Transformers Beyond Reality (UE5, FMallocBinned3) reserves 76 GiB with one
mmap(NULL, size, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS) while libUnreal.so's
static constructors run. Quest grants it; the Frame's kernel (overcommit mode 0) refuses a
writable private mapping larger than RAM + swap, and Unreal's out-of-memory handler then
dereferences its not yet created log: SIGSEGV fault addr 0x10 inside System.loadLibrary.
The patch adds MAP_NORESERVE to every anonymous read/write mmap call site of the engine
library (mov w3, #0x22 -> #0x4022 before a bl to mmap's PLT stub, with x0 = 0 and w2 = 3
in the window), suggested from analysis unreal_binned3 (ANALYSIS_VERSION 22 on main). Triage
unreal-reserve-refused, PLAYBOOK row, tests. Headless on the dev Frame the game now gets
past loading to its OpenXR session and first frames.
ELF helpers find .dynsym/.dynstr/.dynamic by section type and link instead of by name: this
game's libOVRPlugin.so has a scrambled section name table, so add_needed raised
"produced NEEDED=[...]" and the build failed in frame.unreal_ovrp_entrypoints, and
dyn_symbols returned nothing (every ovrp_* lookup then counted as missing).
# Conflicts:
# docs/PATCHES.md
# src/frameport/analysis/detect.py
The Frame's runtime has no XR_FB_display_refresh_rate (-7); OVRPort's dispatcher still
offers it and answered 0 Hz. Team Beef's idTech 4 ports run USERCMD_MSEC = 1000 / refresh,
so PreyVR had 0 ms tics: the async thread spun (~1.9M tics/s), com_frameTime stayed 0 and
the main menu's timeline never got past its first step (black backdrop + cursor only).
FrameBridge now always answers with 1 / predictedDisplayPeriod (else the refresh_rate
setting, else 72 Hz). Headless: menu drawn (snapshot mean 68 vs 0.1 before), clocks advance.
- glmv: gl_mv_debug=2 traces draws (state, GL errors per framebuffer), failed texture
uploads/copies/compiles and idTech 4 clocks; how this was found
- triage: a single xrEndFrame -16 is info, not the black-menu error it was blamed for
- PLAYBOOK row, CLAUDE.md fact, host test for the fallback rate
Scared By Squares (Unreal 4.27, OpenXR) creates two actions named "turn"
(an action mapping and an axis mapping called Turn). The Frame's runtime
accepts the duplicate, then vrserver fails to load the input manifest it
builds ("SetXrInputConfig failed. Failed to load manifest"), drops the
app's connection and treats it as exited: black, then the home environment
while the game keeps running with sound. Headless the app reconnected as a
plain OpenXR instance, got throttled to 10 fps and the compositor received
no presents.
- action_dedup (adapter setting, default on): a later duplicate action name
or localized name in a set is created as "<name>_N" / "<Localized> N"
(native/adapter/action_names.h, host-tested). Headless on the dev Frame:
manifest loads, 72 fps, 2808 presents in 45 s (before: 10 fps, none).
- input_diag logs every action set and action (escaped names).
- force_render (hidden diagnostic): xrWaitFrame reports shouldRender=TRUE so
headless runs exercise engines that skip layers when not visible; FrameBridge
logs shouldRender changes.
- Triage: space-warp-used only on the motion-vector swapchain (format 97);
D24S8 (129) eye depth falsely matched. New info finding duplicate-action-renamed.
- Catalog entry (status unknown, min_app 1.2.1), PLAYBOOK row.
Meta's Unity OpenXR features add Detached Touch/Touch Plus/Pro devices on
/user/detached_controller_meta/left|right. Unity merges same-named actions of all devices, so the
first such action (thumbstick) failed with XR_ERROR_PATH_UNSUPPORTED on the Frame (no
XR_META_detached_controllers), Unity attached no action set and neither Unity nor OVRPlugin got
controller input: hands on the floor (Spatial Zombies). Without the extension in the runtime, these
paths are now left out of xrCreateAction subaction paths and suggested bindings, and
xrGetCurrentInteractionProfile answers no profile for them. Headless: actions created, Touch
bindings accepted, action spaces created, no ACTIONSET_NOT_ATTACHED.
Games that suggest controller bindings only for Meta's Touch Plus/Pro profiles got them moved to
oculus/touch_controller, but xrGetCurrentInteractionProfile then answered oculus/touch_controller,
a profile they never suggested. Unity's OpenXR input creates its devices by the reported profile,
found none and left the controllers unconnected: hands lying on the floor, no buttons (Hotel
Infinity). Such hands are now reported with the game's own (last remapped) profile; games that
suggest Touch themselves are unchanged. Logic moved to profile_report.c with a host test.
Star Wars: Beyond Victory's mixed reality showed the room on the game's
objects and black where the room should be. Unreal keeps 1 - coverage in
the scene alpha, and OVRPlugin chains XrCompositionLayerAlphaBlendFB
(colour ONE_MINUS_SRC_ALPHA / SRC_ALPHA) to the eye layer; the Frame's
runtime ignores the struct and blends with the plain texture alpha.
New adapter setting alpha_blend_emul (default on, Vulkan): while
passthrough is emulated and the projection layer asks for inverse
blending, the alpha of the eye image rectangles is inverted in place
(alpha-only blend pass, once per acquired image, queued ahead of the
runtime's submission). layer_debug now also logs the blend factors.
Headless on the Frame: factors (3,2/3,2) seen, inversion runs, 72 fps,
no rejected frames. Not yet checked in the headset.
- Il2cppReturnPatch (unity_runtime_msaa_off, unity_multipass, unity_text_input, ...): a patch that is turned on
but whose methods Cpp2IL doesn't find in the game now logs it and adds a WARN build check naming the patch
("not applied (<id>): code not found in this game ...") instead of skipping silently. ApkContext.checks =
checks a patch reports while applying; apply_frame_fixes adds them to the build's checks (job/CLI output,
build record). WARN only: the build still succeeds.
- FrameBridge rect_clamp: an empty projection/quad image rect (BattleTalent's first frames: 0,0 0x0 ->
xrEndFrame -25 twice, then OVRPlugin stops submitting) becomes the whole swapchain image when its size is
known; counted as swapped, logged ("rect_clamp: view N empty image rect -> full swapchain WxH"). Adapter
revision unchanged; artifacts rebuilt.
- triage swapchain-rect-invalid, PLAYBOOK row, setting texts, PATCHES.md, i18n template.
Apply saved refresh rates through SteamVR before Lepton starts, preserve launcher upgrade ordering, and cover the behavior with regression tests. Update the setting documentation and fix repository lint errors blocking CI.
Pinball FX2 VR (32-bit, through the a32 bridge) died ~2 s after its loading
screen with "a32: block at 0xf68587a0 overflowed the code buffer" (exit 127):
OpenSSL's sha1_block_data_order_armv8 (reached from RAND_poll) has ~60 SHA-1
crypto instructions in a row, each translated through the interpreter with
its own exit stub, and the block loop only stopped at 96 instructions or half
the code buffer, so the 64-entry stub table overflowed and fatal() ended the
process. The loop now also ends a block while 8 stubs are left.
Headless on the dev Frame the game now runs on past that point (menu-size
swapchains, recenter, its save files written) instead of exiting.
tests/programs/sha1ce.c (72 crypto instructions in a row + an unrolled SHA-1)
failed with the old a32run and passes with the new one, JIT = interpreter.
Triage signature a32-jit-overflow, PLAYBOOK row; frame.a32_bridge marks only
Pinball FX2 VR "Update on Frame" (package_revisions).
Escaping Wonderland's Meta start-up (OculusPlatform.<Initialize>d__13) awaits
Users.GetOrgScopedID after the licence check and the logged-in user, when on
Wi-Fi, only for its analytics id. OVRPort's ovr_User_GetOrgScopedID returns
request id 0, Meta's C# wrapper logs "An unknown error occurred. Request
failed." and never calls back, so the game waits forever. The patch takes the
game's own no-Wi-Fi path for that request (b.ne after cmp w0,#2 on
get_internetReachability -> b, found with Cpp2IL). Analysis flag
cortopia_org_id (ANALYSIS_VERSION 20), triage cortopia-org-id-wait, PLAYBOOK
row, tests. Headless on the dev Frame: past the loading screen into the intro
scene (adventurer spawned), 72 fps.
Photon Voice's AudioInAEC.updateAudioDevice calls getAvailableCommunicationDevices/setCommunicationDevice with no version check; on Lepton's Android 11 the microphone thread dies with NoSuchMethodError (Table Troopers at the tutorial). New patch frame.photon_voice_audio_route (analysis photon_voice_api31, ANALYSIS_VERSION 20) makes it return at once, sharing vivox_audio_route's helper; Vivox's patch is unchanged. Triage vivox-api31 / photon-voice-api31 now look for the SDK in the stack; other libraries fall to audio-api31 (report).
The reporter's read-before-write fix for module 16800_8dbab031 (12 int Function
variables loaded before any store, the same bug as Vader Immortal's lightspeed
shaders), headset-verified: past the loading screen, ~28 min at 72 fps.
From working-recipe issues #378, #377, #376, #375, #364, #363 (validated with
scripts/catalog_from_issue.py). The 7th Guest VR: the foveation darkening
diagnostic (foveation_test) left out, title spaced, notes shortened to the
game-specific findings. FGO VR: scale rounded to 1.2.
Closes#378Closes#377Closes#376Closes#375Closes#364Closes#363
Doom3Quest-based ports (PreyVR, #306) draw their menu on a curved
cylinder layer submitted once per eye. The Frame's runtime has no
cylinder layers, so FrameBridge shows each as ~7 flat quad strips; a
per-eye pair is ~14 quad layers in one frame, which the runtime rejects
whole (xrEndFrame -> XR_ERROR_LAYER_INVALID, -16). The menu then stays
black while the game runs at 72 fps.
Collapse the pair: drop the right-eye cylinder and show the left eye's
strips to both eyes (the runtime composites a quad to both eyes anyway).
That halves the layer count and drops the per-eye eyeVisibility, and the
runtime accepts the frame. Only frames with per-eye cylinders change --
exactly the ones that were being rejected; mono (BOTH) cylinder games
such as 4XVR are untouched.
Verified on the dev Frame (headless): PreyVR v1.2.4 rebuilt + installed,
the menu frame now submits (one transient -16 on the first frame before
the space is locatable, then clean), 72 fps. Visual confirmation of the
menu needs the headset. Triage signature cylinder-menu-layers-rejected.
No adapter revision bump (installed games are not marked outdated).
Headset-confirmed working configs shared through the issue form:
Tea For God (#295), Ghost Town (#299), Eye of the Temple (#302),
Ocean Rift (#304), Quantum Void (#307), AugmentedEmpire (#311),
Battlemarked (#312), Demeo (#313), Homeworld: Vast Reaches (#314),
Moss (#315), Maestro (#316), Mini Motor Racing X (#317),
Operation Wolf Returns (#318), Ragnarock (#319), Smash Drums (#320),
Vendetta Forever (#321).
Quantum Void, Homeworld: Vast Reaches and Ragnarock go in as status: issues.
Turns on frame.unreal_skip_obb_delivery (and keeps frame.hw_video_decode) so
the fix applies without the user finding the toggle. Not device-verified (the
game is ~41 GB); status unknown, min_app 1.1.2 so only builds that recognise
the obfuscated DownloaderActivity get it.
Medal of Honor (com.Virtuos.R6DLM) keeps Epic's DownloaderActivity and log text but renames the delivery predicates
and OBBData, so expansionFilesDelivered wasn't found and frame.unreal_skip_obb_delivery was never offered. Detection
now also matches a boolean method in the package's DownloaderActivity, called from onCreate, that carries Epic's
"Checking for file : " log and calls the expansion-downloader helpers; the patch rewrites those too. ANALYSIS_VERSION
18 -> 19. Heuristics eval unchanged (10/66); no existing recipe affected.
Merged main (agent 90, ANALYSIS_VERSION 17/18 after main's 15/16) and rebuilt the bridge, foveation and a32
libraries from source (deterministic, no local paths).
Fixes on top:
- a32 loader: apply DT_ANDROID_RELR relocations (Journey of the Gods crashed at start)
- VrApi bridge: vrapi_Get/SetTrackingTransform (floor-level tracking; Shadow Point's player was below the floor)
- a32: never submit an untracked default head pose (hold up to 100 ms, repair or drop); pose consistency per display
time; submit/tracking counters
- VrApi bridge: wait again when xrWaitFrame gives a display time in the refresh just submitted (the runtime rejected
the second frame with AlreadySubmitted; Journey of the Gods ran at ~120 fps on a 90 Hz display and the scene slid
and snapped back); pacing counters
- VrApi bridge: GLES re-entry polls events before reusing the kept session (a lost or exiting session is replaced, a
stopped one waits for READY)
- VrApi bridge: STAGE is the runtime's STAGE space (play-area centre and orientation, unchanged by recentering);
LOCAL_FLOOR keeps the head-based origin
- signer certificate: pick the certificate the SignerInfo names, not the first in the PKCS#7 block
- flat 32-bit apps keep the bridge (it isn't a VR-only fix)
- Frida gadget loads are stripped before translation
- launcher restart test fixed; native/.cache is no longer committed
- catalog: Shadow Point and Journey of the Gods work (headset, 2026-10-14; min_app 1.1.2)
- Check the Steam shortcut on every update, also when nothing else changed: a connection lost during
"Add to Steam" or Steam putting its old shortcuts.vdf back left games without a library entry. The
agent restarts Steam only when the entry really changes.
- Artwork updates for installs without a recorded artwork manifest start from a clean folder again
(an old portrait.jpg next to a new portrait.png was picked at random for the Steam grid).
- OpenSSH uploads only rename .part files that are already complete (sftp's reput refuses them, which
sent every resume to the Paramiko fallback).
- frame.tbxr_vendor revision 2: GL4ES ports get "Update on Frame" for the #191 draw fix.
- Configuration-only updates send the library's current Steam tags.
- finalize drops fingerprints and the artwork record an older app didn't send.
- set_settings: malformed numbers are refused before anything is written; int settings keep a
fractional value.
- Display diagnostics use Windows PowerShell 5.1 without pwsh's PSModulePath; window diagnostics and
the instance owner file can't stop the GUI from starting.
spoopyghosty0