Furi [PPSA06147]

[zanopi]

Existing thread

• I searched this category for the title ID and no thread exists for this title on any platform.

Title

Furi [PPSA06147]

Content version tested

01.007.225

AnyPS5 commit

main ea5c27b

System tested

Windows 11 build 26200, Ryzen 5 5600X, Radeon RX6600, 16GB RAM

Furthest point

In game

What is shown

Current blocker

The stop: AK::EventManager reads out of bounds, at the prison area after the tutorial boss.
It reproduced in 2 of 2 runs, at the same instruction:

FATAL: unhandled exception 0xc0000005 on thread 'AK::EventManager'
  rip AkSoundEngine.prx.guest.prx+0x180e57
  read of 0x0000000000001ffc     (run 1)
  read of 0x00000000000027fc     (run 2)

#0 AkSoundEngine+0x19c8ca   #5 AkSoundEngine+0x17a588
#1 AkSoundEngine+0x19aa5f   #6 AkSoundEngine+0x1a3f7d
#2 AkSoundEngine+0x17a40a   #7 AkSoundEngine+0xc4981
#3 AkSoundEngine+0x17b755   #8 AkSoundEngine+0x1a35e3
#4 AkSoundEngine+0x17ab9a   #9 libkernel+0x516a6

The faulting address moves between runs though. Both reads are limit − 4 (0x2000 − 4 and 0x2800 − 4), with r10 carrying the limit (0x1800, 0x2000) and rdx = r8 = r9 = 0x200 constant. So the same instruction walks off the end of a live object by one element, and the distance depends on state — not a fixed bad pointer.

This looks like the third title to hit it.

• Resident Evil Village Resident Evil Village (PPSA01556) #5169 — "the Wwise thread AK::EventManager hit an access violation walking a list whose record has every qword shifted by 4 bytes."
• Onimusha: Way of the Sword Onimusha: Way of the Sword (PPSA27836): Wwise thread AK::EventManager walks a corrupted list and faults on the EULA confirm #6046 — same thread, same failure. Closed as fixed, on the report that it no longer reproduced on main 0afa6a6. "I haven't bisected which change in between removed it."

Furi runs ea5c27b, which is 774 commits past that base, and still crashes the same way. So whatever removed it for Onimusha wasn't a fix.

Cause is likely known. #6046's comments identify this as a use-after-free: a Wwise voice object is freed, its memory reused for a stereo pan gain (0x70710677 pair), and the voice still points at it. The suspected mechanism is libSceAcm being a no-op — sceAcmBatchWait returns instantly, so a batch object can be freed before the batch would really have completed. Worth noting the AudioOut2 pacing there too: real time needs ~47 pushes/s, observed 0.4 to 7.2/s.

Open PRs: none apply. The open audio PRs are libSceAudioOut/AJM work, and this fault is in the title's own Wwise code, never a host library.

Local changes: none. All 128 libs are byte-identical to a clean upstream build, and no APS5_* switches were used.

How it was run

Relinked with the AnyPS5 relinker from a Release build, from the dump's eboot.bin:

relinker --windows --module-dir Media\Modules --module-dir Media\Plugins eboot.bin app.exe

--module-dir is required because the relinker only searches sce_module/, sce_modules/ and prx/ by default. A module found only at run time is then looked up as a host library in libs, and the title dies with Failed to load module: ...\libs<name>.prx. Furi keeps modules in two directories outside those defaults:

• Media/Modules — loaded at startup (Il2CppUserAssemblies.prx, PS5Util.prx)
• Media/Plugins — loaded at run time via sceKernelLoadStartModule

All 14 modules convert (6 in sce_module, 2 in Media/Modules, 6 in Media/Plugins); 1750 NID references, 0 filtered.
The relinker does not copy system libraries, so libs\ was staged separately with the 128 .prx from a build of this commit. It also needs libgcc_s_seh-1.dll, libstdc++-6.dll and libwinpthread-1.dll there — the .prx are loaded without searching PATH, so without them the title fails with error 126.

Environment variables: none. No APS5_* switches were needed to reach the blocker.

Two things were needed beyond the usage guide:

• The dumper's backup copies had to be moved out of the module directories. Dumps ship three copies per module (.prx, .prx.esbak, .prxbak) sharing a soname, and the relinker indexes modules by filename and soname, so conversion aborts with FAIL: Ambiguous guest dependency name: libSceFace.prx. 29 files were moved aside, nothing deleted.
• Game assets staged into app0 (Media, sce_sys).
  No title-specific configuration was needed — this is a Unity title, so no uecommandline.txt or engine config.
  Build: Release, BUILD_TESTING=OFF, MinGW-W64 GCC 15.2.0 (x86_64-ucrt-posix-seh), CMake 4.3.1, Ninja 1.13.2

AI-assisted: yes