sceKernelRaiseException delivers SIGUSR1 as a Windows special user APC.
Windows builds the APC frame directly below the interrupted RSP, which
overwrites live red-zone locals of SysV leaf functions. PPSA10595 (UE5)
signals worker threads while they run a zstd Huffman decoder whose
tableLog slot sits below RSP; the slot came back as zero and the decoder
faulted on a wild table index.
Suspend the target before queuing the APC and, when it is in guest code,
move RSP below the red zone with RIP parked on a "ret 0x80" stub that
restores it in one instruction. The APC handler unparks the context
first, so the guest handler sees and resumes at the real RIP/RSP.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Frame-pointer leaf functions address red-zone locals through RBP below
RSP (e.g. [rbp-0x108] with rsp = rbp-0xc8). The patcher only modeled
RSP-relative operands, so such functions were left unprotected and a
handled access fault overwrote their locals (PPSA10595 crash in a
decompressor on Background Worker #2).
Track RBP - RSP through the CFG, translate frame-relative operands into
the red-zone model, resolve mov rsp,rbp / lea rsp,[rbp+k] / leave deltas,
and fall back to conservative protection when the offset is unknown.
Also follow resolved jump-table successors in the liveness pass.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Hamza ShakirandClaude Opus 5.5