[AlxcBTW]

What

Adds twelve C11 Annex K functions that libSceLibcInternal exports (PS5 3.20 inventory) and that exist nowhere on main: fprintf_s, vfprintf_s, vprintf_s, fwprintf_s, wprintf_s, vfwprintf_s, vwprintf_s, scanf_s, fscanf_s, vscanf_s, vfscanf_s and freopen_s. SDK headers steer code to the _s forms, so a title built with them imports these. No title is named here; the change is generic. They sit beside their siblings and reuse the formatting and scanning engines of the unchecked and _s functions already on main.

Printf side (Formatting.cpp, FormattingWide.cpp):

• vfprintf_s, fprintf_s and vprintf_s format with FormatWindows(..., secure = true), the engine snprintf_s uses, and write the finished text to the stream in one fwrite. A null stream, format or argument list, any %n, and a null %s, %ls or %S argument return -1 and write nothing. A closed stream sets EBADF as fprintf does. vprintf_s writes to the guest standard output stream.
• vfwprintf_s, fwprintf_s, vwprintf_s and wprintf_s do the same through FormatWide(..., secure = true), the engine of swprintf_s and snwprintf_s, and return the number of wide characters like vfwprintf.

Scanf side (Formatting.cpp):

• ScanGuest, the scanner behind sscanf_s, read its input as a NUL-terminated string. It now takes its input through a small StringSource/StreamSource pair (peek, skip, advance, scan one directive) and the body is shared: ScanGuest keeps its signature and behaviour for strings, and ScanGuestStream runs the same scanner over a FileStream by reading each directive with the host fscanf and one character of look-ahead pushed back. So the size rules of sscanf_s (size after the pointer for %s, %c, %[, as unsigned int; an undersized destination gets a null first element and returns the count so far; a null destination returns EOF) apply unchanged, and the stream stops after the last character a conversion used.
• vfscanf_s is the entry; fscanf_s, scanf_s and vscanf_s call it (scanf_s and vscanf_s read the guest standard input stream, as scanf and vscanf do). A null stream or format returns EOF; a closed stream sets EBADF and returns EOF. The 16-bit wide conversions throw on Linux in the stream forms, exactly as in fscanf.

freopen_s (FileAndHeap.cpp) returns EINVAL (22) for a null result, name, mode or stream (and sets *result to null when it can); otherwise it calls freopen, stores the stream in *result and returns 0, or stores null and returns the errno of the failed reopen.

Constraint handling is the one main has for the siblings: a violation only returns, the installed constraint handler is not called (see snprintf_s, fopen_s, sscanf_s and their debt entries). The result values for the stream forms were not measured on a PS5; they are recorded as such in docs/dev/debt/libc.md (three new entries). RSIZE_MAX is not touched (#9360, #8965).

Relation to #9087 (open, "follow snprintf_s and sscanf_s constraints as measured on a PS5"): it rewrites ScanGuest and FormatSecure in the same file (handler calls, the -23 result, size_t sizes). This PR is based on main and does not depend on it; whichever lands second needs a mechanical rebase of the ScanGuest hunk, after which the new stream functions should call the handler the way #9087 does for their siblings. The values #9087 measured are for snprintf_s and sscanf_s only, so I did not copy them to the stream functions.

Tests extend GuestStdioVariadic.cpp (registered as guest_stdio_variadic) and GuestFopenErrors.cpp (guest_fopen_errors); no new target.

Tested

• Linux (Ubuntu 24.04, GitHub runner), fork CI at e77f42d (the PR head 239dc9b plus the CI scaffolding commit; run 39694515304, ctest filter guest_stdio_variadic|guest_fopen_errors|guest_scan_count|guest_formatting|guest_strings|guest_wide_formatting|guest_wide_stream_scan|guest_bounds_checking|guest_standard_streams*|file_streams): 12 of 12 passed, among them guest_stdio_variadic, guest_fopen_errors, guest_scan_count, guest_formatting and guest_strings, the existing tests of the scanner I changed. Not run on Windows or macOS (the Windows paths use the same __builtin_sysv_va_list pattern as fprintf and scanf, and compile only there).
• guest_stdio_variadic has new cases with expected values worked out by hand: fprintf_s and vfprintf_s write the same 16 bytes as fprintf for "%d|%s|%5.2f|%c|%ls" (42|ab| 3.14|z|é); fwprintf_s and vfwprintf_s count 10 wide characters for "%05d:%ls|" and write 00042:été|; vprintf_s returns 14, wprintf_s 12, vwprintf_s 13; every violation (%n, null %s/%ls, null format, null stream) returns -1 with nothing written and the %n target untouched, and snprintf_s is called with the same arguments as the reference; fscanf_s/vfscanf_s read %d %s %c with sizes 6 and 1, continue from the stream position, leave the character that ended a number in the stream (12abc then a), read %3[a-z]=%7s, handle %*f%n (count 5), return 0 for an undersized %s with a null first element like sscanf_s, EOF at the end of the file, and EOF for a null destination, format and stream; scanf_s and vscanf_s read a tmpfile swapped in as the guest standard input. A closed stream makes fprintf_s, fwprintf_s and fscanf_s set EBADF.
• guest_fopen_errors has a new CheckedReopen case: null result returns EINVAL; null name, mode and stream, and an invalid mode, return EINVAL with *result null; a reopen onto reopened.txt returns 0 with *result == stream and creates the file; loop returns ELOOP (62) and missing.txt ENOENT (2), each with *result null.
• Not measured on a PS5: the return values and errno of the stream forms on a violation, and whether the console's default constraint handler runs for them. The three debt entries say so.
• python3 tools/check_conventions.py --base origin/main passes. Based on a6dcea9. tools/pr_overlap.py reports no PR with the same exports. It lists fix(libc): follow snprintf_s and sscanf_s constraints as measured on a PS5 #9087 and feat(libc): scan 16-bit wide conversions on Linux #7386 (ScanGuest, Formatting.cpp lines 121 to 167 on main), feat(libc): implement _Vacopy #8593 (GuestStdioVariadic.cpp line 18), and fix(libc): leave a range that a mutation waits for out of new leases #6565, feat(libc): implement siginterrupt through the sigaction libkernel registers #8872, feat(libc): export the num_get and time_get locale objects as data #8880, test(libc): cover siginterrupt state boundaries #9001, feat(libSceLibcInternal): implement posix_spawn process creation and reaping #9133, fix(libc): return the calling thread from _Thrd_id as the console's libc.prx does #9170 and feat(libc): add the std::__sce_v2 thread start, timed wait, clock and processor count calls #9447 (the append position at the end of docs/dev/debt/libc.md); it could not compare fix(libc): follow measured wide printf behavior #5303 (FormattingWide.cpp), fix(libs): share Sony CRT handler and lconv state between libc and libSceAmpr #7081 and Macos port #7201 (FileAndHeap.cpp), and fix(windows): enter guest startup on an arena-backed main stack #3965, feat(aot): consolidate native ARM64 compiler, runtime and consumers #5021, fix(memory): honor low guest mapping hints #6469, feat(wasm): run relinked titles in the browser with WebGPU #6879, feat(libc): implement std::_Throw_C_error #7648, fix(libc): provide ASOBI_ROOT environment variable for title path resolution #7715, fix(libc): support character reads from random device streams #8150 and fix(libc): use the Annex K size limit and codes of the PS5 libc, as measured on a PS5 #8965 (docs/dev/debt/libc.md) because they conflict with main. Neighbours that touch the area without these names: docs(libc): correct the RSIZE_MAX that swprintf_s and vswprintf_s assume #9360, fix(libc): match reported wide scanf edge cases #9331, feat(libc): decode non-ASCII scanset members and non-BMP characters in the guest wide scanf #9340, fix(libc): use the Annex K size limit and codes of the PS5 libc, as measured on a PS5 #8965.

Checklist

• Based on current main; no other open PR implements the same functions
• One topic per PR; follow-ups go in a new PR
• No comments in code except technical debt
• Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
• No notes, investigation .md files or images added to the repository (attach them to this PR)
• New third-party code is a submodule built from source
• Generic behaviour, not specific to one title
• Depends on: none
• Fixes: none
• Unblocks: none (no named title import)
• GPUs tested: n/a
• AI-assisted: yes

[github-actions]

Progress report (5d48c62 → e0932f8)

📈 System libraries: 49.96% (+0.04%, +11 implemented, +1 declared functions)

✅ 11 implemented

Library	Name
libc	fprintf_s_nid_postfix
libc	freopen_s_nid_postfix
libc	fscanf_s_nid_postfix
libc	fwprintf_s_nid_postfix
libc	scanf_s_nid_postfix
libc	vfprintf_s_nid_postfix
libc	vfwprintf_s_nid_postfix
libc	vprintf_s_nid_postfix
libc	vscanf_s_nid_postfix
libc	vwprintf_s_nid_postfix
libc	wprintf_s_nid_postfix

🆕 1 declared as stubs

Library	Name
libc	vfscanf_s_nid_postfix

Changed libraries (implemented exports)

Library	Before	After	Change
libc	1346/1356 (99.26%)	1357/1368 (99.20%)	-0.07 pp

[MarcZX10]

The changed scanner appears to preserve the existing string-scanner behavior while factoring it into the stream source, and the secure output/reopen cases have useful focused coverage. The author-reported Linux CTest filter passes; current eligibility, conventions, intake, labels, report, relinker matrix/ASan, register-context, and write-watch checks pass. Hosted full Linux and Windows product jobs were skipped, and I did not run a local build/test.

Please resolve the overlap order before merge. The live overlap scan reports shared scanner code with #9087 and #7386, the shared test file with #8593, and the debt insertion with #6565, #8872, #8880, #9001, #9087, #9133, #9170, #9447, and #9526; several older conflicted-base PR comparisons also require manual review. The body acknowledges #9087's same ScanGuest/FormatSecure hunk and says whichever lands second will rebase, but the checklist currently says Depends on: none. Please coordinate the shared-file order with the affected authors, record the agreed prerequisite(s) in Depends on, and rebase/resolve the overlap before merge. This request is for the repository's required overlap coordination, not a claim that the new functions duplicate another PR.

[github-actions]

Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.

Pull request	Conflicting files (lines on main)	Same exports	Same new files
PR 6565	docs/dev/debt/libc.md L183
PR 9087	core/libs/prx/libc/src/Formatting.cpp L128-131, L145-147, L173-174, L237-241, L267-280
PR 10158	docs/dev/debt/libc.md L183
PR 10200	docs/dev/debt/libc.md L183
PR 10222	docs/dev/debt/libc.md L183
PR 10229	docs/dev/debt/libc.md L183
PR 10283	docs/dev/debt/libc.md L183
PR 10346	docs/dev/debt/libc.md L183
PR 10349	docs/dev/debt/libc.md L183
PR 10989	docs/dev/debt/libc.md L183

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request	Shared files not compared
PR 5021	docs/dev/debt/libc.md
PR 5303	core/libs/prx/libc/src/FormattingWide.cpp docs/dev/debt/libc.md
PR 6713	docs/dev/debt/libc.md
PR 7081	core/libs/prx/libc/src/FileAndHeap.cpp docs/dev/debt/libc.md
PR 7201	core/libs/prx/libc/src/FileAndHeap.cpp
PR 7386	core/libs/prx/libc/src/Formatting.cpp core/libs/tests/GuestStdioVariadic.cpp docs/dev/debt/libc.md
PR 7447	core/libs/prx/libc/src/FileAndHeap.cpp docs/dev/debt/libc.md
PR 7544	docs/dev/debt/libc.md
PR 7648	docs/dev/debt/libc.md
PR 7715	docs/dev/debt/libc.md
PR 8150	docs/dev/debt/libc.md
PR 8417	docs/dev/debt/libc.md
PR 9269	docs/dev/debt/libc.md
PR 9371	docs/dev/debt/libc.md
PR 9669	docs/dev/debt/libc.md
PR 9771	docs/dev/debt/libc.md
PR 9863	docs/dev/debt/libc.md
PR 9873	docs/dev/debt/libc.md
PR 9929	docs/dev/debt/libc.md
PR 10007	docs/dev/debt/libc.md
PR 10113	docs/dev/debt/libc.md
PR 10226	docs/dev/debt/libc.md
PR 10405	core/libs/prx/libc/src/FileAndHeap.cpp docs/dev/debt/libc.md
PR 10467	docs/dev/debt/libc.md
PR 10610	docs/dev/debt/libc.md
PR 10742	core/libs/prx/libc/include/Api.hpp docs/dev/debt/libc.md
PR 10788	core/libs/prx/libc/include/Api.hpp docs/dev/debt/libc.md
PR 10898	docs/dev/debt/libc.md

[harisibrar1]

Checked against main 4a17c71, C11 n1570 K.3.5.2.2 and the ps5-payload-dev/sdk libSceLibcInternal stubs:

• All twelve exports are in the sdk stub list, and the NIDs match. The SysV varargs entry points use __builtin_sysv_va_* and APS5_VA_BEGIN on Windows, as fprintf and scanf do. I traced the new fscanf_s stream cases by hand and the expected values hold.
• freopen_s (FileAndHeap.cpp:398) returns EINVAL for a null filename. But K.3.5.2.2 lists only newstreamptr, mode and stream as runtime constraints, and says that with a null filename the call "attempts to change the mode of the stream". So freopen_s(&r, NULL, "rb", f) should not fail as a constraint violation.
• Plain freopen on main already reports that case as unsupported (errno 45, FileAndHeap.cpp:312). Could freopen_s pass the null name through to freopen, so that the existing gap shows instead of a constraint failure? The test at GuestFopenErrors.cpp:105 and the debt line (libc.md:139, "follows C11 K.3.5.2.2") would need the same change. If the console's Dinkumware does reject a null name, a citation in the debt entry would settle it.

Reviewed with AI assistance (Claude Code); the checks above were run locally on my machine.

[MarcZX10]

I rechecked current head 239dc9bf3e: the merge with today’s main is clean, diff-check/conventions pass, and the reported Linux focused suite is 12/12. This branch is 7 ahead / 119 behind current main (merge base a6dcea927), so it still needs a current-main refresh and rerun.

There is also a concrete freopen_s mismatch in the new code and test. The implementation rejects filename == nullptr with EINVAL (FileAndHeap.cpp), and GuestFopenErrors.cpp asserts that result. C11 N1570 K.3.5.2.2 lists only newstreamptr, mode, and stream as runtime constraints; it describes a null filename as a request to attempt a mode change on the existing stream, with the permitted mode changes implementation-defined. See N1570 K.3.5.2.2 (PDF pp. 607–608). Please pass a non-constraint null filename through to freopen and test/report the underlying supported or unsupported mode-change result, unless you have PS5-specific evidence that this export deliberately diverges; if so, document that source and narrow the C11 claim.

The earlier overlap request also remains open: #9087 edits the same scanner/secure-format paths, and the overlap report names shared test/debt insertions with other open PRs. Please record the agreed order and any required Depends on entries before merge. I did not run a local build in this pass.

[MarcZX10]

A fresh comparison also finds #9669 sharing the same docs/dev/debt/libc.md insertion point: the pairwise merge of #9527 and #9669 currently conflicts in that file. Since #9526’s author is also the author of this PR, please coordinate an order across #9526, #9527 and #9669, record the relevant Depends on links in each PR that must follow another, and preserve all entries in the combined debt file.

[ycbuzi]

Windows run of 239dc9b merged onto main a6646f8 (124686139e), the platform the description lists as not run. Windows 11 Home 10.0.26200, MinGW-w64 GCC 15.2.0 (ucrt-posix-seh r7), Release, BUILD_TESTING=ON.

The merge conflicts only in docs/dev/debt/libc.md, as GitHub shows; for this run I took this PR's side of that file. Built libc and guest_stdio_variadic_tests with no errors or warnings. ctest --repeat until-fail:2 on guest_stdio_variadic: passes on both repeats. guest_fopen_errors is registered only under if(UNIX) in core/libs/prx/libc/CMakeLists.txt, so it is not built on Windows. Not run: guest_fopen_errors (Unix only), a title.

[Retr0G28]

@AlxcBTW Hi, #10620 (mine) lets freopen reopen a stream onto /dev/random or /dev/urandom. Your freopen_s calls freopen, so it picks that up with no changes, and the two PRs don't change the same lines. The conflicts in GuestStdioVariadic.cpp and at the end of libc.md are between this PR and current main (git merge-tree --write-tree origin/main on this head shows them without #10620). Neither PR needs the other first, so I've left Depends on: none on mine. If you prefer an order, tell me and I'll record it.

Dismissing a stale review: the requested changes were addressed after it (new head) and the merge queue blocks on it. Please request changes again if anything is still open.

[adriadam10]

Rebased onto current main; the only conflict was docs/dev/debt/libc.md (kept the new main entry and this PR's three). Nothing else changed since the last review; merged.