must run on threads the CLR did not create (no managed frames below
+/// guest frames), so thread creation takes a native entry point and is not
+/// expressible with managed threads.
+/// </summary>
+public interface IHostThreading
+{
+    /// <summary>Allocates a native TLS slot; returns <see cref="uint.MaxValue"/> on failure.</summary>
+    uint AllocateTlsSlot();
+
+    bool FreeTlsSlot(uint slot);
+
+    bool SetTlsValue(uint slot, nint value);
+
+    nint GetTlsValue(uint slot);
+
+    uint CurrentThreadId { get; }
+
+    bool TrySetCurrentThreadAffinity(nuint affinityMask);
+
+    /// <summary>
+    /// Asks the OS for ~1 ms timed-wait granularity for the life of the process
+    /// (idempotent; best-effort). No-op on platforms whose default is already fine.
+    /// </summary>
+    void RequestTimerResolution();
+
+    /// <summary>
+    /// Creates a raw OS thread executing native code at <paramref name="entry"/> with
+    /// <paramref name="stackReserveBytes"/> of reserved (not committed) stack.
+    /// Returns the thread handle, or 0 on failure.
+    /// </summary>
+    nint CreateNativeThread(nint entry, nint parameter, nuint stackReserveBytes, out uint threadId);
+
+    /// <summary>Waits for the thread to exit; true when it did within the timeout.</summary>
+    bool WaitForThreadExit(nint threadHandle, uint timeoutMilliseconds);
+
+    void CloseThreadHandle(nint threadHandle);
+
+    /// <summary>
+    /// Suspends the thread, snapshots its general-purpose registers, and resumes it —
+    /// one indivisible operation (diagnostics only). The caller must not pass the
+    /// current thread. Returns false if the thread cannot be opened or suspended.
+    /// </summary>
+    bool TryCaptureThreadRegisters(uint threadId, out HostCapturedRegisters registers);
+}

src/SharpEmu.HLE/Host/Posix/PosixAlsaAudioStream.cs

@@ -0,0 +1,173 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Posix;
+
+/// <summary>
+/// ALSA-based playback for Linux. The PCM device is opened in blocking mode
+/// with a device buffer sized to match the 32KB queue the other backends
+/// keep, so snd_pcm_writei itself provides the backpressure pacing. The
+/// "default" device routes through PulseAudio/PipeWire on desktops and to
+/// the hardware on bare ALSA setups; SHARPEMU_ALSA_DEVICE overrides it.
+/// </summary>
+internal sealed unsafe class PosixAlsaAudioStream : IHostAudioStream
+{
+    // 32KB of stereo PCM16 at 48kHz is ~170ms; keep the same device-side
+    // queue depth the WinMM/CoreAudio ports enforce in managed code.
+    private const uint DeviceLatencyMicroseconds = 170_000;
+    private const int StreamPlayback = 0;
+    private const int FormatS16LittleEndian = 2;
+    private const int AccessReadWriteInterleaved = 3;
+    private const int ErrorPipe = -32; // -EPIPE, underrun
+    private const int ErrorStreamPipe = -86; // -ESTRPIPE, suspended
+
+    private readonly object _gate = new();
+    private nint _pcm;
+    private bool _disposed;
+
+    public PosixAlsaAudioStream(uint sampleRate)
+    {
+        if (!OperatingSystem.IsLinux())
+        {
+            throw new PlatformNotSupportedException("ALSA audio is only available on Linux.");
+        }
+
+        var device = Environment.GetEnvironmentVariable("SHARPEMU_ALSA_DEVICE");
+        if (string.IsNullOrWhiteSpace(device))
+        {
+            device = "default";
+        }
+
+        var status = snd_pcm_open(out _pcm, device, StreamPlayback, 0);
+        if (status != 0)
+        {
+            throw new InvalidOperationException(
+                $"snd_pcm_open(\"{device}\") failed: {DescribeError(status)}.");
+        }
+
+        status = snd_pcm_set_params(
+            _pcm,
+            FormatS16LittleEndian,
+            AccessReadWriteInterleaved,
+            2,
+            sampleRate,
+            1,
+            DeviceLatencyMicroseconds);
+        if (status != 0)
+        {
+            _ = snd_pcm_close(_pcm);
+            _pcm = 0;
+            throw new InvalidOperationException(
+                $"snd_pcm_set_params({sampleRate} Hz) failed: {DescribeError(status)}.");
+        }
+    }
+
+    public bool Submit(ReadOnlySpan<byte> stereoPcm16)
+    {
+        lock (_gate)
+        {
+            if (_disposed)
+            {
+                return false;
+            }
+
+            return WritePcm(stereoPcm16, (uint)(stereoPcm16.Length / 4));
+        }
+    }
+
+    public void Dispose()
+    {
+        lock (_gate)
+        {
+            if (_disposed)
+            {
+                return;
+            }
+
+            _disposed = true;
+            if (_pcm != 0)
+            {
+                _ = snd_pcm_drop(_pcm);
+                _ = snd_pcm_close(_pcm);
+                _pcm = 0;
+            }
+        }
+    }
+
+    private bool WritePcm(ReadOnlySpan<byte> pcm, uint frames)
+    {
+        var recovered = false;
+        fixed (byte* data = pcm)
+        {
+            var offset = 0L;
+            while (offset < frames)
+            {
+                var written = snd_pcm_writei(
+                    _pcm,
+                    data + (offset * 4),
+                    (nuint)(frames - offset));
+                if (written >= 0)
+                {
+                    offset += written;
+                    continue;
+                }
+
+                // One recovery attempt per submit covers underruns (-EPIPE)
+                // and suspend/resume (-ESTRPIPE); anything else, or a second
+                // failure, drops the buffer rather than stalling the guest.
+                if (recovered ||
+                    (written != ErrorPipe && written != ErrorStreamPipe) ||
+                    snd_pcm_recover(_pcm, (int)written, 1) != 0)
+                {
+                    return false;
+                }
+
+                recovered = true;
+            }
+        }
+
+        return true;
+    }
+
+    private static string DescribeError(long status)
+    {
+        var message = Marshal.PtrToStringUTF8(snd_strerror((int)status));
+        return $"{message ?? "unknown error"} ({status})";
+    }
+
+    private const string Alsa = "libasound.so.2";
+
+    [DllImport(Alsa)]
+    private static extern int snd_pcm_open(
+        out nint pcm,
+        [MarshalAs(UnmanagedType.LPUTF8Str)] string name,
+        int stream,
+        int mode);
+
+    [DllImport(Alsa)]
+    private static extern int snd_pcm_set_params(
+        nint pcm,
+        int format,
+        int access,
+        uint channels,
+        uint rate,
+        int softResample,
+        uint latencyUs);
+
+    [DllImport(Alsa)]
+    private static extern long snd_pcm_writei(nint pcm, byte* buffer, nuint frames);
+
+    [DllImport(Alsa)]
+    private static extern int snd_pcm_recover(nint pcm, int error, int silent);
+
+    [DllImport(Alsa)]
+    private static extern int snd_pcm_drop(nint pcm);
+
+    [DllImport(Alsa)]
+    private static extern int snd_pcm_close(nint pcm);
+
+    [DllImport(Alsa)]
+    private static extern nint snd_strerror(int error);
+}

src/SharpEmu.HLE/Host/Posix/PosixCoreAudioStream.cs

@@ -0,0 +1,261 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Posix;
+
+/// <summary>
+/// AudioQueue-based playback for macOS. Buffers are enqueued as stereo PCM16
+/// and returned by the queue's internal thread through the output callback;
+/// Submit applies the same 32KB backpressure the WinMM backend uses so guest
+/// pacing works identically.
+/// </summary>
+internal sealed unsafe class PosixCoreAudioStream : IHostAudioStream
+{
+    private const int MaximumQueuedPcmBytes = 32 * 1024;
+    private const uint FormatLinearPcm = 0x6C70636D; // 'lpcm'
+    private const uint FlagIsSignedInteger = 0x4;
+    private const uint FlagIsPacked = 0x8;
+
+    private readonly object _gate = new();
+    private readonly AutoResetEvent _completion = new(false);
+    private readonly Queue<nint> _freeBuffers = new();
+    private GCHandle _selfHandle;
+    private nint _queue;
+    private int _queuedPcmBytes;
+    private bool _started;
+    private bool _disposed;
+
+    public PosixCoreAudioStream(uint sampleRate)
+    {
+        if (!OperatingSystem.IsMacOS())
+        {
+            throw new PlatformNotSupportedException("CoreAudio is only available on macOS.");
+        }
+
+        var format = new AudioStreamBasicDescription
+        {
+            SampleRate = sampleRate,
+            FormatId = FormatLinearPcm,
+            FormatFlags = FlagIsSignedInteger | FlagIsPacked,
+            BytesPerPacket = 4,
+            FramesPerPacket = 1,
+            BytesPerFrame = 4,
+            ChannelsPerFrame = 2,
+            BitsPerChannel = 16,
+        };
+
+        _selfHandle = GCHandle.Alloc(this);
+        var status = AudioQueueNewOutput(
+            &format,
+            &OutputCallback,
+            GCHandle.ToIntPtr(_selfHandle),
+            0,
+            0,
+            0,
+            out _queue);
+        if (status != 0)
+        {
+            _selfHandle.Free();
+            throw new InvalidOperationException($"AudioQueueNewOutput failed with OSStatus {status}.");
+        }
+    }
+
+    public bool Submit(ReadOnlySpan<byte> stereoPcm16)
+    {
+        lock (_gate)
+        {
+            if (_disposed || _queue == 0)
+            {
+                return false;
+            }
+
+            var outputLength = stereoPcm16.Length;
+            while (_queuedPcmBytes != 0 &&
+                   _queuedPcmBytes + outputLength > MaximumQueuedPcmBytes)
+            {
+                Monitor.Exit(_gate);
+                try
+                {
+                    // Dispose can free the event while this thread waits
+                    // outside the gate; treat that like a timed-out wait.
+                    if (!_completion.WaitOne(TimeSpan.FromSeconds(1)))
+                    {
+                        return false;
+                    }
+                }
+                catch (ObjectDisposedException)
+                {
+                    return false;
+                }
+                finally
+                {
+                    Monitor.Enter(_gate);
+                }
+
+                if (_disposed)
+                {
+                    return false;
+                }
+            }
+
+            if (!TryTakeBuffer(outputLength, out var buffer))
+            {
+                return false;
+            }
+
+            var audioData = ((AudioQueueBuffer*)buffer)->AudioData;
+            stereoPcm16.CopyTo(new Span<byte>(audioData, outputLength));
+
+            ((AudioQueueBuffer*)buffer)->AudioDataByteSize = (uint)outputLength;
+            if (AudioQueueEnqueueBuffer(_queue, buffer, 0, 0) != 0)
+            {
+                _freeBuffers.Enqueue(buffer);
+                return false;
+            }
+
+            _queuedPcmBytes += outputLength;
+            if (!_started)
+            {
+                if (AudioQueueStart(_queue, 0) != 0)
+                {
+                    // A queue that never starts never drains, so later
+                    // submits would block on backpressure until their
+                    // timeout. Tear the queue down and fail fast instead.
+                    _ = AudioQueueDispose(_queue, true);
+                    _queue = 0;
+                    _queuedPcmBytes = 0;
+                    _freeBuffers.Clear();
+                    return false;
+                }
+
+                _started = true;
+            }
+
+            return true;
+        }
+    }
+
+    public void Dispose()
+    {
+        lock (_gate)
+        {
+            if (_disposed)
+            {
+                return;
+            }
+
+            _disposed = true;
+            if (_queue != 0)
+            {
+                // Synchronous dispose stops the queue, frees its buffers, and
+                // guarantees no further callbacks reference this instance.
+                _ = AudioQueueDispose(_queue, true);
+                _queue = 0;
+            }
+
+            _freeBuffers.Clear();
+            // Wake any submitter waiting on backpressure before the event
+            // goes away; a late waiter observes ObjectDisposedException and
+            // bails out in Submit.
+            _completion.Set();
+            _completion.Dispose();
+            if (_selfHandle.IsAllocated)
+            {
+                _selfHandle.Free();
+            }
+        }
+    }
+
+    private bool TryTakeBuffer(int length, out nint buffer)
+    {
+        while (_freeBuffers.TryDequeue(out buffer))
+        {
+            if (((AudioQueueBuffer*)buffer)->AudioDataBytesCapacity >= (uint)length)
+            {
+                return true;
+            }
+
+            _ = AudioQueueFreeBuffer(_queue, buffer);
+        }
+
+        return AudioQueueAllocateBuffer(_queue, (uint)length, out buffer) == 0;
+    }
+
+    [UnmanagedCallersOnly]
+    private static void OutputCallback(nint userData, nint queue, nint buffer)
+    {
+        if (GCHandle.FromIntPtr(userData).Target is not PosixCoreAudioStream port)
+        {
+            return;
+        }
+
+        lock (port._gate)
+        {
+            if (port._disposed)
+            {
+                return;
+            }
+
+            port._queuedPcmBytes -= checked((int)((AudioQueueBuffer*)buffer)->AudioDataByteSize);
+            port._freeBuffers.Enqueue(buffer);
+        }
+
+        port._completion.Set();
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct AudioStreamBasicDescription
+    {
+        public double SampleRate;
+        public uint FormatId;
+        public uint FormatFlags;
+        public uint BytesPerPacket;
+        public uint FramesPerPacket;
+        public uint BytesPerFrame;
+        public uint ChannelsPerFrame;
+        public uint BitsPerChannel;
+        public uint Reserved;
+    }
+
+    [StructLayout(LayoutKind.Sequential)]
+    private struct AudioQueueBuffer
+    {
+        public uint AudioDataBytesCapacity;
+        public void* AudioData;
+        public uint AudioDataByteSize;
+        public nint UserData;
+        public uint PacketDescriptionCapacity;
+        public nint PacketDescriptions;
+        public uint PacketDescriptionCount;
+    }
+
+    private const string AudioToolbox =
+        "/System/Library/Frameworks/AudioToolbox.framework/AudioToolbox";
+
+    [DllImport(AudioToolbox)]
+    private static extern int AudioQueueNewOutput(
+        AudioStreamBasicDescription* format,
+        delegate* unmanaged<nint, nint, nint, void> callback,
+        nint userData,
+        nint callbackRunLoop,
+        nint runLoopMode,
+        uint flags,
+        out nint queue);
+
+    [DllImport(AudioToolbox)]
+    private static extern int AudioQueueAllocateBuffer(nint queue, uint bufferByteSize, out nint buffer);
+
+    [DllImport(AudioToolbox)]
+    private static extern int AudioQueueFreeBuffer(nint queue, nint buffer);
+
+    [DllImport(AudioToolbox)]
+    private static extern int AudioQueueEnqueueBuffer(nint queue, nint buffer, uint packetDescriptionCount, nint packetDescriptions);
+
+    [DllImport(AudioToolbox)]
+    private static extern int AudioQueueStart(nint queue, nint startTime);
+
+    [DllImport(AudioToolbox)]
+    private static extern int AudioQueueDispose(nint queue, [MarshalAs(UnmanagedType.I1)] bool immediate);
+}

src/SharpEmu.HLE/Host/Posix/PosixHostAudio.cs

@@ -0,0 +1,21 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host.Posix;
+
+/// <summary>
+/// POSIX audio output: CoreAudio (AudioQueue) on macOS, ALSA on Linux. Both
+/// streams accept the seam's interleaved stereo PCM16 and pace the guest via
+/// device-queue backpressure.
+/// </summary>
+internal sealed class PosixHostAudio : IHostAudioOutput
+{
+    public string BackendName => OperatingSystem.IsMacOS() ? "coreaudio" : "alsa";
+
+    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate)
+    {
+        return OperatingSystem.IsMacOS()
+            ? new PosixCoreAudioStream(sampleRate)
+            : new PosixAlsaAudioStream(sampleRate);
+    }
+}

src/SharpEmu.HLE/Host/Posix/PosixHostInput.cs

@@ -0,0 +1,79 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host.Posix;
+
+/// <summary>
+/// Bridges a window-provided input source into the host input seam. POSIX
+/// hosts have no user32/XInput/raw-HID readers; keyboard and gamepad state
+/// come from the presenter's GLFW window instead, which registers itself via
+/// <see cref="SetSource"/> once the window exists. Until then (and with no
+/// window at all, e.g. headless runs) every query reports neutral input.
+/// Rumble and lightbar are unsupported by the GLFW input layer and no-op.
+/// </summary>
+public interface IPosixWindowInputSource
+{
+    /// <summary>True while the window's keyboard is delivering events.</summary>
+    bool HasKeyboardFocus { get; }
+
+    /// <summary>Windows virtual-key semantics; the source translates.</summary>
+    bool IsKeyDown(int virtualKey);
+
+    /// <summary>Same contract as <see cref="IHostInput.GetGamepadStates"/>.</summary>
+    int GetGamepadStates(Span<HostGamepadState> destination);
+
+    string? DescribeConnectedGamepad();
+}
+
+// Public so the presenter's window layer (SharpEmu.Libs) can register its
+// input source; the platform still constructs the singleton itself.
+public sealed class PosixHostInput : IHostInput
+{
+    private static volatile IPosixWindowInputSource? _source;
+
+    /// <summary>Called by the presenter's window layer when input is ready.</summary>
+    public static void SetSource(IPosixWindowInputSource source)
+    {
+        _source = source;
+    }
+
+    public void EnsureStarted()
+    {
+        // Device readers are event-driven off the window thread; nothing to start.
+    }
+
+    public int GetGamepadStates(Span<HostGamepadState> destination)
+    {
+        return _source?.GetGamepadStates(destination) ?? 0;
+    }
+
+    public string? DescribeConnectedGamepad() => _source?.DescribeConnectedGamepad();
+
+    public void SetRumble(byte largeMotor, byte smallMotor)
+    {
+    }
+
+    public void SetTriggerRumble(byte? leftTrigger, byte? rightTrigger)
+    {
+    }
+
+    public void SetLightbar(byte red, byte green, byte blue)
+    {
+    }
+
+    public void ResetLightbar()
+    {
+    }
+
+    public bool IsHostWindowFocused()
+    {
+        // GLFW only delivers key events to the focused window, so a
+        // delivering keyboard implies focus.
+        return _source?.HasKeyboardFocus ?? false;
+    }
+
+    public bool IsKeyDown(int virtualKey)
+    {
+        return _source?.IsKeyDown(virtualKey) ?? false;
+    }
+}

src/SharpEmu.HLE/Host/Posix/PosixHostMemory.cs

@@ -0,0 +1,528 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Posix;
+
+/// <summary>
+/// POSIX virtual memory backend implemented over mmap/mprotect/munmap with a
+/// shadow region table that answers VirtualQuery-style questions and tracks
+/// page protections.
+/// POSIX anonymous mappings are demand-paged by the kernel, so Win32
+/// "reserve-only" regions are mapped as committed memory directly and
+/// commit requests become protection changes.
+/// </summary>
+internal sealed unsafe class PosixHostMemory : IHostMemory
+{
+    private const uint MEM_COMMIT = 0x1000;
+    private const uint MEM_RESERVE = 0x2000;
+    private const uint MEM_RELEASE = 0x8000;
+    private const uint MEM_FREE_STATE = 0x10000;
+    private const uint MEM_PRIVATE = 0x20000;
+
+    private const uint PAGE_NOACCESS = 0x01;
+    private const uint PAGE_READONLY = 0x02;
+    private const uint PAGE_READWRITE = 0x04;
+    private const uint PAGE_EXECUTE = 0x10;
+    private const uint PAGE_EXECUTE_READ = 0x20;
+    private const uint PAGE_EXECUTE_READWRITE = 0x40;
+
+    private const ulong PageSize = 0x1000;
+
+    private struct BasicInfo
+    {
+        public ulong BaseAddress;
+        public ulong AllocationBase;
+        public uint AllocationProtect;
+        public ulong RegionSize;
+        public uint State;
+        public uint Protect;
+        public uint Type;
+    }
+
+    public ulong Allocate(ulong desiredAddress, ulong size, HostPageProtection protection)
+    {
+        return (ulong)Posix.Alloc(
+            (void*)desiredAddress,
+            (nuint)size,
+            MEM_COMMIT | MEM_RESERVE,
+            ToNativeProtection(protection));
+    }
+
+    public ulong Reserve(ulong desiredAddress, ulong size, HostPageProtection protection)
+    {
+        return (ulong)Posix.Alloc(
+            (void*)desiredAddress,
+            (nuint)size,
+            MEM_RESERVE,
+            ToNativeProtection(protection));
+    }
+
+    public bool Commit(ulong address, ulong size, HostPageProtection protection)
+    {
+        return Posix.Alloc(
+            (void*)address,
+            (nuint)size,
+            MEM_COMMIT,
+            ToNativeProtection(protection)) != null;
+    }
+
+    public bool Free(ulong address)
+    {
+        return Posix.Free((void*)address, 0, MEM_RELEASE);
+    }
+
+    public bool Protect(
+        ulong address,
+        ulong size,
+        HostPageProtection protection,
+        out uint rawOldProtection)
+    {
+        return Posix.Protect(
+            (void*)address,
+            (nuint)size,
+            ToNativeProtection(protection),
+            out rawOldProtection);
+    }
+
+    public bool ProtectRaw(
+        ulong address,
+        ulong size,
+        uint rawProtection,
+        out uint rawOldProtection)
+    {
+        return Posix.Protect(
+            (void*)address,
+            (nuint)size,
+            rawProtection,
+            out rawOldProtection);
+    }
+
+    public bool Query(ulong address, out HostRegionInfo info)
+    {
+        if (Posix.Query((void*)address, out var nativeInfo) == 0)
+        {
+            info = default;
+            return false;
+        }
+
+        info = new HostRegionInfo(
+            nativeInfo.BaseAddress,
+            nativeInfo.AllocationBase,
+            nativeInfo.RegionSize,
+            nativeInfo.State switch
+            {
+                MEM_COMMIT => HostRegionState.Committed,
+                MEM_RESERVE => HostRegionState.Reserved,
+                _ => HostRegionState.Free,
+            },
+            nativeInfo.State,
+            ToHostProtection(nativeInfo.Protect),
+            nativeInfo.Protect,
+            nativeInfo.AllocationProtect);
+        return true;
+    }
+
+    public void FlushInstructionCache(ulong address, ulong size)
+    {
+        _ = address;
+        _ = size;
+        // The supported POSIX process is x86-64 (including Rosetta 2), whose
+        // instruction cache is coherent. A future arm64 backend must call the
+        // platform instruction-cache invalidation API here.
+    }
+
+    private static uint ToNativeProtection(HostPageProtection protection) => protection switch
+    {
+        HostPageProtection.NoAccess => PAGE_NOACCESS,
+        HostPageProtection.ReadOnly => PAGE_READONLY,
+        HostPageProtection.ReadWrite => PAGE_READWRITE,
+        HostPageProtection.Execute => PAGE_EXECUTE,
+        HostPageProtection.ReadExecute => PAGE_EXECUTE_READ,
+        HostPageProtection.ReadWriteExecute => PAGE_EXECUTE_READWRITE,
+        HostPageProtection.ExecuteWriteCopy => PAGE_EXECUTE_READWRITE,
+        _ => throw new ArgumentOutOfRangeException(nameof(protection), protection, null),
+    };
+
+    private static HostPageProtection ToHostProtection(uint protection) => protection switch
+    {
+        PAGE_READONLY => HostPageProtection.ReadOnly,
+        PAGE_READWRITE => HostPageProtection.ReadWrite,
+        PAGE_EXECUTE => HostPageProtection.Execute,
+        PAGE_EXECUTE_READ => HostPageProtection.ReadExecute,
+        PAGE_EXECUTE_READWRITE => HostPageProtection.ReadWriteExecute,
+        _ => HostPageProtection.NoAccess,
+    };
+
+    private static class Posix
+    {
+        private const int PROT_NONE = 0x0;
+        private const int PROT_READ = 0x1;
+        private const int PROT_WRITE = 0x2;
+        private const int PROT_EXEC = 0x4;
+
+        private const int MAP_PRIVATE = 0x02;
+        private const int MAP_FIXED = 0x10;
+        private static readonly int MAP_ANON = OperatingSystem.IsMacOS() ? 0x1000 : 0x20;
+        private static readonly int MAP_NORESERVE = OperatingSystem.IsMacOS() ? 0 : 0x4000;
+
+        // Linux-only: fail instead of clobbering an existing mapping.
+        private const int MAP_FIXED_NOREPLACE = 0x100000;
+
+        private static readonly nint MAP_FAILED = -1;
+
+        private static readonly object Gate = new();
+        private static readonly SortedList<ulong, Region> Regions = new();
+
+        private sealed class Region
+        {
+            public ulong Base;
+            public ulong Size;
+            public uint DefaultProtect;
+            public Dictionary<ulong, uint>? PageProtects;
+
+            public ulong End => Base + Size;
+
+            public uint ProtectAt(ulong pageAddress)
+            {
+                if (PageProtects is not null && PageProtects.TryGetValue(pageAddress, out var overriden))
+                {
+                    return overriden;
+                }
+
+                return DefaultProtect;
+            }
+        }
+
+        public static void* Alloc(void* address, nuint size, uint allocationType, uint protect)
+        {
+            if (size == 0)
+            {
+                return null;
+            }
+
+            var alignedSize = AlignUp((ulong)size, PageSize);
+
+            lock (Gate)
+            {
+                if (allocationType == MEM_COMMIT && address != null &&
+                    TryFindRegionLocked((ulong)address, out var existing))
+                {
+                    // Note: MEM_RESERVE requests that overlap an existing
+                    // region must fail like Win32 does; only a pure commit
+                    // may target pages inside a tracked mapping.
+                    // Commit inside an existing mapping: the pages are already
+                    // backed (demand paged), so only apply the protection.
+                    var start = AlignDown((ulong)address, PageSize);
+                    var end = AlignUp((ulong)address + alignedSize, PageSize);
+                    if (end <= start || end > existing.End)
+                    {
+                        // Win32 fails a commit that runs past its reservation
+                        // instead of committing a prefix; committing partially
+                        // here would let callers believe the whole range is
+                        // usable.
+                        return null;
+                    }
+
+                    if (mprotect((nint)start, (nuint)(end - start), ToPosixProtect(protect)) != 0)
+                    {
+                        return null;
+                    }
+
+                    SetProtectRangeLocked(existing, start, end - start, protect);
+                    return address;
+                }
+
+                if ((allocationType & MEM_RESERVE) == 0)
+                {
+                    // MEM_COMMIT alone outside any known region is invalid here.
+                    return null;
+                }
+
+                var posixProtect = ToPosixProtect(protect);
+                var flags = MAP_PRIVATE | MAP_ANON;
+                if ((allocationType & MEM_COMMIT) == 0)
+                {
+                    // Reserve-only: keep the requested protection so the region
+                    // is usable without a separate commit step, but tell the
+                    // kernel not to account swap for it where supported.
+                    flags |= MAP_NORESERVE;
+                }
+
+                nint result;
+                if (address != null)
+                {
+                    // Win32 maps at exactly the requested address or fails
+                    // without touching existing mappings. Fail up front on
+                    // any overlap we track, then place the mapping: Linux
+                    // gets MAP_FIXED_NOREPLACE (fails cleanly on host
+                    // mappings too). Darwin lacks NOREPLACE and plain
+                    // MAP_FIXED would silently clobber untracked host
+                    // memory (dyld, the runtime's JIT heap, Rosetta), so
+                    // pass the address as a hint instead -- the kernel
+                    // honors it when the range is free and relocates the
+                    // mapping otherwise, which we treat as failure.
+                    if (OverlapsTrackedRegionLocked((ulong)address, alignedSize))
+                    {
+                        Trace($"exact overlap: addr=0x{(ulong)address:X16} size=0x{alignedSize:X}");
+                        return null;
+                    }
+
+                    var exactFlags = OperatingSystem.IsMacOS() ? flags : flags | MAP_FIXED_NOREPLACE;
+                    result = mmap((nint)address, (nuint)alignedSize, posixProtect, exactFlags, -1, 0);
+                    if (result != MAP_FAILED && (ulong)result != (ulong)address)
+                    {
+                        munmap(result, (nuint)alignedSize);
+                        result = MAP_FAILED;
+                    }
+
+                    if (result == MAP_FAILED && OperatingSystem.IsMacOS())
+                    {
+                        // The hint-only attempt above didn't land at the requested
+                        // address. This is routinely the case for the PS5's fixed
+                        // 32 GiB image base under Rosetta 2 on Apple Silicon, where
+                        // the kernel never honors that hint. Retry with true
+                        // MAP_FIXED: this can clobber an untracked host mapping
+                        // (dyld, the runtime's JIT heap, Rosetta) if one already
+                        // sits exactly there, but without it guest images that
+                        // require this base never load at all on macOS.
+                        Trace($"exact mmap hint failed, retrying with MAP_FIXED: addr=0x{(ulong)address:X16}");
+                        result = mmap((nint)address, (nuint)alignedSize, posixProtect, flags | MAP_FIXED, -1, 0);
+                    }
+
+                    if (result == MAP_FAILED || (ulong)result != (ulong)address)
+                    {
+                        Trace($"exact mmap failed: addr=0x{(ulong)address:X16} got=0x{(ulong)result:X16} size=0x{alignedSize:X} errno={Marshal.GetLastPInvokeError()}");
+                        if (result != MAP_FAILED)
+                        {
+                            munmap(result, (nuint)alignedSize);
+                        }
+
+                        return null;
+                    }
+                }
+                else
+                {
+                    result = mmap(0, (nuint)alignedSize, posixProtect, flags, -1, 0);
+                    if (result == MAP_FAILED)
+                    {
+                        Trace($"mmap failed: size=0x{alignedSize:X} errno={Marshal.GetLastPInvokeError()}");
+                        return null;
+                    }
+                }
+
+                Regions[(ulong)result] = new Region
+                {
+                    Base = (ulong)result,
+                    Size = alignedSize,
+                    DefaultProtect = protect
+                };
+
+                return (void*)result;
+            }
+        }
+
+        public static bool Free(void* address, nuint size, uint freeType)
+        {
+            _ = size;
+            _ = freeType;
+
+            lock (Gate)
+            {
+                if (!Regions.TryGetValue((ulong)address, out var region))
+                {
+                    return false;
+                }
+
+                Regions.Remove((ulong)address);
+                return munmap((nint)address, (nuint)region.Size) == 0;
+            }
+        }
+
+        public static bool Protect(void* address, nuint size, uint newProtect, out uint oldProtect)
+        {
+            oldProtect = PAGE_NOACCESS;
+            if (size == 0)
+            {
+                return false;
+            }
+
+            var start = AlignDown((ulong)address, PageSize);
+            var end = AlignUp((ulong)address + size, PageSize);
+
+            lock (Gate)
+            {
+                if (!TryFindRegionLocked(start, out var region) || end > region.End)
+                {
+                    return false;
+                }
+
+                oldProtect = region.ProtectAt(start);
+                if (mprotect((nint)start, (nuint)(end - start), ToPosixProtect(newProtect)) != 0)
+                {
+                    return false;
+                }
+
+                SetProtectRangeLocked(region, start, end - start, newProtect);
+                return true;
+            }
+        }
+
+        public static nuint Query(void* address, out BasicInfo info)
+        {
+            info = default;
+            var pageAddress = AlignDown((ulong)address, PageSize);
+
+            lock (Gate)
+            {
+                if (TryFindRegionLocked(pageAddress, out var region))
+                {
+                    // Win32 VirtualQuery reports a run of pages sharing the
+                    // same protection, so stop the run where it changes.
+                    var protect = region.ProtectAt(pageAddress);
+                    var runEnd = pageAddress + PageSize;
+                    while (runEnd < region.End && region.ProtectAt(runEnd) == protect)
+                    {
+                        runEnd += PageSize;
+                    }
+
+                    info.BaseAddress = pageAddress;
+                    info.AllocationBase = region.Base;
+                    info.AllocationProtect = region.DefaultProtect;
+                    info.RegionSize = runEnd - pageAddress;
+                    info.State = MEM_COMMIT;
+                    info.Protect = protect;
+                    info.Type = MEM_PRIVATE;
+                    return (nuint)sizeof(BasicInfo);
+                }
+
+                // Untracked host memory (runtime heaps, stacks, libraries) is
+                // reported as a free block reaching to the next tracked region
+                // so scanning callers keep advancing.
+                var nextBase = ulong.MaxValue;
+                foreach (var regionBase in Regions.Keys)
+                {
+                    if (regionBase > pageAddress)
+                    {
+                        nextBase = regionBase;
+                        break;
+                    }
+                }
+
+                info.BaseAddress = pageAddress;
+                info.AllocationBase = 0;
+                info.AllocationProtect = PAGE_NOACCESS;
+                info.RegionSize = (nextBase == ulong.MaxValue ? pageAddress + PageSize : nextBase) - pageAddress;
+                info.State = MEM_FREE_STATE;
+                info.Protect = PAGE_NOACCESS;
+                info.Type = 0;
+                return (nuint)sizeof(BasicInfo);
+            }
+        }
+
+        private static bool OverlapsTrackedRegionLocked(ulong start, ulong size)
+        {
+            var end = start + size;
+            foreach (var region in Regions.Values)
+            {
+                if (region.Base < end && start < region.End)
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
+        private static bool TryFindRegionLocked(ulong address, out Region region)
+        {
+            region = null!;
+            var keys = Regions.Keys;
+            var low = 0;
+            var high = keys.Count - 1;
+            Region? candidate = null;
+            while (low <= high)
+            {
+                var middle = low + ((high - low) >> 1);
+                var entry = Regions.Values[middle];
+                if (entry.Base <= address)
+                {
+                    candidate = entry;
+                    low = middle + 1;
+                }
+                else
+                {
+                    high = middle - 1;
+                }
+            }
+
+            if (candidate is null || address >= candidate.End)
+            {
+                return false;
+            }
+
+            region = candidate;
+            return true;
+        }
+
+        private static void SetProtectRangeLocked(Region region, ulong start, ulong size, uint protect)
+        {
+            if (start == region.Base && size >= region.Size)
+            {
+                region.DefaultProtect = protect;
+                region.PageProtects = null;
+                return;
+            }
+
+            region.PageProtects ??= new Dictionary<ulong, uint>();
+            var end = start + size;
+            for (var pageAddress = start; pageAddress < end; pageAddress += PageSize)
+            {
+                if (protect == region.DefaultProtect)
+                {
+                    region.PageProtects.Remove(pageAddress);
+                }
+                else
+                {
+                    region.PageProtects[pageAddress] = protect;
+                }
+            }
+        }
+
+        private static int ToPosixProtect(uint win32Protect)
+        {
+            return win32Protect switch
+            {
+                PAGE_NOACCESS => PROT_NONE,
+                PAGE_READONLY => PROT_READ,
+                PAGE_READWRITE => PROT_READ | PROT_WRITE,
+                PAGE_EXECUTE => PROT_READ | PROT_EXEC,
+                PAGE_EXECUTE_READ => PROT_READ | PROT_EXEC,
+                PAGE_EXECUTE_READWRITE => PROT_READ | PROT_WRITE | PROT_EXEC,
+                _ => PROT_READ | PROT_WRITE
+            };
+        }
+
+        private static void Trace(string message)
+        {
+            if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_VMEM"), "1", StringComparison.Ordinal))
+            {
+                Console.Error.WriteLine($"[HOSTMEM] {message}");
+            }
+        }
+
+        private static ulong AlignDown(ulong value, ulong alignment) => value & ~(alignment - 1);
+
+        private static ulong AlignUp(ulong value, ulong alignment) => checked((value + alignment - 1) & ~(alignment - 1));
+
+        [DllImport("libc", SetLastError = true)]
+        private static extern nint mmap(nint addr, nuint length, int prot, int flags, int fd, long offset);
+
+        [DllImport("libc", SetLastError = true)]
+        private static extern int munmap(nint addr, nuint length);
+
+        [DllImport("libc", SetLastError = true)]
+        private static extern int mprotect(nint addr, nuint length, int prot);
+    }
+}

src/SharpEmu.HLE/Host/Posix/PosixHostPlatform.cs

@@ -0,0 +1,17 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host.Posix;
+
+internal sealed class PosixHostPlatform : IHostPlatform
+{
+    public IHostMemory Memory { get; } = new PosixHostMemory();
+
+    public IHostThreading Threading { get; } = new PosixHostThreading();
+
+    public IHostSymbolResolver Symbols { get; } = new PosixHostSymbolResolver();
+
+    public IHostAudioOutput Audio { get; } = new PosixHostAudio();
+
+    public IHostInput Input { get; } = new PosixHostInput();
+}

src/SharpEmu.HLE/Host/Posix/PosixHostStubs.cs

@@ -0,0 +1,657 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Posix;
+
+/// <summary>
+/// POSIX replacements for the kernel32 helpers the native backend embeds in
+/// emitted x86-64 code. Every stub exposed here follows the Win64 calling
+/// convention the emitted call sites were written for (first argument in
+/// ECX, result in RAX, Win64 non-volatile registers preserved), so the
+/// emission code stays identical across platforms.
+/// </summary>
+internal static unsafe class PosixHostStubs
+{
+    private static readonly object Gate = new();
+    private static bool _initialized;
+    private static nint _tlsGetValueStub;
+    private static nint _queryPerformanceCounterStub;
+    private static nint _switchToThreadStub;
+    private static nint _sleepStub;
+    private static nint _waitForSingleObjectStub;
+    private static nint _setEventStub;
+    private static nint _exitThreadStub;
+
+    public static nint TlsGetValueStubAddress
+    {
+        get { EnsureInitialized(); return _tlsGetValueStub; }
+    }
+
+    public static nint QueryPerformanceCounterStubAddress
+    {
+        get { EnsureInitialized(); return _queryPerformanceCounterStub; }
+    }
+
+    public static nint SwitchToThreadStubAddress
+    {
+        get { EnsureInitialized(); return _switchToThreadStub; }
+    }
+
+    public static nint SleepStubAddress
+    {
+        get { EnsureInitialized(); return _sleepStub; }
+    }
+
+    /// <summary>
+    /// Win64-convention replacements for the kernel32 event/thread helpers the
+    /// native guest worker loop embeds. The "handle" they take is a worker
+    /// event created by <see cref="CreateWorkerEvent"/>: a dispatch semaphore
+    /// on macOS, an unnamed POSIX semaphore on Linux. The wait stub always
+    /// waits forever (the worker loop passes INFINITE) and retries EINTR.
+    /// </summary>
+    public static nint WaitForSingleObjectStubAddress
+    {
+        get { EnsureInitialized(); return _waitForSingleObjectStub; }
+    }
+
+    public static nint SetEventStubAddress
+    {
+        get { EnsureInitialized(); return _setEventStub; }
+    }
+
+    public static nint ExitThreadStubAddress
+    {
+        get { EnsureInitialized(); return _exitThreadStub; }
+    }
+
+    /// <summary>
+    /// Creates a binary-semaphore worker event signalable/waitable both from
+    /// managed code and from emitted native code (via the stub addresses
+    /// above). Returns 0 on failure.
+    /// </summary>
+    public static nint CreateWorkerEvent()
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            return dispatch_semaphore_create(0);
+        }
+
+        var semaphore = Marshal.AllocHGlobal(64);
+        if (sem_init(semaphore, 0, 0) != 0)
+        {
+            Marshal.FreeHGlobal(semaphore);
+            return 0;
+        }
+
+        return semaphore;
+    }
+
+    public static bool SignalWorkerEvent(nint handle)
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            _ = dispatch_semaphore_signal(handle);
+            return true;
+        }
+
+        return sem_post(handle) == 0;
+    }
+
+    /// <summary>Waits for a worker event; a negative timeout waits forever.</summary>
+    public static bool WaitWorkerEvent(nint handle, int timeoutMilliseconds)
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            if (timeoutMilliseconds < 0)
+            {
+                return dispatch_semaphore_wait(handle, ulong.MaxValue) == 0;
+            }
+
+            var deadline = dispatch_time(0, timeoutMilliseconds * 1_000_000L);
+            return dispatch_semaphore_wait(handle, deadline) == 0;
+        }
+
+        if (timeoutMilliseconds < 0)
+        {
+            while (sem_wait(handle) != 0)
+            {
+                // EINTR: retry.
+            }
+
+            return true;
+        }
+
+        var deadlineTicks = Environment.TickCount64 + timeoutMilliseconds;
+        while (sem_trywait(handle) != 0)
+        {
+            if (Environment.TickCount64 >= deadlineTicks)
+            {
+                return false;
+            }
+
+            System.Threading.Thread.Sleep(1);
+        }
+
+        return true;
+    }
+
+    public static void DestroyWorkerEvent(nint handle)
+    {
+        if (handle == 0)
+        {
+            return;
+        }
+
+        if (OperatingSystem.IsMacOS())
+        {
+            dispatch_release(handle);
+            return;
+        }
+
+        _ = sem_destroy(handle);
+        Marshal.FreeHGlobal(handle);
+    }
+
+    /// <summary>
+    /// Starts a raw pthread at a native entry point (pthread entries take their
+    /// argument in RDI; the worker loop stub ignores it). Returns an opaque
+    /// handle for <see cref="WaitForWorkerThreadExit"/>/<see cref="CloseWorkerThreadHandle"/>,
+    /// or 0 on failure.
+    /// </summary>
+    public static nint CreateWorkerThread(nint entry, nint parameter, nuint stackReserveBytes, out uint threadId)
+    {
+        threadId = 0;
+        byte* attr = stackalloc byte[512];
+        if (pthread_attr_init(attr) != 0)
+        {
+            return 0;
+        }
+
+        try
+        {
+            if (stackReserveBytes != 0)
+            {
+                _ = pthread_attr_setstacksize(attr, nuint.Max(stackReserveBytes, 512 * 1024));
+            }
+
+            nint thread;
+            if (pthread_create(&thread, attr, entry, parameter) != 0)
+            {
+                return 0;
+            }
+
+            if (OperatingSystem.IsMacOS())
+            {
+                ulong numericId;
+                if (pthread_threadid_np(thread, &numericId) == 0)
+                {
+                    threadId = unchecked((uint)numericId);
+                }
+            }
+            else
+            {
+                threadId = unchecked((uint)thread);
+            }
+
+            var holder = (nint*)Marshal.AllocHGlobal(sizeof(nint) * 2);
+            holder[0] = thread;
+            holder[1] = 0; // joined flag
+            return (nint)holder;
+        }
+        finally
+        {
+            _ = pthread_attr_destroy(attr);
+        }
+    }
+
+    /// <summary>
+    /// Waits for a worker thread to exit. Liveness is probed with
+    /// pthread_kill(thread, 0) (ESRCH once the thread has terminated) because
+    /// neither platform offers a portable timed join; the exited thread is then
+    /// joined so its resources are reclaimed.
+    /// </summary>
+    public static bool WaitForWorkerThreadExit(nint threadHandle, uint timeoutMilliseconds)
+    {
+        var holder = (nint*)threadHandle;
+        if (holder == null)
+        {
+            return false;
+        }
+
+        if (holder[1] != 0)
+        {
+            return true;
+        }
+
+        var thread = holder[0];
+        var deadline = Environment.TickCount64 + timeoutMilliseconds;
+        while (pthread_kill(thread, 0) == 0)
+        {
+            if (Environment.TickCount64 >= deadline)
+            {
+                return false;
+            }
+
+            System.Threading.Thread.Sleep(1);
+        }
+
+        _ = pthread_join(thread, null);
+        holder[1] = 1;
+        return true;
+    }
+
+    public static void CloseWorkerThreadHandle(nint threadHandle)
+    {
+        var holder = (nint*)threadHandle;
+        if (holder == null)
+        {
+            return;
+        }
+
+        if (holder[1] == 0)
+        {
+            // Never observed exiting: detach so the thread does not leak a
+            // zombie join target when it eventually terminates.
+            _ = pthread_detach(holder[0]);
+        }
+
+        Marshal.FreeHGlobal(threadHandle);
+    }
+
+    /// <summary>Allocates a pthread TLS key, mirroring kernel32!TlsAlloc.</summary>
+    public static uint TlsAlloc()
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            nuint key;
+            return pthread_key_create_mac(&key, 0) == 0 ? (uint)key : uint.MaxValue;
+        }
+
+        uint key32;
+        return pthread_key_create_linux(&key32, 0) == 0 ? key32 : uint.MaxValue;
+    }
+
+    public static bool TlsFree(uint key)
+    {
+        return OperatingSystem.IsMacOS()
+            ? pthread_key_delete_mac((nuint)key) == 0
+            : pthread_key_delete_linux(key) == 0;
+    }
+
+    public static bool TlsSetValue(uint key, nint value)
+    {
+        return OperatingSystem.IsMacOS()
+            ? pthread_setspecific_mac((nuint)key, value) == 0
+            : pthread_setspecific_linux(key, value) == 0;
+    }
+
+    public static nint TlsGetValue(uint key)
+    {
+        return OperatingSystem.IsMacOS()
+            ? pthread_getspecific_mac((nuint)key)
+            : pthread_getspecific_linux(key);
+    }
+
+    /// <summary>Stable numeric id of the calling thread (kernel32!GetCurrentThreadId).</summary>
+    public static uint GetCurrentThreadId()
+    {
+        if (OperatingSystem.IsMacOS())
+        {
+            ulong tid;
+            return pthread_threadid_np(0, &tid) == 0 ? unchecked((uint)tid) : 0u;
+        }
+
+        return unchecked((uint)gettid());
+    }
+
+    /// <summary>
+    /// Wraps a managed callback (compiled for the SysV ABI on POSIX .NET) in a
+    /// thunk that accepts up to four integer arguments in the Win64 ABI the
+    /// emitted x86-64 call sites use. Win64 passes args in rcx/rdx/r8/r9 and
+    /// treats rdi/rsi as non-volatile; SysV expects rdi/rsi/rdx/rcx and
+    /// clobbers them, so the thunk saves rdi/rsi, shuffles the registers, keeps
+    /// the stack 16-byte aligned for the call, and forwards the rax result.
+    /// </summary>
+    public static nint CreateWin64ToSysVThunk(nint sysvTarget)
+    {
+        var memory = HostPlatform.Current.Memory;
+        var page = (byte*)memory.Allocate(
+            0,
+            4096,
+            HostPageProtection.ReadWriteExecute);
+        if (page == null)
+        {
+            throw new OutOfMemoryException("Failed to allocate Win64->SysV thunk page");
+        }
+
+        var offset = 0;
+        Emit(page, ref offset, 0x57);                   // push rdi
+        Emit(page, ref offset, 0x56);                   // push rsi
+        Emit(page, ref offset, 0x48, 0x89, 0xCF);       // mov rdi, rcx
+        Emit(page, ref offset, 0x48, 0x89, 0xD6);       // mov rsi, rdx
+        Emit(page, ref offset, 0x4C, 0x89, 0xC2);       // mov rdx, r8
+        Emit(page, ref offset, 0x4C, 0x89, 0xC9);       // mov rcx, r9
+        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08); // sub rsp, 8 (realign to 16)
+        EmitMovRaxImm64(page, ref offset, sysvTarget);  // mov rax, target
+        Emit(page, ref offset, 0xFF, 0xD0);             // call rax
+        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08); // add rsp, 8
+        Emit(page, ref offset, 0x5E);                   // pop rsi
+        Emit(page, ref offset, 0x5F);                   // pop rdi
+        Emit(page, ref offset, 0xC3);                   // ret
+
+        if (!memory.Protect((ulong)page, 4096, HostPageProtection.ReadExecute, out _))
+        {
+            throw new InvalidOperationException("Failed to protect Win64->SysV thunk page");
+        }
+
+        memory.FlushInstructionCache((ulong)page, (ulong)offset);
+        return (nint)page;
+    }
+
+    private static void EnsureInitialized()
+    {
+        if (_initialized)
+        {
+            return;
+        }
+
+        lock (Gate)
+        {
+            if (_initialized)
+            {
+                return;
+            }
+
+            BuildStubs();
+            _initialized = true;
+        }
+    }
+
+    private static void BuildStubs()
+    {
+        var memory = HostPlatform.Current.Memory;
+        var page = (byte*)memory.Allocate(
+            0,
+            4096,
+            HostPageProtection.ReadWriteExecute);
+        if (page == null)
+        {
+            throw new OutOfMemoryException("Failed to allocate POSIX host helper stub page");
+        }
+
+        var offset = 0;
+        _tlsGetValueStub = EmitTlsGetValue(page, ref offset);
+        _queryPerformanceCounterStub = EmitQueryPerformanceCounter(page, ref offset);
+        _switchToThreadStub = EmitSwitchToThread(page, ref offset);
+        _sleepStub = EmitSleep(page, ref offset);
+        _waitForSingleObjectStub = EmitWaitForSingleObject(page, ref offset);
+        _setEventStub = EmitSetEvent(page, ref offset);
+        _exitThreadStub = EmitExitThread(page, ref offset);
+
+        if (!memory.Protect((ulong)page, 4096, HostPageProtection.ReadExecute, out _))
+        {
+            throw new InvalidOperationException("Failed to protect POSIX host helper stub page");
+        }
+
+        memory.FlushInstructionCache((ulong)page, (ulong)offset);
+    }
+
+    private static nint EmitTlsGetValue(byte* page, ref int offset)
+    {
+        var start = (nint)(page + offset);
+        if (OperatingSystem.IsMacOS())
+        {
+            // On macOS x86-64 pthread keys index the gs-based thread specific
+            // data array directly, so TlsGetValue(index in ecx) collapses to a
+            // single load that clobbers nothing but RAX.
+            Emit(page, ref offset, 0x89, 0xC8);                                     // mov eax, ecx
+            Emit(page, ref offset, 0x65, 0x48, 0x8B, 0x04, 0xC5, 0, 0, 0, 0);       // mov rax, gs:[rax*8]
+            Emit(page, ref offset, 0xC3);                                           // ret
+            return start;
+        }
+
+        // Linux: call pthread_getspecific, preserving the registers that are
+        // volatile in SysV but non-volatile in Win64 (rsi, rdi).
+        var pthreadGetSpecific = ResolveLibcExport("pthread_getspecific");
+        Emit(page, ref offset, 0x56);                                               // push rsi
+        Emit(page, ref offset, 0x57);                                               // push rdi
+        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                             // sub rsp, 8
+        Emit(page, ref offset, 0x89, 0xCF);                                         // mov edi, ecx
+        EmitMovRaxImm64(page, ref offset, pthreadGetSpecific);                      // mov rax, imm64
+        Emit(page, ref offset, 0xFF, 0xD0);                                         // call rax
+        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08);                             // add rsp, 8
+        Emit(page, ref offset, 0x5F);                                               // pop rdi
+        Emit(page, ref offset, 0x5E);                                               // pop rsi
+        Emit(page, ref offset, 0xC3);                                               // ret
+        return start;
+    }
+
+    private static nint EmitQueryPerformanceCounter(byte* page, ref int offset)
+    {
+        // BOOL QueryPerformanceCounter(LARGE_INTEGER* out in rcx): the emitted
+        // consumers only need a monotonically increasing counter, which rdtsc
+        // provides without leaving Win64-safe registers.
+        var start = (nint)(page + offset);
+        Emit(page, ref offset, 0x0F, 0x31);                                         // rdtsc
+        Emit(page, ref offset, 0x48, 0xC1, 0xE2, 0x20);                             // shl rdx, 32
+        Emit(page, ref offset, 0x48, 0x09, 0xD0);                                   // or rax, rdx
+        Emit(page, ref offset, 0x48, 0x89, 0x01);                                   // mov [rcx], rax
+        Emit(page, ref offset, 0xB8, 0x01, 0x00, 0x00, 0x00);                       // mov eax, 1
+        Emit(page, ref offset, 0xC3);                                               // ret
+        return start;
+    }
+
+    private static nint EmitSwitchToThread(byte* page, ref int offset)
+    {
+        var schedYield = ResolveLibcExport("sched_yield");
+        var start = (nint)(page + offset);
+        Emit(page, ref offset, 0x56);                                               // push rsi
+        Emit(page, ref offset, 0x57);                                               // push rdi
+        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                             // sub rsp, 8
+        EmitMovRaxImm64(page, ref offset, schedYield);                              // mov rax, imm64
+        Emit(page, ref offset, 0xFF, 0xD0);                                         // call rax
+        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08);                             // add rsp, 8
+        Emit(page, ref offset, 0x5F);                                               // pop rdi
+        Emit(page, ref offset, 0x5E);                                               // pop rsi
+        Emit(page, ref offset, 0xB8, 0x01, 0x00, 0x00, 0x00);                       // mov eax, 1
+        Emit(page, ref offset, 0xC3);                                               // ret
+        return start;
+    }
+
+    private static nint EmitSleep(byte* page, ref int offset)
+    {
+        // void Sleep(DWORD milliseconds in ecx) -> usleep(microseconds in edi).
+        var usleep = ResolveLibcExport("usleep");
+        var start = (nint)(page + offset);
+        Emit(page, ref offset, 0x56);                                               // push rsi
+        Emit(page, ref offset, 0x57);                                               // push rdi
+        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                             // sub rsp, 8
+        Emit(page, ref offset, 0x89, 0xCF);                                         // mov edi, ecx
+        Emit(page, ref offset, 0x81, 0xFF, 0xFF, 0x0F, 0x00, 0x00);                 // cmp edi, 0xFFF
+        Emit(page, ref offset, 0x76, 0x05);                                         // jbe +5
+        Emit(page, ref offset, 0xBF, 0xFF, 0x0F, 0x00, 0x00);                       // mov edi, 0xFFF (cap at ~4s)
+        Emit(page, ref offset, 0x69, 0xFF, 0xE8, 0x03, 0x00, 0x00);                 // imul edi, edi, 1000
+        EmitMovRaxImm64(page, ref offset, usleep);                                  // mov rax, imm64
+        Emit(page, ref offset, 0xFF, 0xD0);                                         // call rax
+        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08);                             // add rsp, 8
+        Emit(page, ref offset, 0x5F);                                               // pop rdi
+        Emit(page, ref offset, 0x5E);                                               // pop rsi
+        Emit(page, ref offset, 0xC3);                                               // ret
+        return start;
+    }
+
+    private static nint EmitWaitForSingleObject(byte* page, ref int offset)
+    {
+        // DWORD WaitForSingleObject(worker event in rcx, timeout in edx): the
+        // worker loop only ever waits forever, so the timeout is ignored.
+        // macOS waits on a dispatch semaphore (needs DISPATCH_TIME_FOREVER in
+        // rsi), Linux on a sem_t; both retry until the wait succeeds (EINTR).
+        var wait = ResolveLibcExport(
+            OperatingSystem.IsMacOS() ? "dispatch_semaphore_wait" : "sem_wait");
+        var start = (nint)(page + offset);
+        Emit(page, ref offset, 0x56);                                           // push rsi
+        Emit(page, ref offset, 0x57);                                           // push rdi
+        Emit(page, ref offset, 0x53);                                           // push rbx
+        Emit(page, ref offset, 0x48, 0x89, 0xCB);                               // mov rbx, rcx
+        var retry = offset;
+        Emit(page, ref offset, 0x48, 0x89, 0xDF);                               // mov rdi, rbx
+        if (OperatingSystem.IsMacOS())
+        {
+            Emit(page, ref offset, 0x48, 0xC7, 0xC6, 0xFF, 0xFF, 0xFF, 0xFF);   // mov rsi, DISPATCH_TIME_FOREVER
+        }
+        EmitMovRaxImm64(page, ref offset, wait);                                // mov rax, imm64
+        Emit(page, ref offset, 0xFF, 0xD0);                                     // call rax
+        Emit(page, ref offset, 0x85, 0xC0);                                     // test eax, eax
+        Emit(page, ref offset, 0x75, unchecked((byte)(retry - (offset + 2))));  // jnz retry
+        Emit(page, ref offset, 0x31, 0xC0);                                     // xor eax, eax (WAIT_OBJECT_0)
+        Emit(page, ref offset, 0x5B);                                           // pop rbx
+        Emit(page, ref offset, 0x5F);                                           // pop rdi
+        Emit(page, ref offset, 0x5E);                                           // pop rsi
+        Emit(page, ref offset, 0xC3);                                           // ret
+        return start;
+    }
+
+    private static nint EmitSetEvent(byte* page, ref int offset)
+    {
+        // BOOL SetEvent(worker event in rcx) -> dispatch_semaphore_signal /
+        // sem_post.
+        var signal = ResolveLibcExport(
+            OperatingSystem.IsMacOS() ? "dispatch_semaphore_signal" : "sem_post");
+        var start = (nint)(page + offset);
+        Emit(page, ref offset, 0x56);                                           // push rsi
+        Emit(page, ref offset, 0x57);                                           // push rdi
+        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                         // sub rsp, 8
+        Emit(page, ref offset, 0x48, 0x89, 0xCF);                               // mov rdi, rcx
+        EmitMovRaxImm64(page, ref offset, signal);                              // mov rax, imm64
+        Emit(page, ref offset, 0xFF, 0xD0);                                     // call rax
+        Emit(page, ref offset, 0x48, 0x83, 0xC4, 0x08);                         // add rsp, 8
+        Emit(page, ref offset, 0x5F);                                           // pop rdi
+        Emit(page, ref offset, 0x5E);                                           // pop rsi
+        Emit(page, ref offset, 0xB8, 0x01, 0x00, 0x00, 0x00);                   // mov eax, 1
+        Emit(page, ref offset, 0xC3);                                           // ret
+        return start;
+    }
+
+    private static nint EmitExitThread(byte* page, ref int offset)
+    {
+        // void ExitThread(code in ecx) -> pthread_exit(NULL); never returns,
+        // so no registers need preserving. pthread_exit runs the thread's TSD
+        // destructors, which detaches the CLR if the thread lazily attached.
+        var pthreadExit = ResolveLibcExport("pthread_exit");
+        var start = (nint)(page + offset);
+        Emit(page, ref offset, 0x48, 0x83, 0xEC, 0x08);                         // sub rsp, 8
+        Emit(page, ref offset, 0x31, 0xFF);                                     // xor edi, edi
+        EmitMovRaxImm64(page, ref offset, pthreadExit);                         // mov rax, imm64
+        Emit(page, ref offset, 0xFF, 0xD0);                                     // call rax
+        Emit(page, ref offset, 0xCC);                                           // int3 (never returns)
+        return start;
+    }
+
+    private static nint ResolveLibcExport(string name)
+    {
+        var libc = NativeLibrary.Load(OperatingSystem.IsMacOS() ? "libSystem.dylib" : "libc.so.6");
+        return NativeLibrary.GetExport(libc, name);
+    }
+
+    private static void Emit(byte* page, ref int offset, params byte[] bytes)
+    {
+        foreach (var value in bytes)
+        {
+            page[offset++] = value;
+        }
+    }
+
+    private static void EmitMovRaxImm64(byte* page, ref int offset, nint value)
+    {
+        Emit(page, ref offset, 0x48, 0xB8);
+        *(long*)(page + offset) = value;
+        offset += sizeof(long);
+    }
+
+    [DllImport("libc", EntryPoint = "pthread_key_create", SetLastError = true)]
+    private static extern int pthread_key_create_mac(nuint* key, nint destructor);
+
+    [DllImport("libc", EntryPoint = "pthread_key_create", SetLastError = true)]
+    private static extern int pthread_key_create_linux(uint* key, nint destructor);
+
+    [DllImport("libc", EntryPoint = "pthread_key_delete")]
+    private static extern int pthread_key_delete_mac(nuint key);
+
+    [DllImport("libc", EntryPoint = "pthread_key_delete")]
+    private static extern int pthread_key_delete_linux(uint key);
+
+    [DllImport("libc", EntryPoint = "pthread_setspecific")]
+    private static extern int pthread_setspecific_mac(nuint key, nint value);
+
+    [DllImport("libc", EntryPoint = "pthread_setspecific")]
+    private static extern int pthread_setspecific_linux(uint key, nint value);
+
+    [DllImport("libc", EntryPoint = "pthread_getspecific")]
+    private static extern nint pthread_getspecific_mac(nuint key);
+
+    [DllImport("libc", EntryPoint = "pthread_getspecific")]
+    private static extern nint pthread_getspecific_linux(uint key);
+
+    [DllImport("libc")]
+    private static extern int pthread_threadid_np(nint thread, ulong* threadId);
+
+    [DllImport("libc")]
+    private static extern int gettid();
+
+    [DllImport("libc")]
+    private static extern int pthread_attr_init(byte* attr);
+
+    [DllImport("libc")]
+    private static extern int pthread_attr_destroy(byte* attr);
+
+    [DllImport("libc")]
+    private static extern int pthread_attr_setstacksize(byte* attr, nuint stackSize);
+
+    [DllImport("libc")]
+    private static extern int pthread_create(nint* thread, byte* attr, nint startRoutine, nint arg);
+
+    [DllImport("libc")]
+    private static extern int pthread_join(nint thread, nint* returnValue);
+
+    [DllImport("libc")]
+    private static extern int pthread_detach(nint thread);
+
+    [DllImport("libc")]
+    private static extern int pthread_kill(nint thread, int signal);
+
+    // macOS: dispatch semaphores back the worker events (unnamed sem_init is
+    // unsupported on Darwin). libSystem reexports libdispatch, so "libc"
+    // resolves these like the pthread imports above.
+    [DllImport("libc")]
+    private static extern nint dispatch_semaphore_create(long value);
+
+    [DllImport("libc")]
+    private static extern nint dispatch_semaphore_signal(nint semaphore);
+
+    [DllImport("libc")]
+    private static extern nint dispatch_semaphore_wait(nint semaphore, ulong timeout);
+
+    [DllImport("libc")]
+    private static extern ulong dispatch_time(ulong when, long deltaNanoseconds);
+
+    [DllImport("libc")]
+    private static extern void dispatch_release(nint handle);
+
+    // Linux: unnamed POSIX semaphores.
+    [DllImport("libc")]
+    private static extern int sem_init(nint semaphore, int shared, uint value);
+
+    [DllImport("libc")]
+    private static extern int sem_post(nint semaphore);
+
+    [DllImport("libc")]
+    private static extern int sem_wait(nint semaphore);
+
+    [DllImport("libc")]
+    private static extern int sem_trywait(nint semaphore);
+
+    [DllImport("libc")]
+    private static extern int sem_destroy(nint semaphore);
+}

src/SharpEmu.HLE/Host/Posix/PosixHostSymbolResolver.cs

@@ -0,0 +1,19 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host.Posix;
+
+internal sealed class PosixHostSymbolResolver : IHostSymbolResolver
+{
+    public nint GetAddress(HostRuntimeFunction function) => function switch
+    {
+        HostRuntimeFunction.TlsGetValue => PosixHostStubs.TlsGetValueStubAddress,
+        HostRuntimeFunction.QueryPerformanceCounter => PosixHostStubs.QueryPerformanceCounterStubAddress,
+        HostRuntimeFunction.SwitchToThread => PosixHostStubs.SwitchToThreadStubAddress,
+        HostRuntimeFunction.Sleep => PosixHostStubs.SleepStubAddress,
+        HostRuntimeFunction.WaitForSingleObject => PosixHostStubs.WaitForSingleObjectStubAddress,
+        HostRuntimeFunction.SetEvent => PosixHostStubs.SetEventStubAddress,
+        HostRuntimeFunction.ExitThread => PosixHostStubs.ExitThreadStubAddress,
+        _ => throw new ArgumentOutOfRangeException(nameof(function), function, null),
+    };
+}

src/SharpEmu.HLE/Host/Posix/PosixHostThreading.cs

@@ -0,0 +1,57 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host.Posix;
+
+internal sealed class PosixHostThreading : IHostThreading
+{
+    public uint AllocateTlsSlot() => PosixHostStubs.TlsAlloc();
+
+    public bool FreeTlsSlot(uint slot) => PosixHostStubs.TlsFree(slot);
+
+    public bool SetTlsValue(uint slot, nint value) => PosixHostStubs.TlsSetValue(slot, value);
+
+    public nint GetTlsValue(uint slot) => PosixHostStubs.TlsGetValue(slot);
+
+    public uint CurrentThreadId => PosixHostStubs.GetCurrentThreadId();
+
+    public void RequestTimerResolution()
+    {
+        // POSIX sleep primitives are already high-resolution; there is no
+        // timeBeginPeriod equivalent to request.
+    }
+
+    // Thread affinity is advisory on POSIX hosts (macOS offers no
+    // pthread-level affinity API); callers treat false as "not applied".
+    public bool TrySetCurrentThreadAffinity(nuint affinityMask)
+    {
+        _ = affinityMask;
+        return false;
+    }
+
+    public nint CreateNativeThread(
+        nint entry,
+        nint parameter,
+        nuint stackReserveBytes,
+        out uint threadId)
+    {
+        return PosixHostStubs.CreateWorkerThread(entry, parameter, stackReserveBytes, out threadId);
+    }
+
+    public bool WaitForThreadExit(nint threadHandle, uint timeoutMilliseconds)
+    {
+        return PosixHostStubs.WaitForWorkerThreadExit(threadHandle, timeoutMilliseconds);
+    }
+
+    public void CloseThreadHandle(nint threadHandle)
+    {
+        PosixHostStubs.CloseWorkerThreadHandle(threadHandle);
+    }
+
+    public bool TryCaptureThreadRegisters(uint threadId, out HostCapturedRegisters registers)
+    {
+        _ = threadId;
+        registers = default;
+        return false;
+    }
+}

src/SharpEmu.HLE/Host/Windows/WindowsDualSenseReader.cs

@@ -3,21 +3,21 @@
 
 using Microsoft.Win32.SafeHandles;
 
-namespace SharpEmu.Libs.Pad;
+namespace SharpEmu.HLE.Host.Windows;
 
 /// <summary>
 /// Reads a DualSense controller over raw HID on a background thread.
 /// Supports USB (input report 0x01) and Bluetooth (extended report 0x31,
 /// activated by requesting feature report 0x05), with hot-plug retry.
 /// </summary>
-internal static class DualSenseReader
+internal static class WindowsDualSenseReader
 {
     private const ushort SonyVendorId = 0x054C;
     private const ushort DualSenseProductId = 0x0CE6;
     private const ushort DualSenseEdgeProductId = 0x0DF2;
 
     private static readonly object Gate = new();
-    private static PadState _state;
+    private static HostGamepadState _state;
     private static bool _started;
 
     // Output (rumble/lightbar) state, all guarded by Gate.
@@ -37,6 +37,8 @@ internal static class DualSenseReader
     /// <summary>Starts the background reader once; safe to call repeatedly.</summary>
     internal static void EnsureStarted()
     {
+        // The GUI source-links this reader and calls it directly, without the
+        // host-platform resolution that otherwise guarantees Windows.
         if (!OperatingSystem.IsWindows())
         {
             return;
@@ -59,7 +61,7 @@ internal static class DualSenseReader
         }
     }
 
-    internal static bool TryGetState(out PadState state)
+    internal static bool TryGetState(out HostGamepadState state)
     {
         lock (Gate)
         {
@@ -69,7 +71,7 @@ internal static class DualSenseReader
         return state.Connected;
     }
 
-    private static void SetState(in PadState state)
+    private static void SetState(in HostGamepadState state)
     {
         lock (Gate)
         {
@@ -148,11 +150,11 @@ internal static class DualSenseReader
         {
             if (_outputStream is null)
             {
-                var handle = HidNative.CreateFile(
+                var handle = WindowsHidNative.CreateFile(
                     _devicePath,
-                    HidNative.GenericRead | HidNative.GenericWrite,
-                    HidNative.FileShareRead | HidNative.FileShareWrite,
-                    0, HidNative.OpenExisting, 0, 0);
+                    WindowsHidNative.GenericRead | WindowsHidNative.GenericWrite,
+                    WindowsHidNative.FileShareRead | WindowsHidNative.FileShareWrite,
+                    0, WindowsHidNative.OpenExisting, 0, 0);
                 if (handle.IsInvalid)
                 {
                     handle.Dispose();
@@ -262,7 +264,7 @@ internal static class DualSenseReader
                 // to the full 0x31 input report. Harmless over USB.
                 var feature = new byte[41];
                 feature[0] = 0x05;
-                _ = HidNative.HidD_GetFeature(handle, feature, feature.Length);
+                _ = WindowsHidNative.HidD_GetFeature(handle, feature, feature.Length);
 
                 if (!announcedConnect)
                 {
@@ -320,18 +322,18 @@ internal static class DualSenseReader
     private static SafeFileHandle? OpenDualSense(out string? devicePath)
     {
         devicePath = null;
-        foreach (var path in HidNative.EnumerateHidDevicePaths())
+        foreach (var path in WindowsHidNative.EnumerateHidDevicePaths())
         {
             // Open without access rights just to query VID/PID.
-            using var probe = HidNative.CreateFile(
-                path, 0, HidNative.FileShareRead | HidNative.FileShareWrite, 0, HidNative.OpenExisting, 0, 0);
+            using var probe = WindowsHidNative.CreateFile(
+                path, 0, WindowsHidNative.FileShareRead | WindowsHidNative.FileShareWrite, 0, WindowsHidNative.OpenExisting, 0, 0);
             if (probe.IsInvalid)
             {
                 continue;
             }
 
-            var attributes = new HidNative.HiddAttributes { Size = 12 };
-            if (!HidNative.HidD_GetAttributes(probe, ref attributes) ||
+            var attributes = new WindowsHidNative.HiddAttributes { Size = 12 };
+            if (!WindowsHidNative.HidD_GetAttributes(probe, ref attributes) ||
                 attributes.VendorId != SonyVendorId ||
                 (attributes.ProductId != DualSenseProductId && attributes.ProductId != DualSenseEdgeProductId))
             {
@@ -339,19 +341,19 @@ internal static class DualSenseReader
             }
 
             // Read+write so feature reports work; fall back to read-only.
-            var handle = HidNative.CreateFile(
+            var handle = WindowsHidNative.CreateFile(
                 path,
-                HidNative.GenericRead | HidNative.GenericWrite,
-                HidNative.FileShareRead | HidNative.FileShareWrite,
-                0, HidNative.OpenExisting, 0, 0);
+                WindowsHidNative.GenericRead | WindowsHidNative.GenericWrite,
+                WindowsHidNative.FileShareRead | WindowsHidNative.FileShareWrite,
+                0, WindowsHidNative.OpenExisting, 0, 0);
             if (handle.IsInvalid)
             {
                 handle.Dispose();
-                handle = HidNative.CreateFile(
+                handle = WindowsHidNative.CreateFile(
                     path,
-                    HidNative.GenericRead,
-                    HidNative.FileShareRead | HidNative.FileShareWrite,
-                    0, HidNative.OpenExisting, 0, 0);
+                    WindowsHidNative.GenericRead,
+                    WindowsHidNative.FileShareRead | WindowsHidNative.FileShareWrite,
+                    0, WindowsHidNative.OpenExisting, 0, 0);
             }
 
             if (!handle.IsInvalid)
@@ -366,7 +368,7 @@ internal static class DualSenseReader
         return null;
     }
 
-    private static bool TryParseReport(ReadOnlySpan<byte> report, out PadState state)
+    private static bool TryParseReport(ReadOnlySpan<byte> report, out HostGamepadState state)
     {
         // USB: report id 0x01, payload starts at [1].
         // Bluetooth extended: report id 0x31, sequence byte at [1], payload at [2].
@@ -395,43 +397,43 @@ internal static class DualSenseReader
         var buttons1 = report[offset + 8];
         var buttons2 = report[offset + 9];
 
-        uint buttons = 0;
-        buttons |= (buttons0 & 0x10) != 0 ? OrbisPadButton.Square : 0;
-        buttons |= (buttons0 & 0x20) != 0 ? OrbisPadButton.Cross : 0;
-        buttons |= (buttons0 & 0x40) != 0 ? OrbisPadButton.Circle : 0;
-        buttons |= (buttons0 & 0x80) != 0 ? OrbisPadButton.Triangle : 0;
+        var buttons = HostGamepadButtons.None;
+        buttons |= (buttons0 & 0x10) != 0 ? HostGamepadButtons.Square : 0;
+        buttons |= (buttons0 & 0x20) != 0 ? HostGamepadButtons.Cross : 0;
+        buttons |= (buttons0 & 0x40) != 0 ? HostGamepadButtons.Circle : 0;
+        buttons |= (buttons0 & 0x80) != 0 ? HostGamepadButtons.Triangle : 0;
         buttons |= HatToButtons(buttons0 & 0x0F);
-        buttons |= (buttons1 & 0x01) != 0 ? OrbisPadButton.L1 : 0;
-        buttons |= (buttons1 & 0x02) != 0 ? OrbisPadButton.R1 : 0;
-        buttons |= (buttons1 & 0x04) != 0 ? OrbisPadButton.L2 : 0;
-        buttons |= (buttons1 & 0x08) != 0 ? OrbisPadButton.R2 : 0;
-        buttons |= (buttons1 & 0x20) != 0 ? OrbisPadButton.Options : 0;
-        buttons |= (buttons1 & 0x40) != 0 ? OrbisPadButton.L3 : 0;
-        buttons |= (buttons1 & 0x80) != 0 ? OrbisPadButton.R3 : 0;
-        buttons |= (buttons2 & 0x02) != 0 ? OrbisPadButton.TouchPad : 0;
+        buttons |= (buttons1 & 0x01) != 0 ? HostGamepadButtons.L1 : 0;
+        buttons |= (buttons1 & 0x02) != 0 ? HostGamepadButtons.R1 : 0;
+        buttons |= (buttons1 & 0x04) != 0 ? HostGamepadButtons.L2 : 0;
+        buttons |= (buttons1 & 0x08) != 0 ? HostGamepadButtons.R2 : 0;
+        buttons |= (buttons1 & 0x20) != 0 ? HostGamepadButtons.Options : 0;
+        buttons |= (buttons1 & 0x40) != 0 ? HostGamepadButtons.L3 : 0;
+        buttons |= (buttons1 & 0x80) != 0 ? HostGamepadButtons.R3 : 0;
+        buttons |= (buttons2 & 0x02) != 0 ? HostGamepadButtons.TouchPad : 0;
 
-        state = new PadState(
+        state = new HostGamepadState(
             Connected: true,
             Buttons: buttons,
             LeftX: leftX,
             LeftY: leftY,
             RightX: rightX,
             RightY: rightY,
-            L2: l2,
-            R2: r2);
+            LeftTrigger: l2,
+            RightTrigger: r2);
         return true;
     }
 
-    private static uint HatToButtons(int hat) => hat switch
+    private static HostGamepadButtons HatToButtons(int hat) => hat switch
     {
-        0 => OrbisPadButton.Up,
-        1 => OrbisPadButton.Up | OrbisPadButton.Right,
-        2 => OrbisPadButton.Right,
-        3 => OrbisPadButton.Right | OrbisPadButton.Down,
-        4 => OrbisPadButton.Down,
-        5 => OrbisPadButton.Down | OrbisPadButton.Left,
-        6 => OrbisPadButton.Left,
-        7 => OrbisPadButton.Left | OrbisPadButton.Up,
+        0 => HostGamepadButtons.Up,
+        1 => HostGamepadButtons.Up | HostGamepadButtons.Right,
+        2 => HostGamepadButtons.Right,
+        3 => HostGamepadButtons.Right | HostGamepadButtons.Down,
+        4 => HostGamepadButtons.Down,
+        5 => HostGamepadButtons.Down | HostGamepadButtons.Left,
+        6 => HostGamepadButtons.Left,
+        7 => HostGamepadButtons.Left | HostGamepadButtons.Up,
         _ => 0,
     };
 }

src/SharpEmu.HLE/Host/Windows/WindowsHidNative.cs

@@ -4,13 +4,13 @@
 using System.Runtime.InteropServices;
 using Microsoft.Win32.SafeHandles;
 
-namespace SharpEmu.Libs.Pad;
+namespace SharpEmu.HLE.Host.Windows;
 
 /// <summary>
 /// Minimal Win32 HID interop used to talk to a DualSense controller
 /// directly, without any external input library.
 /// </summary>
-internal static partial class HidNative
+internal static partial class WindowsHidNative
 {
     internal const int DigcfPresent = 0x02;
     internal const int DigcfDeviceInterface = 0x10;
@@ -38,28 +38,32 @@ internal static partial class HidNative
         public ushort VersionNumber;
     }
 
-    [DllImport("hid.dll")]
-    internal static extern void HidD_GetHidGuid(out Guid hidGuid);
+    [LibraryImport("hid.dll")]
+    internal static partial void HidD_GetHidGuid(out Guid hidGuid);
 
-    [DllImport("hid.dll")]
-    internal static extern bool HidD_GetAttributes(SafeFileHandle hidDeviceObject, ref HiddAttributes attributes);
+    [LibraryImport("hid.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool HidD_GetAttributes(SafeFileHandle hidDeviceObject, ref HiddAttributes attributes);
 
-    [DllImport("hid.dll")]
-    internal static extern bool HidD_GetFeature(SafeFileHandle hidDeviceObject, byte[] reportBuffer, int reportBufferLength);
+    [LibraryImport("hid.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool HidD_GetFeature(SafeFileHandle hidDeviceObject, [In, Out] byte[] reportBuffer, int reportBufferLength);
 
-    [DllImport("setupapi.dll", CharSet = CharSet.Unicode)]
-    internal static extern nint SetupDiGetClassDevs(ref Guid classGuid, nint enumerator, nint hwndParent, int flags);
+    [LibraryImport("setupapi.dll", EntryPoint = "SetupDiGetClassDevsW")]
+    internal static partial nint SetupDiGetClassDevs(ref Guid classGuid, nint enumerator, nint hwndParent, int flags);
 
-    [DllImport("setupapi.dll")]
-    internal static extern bool SetupDiEnumDeviceInterfaces(
+    [LibraryImport("setupapi.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool SetupDiEnumDeviceInterfaces(
         nint deviceInfoSet,
         nint deviceInfoData,
         ref Guid interfaceClassGuid,
         int memberIndex,
         ref SpDeviceInterfaceData deviceInterfaceData);
 
-    [DllImport("setupapi.dll", CharSet = CharSet.Unicode)]
-    internal static extern bool SetupDiGetDeviceInterfaceDetail(
+    [LibraryImport("setupapi.dll", EntryPoint = "SetupDiGetDeviceInterfaceDetailW")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool SetupDiGetDeviceInterfaceDetail(
         nint deviceInfoSet,
         ref SpDeviceInterfaceData deviceInterfaceData,
         nint deviceInterfaceDetailData,
@@ -67,11 +71,12 @@ internal static partial class HidNative
         out int requiredSize,
         nint deviceInfoData);
 
-    [DllImport("setupapi.dll")]
-    internal static extern bool SetupDiDestroyDeviceInfoList(nint deviceInfoSet);
+    [LibraryImport("setupapi.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    internal static partial bool SetupDiDestroyDeviceInfoList(nint deviceInfoSet);
 
-    [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
-    internal static extern SafeFileHandle CreateFile(
+    [LibraryImport("kernel32.dll", EntryPoint = "CreateFileW", SetLastError = true, StringMarshalling = StringMarshalling.Utf16)]
+    internal static partial SafeFileHandle CreateFile(
         string fileName,
         uint desiredAccess,
         uint shareMode,

src/SharpEmu.HLE/Host/Windows/WindowsHostInput.cs

@@ -0,0 +1,84 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Windows;
+
+/// <summary>
+/// Windows input backend: DualSense over raw HID plus XInput controllers for gamepads,
+/// user32 for the keyboard-fallback queries. Rumble fans out to every reader; lightbar
+/// only exists on the DualSense.
+/// </summary>
+internal sealed partial class WindowsHostInput : IHostInput
+{
+    public void EnsureStarted()
+    {
+        WindowsDualSenseReader.EnsureStarted();
+        WindowsXInputReader.EnsureStarted();
+    }
+
+    public int GetGamepadStates(Span<HostGamepadState> destination)
+    {
+        var count = 0;
+        if (count < destination.Length && WindowsDualSenseReader.TryGetState(out var dualSense))
+        {
+            destination[count++] = dualSense;
+        }
+
+        if (count < destination.Length && WindowsXInputReader.TryGetState(out var xinput))
+        {
+            destination[count++] = xinput;
+        }
+
+        return count;
+    }
+
+    public string? DescribeConnectedGamepad()
+    {
+        if (WindowsDualSenseReader.TryGetState(out _))
+        {
+            return "DualSense";
+        }
+
+        return WindowsXInputReader.TryGetState(out _) ? "Xbox controller" : null;
+    }
+
+    public void SetRumble(byte largeMotor, byte smallMotor)
+    {
+        WindowsDualSenseReader.SetRumble(largeMotor, smallMotor);
+        WindowsXInputReader.SetRumble(largeMotor, smallMotor);
+    }
+
+    public void SetTriggerRumble(byte? leftTrigger, byte? rightTrigger) =>
+        WindowsXInputReader.SetTriggerRumble(leftTrigger, rightTrigger);
+
+    public void SetLightbar(byte red, byte green, byte blue) =>
+        WindowsDualSenseReader.SetLightbar(red, green, blue);
+
+    public void ResetLightbar() => WindowsDualSenseReader.ResetLightbar();
+
+    public bool IsHostWindowFocused()
+    {
+        var foregroundWindow = GetForegroundWindow();
+        if (foregroundWindow == 0)
+        {
+            return false;
+        }
+
+        GetWindowThreadProcessId(foregroundWindow, out var processId);
+        return processId == (uint)Environment.ProcessId;
+    }
+
+    public bool IsKeyDown(int virtualKey) =>
+        (GetAsyncKeyState(virtualKey) & 0x8000) != 0;
+
+    [LibraryImport("user32.dll")]
+    private static partial short GetAsyncKeyState(int vKey);
+
+    [LibraryImport("user32.dll")]
+    private static partial nint GetForegroundWindow();
+
+    [LibraryImport("user32.dll")]
+    private static partial uint GetWindowThreadProcessId(nint hWnd, out uint processId);
+}

src/SharpEmu.HLE/Host/Windows/WindowsHostMemory.cs

@@ -0,0 +1,153 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Windows;
+
+/// <summary>
+/// Windows implementation over VirtualAlloc/VirtualFree/VirtualProtect/VirtualQuery.
+/// Sealed so the JIT can devirtualize interface calls on fault-handling hot paths.
+/// </summary>
+internal sealed unsafe partial class WindowsHostMemory : IHostMemory
+{
+    private const uint MEM_COMMIT = 0x1000;
+    private const uint MEM_RESERVE = 0x2000;
+    private const uint MEM_RELEASE = 0x8000;
+    private const uint MEM_FREE = 0x10000;
+
+    private const uint PAGE_NOACCESS = 0x01;
+    private const uint PAGE_READONLY = 0x02;
+    private const uint PAGE_READWRITE = 0x04;
+    private const uint PAGE_WRITECOPY = 0x08;
+    private const uint PAGE_EXECUTE = 0x10;
+    private const uint PAGE_EXECUTE_READ = 0x20;
+    private const uint PAGE_EXECUTE_READWRITE = 0x40;
+    private const uint PAGE_EXECUTE_WRITECOPY = 0x80;
+
+    public ulong Allocate(ulong desiredAddress, ulong size, HostPageProtection protection)
+    {
+        return (ulong)VirtualAlloc((void*)desiredAddress, (nuint)size, MEM_COMMIT | MEM_RESERVE, ToNativeProtection(protection));
+    }
+
+    public ulong Reserve(ulong desiredAddress, ulong size, HostPageProtection protection)
+    {
+        return (ulong)VirtualAlloc((void*)desiredAddress, (nuint)size, MEM_RESERVE, ToNativeProtection(protection));
+    }
+
+    public bool Commit(ulong address, ulong size, HostPageProtection protection)
+    {
+        return VirtualAlloc((void*)address, (nuint)size, MEM_COMMIT, ToNativeProtection(protection)) != null;
+    }
+
+    public bool Free(ulong address)
+    {
+        return VirtualFree((void*)address, 0, MEM_RELEASE);
+    }
+
+    public bool Protect(ulong address, ulong size, HostPageProtection protection, out uint rawOldProtection)
+    {
+        return VirtualProtect((void*)address, (nuint)size, ToNativeProtection(protection), out rawOldProtection);
+    }
+
+    public bool ProtectRaw(ulong address, ulong size, uint rawProtection, out uint rawOldProtection)
+    {
+        return VirtualProtect((void*)address, (nuint)size, rawProtection, out rawOldProtection);
+    }
+
+    public bool Query(ulong address, out HostRegionInfo info)
+    {
+        if (VirtualQuery((void*)address, out var mbi, (nuint)sizeof(MemoryBasicInformation64)) == 0)
+        {
+            info = default;
+            return false;
+        }
+
+        info = new HostRegionInfo(
+            mbi.BaseAddress,
+            mbi.AllocationBase,
+            mbi.RegionSize,
+            ToRegionState(mbi.State),
+            mbi.State,
+            ToHostProtection(mbi.Protect),
+            mbi.Protect,
+            mbi.AllocationProtect);
+        return true;
+    }
+
+    public void FlushInstructionCache(ulong address, ulong size)
+    {
+        FlushInstructionCache(GetCurrentProcess(), (void*)address, (nuint)size);
+    }
+
+    private static uint ToNativeProtection(HostPageProtection protection) => protection switch
+    {
+        HostPageProtection.NoAccess => PAGE_NOACCESS,
+        HostPageProtection.ReadOnly => PAGE_READONLY,
+        HostPageProtection.ReadWrite => PAGE_READWRITE,
+        HostPageProtection.Execute => PAGE_EXECUTE,
+        HostPageProtection.ReadExecute => PAGE_EXECUTE_READ,
+        HostPageProtection.ReadWriteExecute => PAGE_EXECUTE_READWRITE,
+        HostPageProtection.ExecuteWriteCopy => PAGE_EXECUTE_WRITECOPY,
+        _ => throw new ArgumentOutOfRangeException(nameof(protection), protection, null),
+    };
+
+    private static HostRegionState ToRegionState(uint state) => state switch
+    {
+        MEM_COMMIT => HostRegionState.Committed,
+        MEM_RESERVE => HostRegionState.Reserved,
+        MEM_FREE => HostRegionState.Free,
+        _ => HostRegionState.Free,
+    };
+
+    private static HostPageProtection ToHostProtection(uint rawProtection)
+    {
+        // Strip PAGE_GUARD/PAGE_NOCACHE/PAGE_WRITECOMBINE modifiers; callers needing
+        // them compare HostRegionInfo.RawProtection directly.
+        return (rawProtection & 0xFF) switch
+        {
+            PAGE_READONLY => HostPageProtection.ReadOnly,
+            PAGE_READWRITE => HostPageProtection.ReadWrite,
+            PAGE_WRITECOPY => HostPageProtection.ReadWrite,
+            PAGE_EXECUTE => HostPageProtection.Execute,
+            PAGE_EXECUTE_READ => HostPageProtection.ReadExecute,
+            PAGE_EXECUTE_READWRITE => HostPageProtection.ReadWriteExecute,
+            PAGE_EXECUTE_WRITECOPY => HostPageProtection.ExecuteWriteCopy,
+            _ => HostPageProtection.NoAccess,
+        };
+    }
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial void* VirtualAlloc(void* lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool VirtualFree(void* lpAddress, nuint dwSize, uint dwFreeType);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool VirtualProtect(void* lpAddress, nuint dwSize, uint flNewProtect, out uint lpflOldProtect);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial nuint VirtualQuery(void* lpAddress, out MemoryBasicInformation64 lpBuffer, nuint dwLength);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial void* GetCurrentProcess();
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool FlushInstructionCache(void* hProcess, void* lpBaseAddress, nuint dwSize);
+
+    private struct MemoryBasicInformation64
+    {
+        public ulong BaseAddress;
+        public ulong AllocationBase;
+        public uint AllocationProtect;
+        public uint Alignment1;
+        public ulong RegionSize;
+        public uint State;
+        public uint Protect;
+        public uint Type;
+        public uint Alignment2;
+    }
+}

src/SharpEmu.HLE/Host/Windows/WindowsHostPlatform.cs

@@ -0,0 +1,17 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE.Host.Windows;
+
+internal sealed class WindowsHostPlatform : IHostPlatform
+{
+    public IHostMemory Memory { get; } = new WindowsHostMemory();
+
+    public IHostThreading Threading { get; } = new WindowsHostThreading();
+
+    public IHostSymbolResolver Symbols { get; } = new WindowsHostSymbolResolver();
+
+    public IHostAudioOutput Audio { get; } = new WindowsWaveOutAudio();
+
+    public IHostInput Input { get; } = new WindowsHostInput();
+}

src/SharpEmu.HLE/Host/Windows/WindowsHostSymbolResolver.cs

@@ -0,0 +1,39 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Windows;
+
+internal sealed partial class WindowsHostSymbolResolver : IHostSymbolResolver
+{
+    public nint GetAddress(HostRuntimeFunction function)
+    {
+        var kernel32 = GetModuleHandle("kernel32.dll");
+        if (kernel32 == 0)
+        {
+            return 0;
+        }
+
+        return GetProcAddress(kernel32, function switch
+        {
+            HostRuntimeFunction.TlsGetValue => "TlsGetValue",
+            HostRuntimeFunction.QueryPerformanceCounter => "QueryPerformanceCounter",
+            HostRuntimeFunction.SwitchToThread => "SwitchToThread",
+            HostRuntimeFunction.Sleep => "Sleep",
+            HostRuntimeFunction.WaitForSingleObject => "WaitForSingleObject",
+            HostRuntimeFunction.SetEvent => "SetEvent",
+            HostRuntimeFunction.ExitThread => "ExitThread",
+            _ => throw new ArgumentOutOfRangeException(nameof(function), function, null),
+        });
+    }
+
+    // Utf16 marshalling pins the managed string and passes its address directly
+    // (no copy); Utf8 stack-allocates the transient buffer for these short
+    // ASCII export names. LibraryImport is exact-spelling, hence the W entry point.
+    [LibraryImport("kernel32.dll", EntryPoint = "GetModuleHandleW", StringMarshalling = StringMarshalling.Utf16)]
+    private static partial nint GetModuleHandle(string lpModuleName);
+
+    [LibraryImport("kernel32.dll", StringMarshalling = StringMarshalling.Utf8)]
+    private static partial nint GetProcAddress(nint hModule, string procName);
+}

src/SharpEmu.HLE/Host/Windows/WindowsHostThreading.cs

@@ -0,0 +1,193 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Windows;
+
+internal sealed unsafe partial class WindowsHostThreading : IHostThreading
+{
+    private const uint StackSizeParamIsAReservation = 0x00010000u;
+    private const uint ThreadGetContext = 0x0008u;
+    private const uint ThreadSuspendResume = 0x0002u;
+
+    // Win64 CONTEXT layout (CONTROL | INTEGER only — no XMM state is requested).
+    private const int Win64ContextSize = 0x4D0;
+    private const int Win64ContextFlagsOffset = 0x30;
+    private const uint ContextAmd64ControlInteger = 0x00100003u;
+    private const int CtxRax = 120;
+    private const int CtxRcx = 128;
+    private const int CtxRdx = 136;
+    private const int CtxRbx = 144;
+    private const int CtxRsp = 152;
+    private const int CtxRbp = 160;
+    private const int CtxRip = 248;
+
+    private static int _timerResolutionRequested;
+
+    public void RequestTimerResolution()
+    {
+        if (Interlocked.Exchange(ref _timerResolutionRequested, 1) != 0)
+        {
+            return;
+        }
+
+        try
+        {
+            if (TimeBeginPeriod(1) != 0)
+            {
+                Console.Error.WriteLine(
+                    "[LOADER][WARN] Host timer resolution request rejected; " +
+                    "timed waits keep the default ~15.6 ms granularity.");
+            }
+        }
+        catch (DllNotFoundException exception)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][WARN] Host timer resolution unavailable: {exception.Message}");
+        }
+    }
+
+    public uint AllocateTlsSlot() => TlsAlloc();
+
+    public bool FreeTlsSlot(uint slot) => TlsFree(slot);
+
+    public bool SetTlsValue(uint slot, nint value) => TlsSetValue(slot, value);
+
+    public nint GetTlsValue(uint slot) => TlsGetValue(slot);
+
+    public uint CurrentThreadId => GetCurrentThreadId();
+
+    public bool TrySetCurrentThreadAffinity(nuint affinityMask)
+    {
+        return SetThreadAffinityMask(GetCurrentThread(), affinityMask) != 0;
+    }
+
+    public nint CreateNativeThread(nint entry, nint parameter, nuint stackReserveBytes, out uint threadId)
+    {
+        return CreateThread(0, stackReserveBytes, entry, parameter, StackSizeParamIsAReservation, out threadId);
+    }
+
+    public bool WaitForThreadExit(nint threadHandle, uint timeoutMilliseconds)
+    {
+        return WaitForSingleObject(threadHandle, timeoutMilliseconds) == 0u;
+    }
+
+    public void CloseThreadHandle(nint threadHandle)
+    {
+        _ = CloseHandle(threadHandle);
+    }
+
+    public bool TryCaptureThreadRegisters(uint threadId, out HostCapturedRegisters registers)
+    {
+        registers = default;
+        var threadHandle = OpenThread(ThreadGetContext | ThreadSuspendResume, false, threadId);
+        if (threadHandle == 0)
+        {
+            return false;
+        }
+
+        void* contextRecord = null;
+        var suspended = false;
+        try
+        {
+            if (SuspendThread(threadHandle) == uint.MaxValue)
+            {
+                return false;
+            }
+
+            suspended = true;
+            // CONTEXT requires 16-byte alignment (it embeds M128A fields);
+            // NativeMemory.AllocZeroed guarantees max_align_t, stackalloc only
+            // pointer-size — so this stays a native allocation.
+            contextRecord = NativeMemory.AllocZeroed((nuint)Win64ContextSize);
+            *(uint*)((byte*)contextRecord + Win64ContextFlagsOffset) = ContextAmd64ControlInteger;
+            if (!GetThreadContext(threadHandle, contextRecord))
+            {
+                return false;
+            }
+
+            registers = new HostCapturedRegisters(
+                ReadU64(contextRecord, CtxRip),
+                ReadU64(contextRecord, CtxRsp),
+                ReadU64(contextRecord, CtxRbp),
+                ReadU64(contextRecord, CtxRax),
+                ReadU64(contextRecord, CtxRbx),
+                ReadU64(contextRecord, CtxRcx),
+                ReadU64(contextRecord, CtxRdx));
+            return true;
+        }
+        finally
+        {
+            if (contextRecord != null)
+            {
+                NativeMemory.Free(contextRecord);
+            }
+            if (suspended)
+            {
+                _ = ResumeThread(threadHandle);
+            }
+            _ = CloseHandle(threadHandle);
+        }
+    }
+
+    private static ulong ReadU64(void* contextRecord, int offset)
+    {
+        return *(ulong*)((byte*)contextRecord + offset);
+    }
+
+    [LibraryImport("kernel32.dll")]
+    private static partial uint TlsAlloc();
+
+    [LibraryImport("kernel32.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool TlsFree(uint dwTlsIndex);
+
+    [LibraryImport("kernel32.dll")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool TlsSetValue(uint dwTlsIndex, nint lpTlsValue);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial nint TlsGetValue(uint dwTlsIndex);
+
+    [LibraryImport("kernel32.dll")]
+    private static partial uint GetCurrentThreadId();
+
+    [LibraryImport("kernel32.dll")]
+    private static partial nint GetCurrentThread();
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial nuint SetThreadAffinityMask(nint hThread, nuint dwThreadAffinityMask);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial nint CreateThread(
+        nint lpThreadAttributes,
+        nuint dwStackSize,
+        nint lpStartAddress,
+        nint lpParameter,
+        uint dwCreationFlags,
+        out uint lpThreadId);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial uint WaitForSingleObject(nint hHandle, uint dwMilliseconds);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial nint OpenThread(uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, uint dwThreadId);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial uint SuspendThread(nint hThread);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    private static partial uint ResumeThread(nint hThread);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool GetThreadContext(nint hThread, void* lpContext);
+
+    [LibraryImport("kernel32.dll", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static partial bool CloseHandle(nint hObject);
+
+    [LibraryImport("winmm.dll", EntryPoint = "timeBeginPeriod")]
+    private static partial uint TimeBeginPeriod(uint uPeriod);
+}

src/SharpEmu.HLE/Host/Windows/WindowsWaveOutAudio.cs

@@ -0,0 +1,243 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE.Host.Windows;
+
+internal sealed partial class WindowsWaveOutAudio : IHostAudioOutput
+{
+    public string BackendName => "winmm";
+
+    public IHostAudioStream OpenStereoPcm16Stream(uint sampleRate) => new WaveOutStream(sampleRate);
+
+    private sealed partial class WaveOutStream : IHostAudioStream
+    {
+        private const uint WaveMapper = uint.MaxValue;
+        private const uint CallbackEvent = 0x0005_0000;
+        private const ushort WaveFormatPcm = 1;
+        private const uint WaveHeaderDone = 0x0000_0001;
+        private const int MaximumQueuedPcmBytes = 32 * 1024;
+
+        private readonly object _gate = new();
+        private readonly AutoResetEvent _completion = new(false);
+        private readonly Queue<NativeBuffer> _buffers = new();
+        private IntPtr _device;
+        private int _queuedPcmBytes;
+        private bool _disposed;
+
+        public WaveOutStream(uint sampleRate)
+        {
+            var format = new WaveFormat
+            {
+                FormatTag = WaveFormatPcm,
+                Channels = 2,
+                SamplesPerSecond = sampleRate,
+                AverageBytesPerSecond = checked(sampleRate * 4),
+                BlockAlign = 4,
+                BitsPerSample = 16,
+                ExtraSize = 0,
+            };
+            var result = WaveOutOpen(
+                out _device,
+                WaveMapper,
+                ref format,
+                _completion.SafeWaitHandle.DangerousGetHandle(),
+                IntPtr.Zero,
+                CallbackEvent);
+            if (result != 0)
+            {
+                throw new InvalidOperationException($"waveOutOpen failed with MMRESULT {result}.");
+            }
+        }
+
+        public bool Submit(ReadOnlySpan<byte> stereoPcm16)
+        {
+            lock (_gate)
+            {
+                if (_disposed)
+                {
+                    return false;
+                }
+
+                ReapCompletedBuffers();
+                while (_queuedPcmBytes != 0 &&
+                       _queuedPcmBytes + stereoPcm16.Length > MaximumQueuedPcmBytes)
+                {
+                    if (!_completion.WaitOne(TimeSpan.FromSeconds(1)))
+                    {
+                        return false;
+                    }
+
+                    ReapCompletedBuffers();
+                }
+
+                return QueueBuffer(stereoPcm16);
+            }
+        }
+
+        public void Dispose()
+        {
+            lock (_gate)
+            {
+                if (_disposed)
+                {
+                    return;
+                }
+
+                _disposed = true;
+                if (_device != IntPtr.Zero)
+                {
+                    WaveOutReset(_device);
+                    while (_buffers.TryDequeue(out var buffer))
+                    {
+                        ReleaseBuffer(buffer);
+                    }
+
+                    WaveOutClose(_device);
+                    _device = IntPtr.Zero;
+                }
+
+                _completion.Dispose();
+            }
+        }
+
+        private bool QueueBuffer(ReadOnlySpan<byte> data)
+        {
+            var dataAddress = Marshal.AllocHGlobal(data.Length);
+            var headerAddress = IntPtr.Zero;
+            try
+            {
+                unsafe
+                {
+                    data.CopyTo(new Span<byte>((void*)dataAddress, data.Length));
+                }
+
+                var header = new WaveHeader
+                {
+                    Data = dataAddress,
+                    BufferLength = checked((uint)data.Length),
+                };
+                headerAddress = Marshal.AllocHGlobal(Marshal.SizeOf<WaveHeader>());
+                Marshal.StructureToPtr(header, headerAddress, false);
+
+                var result = WaveOutPrepareHeader(
+                    _device,
+                    headerAddress,
+                    checked((uint)Marshal.SizeOf<WaveHeader>()));
+                if (result != 0)
+                {
+                    return false;
+                }
+
+                result = WaveOutWrite(
+                    _device,
+                    headerAddress,
+                    checked((uint)Marshal.SizeOf<WaveHeader>()));
+                if (result != 0)
+                {
+                    WaveOutUnprepareHeader(
+                        _device,
+                        headerAddress,
+                        checked((uint)Marshal.SizeOf<WaveHeader>()));
+                    return false;
+                }
+
+                _buffers.Enqueue(new NativeBuffer(dataAddress, headerAddress, data.Length));
+                _queuedPcmBytes += data.Length;
+                dataAddress = IntPtr.Zero;
+                headerAddress = IntPtr.Zero;
+                return true;
+            }
+            finally
+            {
+                if (headerAddress != IntPtr.Zero)
+                {
+                    Marshal.FreeHGlobal(headerAddress);
+                }
+
+                if (dataAddress != IntPtr.Zero)
+                {
+                    Marshal.FreeHGlobal(dataAddress);
+                }
+            }
+        }
+
+        private void ReapCompletedBuffers()
+        {
+            while (_buffers.TryPeek(out var buffer))
+            {
+                var header = Marshal.PtrToStructure<WaveHeader>(buffer.Header);
+                if ((header.Flags & WaveHeaderDone) == 0)
+                {
+                    return;
+                }
+
+                _buffers.Dequeue();
+                ReleaseBuffer(buffer);
+            }
+        }
+
+        private void ReleaseBuffer(NativeBuffer buffer)
+        {
+            WaveOutUnprepareHeader(
+                _device,
+                buffer.Header,
+                checked((uint)Marshal.SizeOf<WaveHeader>()));
+            _queuedPcmBytes -= buffer.Length;
+            Marshal.FreeHGlobal(buffer.Header);
+            Marshal.FreeHGlobal(buffer.Data);
+        }
+
+        private readonly record struct NativeBuffer(IntPtr Data, IntPtr Header, int Length);
+
+        [StructLayout(LayoutKind.Sequential, Pack = 2)]
+        private struct WaveFormat
+        {
+            public ushort FormatTag;
+            public ushort Channels;
+            public uint SamplesPerSecond;
+            public uint AverageBytesPerSecond;
+            public ushort BlockAlign;
+            public ushort BitsPerSample;
+            public ushort ExtraSize;
+        }
+
+        [StructLayout(LayoutKind.Sequential)]
+        private struct WaveHeader
+        {
+            public IntPtr Data;
+            public uint BufferLength;
+            public uint BytesRecorded;
+            public nuint User;
+            public uint Flags;
+            public uint Loops;
+            public IntPtr Next;
+            public nuint Reserved;
+        }
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutOpen")]
+        private static partial uint WaveOutOpen(
+            out IntPtr device,
+            uint deviceId,
+            ref WaveFormat format,
+            IntPtr callback,
+            IntPtr instance,
+            uint flags);
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutPrepareHeader")]
+        private static partial uint WaveOutPrepareHeader(IntPtr device, IntPtr header, uint headerSize);
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutWrite")]
+        private static partial uint WaveOutWrite(IntPtr device, IntPtr header, uint headerSize);
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutUnprepareHeader")]
+        private static partial uint WaveOutUnprepareHeader(IntPtr device, IntPtr header, uint headerSize);
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutReset")]
+        private static partial uint WaveOutReset(IntPtr device);
+
+        [LibraryImport("winmm.dll", EntryPoint = "waveOutClose")]
+        private static partial uint WaveOutClose(IntPtr device);
+    }
+}

src/SharpEmu.HLE/Host/Windows/WindowsXInputReader.cs

@@ -3,15 +3,15 @@
 
 using System.Runtime.InteropServices;
 
-namespace SharpEmu.Libs.Pad;
+namespace SharpEmu.HLE.Host.Windows;
 
 /// <summary>
 /// Reads Xbox 360 / Xbox One (and other XInput-compatible) controllers via
-/// the Windows XInput API on a background thread, translated to the same
-/// ORBIS pad conventions as <see cref="DualSenseReader"/>. Supports rumble
-/// and hot-plug retry; the first connected slot (of four) is used.
+/// the Windows XInput API on a background thread, translated to
+/// <see cref="HostGamepadState"/> conventions. Supports rumble and hot-plug
+/// retry; the first connected slot (of four) is used.
 /// </summary>
-internal static class XInputReader
+internal static partial class WindowsXInputReader
 {
     private const uint ErrorSuccess = 0;
     private const int SlotCount = 4;
@@ -34,7 +34,7 @@ internal static class XInputReader
     private const ushort XinputY = 0x8000;
 
     private static readonly object Gate = new();
-    private static PadState _state;
+    private static HostGamepadState _state;
     private static bool _started;
     private static int _slot = -1; // connected XInput user index, -1 when none
     private static byte _motorLeft;
@@ -45,6 +45,8 @@ internal static class XInputReader
     /// <summary>Starts the background reader once; safe to call repeatedly.</summary>
     internal static void EnsureStarted()
     {
+        // The GUI source-links this reader and calls it directly, without the
+        // host-platform resolution that otherwise guarantees Windows.
         if (!OperatingSystem.IsWindows())
         {
             return;
@@ -67,7 +69,7 @@ internal static class XInputReader
         }
     }
 
-    internal static bool TryGetState(out PadState state)
+    internal static bool TryGetState(out HostGamepadState state)
     {
         lock (Gate)
         {
@@ -77,7 +79,7 @@ internal static class XInputReader
         return state.Connected;
     }
 
-    private static void SetState(in PadState state)
+    private static void SetState(in HostGamepadState state)
     {
         lock (Gate)
         {
@@ -204,40 +206,40 @@ internal static class XInputReader
         return -1;
     }
 
-    private static PadState Translate(in XInputGamepad pad)
+    private static HostGamepadState Translate(in XInputGamepad pad)
     {
-        uint buttons = 0;
-        buttons |= (pad.Buttons & XinputDpadUp) != 0 ? OrbisPadButton.Up : 0;
-        buttons |= (pad.Buttons & XinputDpadDown) != 0 ? OrbisPadButton.Down : 0;
-        buttons |= (pad.Buttons & XinputDpadLeft) != 0 ? OrbisPadButton.Left : 0;
-        buttons |= (pad.Buttons & XinputDpadRight) != 0 ? OrbisPadButton.Right : 0;
-        buttons |= (pad.Buttons & XinputStart) != 0 ? OrbisPadButton.Options : 0;
-        buttons |= (pad.Buttons & XinputBack) != 0 ? OrbisPadButton.TouchPad : 0;
-        buttons |= (pad.Buttons & XinputLeftThumb) != 0 ? OrbisPadButton.L3 : 0;
-        buttons |= (pad.Buttons & XinputRightThumb) != 0 ? OrbisPadButton.R3 : 0;
-        buttons |= (pad.Buttons & XinputLeftShoulder) != 0 ? OrbisPadButton.L1 : 0;
-        buttons |= (pad.Buttons & XinputRightShoulder) != 0 ? OrbisPadButton.R1 : 0;
-        buttons |= (pad.Buttons & XinputA) != 0 ? OrbisPadButton.Cross : 0;
-        buttons |= (pad.Buttons & XinputB) != 0 ? OrbisPadButton.Circle : 0;
-        buttons |= (pad.Buttons & XinputX) != 0 ? OrbisPadButton.Square : 0;
-        buttons |= (pad.Buttons & XinputY) != 0 ? OrbisPadButton.Triangle : 0;
-        buttons |= pad.LeftTrigger > TriggerThreshold ? OrbisPadButton.L2 : 0;
-        buttons |= pad.RightTrigger > TriggerThreshold ? OrbisPadButton.R2 : 0;
+        var buttons = HostGamepadButtons.None;
+        buttons |= (pad.Buttons & XinputDpadUp) != 0 ? HostGamepadButtons.Up : 0;
+        buttons |= (pad.Buttons & XinputDpadDown) != 0 ? HostGamepadButtons.Down : 0;
+        buttons |= (pad.Buttons & XinputDpadLeft) != 0 ? HostGamepadButtons.Left : 0;
+        buttons |= (pad.Buttons & XinputDpadRight) != 0 ? HostGamepadButtons.Right : 0;
+        buttons |= (pad.Buttons & XinputStart) != 0 ? HostGamepadButtons.Options : 0;
+        buttons |= (pad.Buttons & XinputBack) != 0 ? HostGamepadButtons.TouchPad : 0;
+        buttons |= (pad.Buttons & XinputLeftThumb) != 0 ? HostGamepadButtons.L3 : 0;
+        buttons |= (pad.Buttons & XinputRightThumb) != 0 ? HostGamepadButtons.R3 : 0;
+        buttons |= (pad.Buttons & XinputLeftShoulder) != 0 ? HostGamepadButtons.L1 : 0;
+        buttons |= (pad.Buttons & XinputRightShoulder) != 0 ? HostGamepadButtons.R1 : 0;
+        buttons |= (pad.Buttons & XinputA) != 0 ? HostGamepadButtons.Cross : 0;
+        buttons |= (pad.Buttons & XinputB) != 0 ? HostGamepadButtons.Circle : 0;
+        buttons |= (pad.Buttons & XinputX) != 0 ? HostGamepadButtons.Square : 0;
+        buttons |= (pad.Buttons & XinputY) != 0 ? HostGamepadButtons.Triangle : 0;
+        buttons |= pad.LeftTrigger > TriggerThreshold ? HostGamepadButtons.L2 : 0;
+        buttons |= pad.RightTrigger > TriggerThreshold ? HostGamepadButtons.R2 : 0;
 
-        return new PadState(
+        return new HostGamepadState(
             Connected: true,
             Buttons: buttons,
             LeftX: AxisToByte(pad.ThumbLX),
             LeftY: AxisToByteInverted(pad.ThumbLY),
             RightX: AxisToByte(pad.ThumbRX),
             RightY: AxisToByteInverted(pad.ThumbRY),
-            L2: pad.LeftTrigger,
-            R2: pad.RightTrigger);
+            LeftTrigger: pad.LeftTrigger,
+            RightTrigger: pad.RightTrigger);
     }
 
     private static byte AxisToByte(short value) => (byte)((value + 32768) >> 8);
 
-    // XInput Y grows upward, ORBIS pads report Y growing downward.
+    // XInput Y grows upward, host pad conventions report Y growing downward.
     private static byte AxisToByteInverted(short value) => (byte)(255 - ((value + 32768) >> 8));
 
     [StructLayout(LayoutKind.Sequential)]
@@ -267,9 +269,9 @@ internal static class XInputReader
     }
 
     // xinput1_4.dll ships with Windows 8 and later.
-    [DllImport("xinput1_4.dll")]
-    private static extern uint XInputGetState(uint userIndex, out XInputState state);
+    [LibraryImport("xinput1_4.dll")]
+    private static partial uint XInputGetState(uint userIndex, out XInputState state);
 
-    [DllImport("xinput1_4.dll")]
-    private static extern uint XInputSetState(uint userIndex, ref XInputVibration vibration);
+    [LibraryImport("xinput1_4.dll")]
+    private static partial uint XInputSetState(uint userIndex, ref XInputVibration vibration);
 }

src/SharpEmu.HLE/HostMainThread.cs

@@ -0,0 +1,78 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Collections.Concurrent;
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Runs work on the real process main thread. macOS only allows AppKit (and
+/// therefore GLFW windowing) on that thread, so the CLI moves emulation onto
+/// a worker thread, parks the main thread in <see cref="Pump"/>, and the
+/// video presenter posts its window loop here. On other platforms
+/// <see cref="IsAvailable"/> stays false and nothing changes.
+/// </summary>
+public static class HostMainThread
+{
+    private static readonly BlockingCollection<Action> _work = new();
+    private static Action? _shutdownRequestHandler;
+
+    public static bool IsAvailable { get; private set; }
+
+    /// <summary>
+    /// Registers a callback invoked by <see cref="Shutdown"/> so a
+    /// long-running posted work item (the presenter's window loop) can be
+    /// asked to return to the pump.
+    /// </summary>
+    public static void SetShutdownRequestHandler(Action handler) =>
+        _shutdownRequestHandler = handler;
+
+    /// <summary>Marks the pump as present. Call before guest code can run.</summary>
+    public static void Enable() => IsAvailable = true;
+
+    public static void Post(Action work)
+    {
+        try
+        {
+            _work.Add(work);
+        }
+        catch (InvalidOperationException)
+        {
+            // Shutdown already requested; the process is exiting.
+        }
+    }
+
+    /// <summary>
+    /// Services posted work on the calling (main) thread until
+    /// <see cref="Shutdown"/> is called and the queue drains.
+    /// </summary>
+    public static void Pump()
+    {
+        foreach (var work in _work.GetConsumingEnumerable())
+        {
+            try
+            {
+                work();
+            }
+            catch (Exception exception)
+            {
+                Console.Error.WriteLine($"[LOADER][ERROR] Main-thread work failed: {exception}");
+            }
+        }
+    }
+
+    public static void Shutdown()
+    {
+        IsAvailable = false;
+        try
+        {
+            _shutdownRequestHandler?.Invoke();
+        }
+        catch (Exception exception)
+        {
+            Console.Error.WriteLine($"[LOADER][WARN] Main-thread shutdown handler failed: {exception.Message}");
+        }
+
+        _work.CompleteAdding();
+    }
+}

src/SharpEmu.HLE/HostMemory.cs

@@ -0,0 +1,498 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+using System.Runtime.InteropServices;
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Cross-platform host virtual memory API with Win32 semantics.
+/// On Windows this forwards directly to kernel32. On POSIX systems it is
+/// implemented over mmap/mprotect/munmap with a shadow region table that
+/// answers VirtualQuery-style questions and tracks page protections.
+/// POSIX anonymous mappings are demand-paged by the kernel, so Win32
+/// "reserve-only" regions are mapped as committed memory directly and
+/// commit requests become protection changes.
+/// </summary>
+public static unsafe class HostMemory
+{
+    public const uint MEM_COMMIT = 0x1000;
+    public const uint MEM_RESERVE = 0x2000;
+    public const uint MEM_RELEASE = 0x8000;
+    public const uint MEM_FREE_STATE = 0x10000;
+    public const uint MEM_PRIVATE = 0x20000;
+
+    public const uint PAGE_NOACCESS = 0x01;
+    public const uint PAGE_READONLY = 0x02;
+    public const uint PAGE_READWRITE = 0x04;
+    public const uint PAGE_EXECUTE = 0x10;
+    public const uint PAGE_EXECUTE_READ = 0x20;
+    public const uint PAGE_EXECUTE_READWRITE = 0x40;
+
+    private const ulong PageSize = 0x1000;
+
+    /// <summary>Win32 MEMORY_BASIC_INFORMATION (64-bit) layout.</summary>
+    public struct BasicInfo
+    {
+        public ulong BaseAddress;
+        public ulong AllocationBase;
+        public uint AllocationProtect;
+        public uint Alignment1;
+        public ulong RegionSize;
+        public uint State;
+        public uint Protect;
+        public uint Type;
+        public uint Alignment2;
+    }
+
+    public static void* Alloc(void* address, nuint size, uint allocationType, uint protect)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            return Win32VirtualAlloc(address, size, allocationType, protect);
+        }
+
+        return Posix.Alloc(address, size, allocationType, protect);
+    }
+
+    public static bool Free(void* address, nuint size, uint freeType)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            return Win32VirtualFree(address, size, freeType);
+        }
+
+        return Posix.Free(address, size, freeType);
+    }
+
+    public static bool Protect(void* address, nuint size, uint newProtect, out uint oldProtect)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            return Win32VirtualProtect(address, size, newProtect, out oldProtect);
+        }
+
+        return Posix.Protect(address, size, newProtect, out oldProtect);
+    }
+
+    public static nuint Query(void* address, out BasicInfo info)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            return Win32VirtualQuery(address, out info, (nuint)sizeof(BasicInfo));
+        }
+
+        return Posix.Query(address, out info);
+    }
+
+    public static void FlushInstructionCache(void* address, nuint size)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            Win32FlushInstructionCache(Win32GetCurrentProcess(), address, size);
+            return;
+        }
+
+        // The emulator only executes x86-64 guest code, so a non-Windows host
+        // is either x86-64 (including Rosetta 2 translation) with a coherent
+        // instruction cache, or would need sys_icache_invalidate for a future
+        // arm64 recompiler. Nothing to do today.
+    }
+
+    [DllImport("kernel32.dll", EntryPoint = "VirtualAlloc", SetLastError = true)]
+    private static extern void* Win32VirtualAlloc(void* lpAddress, nuint dwSize, uint flAllocationType, uint flProtect);
+
+    [DllImport("kernel32.dll", EntryPoint = "VirtualFree", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool Win32VirtualFree(void* lpAddress, nuint dwSize, uint dwFreeType);
+
+    [DllImport("kernel32.dll", EntryPoint = "VirtualProtect", SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool Win32VirtualProtect(void* lpAddress, nuint dwSize, uint flNewProtect, out uint lpflOldProtect);
+
+    [DllImport("kernel32.dll", EntryPoint = "VirtualQuery")]
+    private static extern nuint Win32VirtualQuery(void* lpAddress, out BasicInfo lpBuffer, nuint dwLength);
+
+    [DllImport("kernel32.dll", EntryPoint = "GetCurrentProcess")]
+    private static extern void* Win32GetCurrentProcess();
+
+    [DllImport("kernel32.dll", EntryPoint = "FlushInstructionCache")]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool Win32FlushInstructionCache(void* hProcess, void* lpBaseAddress, nuint dwSize);
+
+    private static class Posix
+    {
+        private const int PROT_NONE = 0x0;
+        private const int PROT_READ = 0x1;
+        private const int PROT_WRITE = 0x2;
+        private const int PROT_EXEC = 0x4;
+
+        private const int MAP_PRIVATE = 0x02;
+        private const int MAP_FIXED = 0x10;
+        private static readonly int MAP_ANON = OperatingSystem.IsMacOS() ? 0x1000 : 0x20;
+        private static readonly int MAP_NORESERVE = OperatingSystem.IsMacOS() ? 0 : 0x4000;
+
+        // Linux-only: fail instead of clobbering an existing mapping.
+        private const int MAP_FIXED_NOREPLACE = 0x100000;
+
+        private static readonly nint MAP_FAILED = -1;
+
+        private static readonly object Gate = new();
+        private static readonly SortedList<ulong, Region> Regions = new();
+
+        private sealed class Region
+        {
+            public ulong Base;
+            public ulong Size;
+            public uint DefaultProtect;
+            public Dictionary<ulong, uint>? PageProtects;
+
+            public ulong End => Base + Size;
+
+            public uint ProtectAt(ulong pageAddress)
+            {
+                if (PageProtects is not null && PageProtects.TryGetValue(pageAddress, out var overriden))
+                {
+                    return overriden;
+                }
+
+                return DefaultProtect;
+            }
+        }
+
+        public static void* Alloc(void* address, nuint size, uint allocationType, uint protect)
+        {
+            if (size == 0)
+            {
+                return null;
+            }
+
+            var alignedSize = AlignUp((ulong)size, PageSize);
+
+            lock (Gate)
+            {
+                if (allocationType == MEM_COMMIT && address != null &&
+                    TryFindRegionLocked((ulong)address, out var existing))
+                {
+                    // Note: MEM_RESERVE requests that overlap an existing
+                    // region must fail like Win32 does; only a pure commit
+                    // may target pages inside a tracked mapping.
+                    // Commit inside an existing mapping: the pages are already
+                    // backed (demand paged), so only apply the protection.
+                    var start = AlignDown((ulong)address, PageSize);
+                    var end = Math.Min(existing.End, AlignUp((ulong)address + alignedSize, PageSize));
+                    if (end <= start)
+                    {
+                        return null;
+                    }
+
+                    if (mprotect((nint)start, (nuint)(end - start), ToPosixProtect(protect)) != 0)
+                    {
+                        return null;
+                    }
+
+                    SetProtectRangeLocked(existing, start, end - start, protect);
+                    return address;
+                }
+
+                if ((allocationType & MEM_RESERVE) == 0)
+                {
+                    // MEM_COMMIT alone outside any known region is invalid here.
+                    return null;
+                }
+
+                var posixProtect = ToPosixProtect(protect);
+                var flags = MAP_PRIVATE | MAP_ANON;
+                if ((allocationType & MEM_COMMIT) == 0)
+                {
+                    // Reserve-only: keep the requested protection so the region
+                    // is usable without a separate commit step, but tell the
+                    // kernel not to account swap for it where supported.
+                    flags |= MAP_NORESERVE;
+                }
+
+                nint result;
+                if (address != null)
+                {
+                    // Win32 maps at exactly the requested address or fails
+                    // without touching existing mappings. Fail up front on
+                    // any overlap we track, then place the mapping: Linux
+                    // gets MAP_FIXED_NOREPLACE (fails cleanly on host
+                    // mappings too). Darwin lacks NOREPLACE and plain
+                    // MAP_FIXED would silently clobber untracked host
+                    // memory (dyld, the runtime's JIT heap, Rosetta), so
+                    // pass the address as a hint instead -- the kernel
+                    // honors it when the range is free and relocates the
+                    // mapping otherwise, which we treat as failure.
+                    if (OverlapsTrackedRegionLocked((ulong)address, alignedSize))
+                    {
+                        Trace($"exact overlap: addr=0x{(ulong)address:X16} size=0x{alignedSize:X}");
+                        return null;
+                    }
+
+                    var exactFlags = OperatingSystem.IsMacOS() ? flags : flags | MAP_FIXED_NOREPLACE;
+                    result = mmap((nint)address, (nuint)alignedSize, posixProtect, exactFlags, -1, 0);
+                    if (result == MAP_FAILED || (ulong)result != (ulong)address)
+                    {
+                        Trace($"exact mmap failed: addr=0x{(ulong)address:X16} got=0x{(ulong)result:X16} size=0x{alignedSize:X} errno={Marshal.GetLastPInvokeError()}");
+                        if (result != MAP_FAILED)
+                        {
+                            munmap(result, (nuint)alignedSize);
+                        }
+
+                        return null;
+                    }
+                }
+                else
+                {
+                    result = mmap(0, (nuint)alignedSize, posixProtect, flags, -1, 0);
+                    if (result == MAP_FAILED)
+                    {
+                        Trace($"mmap failed: size=0x{alignedSize:X} errno={Marshal.GetLastPInvokeError()}");
+                        return null;
+                    }
+                }
+
+                Regions[(ulong)result] = new Region
+                {
+                    Base = (ulong)result,
+                    Size = alignedSize,
+                    DefaultProtect = protect
+                };
+
+                return (void*)result;
+            }
+        }
+
+        public static bool Free(void* address, nuint size, uint freeType)
+        {
+            _ = size;
+            _ = freeType;
+
+            lock (Gate)
+            {
+                if (!Regions.TryGetValue((ulong)address, out var region))
+                {
+                    return false;
+                }
+
+                Regions.Remove((ulong)address);
+                return munmap((nint)address, (nuint)region.Size) == 0;
+            }
+        }
+
+        public static bool Protect(void* address, nuint size, uint newProtect, out uint oldProtect)
+        {
+            oldProtect = PAGE_NOACCESS;
+            if (size == 0)
+            {
+                return false;
+            }
+
+            var start = AlignDown((ulong)address, PageSize);
+            var end = AlignUp((ulong)address + size, PageSize);
+
+            lock (Gate)
+            {
+                if (!TryFindRegionLocked(start, out var region) || end > region.End)
+                {
+                    return false;
+                }
+
+                oldProtect = region.ProtectAt(start);
+                if (mprotect((nint)start, (nuint)(end - start), ToPosixProtect(newProtect)) != 0)
+                {
+                    return false;
+                }
+
+                SetProtectRangeLocked(region, start, end - start, newProtect);
+                return true;
+            }
+        }
+
+        public static nuint Query(void* address, out BasicInfo info)
+        {
+            info = default;
+            var pageAddress = AlignDown((ulong)address, PageSize);
+
+            lock (Gate)
+            {
+                if (TryFindRegionLocked(pageAddress, out var region))
+                {
+                    // Win32 VirtualQuery reports a run of pages sharing the
+                    // same protection, so stop the run where it changes. Do
+                    // not walk the whole mapping page-by-page here: PS5 GPU
+                    // apertures can span hundreds of GiB, while protection
+                    // overrides are sparse. A tiny read inside such a mapping
+                    // otherwise performs tens of millions of dictionary
+                    // lookups before it can return.
+                    var pageProtects = region.PageProtects;
+                    uint protect;
+                    ulong runEnd;
+                    if (pageProtects is null || pageProtects.Count == 0)
+                    {
+                        protect = region.DefaultProtect;
+                        runEnd = region.End;
+                    }
+                    else if (pageProtects.TryGetValue(pageAddress, out protect))
+                    {
+                        runEnd = pageAddress + PageSize;
+                        while (runEnd < region.End &&
+                            pageProtects.TryGetValue(runEnd, out var nextProtect) &&
+                            nextProtect == protect)
+                        {
+                            runEnd += PageSize;
+                        }
+                    }
+                    else
+                    {
+                        protect = region.DefaultProtect;
+                        runEnd = region.End;
+                        foreach (var overrideAddress in pageProtects.Keys)
+                        {
+                            if (overrideAddress > pageAddress && overrideAddress < runEnd)
+                            {
+                                runEnd = overrideAddress;
+                            }
+                        }
+                    }
+
+                    info.BaseAddress = pageAddress;
+                    info.AllocationBase = region.Base;
+                    info.AllocationProtect = region.DefaultProtect;
+                    info.RegionSize = runEnd - pageAddress;
+                    info.State = MEM_COMMIT;
+                    info.Protect = protect;
+                    info.Type = MEM_PRIVATE;
+                    return (nuint)sizeof(BasicInfo);
+                }
+
+                // Untracked host memory (runtime heaps, stacks, libraries) is
+                // reported as a free block reaching to the next tracked region
+                // so scanning callers keep advancing.
+                var nextBase = ulong.MaxValue;
+                foreach (var regionBase in Regions.Keys)
+                {
+                    if (regionBase > pageAddress)
+                    {
+                        nextBase = regionBase;
+                        break;
+                    }
+                }
+
+                info.BaseAddress = pageAddress;
+                info.AllocationBase = 0;
+                info.AllocationProtect = PAGE_NOACCESS;
+                info.RegionSize = (nextBase == ulong.MaxValue ? pageAddress + PageSize : nextBase) - pageAddress;
+                info.State = MEM_FREE_STATE;
+                info.Protect = PAGE_NOACCESS;
+                info.Type = 0;
+                return (nuint)sizeof(BasicInfo);
+            }
+        }
+
+        private static bool OverlapsTrackedRegionLocked(ulong start, ulong size)
+        {
+            var end = start + size;
+            foreach (var region in Regions.Values)
+            {
+                if (region.Base < end && start < region.End)
+                {
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
+        private static bool TryFindRegionLocked(ulong address, out Region region)
+        {
+            region = null!;
+            var keys = Regions.Keys;
+            var low = 0;
+            var high = keys.Count - 1;
+            Region? candidate = null;
+            while (low <= high)
+            {
+                var middle = low + ((high - low) >> 1);
+                var entry = Regions.Values[middle];
+                if (entry.Base <= address)
+                {
+                    candidate = entry;
+                    low = middle + 1;
+                }
+                else
+                {
+                    high = middle - 1;
+                }
+            }
+
+            if (candidate is null || address >= candidate.End)
+            {
+                return false;
+            }
+
+            region = candidate;
+            return true;
+        }
+
+        private static void SetProtectRangeLocked(Region region, ulong start, ulong size, uint protect)
+        {
+            if (start == region.Base && size >= region.Size)
+            {
+                region.DefaultProtect = protect;
+                region.PageProtects = null;
+                return;
+            }
+
+            region.PageProtects ??= new Dictionary<ulong, uint>();
+            var end = start + size;
+            for (var pageAddress = start; pageAddress < end; pageAddress += PageSize)
+            {
+                if (protect == region.DefaultProtect)
+                {
+                    region.PageProtects.Remove(pageAddress);
+                }
+                else
+                {
+                    region.PageProtects[pageAddress] = protect;
+                }
+            }
+        }
+
+        private static int ToPosixProtect(uint win32Protect)
+        {
+            return win32Protect switch
+            {
+                PAGE_NOACCESS => PROT_NONE,
+                PAGE_READONLY => PROT_READ,
+                PAGE_READWRITE => PROT_READ | PROT_WRITE,
+                PAGE_EXECUTE => PROT_READ | PROT_EXEC,
+                PAGE_EXECUTE_READ => PROT_READ | PROT_EXEC,
+                PAGE_EXECUTE_READWRITE => PROT_READ | PROT_WRITE | PROT_EXEC,
+                _ => PROT_READ | PROT_WRITE
+            };
+        }
+
+        private static void Trace(string message)
+        {
+            if (string.Equals(Environment.GetEnvironmentVariable("SHARPEMU_LOG_VMEM"), "1", StringComparison.Ordinal))
+            {
+                Console.Error.WriteLine($"[HOSTMEM] {message}");
+            }
+        }
+
+        private static ulong AlignDown(ulong value, ulong alignment) => value & ~(alignment - 1);
+
+        private static ulong AlignUp(ulong value, ulong alignment) => checked((value + alignment - 1) & ~(alignment - 1));
+
+        [DllImport("libc", SetLastError = true)]
+        private static extern nint mmap(nint addr, nuint length, int prot, int flags, int fd, long offset);
+
+        [DllImport("libc", SetLastError = true)]
+        private static extern int munmap(nint addr, nuint length);
+
+        [DllImport("libc", SetLastError = true)]
+        private static extern int mprotect(nint addr, nuint length, int prot);
+    }
+}

src/SharpEmu.HLE/HostSessionControl.cs

@@ -0,0 +1,31 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Lets host-facing libraries (VideoOut, AudioOut) request cooperative guest
+/// shutdown without taking a dependency on SharpEmu.Core.
+/// </summary>
+public static class HostSessionControl
+{
+    private static Action<string>? _shutdownHandler;
+
+    public static void SetShutdownHandler(Action<string>? handler)
+    {
+        Volatile.Write(ref _shutdownHandler, handler);
+    }
+
+    public static void RequestShutdown(string reason)
+    {
+        try
+        {
+            Volatile.Read(ref _shutdownHandler)?.Invoke(reason);
+        }
+        catch (Exception exception)
+        {
+            Console.Error.WriteLine(
+                $"[LOADER][WARN] Host shutdown handler failed: {exception.Message}");
+        }
+    }
+}

src/SharpEmu.HLE/ICpuMemoryWrapper.cs

@@ -0,0 +1,14 @@
+// Copyright (C) 2026 SharpEmu Emulator Project
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+namespace SharpEmu.HLE;
+
+/// <summary>
+/// Implemented by memories that decorate another <see cref="ICpuMemory"/>
+/// (e.g. access trackers) so capability lookups can unwrap to the real
+/// implementation without reflection.
+/// </summary>
+public interface ICpuMemoryWrapper
+{
+    ICpuMemory Inner { get; }
+}