From b10424a47bf3efe4a07972d031879579999a687e Mon Sep 17 00:00:00 2001
From: roboterspinne <229981445+roboterspinne@users.noreply.github.com>
Date: Fri, 23 Oct 2026 20:43:37 +0000
Subject: [PATCH 1/4] fix(relinker): require the Linux entry, relocation
 offsets and DT_PLTGOT in PT_LOAD memory

The Windows and macOS patchers reject an entry point outside executable
PT_LOAD memory and a relocation offset or DT_PLTGOT outside PT_LOAD memory
through WindowsLoadImage::GetRva. The Linux patcher copied these values
unchecked and reported success; with a bad entry or relocation offset the
output crashed with SIGSEGV at load.

LinuxElfPatcher::Patch now requires e_entry in an executable load and every
non-NONE RELA and JMPREL r_offset and DT_PLTGOT to fit inside one PT_LOAD's
MemorySize, in the fixed-base and --lazy-binding paths. A relocation needs
the bytes ld.so writes: 4 for PC32 and 32, the output symbol's st_size (at
least 1) for COPY, and 8 otherwise. DT_PLTGOT needs 8 bytes with eager
binding and 24 with --lazy-binding, where ld.so writes GOT[1] and GOT[2].
Two test fixtures that set e_entry to a file offset outside their only
PT_LOAD now use the matching virtual address.
---
 core/relinker/CMakeLists.txt                  |   2 +
 .../elfpatcher/src/linux/LinuxElfPatcher.cpp  |  34 ++++++
 .../tests/test_linux_eh_frame_header.py       |   2 +-
 .../tests/test_linux_load_alignment.py        |   2 +-
 .../relinker/tests/test_linux_load_bounds.py  | 114 ++++++++++++++++++
 5 files changed, 152 insertions(+), 2 deletions(-)
 create mode 100644 core/relinker/relinker/tests/test_linux_load_bounds.py

diff --git a/core/relinker/CMakeLists.txt b/core/relinker/CMakeLists.txt
index 5c4b89dfa89..7c091a9c5ae 100644
--- a/core/relinker/CMakeLists.txt
+++ b/core/relinker/CMakeLists.txt
@@ -527,6 +527,8 @@ if(BUILD_TESTING)
         set_tests_properties(macos_tls_alu PROPERTIES TIMEOUT 60)
         add_test(NAME linux_load_alignment COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_load_alignment.py $<TARGET_FILE:relinker>)
+        add_test(NAME linux_load_bounds COMMAND ${Python3_EXECUTABLE}
+            ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_load_bounds.py $<TARGET_FILE:relinker>)
         add_test(NAME linux_eh_frame_header COMMAND ${Python3_EXECUTABLE}
             ${CMAKE_CURRENT_SOURCE_DIR}/relinker/tests/test_linux_eh_frame_header.py $<TARGET_FILE:relinker>)
         add_test(NAME linux_dynamic_strings COMMAND ${Python3_EXECUTABLE}
diff --git a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
index 7453d82acaa..883abd7e464 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
@@ -22,6 +22,8 @@ namespace Elfpatcher::Linux {
 namespace {
 
 constexpr std::uint64_t kLinuxUserAddressEnd = 0x800000000000;
+constexpr std::uint64_t kLazyPltGotBytes = 24;
+constexpr std::uint64_t kPltGotEntryBytes = 8;
 
 std::string Hex(const std::uint64_t value) {
     std::ostringstream text;
@@ -103,6 +105,31 @@ void RequireFileRange(const std::vector<std::uint8_t>& buf, const Domain::Progra
         throw Domain::RelinkerException("PT_LOAD at " + Hex(load.MappedAddress) + " has file bytes outside the input");
 }
 
+void RequireLoaded(const std::vector<Domain::ProgramHeader>& headers, const std::uint64_t address, const std::uint64_t size, const std::uint32_t flags, const std::string& what) {
+    for (const auto& header : headers)
+        if (header.Type == PT_LOAD && (header.Flags & flags) == flags && address >= header.MappedAddress && address - header.MappedAddress < header.MemorySize && size <= header.MemorySize - (address - header.MappedAddress))
+            return;
+    const auto range = size > 1 ? " (" + std::to_string(size) + " bytes) does not fit inside " : std::string(" is not inside ");
+    throw Domain::RelinkerException(what + " " + Hex(address) + range + ((flags & PF_X) != 0 ? "an executable" : "a") + " PT_LOAD segment");
+}
+
+std::uint64_t RelocationWidth(const std::vector<std::uint8_t>& relocations, const std::size_t entry, const std::vector<std::uint8_t>& symbols) {
+    const auto info = Io::ReadU64(relocations, entry + 8);
+    switch (static_cast<std::uint32_t>(info)) {
+    case R_X86_64_PC32:
+    case R_X86_64_32:
+        return 4;
+    case R_X86_64_COPY: {
+        const auto symbol = info >> 32;
+        if (symbol >= symbols.size() / kSymEntrySize)
+            throw Domain::RelinkerException("COPY relocation symbol index " + std::to_string(symbol) + " is outside the dynamic symbol table");
+        return std::max<std::uint64_t>(Io::ReadU64(symbols, static_cast<std::size_t>(symbol * kSymEntrySize + 16)), 1);
+    }
+    default:
+        return 8;
+    }
+}
+
 void SeparateSharedLoadPages(std::vector<std::uint8_t>& buf, std::vector<Domain::ProgramHeader>& headers) {
     std::vector<std::size_t> loads;
     for (std::size_t index = 0; index < headers.size(); ++index) {
@@ -358,6 +385,13 @@ std::vector<std::uint8_t> LinuxElfPatcher::Patch(
         throw Domain::RelinkerException("--trace-imports requires libc.prx among the libraries");
     if (_fixedBase)
         RequireOnlyDependencies(dynSection.DynamicSegmentData);
+    RequireLoaded(originalHeaders, Io::ReadU64(sourceElf, kEhdrEntryOffset), 1, PF_X, "e_entry");
+    for (const auto& [relocationTable, name] : {std::pair{&dynSection.RelaData, "RELA r_offset"}, std::pair{&dynSection.RelaPltData, "JMPREL r_offset"}})
+        for (std::size_t entry = 0; entry < relocationTable->size(); entry += kRelaEntrySize)
+            if (static_cast<std::uint32_t>(Io::ReadU64(*relocationTable, entry + 8)) != R_X86_64_NONE)
+                RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry, dynSection.DynSymData), 0, name);
+    if (!dynSection.RelaPltData.empty())
+        RequireLoaded(originalHeaders, originalPltGotVaddr, lazyBinding ? kLazyPltGotBytes : kPltGotEntryBytes, 0, "DT_PLTGOT");
     const auto traced = _traceImports ? TracedImports(dynSection) : std::vector<TracedImport>{};
     const std::uint64_t base = _fixedBase.value_or(0);
     const auto address = [this, base](const std::uint64_t vaddr) {
diff --git a/core/relinker/relinker/tests/test_linux_eh_frame_header.py b/core/relinker/relinker/tests/test_linux_eh_frame_header.py
index a80a1eb1ed5..88d77abe531 100644
--- a/core/relinker/relinker/tests/test_linux_eh_frame_header.py
+++ b/core/relinker/relinker/tests/test_linux_eh_frame_header.py
@@ -18,7 +18,7 @@ def fixture(header_count, with_frame=True):
     image = bytearray(0x8000)
     image[:16] = b"\x7fELF\x02\x01\x01" + bytes(9)
     struct.pack_into("<HHIQQQIHHHHHH", image, 16,
-                     3, 62, 1, 0x4000, 64, 0, 0, 64, 56, header_count, 64, 0, 0)
+                     3, 62, 1, 0, 64, 0, 0, 64, 56, header_count, 64, 0, 0)
     image[0x4000:0x4006] = b"\xb8\x2a\x00\x00\x00\xc3"
     tags = [(5, 0x600), (10, 1), (6, 0x620), (11, 24), (7, 0x700), (8, 0), (9, 24), (0, 0)]
     struct.pack_into("<IIQQQQQQ", image, 64,
diff --git a/core/relinker/relinker/tests/test_linux_load_alignment.py b/core/relinker/relinker/tests/test_linux_load_alignment.py
index 51008e93928..0a549b05ec2 100644
--- a/core/relinker/relinker/tests/test_linux_load_alignment.py
+++ b/core/relinker/relinker/tests/test_linux_load_alignment.py
@@ -14,7 +14,7 @@ def fixture():
     image = bytearray(0x8000)
     image[:16] = b"\x7fELF\x02\x01\x01" + bytes(9)
     struct.pack_into("<HHIQQQIHHHHHH", image, 16,
-                     3, 62, 1, 0x4000, 64, 0, 0, 64, 56, 6, 64, 0, 0)
+                     3, 62, 1, 0, 64, 0, 0, 64, 56, 6, 64, 0, 0)
     image[0x4000:0x4006] = b"\xb8\x2a\x00\x00\x00\xc3"
     tags = [(5, 0x600), (10, 1), (6, 0x620), (11, 24), (7, 0x700), (8, 0), (9, 24), (0, 0)]
     struct.pack_into("<IIQQQQQQ", image, 64,
diff --git a/core/relinker/relinker/tests/test_linux_load_bounds.py b/core/relinker/relinker/tests/test_linux_load_bounds.py
new file mode 100644
index 00000000000..d75d394cdf0
--- /dev/null
+++ b/core/relinker/relinker/tests/test_linux_load_bounds.py
@@ -0,0 +1,114 @@
+"""Check that a Linux relink rejects an entry point, relocation offset or DT_PLTGOT outside PT_LOAD memory."""
+
+from pathlib import Path
+import struct
+import subprocess
+import sys
+import tempfile
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from test_jmprel_table_bounds import fixture
+
+PT_LOAD = 1
+PT_SCE_RELRO = 0x61000010
+PF_W = 2
+PF_R = 4
+R_X86_64_PC32 = 2
+R_X86_64_COPY = 5
+R_X86_64_32 = 10
+E_ENTRY = 24
+SPARE_HEADER = 64 + 3 * 56
+PLTGOT_VALUE = 0x400 + 9 * 16 + 8
+SYMBOL_SIZE = 0x620 + 24 + 16
+OUTSIDE = 0x2000
+
+
+def with_bss(image):
+    struct.pack_into("<IIQQQQQQ", image, SPARE_HEADER, PT_LOAD, PF_R | PF_W, 0x1000, 0x1000, 0x1000, 0, 0x1000, 0x1000)
+    return image
+
+
+def with_relro(image):
+    struct.pack_into("<IIQQQQQQ", image, SPARE_HEADER, PT_SCE_RELRO, PF_R, 0, 0x1000, 0x1000, 0, 0x1000, 1)
+    return with_pltgot(image, 0x1800)
+
+
+def with_entry(image, entry):
+    struct.pack_into("<Q", image, E_ENTRY, entry)
+    return image
+
+
+def with_pltgot(image, value):
+    struct.pack_into("<Q", image, PLTGOT_VALUE, value)
+    return image
+
+
+def with_symbol_size(image, size):
+    struct.pack_into("<Q", image, SYMBOL_SIZE, size)
+    return image
+
+
+def relink(relinker, work, name, image, options, error):
+    source = work / (name + ".elf")
+    output = work / (name + ".out")
+    source.write_bytes(image)
+    result = subprocess.run([str(relinker), "--skip-sce-module", *options, str(source), str(output)],
+                            capture_output=True, text=True, timeout=20)
+    if error is None:
+        assert result.returncode == 0 and output.exists(), (name, options, result.returncode, result.stdout, result.stderr)
+        output.unlink()
+    else:
+        assert result.returncode == 2 and error in result.stderr and not output.exists(), (
+            name, options, result.returncode, result.stdout, result.stderr)
+
+
+def main():
+    relinker = Path(sys.argv[1]).resolve()
+    cases = [
+        ("plt-valid", fixture(linux=True), None),
+        ("rela-valid", fixture(linux=True, data_relocations=True), None),
+        ("rela-in-bss", with_bss(fixture(linux=True, data_relocations=True, target=0x1ff8)), None),
+        ("none-outside", fixture(linux=True, data_relocations=True, relocation_type=0, symbol_index=0, target=OUTSIDE), None),
+        ("rela-in-relro", with_relro(fixture(linux=True, data_relocations=True, target=0x1ff8)), None),
+        ("jmprel-in-relro", with_relro(fixture(linux=True, target=0x1ff8)), None),
+        ("pc32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_PC32, target=0xFFC), None),
+        ("abs32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_32, target=0xFFC), None),
+        ("copy-load-tail", with_symbol_size(
+            fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=0xFFC), 4), None),
+        ("copy-load-last-byte", with_symbol_size(
+            fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=0xFFF), 4), None),
+        ("entry-outside", with_entry(fixture(linux=True), 0x7FFFF000),
+         "e_entry 0x7ffff000 is not inside an executable PT_LOAD segment"),
+        ("entry-not-executable", with_entry(with_bss(fixture(linux=True)), 0x1000),
+         "e_entry 0x1000 is not inside an executable PT_LOAD segment"),
+        ("rela-outside", fixture(linux=True, data_relocations=True, target=OUTSIDE),
+         "RELA r_offset 0x2000 (8 bytes) does not fit inside a PT_LOAD segment"),
+        ("rela-past-load-end", fixture(linux=True, data_relocations=True, target=0xFFC),
+         "RELA r_offset 0xffc (8 bytes) does not fit inside a PT_LOAD segment"),
+        ("abs32-past-load-end", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_32, target=0xFFE),
+         "RELA r_offset 0xffe (4 bytes) does not fit inside a PT_LOAD segment"),
+        ("copy-outside", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=OUTSIDE),
+         "RELA r_offset 0x2000 is not inside a PT_LOAD segment"),
+        ("jmprel-outside", fixture(linux=True, target=OUTSIDE),
+         "JMPREL r_offset 0x2000 (8 bytes) does not fit inside a PT_LOAD segment"),
+    ]
+    with tempfile.TemporaryDirectory(prefix="anyps5-linux-load-bounds-") as directory:
+        work = Path(directory)
+        for name, image, error in cases:
+            for options in ([], ["--lazy-binding"]):
+                relink(relinker, work, name, image, options, error)
+        pltgot_cases = [
+            ("pltgot-outside", OUTSIDE, "DT_PLTGOT 0x2000 (8 bytes) does not fit inside a PT_LOAD segment",
+             "DT_PLTGOT 0x2000 (24 bytes) does not fit inside a PT_LOAD segment"),
+            ("pltgot-load-tail", 0xFF0, None, "DT_PLTGOT 0xff0 (24 bytes) does not fit inside a PT_LOAD segment"),
+            ("pltgot-lazy-fits", 0xFE8, None, None),
+        ]
+        for name, pltgot, eager_error, lazy_error in pltgot_cases:
+            image = with_pltgot(fixture(linux=True), pltgot)
+            relink(relinker, work, name, image, [], eager_error)
+            relink(relinker, work, name, image, ["--lazy-binding"], lazy_error)
+    print("Linux load bounds tests passed")
+
+
+if __name__ == "__main__":
+    main()

From 9bf8860f8757ce0a0543190d15e4f895ac2a133f Mon Sep 17 00:00:00 2001
From: roboterspinne <229981445+roboterspinne@users.noreply.github.com>
Date: Sat, 24 Oct 2026 17:44:53 +0200
Subject: [PATCH 2/4] fix(relinker): drop the COPY width from the Linux load
 bounds check

RelocationWidth took the width of a COPY relocation from the output
symbol table, where every import has st_size 0, so the width was
always one byte and the two copy-* boundary cases passed for that
reason alone. #10658 rejects R_X86_64_COPY in validation, so the type
no longer reaches this check; until it merges, COPY takes the 8-byte
default like every other type. The three copy-* cases go with it.
---
 .../elfpatcher/src/linux/LinuxElfPatcher.cpp  | 20 ++++---------------
 .../relinker/tests/test_linux_load_bounds.py  | 13 ------------
 2 files changed, 4 insertions(+), 29 deletions(-)

diff --git a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
index 883abd7e464..3e9f0c0d272 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
@@ -113,21 +113,9 @@ void RequireLoaded(const std::vector<Domain::ProgramHeader>& headers, const std:
     throw Domain::RelinkerException(what + " " + Hex(address) + range + ((flags & PF_X) != 0 ? "an executable" : "a") + " PT_LOAD segment");
 }
 
-std::uint64_t RelocationWidth(const std::vector<std::uint8_t>& relocations, const std::size_t entry, const std::vector<std::uint8_t>& symbols) {
-    const auto info = Io::ReadU64(relocations, entry + 8);
-    switch (static_cast<std::uint32_t>(info)) {
-    case R_X86_64_PC32:
-    case R_X86_64_32:
-        return 4;
-    case R_X86_64_COPY: {
-        const auto symbol = info >> 32;
-        if (symbol >= symbols.size() / kSymEntrySize)
-            throw Domain::RelinkerException("COPY relocation symbol index " + std::to_string(symbol) + " is outside the dynamic symbol table");
-        return std::max<std::uint64_t>(Io::ReadU64(symbols, static_cast<std::size_t>(symbol * kSymEntrySize + 16)), 1);
-    }
-    default:
-        return 8;
-    }
+std::uint64_t RelocationWidth(const std::vector<std::uint8_t>& relocations, const std::size_t entry) {
+    const auto type = static_cast<std::uint32_t>(Io::ReadU64(relocations, entry + 8));
+    return type == R_X86_64_PC32 || type == R_X86_64_32 ? 4 : 8;
 }
 
 void SeparateSharedLoadPages(std::vector<std::uint8_t>& buf, std::vector<Domain::ProgramHeader>& headers) {
@@ -389,7 +377,7 @@ std::vector<std::uint8_t> LinuxElfPatcher::Patch(
     for (const auto& [relocationTable, name] : {std::pair{&dynSection.RelaData, "RELA r_offset"}, std::pair{&dynSection.RelaPltData, "JMPREL r_offset"}})
         for (std::size_t entry = 0; entry < relocationTable->size(); entry += kRelaEntrySize)
             if (static_cast<std::uint32_t>(Io::ReadU64(*relocationTable, entry + 8)) != R_X86_64_NONE)
-                RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry, dynSection.DynSymData), 0, name);
+                RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry), 0, name);
     if (!dynSection.RelaPltData.empty())
         RequireLoaded(originalHeaders, originalPltGotVaddr, lazyBinding ? kLazyPltGotBytes : kPltGotEntryBytes, 0, "DT_PLTGOT");
     const auto traced = _traceImports ? TracedImports(dynSection) : std::vector<TracedImport>{};
diff --git a/core/relinker/relinker/tests/test_linux_load_bounds.py b/core/relinker/relinker/tests/test_linux_load_bounds.py
index d75d394cdf0..49e9a994c49 100644
--- a/core/relinker/relinker/tests/test_linux_load_bounds.py
+++ b/core/relinker/relinker/tests/test_linux_load_bounds.py
@@ -14,12 +14,10 @@
 PF_W = 2
 PF_R = 4
 R_X86_64_PC32 = 2
-R_X86_64_COPY = 5
 R_X86_64_32 = 10
 E_ENTRY = 24
 SPARE_HEADER = 64 + 3 * 56
 PLTGOT_VALUE = 0x400 + 9 * 16 + 8
-SYMBOL_SIZE = 0x620 + 24 + 16
 OUTSIDE = 0x2000
 
 
@@ -43,11 +41,6 @@ def with_pltgot(image, value):
     return image
 
 
-def with_symbol_size(image, size):
-    struct.pack_into("<Q", image, SYMBOL_SIZE, size)
-    return image
-
-
 def relink(relinker, work, name, image, options, error):
     source = work / (name + ".elf")
     output = work / (name + ".out")
@@ -73,10 +66,6 @@ def main():
         ("jmprel-in-relro", with_relro(fixture(linux=True, target=0x1ff8)), None),
         ("pc32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_PC32, target=0xFFC), None),
         ("abs32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_32, target=0xFFC), None),
-        ("copy-load-tail", with_symbol_size(
-            fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=0xFFC), 4), None),
-        ("copy-load-last-byte", with_symbol_size(
-            fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=0xFFF), 4), None),
         ("entry-outside", with_entry(fixture(linux=True), 0x7FFFF000),
          "e_entry 0x7ffff000 is not inside an executable PT_LOAD segment"),
         ("entry-not-executable", with_entry(with_bss(fixture(linux=True)), 0x1000),
@@ -87,8 +76,6 @@ def main():
          "RELA r_offset 0xffc (8 bytes) does not fit inside a PT_LOAD segment"),
         ("abs32-past-load-end", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_32, target=0xFFE),
          "RELA r_offset 0xffe (4 bytes) does not fit inside a PT_LOAD segment"),
-        ("copy-outside", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_COPY, target=OUTSIDE),
-         "RELA r_offset 0x2000 is not inside a PT_LOAD segment"),
         ("jmprel-outside", fixture(linux=True, target=OUTSIDE),
          "JMPREL r_offset 0x2000 (8 bytes) does not fit inside a PT_LOAD segment"),
     ]

From b15f3eac86de835966a6e2023769684a444c7faf Mon Sep 17 00:00:00 2001
From: roboterspinne <229981445+roboterspinne@users.noreply.github.com>
Date: Sat, 24 Oct 2026 18:09:58 +0200
Subject: [PATCH 3/4] test(relinker): expect the load bounds error for the
 wrapped GOT slot

The got-slot-address-size-underflow case puts its GOT slot at the
32-bit wrapped address 0xfffff008, outside every PT_LOAD. The unused
filter still keeps the import, which the case keeps checking through
the CFG/GOT filtering line, and the Linux patcher now rejects the
relocation, so the case expects exit 2 with that message instead of an
output file.
---
 .../relinker/relinker/tests/test_unused_filter_indirect.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/core/relinker/relinker/tests/test_unused_filter_indirect.py b/core/relinker/relinker/tests/test_unused_filter_indirect.py
index 7b0197ee6e3..69e6e2f8649 100644
--- a/core/relinker/relinker/tests/test_unused_filter_indirect.py
+++ b/core/relinker/relinker/tests/test_unused_filter_indirect.py
@@ -11,6 +11,8 @@
 TABLE = 0x820
 FUNCTION = CODE + 0x40
 SECOND_FUNCTION = CODE + 0x60
+REJECTED = {"got-slot-address-size-underflow":
+            "RELA r_offset 0xfffff008 (8 bytes) does not fit inside a PT_LOAD segment"}
 
 
 def rel(next_address, target):
@@ -62,6 +64,11 @@ def run(relinker, work, name, image, level=1):
     source.write_bytes(image)
     result = subprocess.run([str(relinker), "--skip-sce-module", "--registry", f"unused-filter={level}",
                              str(source), str(output)], capture_output=True, text=True, timeout=20)
+    if name in REJECTED:
+        assert result.returncode == 2 and REJECTED[name] in result.stderr and not output.exists(), (
+            name, result.returncode, result.stdout, result.stderr)
+        assert "CFG/GOT filtering: 1 -> 1;" in result.stdout, (name, result.stdout)
+        return True
     assert result.returncode == 0 and output.exists(), (name, result.returncode, result.stdout, result.stderr)
     registry = json.loads(output.with_suffix(".registry.json").read_text())
     kept = len(registry)

From 66473085c2e7a82a76de6a5938abaae471f18ec0 Mon Sep 17 00:00:00 2001
From: roboterspinne <229981445+roboterspinne@users.noreply.github.com>
Date: Sun, 25 Oct 2026 11:21:16 +0100
Subject: [PATCH 4/4] fix(relinker): accept a Linux entry in a PT_LOAD without
 flags

The Linux output maps a PT_LOAD whose p_flags is 0 as RWX, so the
e_entry check now accepts an entry inside such a segment instead of
rejecting it. A new test case relinks that input in both Linux modes
and checks that the output maps the entry's segment RWX. The
R_X86_64_NONE skip in the relocation offset loop is removed, together
with its none-outside case, because extractRela drops NONE before the
relocation tables are rebuilt.
---
 .../elfpatcher/src/linux/LinuxElfPatcher.cpp  |  5 ++--
 .../relinker/tests/test_linux_load_bounds.py  | 29 ++++++++++++++++---
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
index 2817ea4271d..32a7cf27ba7 100644
--- a/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
+++ b/core/relinker/elfpatcher/src/linux/LinuxElfPatcher.cpp
@@ -106,7 +106,7 @@ void RequireFileRange(const std::vector<std::uint8_t>& buf, const Domain::Progra
 
 void RequireLoaded(const std::vector<Domain::ProgramHeader>& headers, const std::uint64_t address, const std::uint64_t size, const std::uint32_t flags, const std::string& what) {
     for (const auto& header : headers)
-        if (header.Type == PT_LOAD && (header.Flags & flags) == flags && address >= header.MappedAddress && address - header.MappedAddress < header.MemorySize && size <= header.MemorySize - (address - header.MappedAddress))
+        if (header.Type == PT_LOAD && (header.Flags == 0 || (header.Flags & flags) == flags) && address >= header.MappedAddress && address - header.MappedAddress < header.MemorySize && size <= header.MemorySize - (address - header.MappedAddress))
             return;
     const auto range = size > 1 ? " (" + std::to_string(size) + " bytes) does not fit inside " : std::string(" is not inside ");
     throw Domain::RelinkerException(what + " " + Hex(address) + range + ((flags & PF_X) != 0 ? "an executable" : "a") + " PT_LOAD segment");
@@ -375,8 +375,7 @@ std::vector<std::uint8_t> LinuxElfPatcher::Patch(
     RequireLoaded(originalHeaders, Io::ReadU64(sourceElf, kEhdrEntryOffset), 1, PF_X, "e_entry");
     for (const auto& [relocationTable, name] : {std::pair{&dynSection.RelaData, "RELA r_offset"}, std::pair{&dynSection.RelaPltData, "JMPREL r_offset"}})
         for (std::size_t entry = 0; entry < relocationTable->size(); entry += kRelaEntrySize)
-            if (static_cast<std::uint32_t>(Io::ReadU64(*relocationTable, entry + 8)) != R_X86_64_NONE)
-                RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry), 0, name);
+            RequireLoaded(originalHeaders, Io::ReadU64(*relocationTable, entry), RelocationWidth(*relocationTable, entry), 0, name);
     if (!dynSection.RelaPltData.empty())
         RequireLoaded(originalHeaders, originalPltGotVaddr, lazyBinding ? kLazyPltGotBytes : kPltGotEntryBytes, 0, "DT_PLTGOT");
     const auto traced = _traceImports ? TracedImports(dynSection) : std::vector<TracedImport>{};
diff --git a/core/relinker/relinker/tests/test_linux_load_bounds.py b/core/relinker/relinker/tests/test_linux_load_bounds.py
index 49e9a994c49..687e95ae2b1 100644
--- a/core/relinker/relinker/tests/test_linux_load_bounds.py
+++ b/core/relinker/relinker/tests/test_linux_load_bounds.py
@@ -11,14 +11,18 @@
 
 PT_LOAD = 1
 PT_SCE_RELRO = 0x61000010
+PF_X = 1
 PF_W = 2
 PF_R = 4
 R_X86_64_PC32 = 2
 R_X86_64_32 = 10
 E_ENTRY = 24
+FIRST_LOAD_FLAGS = 64 + 4
 SPARE_HEADER = 64 + 3 * 56
 PLTGOT_VALUE = 0x400 + 9 * 16 + 8
 OUTSIDE = 0x2000
+ENTRY = 0x200
+FIXED_BASE = 0x400000
 
 
 def with_bss(image):
@@ -41,6 +45,18 @@ def with_pltgot(image, value):
     return image
 
 
+def without_load_flags(image):
+    struct.pack_into("<I", image, FIRST_LOAD_FLAGS, 0)
+    return image
+
+
+def load_flags_at(elf, address):
+    phoff, = struct.unpack_from("<Q", elf, 0x20)
+    phentsize, phnum = struct.unpack_from("<HH", elf, 0x36)
+    headers = [struct.unpack_from("<IIQQQQQQ", elf, phoff + index * phentsize) for index in range(phnum)]
+    return [header[1] for header in headers if header[0] == PT_LOAD and header[3] <= address < header[3] + header[6]]
+
+
 def relink(relinker, work, name, image, options, error):
     source = work / (name + ".elf")
     output = work / (name + ".out")
@@ -49,10 +65,12 @@ def relink(relinker, work, name, image, options, error):
                             capture_output=True, text=True, timeout=20)
     if error is None:
         assert result.returncode == 0 and output.exists(), (name, options, result.returncode, result.stdout, result.stderr)
+        elf = output.read_bytes()
         output.unlink()
-    else:
-        assert result.returncode == 2 and error in result.stderr and not output.exists(), (
-            name, options, result.returncode, result.stdout, result.stderr)
+        return elf
+    assert result.returncode == 2 and error in result.stderr and not output.exists(), (
+        name, options, result.returncode, result.stdout, result.stderr)
+    return None
 
 
 def main():
@@ -61,7 +79,6 @@ def main():
         ("plt-valid", fixture(linux=True), None),
         ("rela-valid", fixture(linux=True, data_relocations=True), None),
         ("rela-in-bss", with_bss(fixture(linux=True, data_relocations=True, target=0x1ff8)), None),
-        ("none-outside", fixture(linux=True, data_relocations=True, relocation_type=0, symbol_index=0, target=OUTSIDE), None),
         ("rela-in-relro", with_relro(fixture(linux=True, data_relocations=True, target=0x1ff8)), None),
         ("jmprel-in-relro", with_relro(fixture(linux=True, target=0x1ff8)), None),
         ("pc32-load-tail", fixture(linux=True, data_relocations=True, relocation_type=R_X86_64_PC32, target=0xFFC), None),
@@ -84,6 +101,10 @@ def main():
         for name, image, error in cases:
             for options in ([], ["--lazy-binding"]):
                 relink(relinker, work, name, image, options, error)
+        for options, base in (([], FIXED_BASE), (["--lazy-binding"], 0)):
+            elf = relink(relinker, work, "entry-in-flagless-load", without_load_flags(fixture(linux=True)), options, None)
+            flags = load_flags_at(elf, base + ENTRY)
+            assert flags == [PF_R | PF_W | PF_X], ("entry-in-flagless-load", options, flags)
         pltgot_cases = [
             ("pltgot-outside", OUTSIDE, "DT_PLTGOT 0x2000 (8 bytes) does not fit inside a PT_LOAD segment",
              "DT_PLTGOT 0x2000 (24 bytes) does not fit inside a PT_LOAD segment"),