[roboterspinne]

What

On Windows, a guest read from a stream that is open only for writing ("w" or "a"; fdopen/freopen with a write-only mode set the same UCRT flags and were not probed) reaches the UCRT. The UCRT serves the read from the unused part of the write buffer. After fwrite("abc") on a "wb" or "ab" stream, fread(buf, 1, 4) returns 4 zero bytes, fgetc and getc_unlocked return 0, and fgets returns the buffer. After fwrite("12 "), fscanf("%d") returns 0 instead of EOF. In every case ferror stays 0 and errno is not set. fclose then writes the consumed bytes as well, so the 3-byte file ends up 4, 5, 7 or 10 bytes long. SwitchToReadingUnlocked only acts on update streams; on any other stream it returns true (core/libs/prx/libc/include/FileStream.hpp:293 on e0caf13; line numbers below refer to it), so a stream whose UCRT flags have neither _IOREAD (0x1) nor _IOUPDATE (0x4) goes straight to the host. FreeBSD 11.4's __srefill handles a stream that has neither __SRD nor __SRW by setting errno = EBADF and __SERR and returning EOF, and it does not touch pending output. POSIX.1-2008 lists EBADF for fgetc on a stream that is not open for reading. glibc's _IO_new_file_underflow (_IO_NO_READS) already does this for fread, fgetc, getc_unlocked and fgets, but its __vfscanf_internal (ARGCHECK, glibc 2.39 stdio-common/vfscanf-internal.c) returns EOF with EBADF without setting the error indicator, so Linux fscanf still differs from FreeBSD there; this PR records that in docs/dev/debt/libc.md and leaves the Linux code unchanged. macOS's BSD stdio is expected to behave like FreeBSD (not run). #11560 (a7b5208) added the opposite direction for Windows: SwitchToWritingUnlocked fails a write on a read-only stream with errno 9 and the error indicator (FileStream.hpp:329-334, tested at core/libs/tests/FileStreams.cpp:447-457).

• Rule. On Windows, SwitchToReadingUnlocked fails a stream whose UCRT flags have neither _IOREAD nor _IOUPDATE the way its writing counterpart does: errno 9, the guest error indicator, and false. Every read path already returns on a failed switch, so fread returns 0 (core/libs/prx/libc/src/FileAndHeap.cpp:555); fgetc, getc, getchar, __srget and fgetwc return EOF (StandardStreams.cpp:93), gets returns NULL (:176); getc_unlocked returns EOF (:150); fgets returns NULL (:230); and fscanf, vfscanf and their _s forms return EOF (Formatting.cpp:447, 541, 873). Pending output stays buffered, and fclose writes only the guest's bytes. FreeBSD's __ungetc (ungetc.c) returns EOF on such a stream without setting errno or __SERR, and today's guest ungetc and ungetwc already do the same. A new FileStream::OpenForReading (UCRT flags & 0x5 on Windows, true elsewhere) lets both of them return -1 before they reach the failing switch, so their result stays as it is. ungetwc still checks its range first, as FreeBSD's ungetwc encodes before it calls __ungetc. The random-device stream opens NUL "rb" and is not affected; update streams are unchanged. Linux and macOS code is unchanged.
• fgets with n == 1. On such a stream this branch makes fgets with n == 1 fail with EBADF like any other read. Open fix(libc): return NULL from fgets for a size below 2 as the console does #14863 makes fgets return NULL for any size below 2 before the stream is touched, as its author read from the console's libc.prx; a trial merge of the two branches is clean, and with both, a size below 2 follows fix(libc): return NULL from fgets for a size below 2 as the console does #14863.
• Tests. file_streams gains CheckReadsOnWriteOnlyStreams, called next to the read-only EBADF block in CheckStreamWritesAfterReads. For "wb" and "ab", after fwrite("abc"), it checks each of fread == 0, fgetc == EOF, getc_unlocked == EOF and fgets == NULL together with errno == EBADF and ferror != 0, calling clearerr and resetting errno between the calls. It also checks fscanf == EOF. On Windows only, it checks errno == EBADF and ferror != 0 after fscanf, and it checks that ungetc('q') returns EOF with errno 0 and ferror 0. After fclose, the file must hold exactly abc. The assertions outside _WIN32 follow glibc's _IO_new_file_underflow (fread, fgetc, getc_unlocked, fgets: EBADF and the error indicator) and __vfscanf_internal (fscanf: EOF), read in the glibc 2.39 sources, and BSD's __srefill; the error indicator after fscanf is checked on Windows only because glibc does not set it.
• Overlap. pr_overlap.py --branch reported one shared line, with fix(libc): reopen a stream onto /dev/random or /dev/urandom with freopen #10620 in docs/dev/debt/libc.md, while the new entry stood right after the /dev/random entry that fix(libc): reopen a stream onto /dev/random or /dev/urandom with freopen #10620 rewrites; the entry now follows the setvbuf and setbuf entry, and a trial merge of this branch with fix(libc): reopen a stream onto /dev/random or /dev/urandom with freopen #10620 and with fix(libc): give an unbuffered stream FreeBSD's one-byte buffer on Windows #12057 (which rewrites the update-stream entry) is clean. It cannot compare 26 pull requests that do not merge with main (feat(aot): consolidate native ARM64 compiler, runtime and consumers #5021, fix(libs): share Sony CRT handler and lconv state between libc and libSceAmpr #7081, feat(libc): scan 16-bit wide conversions on Linux #7386, feat(libc): support archive-backed stdio reads #7447, fix(libc): provide ASOBI_ROOT environment variable for title path resolution #7715, fix(libc): support character reads from random device streams #8150, fix(libc): use the Annex K size limit and codes of the PS5 libc, as measured on a PS5 #8965, feat(libc): decode non-ASCII scanset members and non-BMP characters in the guest wide scanf #9340, fix(libc): follow a Windows symbolic link before .. in a guest path #9371, feat(libc): add the std::__sce_v2 thread start, timed wait, clock and processor count calls #9447, feat(libc): add std::__sce_v2::_Random_device, _Fiopen and setw #9526, fix(libc): restore syslog program-name fallback #9929, fix(libc): compute expf with FreeBSD msun's algorithm, as titles' libc.prx does #10113, fix(libc): compute remainder and remquo with fprem1, as titles' libc.prx does #10349, fix(libc): share multibyte state in fgetwc #10405, fix(libc): bound narrow formatting fields #11332, feat(relinker): support short scalar guest GS instructions #11661, feat(relinker): support SSE guest GS memory accesses #11689, feat(relinker): support VEX guest GS memory accesses #11698, feat(libc): implement fcloseall with tracked stream lifetimes #11831, fix(libkernel): preserve DOS device names and trailing dots or spaces on Windows #12560, feat(libkernel): cancel blocked POSIX reads with owned operations #12682, fix(libkernel): preserve blocking sockets over nonblocking native transport #12688, feat(libkernel): cancel blocked POSIX writes with partial progress #12700, feat(libkernel): support deferred cancellation in POSIX accept #12965, docs(debt): separate entries with blank lines and drop derived export totals #14212). Checked by hand: a trial merge of this branch with each of them conflicts in exactly the files that main with it already conflicts in. fix(libc): leave write mode when an unbuffered update stream switches to reading on Windows #12036 changes the neighbouring update-stream line in SwitchToReadingUnlocked, fix(libc): give an unbuffered stream FreeBSD's one-byte buffer on Windows #12057 the unbuffered-stream setup, and fix(libc): translate native stream read errors #14560 translates host read errors at the same read paths (host errno 9 stays 9); each merges cleanly with this branch, and none of them handles a write-only stream. docs(libc): name what happens on Windows when ungetc is called twice #14326 (ungetc) appends its entry to docs/dev/debt/libc.md right after the same setvbuf and setbuf entry and changes no other file, so whichever of the two merges second has a one-line conflict there, resolved by keeping both entries.

Tested

Windows 11, WinLibs GCC 15.2.0, build directory configured with Ninja, Release and BUILD_TESTING=ON, on this branch based on e0caf13:

• Baseline, untouched code (file_streams_tests already built from it): cmake --build build --parallel 4 --target guest_stream_purge_tests file_position_tests guest_wide_stream_scan_tests guest_standard_stream_tests file_stream_status_tests guest_append_streams_tests guest_host_stream_tests, then ctest --test-dir build -R '^(file_streams|file_position|guest_standard_streams.*|file_stream_status|guest_wide_stream_scan|guest_stream_purge|guest_append_streams|guest_host_streams)$' --output-on-failure passed 12/12.
• Counter-check, new test with the library of e0caf13: cmake --build build --target file_streams_tests, then ctest --test-dir build -R '^file_streams$' --output-on-failure failed with what(): fread on a write-only stream (exit 0xc0000409). The Windows-only ungetc assertion already passes before the change; it makes sure the new EBADF path does not reach ungetc.
• With the change: the same cmake --build command with file_streams_tests added, then the same ctest command: 12/12 pass (file_streams 0.34 s).
• Standalone probes loaded the new libc.prx and called its exports. For "w" and "a" after fwrite("abc"), fread returned 0, fgetc and getc_unlocked -1 and fgets NULL, each with ferror 1 and errno 9, and the file was 3 bytes long after fclose. ungetc('q') on a "w" stream returned -1 with ferror 0 and errno 0. After fwrite("12 ") on a "w" stream, fscanf("%d") returned -1 with ferror 1 and errno 9, and the file stayed 3 bytes. With the libc.prx of 73f4f7e (none of the read paths above changed up to e0caf13; FileAndHeap.cpp changed only in fopen_s/freopen_s), the same probes reported fread 4 (file 7 bytes), fgetc 0 (4 bytes), fgets success (10 bytes), getc_unlocked 0 (4 bytes) and fscanf 0 (5 bytes), all with ferror 0 and errno 0, and ungetc -1 with ferror 0 and errno 0.
• Not run here: the Linux and macOS builds. The assertions outside _WIN32 were checked against the glibc 2.39 sources (libio/fileops.c _IO_new_file_underflow, stdio-common/vfscanf-internal.c ARGCHECK) and FreeBSD's __srefill; macOS is expected from the BSD sources only.
• python tools/check_conventions.py --base e0caf13600 --head HEAD with this title and description passed.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Fixes: none
• Unblocks: none
• GPUs tested: n/a
• AI-assisted: yes (Claude Code)

[github-actions]

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request	Conflicting files (lines on main)	Same exports	Same new files
PR 14326	docs/dev/debt/libc.md L204

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 5021	core/libs/prx/libc/include/FileStream.hpp core/libs/prx/libc/src/StandardStreams.cpp docs/dev/debt/libc.md
PR 5303	docs/dev/debt/libc.md
PR 6819	docs/dev/debt/libc.md
PR 7081	docs/dev/debt/libc.md
PR 7386	core/libs/tests/FileStreams.cpp docs/dev/debt/libc.md
PR 7447	core/libs/prx/libc/include/FileStream.hpp docs/dev/debt/libc.md
PR 7715	docs/dev/debt/libc.md
PR 8150	core/libs/prx/libc/src/StandardStreams.cpp core/libs/tests/FileStreams.cpp docs/dev/debt/libc.md
PR 8965	docs/dev/debt/libc.md
PR 9340	docs/dev/debt/libc.md
PR 9371	docs/dev/debt/libc.md
PR 9447	docs/dev/debt/libc.md
PR 9526	docs/dev/debt/libc.md
PR 9929	docs/dev/debt/libc.md
PR 10113	docs/dev/debt/libc.md
PR 10226	docs/dev/debt/libc.md
PR 10245	docs/dev/debt/libc.md
PR 10250	docs/dev/debt/libc.md
PR 10253	docs/dev/debt/libc.md
PR 10265	docs/dev/debt/libc.md
PR 10274	docs/dev/debt/libc.md
PR 10325	docs/dev/debt/libc.md
PR 10328	docs/dev/debt/libc.md
PR 10345	docs/dev/debt/libc.md
PR 10349	docs/dev/debt/libc.md
PR 10405	core/libs/prx/libc/include/FileStream.hpp core/libs/prx/libc/src/StandardStreams.cpp docs/dev/debt/libc.md
PR 10506	docs/dev/debt/libc.md
PR 10510	docs/dev/debt/libc.md
PR 10512	docs/dev/debt/libc.md
PR 10565	docs/dev/debt/libc.md
PR 10987	docs/dev/debt/libc.md
PR 11260	docs/dev/debt/libc.md
PR 11262	docs/dev/debt/libc.md
PR 11266	docs/dev/debt/libc.md
PR 11332	docs/dev/debt/libc.md
PR 11632	docs/dev/debt/libc.md
PR 11634	docs/dev/debt/libc.md
PR 11724	docs/dev/debt/libc.md
PR 11726	docs/dev/debt/libc.md
PR 11831	core/libs/prx/libc/include/FileStream.hpp core/libs/tests/FileStreams.cpp docs/dev/debt/libc.md
PR 11907	docs/dev/debt/libc.md
PR 12122	docs/dev/debt/libc.md
PR 12397	docs/dev/debt/libc.md
PR 12514	docs/dev/debt/libc.md
PR 12560	docs/dev/debt/libc.md
PR 12574	docs/dev/debt/libc.md
PR 12593	docs/dev/debt/libc.md
PR 12622	docs/dev/debt/libc.md
PR 12627	docs/dev/debt/libc.md
PR 12682	core/libs/prx/libc/include/FileStream.hpp docs/dev/debt/libc.md
PR 12688	core/libs/prx/libc/include/FileStream.hpp docs/dev/debt/libc.md
PR 12700	core/libs/prx/libc/include/FileStream.hpp docs/dev/debt/libc.md
PR 12965	core/libs/prx/libc/include/FileStream.hpp docs/dev/debt/libc.md
PR 13119	core/libs/tests/FileStreams.cpp docs/dev/debt/libc.md
PR 13390	core/libs/prx/libc/include/FileStream.hpp docs/dev/debt/libc.md
PR 13804	docs/dev/debt/libc.md
PR 14212	docs/dev/debt/libc.md
PR 14559	core/libs/prx/libc/src/StandardStreams.cpp core/libs/tests/FileStreams.cpp
PR 14560	core/libs/prx/libc/src/StandardStreams.cpp core/libs/tests/FileStreams.cpp
PR 14585	docs/dev/debt/libc.md
PR 14610	docs/dev/debt/libc.md
PR 14863	core/libs/prx/libc/src/StandardStreams.cpp

[BunnyFl]

Windows 11, WinLibs GCC 15.2.0 r7, Release (UCRT). Head e700ddb merged into upstream/main 93dbd0f:

• file_streams passes.
• Negative control: with main's FileStream.hpp and StandardStreams.cpp, file_streams aborts with fread on a write-only stream, the first new check. So main still serves the read from the write buffer as described.

Checking the UCRT _IOREAD/_IOUPDATE bits before the host is asked matches __srefill's "neither __SRD nor __SRW" case. Leaving the glibc fscanf difference as a debt entry, rather than special-casing Linux, seems right.

[TechLevelZero]

✅ AMD GPU test: passed

PR head e700ddb merged onto main a4eca2a · tested 2026-11-02 23:19 UTC · 33 min

GPU	AMD Radeon RX 6300 (RADV NAVI24), driver Mesa 25.2.8-0ubuntu0.24.04.4, Vulkan 1.4.318
Host	Ubuntu 26.04.1 LTS, kernel 7.0.0-42-generic, container ubuntu:24.04
Logs	build and test logs for this run
Build	✅ passed (Release, -DANYPS5_ENABLE_SPIRV_TOOLS=ON)
Tests	✅ 3,469 passed · 13 failed (0 new, 12 also fail on main, 1 unstable on main) · 59 skipped (ANYPS5_REQUIRE_VULKAN=1)
Test setup	CPU-only tests without a GPU; GPU tests (and any CPU-only test that failed or skipped without one) once on the GPU with VK_LAYER_KHRONOS_validation and ANYPS5_NO_SHADER_CACHE=1; main ran the same way
Test selection	3,541 of 3,591 tests run: the ones this change can reach, chosen by tools/select_tests.py from main's build graph
Vulkan validation	✅ no new validation IDs vs main (1306 tests run on the GPU)
Slow tests (>30 s, GPU tests timed with validation layers)	⚠️ agc_driver_pipeline_journal 120.6 s, ⚠️ agc_driver_graphics_maps_fallback 100.3 s, ⚠️ agc_driver_graphics 96.4 s, ⚠️ public_headers 68.0 s, ⚠️ agc_driver_bda_device 43.6 s

Unstable on main (1, these also failed in recent main runs on this machine; not counted against this PR)

agc_driver_pipeline_journal: failed in 4 of the last 6 main runs

Failing on main too (12, not counted against this PR)

agc_driver_guest_memory_lifetime_direct
agc_driver_image_table
agc_driver_native_depth_bda_clear
agc_driver_native_depth_buffer_clear
agc_driver_native_depth_clears
agc_driver_native_multisample_depth
agc_driver_submit_progress
agc_idle_publish_wait
agc_submit_progress
agc_submit_progress_no_timeline
guest_mmap_executable
guest_socket_options_multicast

Validation IDs already present on main (4 IDs in 750 tests)

VUID-VkDeviceCreateInfo-pNext-pNext (750 tests): agc_compute_pipeline_replay, agc_driver, agc_driver_address_passes, agc_driver_address_passes_draw_transitions, agc_driver_address_passes_targets_split, agc_driver_alias_copy_label, agc_driver_alpha_to_coverage, agc_driver_array_layer_target, and 742 more
VUID-vkCmdCopyImage-srcImage-01548 (11 tests): agc_driver_depth_clear_hle, agc_driver_depth_plane_buffer_memory, agc_driver_depth_plane_cpu_write_after_memo, agc_driver_depth_plane_cpu_write_after_page_unwatch, agc_driver_depth_plane_cpu_write_after_partial_unwatch, agc_driver_depth_plane_partial_store, agc_driver_depth_plane_partial_store_unimported, agc_driver_depth_storage_dispatch, and 3 more
VUID-vkCmdCopyImage-srcImage-01551 (11 tests): agc_driver_depth_clear_hle, agc_driver_depth_plane_buffer_memory, agc_driver_depth_plane_cpu_write_after_memo, agc_driver_depth_plane_cpu_write_after_page_unwatch, agc_driver_depth_plane_cpu_write_after_partial_unwatch, agc_driver_depth_plane_partial_store, agc_driver_depth_plane_partial_store_unimported, agc_driver_depth_storage_dispatch, and 3 more
VUID-VkPipelineColorBlendStateCreateInfo-pAttachments-00605 (2 tests): agc_driver_prepared_exports, agc_driver_srgb8_color_target

Skipped (59)

agc_driver_bda_reads_shadowed_results: skipped, the device reports watched host memory written when it imports or reads it
agc_driver_bda_reads_shadowed_results_per_build: skipped, the device reports watched host memory written when it imports or reads it
agc_driver_copied_writer_label_order: skipped, the device reports a minStorageBufferOffsetAlignment of 4, so the dispatch binds its record at +0x1004 in place and nothing is written back; the test needs an alignment above 4
agc_driver_copied_writer_label_order_drain: skipped, the device reports a minStorageBufferOffsetAlignment of 4, so the dispatch binds its record at +0x1004 in place and nothing is written back; the test needs an alignment above 4
agc_driver_float16_unused_nan_payloads: skipped, the device has no native f16 conversions with RTE rounding and kept f16 denormals
agc_driver_image_table_vouched_lookups: skipped, the device reports 4 of 4 host-imported pages written after a GPU read, so a watched imported table cannot be vouched for
agc_driver_linear_target_direct_write_completion: skipped, the device does not keep host imports write-watched, so no completion stamp over the target is tracked
agc_driver_ngg_vertex_wave_reduction: skipped, s3 describes a 32-lane wave only on 32-lane subgroups, and the device has 64 lanes
agc_driver_scattered_runs: skipped, host imports are unavailable: /dev/udmabuf is not accessible
agc_driver_sparse_dma_buf_import: skipped, host imports are unavailable: /dev/udmabuf is not accessible
agc_driver_unit_shadow: skipped, the device does not import watched host memory for unit shadows
agc_driver_unit_shadow_budget: skipped, the device does not import watched host memory for unit shadows
agc_driver_vertex_elected_atomic_max: skipped, the device runs vertex programs in subgroups, so they keep their cross-lane reductions
agc_host_import_sparse: skipped, host imports are unavailable: /dev/udmabuf is not accessible
agc_import_settle_initial_dcc: skipped, the device has no deferred settle of host imports: imports under 1 MiB wait for one only on Windows
agc_shadowed_key_stores: skipped, the device imports no watched host memory under a unit shadow
agc_small_tiled_shadow_label: skipped, host imports are unavailable: the test block is not imported and watched
agc_storage_clear_hand_over: skipped, the device imports no watched host memory for the clear-key hand-over
agc_unit_shadow: skipped, the device does not import watched host memory for unit shadows
agc_unit_shadow_completion_store: skipped, the device reports watched host memory written when it imports or reads it
guest_http_uri_locale: 
guest_net_ctl: skipped, the host has no IPv4 address
guest_video_out_color_space: skipped, no display or Vulkan device: SDL_InitSubSystem(VIDEO | GAMECONTROLLER) failed: wayland,x11 not available
guest_video_out_hdr: skipped, no display or Vulkan device: SDL_InitSubSystem(VIDEO | GAMECONTROLLER) failed: wayland,x11 not available
guest_video_out_high_frame_rate: skipped, no display or Vulkan device: SDL_InitSubSystem(VIDEO | GAMECONTROLLER) failed: wayland,x11 not available
guest_video_out_output_mode: skipped, no display or Vulkan device: SDL_InitSubSystem(VIDEO | GAMECONTROLLER) failed: wayland,x11 not available
guest_video_out_resolution_status: skipped, no display or Vulkan device: SDL_InitSubSystem(VIDEO | GAMECONTROLLER) failed: wayland,x11 not available
guest_video_out_wqhd_detection: skipped, no display or Vulkan device: SDL_InitSubSystem(VIDEO | GAMECONTROLLER) failed: wayland,x11 not available
video_out_flip_aftergpu: skipped, no display or Vulkan device: DisplayWindow: Vulkan support is either not configured in SDL or not available in current SDL video driver (offscreen) or platform
video_out_flip_backtoback: skipped, no display or Vulkan device: DisplayWindow: Vulkan support is either not configured in SDL or not available in current SDL video driver (offscreen) or platform
video_out_flip_controls: skipped, no display or Vulkan device: DisplayWi

Reproduce

git fetch origin e700ddb53ae0f7612b8ed8a6ac2369c7f0126954 a4eca2a056bf3bbbec98ab42e9d28163e4ea9cb8
git checkout a4eca2a056bf3bbbec98ab42e9d28163e4ea9cb8 && git merge --no-ff e700ddb53ae0f7612b8ed8a6ac2369c7f0126954
git submodule update --init --recursive
cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON -DANYPS5_ENABLE_SPIRV_TOOLS=ON
cmake --build build && cmake --build build --target libs
VK_DRIVER_FILES=/nonexistent/icd.json ctest --test-dir build -E '^(agc|shader|recompiler|videoout|video_out|guest_video_out|vulkan)|gpu' --timeout 120 --parallel 12 --output-on-failure
ANYPS5_REQUIRE_VULKAN=1 ANYPS5_NO_SHADER_CACHE=1 VK_INSTANCE_LAYERS=VK_LAYER_KHRONOS_validation \
  ctest --test-dir build -R '^(agc|shader|recompiler|videoout|video_out|guest_video_out|vulkan)|gpu' --timeout 120 --parallel 16 --output-on-failure
# failures are then re-run alone: --timeout 360 --parallel 2; new validation IDs: the test alone, twice, --parallel 1

_{Automated build and test on a contributor's AMD machine; it does not replace upstream CI. A new comment is posted for each new push. Full logs.}