[cookie42073-cmd]

What

Hi, this is Blazing Cook.

APR submission passes the recorded length to the executor and queued copy without checking the object's capacity. A buffer containing two valid writes, with its declared capacity reduced to the first write, still executes both. This checks the original descriptor before _submit, so all three submission exports reject an offset beyond capacity without executing commands, consuming an ID or changing the result/ID outputs.

This follows up on the remaining submission-capacity check from item 2 of #3321. The error uses the exports' existing -1/guest EINVAL path. Native PS5 behavior for a corrupted opaque buffer remains unverified and is recorded in technical debt. No title unblock is claimed.

Tested

Windows x64, MinGW-w64 GCC 15.2.0, Release, Tracy disabled.

Tested base: d1670009fbfdfe57f8f26ee09ced77fe6b18c2ca. Fix: 0081a8bd9277973ed09034521c574daefc4ec0d5.

• Before/after: the new registered guest_ampr_markers regression fails on the upstream APR implementation because it returns success and executes both writes; it passes with the two submission guards. The test covers all three exports with an idle queue and with a blocked command ahead, unchanged outputs/backing/object fields, no consumed submission ID, exact capacity and empty buffers.
• Full default build and libs target; seven selected CTest tests: guest_ampr_markers, guest_ampr_threads, guest_amm_placement, guest_memory, guest_addresses, guest_mlock, guest_mutex_contention. All passed. The registered APR regression also passed five consecutive runs with normal process exit.
• Conventions and whitespace checks; independent source and evidence review.

An auxiliary short-process probe intermittently hangs during Windows DLL teardown. The same unchanged valid-submission control reproduces it on d1670009 and the fixed runtime; debugger stacks put it in libkernel CRT detach during LdrShutdownProcess. That separate exit issue is not fixed here. The registered regression completes normally. Linux, native PS5 and commercial games were not tested.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw; silent stubs are documented
• No notes, investigation files or images added to the repository
• New third-party code is a submodule built from source: none added
• Generic behaviour, not specific to one title
• Depends on: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes, Codex; reviewed and tested before submission

[github-actions]

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request	Conflicting files (lines on main)	Same exports	Same new files
#4953	docs/dev/debt/libkernel.md L13
#5537	docs/dev/debt/libkernel.md L13

[oneandonlydean]

Closing: no title is known to reach this. With the queue at 700+ open PRs, please hold off on new PRs that don't name a title needing the change until it's down. If a title stops on this on current main, reopen with the title ID and the log line.