[Lindamea1]

What

On main, scePthreadAttrGet checks only for null arguments and then copies the attributes of whatever the handle points at. A thread that has ended still answers 0: one that was joined, one that finished and is not joined yet, and one that ended detached. For the last kind ReleaseThread deleted the object when the thread ended, so the call reads freed memory. A probe run against libkernel.prx built from main 5eba12d printed the following (cut to the scePthreadAttrGet results; the last line comes from a copy of the slot search described below, run by a 65th thread after 64 others had registered and been joined):

joined thread:            scePthreadAttrGet=0
ended, not joined thread: scePthreadAttrGet=0
detached thread, ended:   scePthreadAttrGet=0
thread #65 (all 64 earlier ones joined): registry index=-1

FreeBSD 11.4 answers ESRCH in all three cases. _pthread_attr_get_np returns EINVAL for a null thread or attribute, then looks the thread up with _thr_find_thread(curthread, pthread, /*include dead*/0). _thr_find_thread returns ESRCH for a thread that is no longer in the thread hash or is in PS_DEAD, and otherwise returns with the thread locked; the attributes are read before the unlock. exit_thread sets PS_DEAD after the thread-specific data destructors have run (thr_exit.c#L287-L305). Where the console was measured (firmware 13.60) it answers ended threads the same way: a second scePthreadJoin returns 0x80020003 (measured in #4160, implemented in #4481) and pthread_getname_np on a joined thread returns ESRCH (recorded in its debt entry, implemented in #4533).

Monster Hunter Wilds (PPSA24191) depends on this answer. It gives each thread an index from a table of 64 slots. A thread that is not in the table yet walks the slots in order and takes the first one that is empty or whose thread scePthreadAttrGet reports gone: for each filled slot it passes, it calls scePthreadAttrInit, scePthreadAttrGet on the slot's thread and scePthreadAttrDestroy, and takes the slot only if scePthreadAttrGet returned 0x80020003. With main's answer no slot is ever freed, so once 64 distinct threads have taken one, later threads get none unless their handle happens to equal an old one. No stop has been observed: here the title does not get past a flat grey screen yet (it needs #7852 and --linux-fixed-base to get that far), and none of the 7 runs logged so far started more than 50 guest threads.

#5584 asked for the same check in pthread_attr_get_np (with pthread_getaffinity_np) and was closed because no title was known to reach it. Monster Hunter Wilds does not import pthread_attr_get_np, so this PR leaves it as it is and changes only scePthreadAttrGet, the call the title makes. The difference from #5584 is a title whose code calls scePthreadAttrGet and acts on 0x80020003; there is still no stop or log line.

The change: after the existing EINVAL checks, scePthreadAttrGet returns ESRCH (0x80020003) unless the handle is a live guest thread in the thread registry, the test pthread_setaffinity_np and pthread_kill already make through GuestThreadIsLive. The lookup compares pointers, so a freed handle is not read. The new LockLiveGuestThread returns the registry lock held when the thread is live, and the attributes are copied under it. A thread's object leaves the registry in its destructor under the same lock, so a detached thread that exits during the call is not freed while its fields are read. GuestThreadIsLive now calls LockLiveGuestThread. A thread counts as ended once its thread-specific data destructors have run, where FreeBSD sets PS_DEAD, so a thread that queries itself from one of its destructors still gets its attributes. Running threads, including the main thread and other adopted host threads, are in the registry and answer as before. pthread_attr_get_np and the other calls that take a thread handle are unchanged.

Not measured on a console. The new libkernel debt entry records that, that pthread_attr_get_np still answers 0 for an ended thread, and that on Windows a host thread adopted by scePthreadSelf that ends without scePthreadExit keeps answering 0, since its object is never marked ended or freed.

Tested

Gentoo Linux, kernel 7.2.8, GCC 16.2.1, glibc 2.43, Ninja, Release, BUILD_TESTING=ON, on main 43a2aba.

• guest_pthread_attr (extended): scePthreadAttrGet returns 0 for the main thread querying itself and for a thread querying itself from a thread-specific data destructor as it ends. It returns 0x80020003 for a joined thread, for a thread that finished and is not joined yet (polled for up to 5 s until the answer changes) and for the same thread after the join, and for 32 detached threads that ended. A null or uninitialized attribute still returns EINVAL for an ended thread, and a failed call leaves the stack size already in the attribute. The test passed 100 runs in a row and 3 × 40 runs in parallel, about 40 ms per run.

• Negative control: with Thread.cpp, Pthread.hpp and Attr.cpp taken from main and the new test kept, guest_pthread_attr aborts at its first joined-thread assertion (scePthreadAttrGet returned 0; the line was found with a -g build of the test under gdb). The probe above, run against this branch's libkernel.prx, prints 0x80020003 for the three ended threads, 0 for the calling thread, and slot 0 for thread fix(agc): keep BGRA color targets resident between draws #65.

• Tests the change reaches, selected by tools/select_tests.py as CI selects them (1349 of 1638): 1334 passed, 0 failed, 15 skipped. The skipped ones are the 13 video_out_flip_* tests, video_out_frame_dump_queue and agc_driver_stencil_ref_export, which skip on this machine on main as well.

• Windows: x86_64-w64-mingw32-g++ 16.2.0 -fsyntax-only -Wall -Wextra on the three changed .cpp files: no warnings, no errors. This is a syntax check, not a Windows build or run.

• tools/check_compile.py --base upstream/main: the 3 changed translation units compile. tools/check_conventions.py passes.

• Open PRs on the same code: fix(libkernel): report thread guard size from attribute queries #6893 (guard size) also changes scePthreadAttrGet and adds its debt entry after pthread_setaffinity_np; this branch puts its entry elsewhere, git merge-tree merges the two branches without conflicts, and neither depends on the other. fix(threads): run Windows pthread and small fiber stacks in guest VA range #7149 adds a Windows test that requires scePthreadAttrGet to return 0 right after it creates threads whose entry calls scePthreadExit at once; with this change that call returns 0x80020003 when the thread has already ended, so whichever of the two is merged second has to query from inside the thread or keep it running until the query is done.

• tools/pr_overlap.py --branch reports no overlapping lines. It could not compare the open PRs that conflict with main; merged with this branch, fix(libkernel): keep the signal mask per thread #3986, feat(aot): consolidate native ARM64 compiler, runtime and consumers #5021, feat(wasm): run relinked titles in the browser with WebGPU #6879, fix(threads): run Windows pthread and small fiber stacks in guest VA range #7149 and Macos port #7201 conflict in the same files as they do with main, and fix(libkernel): report thread guard size from attribute queries #6893 and feat: macOS on Apple Silicon host support (Rosetta 2 and MoltenVK) #7332 merge cleanly.

• Monster Hunter Wilds (PPSA24191, 01.041.040, relinked with --linux-fixed-base 0x400000), 6 minutes headless with gdb breakpoints where its table routine fills a slot and where it gives up with -1: with the libraries of main 83bf557 plus feat(libs): add the Voice and IME exports PPSA24191 needs to load #7852, 44 of the 64 slots were filled and none was given up; with this branch (on 5eba12d) merged with feat(libs): add the Voice and IME exports PPSA24191 needs to load #7852, again 44 slots and no -1. No slot came up for reuse in that time, so neither run reaches the changed answer; they show how full the table gets before the grey screen.

Not run on Windows, macOS or a console.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

🤖 Generated with Claude Code

[github-actions]

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 3986	core/libs/prx/libkernel/Pthread/src/Thread.cpp
PR 5021	core/libs/prx/libkernel/Pthread/include/Pthread.hpp core/libs/prx/libkernel/Pthread/src/Thread.cpp docs/dev/debt/libkernel.md
PR 6044	core/libs/tests/GuestPthreadAttr.cpp
PR 6149	docs/dev/debt/libkernel.md
PR 6469	docs/dev/debt/libkernel.md
PR 6519	docs/dev/debt/libkernel.md
PR 6658	docs/dev/debt/libkernel.md
PR 6740	core/libs/prx/libkernel/Pthread/include/Pthread.hpp docs/dev/debt/libkernel.md
PR 6879	core/libs/prx/libkernel/Pthread/src/Thread.cpp
PR 6977	docs/dev/debt/libkernel.md
PR 7049	docs/dev/debt/libkernel.md
PR 7088	docs/dev/debt/libkernel.md
PR 7105	docs/dev/debt/libkernel.md
PR 7121	docs/dev/debt/libkernel.md
PR 7149	core/libs/prx/libkernel/Pthread/include/Pthread.hpp core/libs/prx/libkernel/Pthread/src/Thread.cpp docs/dev/debt/libkernel.md
PR 7192	docs/dev/debt/libkernel.md
PR 7201	core/libs/prx/libkernel/Pthread/src/Thread.cpp
PR 7464	docs/dev/debt/libkernel.md
PR 7509	docs/dev/debt/libkernel.md
PR 7554	docs/dev/debt/libkernel.md
PR 7556	docs/dev/debt/libkernel.md
PR 7605	docs/dev/debt/libkernel.md
PR 7949	docs/dev/debt/libkernel.md