[veosett]

What

A decrypted SELF smaller than 3 KiB can request an output buffer of roughly 1 TiB when a file-backed segment has a large alignment. The existing 64 MiB padding guard only covers empty PT_LOAD segments.

Count alignment gaps across all copied regions and the final empty-load extent against one 64 MiB budget before allocating output. Count padding rather than alignment values or payload bytes, preserving large alignments that need little padding. Rejection leaves the input and any existing output untouched. Document the input limit and add regression coverage for file-backed load/non-load regions, cumulative gaps and exact budget boundaries.

Tested

• GitHub Actions Build: native relinker builds and CTest pass on Ubuntu, Windows, macOS ARM64 and macOS x86_64; separate ASan TLS coverage passes. The SELF conversion test passed in all four platform jobs. Full system-library Linux/Windows builds were skipped by repository policy.

• Windows x64, Python 3.12.14: all 37 SELF conversion tests pass.

• Ubuntu 24.04 WSL x64, Python 3.12.3: the same 37 tests pass.

• Regression-only tests on unchanged main fail on both hosts: an allocation guard safely intercepts the roughly 1 TiB requests; cumulative-padding cases also fail. No terabyte buffer was allocated.

• Test registration: all 170 Python test scripts are registered.

• Conventions against origin/main and git diff --check pass.

• Local checks use synthetic SELF fixtures; no local native C++ build, game or console testing. Inputs needing more than 64 MiB of cumulative alignment padding are intentionally refused.

• Official pr_overlap completed with no confirmed line/export overlaps. Its ten uncompared legacy PRs (feat(aot): consolidate native ARM64 compiler, runtime and consumers #5021, perf(agc): build the pipelines of a submission ahead on a compile pool #5925, fix(tools): recognize guest module identities in import audit #6171, feat(agc): select Vulkan devices by driver name #6788, perf(recompiler): keep runtime-specialized shader modules in the shader disk cache #6924, perf(agc): draw finisher pipeline (APS5_DRAW_PIPELINE) #6946, perf(agc): GPU descriptor heap (APS5_GPU_HEAP) #6947, feat(agc): look up table images at run time through a device image table on the GPU heap (APS5_GPU_PATH) #7642, fix(agc): reclaim idle images safely during cache creation #7800, fix(relinker): rewrite XSAVEOPT to XSAVE under --to-rosetta #7918) only share USAGE.md; their documentation diffs were inspected and concern other sections. PR fix(tools): reject SELF program tables overlapping the ELF header #8902 was also reviewed: its ELF-header overlap validation is independent of this padding fix.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes

[github-actions]

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 5021	docs/user/USAGE.md
PR 5925	docs/user/USAGE.md
PR 6171	docs/user/USAGE.md
PR 6788	docs/user/USAGE.md
PR 6924	docs/user/USAGE.md
PR 6946	docs/user/USAGE.md
PR 7642	docs/user/USAGE.md
PR 7918	docs/user/USAGE.md
PR 9408	docs/user/USAGE.md
PR 9508	docs/user/USAGE.md

[xXPBSXx]

Linux data point for da1d9407ed (WSL2, Ubuntu 24.04, kernel 6.18 - a virtualised kernel, not bare-metal Linux; Python 3.12.3), this head merged onto main 950388bfd (clean merge), python3 -I tools/tests/test_unwrap_self.py:

• With the PR: 37 tests OK.
• Without it (the PR's test_unwrap_self.py on top of main without the PR's source change): FAILED (6 failures, 6 errors).
  Not tested: macOS, Windows.

AI-assisted (Claude Code).

[THEMANnt]

Reviewed at da1d9407ed on Windows 11 with Python 3.11.9. No actionable findings.

• Exact PR-head SELF suite: 37 passed, no skips.
• Cherry-picked onto local main f894ba69d300: 35 passed, no skips. The PR's newer base has two additional load-ownership regression tests.
• Four safe negative controls reproduce main's roughly 1 TiB allocation attempts for load/non-load regions, with and without existing output. The PR refuses all four before allocating; input and existing output remain intact. No terabyte buffer was allocated.
• Independent checks at 64 MiB minus one byte, exactly 64 MiB, and one byte above the padding budget behave as specified.
• Unwrapped 44 existing local containers with output captured in memory; all ELF SHA-256 values match their main-generated outputs. No asset copies or uploads.
• Conventions and whitespace checks pass.

Local validation covers the Python tool. No native rebuild, Linux/macOS run or game execution was performed for this review.

AI-assisted: yes (Codex); all results above were run locally.