Withering Rooms (PPSA21297)

[Bitencure]

Existing thread

• I searched this category for the title ID and no thread exists for this title on any platform.

Title

Withering Rooms (PPSA21297)

Content version tested

01.000.000

AnyPS5 commit

main 23be5a0 (2026-10-14), built from source, no pull requests on top

System tested

CachyOS Linux (kernel 7.2.9), GCC 16.2.1, AMD Radeon RX 9070 XT (Mesa 26.2.4, RADV), Ryzen 7 7800X3D, 31 GB RAM, KDE Wayland

Furthest point

In game

What is shown

Unity IL2CPP title. It converts, loads, reaches the title screen and plays, on unmodified main with no environment variables.

• Title screen: renders and responds, about 45 fps.
• In game (Gatehouse Residence, a study, Gatehouse Hallway): rooms render with lighting, the character walks between rooms and the "Open" prompt appears. 14-27 fps in the frames I captured, close to 30 at best, with cold shader caches.
• Glitches: the HUD bar at the top right is corrupted, and some walls show lighter rectangular patches.
• There was audio but it with hiccups

Current blocker

It crashes with SIGSEGV (exit 139) after 154 s and 232 s in two default runs, both at the same code address (WitheringRooms.elf + 0x1653dcb, same caller chain). Peak RSS about 10 GB.
The faulting instruction is the game's own allocator unlinking a free-list node: mov [r11+0x18], r10 with r11 = r10 = 0x3130313031303130 (a repeating 16-bit value). The node sits at 0x24ff80000, exactly the base of a 480x270 R16_SFLOAT storage image (StorageTexture vk=76) in the log. On an older commit (2cf23fc) the same crash came after 16-31 s with a 0x3c003c00 fill at another 480x270 R16_SFLOAT image.
This looks like a late GPU storage-image write-back landing in memory the engine has already freed and reused, so it may relate to #865, #4841 and #4448 (all open); I have not verified that. No issue tracks this title yet.
Import audit: 652 imports implemented, no missing system imports; 12 exported-but-throwing stubs (AJM batch calls, sceAudioInOpen, sceSslGet* name getters, sceSystemServiceParamGetString) were not hit in these runs.

How it was run

1. Staged the plain ELFs of the dump's decrypted/ folder (eboot, sce_module/.prx, Media/Modules/.prx, Media/Plugins/*.prx) under src/.
2. cd src && relinker --registry --module-dir Media/Modules --module-dir Media/Plugins eboot.elf ../out/WitheringRooms.elf (the relinker writes the *.guest.prx files into out/app0/)
3. out/app0 = the rest of the dump's resources without the SELF modules; out/libs -> build/core/libs/libs; chmod +x; then ./WitheringRooms.elf. No environment variables.
   Note: the Media/ title modules (Il2CppUserAssemblies, PS5Util, SaveData) must go in through --module-dir. Passing one as the input executable fails with "Unsupported relocation type 0x10".