[atharvjairath]

What

Implement X509_EXTENSION_get_critical, X509_EXTENSION_get_data and X509_EXTENSION_get_object in libSceLibreSsl. Callers can read an extension's critical flag and borrowed ASN.1 object/data pointers instead of hitting unsupported-export exceptions. Null extensions return zero/null; the critical flag is true only for a positive signed 32-bit value, so the upstream default -1 remains false. Pointer values are returned unchanged without decoding, copying or taking ownership.

The contract follows LibreSSL 2.5.4 x509_v3.c and the 24-byte LP64 layout in x509.h. The implementation reads only the requested field, using fixed-width critical storage and byte copies to avoid aliasing assumptions. Published firmware 13.40 measurements identify this module as LibreSSL 2.5.4. These getters and this layout have not been independently measured on a console; that limitation is recorded in the existing debt file.

The progress scanner counts three additional completed functions on the same main baseline (main: 90/401; this PR: 93/401), corresponding exactly to these three exported getters. Its denominator also includes main's new CompareObjects and LoadFile helper callbacks, so 401 is not an export inventory or a compatibility measure. The actual unsupported-export block contains 296 exports, recounted from source against main's 299. The scanner also marks ten APIs outside that block incomplete: ASN1_INTEGER_get, SSL_select_next_proto, ERR_remove_thread_state, i2t_ASN1_OBJECT, X509_STORE_add_lookup, X509_STORE_free, X509_STORE_set_flags, X509_VERIFY_PARAM_set1_host, X509_VERIFY_PARAM_set1_ip_asc and X509_VERIFY_PARAM_set_hostflags. Main's implementations and partial implementations are not attributed to this PR.

Landing status: This single extension-getter follow-up is based on main 2960e9a6e7e1fc99c4ed180c71495b5eb83464c7, with no open prerequisites. The refresh resolves a debt conflict after #11189's X509_VERIFY_PARAM_set1_host merged. It retains main's entire implementation, canonical declaration, expanded host-name/allocation tests and debt entry. Every own production/header/CMake/fixture patch addition and deletion is unchanged from the prior follow-up. The actual unsupported-export count is main 299, this branch 296. The earlier pending-count review remains addressed. All earlier store/lookup/verification-parameter, ExData, store-context, ObjectText/ObjectTable, PKEY, protocol, ASN.1 and LibreSSL3 source/test/debt unions remain intact. Main's improvements are not attributed to these three getters.

The public-header review is addressed by replacing the three extension getter placeholders in include/Api.hpp with their documented signatures. The fixture uses the public umbrella header without duplicate local declarations. Main now provides the canonical cipher declarations. Getter bodies and regression assertions are unchanged.

Tested

Linux passed all 33 tests; Windows PE through Wine/QEMU passed 28 of 33. UI and the normal X509 store, verification-parameter and lookup tests time out after 0xc000001d/liblibc.dll+0xc75a4. ExData times out with St12system_error/guest_libressl_ex_data_tests.exe+0x9758 and missing unwind data. A freshly rebuilt complete LibreSSL DLL from exact main base 2960e9a6e7e1fc99c4ed180c71495b5eb83464c7, including protocol selection and the merged host-name support but excluding our getters, reproduces all five failures with the same rebuilt libc/mbedcrypto and unchanged test executables. The four primary libc fault offsets and ExData exception/offset match; Wine loader traces confirm every control loaded the separate main DLL. These remain validation limitations. No new runtime switch, assertion change or production workaround was added. Failure/control logs and artifact hashes are retained in /private/tmp/anyps5-monitor-20261029-1200.

Exact tested head: f0e1f6b3818cc2542ff7fc3f08b69fab5608cda0; parent and main base: 2960e9a6e7e1fc99c4ed180c71495b5eb83464c7; tree: 1a10fc6fc4dabc09452278a72e23f250b4cf7ee8. Recovery ref: backup/pr-10078-before-verify-host-refresh-20261029-1200 preserves prior remote head 7321dc0124cc087a3e8b38e6ea9fdcc0daea895f. Author and committer: atharvjairath <54663702+atharvjairath@users.noreply.github.com>.

• Linux x86-64, Ubuntu 24.04/GCC 13.3 Release under native ARM QEMU 11.0.3: 33/33 passed, 2.53 s total.
• Windows x86-64, WinLibs GCC15.2.0 UCRT r7 Release through Wine9/QEMU11.0.3: 28/33 passed, 246.98 s total; UI, ExData and the three normal store/verification-parameter/lookup tests timed out as described above.
• The complete real libc, LibreSSL and LibreSSL3 libraries were rebuilt. The same 33 registrations are retained, with main's expanded X509 store host-name and allocation cases. All tests pass on Linux; all three store/verification-parameter/lookup allocator cases also pass under Wine. All fixtures other than the five limitations named above pass on both tested platforms, including the getter and store-context fixtures. The object-allocation fixture covers 18 fast cases and 144 allocation-fault cases, with 740 checks and no failures, escaped exceptions or live allocations on both tested platforms. The 1,100 extension cases and cipher alias/full-width-ID assertions remain intact. The unmodified protocol fixture tests the source export through the real DLL; its separately packaged-NID fixture and whole-product packaging were not run by this focused harness.
• Conventions after committing, whitespace checks and the public-header audit pass (373 libraries, 13,414 exports). The LibreSSL umbrella compiles standalone, included twice, with Linux C++20 and -Werror. Implementation and fixtures compile against the canonical declarations on both tested platforms.
• The exact CLI overlap scan and manual shared-file review found no independent duplicate of these extension getters. All 34 external report peers were independently checked at their current heads. Twenty-six exact unchanged heads/shared payloads retain the earlier reviewed baseline; six changed existing peers change only count labels in normalized full-patch deltas. New feat(libSceLibreSsl): implement the method getters and SSL_CTX and SSL lifecycle #12729 and feat(libSceLibreSsl): implement SSL_connect, SSL_read, SSL_write and the rest of TLS I/O over mbedtls #12730 add distinct SSL lifecycle/BIO and TLS I/O work; their complete shared payloads were reviewed, with no prerequisite for our getters. Main's canonical source/test/debt unions and our getter additions must both survive future integrations. No unmerged implementation was imported. Self-comparisons against this PR's previous remote revision are not competing work.
• The Windows matrix retains APS5_NO_WRITE_WATCH=1 only for guest_libressl_runtime and guest_libressl_asn1. The separate ASN.1 allocator test and all other cases run without it. Assertions and production checks remain enabled; no new workaround was introduced.

The earlier refresh on main 6bc113969895900890ae9bb4c473beb840ba12db initially passed 11/13 tests with default Wine write watching; runtime and ASN.1 conversion timed out after 0xc000001d at GuestHeap::allocate, liblibc.dll+0xb8624. Its exact-main control excluded our getters, rebuilt all LibreSSL sources with the same libc/mbedcrypto and unchanged upstream fixtures, reproduced both faults, then passed with APS5_NO_WRITE_WATCH=1. Those failure/control logs are retained. This refresh rebuilds the complete real libraries and libc and retains that setting only for those same two tests; UI, ExData, store-context, store/verification-parameter/lookup normal and allocator cases, PKEY, protocol, ASN.1 decoder, key-reference, object-text/allocation and other tests use defaults. Historical negative controls and the earlier runtime/ASN.1 default-Wine controls were not rerun on the new base; the fresh exact-main controls above reproduce all five current failures, including matching primary libc offsets and ExData exception/offset. Default Windows page write watching remains unvalidated here; no source assertion or production check was disabled.

Merge/source audit: All three active owned branches merge cleanly with main 2960e9a6e7e1fc99c4ed180c71495b5eb83464c7. The extension runtime-tested head is directly based on that revision. The complete real libc was rebuilt for this focused matrix, including the shared source changes inspected in the intervening source audits. Since the last audit, main's math fixtures only add source-location failure diagnostics without changing assertions. The new host-name setter and expanded store tests are byte-identical to main. The external harness retains main's quoted HostStandardStreams include path; its MinGW host-only helper convention does not apply to these guest-linked targets. The unchanged CES and HTTP branches were not rebuilt during this refresh. This focused matrix and scoped source/merge review do not establish whole-project runtime coverage.

Later-main audit: Main subsequently advanced to edf6804cf52c62eacafc592dd6142cb4efe5bd05. All three clean local merge previews retain every own patch payload. New CES null-input assertions and macOS interface-address support were inspected and preserved; other changed paths received scoped path review. This does not extend the exact runtime coverage beyond the tested base above.

Separate firmware report: BunnyFl reports testing firmware 13.42's library in an emulator. Offset-marker inputs produced object/data reads at 0/16, a signed critical field at 8 with critical > 0, and null results for null extensions in two runs. This agrees with this implementation. It is attributed emulated-library evidence, not independent hardware validation here or a review approval.

Separate contributor evidence: benjaminmathias reports native Windows validation of previous extension head cb6734063f5fd3f4d7612eea44fff5749fbe4454, including cipher 0390178ba06a360f4c4799725bf0699e3a3c4916, integrated with main 16ff208dc32cf3927ba1bae492eee363a5ae7ae8. On Windows 11 Pro with WinLibs GCC 15.2 UCRT, the runtime, ASN.1 conversion, ASN.1 allocator, cipher and extension tests each passed three repetitions with APS5_NO_WRITE_WATCH unset. The report also records failing main-library controls for the two getter fixtures and passing results after restoring the candidate library. This is attributed evidence for those test paths on that pinned integration, not independent reproduction here, approval, or native validation of the refreshed head above. Logs and hashes are retained by the contributor.

The refreshed tree has not been run on native Windows here. Whole-project, title and PS5 console validation were not performed; console layout and ABI limitations remain. Full upstream product CI requires maintainer dispatch.

Focused runtime build recipe

Use this CMake project outside the checkout, with repository-pinned ZArchive, zstd and mbedTLS checkouts under its 3rdparty/ directory (mbedTLS 068ff080b369adfac81509f9b57b2afabaf82dc5, including its pinned framework submodule):

cmake_minimum_required(VERSION 3.20)
project(ExtensionValidation LANGUAGES CXX)
enable_testing()
set(CMAKE_CXX_STANDARD 20)
set(BUILD_TESTING ON)
set(ANYPS5_SOURCE_ROOT /src CACHE PATH "AnyPS5 source checkout")
set(LIBS_INCLUDE_DIR ${ANYPS5_SOURCE_ROOT}/core/libs)
set(ANYPS5_TEST_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/tests)
set(ANYPS5_WINDOWS_TEST_EXIT ${ANYPS5_SOURCE_ROOT}/cmake/WindowsTestExit.cpp)
add_compile_options(-ffunction-sections -fdata-sections)
add_link_options(-Wl,--gc-sections)
function(add_test_executable target)
    add_executable(${target} ${ARGN})
    set_target_properties(${target} PROPERTIES RUNTIME_OUTPUT_DIRECTORY "$<1:${ANYPS5_TEST_OUTPUT_DIRECTORY}>")
    if(MINGW)
        target_sources(${target} PRIVATE "${ANYPS5_WINDOWS_TEST_EXIT}")
        target_link_options(${target} PRIVATE LINKER:--wrap=main)
    endif()
endfunction()
function(add_asan_test_options test options)
    if(ANYPS5_ENABLE_ASAN)
        set_property(TEST ${test} APPEND PROPERTY ENVIRONMENT_MODIFICATION "ASAN_OPTIONS=string_append::${options}")
    endif()
endfunction()
function(configure_windows_unwind target)
    if(MINGW)
        if(NOT EXISTS "${CMAKE_OBJCOPY}")
            message(FATAL_ERROR "Windows DWARF unwinding requires objcopy")
        endif()
        add_custom_command(TARGET ${target} POST_BUILD
                COMMAND "${CMAKE_OBJCOPY}" --rename-section .eh_frame=.ehfram --rename-section .eh_fram=.ehfram "$<TARGET_FILE:${target}>"
                VERBATIM
        )
    endif()
endfunction()
if(MINGW)
    add_compile_options(-fno-asynchronous-unwind-tables)
endif()
include(${ANYPS5_SOURCE_ROOT}/cmake/ZArchive.cmake)
set(BUILD_TESTING OFF)
add_library(libc SHARED)
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libc libc)
configure_windows_unwind(libc)
if(WIN32)
    target_compile_options(libc PRIVATE "SHELL:-include \"${LIBS_INCLUDE_DIR}/prx/libc/include/HostStandardStreams.hpp\"")
endif()
if(CMAKE_SYSTEM_NAME STREQUAL "Linux")
    target_link_options(libc PRIVATE LINKER:-z,now)
    target_link_options(libc INTERFACE LINKER:--no-as-needed)
endif()
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libSceSsl ssl)
set(BUILD_TESTING ON)
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libSceLibreSsl libressl)
add_subdirectory(${ANYPS5_SOURCE_ROOT}/core/libs/prx/libSceLibreSsl3 libressl3)
foreach(target IN ITEMS libSceLibreSsl libSceLibreSsl3)
    target_link_libraries(${target} PUBLIC libc)
    if(WIN32)
        target_compile_options(${target} PRIVATE "SHELL:-include \"${LIBS_INCLUDE_DIR}/prx/libc/include/HostStandardStreams.hpp\"")
    endif()
endforeach()

target_sources(libSceLibreSsl PRIVATE ${ANYPS5_SOURCE_ROOT}/core/libs/prx/libSceLibreSsl/src/ProtocolSelection.cpp)
add_test_executable(guest_libressl_protocol_tests ${LIBS_INCLUDE_DIR}/tests/GuestLibreSslProtocol.cpp)
target_include_directories(guest_libressl_protocol_tests PRIVATE ${LIBS_INCLUDE_DIR})
target_link_libraries(guest_libressl_protocol_tests PRIVATE ${CMAKE_DL_LIBS})
if(WIN32)
    target_link_libraries(guest_libressl_protocol_tests PRIVATE libc)
endif()
add_dependencies(guest_libressl_protocol_tests libSceLibreSsl)
configure_windows_unwind(guest_libressl_protocol_tests)
add_test(NAME guest_libressl_protocol COMMAND guest_libressl_protocol_tests $<TARGET_FILE:libSceLibreSsl> SSL_select_next_proto_nid_postfix)
set_tests_properties(guest_libressl_protocol PROPERTIES TIMEOUT 30)

Configure with -DANYPS5_SOURCE_ROOT=<checkout> -DCMAKE_BUILD_TYPE=Release, build, then run ctest --test-dir <build> --output-on-failure. Linux in this environment sets CMAKE_CROSSCOMPILING_EMULATOR to the native ARM QEMU 11.0.3 x86-64 binary; omit this on native x86-64 Linux. Windows builds use WinLibs GCC 15.2.0 UCRT r7 and compile serially under Wine. The actual Windows executables run through QEMU/Wine with WINELOADERNOEXEC=1, WINEPREFIX=/build/wine, and WINEPATH containing the build directory, both LibreSSL DLL directories and WinLibs bin.

For the reported Wine run, the external Windows CTest manifest additionally sets ENVIRONMENT "APS5_NO_WRITE_WATCH=1" only on guest_libressl_runtime and guest_libressl_asn1, because Wine page write watching faults in this environment. The separate contributor report above covers those default native Windows paths on its pinned earlier integration; the refreshed head has not been tested natively on Windows here.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

[github-actions]

Progress report (edf6804 → f0e1f6b)

📈 System libraries: 45.93% (+0.02%, +3 implemented functions)

✅ 3 implemented

Library	Name
libSceLibreSsl	X509_EXTENSION_get_critical_nid_postfix
libSceLibreSsl	X509_EXTENSION_get_data_nid_postfix
libSceLibreSsl	X509_EXTENSION_get_object_nid_postfix

Changed libraries (implemented exports)

Library	Before	After	Change
libSceLibreSsl	90/401 (22.44%)	93/401 (23.19%)	+0.75 pp

[github-actions]

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request	Conflicting files (lines on main)	Same exports	Same new files
PR 9448	docs/dev/debt/libSceLibreSsl.md L10
PR 9571	docs/dev/debt/libSceLibreSsl.md L10
PR 10395	docs/dev/debt/libSceLibreSsl.md L10
PR 10915	docs/dev/debt/libSceLibreSsl.md L10
PR 11003	docs/dev/debt/libSceLibreSsl.md L10
PR 12601	docs/dev/debt/libSceLibreSsl.md L10
PR 12844	core/libs/prx/libSceLibreSsl/CMakeLists.txt L325 docs/dev/debt/libSceLibreSsl.md L10, L43
PR 12850	core/libs/prx/libSceLibreSsl/CMakeLists.txt L325 docs/dev/debt/libSceLibreSsl.md L10, L43

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 9446	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp docs/dev/debt/libSceLibreSsl.md
PR 10508	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 10571	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 10878	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11128	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11146	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11151	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11174	core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11175	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11466	core/libs/prx/libSceLibreSsl/CMakeLists.txt core/libs/prx/libSceLibreSsl/Export.cpp core/libs/prx/libSceLibreSsl/include/Api.hpp docs/dev/debt/libSceLibreSsl.md
PR 11553	docs/dev/debt/libSceLibreSsl.md

[MarcZX10]

Reviewed exact head abc991925908a7b7fb695f21f89f0eee609d9977. The X509 getter implementation follows the cited LP64 layout using byte copies, preserves borrowed pointers, and the focused 1,100-case fixture exercises signed critical values, pointer preservation and non-mutation. The description reports exact-head Linux and Windows 6/6 runs and records that console validation is outstanding. Hosted eligibility, conventions, labels and report checks pass; hosted product jobs are path-skipped. I have not independently run the local test suite.\n\nOne contribution-rule item needs resolving before merge: a direct merge preview of this head with your open #10071 reports a content conflict in docs/dev/debt/libSceLibreSsl.md (both edit the same pending-export count and add a debt entry). Please coordinate which lands first, declare that order with Depends on, and make sure the second branch keeps both entries and the corrected count. This is a keep-both sequencing request; neither PR needs to be closed.

[MarcZX10]

Formatting correction to my review above: its paragraph separator rendered as literal \n text. The review finding is unchanged.

The direct merge preview confirms a content conflict in docs/dev/debt/libSceLibreSsl.md between #10078 and #10071. Please agree the landing order, declare it with Depends on, and preserve both entries and the corrected pending-export count. Neither PR needs to be closed.

[oneandonlydean]

@atharvjairath on MarcZX10's sequencing point for this PR and #10071: #10071 lands first. Once it has merged, please merge main into this branch, keep both debt entries in docs/dev/debt/libSceLibreSsl.md, and set the pending count from Export.cpp (it should come to 367 if nothing else in that library lands in between). Please also add "Depends on: #10071" to this PR's checklist. #10071 needs no change for this.

[MarcZX10]

Reviewed exact head b0c5bea, comparing the feature commit against its declared prerequisite #10071. The three getters follow the cited LibreSSL 2.5.4 layout and signed critical rule, preserve borrowed object/data pointers, and leave the extension bytes untouched; the focused test covers null inputs, signed boundaries, pointer preservation, and adjacent-byte canaries. The refreshed branch merges cleanly with #10071 (git merge-tree); the checklist now declares Depends on: #10071, matching the recorded landing order. Author-reported Linux and Windows focused runs pass, current hosted conventions/eligibility/labels/report pass, product jobs are path-skipped. I did not run the tests locally.

[benjaminmathias]

Native Windows validation for head cb6734063f5fd3f4d7612eea44fff5749fbe4454, including the exact #10071 prerequisite 0390178ba06a360f4c4799725bf0699e3a3c4916, integrated locally with main snapshot 16ff208dc32cf3927ba1bae492eee363a5ae7ae8.

Windows 11 Pro 10.0.26300, Ryzen 7 5700X3D, WinLibs GCC 15.2.0 UCRT POSIX SEH r7, CMake/CTest 4.3.1, Ninja Release, BUILD_TESTING=ON. The merge was conflict-free, with no manual source changes. The integration differs from the pinned main only in the seven files belonging to #10071/#10078. The author branches were unchanged.

Separate build directories were used. The baseline reused a verified compatible build whose relevant libc, libkernel, LibreSSL, CMake and submodule inputs were unchanged; the candidate build directory was new. Built the real libraries and the runtime, ASN.1, cipher and extension test executables. These fixtures use unpatched libraries.

APS5_NO_WRITE_WATCH was unset throughout; no Wine workaround was applied.

CTest	Main	Integrated PR
guest_libressl_runtime	3/3 pass	3/3 pass
guest_libressl_asn1	3/3 pass	3/3 pass
guest_libressl_asn1_allocator	3/3 pass	3/3 pass
guest_libressl_cipher	not present	3/3 pass
guest_libressl_x509_extension	not present	3/3 pass

No skips or timeouts. In particular, the two tests that needed APS5_NO_WRITE_WATCH=1 under Wine pass here with native Windows defaults. This validates those test paths under the default configuration, not every write-watch behavior.

Negative controls used the unchanged candidate executables and other runtime binaries, replacing only libSceLibreSsl.prx with main's freshly built library. The cipher and extension tests both abort as expected, respectively at SSL_CIPHER_get_bits_nid_postfix not implemented and X509_EXTENSION_get_critical_nid_postfix not implemented (0xc0000409). Both executables pass before the swap and after restoring the candidate library.

The public-header declaration/umbrella audit passes (368 libraries, 12,188 exports). The LibreSSL public umbrella compiles standalone, included twice, with MinGW C++20 and -Werror; the two new fixtures use the canonical public declarations. Whitespace checks pass.

Commands:

cmake --build <pr-build> --target guest_libressl_runtime_tests guest_libressl_asn1_tests guest_libressl_cipher_tests guest_libressl_x509_extension_tests --parallel 4
ctest --test-dir <main-build> --no-tests=error --interactive-debug-mode 0 -R '^guest_libressl_(runtime|asn1|asn1_allocator)$' -V --repeat until-fail:3
ctest --test-dir <pr-build> --no-tests=error --interactive-debug-mode 0 -R '^guest_libressl_(runtime|asn1|asn1_allocator|cipher|x509_extension)$' -V --repeat until-fail:3
python core/libs/tests/test_public_headers.py --audit-only

Both PR heads were rechecked unchanged after testing. Main advanced during the campaign; results apply to the pinned integration above. Logs, JUnit and binary hashes are retained locally. No title, GPU, full-suite, patched-library or console-layout/equivalence validation is claimed; the documented console ABI/layout uncertainty remains. The landing order remains #10071 then #10078.

AI-assisted: yes; these builds, tests and controls ran locally on native Windows.

[BunnyFl]

The layout matches firmware 13.42's libSceLibreSsl.sprx. I ran the 13.42 versions in an emulator on structures filled with offset markers (every 4-byte word holds its own offset), so a getter's result names the field it read. Two runs gave identical results.

X509_EXTENSION_get_object reads +0 and X509_EXTENSION_get_data +0x10 (16). X509_EXTENSION_get_critical reads a signed int at +0x8 and returns 1 only when it is above 0: 0, -1 and INT_MIN give 0, while 1, 5 and INT_MAX give 1. All three return 0 for a null extension. That is your 0 / 8 / 16 layout and your critical > 0.

[oneandonlydean]

@atharvjairath the getters are unchanged and still read right. One thing for the merge: main's libSceLibreSsl debt entry has since dropped from 318 to 313 pending exports through other merges, and this branch changes the same line from 318 to 313. Git merges the two identical edits cleanly, so after merging it would still say 313, although this PR implements three more. Could you rebase on current main and set it to 310 (or whatever the recount gives)?