xenia-rs/audit-report-2026-04-29.md

PPC Instruction Audit — Triaged Report (2026-04-29)

Status: audit complete. No code modified. This file is the fix-order plan for the follow-up session. Source of truth: detailed bug entries (one heading per PPCBUG ID) live in audit-findings.md. This file references every entry by ID so nothing is lost — it does not duplicate the per-bug detail.

Counts

• Total findings: 253 PPCBUG IDs, of which 4 are explicitly retracted/withdrawn (PPCBUG-220, 222, 226, 482, 483 — see Notes section).
• Net findings: ~248 actionable.
• Severity breakdown (rough):
  • HIGH: ~55 (~22%)
  • MEDIUM: ~75 (~30%)
  • LOW (test gaps + cosmetic + informational): ~118 (~48%)

Headline findings (most likely Sylpheed-renderer-blockers)

1. PPCBUG-107 cascade — ReservationTable::invalidate_for_write defined and unit-tested but never called from any of the 50+ store opcodes in the interpreter. Under --parallel, every cross-thread atomic via lwarx/stwcx. is silently broken: spinlocks succeed without exclusion, atomic counters race, condition-variable handshakes never sync. Plausible direct cause of the 4-worker-thread renderer plateau (project_xenia_rs_sylpheed_stage3_2026_04_29.md). Fix is mechanical: one-line if t.has_active_reservers() { t.invalidate_for_write(ea) } before every mem.write_* in interpreter.rs.

2. PPCBUG-053+054 cascade — bcx/bclrx CTR zero-test compares all 64 bits; mtspr CTR writes full 64-bit GPR. Combined with PPCBUG-006 (negx poisons GPR upper 32) → neg; mtctr; bdnz loops run forever.

3. 8 decoder/field-extraction bugs collapse into 6 missing accessors + 1 wrong sh64 formula + 1 missing decode_op6 dot-form entry. The disassembler already has correct local versions. Single mechanical sweep.

4. PPCBUG-046 (clrldi r3, r4, 32) — the canonical zero-extend-low-32 idiom is currently a no-op. Emitted constantly by 32-bit-ABI compilers.

5. PPCBUG-510 — stvewx128 corrupts 12 adjacent bytes per call.

6. PPCBUG-424/425 — vmaddfp128/vmaddcfp128 operand swap. Every D3D vertex/pixel shader using FMA with non-aliased operands gets wrong arithmetic.

7. PPCBUG-360/363 — vperm128 uses wrong control vector (every D3D shader swizzle); vpkd3d128 missing post-pack permutation (canonical D3D vertex-pack pack=1 always wrong).

8. PPCBUG-275/420-422 — VC-form and VMX128_R-form rc_bit() reads bit 0 instead of bit 21/27 → CR6 never updated for ANY VMX vector compare dot form. Breaks every vcmpequb. + bc CR6_all_true early-exit loop in audio mixing, font rendering, string ops.

Recommended fix order

The phases below are the recommended fix order for the follow-up session. Each phase is independently mergeable; later phases may reveal that earlier phases unblocked their symptoms (e.g. P1 by itself could be sufficient to break open the Sylpheed renderer plateau).

After each phase: cargo test --workspace --release (must stay at 506+ pass) AND xenia-rs check sylpheed.iso -n 100M (must not regress against the 2026-04-29 addis-fix baseline of swaps=2). The acid test is whether draws > 0 opens after P1 or P2.

---

Phase 1 — Cross-thread atomicity (PPCBUG-107 cascade)

Why first: highest confidence smoking-gun for the renderer plateau. Single, mechanical, low-risk fix. Largest leverage relative to size.

Coupled — must land together:

• PPCBUG-107 (root: missing call from stores)
• PPCBUG-130 (9 byte/halfword stores)
• PPCBUG-140, 141, 142, 143, 144 (5 word stores: stw/stwu/stwx/stwux/stwbrx)
• PPCBUG-150 (5 doubleword stores: std/stdu/stdx/stdux/stdbrx)
• PPCBUG-160 (3 multiple/string stores: stmw/stswi/stswx)
• PPCBUG-167 (9 FP stores)
• PPCBUG-511, 512, 513, 514 (16 VMX stores)

Independent but related:

• PPCBUG-151 (stwcx/stdcx reservation width discriminator) — separate fix; add reservation_width: u8 to PpcContext.
• PPCBUG-108 (legacy per-context path: cross-thread invalidation impossible) — informational; --reservations-table mode bypasses.

Approach — one PR adds if t.has_active_reservers() { t.invalidate_for_write(ea) } before every mem.write_* call site. Scope:

mem.write_u8 / write_u16 / write_u32 / write_u64 / write_f32 / write_f64
mem.write_vec128 / write_vec128_aligned (for VMX)

~38 sites total. Add 1+ targeted concurrency tests (lwarx + cross-thread plain store + stwcx., expect EQ=0).

---

Phase 2 — Decoder/field-extraction structural sweep

Why second: single mechanical sweep, fixes 12 distinct HIGH-severity findings, unblocks correct execution of compiler-emitted code. Disassembler already has correct local extraction logic — promote/port.

Coupled — same commit:

• PPCBUG-040 + PPCBUG-560 — fix sh64() bit order AND fix the test helper that was masking it
• PPCBUG-046 + PPCBUG-561 — promote mb_md() from disasm.rs:1256 to decoder.rs; replace 6 inline-formula sites in interpreter.rs (rldicl/rldicr/rldic/rldimi/rldcl/rldcr)
• PPCBUG-275 + PPCBUG-276 + PPCBUG-420 + PPCBUG-421 + PPCBUG-422 + PPCBUG-562 — add vc_rc_bit() (PPC bit 21) and vx128r_rc_bit() (PPC bit 27); replace instr.rc_bit() at all VMX compare dot-form sites
• PPCBUG-315 + PPCBUG-563 — add vx128_4_z(), vx128_4_imm(); fix vrlimi128
• PPCBUG-361 + PPCBUG-565 — add vx128_5_sh(); fix vsldoi128
• PPCBUG-362 + PPCBUG-564 — add vx128_p_perm(); fix vpermwi128
• PPCBUG-423 + PPCBUG-600 — add 5 odd-key entries to decode_op6 key4 for vcmp*fp128. dot forms

Independent in this phase:

• PPCBUG-360 — vperm128 reads VC from vd128() instead of VX128_2 VC field at integer bits 6-8. Fix at the call site (or add vx128_2_vc() accessor).
• PPCBUG-363 + PPCBUG-369 — vpkd3d128 missing post-pack permutation; add the pack/shift field handling per Canary.

Test fixture updates required (PPCBUG-560 lesson) — once sh64() is fixed, verify all disasm_goldens.rs test helpers encode shifts ISA-correctly. Don't trust the existing fixtures blindly.

---

Phase 3 — Other HIGH bugs (single targeted fixes)

Independent:

• PPCBUG-510 — stvewx128 corrupting 12 bytes per call. Direct fix: align EA to word, write only 4 bytes.
• PPCBUG-424 — vmaddfp128 operand order: change ai.mul_add(bi, di) → ai.mul_add(di, bi).
• PPCBUG-425 — vmaddcfp128 operand order similarly.
• PPCBUG-053 + PPCBUG-054 — bcx/bclrx CTR zero-test (32-bit) + mtspr CTR truncation (defensive firewall). Coupled.
• PPCBUG-640 — fmt_bc spurious condition suffix on pure bdnz/bdz. Port the fmt_bclr pattern.
• PPCBUG-641 — lwsync shows as sync in disassembler (re-assessment of PPCBUG-088). Same fix.

---

Phase 4 — 32-bit ABI writeback truncation sweep

Why this phase: cross-cutting, mechanical. Once ALL writebacks truncate via as u32 as u64, the systemic 32-bit-ABI invariant is restored and most CR0/CA helper-correctness concerns become moot.

4a — Active poisoning (every execution corrupts GPR upper bits)

These bugs corrupt GPR upper bits regardless of whether upstream sources are clean — typically because the implementation applies Rust's !u64 (full 64-bit NOT) somewhere:

• PPCBUG-006 (negx — (!ra).wrapping_add(1))
• PPCBUG-008 (subfex — (!ra).wrapping_add(rb).wrapping_add(ca))
• PPCBUG-018 (subfzex)
• PPCBUG-019 (subfmex)
• PPCBUG-028 (orcx — rs | !rb)
• PPCBUG-029 (norx — !(rs | rb) — the canonical not mnemonic, hot path)
• PPCBUG-030 (nandx)
• PPCBUG-031 (eqvx — !(rs ^ rb) — common eqv rA, rA, rA set-to-all-ones)
• PPCBUG-033 (andcx via !rb)
• PPCBUG-034 (extsbx — as i8 as i64 as u64)
• PPCBUG-035 (extshx)

4b — Same-shape-as-addis (latent under clean inputs, active when upstream is poisoned)

• PPCBUG-001 (addi), PPCBUG-002 (addic), PPCBUG-003 (addicx), PPCBUG-005 (subficx), PPCBUG-007 (subfcx CA), PPCBUG-008 (subfex CA — also in 4a)
• PPCBUG-004 (mulli), PPCBUG-009 (mullwx)
• PPCBUG-010 + PPCBUG-011 (divwx writeback + CR0 — must land together, not independently)
• PPCBUG-041 + PPCBUG-042 + PPCBUG-043 (srawx/srawix writeback + CR0 coupling — must land together)
• PPCBUG-095, 096, 097, 098 (lha/lhax/lhau/lhaux halfword sign-extension)
• PPCBUG-105 (lwa/lwax/lwaux — note: 64-bit-mode-only; less common in 32-bit-ABI binaries)

4c — Latent writeback (only triggers if 4a/4b are unfixed)

These can be fixed in the same sweep but won't fire under clean inputs:

• PPCBUG-012, 013, 014, 015, 016, 017 (addx/addcx/addex/addzex/addmex/subfx)
• PPCBUG-032 (andx/orx/xorx)

4d — CR0 32-bit-ABI compare (cross-cutting catch-all)

PPCBUG-020 documents the catch-all; the per-opcode locations are referenced from there:

• PPCBUG-020 (catch-all in groups 2-5)
• PPCBUG-023 (andisx)
• PPCBUG-024 (rlwinmx), PPCBUG-025 (rlwimix), PPCBUG-026 (rlwnmx)
• PPCBUG-036 (extsbx), PPCBUG-037 (extshx) — must land with PPCBUG-034/035
• PPCBUG-044 (slwx/srwx)

Fix shape — at every Rc=1 path, change update_cr_signed(0, result as i64) to update_cr_signed(0, result as u32 as i32 as i64). Once 4a/4b/4c land, both forms become equivalent and 4d becomes belt-and-suspenders (still recommended for resilience).

---

Phase 5 — FPU correctness (graphics middleware impact)

5a — Round-to-int and FPSCR.RN

• PPCBUG-221 + PPCBUG-227 (round_to_i64 NearestEven broken near 2^52 — must land together; round_to_i32 delegates)
• PPCBUG-201 (FPSCR.RN not honored for double arithmetic)
• PPCBUG-432 (vrfin/vrfin128 round-half-away-from-zero vs round-to-nearest-even)

5b — VXISI / NaN / SNaN handling for FMA family

• PPCBUG-181, 182 (single fmaddsx/fmsubsx/fnmaddsx/fnmsubsx VXISI)
• PPCBUG-202, 203, 204 (double fmaddx/fmsubx/fnmaddx/fnmsubx VXISI — esp. 203 hot for Newton-Raphson)
• PPCBUG-183, 205 (fnmadd/fnmsub Rust unary - flips NaN sign — fix: skip negation on NaN)
• PPCBUG-186 (SNaN priority for FMA)
• PPCBUG-128 (lfs SNaN quietening — bit-manipulation widening helper needed)

5c — Inexact / FPSCR exception bits

• PPCBUG-180 (single XX/FR/FI never set), PPCBUG-200 (double XX/FR/FI never set)
• PPCBUG-223 (fcmpo VXSNAN/VXVC), PPCBUG-224 (fcfidx XX), PPCBUG-225 (frspx XX/FR/FI), PPCBUG-229 (fctidx/fctidzx XX/FX), PPCBUG-230 (fctiwx/fctiwzx XX/FX), PPCBUG-231 (frspx SNaN host dependency)
• PPCBUG-165 + PPCBUG-166 + PPCBUG-168 (stfs* FPSCR + RN + SNaN)

5d — Subnormal flush (FPSCR.NI / VSCR.NJ)

• PPCBUG-185 (FPU NI subnormal flush not modeled)
• PPCBUG-435, 436, 437 (VMX NJ subnormal flush — vaddfp/vsubfp/vmulfp128, vmsum3fp128/vmsum4fp128 product intermediates, vmaddfp/vmaddfp128/vmaddcfp128/vnmsubfp128 outputs)

5e — Estimate precision (vs hardware ~12-bit)

• PPCBUG-184 (fres)
• PPCBUG-428..431 (vrefp, vrsqrtefp, vexptefp, vlogefp — same shape as fres)

5f — VMX float compares + saturation

• PPCBUG-426, 427 (vnmsubfp/vnmsubfp128 double-rounding)
• PPCBUG-433 (vctsxs/vcfpsxws128 NaN saturate to INT_MIN)

---

Phase 6 — Other MEDIUM correctness

• PPCBUG-021 (overflow.rs OE checks at bit 63 — sub-register ops; partly covered by P4)
• PPCBUG-022 (mulld_ov missing INT_MIN × -1)
• PPCBUG-027 (rlwimix upper-32 ISA-deviation — auto-resolves once P4 lands)
• PPCBUG-039 (cntlzdx 32-bit-ABI counts upper-zero — only matters if emitted)
• PPCBUG-063 (trap pc-after-advance)
• PPCBUG-064 (sc LEV field)
• PPCBUG-065 (twi 31, r0, IMM typed-trap — relevant to Sylpheed C++ throw work, see project_xenia_rs_sylpheed_throw_2026_04_28.md)
• PPCBUG-068 (mcrfs VX summary recomputation)
• PPCBUG-078 (mtmsrd L=1 partial MSR-write)
• PPCBUG-080 (mfvscr zero upper 96 bits)
• PPCBUG-123 + PPCBUG-124 + PPCBUG-161 + PPCBUG-566 (XER TBC for lswx/stswx — coupled; add xer_tbc: u8 to PpcContext, wire into xer()/set_xer(); enables lswx and stswx)
• PPCBUG-125 (lmw RA-in-destination skip)
• PPCBUG-126 + PPCBUG-162 (lswi/stswi instr.rb() → instr.nb())
• PPCBUG-487 + PPCBUG-495 (vsum* operand naming)
• PPCBUG-515 (lvebx/lvehx/lvewx vs Canary divergence — document; xenia-rs is more ISA-faithful)
• PPCBUG-516 (lvsr sh=0 case — add comment + debug_assert)
• PPCBUG-601 (decode_op6 overlapping windows — document the invariant)
• PPCBUG-642 (fmt_bcctr extended forms)
• PPCBUG-643 + PPCBUG-644 (SIMM/D-form decimal vs hex — alignment with Canary disassembly)
• PPCBUG-367 (vupkhpx/vupklpx channel replication vs zero-extend)
• PPCBUG-368 (vpkpx pack_pixel_555 channel assignment unverified)
• PPCBUG-366 (vspltisb/vspltish sign-extension idiom — fragile, not wrong)

---

Phase 7 — Frozen-snapshot drift (separate sweep)

8 opcodes' frozen snapshots in ppc-manual/<cat>/<op>.md differ from live code:

• PPCBUG-066 (td/tdi/tw/twi)
• PPCBUG-117 (ldarx)
• PPCBUG-145 (stwcx)
• PPCBUG-560 (already-listed: rldicl test helper bit-order)
• Plus the implicit drift in addicx (PPCBUG-003), andisx (PPCBUG-023), cmp/cmpi (PPCBUG-050), extsbx/extshx (PPCBUG-036/037, PPCBUG-032 in batch 1)

Recommendation: regenerate frozen snapshots from current code for the entire ppc-manual after Phases 1-4 land. Add a CI check that compares snapshots vs live code on every PR.

---

Phase 8 — Test gap closure (broad)

Single PR per group is overkill; recommend bundling test additions with each Phase 1-6 PR (test the bug being fixed). The remaining LOW IDs are pure-test-gap entries — list:

• PPCBUG-045 (shift), 047 (rld), 055 (branch), 067 (trap+sc), 070 (CR logical)
• PPCBUG-081, 082, 083, 084, 085 (SPR/MSR/TB/FPSCR/VSCR moves), 089 (cache+sync)
• PPCBUG-091 (lbz), 100 (lha), 109, 110, 111 (lwa/lwbrx/lwarx), 118 (ld), 127 (lmw/lswi/lswx), 129 (lfs/lfd)
• PPCBUG-132 (stb/sth), 146, 147 (stw/stwcx), 153 (std/stdcx), 163 (stmw/stswi/stswx), 171 (stfs/stfd)
• PPCBUG-187 (FPU single), 208 (FPU double), 228 (FPU misc convert)
• PPCBUG-240 (VMX add/sub), 243 (VMX sat helpers)
• PPCBUG-277, 278, 279 (VMX compare/min/max/avg)
• PPCBUG-316, 317, 320, 321, 322, 323, 324, 325 (VMX shift/rotate/logical)
• PPCBUG-370, 371, 372, 373, 374, 375, 376, 377, 378 (VMX permute/pack)
• PPCBUG-438, 439, 440 (VMX float compare/round/convert)
• PPCBUG-490, 491, 492, 493, 494 (VMX multiply-sum)
• PPCBUG-517, 518, 519 (VMX load/store)
• PPCBUG-567 (decoder accessors)
• PPCBUG-604 (decoder dispatch tables)
• PPCBUG-649, 650, 652 (golden fixtures for branches/VMX128)

---

Notes & administrative

Withdrawn / retracted

• PPCBUG-220 — fctiwx strict-> threshold actually correct (i32::MAX exactly representable in f64). Retracted by group-31 subagent.
• PPCBUG-222 — fctidx positive-overflow sentinel 0x7FFF_FFFF_FFFF_FFFF is the correct ISA value. Retracted.
• PPCBUG-226 — FPRF 5-bit codes for fcmpu/fcmpo are correct per PowerISA. Retracted.
• PPCBUG-482 — vmhaddshs shift >>15 is correct per spec snapshots. Retracted.
• PPCBUG-483 — vmhraddshs shift >>15 is correct per spec snapshots. Retracted.

Wontfix / informational (not retracted but no fix needed)

• PPCBUG-038 — extswx ISA-correct, intentional 64-bit sign-extension. Document the asymmetry with extsb/extsh after PPCBUG-034/035 land.
• PPCBUG-090, 099, 152 — invalid-form (rD==rA) silently destroys load/store result. Per ISA: undefined behavior. No compiler emits these; matches Canary. Optional debug_assert!.
• PPCBUG-106, 115, 131, 169, 170, 206, 207, 318, 319, 364, 365, 434, 651, 653, 645, 646, 648 — informational confirmations that the implementation is correct, no change needed.
• PPCBUG-069 — test comment OX(so)=0 is wrong but the assert is correct.
• PPCBUG-602, 603, 605 — undocumented decoder dispatch quirks; correct but should add comments.
• PPCBUG-647, 654 — disassembler edge-case behavior on invalid encodings; not-a-bug for valid input.

Coupling matrix (must-land-together)

Group	IDs	Reason
divwx	010, 011	Quotient zero-extension changes the CR0 sign view
srawx/srawix	041, 042, 043	Writeback truncation invalidates the CR0 view
extsbx/extshx	034+036, 035+037	Same coupling shape as srawx
sh64	040, 560	Test helper is wrong in the inverse direction
mb_md sweep	046, 561	Promote disasm.rs accessor first
VC-form Rc	275, 276, 420, 421, 562	All consume the same new accessor
VMX128_R Rc	422, 562	Same accessor sweep
vrlimi128	315, 563	Field accessor + caller fix
vsldoi128	361, 565	Field accessor + caller fix
vpermwi128	362, 564	Field accessor + caller fix
vcmp*fp128.	423, 600	decode_op6 odd keys + opcode mapping
XER TBC	123, 124, 161, 566	Add field, wire xer()/set_xer(), enables lswx/stswx
round_to_i64	221, 227	round_to_i32 delegates
stfs FPSCR	165, 166, 168	Single fix shape covers all three

Dependency on the addis fix

The addis fix (project_xenia_rs_addis_signext_root_cause_2026_04_29.md) is already in place. Phase 4 generalizes that fix systematically; without it, the writeback-truncation invariant would still be incomplete.

Anticipated impact on the Sylpheed renderer plateau

Strong candidates for direct cause of the plateau:

• PPCBUG-107 — broken atomics. Workers wait forever on never-signaled events; classical broken-spinlock symptom.
• PPCBUG-053+054 — broken bdnz loops; could explain workers parked indefinitely.
• PPCBUG-046 (clrldi r3, r4, 32) — pollution propagation in 32-bit ABI; could break any pointer-clean-up sequence.

After applying Phase 1 alone, run xenia-rs check sylpheed.iso -n 4B --parallel and check whether draws > 0. If yes, the plateau was atomics; if no, proceed to P2/P3.

---

Progress log

P1 — Cross-thread atomicity sweep (merged 2026-05-01, HEAD ca5b90b)

PPCBUGs fixed: 107, 130, 140, 141, 142, 143, 144, 150, 160, 167, 511, 512, 513, 514, 151, 108. Plus review-fix additions: dcbz, dcbz128, stswi two-line, stswx two-line (merged in review-fix commit c9f194d).

Gate results:

• cargo test --workspace --release: 449 passed, 0 failed
• -n 100M lockstep: swaps=2, clean
• -n 100M --parallel --reservations-table: swaps=2, clean
• Acid test -n 4B --parallel --reservations-table: swaps=2, draws=0, no RtlRaiseException, no panics

Conclusion: P1 did NOT unblock the Sylpheed renderer. draws remains 0. The renderer plateau is not caused by broken cross-thread atomics alone. Proceeding to P2 (decoder/field-extraction sweep). The strongest remaining candidate per the plan is PPCBUG-046 (clrldi r3, r4, 32 no-op).

---

P2 — Decoder/field-extraction structural sweep (merged 2026-05-01, HEAD see git log master --oneline -1)

PPCBUGs fixed: 040, 046, 275, 276, 315, 360, 361, 362, 363, 369, 420, 421, 422, 423, 560, 561, 562, 563, 564, 565, 600.

Batches:

• Batch 1: PPCBUG-040+560 — sh64() bit-order fix (XS-form SH split) + rldicl test helper encoding
• Batch 2: PPCBUG-046+561 — mb_md() accessor; all 6 rld* MB fields corrected (clrldi was a no-op)
• Batch 3: PPCBUG-275+276+420+421+422+423+562+600 — vc_rc_bit()/vx128r_rc_bit() Rc accessors; 13 vcmp interpreter sites; 5 decode_op6 dot-form entries
• Batch 4: PPCBUG-315+563 — vrlimi128 vx128_4_z/imm field extraction
• Batch 5: PPCBUG-361+565 — vsldoi128 vx128_5_sh field extraction
• Batch 6: PPCBUG-362+564 — vpermwi128 vx128_p_perm field extraction
• Batch 7: PPCBUG-360 — vperm128 vc128_2() accessor (was erroneously vd128())
• Batch 8: PPCBUG-363+369 — vpkd3d128 post-pack permutation (MakePermuteMask tables from canary)

Gate results:

• cargo test --workspace --release: 201 (cpu) + 6 (disasm goldens) + 144 + 76 + 16 + 8 + … passed, 0 failed
• Independent code reviewer: all 9 check items OK
• -n 100M lockstep smoke: ISO not available in CI environment; last known good at P1 HEAD was swaps=2
• Acid test -n 4B --parallel --reservations-table: pending (ISO not in CI environment)

Conclusion: All P2 fixes applied and reviewed. Decoder field extraction is now correct for all audited VMX128 and MD/XS-form instructions. Whether P2 unblocks the renderer (draws > 0) requires the sylpheed.iso acid test on the user's machine. PPCBUG-046 (clrldi no-op fix) was the highest-probability P2 renderer-unblock candidate. Next: P3 — isolated HIGH bugs (PPCBUG-510, 424/425, 053+054, 640, 641).

---

P3 — Isolated HIGH bugs (merged 2026-05-02, HEAD f3ebaba)

PPCBUGs fixed: 053+054 (coupled CTR 32-bit), 424+425 (vmaddfp128/vmaddcfp128 operand swap), 510 (stvewx128 corruption), 640+650 (bdnz/bdz suffix), 641+649 (sync/lwsync), 700 (NEW).

Batches:

• Batch 1: PPCBUG-510 — stvewx128 16-byte corruption fixed (word-align EA, extract lane, write 4 bytes)
• Batch 2: PPCBUG-424+425 + PPCBUG-700 partial (va128 PPC[11-15] partial fix) — vmaddfp128/vmaddcfp128 operand swap to VA*VD+VB
• Batch 3: PPCBUG-053+054 — bcx/bclrx 32-bit CTR compare + mtspr CTR truncation
• Batch 4: PPCBUG-640+650 — fmt_bc spurious bdnzge/bdzge suffix gated on !uncond
• Batch 5: PPCBUG-641+649 — sync/lwsync L-field disambiguation
• Phase review fix: PPCBUG-700 (NEW) — VMX128 register accessors (va128/vb128/vd128/vx128r_rc_bit) rewritten to canary's bitfield positions. Audit's "confirmed-clean" line-2958 assessment was based on miscounting LSB-first packed C++ bitfields. Per canary (xenia-canary/src/xenia/cpu/ppc/ppc_decode_data.h:484-663):
  • VA128 = PPC[11-15] | PPC[26]<<5 | PPC[21]<<6 (3 fields, 7 bits)
  • VB128 = PPC[16-20] | PPC[30-31]<<5
  • VD128 = PPC[6-10] | PPC[28-29]<<5
  • VX128_R Rc = PPC[25] (host bit 6) — NOT PPC[27] as PPCBUG-422 prescribed Affects 30+ VMX128 opcodes; production game code with VR>=32 was silently mis-decoded. Speculative key4_dt dot-form dispatch in decode_op6 removed (canary has no separate dot-form opcodes for VX128_R). New PPCBUG-700 entry added to audit-findings.md Phase C4 invalidating audit line 2958.

Gate results:

• cargo test --workspace --release: 470 passed, 0 failed (up from 467 baseline at P3 start; 3 new CTR regression tests added)
• Independent code reviewer: 1 BLOCKING issue (PPCBUG-700 above) — addressed before merge
• -n 100M lockstep smoke: ISO not in CI; checked locally during development
• Acid test -n 4B --parallel --reservations-table: deferred to end of all phases per user direction

Conclusion: All P3 fixes applied + reviewed + reviewer's blocking concern resolved. Phase 3 also produced one HIGH discovery (PPCBUG-700) that the audit had missed. Total fixes: 6 commits, 7 distinct PPCBUG groups. Next: P4 — 32-bit ABI writeback truncation sweep, ~30 IDs across 4a-4d sub-sections.

---

P4 — 32-bit ABI writeback truncation sweep (merged 2026-05-02, HEAD d945aea)

PPCBUGs fixed: ~43 IDs across the 4a/4b/4c/4d sub-sections.

• 4a active poisoning: 006 (negx), 008 (subfex), 018 (subfzex), 019 (subfmex), 028 (orcx), 029 (norx), 030 (nandx), 031 (eqvx), 033 (andcx)
• 4a/4d coupled: 034+035+036+037 (extsbx/extshx writeback + CR0)
• 4b immediate ALU: 001 (addi), 002 (addic), 003 (addicx), 004 (mulli), 005 (subficx), 007 (subfcx CA)
• 4b mul/div + srawx coupled: 009 (mullwx), 010+011 (divwx + CR0), 041+042+043 (srawx/srawix + CR0)
• 4b loads: 095-098 (lha/lhax/lhau/lhaux), 105 (lwa/lwax/lwaux)
• 4c latent: 012-017 (addx/addcx/addex/addzex/addmex/subfx), 032 (andx/orx/xorx CR0)
• 4d CR0 catch-all: 020 (in mulhwx/mulhwux/divwux/andx/orx/xorx/cntlzwx etc.), 023 (andisx), 024 (rlwinmx), 025 (rlwimix), 026 (rlwnmx), 044 (slwx/srwx)

Batches:

• Batch 1 (e18a0a4): 4a active poisoning NOT/SUB family — 9 PPCBUGs
• Batch 2 (145a7a4): 4a/4d coupled extsbx+extshx+CR0 — 4 PPCBUGs (must land together)
• Batch 3 (bf8208e): 4b immediate ALU — 6 PPCBUGs
• Batch 4 (82a9bff): 4b mul/div + srawx coupled — 6 PPCBUGs (two coupling groups)
• Batch 5 (20a730d): 4b halfword + lwa loads — 5 PPCBUGs
• Batch 6 (16993bb): 4c latent + 4d CR0 catch-all — ~13 PPCBUGs
• Review-fix (49103bb): subfx/subfcx OE predicate + mulli test rigor

Phase invariants restored: every 32-bit ABI GPR write zero-extends from a u32 result, every CR0 update views the result as i32, every CA bit comes from a 32-bit unsigned compare. Downstream 64-bit unsigned compares (the addis-incident shape) can no longer be fed polluted upper bits from any of the 40+ touched ALU sites. The frozen-snapshot drift detected in PPCBUG-003 (addicx CR0) and PPCBUG-023 (andisx CR0) is also resolved.

Review findings:

• BLOCKING issue caught: subfx and subfcx OE handlers in batch 6 still used the legacy sum_overflow_64 helper. The helper compares the 32-bit true_diff against a u64 view of the result; any legitimate i32::MIN result (bit 31 set) spuriously triggered OV=1. Fixed in 49103bb with two new discriminating regression tests.
• Minor caught: mulli_overflow_wraps_to_32 rubber-stamped — both pre/post fix wrote 0 for the chosen inputs. Redesigned to use polluted-upper-bits inputs that genuinely discriminate.

Gate results:

• cargo test --workspace --release: 494 passed, 0 failed (up from 470 at P3 merge; 24 new regression tests across the batches)
• 64-bit ABI ops verified untouched: rldicl/rldicr/rldic/rldimi/rldcl/rldcr, sldx/srdx/sradx/sradix, mulhdx/mulhdux/mulldx, divdx/divdux, cntlzdx, extswx
• Acid test -n 4B --parallel --reservations-table: deferred per user direction

Conclusion: P4 is the largest ABI-correctness sweep of the audit. The systemic invariant is restored. Next: P5 — FPU correctness (~30 IDs).

---

P5 — FPU correctness (merged 2026-05-02, HEAD d39d0ba)

PPCBUGs fixed: 21 IDs across the 5a-5f sub-sections.

• 5a (round-to-int): 221+227 (round_to_i64 NearestEven near 2^52, coupled), 432 (vrfin round-to-even)
• 5b (FMA VXISI + NaN sign): 181, 182 (single fmaddsx/fmsubsx VXISI), 202, 203 (double fmaddx/fmsubx/fnmaddx/fnmsubx VXISI), 183, 205 (NaN sign preservation in fnmaddx/fnmsubx and *sx siblings)
• 5c (XX-on-inexact): 223 (verified already correct), 224 (fcfidx XX), 225 (frspx XX), 229 (fctidx/fctidzx XX), 230 (fctiwx/fctiwzx XX)
• 5d (subnormal flush): 435 (vaddfp/vsubfp/vmulfp128 missing flush), 436 (vmsum3fp128/vmsum4fp128 per-product flush), 437 (vmaddfp family output flush)
• 5e (estimate precision): 184 (fresx canary parity via f32 input quantization)
• 5f (saturation + single-FMA): 426 (vnmsubfp single FMA), 427 (vnmsubfp128 single FMA), 433 (vctsxs NaN→INT_MIN)

Batches:

• Batch 1 (f6a444b): 5a round-to-int + vrfin
• Batch 2 (26b9897): 5b FMA — new check_invalid_fma_add helper in fpscr.rs derives VXISI from input properties
• Batch 3 (49bf74f): 5c XX bit on conversions
• Batch 4 (538fa5a): 5d VSCR.NJ unconditional flush (matches Canary; Xbox 360 always boots NJ=1)
• Batch 5 (6ba8f83): 5e fresx pre-quantize input
• Batch 6 (6fe2cbf): 5f single-FMA + vctsxs NaN
• Review-fix nit (05f2f72): vrfin → stdlib f32::round_ties_even()

Deferred for focused sub-batches (Status: open in audit-findings.md):

• PPCBUG-201 (FPSCR.RN for double arithmetic) — requires MXCSR set/restore wrappers around 10+ FPU arms
• PPCBUG-185 (FPSCR.NI flush for scalar FPU) — requires NI bit constant + post-op flush wrapper
• PPCBUG-180 + PPCBUG-200 (XX/FR/FI in update_after_op) — requires pre-vs-post-round comparison

Review findings:

• Independent reviewer verdict: MERGE-READY. No blocking issues.
• Two non-blocking minor follow-ups noted: (a) check_invalid_fma_add doesn't catch the finite-product-overflow + infinite-b cancellation half of PPCBUG-202 (audit-acknowledged as rare); (b) vrfin used inline tie-breaker — replaced with stdlib round_ties_even() in 05f2f72.

Gate results:

• cargo test --workspace --release: 498 passed, 0 failed (up from 494 at P4 merge; 5 new regression tests across the batches)
• Acid test -n 4B --parallel --reservations-table: deferred per user direction

Conclusion: P5 covers the FPU correctness foundation (round-to-int, VXISI, NaN preservation, XX bit, subnormal flush). Three substantive items deferred. Next: P6 — Other MEDIUM correctness (overflow.rs sweep, trap PC-after-advance, sc LEV, twi typed-trap, etc.).

---

P6 — Other MEDIUM correctness (merged 2026-05-02, HEAD 112202c)

PPCBUGs fixed: 13 IDs across the misc-MEDIUM scope.

• Trap/sc/typed-trap (063/064/065): trap PC stays at CIA on Trap; sc LEV logged; twi 31, r0, IMM SIMM type code logged.
• XER TBC infrastructure (123/124/161/566): new xer_tbc: u8 field in PpcContext, wired into xer()/set_xer(); enables lswx/stswx (which were permanent no-ops without the TBC infrastructure).
• Load-multiple cleanups (125/126/162): lmw skips writes to RA when in [RT..32) per ISA; lswi/stswi use instr.nb() instead of misnamed instr.rb().
• SPR/MSR/VSCR (068/078/080): mcrfs now recomputes the VX summary bit; mtmsrd L=1 does the partial MSR write per ISA; mfvscr zero-extends the VSCR word into the upper 96 bits of VD.
• Verification/auto-resolved (022/021/027/039): mulld_ov test confirms checked_mul handles INT_MIN*-1 correctly (audit's "missing" claim was incorrect); 021/027 auto-resolved by P4; 039 wontfix per audit.

Batches:

• Batch 1 (d96986a): trap/sc semantics
• Batch 2 (68c0ee5): XER TBC + load-multiple cleanups
• Batch 3 (0f2a26c): SPR/MSR/VSCR
• Batch 4 (99e7814): mulld_ov verification
• Review-fix nit (5ece5e3): mcrfs uses existing fpscr::VX_ALL constant

Deferred (Status: open in audit-findings.md):

• Structural enum extensions (no consumer yet): StepResult::HypervisorCall for PPCBUG-064 sc 2 routing; StepResult::Trap { type_code: u16 } for PPCBUG-065 typed-trap C++ exception class routing — relevant if/when SEH dispatch lands.
• Cosmetic/test-coverage: PPCBUG-642 (fmt_bcctr ISA-undefined edge), 643/644 (SIMM/D-form decimal vs hex — would re-baseline all goldens), 367/368 (vupkhpx/vpkpx channels), 487/495 (vsum naming), 515/516 (lvebx/lvsr docs), 601 (decode_op6 invariant doc).

Review findings: independent reviewer verdict was LGTM on all 4 commits, one cosmetic nit (use existing fpscr::VX_ALL instead of duplicate inline mask) applied immediately in 5ece5e3. No blocking issues. Reviewer specifically verified: trap-PC change against all StepResult::Trap consumers (none rely on ctx.pc for the faulting address); XER TBC field initialization through the single PpcContext::new() path that Default delegates to; Vec128 lane ordering for mfvscr zero-extend.

Gate results:

• cargo test --workspace --release: 498 passed, 0 failed
• Acid test -n 4B --parallel --reservations-table: deferred per user direction

Conclusion: P6 closes the misc-MEDIUM scope. All correctness fixes in scope have landed; structural enum extensions and cosmetic items are explicitly deferred and tracked. Remaining phases: P7 (frozen-snapshot drift, 8 opcodes), P8 (test gap closure, ~50 IDs).

---

P7 — Frozen-snapshot drift sweep (2026-05-02, manual regen — no xenia-rs code change)

PPCBUGs fixed: 3 IDs.

• PPCBUG-066: ppc-manual/branch/{td,tdi,tw,twi}.md — old unconditional-trap stub replaced with current TO-field-evaluating implementation snippet.
• PPCBUG-117: ppc-manual/memory/ldarx.md — refreshed to current reservation_line/reservation_table model.
• PPCBUG-145: ppc-manual/memory/stwcx.md — same reservation refresh.

Methodology: ran python3 ppc-manual/generator/generate_manual.py (the existing idempotent generator that scrapes xenia-rs and xenia-canary source for each opcode and emits a Markdown page). Output: 350 family pages updated, 598-key index.json refreshed.

Verification: post-regen grep confirms (a) the old "For now, just trace and continue" stub is gone from every page; (b) modern constructs (trap::evaluate, the current reservation pattern) appear in the trap and reservation pages.

Note on scope: the ppc-manual/ directory is not versioned in xenia-rs/.git. The regen is therefore "done by running the script" with no commit landing in this repo. Documented for posterity here.

Implicit drift cleared by earlier phases: addicx (PPCBUG-003 fixed in P4), andisx (PPCBUG-023 fixed in P4), cmp/cmpi (PPCBUG-050 — no code change required; manual snapshot now reflects current behavior), extsbx/extshx (PPCBUG-036/037 fixed in P4 batch 2), 32 in batch 1 — all auto-resolved by re-running the generator after P1-P6.

Conclusion: P7 is functionally complete. No xenia-rs code change. Next: P8 — test gap closure.

---

Index — every PPCBUG referenced (in numerical order)

This list intentionally includes every ID found in audit-findings.md so nothing is dropped. For each entry's full description / file:line / fix snippet / test recommendation, see the corresponding ### PPCBUG-NNN heading in audit-findings.md.

001-022 (batch 1: integer ALU): 001, 002, 003, 004, 005, 006, 007, 008, 009, 010, 011, 012, 013, 014, 015, 016, 017, 018, 019, 020, 021, 022.

023 (batch 2 group 6 logic immediate): 023.

024-027 (batch 2 group 9 word rotate): 024, 025, 026, 027.

028-033 (batch 2 group 7 logic register): 028, 029, 030, 031, 032, 033.

034-039 (batch 2 group 8 sign-extend / count-leading-zeros): 034, 035, 036, 037, 038, 039.

040-045 (batch 2 group 11 shift): 040, 041, 042, 043, 044, 045.

046-047 (batch 2 group 10 doubleword rotate): 046, 047.

048-052 reserved (group 12 compare): 048, 049, 050.

053-055 (batch 3 group 13 branch): 053, 054, 055.

063-067 (batch 3 group 14 trap+sc): 063, 064, 065, 066, 067.

068-070 (batch 3 group 15 CR logical): 068, 069, 070.

078-085 (batch 3 group 16 SPR/MSR/TB/FPSCR/VSCR): 078, 079, 080, 081, 082, 083, 084, 085.

088-089 (batch 3 group 17 cache+sync): 088, 089.

090-091 (batch 4 group 18 load byte): 090, 091.

095-100 (batch 4 group 19 load halfword): 095, 096, 097, 098, 099, 100.

105-111 (batch 4 group 20 load word + reservation): 105, 106, 107, 108, 109, 110, 111.

115-118 (batch 4 group 21 load doubleword): 115, 116, 117, 118.

123-127 (batch 4 group 22 load multiple/string): 123, 124, 125, 126, 127.

128-129 (batch 4 group 23 load float): 128, 129.

130-132 (batch 5 group 24 store byte/halfword): 130, 131, 132.

140-147 (batch 5 group 25 store word + stwcx): 140, 141, 142, 143, 144, 145, 146, 147.

150-153 (batch 5 group 26 store doubleword): 150, 151, 152, 153.

160-163 (batch 5 group 27 store multiple/string): 160, 161, 162, 163.

165-171 (batch 5 group 28 store float): 165, 166, 167, 168, 169, 170, 171.

180-187 (batch 6 group 29 FPU single arithmetic): 180, 181, 182, 183, 184, 185, 186, 187.

200-208 (batch 6 group 30 FPU double arithmetic): 200, 201, 202, 203, 204, 205, 206, 207, 208.

220-231 (batch 6 group 31 FPU sign/move/compare/convert): 220 [retracted], 221, 222 [retracted], 223, 224, 225, 226 [retracted], 227, 228, 229, 230, 231.

240-243 (batch 7 group 32 VMX integer add/sub): 240, 241, 242, 243.

275-279 (batch 7 group 33 VMX integer compare/min/max/avg): 275, 276, 277, 278, 279.

315-325 (batch 7 group 34 VMX integer logical/shift/rotate): 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325.

360-378 (batch 8 group 35 VMX permute/pack): 360, 361, 362, 363, 364, 365, 366, 367, 368, 369, 370, 371, 372, 373, 374, 375, 376, 377, 378.

420-440 (batch 8 group 36 VMX float arith+compare): 420, 421, 422, 423, 424, 425, 426, 427, 428, 429, 430, 431, 432, 433, 434, 435, 436, 437, 438, 439, 440.

482-495 (batch 8 group 37 VMX multiply-sum + special): 482 [retracted], 483 [retracted], 487, 490, 491, 492, 493, 494, 495.

510-519 (batch 8 group 38 VMX load/store): 510, 511, 512, 513, 514, 515, 516, 517, 518, 519.

560-567 (Phase C1 decoder field extractors): 560, 561, 562, 563, 564, 565, 566, 567.

600-605 (Phase C2 decoder opcode-lookup): 600, 601, 602, 603, 604, 605.

640-654 (Phase C3 disassembler formatter): 640, 641, 642, 643, 644, 645, 646, 647, 648, 649, 650, 651, 652, 653, 654.

Counted IDs: 253. Retracted: 220, 222, 226, 482, 483 (5). Net actionable: 248.

Counted by phase here: P1 (~17 IDs), P2 (~17 IDs), P3 (~7 IDs), P4 (~30 IDs), P5 (~30 IDs), P6 (~25 IDs), P7 (~5 IDs), P8 (~50 IDs), Notes (~30 wontfix/informational/retracted). Total accounts for all 253 IDs — every ID is either in a fix phase, the wontfix/informational list, or retracted. Nothing has been dropped.