[Test] (SelfTest, POST): probe upload/draw ordering in persistently mapped vertex arenas - native GLES controls distinguish mapped destination corruption from staging and synchronization failures

Add the persistent buffer ordering probe to the GLES POST's known-driver-bug inventory. Queue updates and draws into independent FBOs before reading them back, covering SubData and copies from both coherent persistent and ordinary staging buffers. Retry fresh mapped allocations for intermittent corruption.

Require passing never-mapped and fully serialized controls before reporting a finding. Include finish-before, map-then-unmap and barrier diagnostics, preserve caller GL state, and treat setup, allocation and GL errors as inconclusive. This adds detection and reporting only; no rendering workaround is enabled.

Validation: all 46 DriverBugProbesTest tests pass, including 11 new ordering, control, collector and cleanup cases. The Android API 26 / NDK 27 native probe detects all three upload paths on Mali-G1-Ultra r54p1 with clean controls and no GL errors. llvmpipe reports no finding after 240 mapped FBO checks per upload path.

.github/scripts/validate-plugin-apks.sh

@@ -44,12 +44,12 @@ require 'key:MOBILEGL_BACKEND_TYPE' "$plugin_resource_text" 'V2 backend variable
 require 'defaultValue:DirectGLES' "$plugin_resource_text" 'V2 DirectGLES default'
 require 'DirectVulkan' "$plugin_resource_text" 'V2 DirectVulkan option'
 require 'key:MOBILEGL_DISABLE_TIMERQUERY' "$plugin_resource_text" 'V2 timer-query toggle'
-require 'key:MOBILEGL_DISABLE_SUBGROUP' "$plugin_resource_text" 'V2 Vulkan subgroup toggle'
+require 'key:MOBILEGL_MAGMA_DISABLE_SUBGROUP' "$plugin_resource_text" 'V2 Vulkan subgroup toggle'
 require 'key:MOBILEGL_MAGMA_R11G11B10F_FALLBACK' "$plugin_resource_text" 'V2 Magma format fallback toggle'
 require 'key:MOBILEGL_MAGMA_FRAMESINFLIGHT' "$plugin_resource_text" 'V2 Magma frames-in-flight setting'
-require 'key:MOBILEGL_AVOID_SAMPLER_MIPMAP_MIN_FILTER' "$plugin_resource_text" 'V2 sampler workaround toggle'
+require 'key:MOBILEGL_ESPRYT_AVOID_SAMPLER_MIPMAP_MIN_FILTER' "$plugin_resource_text" 'V2 sampler workaround toggle'
 require 'key:MOBILEGL_COHERENT_AS_FLUSH' "$plugin_resource_text" 'V2 coherent-as-flush toggle'
-require 'key:MOBILEGL_USE_ANGLE' "$plugin_resource_text" 'V2 ANGLE toggle'
+require 'key:MOBILEGL_ESPRYT_USE_ANGLE' "$plugin_resource_text" 'V2 ANGLE toggle'
 
 if [[ $(grep -Fc 'fclPlugin_V2' <<<"$plugin_manifest") -ne 1 ]]; then
   echo '::error::Plugin manifest must expose exactly one V2 descriptor' >&2

.github/workflows/apk.yml

@@ -417,12 +417,12 @@ jobs:
 
       - name: Retrace and validate
         env:
-          MOBILEGL_USE_ANGLE: ${{ matrix.backend.name == 'DirectGLES' && '1' || '0' }}
+          MOBILEGL_ESPRYT_USE_ANGLE: ${{ matrix.backend.name == 'DirectGLES' && '1' || '0' }}
           MOBILEGL_TRACE_ANGLE_VARIANT: ${{ matrix.case.name == 'minecraft-1.21.4-fabric-iris-bliss-in-world' && '90a62123d794' || 'ec889e6ea831' }}
           MOBILEGL_MAGMA_R11G11B10F_FALLBACK: ${{ matrix.backend.name == 'DirectVulkan' && '1' || '0' }}
-          MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
-          MOBILEGL_DERIVE_NUM_SUBGROUPS: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
-          MOBILEGL_ITERATIONRP_FIX_BARRIER: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
+          MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
+          MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
+          MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER: ${{ matrix.backend.name == 'DirectVulkan' && matrix.case.name == 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' && '1' || '0' }}
         run: |
           apk_file="android-retrace-apks/MobileGL-plugin-trace-release-${GITHUB_SHA}.apk"
           test -f "${apk_file}"

.github/workflows/test.yml

@@ -265,16 +265,26 @@ jobs:
         # crash stack without burning a CI round on an in-workflow debugger.
         env:
           MOBILEGL_ITEST_REQUIRE_GPU: "1"
-          MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH: "1"
-          MOBILEGL_DERIVE_NUM_SUBGROUPS: "1"
-          MOBILEGL_ITERATIONRP_FIX_BARRIER: "1"
+          MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH: "1"
+          MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS: "1"
+          MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER: "1"
         run: |
           ulimit -c unlimited
           sudo sysctl -w kernel.core_pattern='/tmp/core.%e.%p'
+          # Second, filtered pass: with the range-invalidating map flush disabled,
+          # the buffer scenarios run on the upload ring's staged-copy tier - which
+          # the default pass never reaches (the map tier absorbs every flush on
+          # Mesa), so without this the Mali fallback tier would have zero CI
+          # coverage. The flag is NOT baked into the ctest ENVIRONMENT properties,
+          # so an inline env reaches the test processes (unlike the ICD pin above).
           if [ "${{ secrets.ACTIONS_STEP_DEBUG }}" = "true" ]; then
             ctest -V -L integration-gpu --no-tests=error
+            MOBILEGL_ESPRYT_DISABLE_INVALIDATE_FLUSH=1 ctest -V -L integration-gpu \
+              -R 'Buffer|Readback|Atomic|Ssbo|Arena' --no-tests=error
           else
             ctest --output-on-failure -L integration-gpu --no-tests=error
+            MOBILEGL_ESPRYT_DISABLE_INVALIDATE_FLUSH=1 ctest --output-on-failure -L integration-gpu \
+              -R 'Buffer|Readback|Atomic|Ssbo|Arena' --no-tests=error
           fi
 
       - name: Upload core dumps
@@ -644,9 +654,9 @@ jobs:
           fi
           if [ '${{ matrix.backend }}' = 'DirectVulkan' ] \
              && [ '${{ matrix.case }}' = 'minecraft-1.21.4-fabric-iris-iterationrp-in-world' ]; then
-            export MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH=1
-            export MOBILEGL_DERIVE_NUM_SUBGROUPS=1
-            export MOBILEGL_ITERATIONRP_FIX_BARRIER=1
+            export MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH=1
+            export MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS=1
+            export MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER=1
           fi
           # The blended depth-write quirk auto-enables only on Qualcomm, which no CI
           # runner has, so force it on for the OIT case it exists to fix. ForceOn

CMakeLists.txt

@@ -285,6 +285,7 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/PackDoubleVertexInputsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FlattenXfbInterfaceBlocksPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/UniquifyIoBlockNamesPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/StripIoBlockLocationsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/SplitArrayVertexInputsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/RebaseInstanceIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/ZeroBaseVertexPass.cpp
@@ -306,13 +307,16 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LegalizeFragmentOutputIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/LegalizeResourceArrayIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/FlattenAtomicCounterBlockPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/DemotePointSizePass.cpp
 
     MobileGL/MG_Util/BackendLoaders/OpenGL/Loader.cpp
     MobileGL/MG_Util/BackendLoaders/Vulkan/Loader.cpp
 
     MobileGL/MG_Util/SelfTest/DriverBugProbes.cpp
+    MobileGL/MG_Util/SelfTest/PersistentBufferOrderingProbe.cpp
     MobileGL/MG_Util/SelfTest/DriverPost.cpp
     MobileGL/MG_Util/SelfTest/DriverPostIterationRPWitness.cpp
+    MobileGL/MG_Util/SelfTest/PrimitivesGeneratedNoXfbProbe.cpp
 
     MobileGL/MG_Util/Texture/PixelStoreProcessor.cpp
     MobileGL/MG_Util/Texture/TextureFormatProcessor.cpp

MobileGL/Config.h

@@ -69,34 +69,34 @@ namespace MobileGL::MG_Config {
     struct FeaturesTable {
         // MOBILEGL_DISABLE_TIMERQUERY: do not advertise or use GPU timer queries.
         Bool DisableTimerQuery = false;
-        // MOBILEGL_ENABLE_GLES_TEXTURE_VIEW: advertise GL_ARB_texture_view on DirectGLES when
+        // MOBILEGL_ESPRYT_ENABLE_TEXTURE_VIEW: advertise GL_ARB_texture_view on DirectGLES when
         // the host ES driver has EXT/OES_texture_view. Off by default: the host extension is
         // present on Adreno 830 and the functional half of KHR-GL4{2,3}.texture_view still fails
         // there, because the view's ES internalformat is normalized independently of the storage
         // it aliases (see BackendObject_DirectGLES::BuildAdvertisedExtensions). The flag exists
         // so that work can be done without editing the gate.
-        Bool EnableGlesTextureView = false;
+        Bool EsprytEnableTextureView = false;
         // MOBILEGL_ENABLE_SPIRV_VALIDATION: validate generated and transformed SPIR-V.
         // Disabled by default because validation is a diagnostics-only cost.
         Bool EnableSpirvValidation = false;
-        // MOBILEGL_USE_ANGLE: load ANGLE EGL/GLES libraries.
-        Bool UseAngle = false;
+        // MOBILEGL_ESPRYT_USE_ANGLE: load ANGLE EGL/GLES libraries.
+        Bool EsprytUseAngle = false;
 #if defined(MOBILEGL_TRACE_ANGLE_VARIANTS)
         // MOBILEGL_TRACE_ANGLE_VARIANT: signed trace-APK ANGLE build short hash.
         String TraceAngleVariant;
 #endif
-        // MOBILEGL_DISABLE_SUBGROUP: force-disable Vulkan shader subgroup support,
+        // MOBILEGL_MAGMA_DISABLE_SUBGROUP: force-disable Vulkan shader subgroup support,
         // including the opt-in emulated compute path below.
-        Bool DisableSubgroup = false;
+        Bool MagmaDisableSubgroup = false;
         // MOBILEGL_MAGMA_EMULATE_SUBGROUP: implement GL_KHR_shader_subgroup's compute
         // stage on a 32-lane VIRTUAL subgroup lowered to workgroup-shared memory
         // (ShaderTranspiler::EmulateSubgroupsPass). Strictly a last resort: it only ever
         // engages when this flag is set AND the device has no native subgroup support at
         // all - a device with real subgroup operations always uses them natively,
         // whatever their width (the known iterationRP defect is patched by
-        // FixIterationRPSubgroupScratch below instead). Off by default.
+        // MagmaFixIterationRPSubgroupScratch below instead). Off by default.
         Bool MagmaEmulateSubgroup = false;
-        // MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH: patch iterationRP's own bug - the
+        // MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH: patch iterationRP's own bug - the
         // pack declares `shared vec2 prefixSumCache[32]` for a 512-invocation exposure
         // reduction and indexes it by gl_SubgroupID, so any device with sub-16-lane
         // subgroups (8-lane lavapipe -> 64 subgroups) writes shared memory out of
@@ -106,12 +106,12 @@ namespace MobileGL::MG_Config {
         // so every other shader passes through byte-identical - as does iterationRP
         // itself on >= 16-lane devices. Auto is ON; ForceOff replays the pack's bug
         // verbatim.
-        QuirkOverride FixIterationRPSubgroupScratch = QuirkOverride::Auto;
-        // MOBILEGL_ITERATIONRP_FIX_BARRIER: repair Program 203's missing workgroup
+        QuirkOverride MagmaFixIterationRPSubgroupScratch = QuirkOverride::Auto;
+        // MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER: repair Program 203's missing workgroup
         // rendezvous between its two reductions over prefixSumCache. Off by default and
         // fingerprint-gated by FixIterationRPBarrierPass when enabled.
-        Bool IterationRPFixBarrier = false;
-        // MOBILEGL_DERIVE_NUM_SUBGROUPS: replace compute gl_NumSubgroups loads with
+        Bool MagmaIterationRPFixBarrier = false;
+        // MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS: replace compute gl_NumSubgroups loads with
         // ceil(workgroup invocations / gl_SubgroupSize) on the NATIVE subgroup path
         // (ShaderTranspiler::DeriveNumSubgroupsPass). Auto is ON: GL requires
         // gl_SubgroupID < gl_NumSubgroups, Adreno's builtin reports 1 while the same
@@ -119,7 +119,7 @@ namespace MobileGL::MG_Config {
         // whenever the pipeline can request REQUIRE_FULL_SUBGROUPS (which the renderer
         // does whenever local_size_x is a multiple of the native width). ForceOff returns
         // to the raw driver builtin.
-        QuirkOverride DeriveNumSubgroups = QuirkOverride::Auto;
+        QuirkOverride MagmaDeriveNumSubgroups = QuirkOverride::Auto;
         // MOBILEGL_ADVERTISE_FP64: add GL_ARB_gpu_shader_fp64 to the advertised extension
         // string. `double` in a shader always WORKS - it is narrowed to 32 bits before any
         // module reaches a backend (ShaderTranspiler::DemoteFloat64Pass) - but the extension
@@ -132,16 +132,39 @@ namespace MobileGL::MG_Config {
         Bool MagmaR11G11B10FFallback = false;
         // MOBILEGL_MAGMA_FRAMESINFLIGHT: requested Magma frames in flight, defaulting to 3.
         Uint32 MagmaFramesInFlight = 3;
-        // MOBILEGL_AVOID_SAMPLER_MIPMAP_MIN_FILTER: avoid mipmap min filters in samplers,
+        // MOBILEGL_ESPRYT_AVOID_SAMPLER_MIPMAP_MIN_FILTER: avoid mipmap min filters in samplers,
         // resolves certain rendering bugs on ANGLE + llvmpipe.
-        Bool AvoidSamplerMipmapMinFilter = false;
-        // MOBILEGL_AVOID_EXPLICIT_LOD_BIAS: leave an already-explicit LOD argument alone when
+        Bool EsprytAvoidSamplerMipmapMinFilter = false;
+        // MOBILEGL_ESPRYT_AVOID_EXPLICIT_LOD_BIAS: leave an already-explicit LOD argument alone when
         // emulating GL_TEXTURE_LOD_BIAS, instead of adding the bias uniform to it. Injecting
         // the uniform turns a compile-time-constant LOD into a runtime expression, which
         // sends ANGLE + llvmpipe down a mip-selection path that dereferences a NULL
         // descriptor and kills the process. Deviates from spec (Vulkan adds the bias to
         // OpImageSampleExplicitLod), so it is an avoidance for that stack only.
-        Bool AvoidExplicitLodBias = false;
+        Bool EsprytAvoidExplicitLodBias = false;
+        // MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS: emit a tessellation/geometry program's
+        // inter-stage interface blocks WITHOUT their layout(location=) qualifier, letting ES
+        // match them by block name and member sequence instead. The Mali ES driver delivers
+        // nothing at all through a located block once a tessellation or geometry stage is in
+        // the pipeline; the driver POST measures that and turns this on by itself, so Auto is
+        // the right setting everywhere. ForceOn exists so the emulation can be exercised on a
+        // healthy driver - which is what the integration lane does, since llvmpipe and
+        // lavapipe carry a located block correctly and would otherwise never run this code -
+        // and ForceOff is the negative control. See StripIoBlockLocationsPass.
+        QuirkOverride EsprytUnlocatedIoBlocks = QuirkOverride::Auto;
+        // MOBILEGL_POINT_SIZE_DEMOTION: demote gl_PointSize out of tessellation/geometry
+        // stages into an ordinary varying (ShaderCompiler::
+        // DemoteTessellationGeometryPointSizeForProgram) instead of declining such programs
+        // on a device that advertises neither EXT/OES_tessellation_point_size /
+        // geometry_point_size (DirectGLES) nor shaderTessellationAndGeometryPointSize
+        // (DirectVulkan). Auto arms it exactly where the detection says the capability is
+        // absent, which is the right setting everywhere. ForceOn exists so the demotion can
+        // be exercised on a healthy driver - llvmpipe and lavapipe host the built-in
+        // natively and would otherwise never run this code, which is what the pinned
+        // integration lane uses - and ForceOff restores the plain declines (escape hatch /
+        // negative control). Cross-backend by design: the demotion runs in the shared
+        // phase-B chain, so one switch covers both. See DemotePointSizePass.
+        QuirkOverride PointSizeDemotion = QuirkOverride::Auto;
         // MOBILEGL_COHERENT_AS_FLUSH: app-compat for engines (e.g. Flywheel) that write
         // GPU-read data through persistent GL_MAP_FLUSH_EXPLICIT_BIT maps they never
         // flush. Persistent FLUSH_EXPLICIT map requests are rewritten to coherent
@@ -151,10 +174,38 @@ namespace MobileGL::MG_Config {
         Bool CoherentAsFlush = false;
         // MOBILEGL_TRACE_SKIP_AUTODESTROY: skip teardown in the ELF destructor (Init.cpp).
         Bool TraceSkipAutodestroy = false;
-        // MOBILEGL_DISABLE_UBO_RING: force the DirectGLES global-UBO upload back to the
+        // MOBILEGL_ESPRYT_DISABLE_UBO_RING: force the DirectGLES global-UBO upload back to the
         // per-draw glBufferSubData path instead of the persistent-mapped ring allocator
         // (negative control / driver-bug escape hatch).
-        Bool DisableUboRing = false;
+        Bool EsprytDisableUboRing = false;
+        // MOBILEGL_ESPRYT_DISABLE_UNPACK_RING: force DirectGLES texture uploads back to
+        // glTexSubImage from the client pointer instead of staging them through the
+        // persistent-mapped unpack-PBO ring (negative control / driver-bug escape
+        // hatch).
+        Bool EsprytDisableUnpackRing = false;
+        // MOBILEGL_ESPRYT_DISABLE_UPLOAD_RING: force DirectGLES app buffer updates
+        // (glBufferSubData / map flushes) back to the immediate driver upload instead
+        // of queueing them for the staged-copy flush through the persistent-mapped
+        // upload ring (negative control / driver-bug escape hatch; the immediate
+        // upload stalls on drivers that resolve the WAR hazard on the CPU, e.g. Mali).
+        Bool EsprytDisableUploadRing = false;
+        // MOBILEGL_ESPRYT_DISABLE_INVALIDATE_FLUSH: skip the glMapBufferRange(WRITE |
+        // INVALIDATE_RANGE) tier of the DirectGLES pending-range flush and go straight
+        // to the upload ring's staged glCopyBufferSubData (negative control / escape
+        // hatch for a driver whose range-invalidating map misbehaves). The map tier is
+        // what keeps a partial write into a large in-flight buffer priced by the RANGE:
+        // on Mali both the immediate glBufferSubData and a staged copy into a busy
+        // mutable store ghost the whole destination on the CPU.
+        Bool EsprytDisableInvalidateFlush = false;
+        // MOBILEGL_DISABLE_LARGE_BUFFER_ADOPTION: keep mesh-arena-sized buffer stores
+        // (>= 16MiB) on the CPU-shadow model instead of backing them with the backend's
+        // persistently+coherently mapped storage at definition time (negative control /
+        // escape hatch). Frontend-scoped: it engages only where the active backend
+        // provides AcquirePersistentMap. With adoption on, an app SubData into a busy
+        // 128MB arena is a plain memcpy into GPU-visible memory; every driver-mediated
+        // route for the same write stalls the thread or ghost-copies the whole arena on
+        // this class of Mali driver, and the arena stops costing its size again in RAM.
+        Bool DisableLargeBufferAdoption = false;
         // MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION: make DirectGLES skip the native ES
         // depth/stencil reads and always go through the shader-sampling emulation. Core GL
         // ES has no depth or stencil readback, but some drivers accept it anyway (Mesa does,
@@ -175,10 +226,10 @@ namespace MobileGL::MG_Config {
         // gl_FragDepth writers, and fully color-masked attachments are exempt (see
         // PipelineFactory::ShouldSuppressDepthWrite). Auto detects Qualcomm.
         QuirkOverride MagmaDisableBlendedDepthWriteQuirk = QuirkOverride::Auto;
-        // MOBILEGL_DISABLE_ROBUST_BUFFER_ACCESS: leave the Vulkan robustBufferAccess device
+        // MOBILEGL_MAGMA_DISABLE_ROBUST_BUFFER_ACCESS: leave the Vulkan robustBufferAccess device
         // feature off. It is enabled by default to match GL's defined out-of-range fetch
         // behavior; this escape hatch exists to measure or dodge its GPU cost on a device.
-        Bool DisableRobustBufferAccess = false;
+        Bool MagmaDisableRobustBufferAccess = false;
         // MOBILEGL_MAGMA_MULTIDRAW_MODE: preferred DirectVulkan multi-draw dispatch tier
         // ("ext" | "indirect" | "unroll", see MultiDrawMode). Clamped to device support;
         // unset picks the best supported tier.
@@ -219,7 +270,7 @@ namespace MobileGL::MG_Config {
         // miscompiled shader: if a device ever renders differently with the cache
         // on, one run with this falsy says so.
         QuirkOverride ShaderTranslationCache = QuirkOverride::Auto;
-        // MOBILEGL_FORCE_VIEWPORT_ARRAY_EMULATION: DirectGLES' gl_ViewportIndex routing
+        // MOBILEGL_ESPRYT_FORCE_VIEWPORT_ARRAY_EMULATION: DirectGLES' gl_ViewportIndex routing
         // emulation - the builtin becomes a flat varying, the fragment stage gets a
         // per-pass gate, and a routed draw is REPLAYED once per distinct viewport state
         // with the real glViewport/glScissor/glDepthRangef set for it. Auto is ON, and
@@ -231,7 +282,40 @@ namespace MobileGL::MG_Config {
         // the pre-emulation path, extension passthrough where it exists and
         // LowerViewportIndexPass' demote-to-a-plain-global where it does not - and is
         // the negative control the emulation is measured against.
-        QuirkOverride ViewportArrayEmulation = QuirkOverride::Auto;
+        QuirkOverride EsprytViewportArrayEmulation = QuirkOverride::Auto;
+        // MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE: DirectGLES stores GL_RGB565/GL_RGB5(A1)/GL_RGBA4
+        // images as 8-bit-per-channel ES storage (GL_RGB8/GL_RGBA8) instead of the driver's
+        // native 16-bit packed formats. Auto defers to a POST driver-bug probe
+        // (SelfTest::CopyImageMirrorsPacked16FieldOrder): some Mali drivers store SOME
+        // packed16 allocations with a MIRRORED field order (allocation-scoped and
+        // shape/context dependent - the failing 30x30x12 GL_TEXTURE_2D_ARRAYs are mirrored
+        // at every level), so glCopyImageSubData - a raw texel-block move - lands R/G/B/A
+        // reversed whenever exactly one endpoint sits in a mirrored allocation
+        // (KHR-GL4x.copy_image.functional rgb5/rgb5_a1/rgba4 x every *2d_array* pair).
+        // With no 16-bit packed ES image left there is no field order to disagree about; the
+        // client word still round-trips exactly, because the canonical shadow is already
+        // UNorm8 and an n-bit field encodes to UNorm8 and back losslessly for n <= 8.
+        // ForceOn widens on any driver (the llvmpipe suites use it to exercise the widened
+        // path); ForceOff keeps the native narrow storage even where the probe fires - the
+        // negative control that replays the corruption. Costs 2x the memory of the affected
+        // formats where it engages, which is why Auto is probe-gated rather than always-on.
+        QuirkOverride EsprytWidenPacked16Storage = QuirkOverride::Auto;
+        // MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE: DirectVulkan's GL_PRIMITIVES_GENERATED
+        // reroute for draws made while transform feedback is INACTIVE. The stream query
+        // (VK_QUERY_TYPE_TRANSFORM_FEEDBACK_STREAM_EXT primitivesNeeded) is defined to count
+        // them, but a Mali driver - and Mesa lavapipe - answers 0 unless a capture span is
+        // open, which is exactly the shape the CTS uses to measure the tessellator, so ~29
+        // tessellation tests per tree size a capture buffer from the 0 and die on the
+        // zero-length map. Auto defers to a device probe at renderer bring-up
+        // (SelfTest::RunPrimitivesGeneratedNoXfbProbe), which measures two substitutes on
+        // the same capture-less draws and arms the best proven one: the dedicated
+        // VK_EXT_primitives_generated_query (exact semantics by definition; lavapipe passes
+        // it, rasterizer discard included), else a clipping-invocations pipeline-statistics
+        // pool (see the verdict vocabulary for its rasterizer-discard split). ForceOn pins
+        // the reroute structurally wherever a pool can exist (the arming-observable lane,
+        // immune to the probe's verdict moving), and ForceOff is the negative control that
+        // replays the driver's silence.
+        QuirkOverride MagmaPrimGenQueryReroute = QuirkOverride::Auto;
     };
     extern FeaturesTable Features;
 } // namespace MobileGL::MG_Config

MobileGL/ConfigLoader.cpp

@@ -162,33 +162,39 @@ namespace MobileGL::MG_ConfigLoader {
     inline void InitFeatures() {
         auto& features = MG_Config::Features;
         features.DisableTimerQuery = QueryEnvFlag("MOBILEGL_DISABLE_TIMERQUERY");
-        features.EnableGlesTextureView = QueryEnvFlag("MOBILEGL_ENABLE_GLES_TEXTURE_VIEW");
+        features.EsprytEnableTextureView = QueryEnvFlag("MOBILEGL_ESPRYT_ENABLE_TEXTURE_VIEW");
         features.EnableSpirvValidation = QueryEnvFlag("MOBILEGL_ENABLE_SPIRV_VALIDATION");
-        features.UseAngle = QueryEnvFlag("MOBILEGL_USE_ANGLE");
+        features.EsprytUseAngle = QueryEnvFlag("MOBILEGL_ESPRYT_USE_ANGLE");
 #if defined(MOBILEGL_TRACE_ANGLE_VARIANTS)
         QueryEnvVariable("MOBILEGL_TRACE_ANGLE_VARIANT", features.TraceAngleVariant, "");
 #endif
-        features.DisableSubgroup = QueryEnvFlag("MOBILEGL_DISABLE_SUBGROUP");
+        features.MagmaDisableSubgroup = QueryEnvFlag("MOBILEGL_MAGMA_DISABLE_SUBGROUP");
         features.MagmaEmulateSubgroup = QueryEnvFlag("MOBILEGL_MAGMA_EMULATE_SUBGROUP");
-        features.FixIterationRPSubgroupScratch =
-            QueryEnvQuirkOverride("MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH");
-        features.IterationRPFixBarrier = QueryEnvFlag("MOBILEGL_ITERATIONRP_FIX_BARRIER");
-        features.DeriveNumSubgroups = QueryEnvQuirkOverride("MOBILEGL_DERIVE_NUM_SUBGROUPS");
+        features.MagmaFixIterationRPSubgroupScratch =
+            QueryEnvQuirkOverride("MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH");
+        features.MagmaIterationRPFixBarrier = QueryEnvFlag("MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER");
+        features.MagmaDeriveNumSubgroups = QueryEnvQuirkOverride("MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS");
         features.AdvertiseFp64 = QueryEnvFlag("MOBILEGL_ADVERTISE_FP64");
         features.MagmaR11G11B10FFallback = QueryEnvFlag("MOBILEGL_MAGMA_R11G11B10F_FALLBACK");
         features.MagmaFramesInFlight = QueryEnvUint32("MOBILEGL_MAGMA_FRAMESINFLIGHT", 3, 1, 64);
-        features.AvoidSamplerMipmapMinFilter =
-            QueryEnvFlag("MOBILEGL_AVOID_SAMPLER_MIPMAP_MIN_FILTER");
-        features.AvoidExplicitLodBias = QueryEnvFlag("MOBILEGL_AVOID_EXPLICIT_LOD_BIAS");
+        features.EsprytAvoidSamplerMipmapMinFilter =
+            QueryEnvFlag("MOBILEGL_ESPRYT_AVOID_SAMPLER_MIPMAP_MIN_FILTER");
+        features.EsprytAvoidExplicitLodBias = QueryEnvFlag("MOBILEGL_ESPRYT_AVOID_EXPLICIT_LOD_BIAS");
+        features.EsprytUnlocatedIoBlocks = QueryEnvQuirkOverride("MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS");
+        features.PointSizeDemotion = QueryEnvQuirkOverride("MOBILEGL_POINT_SIZE_DEMOTION");
         features.CoherentAsFlush = QueryEnvFlag("MOBILEGL_COHERENT_AS_FLUSH");
         features.TraceSkipAutodestroy = QueryEnvFlag("MOBILEGL_TRACE_SKIP_AUTODESTROY");
-        features.DisableUboRing = QueryEnvFlag("MOBILEGL_DISABLE_UBO_RING");
+        features.EsprytDisableUboRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UBO_RING");
+        features.EsprytDisableUnpackRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UNPACK_RING");
+        features.EsprytDisableUploadRing = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_UPLOAD_RING");
+        features.EsprytDisableInvalidateFlush = QueryEnvFlag("MOBILEGL_ESPRYT_DISABLE_INVALIDATE_FLUSH");
+        features.DisableLargeBufferAdoption = QueryEnvFlag("MOBILEGL_DISABLE_LARGE_BUFFER_ADOPTION");
         features.EsprytForceDepthStencilReadbackEmulation =
             QueryEnvFlag("MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION");
         features.RelaxedSemantics = QueryEnvFlag("MOBILEGL_RELAXED_SEMANTICS");
         features.MagmaDisableBlendedDepthWriteQuirk =
             QueryEnvQuirkOverride("MOBILEGL_MAGMA_DISABLE_BLENDED_DEPTH_WRITE");
-        features.DisableRobustBufferAccess = QueryEnvFlag("MOBILEGL_DISABLE_ROBUST_BUFFER_ACCESS");
+        features.MagmaDisableRobustBufferAccess = QueryEnvFlag("MOBILEGL_MAGMA_DISABLE_ROBUST_BUFFER_ACCESS");
         features.MagmaMultiDrawMode = QueryEnvMultiDrawMode("MOBILEGL_MAGMA_MULTIDRAW_MODE");
         features.EsprytMultiDrawMode = QueryEnvGLESMultiDrawMode("MOBILEGL_ESPRYT_MULTIDRAW_MODE");
         features.AsyncShaderCompile = QueryEnvQuirkOverride("MOBILEGL_ASYNC_SHADER_COMPILE");
@@ -196,8 +202,11 @@ namespace MobileGL::MG_ConfigLoader {
         features.AsyncOptimisticShaderStatus =
             QueryEnvQuirkOverride("MOBILEGL_ASYNC_OPTIMISTIC_SHADER_STATUS");
         features.ShaderTranslationCache = QueryEnvQuirkOverride("MOBILEGL_SHADER_CACHE");
-        features.ViewportArrayEmulation =
-            QueryEnvQuirkOverride("MOBILEGL_FORCE_VIEWPORT_ARRAY_EMULATION");
+        features.EsprytViewportArrayEmulation =
+            QueryEnvQuirkOverride("MOBILEGL_ESPRYT_FORCE_VIEWPORT_ARRAY_EMULATION");
+        features.EsprytWidenPacked16Storage =
+            QueryEnvQuirkOverride("MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE");
+        features.MagmaPrimGenQueryReroute = QueryEnvQuirkOverride("MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE");
     }
 
     inline void InitBackendType() {

MobileGL/MG_Backend/BackendObject.h

@@ -389,6 +389,19 @@ namespace MobileGL {
             // where there is no device to be honest about and BuildTBuiltInResource still has to
             // hand glslang a workable gl_MaxClipDistances.
             Int MaxClipDistances = 8;
+            // GL_MAX_CULL_DISTANCES and GL_MAX_COMBINED_CLIP_AND_CULL_DISTANCES, under exactly
+            // the contract stated for MaxClipDistances above: ZERO IS A LEGAL ANSWER and a
+            // backend that cannot host a cull distance MUST report it. The failure this prevents
+            // is worse than the clip one, because cull distance discards the whole primitive:
+            // glslang bounds gl_CullDistance[i] against maxCullDistances and expands
+            // gl_MaxCullDistances from it, SPIRV-Cross then emits
+            // `#extension GL_EXT_clip_cull_distance : require` into the ESSL, and a host driver
+            // without that extension rejects the program in an info log nobody surfaces. These
+            // used to be bare 8s inside BuildTBuiltInResource with no backend consulted at all.
+            // The DEFAULTS are the GL 4.5 core minimums for the same reason MaxClipDistances'
+            // is: they describe the no-backend case (standalone compiles, unit tests).
+            Int MaxCullDistances = 8;
+            Int MaxCombinedClipAndCullDistances = 8;
             Int MaxViewports = 16;
             // GL_LAYER_PROVOKING_VERTEX / GL_VIEWPORT_INDEX_PROVOKING_VERTEX: which vertex of a
             // primitive supplies gl_Layer and gl_ViewportIndex. GL 4.6 table 23.65 makes
@@ -482,6 +495,24 @@ namespace MobileGL {
             // halves (PackDoubleVertexInputsPass and VertexInputStateFactory::ToVkVertexFormat)
             // still see one consistent world.
             Bool SupportsFloat64VertexAttributes = false;
+            // Whether a TESSELLATION stage of this backend may access gl_PointSize - i.e.
+            // whether a module declaring OpCapability TessellationPointSize can reach the
+            // driver at all. DirectVulkan sets both this and the geometry twin from the one
+            // shaderTessellationAndGeometryPointSize feature; DirectGLES sets them
+            // independently from the EXT/OES_tessellation_point_size /
+            // geometry_point_size extension pairs (PointSizeTier), which really do come
+            // separately. When absent, ProgramSpirvTask demotes the built-in to an ordinary
+            // varying program-wide (ShaderCompiler::
+            // DemoteTessellationGeometryPointSizeForProgram); MOBILEGL_POINT_SIZE_DEMOTION
+            // overrides the detection in either direction at backend init.
+            //
+            // Defaults TRUE, deliberately against the house "assume absent" rule: false
+            // ARMS a rewrite, so the conservative no-backend answer (standalone compiles,
+            // unit tests) is the one that leaves modules untouched. A backend that never
+            // sets it gets standard modules and, at worst, the old honest declines.
+            Bool SupportsTessellationPointSize = true;
+            // The geometry-stage twin (OpCapability GeometryPointSize).
+            Bool SupportsGeometryPointSize = true;
             SizeT MaxShaderStorageBlockSize = 128 * 1024 * 1024;
             Uint32 SubgroupSize = 0;
             Uint32 SubgroupSupportedStages = 0;

MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.cpp

@@ -307,6 +307,23 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return capabilities.MaxColorTextureSamples;
         }
 
+        // The RENDERBUFFER twin, and it is a different set of pnames on purpose.
+        // GL_MAX_{COLOR,DEPTH}_TEXTURE_SAMPLES bound multisample TEXTURES; a renderbuffer is
+        // bounded by GL_MAX_SAMPLES (GL 4.6 core 9.2.4), with GL_MAX_INTEGER_SAMPLES for the
+        // integer formats. Using the texture ceilings here - which is what the renderbuffer probe
+        // did - is not merely untidy: the two texture pnames are ES 3.1 state, so on an ES 3.0
+        // context the loader's rejected-probe clamp leaves them at 1 (see the multisample clamps
+        // in the GLES loader) and the walk below would never run past one sample, recording {1}
+        // for EVERY colour format while GL_MAX_SAMPLES - ES 3.0 core, so genuinely answered -
+        // reports 4. Once the frontend validates against this list, that would reject every
+        // multisample renderbuffer on such a context.
+        Int GetGLESRenderbufferFormatMaxSamples(const MG_External::GLESCapabilities& capabilities,
+                                                GLenum imageFormat) {
+            const Bool isInteger = imageFormat == GL_RED_INTEGER || imageFormat == GL_RG_INTEGER ||
+                                   imageFormat == GL_RGB_INTEGER || imageFormat == GL_RGBA_INTEGER;
+            return isInteger ? capabilities.MaxIntegerSamples : capabilities.MaxSamples;
+        }
+
         Bool ProbeFramebufferCompletenessForTexture(const MG_External::GLESFunctionsTable& gl, TextureTarget target,
                                                     GLuint texture, TextureInternalFormat format) {
             GLuint framebuffer = 0;
@@ -717,7 +734,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         AddFullFormatCaps(cache, renderbufferTargetIndex, formatIndex,
                                           GetRenderbufferFeatureCaps(logicalFormat));
                         const Int maxSamples =
-                            GetGLESFormatMaxSamples(capabilities, logicalFormat, nativeInfo.ImageFormat);
+                            GetGLESRenderbufferFormatMaxSamples(capabilities, nativeInfo.ImageFormat);
                         cache.SampleCounts[renderbufferTargetIndex][formatIndex] =
                             ProbeRenderbufferSampleCounts(gl, nativeInfo.InternalFormat, logicalFormat, maxSamples);
                     } else {
@@ -731,7 +748,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                         LogGLESFormatCaveat(logicalFormat, renderbufferTargetIndex, renderbufferFallbackInfo);
                     }
                     const Int maxSamples =
-                        GetGLESFormatMaxSamples(capabilities, logicalFormat, renderbufferFallbackInfo.ImageFormat);
+                        GetGLESRenderbufferFormatMaxSamples(capabilities, renderbufferFallbackInfo.ImageFormat);
                     cache.SampleCounts[renderbufferTargetIndex][formatIndex] = ProbeRenderbufferSampleCounts(
                         gl, renderbufferFallbackInfo.InternalFormat, logicalFormat, maxSamples);
                 }
@@ -749,7 +766,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 .ExtraVendor = Nullopt,              // Extra vendor
                 .RendererGLInfo =
                     {
-                        .TargetGLVersion = {4, 3, 0},   // GL target version
+                        .TargetGLVersion = {4, 6, 0},   // GL target version
                         .TargetGLSLVersion = {4, 6, 0}, // Target Shading Language Version
                         // Baseline advertisement (no runtime capabilities yet); reconciled once
                         // the ES capabilities exist, see UpdateAdvertisedCapabilityExtensions.
@@ -995,10 +1012,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                                   Bool textureViewSupported, Bool cubeMapArraySupported) {
         Vector<GLExtension> extensions = {
             // The version tokens have to reach the version the backend actually claims:
-            // TargetGLVersion is {4,3,0}, and a list that stopped at OpenGL40 told an
+            // TargetGLVersion is {4,6,0}, and a list that stopped at OpenGL40 told an
             // application feature-detecting off these tokens the opposite of what
             // GL_MAJOR_VERSION / GL_MINOR_VERSION told it.
             V_OpenGL30, V_OpenGL31, V_OpenGL32, V_OpenGL33, V_OpenGL40, V_OpenGL41, V_OpenGL42, V_OpenGL43,
+            V_OpenGL44, V_OpenGL45, V_OpenGL46,
             E_GL_ARB_draw_buffers_blend,
             E_GL_ARB_compute_shader, E_GL_ARB_shader_storage_buffer_object, E_GL_ARB_shader_image_load_store,
             E_GL_ARB_clear_buffer_object, E_GL_ARB_program_interface_query, E_GL_ARB_framebuffer_object, E_GL_EXT_framebuffer_object,
@@ -1180,8 +1198,8 @@ namespace MobileGL::MG_Backend::DirectGLES {
         //
         // Until that reconciliation exists, advertising here would be the same lie the comment
         // above refuses to tell, just with an extra prerequisite met. Set
-        // MOBILEGL_ENABLE_GLES_TEXTURE_VIEW=1 to re-enable it for that work.
-        if (textureViewSupported && MG_Config::Features.EnableGlesTextureView) {
+        // MOBILEGL_ESPRYT_ENABLE_TEXTURE_VIEW=1 to re-enable it for that work.
+        if (textureViewSupported && MG_Config::Features.EsprytEnableTextureView) {
             extensions.push_back(E_GL_ARB_texture_view);
         }
         // Only advertised when the host ES driver actually filters anisotropically: the sampler
@@ -1461,9 +1479,44 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // Follows the line above, and must: OpenGL ES has no double-precision vertex format and no
         // fp64 type to consume one with, so a 64-bit vertex attribute has nowhere to land here.
         m_dynamicParameters.SupportsFloat64VertexAttributes = false;
+        // Whether a tessellation / geometry stage's ESSL may name gl_PointSize at all: the two
+        // extension pairs the loader probed, independently, because they really do come
+        // separately. False arms the shared phase-B demotion
+        // (ShaderCompiler::DemoteTessellationGeometryPointSizeForProgram), whose ESSL then
+        // never names the built-in in those stages and needs no extension.
+        // MOBILEGL_POINT_SIZE_DEMOTION=1 pretends both are absent so the demotion can be
+        // exercised on a healthy driver (the pinned integration lane); =0 restores the
+        // detected answer's declines.
+        m_dynamicParameters.SupportsTessellationPointSize =
+            m_GLESCapabilities.TessellationPointSizeSupport !=
+            MG_External::GLESCapabilities::PointSizeTier::None;
+        m_dynamicParameters.SupportsGeometryPointSize =
+            m_GLESCapabilities.GeometryPointSizeSupport !=
+            MG_External::GLESCapabilities::PointSizeTier::None;
+        switch (MG_Config::Features.PointSizeDemotion) {
+        case MG_Config::QuirkOverride::ForceOn:
+            MGLOG_I("DirectGLES: MOBILEGL_POINT_SIZE_DEMOTION=1 - treating tessellation/geometry "
+                    "gl_PointSize as unhosted so the demotion runs on this driver");
+            m_dynamicParameters.SupportsTessellationPointSize = false;
+            m_dynamicParameters.SupportsGeometryPointSize = false;
+            break;
+        case MG_Config::QuirkOverride::ForceOff:
+            MGLOG_I("DirectGLES: MOBILEGL_POINT_SIZE_DEMOTION=0 - keeping the built-in and the "
+                    "plain declines regardless of the driver's extensions");
+            m_dynamicParameters.SupportsTessellationPointSize = true;
+            m_dynamicParameters.SupportsGeometryPointSize = true;
+            break;
+        case MG_Config::QuirkOverride::Auto:
+            break;
+        }
         m_dynamicParameters.MaxDrawBuffers = m_GLESCapabilities.MaxDrawBuffers;
         m_dynamicParameters.MaxColorAttachments = m_GLESCapabilities.MaxColorAttachments;
         m_dynamicParameters.MaxClipDistances = m_GLESCapabilities.MaxClipDistances;
+        // The loader already gated both on GL_EXT_clip_cull_distance and left 0 without it, which
+        // is the answer that keeps glslang from accepting a gl_CullDistance the ESSL compiler
+        // would reject.
+        m_dynamicParameters.MaxCullDistances = m_GLESCapabilities.MaxCullDistances;
+        m_dynamicParameters.MaxCombinedClipAndCullDistances = m_GLESCapabilities.MaxCombinedClipAndCullDistances;
         m_dynamicParameters.MaxViewports = m_GLESCapabilities.MaxViewports;
         // Whatever the driver said about which vertex supplies gl_Layer, and GL_UNDEFINED_VERTEX
         // for gl_ViewportIndex on every driver without GL_OES_viewport_array - which is both test

MobileGL/MG_Backend/DirectGLES/Managers.h

@@ -102,9 +102,98 @@ namespace MobileGL::MG_Backend::DirectGLES {
     // Brings the whole draw-relevant frontend state onto the native ES context and binds
     // the program; every GL draw entry point calls it exactly once before issuing draws.
     void PrepareForDraw(DrawSyncFlags syncBits);
-    // GLES core supports only GL_PRIMITIVE_RESTART_FIXED_INDEX. Throws when the app enabled
-    // the arbitrary GL_PRIMITIVE_RESTART with a non-fixed index for this index type.
-    void CheckPrimitiveRestartSupported(GLenum indexType);
+    // What an indexed draw has to do about primitive restart before it can be issued.
+    //
+    // Desktop GL restarts on an application-chosen index (glPrimitiveRestartIndex under
+    // GL_PRIMITIVE_RESTART); GLES core restarts only on the all-ones value of the index type
+    // (GL_PRIMITIVE_RESTART_FIXED_INDEX), which the render-state push enables for BOTH caps.
+    // That leaves three cases, and the difference between the last two is not cosmetic - one
+    // adds restarts, the other has to take away restarts the driver would otherwise make.
+    enum class RestartSubstitutionKind : Uint8 {
+        // Nothing to do: restart is off, the fixed-index cap is on, or the application's
+        // restart index already IS the type's all-ones value. The overwhelmingly common answer.
+        None,
+        // The application's index is representable in this index type and differs from the
+        // all-ones value: the index DATA has to be rewritten so the driver restarts where the
+        // application asked.
+        RewriteIndices,
+        // The application's index cannot be held by this index type at all. GL 4.6 core 10.3.6
+        // compares the fetched index, zero-extended, against the full 32-bit
+        // PRIMITIVE_RESTART_INDEX, so no index can match and the draw restarts NOWHERE - but the
+        // render-state push has already enabled the driver's fixed-index restart, so the
+        // all-ones value has to be un-restarted for the duration of the draw.
+        SuppressRestart,
+    };
+    RestartSubstitutionKind ResolveRestartSubstitution(GLenum indexType);
+
+    // Turns the driver's fixed-index restart off for one draw and back on afterwards, for the
+    // SuppressRestart case above. Separate from the substitution below because the multi-draw
+    // tiers need it on its own: they rewrite the index stream themselves and only ever need the
+    // cap half. Inert for every other kind, and it never touches the render-state shadow - it
+    // puts the driver back exactly where SyncRenderState left it.
+    class ScopedSuppressedPrimitiveRestart {
+    public:
+        explicit ScopedSuppressedPrimitiveRestart(RestartSubstitutionKind kind);
+        ~ScopedSuppressedPrimitiveRestart();
+        ScopedSuppressedPrimitiveRestart(const ScopedSuppressedPrimitiveRestart&) = delete;
+        ScopedSuppressedPrimitiveRestart& operator=(const ScopedSuppressedPrimitiveRestart&) = delete;
+
+    private:
+        Bool m_suppressed = false;
+    };
+
+    // Swaps in a scratch element array buffer holding a copy of the index data in which the
+    // application's restart index has been replaced by the value GLES restarts on. Inert
+    // (and free) unless ResolveRestartSubstitution asks for it. The swap lives for the
+    // object's lifetime, so it covers every pass of a viewport-routed draw, and the previous
+    // GL_ELEMENT_ARRAY_BUFFER name is restored on destruction - which matters beyond tidiness,
+    // because the VAO twin memoises that it already synced that binding.
+    //
+    // The copy may be WIDER than the source (see IndexType): when the source already contains
+    // the type's all-ones value as an ordinary vertex index, that value cannot double as the
+    // restart sentinel, and widening is the only way to keep both meanings. Callers must
+    // therefore take the index type from this object, not from their own argument.
+    class ScopedRestartIndexSubstitution {
+    public:
+        // count/indices describe the draw's index range when the CPU knows it. Pass
+        // count == 0 for an indirect draw, whose count lives in GPU memory: the whole bound
+        // element array buffer is rewritten instead, so every element keeps its position and
+        // a GPU-resident firstIndex - an ELEMENT index, so it survives widening too - still
+        // addresses the index it named.
+        ScopedRestartIndexSubstitution(GLenum indexType, GLsizei count, const void* indices);
+        ~ScopedRestartIndexSubstitution();
+        ScopedRestartIndexSubstitution(const ScopedRestartIndexSubstitution&) = delete;
+        ScopedRestartIndexSubstitution& operator=(const ScopedRestartIndexSubstitution&) = delete;
+
+        // False only when a substitution was needed and could not be made. The draw must
+        // then be skipped: issuing it would let the driver silently drop every restart and
+        // weld the primitives on either side together, which is worse than drawing nothing.
+        Bool DrawIsValid() const { return m_valid; }
+        // The element-array offset (or client pointer) the draw must use. Identical to what
+        // was passed in unless a substitution was made.
+        const void* Indices() const { return m_indices; }
+        // The index type the draw must be issued with. Identical to the constructor's unless
+        // the copy had to be widened to keep an all-ones vertex index distinguishable from the
+        // restart sentinel.
+        GLenum IndexType() const { return m_indexType; }
+
+    private:
+        // Declared before m_capOverride so it is initialised first (members initialise in
+        // declaration order): the whole decision is made once, and both the cap override and the
+        // constructor body read the same answer.
+        RestartSubstitutionKind m_kind = RestartSubstitutionKind::None;
+        ScopedSuppressedPrimitiveRestart m_capOverride;
+        const void* m_indices = nullptr;
+        GLenum m_indexType = 0;
+        Uint m_previousBinding = 0;
+        Bool m_substituted = false;
+        Bool m_valid = true;
+    };
+
+    // Drops the scratch element array buffer the substitution above stages through. Like
+    // MultiDrawImpl's scratch names it is abandoned rather than deleted: the name belongs to
+    // the dead ES context, and deleting it would target whatever its successor handed out.
+    void OnRestartSubstitutionContextDestroyed();
     // Feed the current program's gl_BaseInstance / gl_DrawID / gl_BaseVertex emulation
     // uniforms. All are no-ops when the program does not read the corresponding builtin.
     void SetCurrentBaseInstance(Uint32 baseInstance);
@@ -141,7 +230,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
     // still holding what glViewport/glScissor/glDepthRange broadcast to all sixteen - collapses
     // to a single pass with an all-ones gate mask, i.e. one draw and no behaviour change at all.
     //
-    // Whether emulation runs. Off only under MOBILEGL_FORCE_VIEWPORT_ARRAY_EMULATION falsy, which
+    // Whether emulation runs. Off only under MOBILEGL_ESPRYT_FORCE_VIEWPORT_ARRAY_EMULATION falsy, which
     // restores the pre-emulation path as a negative control.
     Bool ViewportArrayEmulationEnabled();
     // Whether ANY program built in this process has come out with a viewport gate. Sticky once
@@ -372,6 +461,16 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // the owning thread replaying them: guard both fields with pendingMutex.
             Bool pendingRespecify = false;
             VecRange1D pendingRanges;
+            // App bytes for an ADOPTED store, awaiting their GPU-ordered landing (ring
+            // stage + glCopyBufferSubData at the next sync; see
+            // BufferBackendOps::ResidentSubData). The frontend keeps such writes out of
+            // the coherent mapping - an in-place host write tears the in-flight frames
+            // still reading the old bytes. Guarded by pendingMutex like pendingRanges.
+            struct PendingResidentWrite {
+                SizeT offset = 0;
+                Vector<Uint8> bytes;
+            };
+            Vector<PendingResidentWrite> pendingResidentWrites;
             std::mutex pendingMutex;
             // Buffer-mutation epoch (see CurrentBufferMutationEpoch) at which this
             // resource last probed IsBufferDrawClean == true, 0 = never (epochs start
@@ -455,12 +554,21 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // BackendVertexArrayObject::SyncToBackend.
         extern Uint64 g_bufferBackendIdGeneration;
         // Redundant-bind cache for INDEXED buffer bindings (glBindBufferBase/Range on
-        // GL_UNIFORM_BUFFER / GL_SHADER_STORAGE_BUFFER): skips the GL call when the
-        // (id, range) already at that index matches, like the array-buffer/texture/
-        // sampler caches already do. Invalidated on MakeCurrent (context may reset).
+        // GL_UNIFORM_BUFFER / GL_SHADER_STORAGE_BUFFER / GL_TRANSFORM_FEEDBACK_BUFFER):
+        // skips the GL call when the (id, range) already at that index matches, like the
+        // array-buffer/texture/sampler caches already do. Invalidated on MakeCurrent
+        // (context may reset).
+        // Binds the transform feedback capture points [0, bufferCount) from the frontend
+        // state, and touches nothing else - in particular it never binds a zero the
+        // application did not ask for. See the definition for why that matters on Mali.
+        void SyncTransformFeedbackBindingPoints(SizeT bufferCount);
         void BindBufferBaseCached(GLenum glTarget, Uint index, Uint id);
         void BindBufferRangeCached(GLenum glTarget, Uint index, Uint id, GLintptr offset, GLsizeiptr size);
         void InvalidateIndexedBufferBindingCache();
+        // The transform feedback capture points are per-transform-feedback-OBJECT state, so
+        // every glBindTransformFeedback swaps all of them under the shadow above. XfbImpl
+        // calls this on each bind/delete.
+        void InvalidateTransformFeedbackBindingShadows();
         // Re-issues the GL_ATOMIC_COUNTER_BUFFER binding points a program's shaders declare as
         // GL_SHADER_STORAGE_BUFFER bindings at the reserved slots the transpiled ESSL was built
         // against (BackendProgramObjectImpl::GetAtomicCounterBindings /
@@ -510,6 +618,57 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // Present()-time upkeep: records the frame's high-water mark for reclamation
         // and deletes grown-away ring stores once the GPU is done with them.
         void UboRingOnPresent();
+
+        // --- Texture unpack-PBO ring ----------------------------------------------
+        // The same persistent-mapped bump allocator, staging TEXTURE UPLOADS. A
+        // glTexSubImage from client memory hands the driver a pointer it must read
+        // before the call returns, so the copy has to be ordered against whatever GPU
+        // work still reads the destination texture: Mali resolves that by BLOCKING the
+        // calling thread (osup_sync_object_wait) instead of ghosting, and Minecraft
+        // re-uploads animated atlas sprites and the lightmap every tick into textures
+        // the in-flight frame is still sampling. Staging the bytes into a
+        // GPU-visible unpack PBO and passing an OFFSET instead lets the driver queue
+        // the copy in the command stream with no CPU wait at all.
+        //
+        // Same reclamation contract as the UBO ring: no ring bytes are recycled before
+        // the frame that referenced them completed on the GPU, so a staged block stays
+        // intact for as long as the queued transfer can still be reading it. The store
+        // therefore settles at roughly (bytes staged per frame) x (frames in flight),
+        // which is what to watch if this ring ever shows up in an RSS regression: it
+        // grows on demand from 4 MiB and is capped, not unbounded.
+        //
+        // False when the feature is disabled (MOBILEGL_ESPRYT_DISABLE_UNPACK_RING),
+        // EXT_buffer_storage / fences are missing, the ES context is not current, or
+        // ring creation already failed under this context. Callers then upload from
+        // the client pointer exactly as before.
+        Bool UnpackRingAvailable();
+        // Bump-allocate `size` bytes aligned to 64 (a PBO-sourced glTexSubImage only
+        // owes the driver the pixel type's own alignment). Grows the ring when the
+        // in-flight span would be overrun; false when the request exceeds the ring's
+        // size cap or storage (re)creation fails.
+        Bool UnpackRingAllocate(SizeT size, SizeT& outOffset);
+        void* UnpackRingMappedPtr();
+        Uint UnpackRingBufferId();
+        // Largest single staging request the ring can ever satisfy.
+        SizeT UnpackRingMaxBytes();
+        void UnpackRingOnPresent();
+
+        // --- Buffer upload ring ---------------------------------------------------
+        // The same persistent-mapped bump allocator, staging APP BUFFER UPDATES
+        // (glBufferSubData / non-persistent map flushes) whose destination store may
+        // still be referenced by in-flight GPU work. Mali resolves that WAR hazard by
+        // BLOCKING the calling glBufferSubData (osup_sync_object_wait) until every
+        // referencing job retires - Minecraft 26.3 rewrites its chunk-section and
+        // dynamic-transform UBOs and streams chunk meshes with per-frame SubData, and
+        // each such call serialized against the whole GPU queue (~1 fps while chunks
+        // stream in, and again on every camera pan). App SubData ranges are queued on
+        // the resource instead (the frontend shadow already holds the bytes) and
+        // draw-time sync drains them: bytes staged into this ring, then one
+        // glCopyBufferSubData per merged range - the copy is ordered on the GPU
+        // timeline, so the hazard costs no CPU wait. Reclamation contract identical
+        // to the other two rings. MOBILEGL_ESPRYT_DISABLE_UPLOAD_RING restores the
+        // historical immediate-upload path (negative control / escape hatch).
+        void UploadRingOnPresent();
     } // namespace BufferImpl
 
     namespace VertexArrayImpl {
@@ -927,7 +1086,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
             Uint16 m_syncedShapeParamsVersion = 0;
             SamplerParameters m_cacheSamplerParameters;
             UintVec2 m_cacheLodRange = {0, 1000};
+            // All three representations plus the form, because none of them alone identifies the
+            // border colour the driver texture is holding: two integer borders can share one float
+            // (anything differing above 2^24), and a Float -> Int transition can leave every number
+            // unchanged while still needing a different driver entry point.
             FloatVec4 m_cacheBorderColor = {0.0f, 0.0f, 0.0f, 0.0f};
+            IntVec4 m_cacheBorderColorI = {0, 0, 0, 0};
+            UintVec4 m_cacheBorderColorUI = {0, 0, 0, 0};
+            BorderColorForm m_cacheBorderColorForm = BorderColorForm::Float;
             Vec4<TextureSwizzleParam> m_cacheSwizzleParams = {TextureSwizzleParam::Red, TextureSwizzleParam::Green,
                                                               TextureSwizzleParam::Blue, TextureSwizzleParam::Alpha};
             // GL_DEPTH_STENCIL_TEXTURE_MODE. GL_DEPTH_COMPONENT is the GL and ES default, so a
@@ -1413,6 +1579,17 @@ namespace MobileGL::MG_Backend::DirectGLES {
             Int GetPassthroughTessControlPatchVertices() const {
                 return m_passthroughTessControlPatchVertices;
             }
+            // GL_PATCH_DEFAULT_{OUTER,INNER}_LEVEL the same synthesized stage was built with, for
+            // the same reason: ES has neither the state nor an entry point to forward it to, so
+            // glPatchParameterfv's values are compiled in as literals and a program built with one
+            // set is stale for another. Meaningless (and never read) when the patch-vertices field
+            // above is -1, which is the gate the draw path tests first.
+            const FloatVec4& GetPassthroughTessControlOuterLevel() const {
+                return m_passthroughTessControlOuterLevel;
+            }
+            const FloatVec2& GetPassthroughTessControlInnerLevel() const {
+                return m_passthroughTessControlInnerLevel;
+            }
 
             Bool HasGlobalUboBlock() const { return m_globalUboBackendBlockIndex >= 0; }
             const Vector<Int>& GetUniformBlockBackendIndices() const { return m_uniformBlockBackendIndices; }
@@ -1483,6 +1660,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
                                       const UnorderedMap<String, Int>& storageBlockBindingOverrides,
                                       const std::map<String, String>& inputBlockRenames,
                                       const std::map<String, String>& outputBlockRenames,
+                                      Bool stripInputBlockLocations, Bool stripOutputBlockLocations,
                                       Int atomicCounterEsslBindingTop, Bool enableSpirvValidation,
                                       String& outSource,
                                       std::set<String>& outFlattenedXfbBlockNames,
@@ -1513,6 +1691,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // all); otherwise the GL_PATCH_VERTICES the synthesized pass-through stage was built
             // with. See GetPassthroughTessControlPatchVertices.
             Int m_passthroughTessControlPatchVertices = -1;
+            // The default tessellation levels baked into that same stage. Only meaningful while
+            // the field above is not -1.
+            FloatVec4 m_passthroughTessControlOuterLevel = FloatVec4(1.0f, 1.0f, 1.0f, 1.0f);
+            FloatVec2 m_passthroughTessControlInnerLevel = FloatVec2(1.0f, 1.0f);
             Bool m_isInitialized = false;
             Bool m_backendProgramUsable = false;
             // Set by SyncToBackend every time it relinks the driver program, cleared by the

MobileGL/MG_Backend/DirectGLES/MultiDraw.cpp

@@ -29,16 +29,21 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
             }
         }
 
-        // The all-ones value of an index type, which is what GL restarts on once
-        // primitive restart is in play. CheckPrimitiveRestartSupported has already
-        // rejected the arbitrary-index form of GL_PRIMITIVE_RESTART, so an enabled
-        // restart always restarts here and nowhere else.
+        // The index value this batch restarts on, compared at 32 bits against the zero-extended
+        // source index. Normally the all-ones value of the source type, which is what
+        // GL_PRIMITIVE_RESTART_FIXED_INDEX and GLES both restart on; with desktop
+        // GL_PRIMITIVE_RESTART it is instead whatever glPrimitiveRestartIndex named. The rebased
+        // tier turns whichever it is into 0xFFFFFFFF in its widened stream, which is what the
+        // driver restarts on.
+        //
+        // No truncation, deliberately, and the same rule ResolveRestartSubstitution applies: a
+        // restart index the source type cannot hold simply matches nothing, so returning it
+        // verbatim is already "this batch restarts nowhere".
         Uint32 RestartSentinelFor(GLenum type) {
-            switch (type) {
-            case GL_UNSIGNED_BYTE: return 0xFFu;
-            case GL_UNSIGNED_SHORT: return 0xFFFFu;
-            default: return 0xFFFFFFFFu;
+            if (ResolveRestartSubstitution(type) != RestartSubstitutionKind::None) {
+                return MG_State::pGLContext->GetPrimitiveRestartIndex();
             }
+            return MG_Util::FixedRestartIndexForGLType(type);
         }
 
         Bool RestartActive() {
@@ -275,10 +280,20 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
         // its remaining feasibility checks inside its implementation, where the data it
         // has to walk is already in hand.
         GLESMultiDrawMode ResolveTierForBatch(Bool programReadsDrawID, Bool perSubDrawBaseVertex,
-                                              Bool hasIndexBuffer) {
+                                              Bool hasIndexBuffer, Bool arbitraryRestart) {
             ResolveTierOnce();
             GLESMultiDrawMode tier = g_resolvedTier;
 
+            // Desktop GL_PRIMITIVE_RESTART restarts on an application-chosen index; the driver
+            // only ever restarts on the all-ones value. Every tier but the rebased one hands
+            // the application's own index data to the driver, which would then see no restarts
+            // at all and weld the primitives together. The rebased tier is the one that
+            // REWRITES the stream, and RestartSentinelFor already tells it which value to
+            // translate, so it is the only tier this batch can take.
+            if (arbitraryRestart) {
+                return GLESMultiDrawMode::DrawElements;
+            }
+
             // Batched tiers issue one driver entry for the whole batch, so the emulated
             // gl_DrawID uniform can only hold one value across every sub-draw. A program
             // that reads gl_DrawID gets an unrolled tier, which feeds each sub-draw its
@@ -488,6 +503,16 @@ namespace MobileGL::MG_Backend::DirectGLES::MultiDrawImpl {
 
             const Bool restartActive = RestartActive();
             const Uint32 restartSentinel = RestartSentinelFor(type);
+            // Widening to GL_UNSIGNED_INT gives a UBYTE/USHORT source a sentinel it can never
+            // spell, so those batches are lossless. A UINT source that already uses 0xFFFFFFFF as
+            // a real vertex index while restarting on a different one is the one shape 32 bits
+            // cannot express - the same corner the single-draw substitution reports.
+            if (restartActive && indexSize == 4 && restartSentinel != 0xFFFFFFFFu) {
+                MGLOG_E_ONCE("GL_PRIMITIVE_RESTART with restart index %u over GL_UNSIGNED_INT multi-draw indices: "
+                             "any index that is already 0xFFFFFFFF will restart too, because the rewritten stream "
+                             "has no wider sentinel to move to.",
+                             restartSentinel);
+            }
             g_indexStaging.resize(total);
             SizeT cursor = 0;
             for (GLsizei i = 0; i < drawcount; ++i) {
@@ -852,8 +877,14 @@ void main() {
     void DrawElementsBatch(GLenum mode, const GLsizei* count, GLenum type, const GLvoid* const* indices,
                            GLsizei drawcount, const GLint* basevertex) {
         if (drawcount <= 0 || !count || !indices) return;
-        // State-independent and possibly throwing, so it runs before any GL work.
-        CheckPrimitiveRestartSupported(type);
+        // Read before any GL work, because it decides the tier below: a desktop restart index
+        // the driver does not know about can only be honoured by the tier that rewrites the
+        // index stream (see ResolveTierForBatch). A restart index this index type cannot hold
+        // needs no rewrite at all - nothing can match it - but it does need the driver's own
+        // fixed-index restart held off for the batch, which is what the scope below does.
+        const RestartSubstitutionKind restartKind = ResolveRestartSubstitution(type);
+        const Bool arbitraryRestart = restartKind == RestartSubstitutionKind::RewriteIndices;
+        const ScopedSuppressedPrimitiveRestart restartCapOverride(restartKind);
 
         const Bool hasIndexBuffer = BoundIndexBuffer() != nullptr;
 
@@ -889,7 +920,8 @@ void main() {
         // the tier choice and the per-sub-draw feeds use those, not the guess above.
         const Bool feedDrawID = CurrentProgramReadsDrawID();
         const Bool feedBaseVertex = basevertex != nullptr && CurrentProgramReadsBaseVertex();
-        const GLESMultiDrawMode tier = ResolveTierForBatch(feedDrawID, feedBaseVertex, hasIndexBuffer);
+        const GLESMultiDrawMode tier =
+            ResolveTierForBatch(feedDrawID, feedBaseVertex, hasIndexBuffer, arbitraryRestart);
 
         Bool drawn = false;
         switch (tier) {
@@ -921,8 +953,10 @@ void main() {
         // Every tier above may decline a batch whose shape it cannot express. The two
         // below are the floor: a base-vertex replay where the driver has one, and the
         // rewritten index stream where it does not. Both are safe for any batch these
-        // entry points can receive.
-        if (!drawn) {
+        // entry points can receive - except that the base-vertex replay hands the
+        // application's own indices to the driver, which cannot restart on a desktop
+        // restart index, so that batch has only the rewriting floor.
+        if (!drawn && !arbitraryRestart) {
             drawn = RunBaseVertexLoop(mode, count, type, indices, drawcount, basevertex, feedDrawID, feedBaseVertex);
         }
         if (!drawn) {

MobileGL/MG_Backend/DirectGLES/Utils.cpp

@@ -11,8 +11,10 @@
 #include "Managers.h"
 #include "MG_Backend/BackendObjects.h"
 #include "MG_Util/Converters/GLToMG/FramebufferEnumConverter.h"
+#include "MG_Util/SelfTest/DriverBugProbes.h"
 #include "MG_Util/Texture/TextureFormatProcessor.h"
 #include "MG_Util/ShaderTranspiler/ShaderCompiler.h"
+#include <Config.h>
 
 #include <MG_State/GLState/Core.h>
 #include <MG_Util/BackendLoaders/OpenGL/Loader.h>
@@ -26,6 +28,7 @@
 #include <cmath>
 #include <cctype>
 #include <cstring>
+#include <format>
 #include <regex>
 
 namespace MobileGL::MG_Backend::DirectGLES {
@@ -124,6 +127,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     requestedInternalFormat,
                     TextureImpl::GetRenderTargetNormalizeOptions(g_GLESCapabilities, targetIndex));
             }
+            // Outside the caveat branch on purpose: the driver CAN create the native narrow
+            // storage - the capability probes say so - it just cannot be trusted as a raw-copy
+            // endpoint. Texture and renderbuffer targets both come through here, which is what
+            // keeps a renderbuffer -> texture copy of these formats same-ES-format when the
+            // widening engages.
+            if (TextureImpl::UsesWidenedPacked16NormStorage(internalFormat)) {
+                options |= PixelFormatNormalizeOptionBit::WidenPacked16Norm;
+            }
             NormalizePixelFormat(requestedInternalFormat, options, outInternalFormat, outFormat, outType);
         }
     } // namespace
@@ -181,6 +192,36 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return options;
         }
 
+        Bool UsesWidenedPacked16NormStorage(TextureInternalFormat internalFormat) {
+            switch (internalFormat) {
+            // TextureInternalFormat::RGB5 is both GL_RGB5 and GL_RGB565 - the GL-to-MG
+            // converter folds the two spellings onto one logical format.
+            case TextureInternalFormat::RGB5:
+            case TextureInternalFormat::RGB5A1:
+            case TextureInternalFormat::RGBA4:
+                break;
+            default:
+                return false;
+            }
+            switch (MG_Config::Features.EsprytWidenPacked16Storage) {
+            case MG_Config::QuirkOverride::ForceOn:
+                return true;
+            case MG_Config::QuirkOverride::ForceOff:
+                return false;
+            case MG_Config::QuirkOverride::Auto:
+                break;
+            }
+            // Behind the backend gate on purpose: the memoized probe latches its first answer
+            // for the whole process, and before the backend is up the GL function table may
+            // not be resolved yet - a probe run then would latch "cannot tell" as "clean"
+            // forever. Once the backend exists, the first narrow-format image this process
+            // creates runs the probe on a live context.
+            if (pActiveBackendObject == nullptr) {
+                return false;
+            }
+            return MG_Util::SelfTest::CopyImageMirrorsPacked16FieldOrder(g_GLESFuncs);
+        }
+
         void GenerateTextureFormatInfo(TextureInternalFormat internalFormat, GLenum* outInternalFormat,
                                        GLenum* outFormat, GLenum* outType, TextureTarget target) {
 #ifdef TRACY_ENABLE
@@ -712,6 +753,47 @@ namespace MobileGL::MG_Backend::DirectGLES {
             return glslCode;
         }
 
+        const char* PointSizeExtensionName(MG_External::GLESCapabilities::PointSizeTier tier, Bool tessellation) {
+            using Tier = MG_External::GLESCapabilities::PointSizeTier;
+            switch (tier) {
+                case Tier::ExtensionEXT:
+                    return tessellation ? "GL_EXT_tessellation_point_size" : "GL_EXT_geometry_point_size";
+                case Tier::ExtensionOES:
+                    return tessellation ? "GL_OES_tessellation_point_size" : "GL_OES_geometry_point_size";
+                default:
+                    return nullptr;
+            }
+        }
+
+        String RequestPointSizeExtension(String glslCode, const char* extensionName) {
+#ifdef TRACY_ENABLE
+            ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
+#endif
+            // The gl_ViewportIndex story, one built-in over: ESSL 320 makes the tessellation and
+            // geometry STAGES core but leaves gl_PointSize out of their gl_PerVertex entirely,
+            // and SPIRV-Cross - which only ever sees a SPIR-V BuiltIn PointSize decoration -
+            // prints the identifier with no directive behind it. Same hard rule as the two
+            // neighbours: never emitted speculatively, because `#extension` on a name the driver
+            // does not advertise is a compile error of its own.
+            if (extensionName == nullptr || glslCode.find(extensionName) != String::npos) {
+                return glslCode;
+            }
+            const String directive = String("#extension ") + extensionName + " : require\n";
+            // Right after the #version line, the one position that must stay first;
+            // ForceSupporterOutput's scan for the LAST #extension directive still finds
+            // whichever one that ends up being.
+            const SizeT versionPos = glslCode.find("#version");
+            if (versionPos == String::npos) {
+                return directive + glslCode;
+            }
+            const SizeT lineEnd = glslCode.find('\n', versionPos);
+            if (lineEnd == String::npos) {
+                return glslCode + "\n" + directive;
+            }
+            glslCode.insert(lineEnd + 1, directive);
+            return glslCode;
+        }
+
         String BakeImageFormatQualifiers(String glslCode,
                                          const UnorderedMap<String, String>& esslFormatByUniformName) {
 #ifdef TRACY_ENABLE
@@ -836,7 +918,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
 
         String BuildPassthroughTessControlEssl(const Uint esslVersion, const Uint patchVertices,
                                                const String& inPerVertexMembers,
-                                               const String& outPerVertexMembers) {
+                                               const String& outPerVertexMembers,
+                                               const FloatVec4& defaultOuterLevel,
+                                               const FloatVec2& defaultInnerLevel) {
 #ifdef TRACY_ENABLE
             ZoneScopedC(TRACY_ZONECOLOR_BACKEND);
 #endif
@@ -866,12 +950,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // was declined before this was ever called (ModuleReadsLocatedInput), and gl_PointSize
             // from a tessellation stage is a separate capability on both targets.
             source += "    gl_out[gl_InvocationID].gl_Position = gl_in[gl_InvocationID].gl_Position;\n";
-            source += "    gl_TessLevelOuter[0] = 1.0;\n";
-            source += "    gl_TessLevelOuter[1] = 1.0;\n";
-            source += "    gl_TessLevelOuter[2] = 1.0;\n";
-            source += "    gl_TessLevelOuter[3] = 1.0;\n";
-            source += "    gl_TessLevelInner[0] = 1.0;\n";
-            source += "    gl_TessLevelInner[1] = 1.0;\n";
+            for (Uint i = 0; i < 4; ++i) {
+                source += "    gl_TessLevelOuter[" + std::to_string(i) +
+                          "] = " + MG_Util::ShaderTranspiler::TessellationLevelLiteral(defaultOuterLevel[i]) + ";\n";
+            }
+            for (Uint i = 0; i < 2; ++i) {
+                source += "    gl_TessLevelInner[" + std::to_string(i) +
+                          "] = " + MG_Util::ShaderTranspiler::TessellationLevelLiteral(defaultInnerLevel[i]) + ";\n";
+            }
             source += "}\n";
             return source;
         }

MobileGL/MG_Backend/DirectGLES/Utils.h

@@ -46,6 +46,15 @@ namespace MobileGL::MG_Backend::DirectGLES {
         Flags<PixelFormatNormalizeOptionBit> GetRenderTargetNormalizeOptions(
             const MG_External::GLESCapabilities& capabilities, SizeT targetIndex);
 
+        // Whether this format's ES storage is widened to 8-bit-per-channel because the
+        // driver stores some packed16 allocations with a mirrored field order
+        // (PixelFormatNormalizeOptionBit::WidenPacked16Norm). True only for
+        // GL_RGB565/GL_RGB5(_A1)/GL_RGBA4, and only where the POST probe measured the
+        // divergence (or MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE forces it). The transfer paths
+        // consult it too: the packed-norm re-upload leg must stand down when the ES storage
+        // is no longer 16-bit packed.
+        Bool UsesWidenedPacked16NormStorage(TextureInternalFormat internalFormat);
+
         void GenerateTextureFormatInfo(TextureInternalFormat internalFormat, GLenum* outInternalFormat,
                                        GLenum* outFormat, GLenum* outType,
                                        TextureTarget target = TextureTarget::Unknown);
@@ -273,6 +282,22 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // error, so this is never emitted speculatively. A no-op when not needed or already
         // present.
         String RequestViewportArrayExtension(String glslCode, Bool needed);
+        // Adds `#extension <extensionName> : require` when a TESSELLATION or GEOMETRY stage's
+        // emitted ESSL names gl_PointSize. Desktop GL has that built-in in gl_PerVertex for every
+        // vertex-processing stage; ESSL does NOT have it in those two at any version - not even
+        // 320, where the stages themselves are core - until EXT/OES_tessellation_point_size resp.
+        // EXT/OES_geometry_point_size is requested. SPIRV-Cross prints the identifier bare and
+        // asks for nothing, exactly as it does for gl_ViewportIndex, so without this the stage
+        // fails to compile with "`gl_PointSize' undeclared" and the WHOLE program is replaced by
+        // program 0 - the draw renders nothing and any transform-feedback capture it was carrying
+        // is rejected outright. `extensionName` is the caller's answer, nullptr when the driver
+        // advertises neither spelling, because requesting an unadvertised extension is itself a
+        // compile error. A no-op when nullptr or already present.
+        String RequestPointSizeExtension(String glslCode, const char* extensionName);
+        // The extension name RequestPointSizeExtension should be given for `tier`, or nullptr for
+        // PointSizeTier::None. `tessellation` picks the tessellation spellings over the geometry
+        // ones; the two extensions are separate and neither implies the other.
+        const char* PointSizeExtensionName(MG_External::GLESCapabilities::PointSizeTier tier, Bool tessellation);
         // Writes a format layout qualifier into the image declarations named in
         // `esslFormatByUniformName` that still have none. The completion half of the image-format
         // bake, and ONLY that: the SPIR-V pass (BakeImageFormatsPass) is what normally puts the
@@ -368,11 +393,11 @@ namespace MobileGL::MG_Backend::DirectGLES {
         //
         // All four outer levels and both inner levels are written unconditionally: writing a
         // level the evaluation stage's domain does not use is legal and ignored, and it saves
-        // this from having to know the domain. They are literal 1.0 because that is the GL
-        // default and glPatchParameterfv - their only setter - is a stub in this frontend
-        // (MG_Impl/GLImpl/Exporting/Definitions.cpp). Implementing that entry point means making
-        // the levels a parameter here AND part of what makes a built program stale, exactly as
-        // PATCH_VERTICES already is; the two must move together, so they are named together.
+        // this from having to know the domain. They are the GL_PATCH_DEFAULT_OUTER_LEVEL /
+        // GL_PATCH_DEFAULT_INNER_LEVEL state, baked in as literals - ES has no such state and no
+        // glPatchParameterfv to forward to, so compiling them in is the only way to honour them.
+        // That makes them part of what a built program is stale against, exactly as PATCH_VERTICES
+        // is: see the staleness clause in DirectGLES.cpp's SyncCurrentProgram, which compares both.
         //
         // The same stage, for the same reason, that DirectVulkan synthesizes in
         // ProgramFactory::BuildPassthroughTessControlSource - Vulkan likewise requires both
@@ -382,7 +407,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // VkShaderModule against a driver shader object.
         String BuildPassthroughTessControlEssl(Uint esslVersion, Uint patchVertices,
                                                const String& inPerVertexMembers,
-                                               const String& outPerVertexMembers);
+                                               const String& outPerVertexMembers,
+                                               const FloatVec4& defaultOuterLevel,
+                                               const FloatVec2& defaultInnerLevel);
         // Prefix of the writeonly half a read+write image uniform is split into (see
         // SplitReadWriteImageUniforms); the suffix is the image's own (already access-tagged) name.
         constexpr const char* IMAGE_WRITE_ALIAS_PREFIX = "mg_imageWrite_";
@@ -505,7 +532,7 @@ namespace MobileGL::MG_Backend::DirectGLES {
         // avoidExplicitLodBias leaves lookups that already carry an explicit LOD untouched,
         // so their constant level stays constant; only the implicit-LOD forms take the bias.
         // Off by default and only ever set on ANGLE + llvmpipe, where injecting the uniform
-        // into a constant LOD crashes the driver (MOBILEGL_AVOID_EXPLICIT_LOD_BIAS).
+        // into a constant LOD crashes the driver (MOBILEGL_ESPRYT_AVOID_EXPLICIT_LOD_BIAS).
         String EmulateTextureLodBias(const String& glslCode, Bool avoidExplicitLodBias = false);
     } // namespace PrgramImpl
 

MobileGL/MG_Backend/DirectVulkan/BackendObject_DirectVulkan.cpp

@@ -500,7 +500,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             .RendererName = "Magma",
             .BackendName = "Direct (Vulkan)",
             .ExtraVendor = Nullopt,
-            .RendererGLInfo = {.TargetGLVersion = {4, 3, 0},
+            .RendererGLInfo = {.TargetGLVersion = {4, 6, 0},
                                .TargetGLSLVersion = {4, 6, 0},
                                // Baseline advertisement (no runtime-gated capabilities); a live
                                // backend reconciles its copy in UpdateAdvertisedExtensions.
@@ -516,10 +516,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                                   Bool cubeMapArraySupported) {
         Vector<GLExtension> extensions = {
             // The version tokens have to reach the version the backend actually claims:
-            // TargetGLVersion is {4,3,0}, and a list that stopped at OpenGL40 told an
+            // TargetGLVersion is {4,6,0}, and a list that stopped at OpenGL40 told an
             // application feature-detecting off these tokens the opposite of what
             // GL_MAJOR_VERSION / GL_MINOR_VERSION told it.
             V_OpenGL30, V_OpenGL31, V_OpenGL32, V_OpenGL33, V_OpenGL40, V_OpenGL41, V_OpenGL42, V_OpenGL43,
+            V_OpenGL44, V_OpenGL45, V_OpenGL46,
             E_GL_ARB_draw_buffers_blend,
             E_GL_ARB_compute_shader, E_GL_ARB_shader_storage_buffer_object, E_GL_ARB_shader_image_load_store,
             E_GL_ARB_clear_buffer_object, E_GL_ARB_program_interface_query, E_GL_ARB_framebuffer_object, E_GL_ARB_draw_indirect,
@@ -623,7 +624,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (nonZeroIndirectBaseInstanceSupported) {
             extensions.push_back(E_GL_ARB_base_instance);
         }
-        if (shaderSubgroupSupported && !MG_Config::Features.DisableSubgroup) {
+        if (shaderSubgroupSupported && !MG_Config::Features.MagmaDisableSubgroup) {
             extensions.push_back(E_GL_KHR_shader_subgroup);
         }
         // GL_KHR_parallel_shader_compile is MobileGL's own capability, not the Vulkan
@@ -1005,6 +1006,19 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // it the limit describes a capacity no shader may use, so report none.
         m_dynamicParameters.MaxClipDistances =
             m_vulkanCaps.SupportsShaderClipDistance ? std::max(m_vulkanCaps.MaxClipDistances, 0) : 0;
+        // The cull pair, gated on its own feature. shaderCullDistance is separate from
+        // shaderClipDistance and VulkanRenderer enables it independently, so it gets its own
+        // gate rather than riding on the clip one.
+        m_dynamicParameters.MaxCullDistances =
+            m_vulkanCaps.SupportsShaderCullDistance ? std::max(m_vulkanCaps.MaxCullDistances, 0) : 0;
+        // GL 4.6 core 11.1.3.10: the combined limit is at least as large as either half. A device
+        // with only one of the two features must not report a combined capacity that implies the
+        // other, so the gate is "either feature" and the value never drops below what is enabled.
+        m_dynamicParameters.MaxCombinedClipAndCullDistances =
+            (m_vulkanCaps.SupportsShaderClipDistance || m_vulkanCaps.SupportsShaderCullDistance)
+                ? std::max({m_vulkanCaps.MaxCombinedClipAndCullDistances, m_dynamicParameters.MaxClipDistances,
+                            m_dynamicParameters.MaxCullDistances})
+                : 0;
         m_dynamicParameters.MaxViewports = m_vulkanCaps.MaxViewports;
         // Assigned explicitly rather than left to the struct's defaults, like every other
         // parameter here, so a second fill cannot inherit a stale value. GL_UNDEFINED_VERTEX is
@@ -1067,6 +1081,31 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // report VK_FALSE, so on every real mobile device this is false and the demotion runs
         // exactly as it always has.
         m_dynamicParameters.SupportsShaderFloat64 = m_vulkanCaps.SupportsShaderFloat64;
+        // shaderTessellationAndGeometryPointSize, both stage families from the one feature.
+        // False arms the shared phase-B point-size demotion, whose modules then carry no
+        // TessellationPointSize/GeometryPointSize capability and build without the feature.
+        // MOBILEGL_POINT_SIZE_DEMOTION=1 pretends it is absent so the demotion can be
+        // exercised on a healthy driver (lavapipe advertises the feature); =0 restores the
+        // detected answer's declines.
+        {
+            Bool supportsStagePointSize = m_vulkanCaps.SupportsTessellationAndGeometryPointSize;
+            switch (MG_Config::Features.PointSizeDemotion) {
+            case MG_Config::QuirkOverride::ForceOn:
+                MGLOG_I("DirectVulkan: MOBILEGL_POINT_SIZE_DEMOTION=1 - treating tessellation/geometry "
+                        "gl_PointSize as unhosted so the demotion runs on this driver");
+                supportsStagePointSize = false;
+                break;
+            case MG_Config::QuirkOverride::ForceOff:
+                MGLOG_I("DirectVulkan: MOBILEGL_POINT_SIZE_DEMOTION=0 - keeping the built-in and the "
+                        "plain declines regardless of the device feature");
+                supportsStagePointSize = true;
+                break;
+            case MG_Config::QuirkOverride::Auto:
+                break;
+            }
+            m_dynamicParameters.SupportsTessellationPointSize = supportsStagePointSize;
+            m_dynamicParameters.SupportsGeometryPointSize = supportsStagePointSize;
+        }
         // Never, on any device, and DELIBERATELY NOT COUPLED to the line above even though it
         // once tracked the same feature. It used to, because a `dvec` input needed Float64 to
         // exist in the module at all; a 64-bit vertex FETCH was already impossible

MobileGL/MG_Backend/DirectVulkan/BackendObject_DirectVulkan.h

@@ -70,7 +70,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     const RendererInfo& GetRendererIdentity();
 
     // The full OpenGL extension list Magma advertises (glGetString(GL_EXTENSIONS)) for
-    // a device with the given raw capabilities. The MOBILEGL_DISABLE_SUBGROUP and
+    // a device with the given raw capabilities. The MOBILEGL_MAGMA_DISABLE_SUBGROUP and
     // MOBILEGL_DISABLE_TIMERQUERY escape hatches are applied inside, so callers pass
     // the detected device support (passing an already-gated value is harmless).
     Vector<GLExtension> BuildAdvertisedExtensions(Bool shaderSubgroupSupported, Bool timerQueriesSupported,

MobileGL/MG_Backend/DirectVulkan/DirectVulkan.cpp

@@ -1206,6 +1206,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             SharedPtr<VkTimerQueryManager::TimestampRecord> end;
             // Kind::Occlusion - pool slots recorded between Begin/End; summed at result time.
             Vector<Uint32> occlusionSlots;
+            // Kind::XfbGenerated - reroute-pool slots for the span's XFB-INACTIVE
+            // draws, where the renderer's reroute is armed (the affected driver's
+            // stream query counts nothing without an open capture; see
+            // VulkanRenderer::BeginXfbQueryForDraw). Summed alongside the stream
+            // slots above, which keep the span's XFB-active draws.
+            Vector<Uint32> rerouteSlots;
             // Renderer generation the records were written under (see
             // g_rendererGeneration). A stale generation resolves as available
             // with a final zero result: the records' pool indices and frame
@@ -1215,11 +1221,19 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // stale queries are always safe to delete.
             Uint64 rendererGeneration = 0;
             // Kind::XfbGenerated - the frontend's paused-draw primitive counter when the
-            // query began. VK_QUERY_TYPE_TRANSFORM_FEEDBACK_STREAM_EXT counts only what the
-            // capture saw, so a draw made while the span was paused is invisible to it -
-            // but GL_PRIMITIVES_GENERATED counts what the last vertex processing stage
-            // emitted regardless. The delta closes that gap at result time.
+            // query began. On the affected drivers VK_QUERY_TYPE_TRANSFORM_FEEDBACK_STREAM_EXT
+            // counts only what the capture saw, so a draw made while the span was paused is
+            // invisible to it - but GL_PRIMITIVES_GENERATED counts what the last vertex
+            // processing stage emitted regardless. The delta closes that gap at result time.
             Uint64 pausedPrimitiveSnapshot = 0;
+            // ...unless the GPU already counted those paused draws when the span opened -
+            // through the reroute pool (VulkanRenderer::BeginXfbQueryForDraw reroutes every
+            // draw with no open capture, paused ones included) or, where the probe measured
+            // the stream query as counting capture-less draws, through the stream slot the
+            // paused draw still takes. Adding the CPU delta on top would count them twice,
+            // and the CPU counter is the weaker source anyway: only 3 of the ~15 draw entry
+            // points write it and it answers 0 for GL_PATCHES.
+            Bool pausedPrimitivesCountedByGpu = false;
         };
     } // namespace
 
@@ -1313,12 +1327,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (query->kind == VulkanTimerQuery::Kind::XfbWritten ||
             query->kind == VulkanTimerQuery::Kind::XfbGenerated) {
             Uint64 primitives = 0;
-            if (!pVulkanRenderer->ResolveXfbQueryResult(query->occlusionSlots,
+            if (!pVulkanRenderer->ResolveXfbQueryResult(query->occlusionSlots, query->rerouteSlots,
                                                         query->kind == VulkanTimerQuery::Kind::XfbGenerated,
                                                         primitives)) {
                 return false;
             }
-            if (query->kind == VulkanTimerQuery::Kind::XfbGenerated && MG_State::pGLContext != nullptr) {
+            if (query->kind == VulkanTimerQuery::Kind::XfbGenerated &&
+                !query->pausedPrimitivesCountedByGpu && MG_State::pGLContext != nullptr) {
                 primitives += MG_State::pGLContext->GetTransformFeedbackPausedPrimitiveCounter() -
                               query->pausedPrimitiveSnapshot;
             }
@@ -1367,6 +1382,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         query->rendererGeneration = GetRendererGeneration();
         query->pausedPrimitiveSnapshot =
             MG_State::pGLContext ? MG_State::pGLContext->GetTransformFeedbackPausedPrimitiveCounter() : 0;
+        // Read AFTER StartXfbQueryCapture, which is where a failed reroute-pool creation
+        // disarms: the answer is then what this span will actually do for every draw.
+        query->pausedPrimitivesCountedByGpu = generated && pVulkanRenderer->ArePausedDrawsGpuCounted();
         return query;
     }
 
@@ -1377,7 +1395,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return;
         }
         pVulkanRenderer->StopXfbQueryCapture(
-            query->kind == VulkanTimerQuery::Kind::XfbGenerated ? 1u : 0u, query->occlusionSlots);
+            query->kind == VulkanTimerQuery::Kind::XfbGenerated ? 1u : 0u, query->occlusionSlots,
+            query->rerouteSlots);
     }
 
     BackendQueryHandle BeginOcclusionQuery() {

MobileGL/MG_Backend/DirectVulkan/Renderer/PipelineFactory.cpp

@@ -201,11 +201,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.renderPass, sizeof(payload.renderPass)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.colorAttachmentCount, sizeof(payload.colorAttachmentCount)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.rasterizationSamples, sizeof(payload.rasterizationSamples)));
+        XXHASH_VERIFY(XXH64_update(m_hashState, &payload.sampleShadingEnable, sizeof(payload.sampleShadingEnable)));
+        XXHASH_VERIFY(XXH64_update(m_hashState, &payload.minSampleShading, sizeof(payload.minSampleShading)));
+        XXHASH_VERIFY(XXH64_update(m_hashState, &payload.sampleMask, sizeof(payload.sampleMask)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.subpass, sizeof(payload.subpass)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.topology, sizeof(payload.topology)));
         XXHASH_VERIFY(
             XXH64_update(m_hashState, &payload.primitiveRestartEnable, sizeof(payload.primitiveRestartEnable)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.patchControlPoints, sizeof(payload.patchControlPoints)));
+        XXHASH_VERIFY(XXH64_update(m_hashState, &payload.passthroughTessControlKey,
+                                   sizeof(payload.passthroughTessControlKey)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.viewportCount, sizeof(payload.viewportCount)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.polygonMode, sizeof(payload.polygonMode)));
         XXHASH_VERIFY(XXH64_update(m_hashState, &payload.cullMode, sizeof(payload.cullMode)));
@@ -435,6 +440,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         VkPipelineMultisampleStateCreateInfo ms{VK_STRUCTURE_TYPE_PIPELINE_MULTISAMPLE_STATE_CREATE_INFO};
         ms.rasterizationSamples = payload.rasterizationSamples;
+        ms.sampleShadingEnable = payload.sampleShadingEnable ? VK_TRUE : VK_FALSE;
+        // Ignored by Vulkan unless sampleShadingEnable is set, but written unconditionally so the
+        // struct's bytes match the hash the payload was keyed by.
+        ms.minSampleShading = payload.minSampleShading;
+        // GL_SAMPLE_MASK / glSampleMaski. Left at nullptr - which Vulkan reads as all-ones - until
+        // now, so glSampleMaski was a silent no-op on this backend while DirectGLES forwarded it.
+        // The pointer has to outlive the vkCreateGraphicsPipelines call, which the payload does.
+        ms.pSampleMask = payload.sampleMask;
 
         VkPipelineDepthStencilStateCreateInfo depthStencil{VK_STRUCTURE_TYPE_PIPELINE_DEPTH_STENCIL_STATE_CREATE_INFO};
         depthStencil.depthTestEnable = payload.depthTestEnable ? VK_TRUE : VK_FALSE;

MobileGL/MG_Backend/DirectVulkan/Renderer/PipelineFactory.h

@@ -37,11 +37,39 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             VkRenderPass renderPass = VK_NULL_HANDLE;
             Uint32 colorAttachmentCount = 1;
             VkSampleCountFlagBits rasterizationSamples = VK_SAMPLE_COUNT_1_BIT;
+            // glEnable(GL_SAMPLE_SHADING) + glMinSampleShading, which Vulkan bakes into the
+            // pipeline rather than exposing as dynamic state - so both are part of the pipeline's
+            // identity and both are hashed. The renderer leaves the enable false unless the
+            // device's sampleRateShading feature was enabled
+            // (VUID-VkPipelineMultisampleStateCreateInfo-sampleShadingEnable-00784).
+            Bool sampleShadingEnable = false;
+            Float minSampleShading = 0.0f;
+            // glEnable(GL_SAMPLE_MASK) + glSampleMaski, the fixed-function coverage mask, already
+            // reduced to what GL says this draw gets (VulkanRenderer::ResolveEffectiveSampleMask:
+            // all-ones unless the target is genuinely multisampled). Pipeline state like the two
+            // above - Vulkan has no dynamic sample mask before VK_EXT_extended_dynamic_state3 -
+            // so it is hashed with them, and all-ones has to keep producing the pipeline a null
+            // pSampleMask always did.
+            //
+            // TWO words, though GL only ever fills the first. GL_MAX_SAMPLE_MASK_WORDS is clamped
+            // to 1 on both backends, so glSampleMaski writes index 0 and nothing else - but the
+            // count Vulkan READS is ceil(rasterizationSamples / 32), which is 2 on a 64-sample
+            // target, and GetAdvertisedMaxSamples does not cap the driver's sample count. A
+            // single Uint32 here let such a pipeline read one word past the member (the next
+            // struct field). The second word is all-ones: full coverage for samples 32..63, which
+            // is the only honest answer when GL has no state describing them.
+            Uint32 sampleMask[2] = {0xffffffffu, 0xffffffffu};
             Uint32 subpass = 0;
             VkPrimitiveTopology topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
             Bool primitiveRestartEnable = false;
             // GL_PATCH_VERTICES; only read for a PATCH_LIST topology.
             Uint32 patchControlPoints = 3;
+            // ProgramFactory::ComputePassthroughTessControlKey of the synthesized pass-through
+            // tessellation control stage below, or 0 when this pipeline has none. Hashed, because
+            // the levels glPatchParameterfv set are compiled INTO that module and are not a
+            // function of the program or of patchControlPoints - see the note on
+            // passthroughTessControlStage.
+            Uint64 passthroughTessControlKey = 0;
             // How many of ARB_viewport_array's viewports this pipeline rasterizes into. 1 for
             // every program that never assigns gl_ViewportIndex, which is all of them outside the
             // conformance suite - the wide shape costs a longer vkCmdSetViewport/Scissor per state
@@ -87,8 +115,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // renderer could not build one, and CreatePipeline refuses the pipeline - the same
             // refusal it applies when `stages` itself is half-tessellated.
             //
-            // NOT hashed: it is a pure function of the program and of patchControlPoints, both
-            // of which ComputeHash already mixes in.
+            // NOT hashed directly: it is a pure function of the program, of patchControlPoints and
+            // of the default tessellation levels - the first two of which ComputeHash already
+            // mixes in, and the third of which arrives through passthroughTessControlKey above.
             VkPipelineShaderStageCreateInfo passthroughTessControlStage{};
             const VkPipelineVertexInputStateCreateInfo* vertexInputState = nullptr;
             // Diagnostic only; may be null. Read solely from the pipeline-creation failure path.

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.cpp

@@ -13,7 +13,10 @@
 #include "MG_Util/ShaderTranspiler/SpvcSession.h"
 #include "MG_Util/ShaderTranspiler/Types.h"
 #include <algorithm>
+#include <bit>
+#include <cmath>
 #include <cstring>
+#include <format>
 #include <map>
 #include <utility>
 #include <spirv-tools/libspirv.h>
@@ -74,6 +77,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
         };
 
+        // Where a gl_PerVertex built-in output lives, resolved from the module's annotations.
+        // Named for gl_Position because the clip-space fixup is what it was written for, and it
+        // is still the only shape that pass accepts - but the transform-feedback capture pass
+        // resolves gl_PointSize through the same struct, in which case `vectorTypeId` /
+        // `vectorPtrTypeId` hold the SCALAR float type and its Output pointer rather than a vec4.
         struct PositionTargetInfo {
             Uint32 variableId = 0;
             Uint32 vectorTypeId = 0;
@@ -99,6 +107,23 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return true;
         }
 
+        // gl_PointSize's counterpart to IsVec4Float32. The two are the only shapes any
+        // gl_PerVertex member this file resolves can have, and each resolver takes whichever
+        // one its built-in is declared with, so a mismatched type declines rather than
+        // producing a mirror the driver would reject.
+        Bool IsFloat32Scalar(spvtools::opt::IRContext* context, Uint32 typeId, Uint32* outFloatTypeId) {
+            auto* floatInst = context->get_def_use_mgr()->GetDef(typeId);
+            if (!floatInst || floatInst->opcode() != spv::Op::OpTypeFloat) return false;
+            if (floatInst->GetSingleWordInOperand(0) != 32) return false;
+
+            if (outFloatTypeId) *outFloatTypeId = typeId;
+            return true;
+        }
+
+        // Which of the two shapes above a resolver should accept. A plain function pointer
+        // rather than a std::function: every call site is one of the two free functions.
+        using BuiltInTypeCheckFn = Bool (*)(spvtools::opt::IRContext*, Uint32, Uint32*);
+
         spvc_basetype MapReflectInterfaceToSpvcBasetype(const SpvReflectInterfaceVariable& variable) {
             if (variable.type_description == nullptr) {
                 return SPVC_BASETYPE_UNKNOWN;
@@ -378,9 +403,33 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return used;
         }
 
-        void ValidateTransformedSpirv(const Vector<Uint>& spirv, ShaderStage shaderStage, Uint programExternalIndex) {
+        // What a failed validation says, for a caller that wants to put it in its own message.
+        struct SpirvValidationFailure {
+            String message;
+            Int result = 0;
+            SizeT index = 0;
+        };
+
+        // Returns whether the module validates. The result used to be discarded everywhere: the
+        // call was DEBUG-or-env gated and only logged, so an invalid module produced by a backend
+        // transform went straight to vkCreateShaderModule. That is not a survivable outcome on
+        // this hardware - Mali r54 SIGSEGVs building the pipeline instead of returning an error,
+        // the same "not a validating entry point" behaviour PipelineFactory already documents for
+        // vkCreateGraphicsPipelines - so the callers that feed the driver now act on it.
+        //
+        // This function does NOT log the failure at E any more. It used to, unlatched, on the
+        // stated grounds that "reaching here already requires the validation switch to be armed,
+        // which bounds the volume" - and that premise died when the two GetOrCreateProgram call
+        // sites became unconditional: MGLOG_E is live at the production INFO level, and Log.h's
+        // own rule is that anything at W or E on a repeatable path must be latched or demoted.
+        // The failure text now travels back through `outFailure` so the LATCHED call-site
+        // messages carry the VUID instead of an unlatched inner one repeating it; what stays here
+        // is the D-level detail and the process-wide counter the test lanes assert on.
+        Bool ValidateTransformedSpirv(const Vector<Uint>& spirv, ShaderStage shaderStage, Uint programExternalIndex,
+                                      SpirvValidationFailure* outFailure = nullptr) {
+            if (outFailure != nullptr) *outFailure = {};
             if (spirv.empty()) {
-                return;
+                return true;
             }
 
             spv_const_binary_t binary = {spirv.data(), spirv.size()};
@@ -402,18 +451,24 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             spv_diagnostic diagnostic = nullptr;
             const spv_result_t result = spvValidateWithOptions(context, options, &binary, &diagnostic);
             if (result != SPV_SUCCESS) {
-                // MGLOG_E, unlatched: reaching here already requires the validation switch to
-                // be armed, which bounds the volume, and each VUID names a different defect.
-                // (Parked at MGLOG_I until the Log.h level ordering was fixed, when E was
-                // compiled out of every INFO build.) The latch is what a test harness asserts on.
+                const char* message =
+                    diagnostic != nullptr && diagnostic->error != nullptr ? diagnostic->error : "<null>";
+                const SizeT index = diagnostic != nullptr ? diagnostic->position.index : 0;
+                // The test-lane signal (ShaderCompiler.h documents harnesses snapshotting it and
+                // asserting on the delta). Bumped for every failed validation, including one a
+                // caller goes on to recover from: a transform that produced an invalid module is
+                // a real defect whether or not this run survived it.
                 MG_Util::ShaderTranspiler::ShaderCompiler::NoteSpirvValidationFailure();
-                MGLOG_E(
+                if (outFailure != nullptr) {
+                    *outFailure = {String(message), static_cast<Int>(result), index};
+                }
+                MGLOG_D(
                     "ProgramFactory::ValidateTransformedSpirv: validation failed for stage=%d program=%u result=%d index=%zu msg=%s",
                     static_cast<Int>(shaderStage),
                     programExternalIndex,
                     static_cast<Int>(result),
-                    diagnostic != nullptr ? diagnostic->position.index : 0,
-                    diagnostic != nullptr && diagnostic->error != nullptr ? diagnostic->error : "<null>");
+                    index,
+                    message);
             }
             MOBILEGL_ASSERT(
                 result == SPV_SUCCESS,
@@ -429,6 +484,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             spvDiagnosticDestroy(diagnostic);
             spvValidatorOptionsDestroy(options);
             spvContextDestroy(context);
+            return result == SPV_SUCCESS;
         }
 
         void ReflectStageInterfaceVariable(const SpvReflectInterfaceVariable& variable,
@@ -740,8 +796,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
         }
 
-        Bool ResolveDirectPositionTarget(spvtools::opt::IRContext* context, Uint32 variableId,
-                                         PositionTargetInfo* outTarget) {
+        Bool ResolveDirectBuiltInTarget(spvtools::opt::IRContext* context, Uint32 variableId,
+                                        BuiltInTypeCheckFn typeCheck, PositionTargetInfo* outTarget) {
             auto* varInst = context->get_def_use_mgr()->GetDef(variableId);
             if (!varInst || varInst->opcode() != spv::Op::OpVariable) return false;
             if (varInst->GetSingleWordInOperand(0) != static_cast<Uint32>(spv::StorageClass::Output)) return false;
@@ -753,7 +809,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             PositionTargetInfo target{};
             target.variableId = variableId;
             target.vectorTypeId = ptrTypeInst->GetSingleWordInOperand(1);
-            if (!IsVec4Float32(context, target.vectorTypeId, &target.floatTypeId)) return false;
+            if (!typeCheck(context, target.vectorTypeId, &target.floatTypeId)) return false;
             target.vectorPtrTypeId = varInst->type_id();
             target.isMember = false;
 
@@ -768,15 +824,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return context->get_type_mgr()->GetTypeInstruction(&ptrType);
         }
 
-        Bool ResolveMemberPositionTarget(spvtools::opt::IRContext* context, Uint32 structTypeId, Uint32 memberIndex,
-                                         PositionTargetInfo* outTarget) {
+        Bool ResolveMemberBuiltInTarget(spvtools::opt::IRContext* context, Uint32 structTypeId, Uint32 memberIndex,
+                                        BuiltInTypeCheckFn typeCheck, PositionTargetInfo* outTarget) {
             auto* structInst = context->get_def_use_mgr()->GetDef(structTypeId);
             if (!structInst || structInst->opcode() != spv::Op::OpTypeStruct) return false;
             if (memberIndex >= structInst->NumInOperands()) return false;
 
             const Uint32 vectorTypeId = structInst->GetSingleWordInOperand(memberIndex);
             Uint32 floatTypeId = 0;
-            if (!IsVec4Float32(context, vectorTypeId, &floatTypeId)) return false;
+            if (!typeCheck(context, vectorTypeId, &floatTypeId)) return false;
 
             const Uint32 vectorPtrTypeId = FindOutputVectorPointerTypeId(context, vectorTypeId);
             if (vectorPtrTypeId == 0) return false;
@@ -804,27 +860,130 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             return false;
         }
 
-        Bool FindPositionTarget(spvtools::opt::IRContext* context, PositionTargetInfo* outTarget) {
+        // The OUTPUT variable (or gl_PerVertex member) carrying `builtIn`, if the module
+        // declares one of the expected type. Annotations are the search space deliberately:
+        // they survive the link-time sanitize chain's interface delisting, which is the whole
+        // reason EnsureEntryPointInterface exists.
+        Bool FindBuiltInTarget(spvtools::opt::IRContext* context, spv::BuiltIn builtIn,
+                               BuiltInTypeCheckFn typeCheck, PositionTargetInfo* outTarget) {
             Vector<Pair<Uint32, Uint32>> memberCandidates;
             constexpr auto kDecorationBuiltIn = static_cast<Uint32>(spv::Decoration::BuiltIn);
-            constexpr auto kBuiltInPosition = static_cast<Uint32>(spv::BuiltIn::Position);
+            const auto wantedBuiltIn = static_cast<Uint32>(builtIn);
 
             for (auto& inst : context->module()->annotations()) {
                 if (inst.opcode() == spv::Op::OpDecorate) {
                     if (inst.NumInOperands() < 3) continue;
                     if (inst.GetSingleWordInOperand(1) != kDecorationBuiltIn) continue;
-                    if (inst.GetSingleWordInOperand(2) != kBuiltInPosition) continue;
-                    if (ResolveDirectPositionTarget(context, inst.GetSingleWordInOperand(0), outTarget)) return true;
+                    if (inst.GetSingleWordInOperand(2) != wantedBuiltIn) continue;
+                    if (ResolveDirectBuiltInTarget(context, inst.GetSingleWordInOperand(0), typeCheck, outTarget)) {
+                        return true;
+                    }
                 } else if (inst.opcode() == spv::Op::OpMemberDecorate) {
                     if (inst.NumInOperands() < 4) continue;
                     if (inst.GetSingleWordInOperand(2) != kDecorationBuiltIn) continue;
-                    if (inst.GetSingleWordInOperand(3) != kBuiltInPosition) continue;
+                    if (inst.GetSingleWordInOperand(3) != wantedBuiltIn) continue;
                     memberCandidates.emplace_back(inst.GetSingleWordInOperand(0), inst.GetSingleWordInOperand(1));
                 }
             }
 
             for (const auto& [structTypeId, memberIndex] : memberCandidates) {
-                if (ResolveMemberPositionTarget(context, structTypeId, memberIndex, outTarget)) return true;
+                if (ResolveMemberBuiltInTarget(context, structTypeId, memberIndex, typeCheck, outTarget)) return true;
+            }
+            return false;
+        }
+
+        Bool FindPositionTarget(spvtools::opt::IRContext* context, PositionTargetInfo* outTarget) {
+            return FindBuiltInTarget(context, spv::BuiltIn::Position, IsVec4Float32, outTarget);
+        }
+
+        // Put `variableId` back on `entryPoint`'s interface list if it is not already there.
+        //
+        // SPIR-V requires every Input/Output global an entry point statically uses to be listed on
+        // its OpEntryPoint, and spirv-val enforces it ("Interface variable id <N> is used by entry
+        // point 'main' id <M>, but is not listed as an interface"). The link-time sanitize chain
+        // DELISTS a variable nothing referenced yet - ShaderCompiler::SanitizeAndOptimizeBinary
+        // runs CreateAggressiveDCEPass(false), which may never delete an Output, followed by
+        // CreateRemoveUnusedInterfaceVariablesPass, which rebuilds the operand list from the
+        // variables actually referenced. A TES that redeclares `out gl_PerVertex { vec4
+        // gl_Position; }` and never writes it therefore reaches the backend with the OpVariable
+        // and its BuiltIn Position decoration intact and its interface slot gone. Any pass that
+        // then injects a reference has to put the slot back, or it hands the driver a module no
+        // validator accepts - and Mali r54 answers that with a SIGSEGV inside pipeline creation
+        // rather than an error return.
+        //
+        // No SPIR-V version gate here, unlike GlFragCoordYFlipPass's identical call for its
+        // injected PRIVATE global: Input and Output belong on the interface in every version,
+        // and only 1.4 widened it to the other storage classes.
+        Bool EnsureEntryPointInterface(spvtools::opt::IRContext* context, spvtools::opt::Instruction& entryPoint,
+                                       Uint32 variableId) {
+            // In-operands: 0 = execution model, 1 = entry function id, 2 = name, 3.. = interface.
+            constexpr Uint32 kFirstInterfaceOperand = 3;
+            if (variableId == 0) return false;
+            for (Uint32 operand = kFirstInterfaceOperand; operand < entryPoint.NumInOperands(); ++operand) {
+                if (entryPoint.GetSingleWordInOperand(operand) == variableId) return false;
+            }
+            entryPoint.AddOperand({SPV_OPERAND_TYPE_ID, {variableId}});
+            context->AnalyzeUses(&entryPoint);
+            return true;
+        }
+
+        // Is `pointerId` the position target itself, or an access chain rooted at it?
+        Bool PointerReachesPositionTarget(spvtools::opt::IRContext* context, Uint32 pointerId,
+                                          const PositionTargetInfo& target) {
+            auto* defUse = context->get_def_use_mgr();
+            for (Uint32 current = pointerId; current != 0;) {
+                if (current == target.variableId) return true;
+                const auto* inst = defUse->GetDef(current);
+                if (inst == nullptr) return false;
+                switch (inst->opcode()) {
+                case spv::Op::OpAccessChain:
+                case spv::Op::OpInBoundsAccessChain:
+                case spv::Op::OpPtrAccessChain:
+                case spv::Op::OpInBoundsPtrAccessChain:
+                case spv::Op::OpCopyObject:
+                    current = inst->GetSingleWordInOperand(0);
+                    break;
+                default:
+                    return false;
+                }
+            }
+            return false;
+        }
+
+        // Does anything in the module write the position target?
+        //
+        // Deliberately conservative - it answers "assume yes" for every shape it cannot read
+        // exactly, because a false "no" would silently drop the clip-space fixup from a shader
+        // that does write gl_Position, while a false "yes" only reinstates the behaviour this
+        // pass has always had. Scans every function rather than just the entry point's: a shader
+        // that assigns gl_Position inside a helper is still a shader that writes it, and passing
+        // the pointer to a call is a write as far as this can tell.
+        Bool ModuleWritesPositionTarget(spvtools::opt::IRContext* context, const PositionTargetInfo& target) {
+            for (auto& function : *context->module()) {
+                for (auto& block : function) {
+                    for (const auto& inst : block) {
+                        switch (inst.opcode()) {
+                        case spv::Op::OpStore:
+                        case spv::Op::OpCopyMemory:
+                        case spv::Op::OpCopyMemorySized:
+                            if (PointerReachesPositionTarget(context, inst.GetSingleWordInOperand(0), target)) {
+                                return true;
+                            }
+                            break;
+                        case spv::Op::OpFunctionCall:
+                            // In-operand 0 is the callee; the rest are arguments.
+                            for (Uint32 argument = 1; argument < inst.NumInOperands(); ++argument) {
+                                if (PointerReachesPositionTarget(context, inst.GetSingleWordInOperand(argument),
+                                                                 target)) {
+                                    return true;
+                                }
+                            }
+                            break;
+                        default:
+                            break;
+                        }
+                    }
+                }
             }
             return false;
         }
@@ -911,6 +1070,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 PositionTargetInfo target{};
                 if (!FindPositionTarget(context(), &target)) return Status::SuccessWithoutChange;
 
+                // Nothing to remap in a Position the shader never writes. Declining is not just
+                // an optimisation: the fixup is load-modify-store, so on an unwritten Position it
+                // converts "undefined, never written" into "written with whatever the load
+                // returned", and the store is a reference to a variable the link-time sanitize
+                // chain has already delisted from the entry-point interface. glslang emits the
+                // OpVariable for every DECLARED interface block, so a redeclared-but-unwritten
+                // `out gl_PerVertex` is a shape real shaders have.
+                if (!ModuleWritesPositionTarget(context(), target)) {
+                    MGLOG_D("gl-to-vulkan-position-fix: the shader never writes gl_Position; leaving it alone");
+                    return Status::SuccessWithoutChange;
+                }
+
                 auto* floatType = context()->get_type_mgr()->GetType(target.floatTypeId);
                 if (!floatType) return Status::SuccessWithoutChange;
 
@@ -942,6 +1113,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     auto* function = context()->GetFunction(entryPoint.GetSingleWordInOperand(1));
                     if (!function) continue;
 
+                    Bool modifiedThisEntryPoint = false;
                     for (auto& bb : *function) {
                         for (auto instIter = bb.begin(); instIter != bb.end(); ++instIter) {
                             auto* inst = &*instIter;
@@ -950,10 +1122,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                 (model != spv::ExecutionModel::Geometry && inst->opcode() == spv::Op::OpReturn);
                             if (!needsFixup) continue;
 
-                            modified |= InsertPositionFixup(context(), inst, target, halfConstId, doYFlip, doZRemap,
-                                                             doSurfaceRotate90, doSurfaceRotate180, doSurfaceRotate270);
+                            modifiedThisEntryPoint |=
+                                InsertPositionFixup(context(), inst, target, halfConstId, doYFlip, doZRemap,
+                                                    doSurfaceRotate90, doSurfaceRotate180, doSurfaceRotate270);
                         }
                     }
+                    // Per entry point, and only for one this pass actually injected into: the
+                    // injected load/store is a static use of the position variable, so the
+                    // variable has to be on THIS entry point's interface list.
+                    if (modifiedThisEntryPoint) {
+                        EnsureEntryPointInterface(context(), entryPoint, target.variableId);
+                    }
+                    modified |= modifiedThisEntryPoint;
                 }
 
                 if (!modified) return Status::SuccessWithoutChange;
@@ -1232,6 +1412,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 Bool needsPositionMirror = false;
                 Uint32 positionBufferIndex = 0;
                 Uint32 positionOffset = 0;
+                // gl_PointSize is a gl_PerVertex MEMBER, never a variable of its own, so the
+                // debug-name lookup below can never resolve it - it used to fall through to
+                // "no SPIR-V variable named 'gl_PointSize'" and leave the frontend's reserved
+                // slot unwritten, or, when it was the only capture, leave the module with no
+                // Xfb execution mode at all and the whole span declined.
+                Bool needsPointSizeMirror = false;
+                Uint32 pointSizeBufferIndex = 0;
+                Uint32 pointSizeOffset = 0;
                 for (const auto& varying : m_varyings) {
                     if (varying.name == "gl_Position") {
                         needsPositionMirror = true;
@@ -1239,6 +1427,28 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         positionOffset = varying.offsetBytes;
                         continue;
                     }
+                    if (varying.name == "gl_PointSize") {
+                        // A demoted module (ShaderCompiler::
+                        // DemoteTessellationGeometryPointSizeForProgram) no longer ACCESSES the
+                        // built-in member - the value lives in the carrier variable the demotion
+                        // named - so the capture binds to the carrier directly. The mirror below
+                        // must not run for it: reading the now-unwritten member would capture
+                        // garbage, and the read itself is the capability access the demotion
+                        // exists to remove. Detected off the module's own debug names, so a
+                        // composite built from another program's stage answers for the module it
+                        // actually contains.
+                        const auto carrierIt = idsByName.find(
+                            MG_Util::ShaderTranspiler::ShaderCompiler::POINT_SIZE_CAPTURE_CARRIER_NAME);
+                        if (carrierIt != idsByName.end()) {
+                            decorateForXfb(carrierIt->second, varying.bufferIndex, varying.offsetBytes);
+                            modified = true;
+                            continue;
+                        }
+                        needsPointSizeMirror = true;
+                        pointSizeBufferIndex = varying.bufferIndex;
+                        pointSizeOffset = varying.offsetBytes;
+                        continue;
+                    }
                     if (varying.blockMemberIndex >= 0) {
                         // glslang names the block's instance variable and its struct type
                         // separately; an anonymous instance leaves only the type named, so
@@ -1303,8 +1513,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 }
 
                 if (needsPositionMirror) {
-                    modified |= MirrorPositionForCapture(entryFunctionId, *entryPoint, positionBufferIndex,
-                                                         positionOffset, decorateForXfb);
+                    modified |= MirrorPerVertexBuiltInForCapture(entryFunctionId, *entryPoint,
+                                                                 spv::BuiltIn::Position, IsVec4Float32,
+                                                                 "gl_Position", positionBufferIndex, positionOffset,
+                                                                 decorateForXfb);
+                }
+                if (needsPointSizeMirror) {
+                    modified |= MirrorPerVertexBuiltInForCapture(entryFunctionId, *entryPoint,
+                                                                 spv::BuiltIn::PointSize, IsFloat32Scalar,
+                                                                 "gl_PointSize", pointSizeBufferIndex,
+                                                                 pointSizeOffset, decorateForXfb);
                 }
 
                 if (!modified) return Status::SuccessWithoutChange;
@@ -1344,19 +1562,28 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 return 0;
             }
 
+            // gl_Position and gl_PointSize are captured the same way and differ only in which
+            // built-in is looked up and what type it has, so one injector serves both. Anything
+            // else in gl_PerVertex would need its own type check before it could be added here.
             template <typename DecorateFn>
-            Bool MirrorPositionForCapture(Uint32 entryFunctionId, spvtools::opt::Instruction& entryPoint,
-                                          Uint32 bufferIndex, Uint32 offsetBytes, const DecorateFn& decorateForXfb) {
+            Bool MirrorPerVertexBuiltInForCapture(Uint32 entryFunctionId, spvtools::opt::Instruction& entryPoint,
+                                                  spv::BuiltIn builtIn, BuiltInTypeCheckFn typeCheck,
+                                                  const char* glslName, Uint32 bufferIndex, Uint32 offsetBytes,
+                                                  const DecorateFn& decorateForXfb) {
                 const Uint32 entryPointModel = entryPoint.GetSingleWordInOperand(0);
                 using namespace spvtools::opt;
                 PositionTargetInfo target{};
-                if (!FindPositionTarget(context(), &target)) {
-                    MGLOG_E("XfbCaptureDecoratePass: gl_Position capture requested but no position output found");
+                if (!FindBuiltInTarget(context(), builtIn, typeCheck, &target)) {
+                    MGLOG_E("XfbCaptureDecoratePass: %s capture requested but no such output found", glslName);
                     return false;
                 }
                 if (!target.isMember) {
-                    // Standalone gl_Position variable: decorate it directly.
+                    // Standalone built-in variable: decorate it directly. It still has to be
+                    // on the interface - a transform-feedback decoration on a variable the entry
+                    // point does not list captures nothing, and the sanitize chain delists an
+                    // unwritten one (see EnsureEntryPointInterface).
                     decorateForXfb(target.variableId, bufferIndex, offsetBytes);
+                    EnsureEntryPointInterface(context(), entryPoint, target.variableId);
                     return true;
                 }
 
@@ -1410,6 +1637,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         injected = true;
                     }
                 }
+                // The mirror was listed on the entry point above, but the loop just added a READ
+                // of the SOURCE block through an access chain, and the interface rule covers
+                // reads exactly as it covers writes. A built-in capture on a shader whose
+                // block the sanitize chain delisted - a TES that redeclares `out gl_PerVertex`
+                // and never writes it, which is what the tessellation_control_to_tessellation_
+                // evaluation.gl_MaxPatchVertices_Position_PointSize bodies do - produced an
+                // invalid module here for the same reason the position fixup did.
+                if (injected) {
+                    EnsureEntryPointInterface(context(), entryPoint, target.variableId);
+                }
                 return injected;
             }
 
@@ -3233,11 +3470,21 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // `spirv` and `moduleSpirvs` for any program attached to after it linked.
         const Vector<ShaderStage> stages = program.GetLinkedShaderStages();
         auto& spirv = program.GetGeneratedSpirv();
+        if (program.PointSizeDemoted()) {
+            // THE ARMING SIGNAL, INFO on purpose and latched: the integration lane that pins
+            // MOBILEGL_POINT_SIZE_DEMOTION=1 asserts on exactly this line, because every
+            // rendering assertion above it stays green on a healthy driver whether the
+            // demotion ran or was silently disarmed. See PointSizeDemotionScenario.
+            MGLOG_I_ONCE("DirectVulkan is building programs whose tessellation/geometry gl_PointSize was "
+                         "demoted to an ordinary varying, because this device cannot host the built-in "
+                         "in those stages.");
+        }
         Vector<Vector<Uint>> moduleSpirvs(spirv.size());
         const Bool enableSpirvValidation = program.GetSpirvValidationEnabled();
-        if (enableSpirvValidation) {
-            MG_Util::ShaderTranspiler::ShaderCompiler::PrepareSpirvValidation();
-        }
+        // Unconditional now: the two ValidateTransformedSpirv calls below run in every build,
+        // not only when the switch is armed, so the validator's static tables have to be pinned
+        // against process exit in every build too.
+        MG_Util::ShaderTranspiler::ShaderCompiler::PrepareSpirvValidation();
 
         const ShaderStage fixupStage = PickClipFixupStage(stages);
 
@@ -3261,6 +3508,46 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     }
                 }
                 TransformSpirvForVulkanPositionFix(*fixupInput, moduleSpirvs[i], flags);
+                // These two passes INJECT references - a store for the clip fixup, an access
+                // chain and a load for the gl_Position capture mirror - and a reference to a
+                // variable the link-time sanitize chain delisted from the entry-point interface
+                // is invalid SPIR-V that Mali r54 turns into a SIGSEGV inside pipeline creation
+                // rather than an error return. EnsureEntryPointInterface keeps them honest; this
+                // is the backstop.
+                //
+                // The fallback UNWINDS ONE PASS AT A TIME, which matters because the two passes
+                // are not equally optional. Rewinding straight to `spv` would also throw away the
+                // XfbBuffer/XfbStride/Offset decorations, the TransformFeedback capability and the
+                // Xfb execution mode - while the renderer decides to call
+                // vkCmdBeginTransformFeedbackEXT purely from GL state and never looks at the
+                // module. That ships a pipeline whose last pre-rasterization stage has no Xfb mode
+                // into a transform-feedback span, violating
+                // VUID-vkCmdBeginTransformFeedbackEXT-None-04128 on exactly the driver class this
+                // guard exists for. So: try the post-XFB, pre-clip-fixup module first, which keeps
+                // capture working and costs only the clip-space remap.
+                //
+                // Once per program on a cache miss, and only for the single stage that carries the
+                // fixups - not per draw and not per module.
+                SpirvValidationFailure fixupFailure{};
+                if (!ValidateTransformedSpirv(moduleSpirvs[i], stages[i], program.GetExternalIndex(),
+                                              &fixupFailure)) {
+                    SpirvValidationFailure xfbFailure{};
+                    if (fixupInput != &spv &&
+                        ValidateTransformedSpirv(*fixupInput, stages[i], program.GetExternalIndex(), &xfbFailure)) {
+                        MGLOG_E_ONCE("ProgramFactory: the clip fixup produced an invalid module for program %u "
+                                     "stage %d (%s); keeping the capture-decorated one, so this program draws "
+                                     "without the clip-space remap",
+                                     program.GetExternalIndex(), static_cast<Int>(stages[i]),
+                                     fixupFailure.message.c_str());
+                        moduleSpirvs[i] = *fixupInput;
+                    } else {
+                        MGLOG_E_ONCE("ProgramFactory: the clip/XFB fixups produced an invalid module for program %u "
+                                     "stage %d (%s); keeping the untransformed one",
+                                     program.GetExternalIndex(), static_cast<Int>(stages[i]),
+                                     fixupFailure.message.c_str());
+                        moduleSpirvs[i] = spv;
+                    }
+                }
             } else {
                 moduleSpirvs[i] = spv;
             }
@@ -3469,15 +3756,63 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             auto& moduleSpv = moduleSpirvs[i];
             if (moduleSpv.empty()) continue;
 
-#if MOBILEGL_LOG_ACTIVE_LEVEL <= MOBILEGL_LOG_LEVEL_DEBUG
-            ValidateTransformedSpirv(moduleSpv, stages[i], program.GetExternalIndex());
-#else
-            // Final module the driver receives; also checked in the INFO-level CI/test
-            // lanes, where the DEBUG gate above is compiled out.
-            if (enableSpirvValidation) {
-                ValidateTransformedSpirv(moduleSpv, stages[i], program.GetExternalIndex());
+            // Last look at the exact bytes the driver receives, in EVERY build rather than only
+            // in DEBUG or with MOBILEGL_ENABLE_SPIRV_VALIDATION armed. This one only reports:
+            // by here the descriptor bindings have been remapped and the layout about to be
+            // reflected describes the remapped module, so there is no module left that is both
+            // valid and consistent with it to fall back to. The recovery lives one step earlier,
+            // at the clip/XFB fixups (see the revert there) - which is where a transform can
+            // introduce a reference to a delisted interface variable, the failure this whole
+            // guard exists for. Anything that reaches this line names itself in the log of a
+            // shipping build instead of dying anonymously inside the driver.
+            SpirvValidationFailure finalFailure{};
+            if (!ValidateTransformedSpirv(moduleSpv, stages[i], program.GetExternalIndex(), &finalFailure)) {
+                MGLOG_E_ONCE("ProgramFactory: handing vkCreateShaderModule an INVALID module for program %u stage %d - "
+                             "a backend transform after the clip/XFB fixups broke it (%s)",
+                             program.GetExternalIndex(), static_cast<Int>(stages[i]),
+                             finalFailure.message.c_str());
+            }
+
+            // Does the stage the driver will treat as the last pre-rasterization one actually
+            // carry Xfb? Asked of the FINAL bytes, so it answers for whatever the whole transform
+            // chain produced - a rewound clip/XFB backstop, a capture pass that resolved no
+            // varying and changed nothing, anything later that might strip it. The renderer picks
+            // its capture commands from GL state alone and would otherwise open a span against a
+            // pipeline that cannot feed it.
+            if (stages[i] == fixupStage && (flags & ProgramFactory::CompileOptionBit::XfbCapture) &&
+                program.GetTransformFeedbackVaryingCount() > 0 &&
+                !MG_Util::ShaderTranspiler::ShaderCompiler::ModuleDeclaresTransformFeedback(moduleSpv)) {
+                MGLOG_E_ONCE("ProgramFactory: program %u was built as a transform-feedback capture variant but its "
+                             "stage %d carries no Xfb execution mode; its capture spans will be declined rather "
+                             "than recorded against a pipeline that cannot feed them",
+                             program.GetExternalIndex(), static_cast<Int>(stages[i]));
+                entry.xfbCaptureDeclined = true;
+            }
+
+            // Does this stage need a device feature the device did not give us? Asked ONLY when
+            // the feature is off, so a device that has it - the common case - pays nothing: the
+            // whole test is short-circuited before the module is parsed.
+            //
+            // gl_PointSize is an ordinary per-vertex output in desktop GL and any
+            // vertex-processing stage may write it, but Vulkan puts the built-in behind
+            // shaderTessellationAndGeometryPointSize in the tessellation and geometry stages
+            // (VUID-RuntimeSpirv-PointSize-06439). glslang emits TessellationPointSize /
+            // GeometryPointSize from the application's own access, so this program is legal GL
+            // that this device cannot run - the same shape the DirectGLES arm reports when a
+            // driver advertises neither EXT nor OES point-size extension, and it deserves the
+            // same named message rather than a pipeline the driver may fault on.
+            if (!m_tessellationAndGeometryPointSizeEnabled &&
+                (stages[i] == ShaderStage::TessControl || stages[i] == ShaderStage::TessEval ||
+                 stages[i] == ShaderStage::Geometry) &&
+                MG_Util::ShaderTranspiler::ShaderCompiler::ModuleDeclaresTessellationOrGeometryPointSize(
+                    moduleSpv)) {
+                MGLOG_E_ONCE("ProgramFactory: program %u stage %d accesses gl_PointSize, but this device does not "
+                             "support shaderTessellationAndGeometryPointSize; its draws are refused rather than "
+                             "built into a pipeline the driver may fault on. Point size from a non-vertex stage "
+                             "is not available on this device.",
+                             program.GetExternalIndex(), static_cast<Int>(stages[i]));
+                entry.pointSizeCapabilityUnsupported = true;
             }
-#endif
 
             VkShaderModuleCreateInfo smci{VK_STRUCTURE_TYPE_SHADER_MODULE_CREATE_INFO};
             smci.codeSize = moduleSpv.size() * sizeof(Uint);
@@ -3594,18 +3929,136 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
     }
 
-    String ProgramFactory::BuildPassthroughTessControlSource(Uint32 patchVertices) {
+    Uint64 ProgramFactory::ComputePassthroughTessControlKey(Uint32 patchVertices,
+                                                            const FloatVec4& defaultOuterLevel,
+                                                            const FloatVec2& defaultInnerLevel,
+                                                            Uint32 perVertexMembers) {
+        // A plain 32-byte blob of exactly what the generator reads, hashed once. Deliberately over
+        // the RAW BITS rather than the values: two levels that compare unequal must key apart, and
+        // a NaN level - which glPatchParameterfv accepts - compares unequal to itself.
+        struct Blob {
+            Uint32 patchVertices;
+            Uint32 outerBits[4];
+            Uint32 innerBits[2];
+            Uint32 perVertexMembers;
+        } blob{};
+        blob.patchVertices = patchVertices;
+        for (Uint32 i = 0; i < 4; ++i) blob.outerBits[i] = std::bit_cast<Uint32>(defaultOuterLevel[i]);
+        for (Uint32 i = 0; i < 2; ++i) blob.innerBits[i] = std::bit_cast<Uint32>(defaultInnerLevel[i]);
+        blob.perVertexMembers = perVertexMembers;
+        return XXH64(&blob, sizeof(blob), 0);
+    }
+
+    // The member list a gl_PerVertex redeclaration must spell, derived from the mask. Order is
+    // glslang's declaration order and is load-bearing: a redeclaration whose members are the same
+    // set in a different order is a different block.
+    static String BuildPerVertexMemberDeclarations(Uint32 perVertexMembers) {
+        using Bit = ProgramFactory::PerVertexMemberBit;
+        String members;
+        if (perVertexMembers & static_cast<Uint32>(Bit::Position)) members += "    vec4 gl_Position;\n";
+        if (perVertexMembers & static_cast<Uint32>(Bit::PointSize)) members += "    float gl_PointSize;\n";
+        // Sized at one, not left unsized: an unsized built-in array in a redeclared block is
+        // implicitly sized by use, and this stage never indexes either distance array.
+        if (perVertexMembers & static_cast<Uint32>(Bit::ClipDistance)) members += "    float gl_ClipDistance[1];\n";
+        if (perVertexMembers & static_cast<Uint32>(Bit::CullDistance)) members += "    float gl_CullDistance[1];\n";
+        return members;
+    }
+
+    Uint32 ProgramFactory::ReflectPerVertexInputMembers(const Vector<Uint>& spirv) {
+        // Minimal, self-contained SPIR-V walk. SPIRV-Reflect is deliberately NOT used: for an
+        // array of interface blocks it reports built_in == -1 on the block and leaves every
+        // member's built_in at 0 (which is SpvBuiltInPosition), so a member walk through it reads
+        // "Position, Position, Position" - the same trap ReflectPassthroughTessControlNeed
+        // documents. The decorations below are unambiguous.
+        constexpr SizeT kHeaderWords = 5;
+        constexpr Uint32 kOpName = 5;
+        constexpr Uint32 kOpDecorate = 71;
+        constexpr Uint32 kOpMemberDecorate = 72;
+        constexpr Uint32 kOpTypeArray = 28;
+        constexpr Uint32 kOpTypePointer = 32;
+        constexpr Uint32 kOpVariable = 59;
+        constexpr Uint32 kDecorationBlock = 2;
+        constexpr Uint32 kDecorationBuiltIn = 11;
+        constexpr Uint32 kStorageClassInput = 1;
+        constexpr Uint32 kBuiltInPosition = 0;
+        constexpr Uint32 kBuiltInPointSize = 1;
+        constexpr Uint32 kBuiltInClipDistance = 3;
+        constexpr Uint32 kBuiltInCullDistance = 4;
+        (void)kOpName;
+
+        if (spirv.size() <= kHeaderWords) return 0;
+
+        UnorderedMap<Uint32, Uint32> arrayElementType;             // array id   -> element type id
+        UnorderedMap<Uint32, Pair<Uint32, Uint32>> pointerPointee; // pointer id -> (storage class, pointee)
+        UnorderedMap<Uint32, Uint32> structMembers;                // struct id  -> PerVertexMemberBit mask
+        std::set<Uint32> blockStructs;
+        Vector<Uint32> inputVariablePointerTypes;
+
+        for (SizeT i = kHeaderWords; i < spirv.size();) {
+            const Uint32 wordCount = spirv[i] >> 16;
+            const Uint32 opcode = spirv[i] & 0xFFFFu;
+            if (wordCount == 0 || i + wordCount > spirv.size()) break;
+            const Uint32* words = &spirv[i];
+            switch (opcode) {
+            case kOpTypeArray:
+                if (wordCount >= 4) arrayElementType[words[1]] = words[2];
+                break;
+            case kOpTypePointer:
+                if (wordCount >= 4) pointerPointee[words[1]] = {words[2], words[3]};
+                break;
+            case kOpVariable:
+                if (wordCount >= 4 && words[3] == kStorageClassInput) inputVariablePointerTypes.push_back(words[1]);
+                break;
+            case kOpDecorate:
+                if (wordCount >= 3 && words[2] == kDecorationBlock) blockStructs.insert(words[1]);
+                break;
+            case kOpMemberDecorate:
+                if (wordCount >= 5 && words[3] == kDecorationBuiltIn) {
+                    Uint32 bit = 0;
+                    switch (words[4]) {
+                    case kBuiltInPosition: bit = static_cast<Uint32>(PerVertexMemberBit::Position); break;
+                    case kBuiltInPointSize: bit = static_cast<Uint32>(PerVertexMemberBit::PointSize); break;
+                    case kBuiltInClipDistance: bit = static_cast<Uint32>(PerVertexMemberBit::ClipDistance); break;
+                    case kBuiltInCullDistance: bit = static_cast<Uint32>(PerVertexMemberBit::CullDistance); break;
+                    default: break;
+                    }
+                    structMembers[words[1]] |= bit;
+                }
+                break;
+            default:
+                break;
+            }
+            i += wordCount;
+        }
+
+        // The one Input variable whose type is an array of a Block-decorated struct IS gl_in;
+        // gl_TessCoord and friends are plain scalars/vectors and never match.
+        for (const Uint32 pointerType : inputVariablePointerTypes) {
+            const auto pointer = pointerPointee.find(pointerType);
+            if (pointer == pointerPointee.end()) continue;
+            const auto array = arrayElementType.find(pointer->second.second);
+            if (array == arrayElementType.end()) continue;
+            if (!blockStructs.contains(array->second)) continue;
+            const auto members = structMembers.find(array->second);
+            if (members == structMembers.end()) continue;
+            return members->second;
+        }
+        return 0;
+    }
+
+    String ProgramFactory::BuildPassthroughTessControlSource(Uint32 patchVertices,
+                                                             const FloatVec4& defaultOuterLevel,
+                                                             const FloatVec2& defaultInnerLevel,
+                                                             Uint32 perVertexMembers) {
         // The stage GL 4.6 core 11.2.2 describes when a program has an evaluation shader and no
         // control shader: "the input patch is passed through unmodified", the output patch has
         // as many vertices as the input one (PATCH_VERTICES), and the levels come from the
         // PATCH_DEFAULT_OUTER_LEVEL / PATCH_DEFAULT_INNER_LEVEL state.
         //
-        // Those two levels default to 1.0 and are baked here as literals because
-        // glPatchParameterfv - their only setter - is not implemented in this frontend (it is a
-        // stub in MG_Impl/GLImpl/Exporting/Definitions.cpp). Implementing that entry point means
-        // making the levels a parameter of this source AND of the cache key in
-        // GetOrCreatePassthroughTessControlStage; the two must move together, so they are named
-        // together here.
+        // Those two levels are baked in as literals - Vulkan has no equivalent dynamic state, so
+        // compiling them in is the only way to honour glPatchParameterfv. That makes them part of
+        // this module's identity: GetOrCreatePassthroughTessControlStage keys its cache on them,
+        // and PipelineFactory hashes them into the pipeline key. The three must move together.
         //
         // gl_out carries gl_Position and nothing else on purpose. The evaluation stage that
         // reads it was linked against the VERTEX stage directly, so its input gl_PerVertex holds
@@ -3619,60 +4072,104 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // this from having to know the domain.
         String source = "#version 450 core\n";
         source += "layout(vertices = " + std::to_string(patchVertices) + ") out;\n";
-        // gl_in and gl_out are redeclared to the exact gl_PerVertex the FRONTEND's linked programs
-        // carry - gl_Position, gl_PointSize, gl_ClipDistance[1], in that order - because Vulkan
-        // matches built-in interface blocks by their whole shape, and the two obvious spellings
-        // are both wrong:
+        // gl_in and gl_out are redeclared to the exact gl_PerVertex the NEIGHBOURING EVALUATION
+        // STAGE carries, because Vulkan matches built-in interface blocks by their whole shape,
+        // and the two obvious spellings are both wrong:
         //   * narrowing the block to gl_Position alone makes the evaluation stage read a patch of
         //     zeroes (degenerate triangles, nothing rasterized), and
-        //   * taking glslang's DEFAULT block for a standalone control stage yields FOUR members -
-        //     it appends gl_CullDistance - where a linked vertex+evaluation program has three.
-        // PassthroughTessControlTest.MatchesTheFrontendPerVertexBlock is the latch: it links a
-        // vertex+evaluation program through this same compiler and fails if the two shapes ever
-        // stop agreeing, rather than letting the mismatch show up as a black frame.
+        //   * taking glslang's DEFAULT block for a standalone control stage yields whatever THIS
+        //     source's #version implies, which is unrelated to the evaluation stage's.
         //
-        // Only gl_Position is written. gl_PointSize is declared but left alone deliberately:
-        // writing it from a tessellation stage requires the shaderTessellationAndGeometryPointSize
-        // feature, which this renderer does not enable, so a program whose evaluation stage reads
-        // gl_in[].gl_PointSize gets an undefined point size instead of the vertex stage's - a gap
-        // this trades for not making every tessellated pipeline depend on an optional feature.
-        source += "in gl_PerVertex {\n"
-                  "    vec4 gl_Position;\n"
-                  "    float gl_PointSize;\n"
-                  "    float gl_ClipDistance[1];\n"
-                  "} gl_in[gl_MaxPatchVertices];\n";
-        source += "out gl_PerVertex {\n"
-                  "    vec4 gl_Position;\n"
-                  "    float gl_PointSize;\n"
-                  "    float gl_ClipDistance[1];\n"
-                  "} gl_out[];\n";
+        // The member set is a PARAMETER rather than a constant, and that is the whole point: it
+        // was hardcoded to {gl_Position, gl_PointSize, gl_ClipDistance[1]}, which is the shape a
+        // program carries only below #version 450. glslang appends gl_CullDistance to the block
+        // from 450 upward, so every 450/460 program - and every ESSL program, which the source
+        // processor rewrites to "#version 460 core" - carried FOUR members against this stage's
+        // three and got the black-frame-no-error case described above. The mask comes from
+        // ReflectPerVertexInputMembers, read off the evaluation stage's own SPIR-V.
+        // PassthroughTessControlTest.MatchesTheFrontendPerVertexBlock is the latch, and it now
+        // links the program at both 430 and 460.
+        //
+        // Only gl_Position is written, and gl_PointSize is declared without being forwarded. That
+        // is a KNOWN GAP, not a design: GL 4.6 core 11.2.2 says the fixed-function pass-through
+        // hands the input patch to the evaluation stage unmodified, so an evaluation stage
+        // reading gl_in[].gl_PointSize should see the vertex stage's value and instead sees
+        // whatever this stage left in gl_out[] - which is nothing. A capture of it (the mirror in
+        // XfbCaptureDecoratePass) faithfully records that nothing.
+        //
+        // The reason this comment used to give - "the renderer does not enable
+        // shaderTessellationAndGeometryPointSize" - stopped being true when
+        // VulkanRenderer::CreateLogicalDeviceAndQueues started taking the feature wherever the
+        // device advertises it. Closing the gap is therefore possible now, but it is not free:
+        // the forwarding store has to be gated on that feature, because on a device without it
+        // the store is exactly the invalid usage the build-time refusal
+        // (VkProgramObject::pointSizeCapabilityUnsupported) exists to keep away from the driver -
+        // and this synthesized stage is not the application's, so refusing the program because
+        // MobileGL's own pass-through named a built-in would be the wrong trade. Nothing pins
+        // the shape either: every case in TessellationXfbCaptureScenario builds an explicit
+        // control stage, so a TES-without-TCS test has to come with the fix.
+        const String perVertexBody = BuildPerVertexMemberDeclarations(perVertexMembers);
+        source += "in gl_PerVertex {\n" + perVertexBody + "} gl_in[gl_MaxPatchVertices];\n";
+        source += "out gl_PerVertex {\n" + perVertexBody + "} gl_out[];\n";
         source += "void main() {\n";
         source += "    gl_out[gl_InvocationID].gl_Position = gl_in[gl_InvocationID].gl_Position;\n";
-        source += "    gl_TessLevelOuter[0] = 1.0;\n";
-        source += "    gl_TessLevelOuter[1] = 1.0;\n";
-        source += "    gl_TessLevelOuter[2] = 1.0;\n";
-        source += "    gl_TessLevelOuter[3] = 1.0;\n";
-        source += "    gl_TessLevelInner[0] = 1.0;\n";
-        source += "    gl_TessLevelInner[1] = 1.0;\n";
+        for (Uint32 i = 0; i < 4; ++i) {
+            source += "    gl_TessLevelOuter[" + std::to_string(i) +
+                      "] = " + MG_Util::ShaderTranspiler::TessellationLevelLiteral(defaultOuterLevel[i]) + ";\n";
+        }
+        for (Uint32 i = 0; i < 2; ++i) {
+            source += "    gl_TessLevelInner[" + std::to_string(i) +
+                      "] = " + MG_Util::ShaderTranspiler::TessellationLevelLiteral(defaultInnerLevel[i]) + ";\n";
+        }
         source += "}\n";
         return source;
     }
 
-    VkPipelineShaderStageCreateInfo ProgramFactory::GetOrCreatePassthroughTessControlStage(Uint32 patchVertices) {
+    VkPipelineShaderStageCreateInfo ProgramFactory::GetOrCreatePassthroughTessControlStage(
+        Uint32 patchVertices, const FloatVec4& defaultOuterLevel, const FloatVec2& defaultInnerLevel,
+        Uint32 perVertexMembers) {
+        // Everything compiled into the stage, folded into one key. The patch size alone stopped
+        // being enough once glPatchParameterfv could change the levels: two modules that differ
+        // only in a baked-in level are different modules, and pipelines built from either may be
+        // alive at the same time. The gl_PerVertex member set joins it for the same reason - two
+        // programs at different GLSL versions need differently-shaped blocks.
+        const Uint64 key =
+            ComputePassthroughTessControlKey(patchVertices, defaultOuterLevel, defaultInnerLevel, perVertexMembers);
         // A cached VK_NULL_HANDLE is a remembered failure, not a miss: returning it keeps a
         // generator that cannot compile from re-running glslang on every draw.
-        const auto cached = m_passthroughTessControlStages.find(patchVertices);
+        const auto cached = m_passthroughTessControlStages.find(key);
         if (cached != m_passthroughTessControlStages.end()) {
             return cached->second;
         }
 
+        // The key stopped being bounded when the levels joined it: patchVertices alone could only
+        // take 32 values, but six unclamped application floats can take any number, and an
+        // application that ramps a level per frame would retain one VkShaderModule per frame for
+        // the lifetime of the device. Flushed wholesale rather than aged: a module is not
+        // referenced by the pipelines built from it (Vulkan copies what it needs at
+        // vkCreateGraphicsPipelines), everything here runs on the GL thread, and an application
+        // that can overflow this cap is already recompiling every frame - so the flush costs it
+        // nothing it was not paying anyway.
+        if (m_passthroughTessControlStages.size() >= kMaxPassthroughTessControlStages) {
+            MGLOG_D("ProgramFactory: flushing %zu pass-through tessellation control stages; the application has "
+                    "used more than %zu distinct (patch size, default level) combinations",
+                    m_passthroughTessControlStages.size(), kMaxPassthroughTessControlStages);
+            for (auto& entry : m_passthroughTessControlStages) {
+                if (entry.second.module != VK_NULL_HANDLE) {
+                    vkDestroyShaderModule(m_device, entry.second.module, nullptr);
+                }
+            }
+            m_passthroughTessControlStages.clear();
+        }
+
         VkPipelineShaderStageCreateInfo stage{VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO};
         stage.stage = VK_SHADER_STAGE_TESSELLATION_CONTROL_BIT;
         stage.module = VK_NULL_HANDLE;
         stage.pName = "main";
 
         using namespace MG_Util::ShaderTranspiler;
-        const String source = BuildPassthroughTessControlSource(patchVertices);
+        const String source =
+            BuildPassthroughTessControlSource(patchVertices, defaultOuterLevel, defaultInnerLevel, perVertexMembers);
         // Same compile configuration as every other stage of every other program: this runs on
         // the GL thread (the draw path), so the live compile env is the right one, and flags=0
         // is the Vulkan-targeting form (CompileForOpenGL is what the GLES backend adds).
@@ -3686,7 +4183,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             MGLOG_E("ProgramFactory: could not compile the pass-through tessellation control stage for "
                     "patchVertices=%u; a program with an evaluation stage and no control stage cannot draw. %s",
                     patchVertices, compiled.error().log.c_str());
-            m_passthroughTessControlStages.emplace(patchVertices, stage);
+            m_passthroughTessControlStages.emplace(key, stage);
             return stage;
         }
 
@@ -3696,7 +4193,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (!linked) {
             MGLOG_E("ProgramFactory: could not link the pass-through tessellation control stage for "
                     "patchVertices=%u. %s", patchVertices, linked.error().log.c_str());
-            m_passthroughTessControlStages.emplace(patchVertices, stage);
+            m_passthroughTessControlStages.emplace(key, stage);
             return stage;
         }
 
@@ -3705,19 +4202,33 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (!binary || binary.value().empty() || binary.value().front().empty()) {
             MGLOG_E("ProgramFactory: could not generate SPIR-V for the pass-through tessellation control stage "
                     "for patchVertices=%u", patchVertices);
-            m_passthroughTessControlStages.emplace(patchVertices, stage);
+            m_passthroughTessControlStages.emplace(key, stage);
             return stage;
         }
 
         const Vector<Uint>& spirv = binary.value().front();
+        {
+            // Still switch-gated, unlike the two in GetOrCreateProgram: this stage is synthesized
+            // by MobileGL from a fixed template rather than transformed from application SPIR-V,
+            // so a failure here is a MobileGL bug to catch in a validating lane, not something a
+            // shipping build can be handed by an application. The message is latched all the same
+            // - the pass-through cache is keyed on patchVertices, so a broken template would
+            // otherwise re-report once per distinct patch size.
+            Bool validateThisOne = false;
 #if MOBILEGL_LOG_ACTIVE_LEVEL <= MOBILEGL_LOG_LEVEL_DEBUG
-        ValidateTransformedSpirv(spirv, ShaderStage::TessControl, 0);
+            validateThisOne = true;
 #else
-        if (m_enableSpirvValidation) {
-            MG_Util::ShaderTranspiler::ShaderCompiler::PrepareSpirvValidation();
-            ValidateTransformedSpirv(spirv, ShaderStage::TessControl, 0);
-        }
+            validateThisOne = m_enableSpirvValidation;
+            if (validateThisOne) MG_Util::ShaderTranspiler::ShaderCompiler::PrepareSpirvValidation();
 #endif
+            SpirvValidationFailure passthroughFailure{};
+            if (validateThisOne &&
+                !ValidateTransformedSpirv(spirv, ShaderStage::TessControl, 0, &passthroughFailure)) {
+                MGLOG_E_ONCE("ProgramFactory: the synthesized pass-through tessellation control stage for "
+                             "patchVertices=%u does not validate (%s)",
+                             patchVertices, passthroughFailure.message.c_str());
+            }
+        }
 
         VkShaderModuleCreateInfo smci{VK_STRUCTURE_TYPE_SHADER_MODULE_CREATE_INFO};
         smci.codeSize = spirv.size() * sizeof(Uint);
@@ -3727,14 +4238,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (result != VK_SUCCESS) {
             MGLOG_E("ProgramFactory: vkCreateShaderModule failed (%d) for the pass-through tessellation control "
                     "stage for patchVertices=%u", static_cast<Int>(result), patchVertices);
-            m_passthroughTessControlStages.emplace(patchVertices, stage);
+            m_passthroughTessControlStages.emplace(key, stage);
             return stage;
         }
 
         stage.module = module;
         MGLOG_D("ProgramFactory: built the pass-through tessellation control stage for patchVertices=%u "
                 "(GL 4.6 11.2.2; Vulkan has no fixed-function equivalent)", patchVertices);
-        m_passthroughTessControlStages.emplace(patchVertices, stage);
+        m_passthroughTessControlStages.emplace(key, stage);
         return stage;
     }
 
@@ -3744,6 +4255,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         VkProgramObject& entry) const {
         entry.needsPassthroughTessControl = false;
         entry.passthroughTessControlEmulatable = false;
+        entry.passthroughPerVertexMembers = 0;
 
         Bool hasTessEval = false;
         Bool hasTessControl = false;
@@ -3763,6 +4275,17 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (tessEvalModuleIndex >= spirv.size() || spirv[tessEvalModuleIndex].empty()) return;
         const auto& module = spirv[tessEvalModuleIndex];
 
+        // The shape the synthesized control stage has to redeclare. Read here because this is the
+        // only place that holds the evaluation stage's module; a zero mask means the walk found
+        // no input per-vertex block at all, in which case the pre-450 shape is the safe stand-in
+        // (it is what every program carried before gl_CullDistance joined the block).
+        const Uint32 perVertexMembers = ReflectPerVertexInputMembers(module);
+        entry.passthroughPerVertexMembers = perVertexMembers != 0 ? perVertexMembers : kDefaultPerVertexMembers;
+        if (perVertexMembers == 0) {
+            MGLOG_W("ProgramFactory: could not read the evaluation stage's gl_PerVertex block shape; the "
+                    "pass-through control stage falls back to the pre-450 three-member form");
+        }
+
         SpvReflectShaderModule reflectModule{};
         const SpvReflectResult createResult =
             spvReflectCreateShaderModule(module.size() * sizeof(Uint), module.data(), &reflectModule);

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.h

@@ -76,6 +76,23 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         using CompileOptionFlags = Flags<CompileOptionBit>;
         using HashType = Uint64;
 
+        // The gl_PerVertex members a pass-through tessellation control stage may have to carry,
+        // in the order glslang declares them - which is the order a redeclaration must use.
+        // Which of them exist is a function of the neighbouring stage's GLSL VERSION
+        // (gl_CullDistance joins the block at #version 450), so the mask is read off that
+        // stage's SPIR-V rather than assumed. See ReflectPerVertexInputMembers.
+        enum class PerVertexMemberBit : Uint32 {
+            Position = 1u << 0,
+            PointSize = 1u << 1,
+            ClipDistance = 1u << 2,
+            CullDistance = 1u << 3,
+        };
+        // What a program parsed below #version 450 carries, and the fallback when a module's
+        // block cannot be read.
+        static constexpr Uint32 kDefaultPerVertexMembers =
+            static_cast<Uint32>(PerVertexMemberBit::Position) | static_cast<Uint32>(PerVertexMemberBit::PointSize) |
+            static_cast<Uint32>(PerVertexMemberBit::ClipDistance);
+
         struct UpdateAfterBindLimits {
             Bool enabled = false;
             Uint32 maxPerStageSamplers = 0;
@@ -185,6 +202,32 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // tessellation stages are present or neither
             // (VUID-VkGraphicsPipelineCreateInfo-pStages-00730). So the draw path has to supply
             // the pass-through stage GL describes; see GetOrCreatePassthroughTessControlStage.
+            // True when this program was built AS a transform-feedback capture variant but its
+            // last pre-rasterization module does NOT carry the Xfb execution mode - so the
+            // renderer must decline the capture span instead of issuing
+            // vkCmdBeginTransformFeedbackEXT against it
+            // (VUID-vkCmdBeginTransformFeedbackEXT-None-04128).
+            //
+            // Two ways to get here, and neither is visible from GL state, which is all
+            // BeginXfbCaptureForDraw otherwise consults: the clip/XFB validation backstop had to
+            // rewind past the capture decoration, or XfbCaptureDecoratePass resolved none of the
+            // requested varyings and returned without changing anything (its own MGLOG_E path)
+            // while its runner still reported success. Both used to ship a non-Xfb module under
+            // an Xfb-flagged cache entry - the flag and the layout are part of the program cache
+            // key, so it was sticky for every later captured draw of the program, not a glitch.
+            Bool xfbCaptureDeclined = false;
+            // The program has a tessellation or geometry module declaring TessellationPointSize /
+            // GeometryPointSize on a device whose shaderTessellationAndGeometryPointSize feature
+            // is off, so a pipeline built from it is invalid usage
+            // (VUID-RuntimeSpirv-PointSize-06439). Its draws are refused in SetupDraw rather than
+            // handed to the driver - the same contract PipelineFactory's half-tessellated refusal
+            // implements one level up, and the counterpart of the DirectGLES arm that reports a
+            // driver with neither point-size extension by name.
+            //
+            // Sticky by construction, which is what makes ONE log line honest: the flag lives on
+            // the cache entry, so every later draw of the same program variant reads the same
+            // answer instead of re-deciding it.
+            Bool pointSizeCapabilityUnsupported = false;
             Bool needsPassthroughTessControl = false;
             // ...and the pass-through this renderer can synthesize carries gl_Position and
             // nothing else, so it is only correct when the evaluation stage's inputs are
@@ -194,6 +237,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // instead (PipelineFactory::CreatePipeline refuses the pipeline and the draw is
             // skipped). See ReflectPassthroughTessControlNeed.
             Bool passthroughTessControlEmulatable = false;
+            // Which gl_PerVertex members the evaluation stage's `in gl_PerVertex gl_in[]` block
+            // actually carries, as a PerVertexMemberBit mask read off its SPIR-V. The synthesized
+            // control stage has to redeclare the SAME shape: glslang appends gl_CullDistance to
+            // that block from #version 450 upward, so a 450/460 program - and every ESSL program,
+            // which the source processor rewrites to "#version 460 core" - carries four members
+            // where a 430 program carries three. A fixed three-member pass-through fed the
+            // evaluation stage a differently-shaped block, which is the black-frame-no-error case
+            // this whole family is written around.
+            Uint32 passthroughPerVertexMembers = 0;
             // Frame-boundary counter value of the last GetOrCreateProgram hit; drives
             // cache eviction (see OnFrameBoundary). Mutable: the draw snapshot's memoised
             // entry pointer re-stamps use through a const reference (StampProgramUse).
@@ -249,6 +301,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 writesViewportIndexBuiltin = other.writesViewportIndexBuiltin;
                 needsPassthroughTessControl = other.needsPassthroughTessControl;
                 passthroughTessControlEmulatable = other.passthroughTessControlEmulatable;
+                passthroughPerVertexMembers = other.passthroughPerVertexMembers;
                 lastUsedFrame = other.lastUsedFrame;
                 other.hash = 0;
                 other.descriptorSetLayout = VK_NULL_HANDLE;
@@ -267,6 +320,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 other.writesViewportIndexBuiltin = false;
                 other.needsPassthroughTessControl = false;
                 other.passthroughTessControlEmulatable = false;
+                other.passthroughPerVertexMembers = 0;
                 other.lastUsedFrame = 0;
             }
             VkProgramObject& operator=(VkProgramObject&& other) noexcept {
@@ -311,6 +365,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 writesViewportIndexBuiltin = other.writesViewportIndexBuiltin;
                 needsPassthroughTessControl = other.needsPassthroughTessControl;
                 passthroughTessControlEmulatable = other.passthroughTessControlEmulatable;
+                passthroughPerVertexMembers = other.passthroughPerVertexMembers;
                 lastUsedFrame = other.lastUsedFrame;
                 other.hash = 0;
                 other.descriptorSetLayout = VK_NULL_HANDLE;
@@ -329,6 +384,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 other.writesViewportIndexBuiltin = false;
                 other.needsPassthroughTessControl = false;
                 other.passthroughTessControlEmulatable = false;
+                other.passthroughPerVertexMembers = 0;
                 other.lastUsedFrame = 0;
                 return *this;
             }
@@ -396,12 +452,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         explicit ProgramFactory(VkDevice device, const VulkanRendererConfig& config, Uint32 maxBindings,
                                 Bool shaderDrawParametersEnabled,
                                 Bool unformattedFloatStorageImagesEnabled,
+                                Bool tessellationAndGeometryPointSizeEnabled,
                                 Bool enableSpirvValidation,
                                 UpdateAfterBindLimits updateAfterBindLimits,
                                 SubgroupLoweringPolicy subgroupPolicy)
             : m_device(device), m_maxBindings(maxBindings), m_config(config),
               m_shaderDrawParametersEnabled(shaderDrawParametersEnabled),
               m_unformattedFloatStorageImagesEnabled(unformattedFloatStorageImagesEnabled),
+              m_tessellationAndGeometryPointSizeEnabled(tessellationAndGeometryPointSizeEnabled),
               m_enableSpirvValidation(enableSpirvValidation),
               m_updateAfterBindLimits(updateAfterBindLimits),
               m_subgroupPolicy(subgroupPolicy) {
@@ -485,18 +543,40 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // the caller then has no control stage to inject, and CreatePipeline refuses the
         // pipeline rather than handing the driver a half-tessellated one.
         //
-        // Keyed on the patch size because GL takes the output patch size from PATCH_VERTICES,
-        // which is draw state, not link state - the CTS case that motivated this links at the
-        // default 3 and draws at 4. The pipeline cache already re-keys on patchControlPoints,
-        // so the module a pipeline was built with is part of that pipeline's identity.
-        // Compiling is bounded by the number of distinct patch sizes a program draws with
-        // (MAX_PATCH_VERTICES = 32 in the worst case, one or two in practice) and only ever
-        // happens for the rare program that has no control stage at all.
-        VkPipelineShaderStageCreateInfo GetOrCreatePassthroughTessControlStage(Uint32 patchVertices);
+        // Keyed on the patch size, the six default tessellation levels AND the gl_PerVertex
+        // member set, because all three decide what the generator emits. The size comes from
+        // PATCH_VERTICES and the levels from PATCH_DEFAULT_OUTER_LEVEL / PATCH_DEFAULT_INNER_LEVEL
+        // - draw state rather than link state, and the CTS case that motivated this links at the
+        // default 3 and draws at 4. The member set comes from the neighbouring evaluation stage's
+        // own SPIR-V, so two programs at different GLSL versions need different modules. The
+        // pipeline cache re-keys on the same inputs, so the module a pipeline was built with is
+        // part of that pipeline's identity. Compiling is bounded by the number of distinct
+        // (size, levels, members) combinations a program draws with - one or two in practice -
+        // and only ever happens for the rare program that has no control stage at all.
+        VkPipelineShaderStageCreateInfo GetOrCreatePassthroughTessControlStage(Uint32 patchVertices,
+                                                                              const FloatVec4& defaultOuterLevel,
+                                                                              const FloatVec2& defaultInnerLevel,
+                                                                              Uint32 perVertexMembers);
 
         // Source of the module above. Exposed for tests: the generated GLSL is the whole
         // contract with the evaluation stage, so it is worth pinning independently of a device.
-        static String BuildPassthroughTessControlSource(Uint32 patchVertices);
+        static String BuildPassthroughTessControlSource(Uint32 patchVertices, const FloatVec4& defaultOuterLevel,
+                                                        const FloatVec2& defaultInnerLevel, Uint32 perVertexMembers);
+
+        // The identity of one such module: everything the generator bakes in, folded into a
+        // 64-bit key over the raw bits (so -0.0 and +0.0 key apart, which is harmless, and NaN
+        // keys to itself, which is what matters). Shared with PipelineFactory, which mixes the
+        // same value into the pipeline hash so a pipeline can never be handed a module built for
+        // different levels or a different block shape.
+        static Uint64 ComputePassthroughTessControlKey(Uint32 patchVertices, const FloatVec4& defaultOuterLevel,
+                                                       const FloatVec2& defaultInnerLevel, Uint32 perVertexMembers);
+
+        // The PerVertexMemberBit mask of the INPUT per-vertex block a module declares, read
+        // straight out of its SPIR-V (OpMemberDecorate ... BuiltIn on the struct behind the one
+        // Input variable that is an array of a Block-decorated struct). Zero when the module has
+        // no such block. Exposed for tests, which is the only way to pin the shape agreement
+        // without a device.
+        static Uint32 ReflectPerVertexInputMembers(const Vector<Uint>& spirv);
 
     private:
         struct ProgramLookupCache {
@@ -539,6 +619,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // True only when the logical device enabled both
         // shaderStorageImageReadWithoutFormat and shaderStorageImageWriteWithoutFormat.
         Bool m_unformattedFloatStorageImagesEnabled = false;
+        // True when the logical device enabled shaderTessellationAndGeometryPointSize. When it is
+        // FALSE a program whose tessellation or geometry module declares TessellationPointSize /
+        // GeometryPointSize is refused at build time (see VkProgramObject::
+        // pointSizeCapabilityUnsupported) instead of being handed to the driver as invalid usage.
+        Bool m_tessellationAndGeometryPointSizeEnabled = false;
         // Startup snapshot used only by internally synthesized shader modules, which do not
         // originate from a ProgramLinkTask.
         Bool m_enableSpirvValidation = false;
@@ -556,11 +641,20 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // See GetCacheStructureEpoch(). Starts at 1 so a zero-initialized memo can never match.
         Uint64 m_cacheStructureEpoch = 1;
         IEvictionObserver* m_evictionObserver = nullptr;
-        // Pass-through tessellation control stages by input patch size. Never evicted: at most
-        // MAX_PATCH_VERTICES entries exist for the lifetime of the device, and every pipeline
-        // ever built from one keeps referencing its module. A failed build is cached as
+        // Pass-through tessellation control stages by the identity of what was compiled into
+        // them - the input patch size and the six default tessellation levels, folded into one
+        // 64-bit key by ComputePassthroughTessControlKey (the levels are float state, so the map
+        // cannot simply be keyed on the patch size any more). A failed build is cached as
         // VK_NULL_HANDLE so a broken generator costs one compile, not one per draw.
-        UnorderedMap<Uint32, VkPipelineShaderStageCreateInfo> m_passthroughTessControlStages;
+        //
+        // Hard-capped, because the key is application-controlled: glPatchParameterfv clamps
+        // nothing, so an application that recomputes a level per frame mints a new key per frame.
+        // Reaching the cap destroys every module and starts over (see the flush in
+        // GetOrCreatePassthroughTessControlStage); the cap is far above what any program that
+        // holds its levels still will ever need. The gl_PerVertex member set is in the key too
+        // and adds only a handful of values, so it does not move the cap in practice.
+        static constexpr SizeT kMaxPassthroughTessControlStages = 64;
+        UnorderedMap<Uint64, VkPipelineShaderStageCreateInfo> m_passthroughTessControlStages;
         static inline XXH64_state_t* m_hashState = XXH64_createState();
     };
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.cpp

@@ -37,6 +37,24 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // glGenTextures ever hands this out, and nothing looks a placeholder up by name - so the
         // id only has to stay clear of the application's, exactly like the sampled fallback's.
         constexpr Uint kUnboundStorageImageExternalIndex = 0xFFFFFF01u;
+        // The multisample sampled fallbacks: one per (target, numeric domain), because unlike the
+        // single-sampled fallback they cannot be reinterpreted into another domain at view time
+        // (see GetFallbackMultisampleTexture). Six reserved ids, contiguous from this base for the
+        // same reason as the two above - they must not collide with anything glGenTextures can
+        // hand out.
+        constexpr Uint kFallbackMultisampleExternalIndexBase = 0xFFFFFF02u;
+        constexpr Uint kFallbackMultisampleExternalIndexCount = 6u;
+
+        // MobileGL's own stand-in textures, by the reserved ids above. Nothing an application can
+        // do reaches one, so anything keyed on the GL object an application bound - image-unit
+        // aliasing above all - has to leave them alone.
+        Bool IsPlaceholderTexture(const MG_State::GLState::ITextureObject* texture) {
+            if (texture == nullptr) return false;
+            const Uint index = static_cast<Uint>(texture->GetExternalIndex());
+            return index == kFallbackTexture2DExternalIndex || index == kUnboundStorageImageExternalIndex ||
+                   (index >= kFallbackMultisampleExternalIndexBase &&
+                    index < kFallbackMultisampleExternalIndexBase + kFallbackMultisampleExternalIndexCount);
+        }
 
         // The R32 member of each numeric class. Every one of the three is a MANDATORY-support
         // format for uniform texel buffers, storage texel buffers and storage images alike
@@ -360,6 +378,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_textureManager = nullptr;
         m_samplerManager = nullptr;
         m_fallbackTexture2D.reset();
+        m_fallbackMultisampleTextures.clear();
     }
 
     void UniformManager::BeginFrame(Uint32 frameIndex) {
@@ -496,7 +515,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             texture = nullptr;
         }
         if (texture == nullptr) {
-            fallbackHolder = GetFallbackTexture(preferredTarget);
+            // The binding's sampler class, read here rather than through the `numericDomain`
+            // local further down (it is declared after this point): the multisample placeholder
+            // has to be built in the class the shader will read it in.
+            fallbackHolder = GetFallbackTexture(preferredTarget, programObj.samplerNumericDomainByBinding[binding]);
             texture = fallbackHolder.get();
             if (texture == nullptr) {
                 MGLOG_E_ONCE("ResolveSamplerDescriptor: no fallback texture available for binding=%u ('%s') "
@@ -1367,18 +1389,30 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return outImageInfo.imageView != VK_NULL_HANDLE;
     }
 
-    SharedPtr<MG_State::GLState::ITextureObject> UniformManager::GetFallbackTexture(TextureTarget target) const {
-        // The fallback is a single-sampled 2D image, so it can only stand in for a sampler that
-        // would accept one. A multisample sampler in particular cannot: its descriptor demands a
-        // multisample view, and handing it this one is invalid Vulkan, not a degraded picture.
-        // Report that there is no fallback and let the caller decline the draw - aborting the
-        // process over an unbound sampler is never the right answer.
+    SharedPtr<MG_State::GLState::ITextureObject> UniformManager::GetFallbackTexture(
+        TextureTarget target, SamplerNumericDomain numericDomain) const {
+        // A multisample sampler cannot be served by the single-sampled 2D image below - its
+        // descriptor demands a multisample view - so it gets its own placeholder rather than no
+        // placeholder at all. Without one, ResolveSamplerDescriptor declined and
+        // BindProgramUniformBuffers dropped the WHOLE draw, which is how every
+        // sample_variables.*.samples_0 body failed: the CTS's resolve program declares both a
+        // sampler2D and a sampler2DMS and deliberately points the unused one at an empty texture
+        // unit, and at samples_0 the unused one is the sampler2DMS. GL says sampling an
+        // incomplete texture is undefined, not fatal, so the draw has to happen.
+        if (target == TextureTarget::Texture2DMultisample ||
+            target == TextureTarget::Texture2DMultisampleArray) {
+            return GetFallbackMultisampleTexture(target, numericDomain);
+        }
         if (target != TextureTarget::Texture2D && target != TextureTarget::TextureRectangle) {
             MGLOG_E_ONCE("UniformManager::GetFallbackTexture: no fallback exists for target=%d",
                     static_cast<Int>(target));
             return nullptr;
         }
 
+        // The single-sampled fallback stays domain-agnostic: it is storage-image capable, so its
+        // image carries VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT and ResolveSampledImageViewFormat can
+        // hand an integer sampler an R8G8B8A8_UINT view of these same RGBA8 texels. A multisample
+        // image can never carry that bit, which is why the arm above needs one object per domain.
         if (m_fallbackTexture2D == nullptr) {
             auto fallbackTexture = MakeShared<MG_State::GLState::TextureObject2D>(kFallbackTexture2DExternalIndex);
             fallbackTexture->SetInternalFormat(TextureInternalFormat::RGBA8);
@@ -1396,6 +1430,83 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return m_fallbackTexture2D;
     }
 
+    SharedPtr<MG_State::GLState::ITextureObject> UniformManager::GetFallbackMultisampleTexture(
+        TextureTarget target, SamplerNumericDomain numericDomain) const {
+        // ONE PLACEHOLDER PER NUMERIC DOMAIN, unlike the single-sampled fallback.
+        //
+        // A descriptor whose image format is in a different numeric class than the sampler that
+        // reads it needs a format-reinterpreting view, and building one needs
+        // VK_IMAGE_CREATE_MUTABLE_FORMAT_BIT on the image. A multisample image can never have it:
+        // SyncTextureResource computes storageImageCapable as `!isMultisampleTexture && ...`, and
+        // the only other source of the bit is the sRGB twin, which RGBA8 is not. So an RGBA8
+        // placeholder handed to a usampler2DMS made GetOrCreateSampledImageView bail with "needs
+        // mutable image format", ResolveSamplerDescriptor return false, and the draw be dropped -
+        // the exact outcome the placeholder exists to prevent, just reached later. Matching the
+        // image's own format to the sampler's class instead means no reinterpreting view is
+        // needed at all.
+        const Bool arrayed = target == TextureTarget::Texture2DMultisampleArray;
+        TextureInternalFormat internalFormat = TextureInternalFormat::RGBA8;
+        Uint32 domainSlot = 0;
+        switch (numericDomain) {
+        case SamplerNumericDomain::SignedInteger:
+            internalFormat = TextureInternalFormat::RGBA8I;
+            domainSlot = 1;
+            break;
+        case SamplerNumericDomain::UnsignedInteger:
+            internalFormat = TextureInternalFormat::RGBA8UI;
+            domainSlot = 2;
+            break;
+        case SamplerNumericDomain::Float:
+        case SamplerNumericDomain::Unknown:
+        default:
+            // Unknown reads as float, matching PlaceholderFormatForNumericDomain's own default:
+            // a shader whose sampler class could not be reflected is far likelier to be a plain
+            // sampler2DMS than an integer one, and a float view is the only one buildable without
+            // the mutable bit anyway.
+            break;
+        }
+        const Uint32 key = (arrayed ? kFallbackMultisampleExternalIndexCount / 2 : 0u) + domainSlot;
+        auto cached = m_fallbackMultisampleTextures.find(key);
+        if (cached != m_fallbackMultisampleTextures.end()) {
+            return cached->second;
+        }
+
+        const TextureUploadTarget uploadTarget = arrayed ? TextureUploadTarget::Texture2DMultisampleArray
+                                                         : TextureUploadTarget::Texture2DMultisample;
+        const Uint externalIndex = kFallbackMultisampleExternalIndexBase + key;
+        SharedPtr<MG_State::GLState::TextureObjectMipmap> texture;
+        if (arrayed) {
+            texture = MakeShared<MG_State::GLState::TextureObject2DMultisampleArray>(externalIndex);
+        } else {
+            texture = MakeShared<MG_State::GLState::TextureObject2DMultisample>(externalIndex);
+        }
+        texture->SetInternalFormat(internalFormat);
+        // TWO samples, never one. VUID-RuntimeSpirv-samples-08726 forbids an OpTypeImage with
+        // MS = 1 from reading a VK_SAMPLE_COUNT_1_BIT image, which is exactly the hazard
+        // VkTextureManager::SyncTextureResource's one-sample floor exists to avoid; a placeholder
+        // that re-created it would be worse than none.
+        texture->SetSamples(2);
+        texture->SetFixedSampleLocations(true);
+        // No upload, and MarkStorageDirty(dirty = false) to say so: a multisample image cannot be
+        // written by a transfer at all - it deliberately carries no TRANSFER_DST usage - so unlike
+        // the 2D fallback this one cannot be given (0, 0, 0, 1) content. Its texels are undefined,
+        // which is precisely what GL 4.6 core 8.17 promises for a texelFetch on a multisample
+        // texture that is not complete. The point of the placeholder is that the DRAW happens.
+        texture->AllocateStorage(uploadTarget, 0, {.texelSize = {1, 1, 1}, .byteSize = 0});
+        texture->TruncateMipmapLevels(uploadTarget, 1);
+        texture->MarkStorageDirty(uploadTarget, 0, false);
+        // Worth knowing if it ever fires: an integer multisample format can legitimately support
+        // no count above one on a device (framebufferIntegerColorSampleCounts is allowed to be
+        // VK_SAMPLE_COUNT_1_BIT), and SyncTextureResource's round-down would then hand this
+        // placeholder a single-sampled image, which is the samples-08726 shape the SetSamples(2)
+        // above exists to avoid. It already warns from there; nothing better is available - a
+        // one-sample integer image is still a draw, and declining is the outcome this whole
+        // placeholder replaced.
+        MGLOG_D("UniformManager::GetFallbackMultisampleTexture: created placeholder target=%d domain=%d format=%d",
+                static_cast<Int>(target), static_cast<Int>(numericDomain), static_cast<Int>(internalFormat));
+        return m_fallbackMultisampleTextures.emplace(key, Move(texture)).first->second;
+    }
+
     VkBufferView UniformManager::AcquireUnboundTexelBufferView(VkFormat declaredFormat,
                                                                SamplerNumericDomain numericDomain, Bool storage) {
         MOBILEGL_ASSERT(m_bufferManager != nullptr, "AcquireUnboundTexelBufferView: buffer manager is null");
@@ -1551,25 +1662,49 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         const TextureTarget preferredTarget = programObj.samplerTextureTargetByBinding[binding];
         MG_State::GLState::ITextureObject* texture =
             textureUnit.GetBindingSlot(preferredTarget).GetBoundObject().get();
+        // The sampler in effect, resolved BEFORE the completeness test below rather than after:
+        // GL's completeness rules are a property of (texture, sampler in effect), so the test
+        // cannot be asked without it.
+        const auto& samplerOverride = textureUnit.GetSamplerObject();
+        const MG_State::GLState::SamplerObject* effectiveSampler =
+            samplerOverride ? samplerOverride.get()
+                            : (texture != nullptr ? texture->GetSamplerObject().get() : nullptr);
         // Undefined default texture (name 0, no image) resolves as "unbound", exactly
         // like ResolveSamplerTextureRaw reports it.
         if (MG_State::GLState::IsUndefinedDefaultTexture(texture)) {
             texture = nullptr;
         }
+        // ...and so does a texture that fails the completeness rules for the filter in effect,
+        // because that is precisely what ResolveSamplerDescriptor does with it. The two used to
+        // disagree: this one asked only whether the default texture was UNDEFINED, so a default
+        // texture that had been given a base level but no mip chain - which is what the GL-CTS
+        // state reset between test cases leaves behind, and what any application that uploads to
+        // texture 0 has - stayed in the sampled set while the descriptor path swapped it for the
+        // fallback. SetupDraw then synced a texture no descriptor would use, the sync declined
+        // (GL calls it incomplete), and the null it returned was dereferenced one line later.
+        // Keeping the two predicates identical is the invariant; CollectSampledTextures exists to
+        // pre-sync exactly the textures the descriptors will hold.
+        if (MG_State::GLState::SamplesAsIncompleteTexture(texture, effectiveSampler)) {
+            texture = nullptr;
+        }
         if (texture == nullptr) {
             // ResolveSamplerDescriptor will substitute the fallback texture for this binding;
             // include it in the sampled set so the pre-render-pass sync/transition pass covers
             // its first use instead of leaving that work to happen inside an active pass.
-            if (preferredTarget != TextureTarget::Texture2D &&
-                preferredTarget != TextureTarget::TextureRectangle) {
+            // Ask GetFallbackTexture rather than re-listing the targets it serves: that list grew
+            // a multisample arm and the two must not drift apart.
+            texture = GetFallbackTexture(preferredTarget, programObj.samplerNumericDomainByBinding[binding]).get();
+            if (texture == nullptr) {
                 return false;
             }
-            texture = GetFallbackTexture(preferredTarget).get();
+            // The substitution changed the texture, so the "no override" arm of the effective
+            // sampler has to follow it to the fallback's own.
+            if (!samplerOverride) {
+                effectiveSampler = texture != nullptr ? texture->GetSamplerObject().get() : nullptr;
+            }
         }
-        const auto& samplerOverride = textureUnit.GetSamplerObject();
         outTexture = texture;
-        outSampler = samplerOverride ? samplerOverride.get()
-                                     : (texture != nullptr ? texture->GetSamplerObject().get() : nullptr);
+        outSampler = effectiveSampler;
         return true;
     }
 
@@ -1765,9 +1900,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 if (!ResolveSampledBinding(program, programObj, samplerBinding, samplerElement,
                                            sampledTexture, sampledSampler) ||
                     sampledTexture == nullptr || sampledSampler == nullptr ||
-                    MG_State::GLState::SamplesAsIncompleteTexture(sampledTexture, sampledSampler)) {
+                    IsPlaceholderTexture(sampledTexture)) {
                     // ResolveSamplerDescriptor uses a fallback in these cases, which cannot
-                    // alias the image-unit binding of the original texture.
+                    // alias the image-unit binding of the original texture. The unbound and
+                    // incomplete cases both arrive here AS that fallback now that
+                    // ResolveSampledBinding applies the completeness rule itself, so the test is
+                    // "is this one of ours" rather than a second completeness check.
                     continue;
                 }
                 // Multisample source images intentionally omit TRANSFER_SRC usage. Keep their existing

MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.h

@@ -179,7 +179,17 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         static MG_State::GLState::ITextureObject* ResolveSamplerTextureRaw(
             const MG_State::GLState::ProgramObject& program,
             const ProgramFactory::VkProgramObject& programObj, Uint32 binding, Uint32 element);
-        SharedPtr<MG_State::GLState::ITextureObject> GetFallbackTexture(TextureTarget target) const;
+        // `numericDomain` is the sampler's class, and it matters only for the multisample arm -
+        // see GetFallbackMultisampleTexture for why the single-sampled fallback can ignore it.
+        SharedPtr<MG_State::GLState::ITextureObject> GetFallbackTexture(
+            TextureTarget target, SamplerNumericDomain numericDomain) const;
+        // The multisample arm of GetFallbackTexture. One object per (target, numeric domain) and
+        // no upload path: a multisample image cannot be written by a transfer, so its texels stay
+        // undefined - which is what GL promises for a texelFetch on an incomplete multisample
+        // texture - and it cannot carry MUTABLE_FORMAT, so its format has to match the sampler's
+        // class outright rather than being reinterpreted at view time.
+        SharedPtr<MG_State::GLState::ITextureObject> GetFallbackMultisampleTexture(
+            TextureTarget target, SamplerNumericDomain numericDomain) const;
         // ---- placeholders for UNBOUND image-backed descriptors -------------------------
         // GL lets a program declare `samplerBuffer`, `imageBuffer` or `image2D` and bind nothing
         // to the unit it names: the fetch is then undefined (GL 4.6 core 8.9 for an incomplete
@@ -293,6 +303,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         VkTextureManager* m_textureManager = nullptr;
         VkSamplerManager* m_samplerManager = nullptr;
         mutable SharedPtr<MG_State::GLState::ITextureObject> m_fallbackTexture2D;
+        // Keyed by (arrayed, numeric domain); see GetFallbackMultisampleTexture. Lazily populated,
+        // never evicted - at most six tiny 1x1 images - and torn down with the manager.
+        mutable UnorderedMap<Uint32, SharedPtr<MG_State::GLState::ITextureObject>> m_fallbackMultisampleTextures;
         // See AcquireUnboundTexelBufferView / GetUnboundStorageImageTexture. Both are lazily
         // populated, never evicted (a program's declared formats are a fixed, tiny set) and torn
         // down with the manager. The texel views are keyed by format AND by storage-vs-sampled

MobileGL/MG_Backend/DirectVulkan/Renderer/VkClearManager.cpp

@@ -8,6 +8,10 @@
 
 #include "VkClearManager.h"
 
+// For the shared ResolveAttachmentLayerCount (and the ToVulkanLevelExtent it is built on): the
+// clear key's layer span has to be the same one the render pass builds its attachment view from.
+#include "VkTextureManager.h"
+
 #include "MG_State/GLState/Core.h"
 #include "MG_Util/Converters/MGToStr/FramebufferEnumConverter.h"
 #include "MG_Util/Converters/MGToStr/TextureEnumConverter.h"
@@ -100,13 +104,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return ResolveAttachmentBaseArrayLayer(uploadTarget);
     }
 
-    static Uint32 ResolveAttachmentLayerCount(
-        const MG_State::GLState::FramebufferAttachmentObject& attachment) {
-        if (attachment.IsLayered()) {
-            return static_cast<Uint32>(std::max(attachment.GetSize().z(), 1));
-        }
-        return 1u;
-    }
+    // ResolveAttachmentLayerCount used to be duplicated here, reading attachment.GetSize().z()
+    // raw - no ToVulkanLevelExtent remap for a 1D array, no six-faces arm for a cube map. That is
+    // not a cosmetic difference: the count below is not key-only, it is written straight into
+    // VkImageSubresourceRange::layerCount by MaterializePendingClearForTexture, which then POPS
+    // the entry - so a layered cube map's glClear reached one face and the other five were lost
+    // for good, while the very same queued clear cleared all six through the render pass's
+    // LOAD_OP_CLEAR. The helper now lives once, in VkTextureManager.h beside ToVulkanLevelExtent.
 
     static const MG_State::GLState::FramebufferAttachmentObject* GetClearableAttachment(
         const MG_State::GLState::FramebufferObject& drawFbo, FramebufferAttachmentType attachmentType) {

MobileGL/MG_Backend/DirectVulkan/Renderer/VkRenderPassManager.cpp

@@ -86,25 +86,39 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return ToStorageArrayLayer(texture, face);
     }
 
-    // The attachment's size is GL geometry, and GL_TEXTURE_1D_ARRAY keeps its layer count in the
-    // state-side HEIGHT rather than in z (see ToVulkanLevelExtent, which exists for exactly this
-    // remap). Reading z directly gave every layered 1D-array attachment layerCount = 1, so a
-    // geometry shader writing gl_Layer = 1..n had its output silently dropped and the parent's
-    // upper layers were never written at all.
-    static Uint32 ResolveAttachmentLayerCount(const MG_State::GLState::FramebufferAttachmentObject& attachment) {
-        if (attachment.IsLayered()) {
-            const auto& texture = attachment.GetTexture();
-            const TextureTarget target = texture != nullptr ? texture->GetTarget() : TextureTarget::Unknown;
-            return static_cast<Uint32>(std::max(ToVulkanLevelExtent(target, attachment.GetSize()).z(), 1));
-        }
-        return 1u;
-    }
+    // ResolveAttachmentLayerCount lives in VkTextureManager.h, beside ToVulkanLevelExtent, because
+    // VkClearManager needs the SAME answer: its pending-clear key's layerCount becomes a real
+    // VkImageSubresourceRange when a clear is materialised outside a render pass. See the header.
 
+    // VUID-VkFramebufferCreateInfo-flags-04113: every view handed to vkCreateFramebuffer must have
+    // been created as VK_IMAGE_VIEW_TYPE_2D or VK_IMAGE_VIEW_TYPE_2D_ARRAY. The image's OWN view
+    // type is not a legal answer for several of the targets GL can attach, and returning it
+    // unchanged is what took the process down on every layered 3D / cube-map-array attachment:
+    // a 3D view is refused outright by the layer-span guard in GetOrCreateAttachmentViewAtMipLevel
+    // (3D images have arrayLayers == 1) and a CUBE_ARRAY view is built happily and then rejected -
+    // or dereferenced - by the driver inside vkCreateFramebuffer.
+    //
+    // A 2D_ARRAY view is the legal spelling of all three: over a 2D-array-compatible 3D image its
+    // "layers" are the mip's z slices (VUID-VkImageViewCreateInfo-image-04970), and over a
+    // CUBE_COMPATIBLE 2D image - which is what both cube targets are - its layers are the faces.
+    //
+    // Knowingly NOT remapped: VK_IMAGE_VIEW_TYPE_1D / _1D_ARRAY, which 04113 also forbids. There is
+    // no legal alternative for them (a VK_IMAGE_TYPE_1D image admits no 2D-family view at all), so
+    // the only honest answer would be to decline the attachment - and every driver this has run on,
+    // lavapipe included, accepts them. Declining would turn working GL_TEXTURE_1D[_ARRAY] render
+    // targets into skipped draws to satisfy a VU nothing enforces. Left as-is, deliberately.
     static VkImageViewType ResolveAttachmentViewType(
         const MG_State::GLState::FramebufferAttachmentObject& attachment,
         const VkTextureManager::TextureResource& resource) {
         if (attachment.IsLayered()) {
-            return resource.viewType;
+            switch (resource.viewType) {
+            case VK_IMAGE_VIEW_TYPE_3D:
+            case VK_IMAGE_VIEW_TYPE_CUBE:
+            case VK_IMAGE_VIEW_TYPE_CUBE_ARRAY:
+                return VK_IMAGE_VIEW_TYPE_2D_ARRAY;
+            default:
+                return resource.viewType;
+            }
         }
         // A non-layered attachment names ONE layer, so the view over it is a plain 2D view whatever
         // the image's own view type is. The cube-face upload targets always meant this; a cube map
@@ -112,8 +126,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // a single layer is not a legal attachment. The CUBE arm is inert today - no frontend path
         // produces a non-layered cube attachment without a face upload target - and is kept for
         // symmetry with CUBE_ARRAY.
+        //
+        // 3D belongs in the same list and was missing from it, which is why the "per-slice
+        // attachment view is a 2D view whose array layer is the slice" branch in
+        // GetOrCreateAttachmentViewAtMipLevel was unreachable: glFramebufferTextureLayer on a
+        // GL_TEXTURE_3D asked for a 3D view (illegal as an attachment) whose span was then checked
+        // against arrayLayers == 1, so every slice above z = 0 came back VK_NULL_HANDLE.
         if (IsCubeMapFaceUploadTarget(attachment.GetTextureUploadTarget()) ||
-            resource.viewType == VK_IMAGE_VIEW_TYPE_CUBE_ARRAY || resource.viewType == VK_IMAGE_VIEW_TYPE_CUBE) {
+            resource.viewType == VK_IMAGE_VIEW_TYPE_CUBE_ARRAY || resource.viewType == VK_IMAGE_VIEW_TYPE_CUBE ||
+            resource.viewType == VK_IMAGE_VIEW_TYPE_3D) {
             return VK_IMAGE_VIEW_TYPE_2D;
         }
         return resource.viewType;
@@ -334,47 +355,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
 
         const auto internalFormat = renderbuffer->GetInternalFormat();
-        // Three-channel color formats widen to their RGBA twin exactly like textures do
-        // (VkTextureManager::ResolveTextureFormatInfo): blits/resolves between a
-        // renderbuffer and a texture of the same GL format then see one VkFormat.
-        const VkFormat format = [&]() -> VkFormat {
-            switch (internalFormat) {
-            case TextureInternalFormat::RGB:
-            case TextureInternalFormat::RGB8:
-            case TextureInternalFormat::R3G3B2:
-            case TextureInternalFormat::RGB4:
-            case TextureInternalFormat::RGB5:
-                return VK_FORMAT_R8G8B8A8_UNORM;
-            case TextureInternalFormat::SRGB8:
-                return VK_FORMAT_R8G8B8A8_SRGB;
-            case TextureInternalFormat::RGB8Snorm:
-                return VK_FORMAT_R8G8B8A8_SNORM;
-            case TextureInternalFormat::RGB10:
-            case TextureInternalFormat::RGB12:
-            case TextureInternalFormat::RGB16:
-                return VK_FORMAT_R16G16B16A16_UNORM;
-            case TextureInternalFormat::RGB16Snorm:
-                return VK_FORMAT_R16G16B16A16_SNORM;
-            case TextureInternalFormat::RGB16F:
-                return VK_FORMAT_R16G16B16A16_SFLOAT;
-            case TextureInternalFormat::RGB32F:
-                return VK_FORMAT_R32G32B32A32_SFLOAT;
-            case TextureInternalFormat::RGB8I:
-                return VK_FORMAT_R8G8B8A8_SINT;
-            case TextureInternalFormat::RGB8UI:
-                return VK_FORMAT_R8G8B8A8_UINT;
-            case TextureInternalFormat::RGB16I:
-                return VK_FORMAT_R16G16B16A16_SINT;
-            case TextureInternalFormat::RGB16UI:
-                return VK_FORMAT_R16G16B16A16_UINT;
-            case TextureInternalFormat::RGB32I:
-                return VK_FORMAT_R32G32B32A32_SINT;
-            case TextureInternalFormat::RGB32UI:
-                return VK_FORMAT_R32G32B32A32_UINT;
-            default:
-                return MG_Util::ConvertTextureInternalFormatToVkEnum(internalFormat);
-            }
-        }();
+        // ONE resolver, shared with textures (VkTextureManager::ResolveTextureFormatInfo), so a
+        // renderbuffer and a texture of the same GL format cannot disagree about their VkFormat.
+        // `expandRgbToRgba` / `componentByteCount` / `alphaBytes` describe how to reshape a SHADOW
+        // UPLOAD, and a renderbuffer has none, so only `.format` is taken.
+        //
+        // This used to be a hand-maintained second copy of that table, and it was missing exactly
+        // four rows: RGBA2 and RGBA12 fell through to ConvertTextureInternalFormatToVkEnum's
+        // VK_FORMAT_UNDEFINED (no image at all - bound as a draw buffer the attachment became
+        // VK_ATTACHMENT_UNUSED and every draw into it was dropped), while RGBA4 and RGB5A1 fell
+        // through to the 16-bit packed formats and then faced 32-bit R8G8B8A8_UNORM textures across
+        // a size-incompatible vkCmdCopyImage.
+        const VkFormat format = ResolveTextureFormatInfo(internalFormat).format;
         const VkImageAspectFlags aspect = ResolveImageAspectMaskForFormat(format);
         // Renderbuffers are never sampled (GL has no way to bind one to a sampler), so the
         // usage set is attachment + transfer: transfer covers readback (vkCmdCopyImageToBuffer),
@@ -772,7 +764,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return XXH64_digest(m_hashState);
     }
 
-    RenderPassEntry& VkRenderPassManager::GetOrCreateRenderPass(const MG_State::GLState::FramebufferObject& fbo,
+    RenderPassEntry* VkRenderPassManager::GetOrCreateRenderPass(const MG_State::GLState::FramebufferObject& fbo,
                                                                 Uint32 swapchainImageIndex,
                                                                 Bool drawUsesDepthStencil) {
         // Resolve the default-FBO depth flavor (see the header comment): keep the
@@ -858,7 +850,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             auto activeIt = m_renderPasses.find(activeRenderPass->hash);
             if (activeIt != m_renderPasses.end()) {
                 activeIt->second.lastUsedFrame = m_frameCounter;
-                return activeIt->second;
+                return &activeIt->second;
             }
         }
 
@@ -882,13 +874,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             m_rpFastRenderPassHash = activeRenderPass->hash;
             m_rpFastHadDepthStencil = activeIt->second.hasDepthStencilAttachment;
             activeIt->second.lastUsedFrame = m_frameCounter;
-            return activeIt->second;
+            return &activeIt->second;
         }
         auto hash = ComputeHash(fbo, swapchainImageIndex, true, includeDefaultFboDepthStencil);
         auto it = m_renderPasses.find(hash);
         if (it != m_renderPasses.end()) {
             it->second.lastUsedFrame = m_frameCounter;
-            return it->second;
+            return &it->second;
         }
 
         Bool isDefaultFbo = fbo.IsDefaultFramebuffer();
@@ -1011,8 +1003,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     textureResources.emplace_back(nullptr);
                     attachmentViews.emplace_back(rbAttachmentFormat != rbResource->format ? rbResource->unormTwinView
                                                                                           : rbResource->view);
-                    MOBILEGL_ASSERT(attachmentViews.back() != VK_NULL_HANDLE,
-                                    "GetOrCreateRenderPass: renderbuffer view missing at color attachment %d", i);
+                    if (attachmentViews.back() == VK_NULL_HANDLE) {
+                        MGLOG_E_ONCE("GetOrCreateRenderPass: renderbuffer %u has no usable view for color attachment "
+                                     "%u on FBO %u; declining the render pass",
+                                     renderbuffer->GetExternalIndex(), i, fbo.GetExternalIndex());
+                        return nullptr;
+                    }
 
                     colorAttachmentRefs[i].attachment = rbAttachmentIndex;
                     continue;
@@ -1100,8 +1096,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         attachmentViews.emplace_back(swapchainViews[swapchainImageIndex]);
                     } else {
                         auto* textureResource = m_textureManager.SyncTextureAndGetDescriptor(*texture);
-                        MOBILEGL_ASSERT(textureResource,
-                                        "GetOrCreateRenderPass: SyncTextureAndGetDescriptor failed at color attachment %d", i);
+                        if (textureResource == nullptr) {
+                            // SyncTextureResource legitimately declines - an unsupported format,
+                            // sample count or image-flag combination, or a vkCreateImage the driver
+                            // refused. There is no image to attach, so there is no render pass.
+                            MGLOG_E_ONCE("GetOrCreateRenderPass: textureId=%d could not be backed for color "
+                                         "attachment %u on FBO %u; declining the render pass",
+                                         texture->GetExternalIndex(), i, fbo.GetExternalIndex());
+                            return nullptr;
+                        }
                         textureResources.emplace_back(textureResource);
                         desc.format = ResolveSrgbAttachmentWriteFormat(
                             textureResource->format,
@@ -1122,8 +1125,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                         attachmentViews.emplace_back(
                             m_textureManager.GetOrCreateAttachmentViewAtMipLevel(
                                 *texture, attachmentMipLevel, baseArrayLayer, layerCount, attachmentViewType));
-                        MOBILEGL_ASSERT(attachmentViews.back() != VK_NULL_HANDLE,
-                                        "GetOrCreateRenderPass: GetOrCreateAttachmentView failed at color attachment %d", i);
+                        if (attachmentViews.back() == VK_NULL_HANDLE) {
+                            MGLOG_E_ONCE("GetOrCreateRenderPass: no attachment view for textureId=%d mip=%u layers "
+                                         "[%u, %u) viewType=%d at color attachment %u on FBO %u; declining the "
+                                         "render pass",
+                                         texture->GetExternalIndex(), attachmentMipLevel, baseArrayLayer,
+                                         baseArrayLayer + layerCount, static_cast<Int>(attachmentViewType), i,
+                                         fbo.GetExternalIndex());
+                            return nullptr;
+                        }
                     }
                     desc.samples = attachmentSampleCount;
                     adoptRenderPassSampleCount(attachmentSampleCount, "color", texture->GetExternalIndex());
@@ -1216,8 +1226,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             } else if (selectedDepthStencilAttachment->IsTexture()) {
                 auto& texture = *selectedDepthStencilAttachment->GetTexture();
                 depthTextureResource = m_textureManager.SyncTextureAndGetDescriptor(texture);
-                MOBILEGL_ASSERT(depthTextureResource,
-                                "GetOrCreateRenderPass: SyncTextureAndGetDescriptor failed at depth attachment");
+                if (depthTextureResource == nullptr) {
+                    MGLOG_E_ONCE("GetOrCreateRenderPass: textureId=%d could not be backed for the depth/stencil "
+                                 "attachment of FBO %u; declining the render pass",
+                                 texture.GetExternalIndex(), fbo.GetExternalIndex());
+                    return nullptr;
+                }
                 trackedDepthLayout = depthTextureResource->layout;
                 depthAttachmentDescription.format = depthTextureResource->format;
                 depthAttachmentSampleCount = depthTextureResource->sampleCount;
@@ -1229,8 +1243,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             } else {
                 const auto& renderbuffer = selectedDepthStencilAttachment->GetRenderbuffer();
                 depthRenderbufferResource = GetOrCreateRenderbufferResource(renderbuffer);
-                MOBILEGL_ASSERT(depthRenderbufferResource,
-                                "GetOrCreateRenderPass: GetOrCreateRenderbufferResource failed at depth attachment");
+                if (depthRenderbufferResource == nullptr) {
+                    MGLOG_E_ONCE("GetOrCreateRenderPass: renderbuffer %u could not be backed for the depth/stencil "
+                                 "attachment of FBO %u; declining the render pass",
+                                 renderbuffer->GetExternalIndex(), fbo.GetExternalIndex());
+                    return nullptr;
+                }
                 trackedDepthLayout = depthRenderbufferResource->layout;
                 depthAttachmentDescription.format = depthRenderbufferResource->format;
                 depthAttachmentSampleCount = depthRenderbufferResource->sampleCount;
@@ -1304,8 +1322,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 attachmentViews.emplace_back(
                     m_textureManager.GetOrCreateAttachmentViewAtMipLevel(
                         texture, attachmentMipLevel, baseArrayLayer, layerCount, attachmentViewType));
-                MOBILEGL_ASSERT(attachmentViews.back() != VK_NULL_HANDLE,
-                                "GetOrCreateRenderPass: GetOrCreateAttachmentView failed at depth attachment");
+                if (attachmentViews.back() == VK_NULL_HANDLE) {
+                    MGLOG_E_ONCE("GetOrCreateRenderPass: no attachment view for textureId=%d mip=%u layers [%u, %u) "
+                                 "viewType=%d at the depth/stencil attachment of FBO %u; declining the render pass",
+                                 texture.GetExternalIndex(), attachmentMipLevel, baseArrayLayer,
+                                 baseArrayLayer + layerCount, static_cast<Int>(attachmentViewType),
+                                 fbo.GetExternalIndex());
+                    return nullptr;
+                }
                 if (width == 0 || height == 0) {
                     width = attachmentExtent.x();
                     height = attachmentExtent.y();
@@ -1327,6 +1351,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 });
                 textureResources.emplace_back(nullptr);
                 attachmentViews.emplace_back(depthRenderbufferResource->view);
+                if (attachmentViews.back() == VK_NULL_HANDLE) {
+                    MGLOG_E_ONCE("GetOrCreateRenderPass: renderbuffer %u has no usable view for the depth/stencil "
+                                 "attachment of FBO %u; declining the render pass",
+                                 renderbuffer->GetExternalIndex(), fbo.GetExternalIndex());
+                    return nullptr;
+                }
                 if (width == 0 || height == 0) {
                     width = attachmentExtent.x();
                     height = attachmentExtent.y();
@@ -1424,8 +1454,25 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         renderPassCreateInfo.dependencyCount = 2;
         renderPassCreateInfo.pDependencies = subpassDependencies;
 
+        // NOT VK_VERIFY. VkIncludes.h states the rule this function now lives by: VK_VERIFY is the
+        // INVARIANT check - a should-never-happen state, fatal-logged unlatched and trapped in a
+        // DEBUG build - and "a soft, recoverable failure must therefore NOT be routed through
+        // VK_VERIFY. Check the VkResult directly and report it with MGLOG_E_ONCE". A decline here
+        // is recoverable by construction: the caller drops the draw. Routing it through VK_VERIFY
+        // would have made the recovery dead code in a DEBUG build (the TRAP fires inside the macro,
+        // before the handle is ever examined) and, in an INFO build, printed an UNLATCHED fatal
+        // line on every draw for the life of the process - a decline caches nothing, so every
+        // later draw to the same framebuffer re-enters this path and fails again.
         VkRenderPass renderPass = VK_NULL_HANDLE;
-        VK_VERIFY(vkCreateRenderPass(m_device, &renderPassCreateInfo, nullptr, &renderPass));
+        const VkResult renderPassResult =
+            vkCreateRenderPass(m_device, &renderPassCreateInfo, nullptr, &renderPass);
+        if (renderPassResult != VK_SUCCESS || renderPass == VK_NULL_HANDLE) {
+            MGLOG_E_ONCE("GetOrCreateRenderPass: vkCreateRenderPass failed (%s, %d) for FBO %u; declining the "
+                         "render pass",
+                         VkResultToString(renderPassResult), static_cast<Int>(renderPassResult),
+                         fbo.GetExternalIndex());
+            return nullptr;
+        }
 
         // Framebuffer
         VkFramebufferCreateInfo framebufferCreateInfo;
@@ -1438,8 +1485,21 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         framebufferCreateInfo.width = width;
         framebufferCreateInfo.height = height;
         framebufferCreateInfo.layers = framebufferLayers;
+        // Direct VkResult check, for the same reason as vkCreateRenderPass above.
         VkFramebuffer framebuffer = VK_NULL_HANDLE;
-        VK_VERIFY(vkCreateFramebuffer(m_device, &framebufferCreateInfo, nullptr, &framebuffer));
+        const VkResult framebufferResult =
+            vkCreateFramebuffer(m_device, &framebufferCreateInfo, nullptr, &framebuffer);
+        if (framebufferResult != VK_SUCCESS || framebuffer == VK_NULL_HANDLE) {
+            // The render pass has no entry to own it yet, so it is destroyed here rather than
+            // leaked - RenderPassEntry's destructor is the only other thing that would.
+            MGLOG_E_ONCE("GetOrCreateRenderPass: vkCreateFramebuffer failed (%s, %d) for FBO %u (%dx%d, "
+                         "%u attachments, %u layers); declining the render pass",
+                         VkResultToString(framebufferResult), static_cast<Int>(framebufferResult),
+                         fbo.GetExternalIndex(), width, height,
+                         static_cast<Uint32>(attachmentViews.size()), framebufferLayers);
+            vkDestroyRenderPass(m_device, renderPass, nullptr);
+            return nullptr;
+        }
         IntVec2 extent = {width, height};
         RenderPassEntry renderPassEntry {
             hash,
@@ -1464,7 +1524,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 extent.y());
         auto [insertedIt, _] = m_renderPasses.emplace(hash, Move(renderPassEntry));
         insertedIt->second.lastUsedFrame = m_frameCounter;
-        return insertedIt->second;
+        return &insertedIt->second;
     }
 
     void VkRenderPassManager::OnPresent() {

MobileGL/MG_Backend/DirectVulkan/Renderer/VkRenderPassManager.h

@@ -243,9 +243,24 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // draw against a depth-less active pass resolves to a new (incompatible)
         // entry, which the caller's compatibility check turns into a pass split;
         // the new pass's depth loads DONT_CARE (content was undefined all along).
-        RenderPassEntry& GetOrCreateRenderPass(const MG_State::GLState::FramebufferObject& fbo,
-                                               Uint32 swapchainImageIndex,
-                                               Bool drawUsesDepthStencil = true);
+        //
+        // Returns NULLPTR when this framebuffer cannot be represented as a Vulkan render pass at
+        // all - a texture the texture manager declined to back (an unsupported format or sample
+        // count), or an attachment view it cannot construct (a layer span the image has no room
+        // for, a 3D image whose format was refused 2D-array compatibility). This used to be
+        // unrepresentable: the function returned a reference, so the only thing the two fallible
+        // calls it builds on could do was trip a MOBILEGL_ASSERT - which is compiled out of every
+        // INFO build - and then dereference the null resource, or hand VK_NULL_HANDLE to
+        // vkCreateFramebuffer. That took the whole process down (51 lost CTS records over 21
+        // bodies, one runner restart each) where a declined draw is merely a wrong picture.
+        //
+        // EVERY caller must handle nullptr by dropping the operation, exactly as the draw path
+        // already drops a draw whose sampler descriptor could not be resolved
+        // (UniformManager::BindProgramUniformBuffers). The failure paths log MGLOG_E_ONCE
+        // themselves, so a caller needs no message of its own.
+        [[nodiscard]] RenderPassEntry* GetOrCreateRenderPass(const MG_State::GLState::FramebufferObject& fbo,
+                                                             Uint32 swapchainImageIndex,
+                                                             Bool drawUsesDepthStencil = true);
         void QueueRenderbufferClear(GLbitfield mask, const ClearFramebufferPayload& clearPayload,
                                     const MG_State::GLState::FramebufferObject& drawFbo);
         void QueueRenderbufferClear(const ClearAttachmentPayload& clearPayload,

MobileGL/MG_Backend/DirectVulkan/Renderer/VkSamplerManager.cpp

@@ -21,6 +21,156 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                    sampler.GetWrapR() == SamplerWrapMode::ClampToBorder;
         }
 
+        // The numeric domain the texture is SAMPLED in. Vulkan splits VkBorderColor into a float
+        // family and an integer family and requires the sampler's choice to match the image view's
+        // format (a float border on an integer view, or the reverse, is undefined) - so the domain
+        // comes from the TEXTURE, while the value comes from whichever GL entry point wrote it.
+        enum class BorderColorDomain {
+            Float,
+            SignedInteger,
+            UnsignedInteger
+        };
+
+        BorderColorDomain ResolveBorderColorDomain(TextureInternalFormat format) {
+            switch (format) {
+            case TextureInternalFormat::R8I:
+            case TextureInternalFormat::R16I:
+            case TextureInternalFormat::R32I:
+            case TextureInternalFormat::RG8I:
+            case TextureInternalFormat::RG16I:
+            case TextureInternalFormat::RG32I:
+            case TextureInternalFormat::RGB8I:
+            case TextureInternalFormat::RGB16I:
+            case TextureInternalFormat::RGB32I:
+            case TextureInternalFormat::RGBA8I:
+            case TextureInternalFormat::RGBA16I:
+            case TextureInternalFormat::RGBA32I:
+                return BorderColorDomain::SignedInteger;
+            case TextureInternalFormat::R8UI:
+            case TextureInternalFormat::R16UI:
+            case TextureInternalFormat::R32UI:
+            case TextureInternalFormat::RG8UI:
+            case TextureInternalFormat::RG16UI:
+            case TextureInternalFormat::RG32UI:
+            case TextureInternalFormat::RGB8UI:
+            case TextureInternalFormat::RGB16UI:
+            case TextureInternalFormat::RGB32UI:
+            case TextureInternalFormat::RGBA8UI:
+            case TextureInternalFormat::RGBA16UI:
+            case TextureInternalFormat::RGBA32UI:
+            case TextureInternalFormat::RGB10A2UI:
+                return BorderColorDomain::UnsignedInteger;
+            default:
+                return BorderColorDomain::Float;
+            }
+        }
+
+        Bool IsSignedNormalizedFormat(TextureInternalFormat format) {
+            switch (format) {
+            case TextureInternalFormat::R8Snorm:
+            case TextureInternalFormat::R16Snorm:
+            case TextureInternalFormat::RG8Snorm:
+            case TextureInternalFormat::RG16Snorm:
+            case TextureInternalFormat::RGB8Snorm:
+            case TextureInternalFormat::RGB16Snorm:
+            case TextureInternalFormat::RGBA8Snorm:
+            case TextureInternalFormat::RGBA16Snorm:
+                return true;
+            default:
+                return false;
+            }
+        }
+
+        // GL 4.6 core 8.14.2: "The border values are clamped before they are used, according to the
+        // format in which texture components are stored. For signed and unsigned normalized
+        // fixed-point formats, border values are clamped to [-1,1] and [0,1] respectively. For
+        // floating-point and integer formats, border values are clamped to the representable range of
+        // the format." Every clause of that sentence is a real case here - the clamp is not just the
+        // normalized one.
+        //
+        // Only the 32-bit float formats are genuinely unclamped: every finite float is representable
+        // in them. Half-float has a finite maximum, and the two packed "float" formats are UNSIGNED,
+        // so a negative border on them must come back as 0 rather than as a negative number the
+        // driver delivers verbatim through VK_BORDER_COLOR_FLOAT_CUSTOM_EXT.
+        struct FloatBorderRange {
+            Bool clamped = true;
+            Float minValue = 0.0f;
+            Float maxValue = 1.0f;
+        };
+
+        FloatBorderRange ResolveFloatBorderRange(TextureInternalFormat format, Bool isSignedNormalized) {
+            switch (format) {
+            case TextureInternalFormat::R32F:
+            case TextureInternalFormat::RG32F:
+            case TextureInternalFormat::RGB32F:
+            case TextureInternalFormat::RGBA32F:
+                return {false, 0.0f, 0.0f};
+            case TextureInternalFormat::R16F:
+            case TextureInternalFormat::RG16F:
+            case TextureInternalFormat::RGB16F:
+            case TextureInternalFormat::RGBA16F:
+                return {true, -65504.0f, 65504.0f};
+            // Unsigned packed floats: no sign bit at all. 65024 is the largest 11-bit float; the
+            // 10-bit blue channel tops out lower (64512) and RGB9E5 higher (65408), but the bound
+            // that matters for correctness is the lower one, and a single conservative upper bound
+            // costs nothing a real border colour will ever notice.
+            case TextureInternalFormat::R11FG11FB10F:
+                return {true, 0.0f, 64512.0f};
+            case TextureInternalFormat::RGB9E5:
+                return {true, 0.0f, 65408.0f};
+            default:
+                return {true, isSignedNormalized ? -1.0f : 0.0f, 1.0f};
+            }
+        }
+
+        // Per-component representable range of an integer texture format, as Int64 so that the whole
+        // signed and unsigned 32-bit ranges are expressible in one type and the clamp can be written
+        // once for both domains. Alpha is carried separately because RGB10_A2UI is the one format
+        // whose alpha is narrower than its colour channels.
+        struct IntegerBorderRange {
+            Int64 rgbMin = 0;
+            Int64 rgbMax = 0;
+            Int64 alphaMin = 0;
+            Int64 alphaMax = 0;
+        };
+
+        IntegerBorderRange ResolveIntegerBorderRange(TextureInternalFormat format) {
+            const auto uniform = [](Int64 low, Int64 high) { return IntegerBorderRange{low, high, low, high}; };
+            switch (format) {
+            case TextureInternalFormat::R8I:
+            case TextureInternalFormat::RG8I:
+            case TextureInternalFormat::RGB8I:
+            case TextureInternalFormat::RGBA8I:
+                return uniform(-128, 127);
+            case TextureInternalFormat::R16I:
+            case TextureInternalFormat::RG16I:
+            case TextureInternalFormat::RGB16I:
+            case TextureInternalFormat::RGBA16I:
+                return uniform(-32768, 32767);
+            case TextureInternalFormat::R8UI:
+            case TextureInternalFormat::RG8UI:
+            case TextureInternalFormat::RGB8UI:
+            case TextureInternalFormat::RGBA8UI:
+                return uniform(0, 255);
+            case TextureInternalFormat::R16UI:
+            case TextureInternalFormat::RG16UI:
+            case TextureInternalFormat::RGB16UI:
+            case TextureInternalFormat::RGBA16UI:
+                return uniform(0, 65535);
+            case TextureInternalFormat::R32UI:
+            case TextureInternalFormat::RG32UI:
+            case TextureInternalFormat::RGB32UI:
+            case TextureInternalFormat::RGBA32UI:
+                return uniform(0, 4294967295LL);
+            case TextureInternalFormat::RGB10A2UI:
+                return {0, 1023, 0, 3};
+            default:
+                // The signed 32-bit formats, and anything unexpected: the full int32 range, i.e. a
+                // clamp that cannot alter a value the GL entry points could have carried.
+                return uniform(-2147483648LL, 2147483647LL);
+            }
+        }
+
         Bool IsDepthTextureFormat(TextureInternalFormat format) {
             switch (format) {
             case TextureInternalFormat::DepthComponent:
@@ -72,6 +222,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_config = initInfo.config;
         m_samplerAnisotropySupported = initInfo.samplerAnisotropySupported;
         m_maxSamplerAnisotropy = std::max(initInfo.maxSamplerAnisotropy, 1.0f);
+        m_customBorderColorSupported = initInfo.customBorderColorSupported;
+        m_maxCustomBorderColorSamplers = initInfo.maxCustomBorderColorSamplers;
+        m_customBorderColorSamplerCount = 0;
         MOBILEGL_ASSERT(m_device != VK_NULL_HANDLE && m_config != nullptr,
                         "VkSamplerManager::Initialize failed: invalid initialization info");
         return true;
@@ -102,6 +255,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         m_device = VK_NULL_HANDLE;
         m_config = nullptr;
         m_frameBoundaryCounter = 0;
+        m_customBorderColorSupported = false;
+        m_maxCustomBorderColorSamplers = 0;
+        m_customBorderColorSamplerCount = 0;
     }
 
     void VkSamplerManager::OnFrameBoundary() {
@@ -123,6 +279,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 if (m_device != VK_NULL_HANDLE && entry.handle != VK_NULL_HANDLE) {
                     vkDestroySampler(m_device, entry.handle, nullptr);
                 }
+                if (entry.usesCustomBorderColor && m_customBorderColorSamplerCount > 0) {
+                    --m_customBorderColorSamplerCount;
+                }
                 it = m_samplers.erase(it);
             } else {
                 ++it;
@@ -131,8 +290,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     }
 
     Uint64 VkSamplerManager::BuildSamplerKey(const MG_State::GLState::SamplerObject& sampler,
-                                             const MG_State::GLState::ITextureObject& texture,
-                                             Bool forceNearestFiltering, Bool singleLevelView) const {
+                                             Bool forceNearestFiltering, Bool singleLevelView,
+                                             const ResolvedBorderColor& borderColor) const {
         MOBILEGL_ASSERT(m_config != nullptr, "VkSamplerManager::BuildSamplerKey: m_config is null");
         XXHASH_VERIFY(XXH64_reset(m_hashState, m_config->CacheVersion));
 
@@ -166,8 +325,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         XXHASH_VERIFY(XXH64_update(m_hashState, &compareMode, sizeof(compareMode)));
         const auto compareFunc = sampler.GetSamplerCompareFunc();
         XXHASH_VERIFY(XXH64_update(m_hashState, &compareFunc, sizeof(compareFunc)));
-        const auto borderColor = ResolveVkBorderColor(sampler, texture);
-        XXHASH_VERIFY(XXH64_update(m_hashState, &borderColor, sizeof(borderColor)));
+        // The resolved enum AND, when it is one of the *_CUSTOM_EXT values, the sixteen bytes of the
+        // colour itself: two samplers that differ only in a custom border colour carry the same enum
+        // and would otherwise collide onto whichever one was created first.
+        XXHASH_VERIFY(XXH64_update(m_hashState, &borderColor.color, sizeof(borderColor.color)));
+        if (borderColor.isCustom) {
+            XXHASH_VERIFY(XXH64_update(m_hashState, &borderColor.customValue, sizeof(borderColor.customValue)));
+        }
         return XXH64_digest(m_hashState);
     }
 
@@ -183,7 +347,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // allocation for a genuinely single-level image) and faults the GPU - the same failure
         // the default-framebuffer blit shader had to work around with an explicit-LOD sample.
         const Bool singleLevelView = viewLevelCount == 1;
-        const Uint64 key = BuildSamplerKey(sampler, texture, forceNearestFiltering, singleLevelView);
+        // Resolved once and used for both the key and the create-info; see ResolvedBorderColor.
+        const ResolvedBorderColor borderColor = ResolveBorderColor(sampler, texture);
+        const Uint64 key = BuildSamplerKey(sampler, forceNearestFiltering, singleLevelView, borderColor);
         auto it = m_samplers.find(key);
         if (it != m_samplers.end()) {
             it->second.lastUsedFrameBoundary = m_frameBoundaryCounter;
@@ -211,9 +377,21 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // Must match BuildSamplerKey's resolution exactly.
         samplerInfo.maxLod = ResolveSingleLevelMaxLod(sampler, singleLevelView);
         samplerInfo.minLod = ResolveEffectiveMinLod(sampler, samplerInfo.maxLod);
-        samplerInfo.borderColor = ResolveVkBorderColor(sampler, texture);
+        samplerInfo.borderColor = borderColor.color;
         samplerInfo.unnormalizedCoordinates = VK_FALSE;
 
+        // VK_EXT_custom_border_color. `format` stays UNDEFINED, which is legal only because
+        // customBorderColorWithoutFormat was required alongside customBorderColors at device
+        // creation - a GL sampler object has no idea which texture it will be paired with.
+        VkSamplerCustomBorderColorCreateInfoEXT customBorderColorInfo{};
+        if (borderColor.isCustom) {
+            customBorderColorInfo.sType = VK_STRUCTURE_TYPE_SAMPLER_CUSTOM_BORDER_COLOR_CREATE_INFO_EXT;
+            customBorderColorInfo.customBorderColor = borderColor.customValue;
+            customBorderColorInfo.format = VK_FORMAT_UNDEFINED;
+            customBorderColorInfo.pNext = samplerInfo.pNext;
+            samplerInfo.pNext = &customBorderColorInfo;
+        }
+
         VkSampler vkSampler = VK_NULL_HANDLE;
         VK_VERIFY(vkCreateSampler(m_device, &samplerInfo, nullptr, &vkSampler), "vkCreateSampler(texture)");
 
@@ -222,6 +400,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         entry.externalIndex = sampler.GetExternalIndex();
         entry.version = sampler.GetVersion();
         entry.lastUsedFrameBoundary = m_frameBoundaryCounter;
+        entry.usesCustomBorderColor = borderColor.isCustom;
+        if (entry.usesCustomBorderColor) {
+            ++m_customBorderColorSamplerCount;
+        }
         m_samplers[key] = entry;
         return vkSampler;
     }
@@ -281,39 +463,148 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
     }
 
-    VkBorderColor VkSamplerManager::ResolveVkBorderColor(const MG_State::GLState::SamplerObject& sampler,
-                                                         const MG_State::GLState::ITextureObject& texture) {
+    VkSamplerManager::ResolvedBorderColor VkSamplerManager::ResolveBorderColor(
+        const MG_State::GLState::SamplerObject& sampler, const MG_State::GLState::ITextureObject& texture) const {
+        ResolvedBorderColor resolved{};
         if (!UsesBorderColor(sampler)) {
-            return VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK;
+            return resolved; // FLOAT_TRANSPARENT_BLACK, never sampled
         }
 
         // Border colour is sampler state: a bound sampler object supplies its own, and a texture
         // with none reaches the very same value through the sampler object it owns.
-        const auto& borderColor = sampler.GetBorderColor();
-        const Bool isDepthTexture = IsDepthTextureFormat(texture.GetFormat());
+        const auto format = texture.GetFormat();
+        const auto domain = ResolveBorderColorDomain(format);
+        const Bool canUseCustom = m_customBorderColorSupported && m_maxCustomBorderColorSamplers > 0 &&
+                                  m_customBorderColorSamplerCount < m_maxCustomBorderColorSamplers;
 
-        if (isDepthTexture) {
+        if (domain != BorderColorDomain::Float) {
+            // An integer image view REQUIRES an integer border colour, whatever the value is - even
+            // (0,0,0,1). The value itself is whichever integer form the application wrote; a float
+            // border on an integer texture is nonsense GL leaves undefined, so the derived integer
+            // representation (a plain cast) is as good an answer as any.
+            //
+            // Clamped to the format's representable range FIRST, per GL 4.6 core 8.14.2, and read
+            // through Int64 so the whole signed and unsigned 32-bit ranges are expressible at once.
+            //
+            // Which representation to start from is the TEXTURE's domain, not the entry-point form
+            // the application used. GL 4.6 core 8.10 stores an "I"-form border colour unmodified with
+            // an integer internal data type and does not define a sign conversion between the two
+            // integer forms, so the stored bits are reinterpreted in the sampled format's own
+            // signedness. Measured, not assumed: a border of -1 written with glTexParameterIiv
+            // against a GL_R8UI texture samples as 255 on the ES driver, i.e. as 0xFFFFFFFF clamped
+            // to the format's maximum - see the IntegerBorderColorScenario case that pins it. Picking
+            // the representation by the FORM instead would answer 0 here, which is a defensible
+            // reading of the same spec text but puts DirectVulkan at odds with DirectGLES - and
+            // DirectGLES cannot deviate, it forwards the value to the driver verbatim. Cross-backend
+            // agreement decides it.
+            const auto range = ResolveIntegerBorderRange(format);
+            const auto& borderColorI = sampler.GetBorderColorI();
+            const auto& borderColorUI = sampler.GetBorderColorUI();
+            const Bool startFromUnsigned = domain == BorderColorDomain::UnsignedInteger;
+            Int64 clamped[4];
+            for (SizeT channel = 0; channel < 4; ++channel) {
+                const Int64 raw = startFromUnsigned ? static_cast<Int64>(borderColorUI[channel])
+                                                    : static_cast<Int64>(borderColorI[channel]);
+                const Int64 low = channel == 3 ? range.alphaMin : range.rgbMin;
+                const Int64 high = channel == 3 ? range.alphaMax : range.rgbMax;
+                clamped[channel] = std::clamp(raw, low, high);
+            }
+
+            // Matched against the CLAMPED value, so a border the format cannot hold still lands on
+            // the palette entry it clamps to rather than missing every one of them.
+            const Bool allZeroRgb = clamped[0] == 0 && clamped[1] == 0 && clamped[2] == 0;
+            if (allZeroRgb && clamped[3] == 0) {
+                resolved.color = VK_BORDER_COLOR_INT_TRANSPARENT_BLACK;
+                return resolved;
+            }
+            if (allZeroRgb && clamped[3] == 1) {
+                resolved.color = VK_BORDER_COLOR_INT_OPAQUE_BLACK;
+                return resolved;
+            }
+            if (clamped[0] == 1 && clamped[1] == 1 && clamped[2] == 1 && clamped[3] == 1) {
+                resolved.color = VK_BORDER_COLOR_INT_OPAQUE_WHITE;
+                return resolved;
+            }
+            if (canUseCustom) {
+                resolved.color = VK_BORDER_COLOR_INT_CUSTOM_EXT;
+                resolved.isCustom = true;
+                for (SizeT channel = 0; channel < 4; ++channel) {
+                    if (domain == BorderColorDomain::UnsignedInteger) {
+                        resolved.customValue.uint32[channel] = static_cast<Uint32>(clamped[channel]);
+                    } else {
+                        resolved.customValue.int32[channel] = static_cast<Int32>(clamped[channel]);
+                    }
+                }
+                return resolved;
+            }
+            // No custom colour available: pick the nearest of the three integer palette entries
+            // rather than always answering transparent black, which is what turned an integer border
+            // of (-1,-1,-1,-1) into 0 and broke the CTS's clamped-texel detection outright.
+            const Bool opaque = clamped[3] != 0;
+            const Bool bright = clamped[0] != 0 || clamped[1] != 0 || clamped[2] != 0;
+            resolved.color = !opaque ? VK_BORDER_COLOR_INT_TRANSPARENT_BLACK
+                                     : (bright ? VK_BORDER_COLOR_INT_OPAQUE_WHITE : VK_BORDER_COLOR_INT_OPAQUE_BLACK);
+            return resolved;
+        }
+
+        // Float domain. GL 4.6 core 8.14.2/8.23: the border colour is interpreted in the texture's
+        // format, so it is clamped to that format's representable range first. Without the clamp the
+        // CTS's border of (255,255,255,255) on a GL_RGBA8 texture matched none of the palette entries
+        // and fell through to transparent black - every border texel sampled 0 where the test wanted
+        // 255. The range is per format class, not just the normalized [0,1] / [-1,1] pair: only the
+        // 32-bit float formats are unclamped.
+        FloatVec4 borderColor = sampler.GetBorderColor();
+        if (const auto range = ResolveFloatBorderRange(format, IsSignedNormalizedFormat(format)); range.clamped) {
+            borderColor = FloatVec4(std::clamp(borderColor.x(), range.minValue, range.maxValue),
+                                    std::clamp(borderColor.y(), range.minValue, range.maxValue),
+                                    std::clamp(borderColor.z(), range.minValue, range.maxValue),
+                                    std::clamp(borderColor.w(), range.minValue, range.maxValue));
+        }
+
+        // A depth texture samples one component, so only x decides - and its alpha reads as 1.
+        if (IsDepthTextureFormat(format)) {
             if (NearlyEqual(borderColor.x(), 1.0f)) {
-                return VK_BORDER_COLOR_FLOAT_OPAQUE_WHITE;
+                resolved.color = VK_BORDER_COLOR_FLOAT_OPAQUE_WHITE;
+                return resolved;
             }
             if (NearlyEqual(borderColor.x(), 0.0f)) {
-                return VK_BORDER_COLOR_FLOAT_OPAQUE_BLACK;
+                resolved.color = VK_BORDER_COLOR_FLOAT_OPAQUE_BLACK;
+                return resolved;
             }
         }
 
         const Bool rgbZero = NearlyEqual(borderColor.x(), 0.0f) && NearlyEqual(borderColor.y(), 0.0f) &&
                              NearlyEqual(borderColor.z(), 0.0f);
         if (rgbZero && NearlyEqual(borderColor.w(), 0.0f)) {
-            return VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK;
+            resolved.color = VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK;
+            return resolved;
         }
         if (rgbZero && NearlyEqual(borderColor.w(), 1.0f)) {
-            return VK_BORDER_COLOR_FLOAT_OPAQUE_BLACK;
+            resolved.color = VK_BORDER_COLOR_FLOAT_OPAQUE_BLACK;
+            return resolved;
         }
         if (NearlyEqual(borderColor.x(), 1.0f) && NearlyEqual(borderColor.y(), 1.0f) &&
             NearlyEqual(borderColor.z(), 1.0f) && NearlyEqual(borderColor.w(), 1.0f)) {
-            return VK_BORDER_COLOR_FLOAT_OPAQUE_WHITE;
+            resolved.color = VK_BORDER_COLOR_FLOAT_OPAQUE_WHITE;
+            return resolved;
         }
 
-        return VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK;
+        if (canUseCustom) {
+            resolved.color = VK_BORDER_COLOR_FLOAT_CUSTOM_EXT;
+            resolved.isCustom = true;
+            resolved.customValue.float32[0] = borderColor.x();
+            resolved.customValue.float32[1] = borderColor.y();
+            resolved.customValue.float32[2] = borderColor.z();
+            resolved.customValue.float32[3] = borderColor.w();
+            return resolved;
+        }
+
+        // Nearest of the three float palette entries. Transparent black stays the answer for a
+        // transparent border, which is what the old unconditional fallback got right by accident.
+        const Bool opaque = borderColor.w() >= 0.5f;
+        const Bool bright = (borderColor.x() + borderColor.y() + borderColor.z()) >= 1.5f;
+        resolved.color = !opaque ? VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK
+                                 : (bright ? VK_BORDER_COLOR_FLOAT_OPAQUE_WHITE : VK_BORDER_COLOR_FLOAT_OPAQUE_BLACK);
+        return resolved;
     }
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Backend/DirectVulkan/Renderer/VkSamplerManager.h

@@ -28,6 +28,13 @@ public:
         Bool samplerAnisotropySupported = false;
         // VkPhysicalDeviceLimits::maxSamplerAnisotropy.
         Float maxSamplerAnisotropy = 1.0f;
+        // VK_EXT_custom_border_color was enabled with BOTH customBorderColors and
+        // customBorderColorWithoutFormat; see VulkanRenderer::m_customBorderColorFeatureEnabled.
+        Bool customBorderColorSupported = false;
+        // VkPhysicalDeviceCustomBorderColorPropertiesEXT::maxCustomBorderColorSamplers. A hard device
+        // limit on how many LIVE samplers may carry a custom border colour, so the cache counts them
+        // and falls back to the snapped predefined value once it is reached.
+        Uint32 maxCustomBorderColorSamplers = 0;
     };
 
     Bool Initialize(const InitInfo& initInfo);
@@ -52,6 +59,21 @@ public:
     // boundaries.
     void OnFrameBoundary();
 
+    // What GL_TEXTURE_BORDER_COLOR resolves to for one (sampler, texture) pair. `color` is always a
+    // legal VkBorderColor; when `isCustom` it is one of the *_CUSTOM_EXT values and `customValue`
+    // carries the actual components in a VkSamplerCustomBorderColorCreateInfoEXT.
+    //
+    // Resolved ONCE per GetOrCreateSampler call and threaded into both the cache key and the
+    // create-info, so the two cannot disagree - the same discipline the resolved anisotropy needs,
+    // and here it also makes the maxCustomBorderColorSamplers fallback deterministic: whether a
+    // custom colour was affordable is decided before the key is built, not twice with a budget
+    // change in between.
+    struct ResolvedBorderColor {
+        VkBorderColor color = VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK;
+        VkClearColorValue customValue{};
+        Bool isCustom = false;
+    };
+
 private:
     struct SamplerCacheEntry {
         VkSampler handle = VK_NULL_HANDLE;
@@ -60,17 +82,18 @@ private:
         // Frame boundary of the last cache hit; entries idle past the
         // OnFrameBoundary retirement age have their VkSampler destroyed.
         Uint64 lastUsedFrameBoundary = 0;
+        // Counted against maxCustomBorderColorSamplers for as long as this entry lives.
+        Bool usesCustomBorderColor = false;
     };
 
-    Uint64 BuildSamplerKey(const MG_State::GLState::SamplerObject& sampler,
-                           const MG_State::GLState::ITextureObject& texture,
-                           Bool forceNearestFiltering, Bool singleLevelView) const;
+    Uint64 BuildSamplerKey(const MG_State::GLState::SamplerObject& sampler, Bool forceNearestFiltering,
+                           Bool singleLevelView, const ResolvedBorderColor& borderColor) const;
     static VkFilter ToVkFilter(SamplerFilterMode mode);
     static VkSamplerMipmapMode ToVkMipmapMode(SamplerMipmapMode mode);
     static VkSamplerAddressMode ToVkAddressMode(SamplerWrapMode mode);
     static VkCompareOp ToVkCompareOp(SamplerCompareFunc func);
-    static VkBorderColor ResolveVkBorderColor(const MG_State::GLState::SamplerObject& sampler,
-                                              const MG_State::GLState::ITextureObject& texture);
+    ResolvedBorderColor ResolveBorderColor(const MG_State::GLState::SamplerObject& sampler,
+                                           const MG_State::GLState::ITextureObject& texture) const;
     // The anisotropy Vulkan will actually apply: 1.0 (i.e. disabled) unless the feature is on and
     // the sampler filters linearly both ways, otherwise the GL request clamped to the device limit.
     // GL happily carries GL_TEXTURE_MAX_ANISOTROPY on a NEAREST sampler (Blaze3D's blocks do exactly
@@ -82,6 +105,12 @@ private:
     const VulkanRendererConfig* m_config = nullptr;
     Bool m_samplerAnisotropySupported = false;
     Float m_maxSamplerAnisotropy = 1.0f;
+    Bool m_customBorderColorSupported = false;
+    Uint32 m_maxCustomBorderColorSamplers = 0;
+    // Live cache entries carrying a custom border colour. Kept in step with the entries themselves
+    // in exactly the three places one can appear or disappear: creation, the OnFrameBoundary sweep,
+    // and Shutdown.
+    Uint32 m_customBorderColorSamplerCount = 0;
     UnorderedMap<Uint64, SamplerCacheEntry> m_samplers;
     // Monotonic frame-boundary counter (bumped in OnFrameBoundary) for cache aging.
     Uint64 m_frameBoundaryCounter = 0;

MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.cpp

@@ -46,13 +46,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return mipLevelCount;
     }
 
-    struct TextureFormatInfo {
-        VkFormat format = VK_FORMAT_UNDEFINED;
-        Bool expandRgbToRgba = false;
-        Uint32 componentByteCount = 0;
-        Array<Uint8, 4> alphaBytes = {0, 0, 0, 0};
-    };
-
     struct TextureShapeInfo {
         VkImageType imageType = VK_IMAGE_TYPE_2D;
         VkImageViewType viewType = VK_IMAGE_VIEW_TYPE_2D;
@@ -380,7 +373,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return true;
     }
 
-    static TextureFormatInfo ResolveTextureFormatInfo(TextureInternalFormat format) {
+    TextureFormatInfo ResolveTextureFormatInfo(TextureInternalFormat format) {
         switch (format) {
         case TextureInternalFormat::RGB:
         case TextureInternalFormat::RGB8:
@@ -921,18 +914,28 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (mipLevel >= resource->mipLevels) {
             return VK_NULL_HANDLE;
         }
-        // A 3D image has arrayLayers == 1 and keeps its GL layers on the z axis, so a per-slice
-        // attachment view is a 2D view whose "array layer" is the slice - legal only on a
-        // 2D-array-compatible image (VUID-VkImageViewCreateInfo-image-04970), which
-        // SyncTextureResource asks for and may have had refused per format.
-        if (resource->viewType == VK_IMAGE_VIEW_TYPE_3D && viewType == VK_IMAGE_VIEW_TYPE_2D) {
+        // A 3D image has arrayLayers == 1 and keeps its GL layers on the z axis, so an attachment
+        // view over it addresses SLICES through baseArrayLayer/layerCount: one slice for a
+        // non-layered attachment (a 2D view) and the whole span for a layered one (a 2D_ARRAY view,
+        // which is what a layered GL_TEXTURE_3D attachment plus a gl_Layer-writing geometry shader
+        // means). BOTH spellings are legal only on a 2D-array-compatible image
+        // (VUID-VkImageViewCreateInfo-image-04970 / -06723), which SyncTextureResource asks for and
+        // may have had refused per format.
+        //
+        // The span is validated against the MIP's slice count, never against arrayLayers: a 3D
+        // image's arrayLayers is 1 by construction, so measuring a layered span against it rejected
+        // every layered 3D attachment - the null view that used to reach vkCreateFramebuffer.
+        if (resource->viewType == VK_IMAGE_VIEW_TYPE_3D &&
+            (viewType == VK_IMAGE_VIEW_TYPE_2D || viewType == VK_IMAGE_VIEW_TYPE_2D_ARRAY)) {
             const Uint32 sliceCount = std::max(resource->depth >> mipLevel, 1u);
             if ((resource->imageCreateFlags & VK_IMAGE_CREATE_2D_ARRAY_COMPATIBLE_BIT) == 0 ||
                 layerCount == 0 || baseArrayLayer >= sliceCount || baseArrayLayer + layerCount > sliceCount) {
-                MGLOG_D("%s: cannot name slice span [%u, %u) of 3D textureId=%d (mip %u has %u slices, "
-                        "2D-array-compatible=%d)",
+                // Not an error line: the render-pass builder turns the null view into one
+                // MGLOG_E_ONCE and a skipped draw, which is the level this belongs at.
+                MGLOG_D("%s: cannot name slice span [%u, %u) of 3D textureId=%d as viewType=%d (mip %u has %u "
+                        "slices, 2D-array-compatible=%d)",
                         __func__, baseArrayLayer, baseArrayLayer + layerCount, texture.GetExternalIndex(),
-                        mipLevel, sliceCount,
+                        static_cast<Int>(viewType), mipLevel, sliceCount,
                         (int)((resource->imageCreateFlags & VK_IMAGE_CREATE_2D_ARRAY_COMPATIBLE_BIT) != 0));
                 return VK_NULL_HANDLE;
             }
@@ -2173,12 +2176,16 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
             if (imageFormatResult != VK_SUCCESS && !isMultisampleTexture &&
                 (imageInfo.flags & VK_IMAGE_CREATE_2D_ARRAY_COMPATIBLE_BIT) != 0) {
-                // Losing 2D-array compatibility only costs per-slice framebuffer attachment for this
-                // format; failing creation would lose the texture entirely. Remembered so later syncs
-                // neither reprobe nor flag-mismatch against this image and recreate it.
+                // Losing 2D-array compatibility only costs framebuffer attachment of this format's
+                // 3D images - per-slice AND layered, since both are spelled as a 2D-family view over
+                // the z axis; failing creation would lose the texture entirely. Recorded here (the
+                // per-format set below) so later syncs neither reprobe nor flag-mismatch against this
+                // image and recreate it, and so GetOrCreateAttachmentViewAtMipLevel declines rather
+                // than handing back a view that cannot exist - the render-pass builder then turns
+                // that decline into a skipped draw instead of a null VkImageView in pAttachments.
                 MGLOG_W_ONCE("%s: VK_IMAGE_CREATE_2D_ARRAY_COMPATIBLE_BIT is unsupported for format=%d "
-                        "textureId=%d; creating without it (per-slice framebuffer attachment will be "
-                        "unavailable for it)",
+                        "textureId=%d; creating without it (per-slice and layered framebuffer "
+                        "attachment of 3D textures in this format will be unavailable)",
                         __func__, static_cast<Int>(format), texture.GetExternalIndex());
                 m_2dArrayCompatibleUnsupported.insert(format);
                 imageInfo.flags &= ~VK_IMAGE_CREATE_2D_ARRAY_COMPATIBLE_BIT;

MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.h

@@ -10,8 +10,10 @@
 
 #include "../VkIncludes.h"
 #include <Includes.h>
+#include <MG_State/GLState/FramebufferState/FramebufferObject.h>
 #include <MG_State/GLState/TextureState/TextureObject.h>
 #include <vk_mem_alloc.h>
+#include <algorithm>
 #include <unordered_map>
 #include <unordered_set>
 
@@ -22,6 +24,31 @@ class ITextureObject;
 namespace MobileGL::MG_Backend::DirectVulkan {
 enum class SamplerNumericDomain : Uint8;
 
+// What VkFormat a GL internal format is BACKED with, and how a shadow upload has to be reshaped to
+// fit it. This is not the same question as "is there an exact VkFormat for this GL format", which is
+// what ConvertTextureInternalFormatToVkEnum answers: several GL formats have no Vulkan twin at all
+// (RGBA2, RGBA12) and several three-channel ones are deliberately widened to their four-channel twin
+// because Vulkan devices rarely support the 3-channel layouts.
+//
+// SHARED, and it must stay the only answer to that question. A renderbuffer and a texture of the
+// same GL format have to resolve to the SAME VkFormat or every blit, resolve and glCopyImageSubData
+// between them crosses a size-incompatible pair, which vkCmdCopyImage leaves undefined
+// (VUID-vkCmdCopyImage-srcImage-01548). The renderbuffer path used to carry a hand-maintained second
+// copy of this table that was missing four rows - RGBA2, RGBA4, RGB5A1 and RGBA12 - so those four
+// renderbuffer formats either got no image at all or a 16-bit-packed one facing a 32-bit texture.
+struct TextureFormatInfo {
+    VkFormat format = VK_FORMAT_UNDEFINED;
+    // The GL format has three channels and is carried in a four-channel image; a shadow upload has
+    // to be expanded, inserting `alphaBytes` after every `componentByteCount * 3` source bytes.
+    Bool expandRgbToRgba = false;
+    Uint32 componentByteCount = 0;
+    Array<Uint8, 4> alphaBytes = {0, 0, 0, 0};
+};
+
+// Callers that only need the backing VkFormat (a renderbuffer has no shadow upload to reshape) take
+// `.format` and ignore the rest.
+TextureFormatInfo ResolveTextureFormatInfo(TextureInternalFormat format);
+
 // A GL 1D-ARRAY level keeps its LAYER COUNT in the state-side HEIGHT: that is what
 // glTexImage2D(GL_TEXTURE_1D_ARRAY, width, layers) means, and the frontend records the level
 // as {width, layers, 1} (see GL_Texture.cpp's AllocateStorage and the completeness walk in
@@ -41,6 +68,37 @@ inline IntVec3 ToVulkanLevelExtent(TextureTarget stateTarget, const IntVec3& glT
     return glTexelSize;
 }
 
+// How many Vulkan array layers (or, for a 3D image, z slices) a GL framebuffer attachment spans.
+//
+// THE ONE COPY, deliberately. This used to exist twice - privately in VkRenderPassManager.cpp and
+// again in VkClearManager.cpp - and the two are not independent: the render pass builds the
+// attachment view and VkFramebufferCreateInfo::layers from one, while the CLEAR key built from the
+// other is written verbatim into VkImageSubresourceRange::layerCount when a queued glClear is
+// materialised outside a render pass (MaterializePendingClearForTexture). They are two consumers
+// of the same GL clear, so any disagreement means the same glClear produces two different pictures
+// depending only on which path happens to consume it first - and the materialise path then POPS
+// the entry, so the other one never runs. Fixing one copy and leaving the other is exactly how
+// that split gets introduced; keep them the same function.
+//
+// Two shapes make this more than `size.z()`:
+//   * GL_TEXTURE_1D_ARRAY keeps its layer count in the state-side HEIGHT (see ToVulkanLevelExtent
+//     just above), so z reads 1 and every layer above the first was silently dropped.
+//   * GL_TEXTURE_CUBE_MAP is attached layered as its REPRESENTATIVE upload target, the +X face
+//     (ResolveRepresentableFramebufferTextureUploadTarget), and one face's level size has z = 1 -
+//     but a layered cube attachment names all six faces (GL 4.6 core 9.2.8), which are the image's
+//     six array layers. A cube ARRAY needs no such arm: its representative target carries 6n in z.
+inline Uint32 ResolveAttachmentLayerCount(const MG_State::GLState::FramebufferAttachmentObject& attachment) {
+    if (!attachment.IsLayered()) {
+        return 1u;
+    }
+    const auto& texture = attachment.GetTexture();
+    const TextureTarget target = texture != nullptr ? texture->GetTarget() : TextureTarget::Unknown;
+    if (target == TextureTarget::TextureCubeMap) {
+        return 6u;
+    }
+    return static_cast<Uint32>(std::max(ToVulkanLevelExtent(target, attachment.GetSize()).z(), 1));
+}
+
 // A GL framebuffer attachment's level/layer, and a GL image unit's, are relative to the texture
 // the application NAMED. When that texture was created by glTextureView (ARB_texture_view) they
 // are relative to the VIEW, and have to be shifted into the storage image's numbering before they

MobileGL/MG_Backend/DirectVulkan/Renderer/VulkanRenderer.h

@@ -24,6 +24,7 @@
 #include "MG_Util/Math/VectorTypes.h"
 #include <Includes.h>
 #include <MG_Backend/BackendObject.h>
+#include <MG_Util/SelfTest/PrimitivesGeneratedNoXfbProbe.h>
 #include <vk_mem_alloc.h>
 
 #include "../VkIncludes.h"
@@ -563,7 +564,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // Native subgroup topology, queried at device creation for the compute-module
         // subgroup repairs (SubgroupSupportPolicy.h) and the REQUIRE_FULL_SUBGROUPS
         // stage flag; 0 / false when the device has no usable compute subgroups or
-        // MOBILEGL_DISABLE_SUBGROUP forced them off.
+        // MOBILEGL_MAGMA_DISABLE_SUBGROUP forced them off.
         Uint32 m_nativeSubgroupSize = 0;
         Bool m_nativeSubgroupSupported = false;
         Bool m_computeFullSubgroupsFeatureEnabled = false;
@@ -584,6 +585,30 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // needs no feature). Both cached at device creation and drive a hard-fail-at-draw when absent.
         Bool m_dualSrcBlendFeatureEnabled = false;
         Bool m_primitiveTopologyListRestartFeatureEnabled = false;
+        // shaderTessellationAndGeometryPointSize gates the PointSize built-in in a tessellation
+        // or geometry stage, which desktop GL treats as an ordinary per-vertex output (writable,
+        // and capturable by name through transform feedback). Cached at device creation and
+        // handed to ProgramFactory, which refuses a program whose tessellation or geometry module
+        // declares the matching SPIR-V capability while this is false - SetupDraw then skips its
+        // draws (VkProgramObject::pointSizeCapabilityUnsupported) rather than building a pipeline
+        // that is invalid usage.
+        Bool m_tessellationAndGeometryPointSizeFeatureEnabled = false;
+        // VK_EXT_custom_border_color. Vulkan's four predefined VkBorderColor values cover only
+        // transparent/opaque black and opaque white; GL_TEXTURE_BORDER_COLOR is an arbitrary vec4 (or
+        // an arbitrary ivec4/uvec4 through the "I" entry points). Without this extension a border
+        // colour outside the palette has to be snapped to the nearest predefined one. Both features
+        // are required together: customBorderColorWithoutFormat is what lets a sampler carry a custom
+        // colour without naming the image format it will be paired with, which GL's sampler objects
+        // cannot know. maxCustomBorderColorSamplers is a real device limit, so the sampler cache has
+        // to be able to fall back to the snapped value once it is reached.
+        Bool m_customBorderColorFeatureEnabled = false;
+        Uint32 m_maxCustomBorderColorSamplers = 0;
+        // sampleRateShading gates VkPipelineMultisampleStateCreateInfo::sampleShadingEnable, i.e.
+        // glEnable(GL_SAMPLE_SHADING) + glMinSampleShading. Unlike dualSrcBlend this does NOT
+        // hard-fail the draw when absent: sample shading is a rate hint, and every sample-rate
+        // pipeline is still correct (just not per-sample) at the default rate - so the enable is
+        // dropped and the draw proceeds, which is what a GL implementation with SAMPLES=1 does too.
+        Bool m_sampleRateShadingFeatureEnabled = false;
         // multiViewport gates rasterizing into more than one of ARB_viewport_array's 16 viewports
         // (gl_ViewportIndex). m_maxRasterizableViewports is min(MAX_VIEWPORTS, device limit), or 1
         // when the feature is off, and is the viewportCount a gl_ViewportIndex-writing pipeline
@@ -693,15 +718,74 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         Vector<Uint32> m_xfbQueryActiveSlots[2];
         Bool m_xfbQuerySlotOpen = false;
         Uint32 m_xfbQueryOpenSlot = 0;
+        // GL_PRIMITIVES_GENERATED reroute for draws made while transform feedback is
+        // INACTIVE. The stream pool's primitivesNeeded is defined to count those draws
+        // too, but a Mali driver (and Mesa lavapipe) answers 0 unless a capture span
+        // is open (the CTS's tessellator-measuring shape). Where the bring-up probe
+        // finds that defect with a working control - or
+        // MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE forces it - such draws accumulate the
+        // GENERATED count through this pool instead, whose type the arming picks:
+        // VK_QUERY_TYPE_PRIMITIVES_GENERATED_EXT where the device hosts the dedicated
+        // query with its rasterizer-discard feature (exact semantics by definition -
+        // the extension exists because GL needs this count without a capture), else a
+        // VK_QUERY_TYPE_PIPELINE_STATISTICS pool over clipping-stage invocations (one
+        // per primitive reaching primitive clipping - after every vertex processing
+        // stage, before rasterizer discard - which is the same set).
+        // XFB-ACTIVE draws keep the stream slot (exact today, and WRITTEN needs it);
+        // every draw with no open capture - a PAUSED span's draws included - takes a
+        // reroute slot, and the span then ignores the frontend's CPU paused-primitive
+        // counter rather than adding it on top (see IsPrimGenRerouteArmed): that
+        // counter is written by only 3 of the ~15 draw entry points and answers 0 for
+        // GL_PATCHES, so it cannot price the draws this reroute exists to repair. One
+        // GL query span may therefore hold slots of both pools.
+        Bool m_pipelineStatisticsQueryFeatureEnabled = false;
+        // VK_EXT_primitives_generated_query: base feature, and the
+        // ...WithRasterizerDiscard feature without which a discarding draw inside the
+        // query is invalid usage (so the reroute never picks the dedicated pool on a
+        // base-only device - GL applications toggle discard freely).
+        Bool m_primitivesGeneratedQueryFeatureEnabled = false;
+        Bool m_primitivesGeneratedQueryDiscardFeatureEnabled = false;
+        // tessellationShader was enabled at device creation (it is taken whenever the
+        // device advertises it); gates the probe's PATCHES shape.
+        Bool m_tessellationShaderFeatureEnabled = false;
+        MG_Util::SelfTest::PrimGenRerouteKind m_primGenRerouteKind =
+            MG_Util::SelfTest::PrimGenRerouteKind::None;
+        // The bring-up probe measured this device's stream query as counting draws made
+        // with no capture span open (the StreamCounts verdict) - so it counts the
+        // PAUSED-span ones too, through the stream slot they take when nothing is
+        // rerouted. Only the probe can know this, so it stays false wherever the probe
+        // is not consulted (the forced arms), which keeps those lanes' accounting as it
+        // was.
+        Bool m_primGenStreamCountsXfbInactiveDraws = false;
+        VkQueryPool m_primGenReroutePool = VK_NULL_HANDLE;
+        Uint32 m_primGenRerouteSlotCursor = 0;
+        Vector<Uint32> m_primGenRerouteActiveSlots;
+        Bool m_primGenRerouteSlotOpen = false;
+        Uint32 m_primGenRerouteOpenSlot = 0;
+        // Runs the bring-up probe (memoized per process) and decides
+        // m_primGenRerouteKind. Called at the end of device creation: it records on
+        // m_graphicsQueue, which nothing else is using yet.
+        void ArmPrimGenReroute();
 
     public:
+        // Whether a GENERATED span opened now will have the draws made while the GL
+        // span is PAUSED counted on the GPU - through the reroute pool, which takes
+        // every draw with no open capture, or (where the reroute is not armed because
+        // the stream query was measured to count capture-less draws) through the stream
+        // slot such a draw still takes. The frontend's CPU paused-primitive counter
+        // must not be added on top of either: it would double count, and it cannot
+        // price the draws that matter anyway - only 3 of the ~15 draw entry points
+        // write it and it answers 0 for GL_PATCHES. Read once per span, after
+        // StartXfbQueryCapture (whose pool creation may disarm the reroute).
+        Bool ArePausedDrawsGpuCounted() const;
         // kind: 0 = PRIMITIVES_WRITTEN, 1 = PRIMITIVES_GENERATED.
         Bool StartXfbQueryCapture(Uint32 kind);
-        void StopXfbQueryCapture(Uint32 kind, Vector<Uint32>& outSlots);
-        Bool ResolveXfbQueryResult(const Vector<Uint32>& slots, Bool wantGenerated, Uint64& outPrimitives);
+        void StopXfbQueryCapture(Uint32 kind, Vector<Uint32>& outSlots, Vector<Uint32>& outRerouteSlots);
+        Bool ResolveXfbQueryResult(const Vector<Uint32>& slots, const Vector<Uint32>& rerouteSlots,
+                                   Bool wantGenerated, Uint64& outPrimitives);
 
     private:
-        void BeginXfbQueryForDraw(VkCommandBuffer commandBuffer);
+        void BeginXfbQueryForDraw(VkCommandBuffer commandBuffer, Bool xfbActive);
         void EndXfbQueryForDraw(VkCommandBuffer commandBuffer);
 
         VkCommandPool m_commandPool = VK_NULL_HANDLE;
@@ -733,6 +817,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // values the memo already holds.
             Uint64 pipelineStateHash = 0;
             ProgramFactory::CompileOptionFlags transformFlags = {};
+            // Baked into the pipeline (PipelineFactory::ComputeHash mixes it), and NOT derivable
+            // from anything else in this key: it depends on whether the draw is indexed and on the
+            // index type, neither of which the mode/program/state hashes carry. Without it an
+            // indexed and a non-indexed draw over the same program and state collide on one entry
+            // and the second one gets the first one's restart setting.
+            Bool primitiveRestartEnable = false;
             VkPipeline pipeline = VK_NULL_HANDLE;
         };
         static constexpr Uint32 kPipelineMemoSize = 8;
@@ -746,9 +836,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // version: the version is monotonic and bumps on every pipeline-state
         // change, so an unchanged (version, colorAttachmentCount) proves the state
         // bytes are unchanged and the hash can be reused without re-reading them.
-        Uint64 ComputePipelineStateHash(Uint32 colorAttachmentCount) const;
+        Uint64 ComputePipelineStateHash(Uint32 colorAttachmentCount,
+                                        VkSampleCountFlagBits rasterizationSamples) const;
+        // The effective GL_SAMPLE_MASK word for a draw at this rasterization sample count; see
+        // the definition for the GL-vs-Vulkan rule it reconciles. Shared by the pipeline payload
+        // and the pipeline-state memo word so the two cannot disagree.
+        Uint32 ResolveEffectiveSampleMask(VkSampleCountFlagBits rasterizationSamples) const;
         Uint m_pipelineStateHashVersion = 0;
         Uint32 m_pipelineStateHashColorCount = 0;
+        // The sample count the cached hash was computed at. A pipeline-state input now depends on
+        // it (the effective sample mask), so a draw that changes only the target's sample count
+        // has to recompute rather than reuse.
+        VkSampleCountFlagBits m_pipelineStateHashSampleCount = VK_SAMPLE_COUNT_1_BIT;
         Uint64 m_pipelineStateHash = 0;
         Bool m_pipelineStateHashValid = false;
         // GetShaderTransformFlags memo. NOT pure in the pre-transform alone: the
@@ -790,7 +889,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // Skip the per-draw CollectSampledTextures walk (~5% of the render thread) when the sampled
         // texture SET is provably unchanged from the previous draw: same program (lifetime id +
         // backend-state version, which covers sampler-uniform reassignment / relink) and transform
-        // flags, and no texture bind/unbind/delete since (GetTextureBindGeneration). On a hit,
+        // flags, no texture bind/unbind/delete since (GetTextureBindGeneration), and nothing that
+        // moves a texture's shape or a sampler's parameters since (GetSamplingResolutionGeneration
+        // - membership depends on mipmap-completeness, which both of those decide). On a hit,
         // m_sampledTexturesScratch still holds the previous draw's list and steps 2-4 (feedback /
         // layout probe / transition) re-run on it, so layout correctness is unaffected - only the GL
         // walk is skipped. The program lifetime id (never reused, unlike the GL name) and the
@@ -801,6 +902,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         Uint32 m_lastSampledSetProgramVersion = 0;
         ProgramFactory::CompileOptionFlags m_lastSampledSetTransformFlags = {};
         Uint64 m_lastSampledSetBindGeneration = 0;
+        Uint64 m_lastSampledSetSamplingGeneration = 0;
+        // Set from the draw's resolved VkProgramObject on both the full and the fast setup paths;
+        // read by BeginXfbCaptureForDraw, which has only GL state otherwise. See
+        // VkProgramObject::xfbCaptureDeclined.
+        Bool m_currentDrawXfbCaptureDeclined = false;
 
         // Memo for the per-draw explicit-LOD-0 eligibility probe
         // (ProgramSamplesOnlySingleLevelTextures): same key family as the
@@ -865,6 +971,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             Uint64 bindGeneration = 0;
             Uint32 baseTransformFlags = 0;
             Uint32 resolvedTransformFlags = 0;
+            // What ResolvePrimitiveRestartEnable answered for the draw this snapshot was taken
+            // from, i.e. what its pipeline's primitiveRestartEnable was built with. `aspects`
+            // already separates indexed from non-indexed draws, but not one index TYPE from
+            // another, and a restart index that fits GL_UNSIGNED_INT but not GL_UNSIGNED_SHORT
+            // makes those two draws want different pipelines.
+            Bool primitiveRestartEnable = false;
             Uint64 renderPassHash = 0;
             Uint32 imageIndex = 0;
             Uint64 textureEraseEpoch = 0;
@@ -893,6 +1005,9 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             // probe the pipeline memo after a state change without re-fetching the
             // render-pass entry (the pass itself is pinned by renderPassHash above).
             Uint32 renderPassColorCount = 0;
+            // Pinned with the colour count and for the same reason: the fast path recomputes the
+            // pipeline-state value hash from the snapshot, and that hash reads the sample count.
+            VkSampleCountFlagBits renderPassSampleCount = VK_SAMPLE_COUNT_1_BIT;
             VkPipeline pipeline = VK_NULL_HANDLE;
             // layoutHash of the snapshotting draw's vertex-input state. The pipeline and
             // the vertex-input pre-flight depend on the VAO only through this (plus the
@@ -1168,13 +1283,23 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         void CreateSwapchain();
         void CreateCommandPool();
 
+        // Whether THIS draw's primitive stream restarts, and therefore what
+        // VkPipelineInputAssemblyStateCreateInfo::primitiveRestartEnable must be. Resolved by the
+        // caller because it needs two facts a pipeline cannot see: whether the draw is indexed at
+        // all (GL primitive restart acts on the index stream, so it is a no-op for glDrawArrays),
+        // and the index TYPE (an application restart index that does not fit the type matches no
+        // index, so that draw restarts nowhere - see UploadAndBindIndexBuffer).
+        Bool ResolvePrimitiveRestartEnable(Flags<DrawSetupAspect> aspects,
+                                           const IndexBufferView* pIndexBufferView) const;
+
         VkPipeline GetOrCreatePipeline(
             GLenum mode,
             const MG_State::GLState::ProgramObject& program,
             const ProgramFactory::VkProgramObject& programObj,
             ProgramFactory::CompileOptionFlags transformFlags,
             const MG_State::GLState::VertexArrayObject& vao,
-            const RenderPassEntry& renderPassEntry);
+            const RenderPassEntry& renderPassEntry,
+            Bool primitiveRestartEnable);
         VkPipeline GetOrCreateComputePipeline(const ProgramFactory::VkProgramObject& programObj);
         void DestroyComputePipelines();
         // Takes the frame rather than a command buffer: a first-time storage-usage upgrade has to
@@ -1241,13 +1366,25 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                                                    GLint srcX0, GLint srcY0, GLint srcX1, GLint srcY1,
                                                    GLint dstX0, GLint dstY0, GLint dstX1, GLint dstY1,
                                                    GLenum filter);
-        // Clears one z slice of a VK_IMAGE_TYPE_3D colour image. See the call site in
-        // MaterializePendingClearForTexture for why a transfer clear cannot do this.
+        // Clears one layer of a colour image through a throwaway render pass whose entire content
+        // is its LOAD_OP_CLEAR. Two callers, both of which a transfer clear cannot serve: a z
+        // slice of a VK_IMAGE_TYPE_3D image (vkCmdClearColorImage cannot name one), and a
+        // MULTISAMPLE image (which carries no TRANSFER_DST usage at all). `finalLayout` is the
+        // layout the caller already tracks for the whole image, so this never has to touch
+        // resource->layout.
         Bool ClearDepthSliceWithRenderPass(VkCommandBuffer commandBuffer,
                                            MG_State::GLState::ITextureObject& texture, Uint32 mipLevel,
-                                           Uint32 depthSlice, const VkClearValue& clearValue);
+                                           Uint32 depthSlice, const VkClearValue& clearValue,
+                                           VkImageLayout finalLayout = VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL);
         Bool MaterializePendingClearForTexture(VkCommandBuffer commandBuffer,
                                                MG_State::GLState::ITextureObject& texture);
+        // The multisample arm of the above. Split out rather than branched inline because it
+        // shares none of the transfer path: a multisample image carries no TRANSFER_DST usage, so
+        // neither the TRANSFER_DST transition nor vkCmdClearColorImage is legal on one.
+        Bool MaterializeMultisamplePendingClear(VkCommandBuffer commandBuffer,
+                                                MG_State::GLState::ITextureObject& texture,
+                                                VkTextureManager::TextureResource& resource,
+                                                const Vector<PendingClearEntry>& pendingClears);
         Bool MaterializePendingClearForRenderbuffer(
             VkCommandBuffer commandBuffer,
             const SharedPtr<MG_State::GLState::RenderbufferObject>& renderbuffer);

MobileGL/MG_Backend/DirectVulkan/SubgroupSupportPolicy.h

@@ -39,18 +39,18 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
     inline Bool ShouldEmulateSubgroups(const Bool nativeSubgroupSupported) {
         return MG_Config::Features.MagmaEmulateSubgroup && !nativeSubgroupSupported &&
-               !MG_Config::Features.DisableSubgroup;
+               !MG_Config::Features.MagmaDisableSubgroup;
     }
 
     inline Bool ShouldFixIterationRPSubgroupScratch() {
         // Auto is ON: the patch is fingerprint-gated to iterationRP's reduction and
         // grows one under-declared array; every other module passes through untouched.
-        return MG_Config::Features.FixIterationRPSubgroupScratch !=
+        return MG_Config::Features.MagmaFixIterationRPSubgroupScratch !=
                MG_Config::QuirkOverride::ForceOff;
     }
 
     inline Bool ShouldFixIterationRPBarrier() {
-        return MG_Config::Features.IterationRPFixBarrier;
+        return MG_Config::Features.MagmaIterationRPFixBarrier;
     }
 
     inline Bool ShouldDeriveNumSubgroups() {
@@ -58,6 +58,6 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // contract to hold, and the derived ceil() value is the one the renderer can pin
         // with REQUIRE_FULL_SUBGROUPS - the driver builtin is the value with no
         // cross-driver guarantee (Adreno returns 1 for an 8-subgroup dispatch).
-        return MG_Config::Features.DeriveNumSubgroups != MG_Config::QuirkOverride::ForceOff;
+        return MG_Config::Features.MagmaDeriveNumSubgroups != MG_Config::QuirkOverride::ForceOff;
     }
 } // namespace MobileGL::MG_Backend::DirectVulkan

MobileGL/MG_Impl/GLImpl/Drawing/GL_Drawing.cpp

@@ -34,8 +34,81 @@ namespace MobileGL::MG_Impl::GLImpl {
         return true;
     }
 
-    static Bool ValidateCurrentProgramForExecution(const char* functionName) {
-        return ValidateProgramForExecution(MG_State::pGLContext->GetProgramForDraw(), functionName);
+    // Takes the ALREADY-RESOLVED draw program rather than looking it up: GLContext::GetProgramForDraw
+    // is not a plain getter (it settles the program's link and SPIR-V jobs so every version a
+    // backend samples during this draw describes the program it is drawing), so the draw funnel
+    // below resolves it exactly once and hands it to both users.
+    static Bool ValidateResolvedProgramForDraw(const SharedPtr<MG_State::GLState::ProgramObject>& currentProgram,
+                                               const char* functionName) {
+        // "If there is no current program object or bound program pipeline object, the results of
+        // a draw are UNDEFINED" - and undefined is not an error (GL 4.6 core 7.3, ES 3.1 7.3).
+        // The draw is dropped, silently, which is one of the shapes "undefined" is allowed to
+        // take; recording INVALID_OPERATION here is not, and es31cSeparateShaderObjsTests'
+        // StateInteraction reads exactly that error back after useProgram(0) + bindProgramPipeline(0).
+        // A DISPATCH is the opposite rule ("INVALID_OPERATION if there is no active program for
+        // the compute shader stage"), which is why this lives on the draw path and not in the
+        // shared ValidateProgramForExecution below.
+        if (!currentProgram) return false;
+        if (!ValidateProgramForExecution(currentProgram, functionName)) return false;
+
+        // GL 4.6 core 7.4.1, the pipeline validation rule every vertex-transferring command
+        // inherits: it is an INVALID_OPERATION when a tessellation control, tessellation
+        // evaluation or geometry stage has an executable but no program supplies an executable
+        // VERTEX shader. A non-separable program cannot reach this - the link rule forbids the
+        // shape - so in practice it catches a program pipeline assembled out of stage programs,
+        // which today draws happily and renders nothing.
+        //
+        // Asked of the EXECUTABLE, like the compute check below: for a pipeline the resolved
+        // program is the graphics composite, whose linked-shader snapshot is built out of exactly
+        // the pipeline's own graphics stage programs (GLContext::GetProgramForDraw), and the only
+        // stage compositing ever invents is a default FRAGMENT shader. A fragment-only pipeline is
+        // deliberately NOT rejected: the rule above names the three pre-rasterization stages, and
+        // nothing else here should start refusing draws GL accepts.
+        //
+        // On the DRAW path only, never in ValidateProgramForExecution itself, so a dispatch -
+        // which shares that helper and legitimately has no vertex stage - is untouched.
+        const Bool hasPreRasterizationStage = currentProgram->HasLinkedShaderStage(ShaderStage::Geometry) ||
+                                              currentProgram->HasLinkedShaderStage(ShaderStage::TessControl) ||
+                                              currentProgram->HasLinkedShaderStage(ShaderStage::TessEval);
+        if (hasPreRasterizationStage && !currentProgram->HasLinkedShaderStage(ShaderStage::Vertex)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", functionName,
+                    "The program in use runs a geometry or tessellation stage but has no vertex shader stage."));
+            return false;
+        }
+
+        return true;
+    }
+
+    // gl_NumSamples has no SPIR-V built-in, so the source pipeline lowers it onto a reserved
+    // default-block uniform (see InjectNumSamplesBuiltinShim). This is where that uniform is paid
+    // for: the value is a property of the DRAW FRAMEBUFFER, not of the program, so one program
+    // drawn into a 4x target and then into the default framebuffer must see 4 and then 1 - which
+    // rules out baking it at link time.
+    //
+    // Per draw rather than on framebuffer changes because the pair (program, framebuffer) is what
+    // decides the value and either half can move between draws. It costs a phase-A flag read for
+    // every program that has no shim, and a 4-byte compare for the ones that do: the write only
+    // bumps the UBO content version when the number actually changes, so a run of draws into one
+    // framebuffer re-uploads nothing.
+    static void PublishDrawFramebufferSampleCount(const SharedPtr<MG_State::GLState::ProgramObject>& program) {
+        if (!program || !program->UsesReservedNumSamples()) return;
+        // GL 4.6 core 15.2.2: gl_NumSamples is the number of samples in the framebuffer, or ONE
+        // when the target is not multisampled - where glGetIntegerv(GL_SAMPLES) answers zero.
+        program->WriteReservedNumSamples(static_cast<Int>(std::max<GLint>(ResolveDrawFramebufferSampleCount(), 1)));
+    }
+
+    // The one funnel every drawing command passes through. Order is load-bearing: validate first
+    // (a rejected draw must leave state alone), then publish the sample count - which reads the
+    // DRAW FRAMEBUFFER binding, so it has to run after the caller's framebuffer state is settled
+    // and before the backend consumes the program's UBO content version.
+    static Bool PrepareCurrentProgramForDraw(const char* functionName) {
+        const auto& currentProgram = MG_State::pGLContext->GetProgramForDraw();
+        if (!ValidateResolvedProgramForDraw(currentProgram, functionName)) return false;
+        PublishDrawFramebufferSampleCount(currentProgram);
+        return true;
     }
 
     // A dispatch resolves its program through the DISPATCH accessor: with a pipeline bound
@@ -73,6 +146,20 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_TRIANGLES: return static_cast<Uint64>(count / 3);
         case GL_TRIANGLE_STRIP:
         case GL_TRIANGLE_FAN: return count >= 3 ? static_cast<Uint64>(count - 2) : 0;
+        // Adjacency primitives (GL 4.6 core table 10.1). Only a geometry stage can consume
+        // them, and it is the ADJACENT-free primitive count that reaches it: 4 vertices per
+        // line, 6 per triangle, one per step for the strips. Answering 0 here - which is what
+        // the default arm did - made AccountTransformFeedbackPrimitives bail before it had
+        // recorded anything, so an adjacency capture advanced neither the captured-vertex
+        // counter the scattered-capture path is bounded by nor the geometry-capture-draw flag
+        // that routes the transform feedback queries to the driver's own counter.
+        case GL_LINES_ADJACENCY: return static_cast<Uint64>(count / 4);
+        case GL_LINE_STRIP_ADJACENCY: return count >= 4 ? static_cast<Uint64>(count - 3) : 0;
+        case GL_TRIANGLES_ADJACENCY: return static_cast<Uint64>(count / 6);
+        case GL_TRIANGLE_STRIP_ADJACENCY: return count >= 6 ? static_cast<Uint64>((count - 4) / 2) : 0;
+        // GL_PATCHES is deliberately absent: the tessellator's amplification is not knowable
+        // on the CPU, and answering 0 is what defers GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN
+        // to the driver's own counter, which is the only correct source for a patch capture.
         default: return 0;
         }
     }
@@ -99,11 +186,17 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_LINES:
         case GL_LINE_STRIP:
         case GL_LINE_LOOP:
+        // An adjacency primitive delivers the same line/triangle to the geometry stage; the
+        // adjacent vertices are context, not part of the primitive.
+        case GL_LINES_ADJACENCY:
+        case GL_LINE_STRIP_ADJACENCY:
             verticesPerPrimitive = 2;
             break;
         case GL_TRIANGLES:
         case GL_TRIANGLE_STRIP:
         case GL_TRIANGLE_FAN:
+        case GL_TRIANGLES_ADJACENCY:
+        case GL_TRIANGLE_STRIP_ADJACENCY:
             verticesPerPrimitive = 3;
             break;
         default:
@@ -308,11 +401,21 @@ namespace MobileGL::MG_Impl::GLImpl {
             case GL_POINTS:
                 compatible = mode == GL_POINTS;
                 break;
+            // The adjacency modes belong here too (GL 4.6 core table 13.1, ES 3.2 table 12.1).
+            // This arm is only reached when the program has NO geometry or tessellation
+            // evaluation stage, and without a geometry stage the adjacent vertices are simply
+            // ignored (GL 4.6 core 10.1) - the primitive assembled IS a plain line or triangle,
+            // so the combination is legal and must capture. Omitting them raised a spurious
+            // GL_INVALID_OPERATION and dropped the draw entirely, leaving the capture buffer
+            // with its pre-draw bytes. The geometry-stage input table above already carries the
+            // same four arms; this is the second table catching up with it.
             case GL_LINES:
-                compatible = mode == GL_LINES || mode == GL_LINE_STRIP || mode == GL_LINE_LOOP;
+                compatible = mode == GL_LINES || mode == GL_LINE_STRIP || mode == GL_LINE_LOOP ||
+                             mode == GL_LINES_ADJACENCY || mode == GL_LINE_STRIP_ADJACENCY;
                 break;
             case GL_TRIANGLES:
-                compatible = mode == GL_TRIANGLES || mode == GL_TRIANGLE_STRIP || mode == GL_TRIANGLE_FAN;
+                compatible = mode == GL_TRIANGLES || mode == GL_TRIANGLE_STRIP || mode == GL_TRIANGLE_FAN ||
+                             mode == GL_TRIANGLES_ADJACENCY || mode == GL_TRIANGLE_STRIP_ADJACENCY;
                 break;
             default:
                 break;
@@ -713,6 +816,37 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     }
 
+    // GL 4.6 core 11.2.2. The default tessellation levels a program with an evaluation stage and
+    // NO control stage tessellates at; both backends have to synthesize that control stage
+    // themselves (ES 3.2 and Vulkan both require one), and they compile these numbers into it, so
+    // there is no backend entry point to forward to - ES has none at all. INVALID_ENUM on a bad
+    // pname is the only error the spec lists: any float values are accepted, negatives and NaN
+    // included, and it is the tessellator that clamps them.
+    //
+    // This used to be a stub, which is why the two synthesizers hardcoded 1.0.
+    void PatchParameterfv(GLenum pname, const GLfloat* values) {
+        if (pname != GL_PATCH_DEFAULT_OUTER_LEVEL && pname != GL_PATCH_DEFAULT_INNER_LEVEL) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", __func__,
+                    "pname must be GL_PATCH_DEFAULT_OUTER_LEVEL or GL_PATCH_DEFAULT_INNER_LEVEL."));
+            return;
+        }
+        if (!values) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "values pointer cannot be null"));
+            return;
+        }
+        if (pname == GL_PATCH_DEFAULT_OUTER_LEVEL) {
+            MG_State::pGLContext->SetPatchDefaultOuterLevel(
+                FloatVec4(values[0], values[1], values[2], values[3]));
+        } else {
+            MG_State::pGLContext->SetPatchDefaultInnerLevel(FloatVec2(values[0], values[1]));
+        }
+    }
+
     namespace {
         // GL 4.6 core 7.11.2 (and ARB_shader_image_load_store, which introduced the call): the
         // barrier bitfield is INVALID_VALUE unless every bit is one of the defined ones, with
@@ -751,6 +885,27 @@ namespace MobileGL::MG_Impl::GLImpl {
         memoryBarrier(barriers);
     }
 
+    void TextureBarrier() {
+        // GL 4.5 core 8.26 / GL_ARB_texture_barrier: order every write the fixed-function
+        // framebuffer has already issued ahead of every subsequent texture fetch, so a shader may
+        // read texels of a texture that is also attached to the current framebuffer.
+        //
+        // Both backends serve this through their existing memory-barrier hook rather than a new
+        // entry point of their own: GL_FRAMEBUFFER_BARRIER_BIT is the source half (framebuffer
+        // writes) and GL_TEXTURE_FETCH_BARRIER_BIT the destination half (texture fetches), which
+        // is exactly the dependency ARB_texture_barrier defines - just expressed with the wider
+        // scope glMemoryBarrier gives it. That is a superset of the required ordering, never a
+        // subset, so it cannot under-synchronize.
+        auto memoryBarrier = MG_Backend::gBackendFunctionsTable.GL.MemoryBarrier;
+        if (!memoryBarrier) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "Backend does not support memory barriers."));
+            return;
+        }
+        memoryBarrier(GL_TEXTURE_FETCH_BARRIER_BIT | GL_FRAMEBUFFER_BARRIER_BIT);
+    }
+
     void MemoryBarrierByRegion(GLbitfield barriers) {
         if (!ValidateMemoryBarrierBits(__func__, barriers)) return;
         auto memoryBarrierByRegion = MG_Backend::gBackendFunctionsTable.GL.MemoryBarrierByRegion;
@@ -766,14 +921,14 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void MultiDrawElementsIndirect(GLenum mode, GLenum type, const void* indirect, GLsizei drawcount, GLsizei stride) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         MultiDrawElementsIndirect_Backend(mode, type, indirect, drawcount, stride);
     }
 
     void MultiDrawArraysIndirect(GLenum mode, const void* indirect, GLsizei drawcount, GLsizei stride) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         MultiDrawArraysIndirect_Backend(mode, indirect, drawcount, stride);
     }
@@ -851,7 +1006,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         // NegativeApiErrorsTest.IndirectParameterDrawsCheckBothBuffers pins the INVALID_VALUE
         // they produce for a call made with no program bound. Same precedence decision, and
         // the same reason, as DispatchComputeIndirect above.
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         auto multiDrawElementsIndirectCount = MG_Backend::gBackendFunctionsTable.GL.MultiDrawElementsIndirectCount;
         if (!multiDrawElementsIndirectCount) {
             MG_State::pGLContext->RecordError(
@@ -872,7 +1027,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
         // See MultiDrawElementsIndirectCount, including why this one goes last.
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         auto multiDrawArraysIndirectCount = MG_Backend::gBackendFunctionsTable.GL.MultiDrawArraysIndirectCount;
         if (!multiDrawArraysIndirectCount) {
             MG_State::pGLContext->RecordError(
@@ -887,7 +1042,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DrawRangeElementsBaseVertex(GLenum mode, GLuint start, GLuint end, GLsizei count, GLenum type,
                                      const void* indices, GLint basevertex) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (!ValidateDrawElementsIndexType(__func__, type)) return;
         if (!ValidateNonNegativeDrawArgument(__func__, "count", count)) return;
@@ -897,7 +1052,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawRangeElements(GLenum mode, GLuint start, GLuint end, GLsizei count, GLenum type, const void* indices) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawRangeElements_Backend(mode, start, end, count, type, indices);
     }
@@ -905,7 +1060,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DrawElementsInstancedBaseVertexBaseInstance(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                                      GLsizei instancecount, GLint basevertex, GLuint baseinstance) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawElementsInstancedBaseVertexBaseInstance_Backend(mode, count, type, indices, instancecount, basevertex,
                                                             baseinstance);
@@ -914,7 +1069,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DrawElementsInstancedBaseVertex(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                          GLsizei instancecount, GLint basevertex) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (!ValidateDrawElementsIndexType(__func__, type)) return;
         if (!ValidateNonNegativeDrawArgument(__func__, "count", count)) return;
@@ -925,21 +1080,21 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DrawElementsInstancedBaseInstance(GLenum mode, GLsizei count, GLenum type, const void* indices,
                                            GLsizei instancecount, GLuint baseinstance) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawElementsInstancedBaseInstance_Backend(mode, count, type, indices, instancecount, baseinstance);
     }
 
     void DrawElementsInstanced(GLenum mode, GLsizei count, GLenum type, const void* indices, GLsizei instancecount) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawElementsInstanced_Backend(mode, count, type, indices, instancecount);
     }
 
     void DrawElementsIndirect(GLenum mode, GLenum type, const void* indirect) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (!ValidateDrawElementsIndexType(__func__, type)) return;
         if (!ValidateIndirectDrawSource(__func__, indirect, kDrawElementsIndirectCommandBytes)) return;
@@ -949,21 +1104,21 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DrawArraysInstancedBaseInstance(GLenum mode, GLint first, GLsizei count, GLsizei instancecount,
                                          GLuint baseinstance) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawArraysInstancedBaseInstance_Backend(mode, first, count, instancecount, baseinstance);
     }
 
     void DrawArraysInstanced(GLenum mode, GLint first, GLsizei count, GLsizei instancecount) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         DrawArraysInstanced_Backend(mode, first, count, instancecount);
     }
 
     void DrawArraysIndirect(GLenum mode, const void* indirect) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (!ValidateIndirectDrawSource(__func__, indirect, kDrawArraysIndirectCommandBytes)) return;
         DrawArraysIndirect_Backend(mode, indirect);
@@ -971,7 +1126,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawElementsBaseVertex(GLenum mode, GLsizei count, GLenum type, const void* indices, GLint basevertex) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (!ValidateDrawElementsIndexType(__func__, type)) return;
         if (!ValidateNonNegativeDrawArgument(__func__, "count", count)) return;
@@ -981,7 +1136,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawArrays(GLenum mode, GLint first, GLsizei count) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         AccountTransformFeedbackPrimitives(mode, count);
         DrawArrays_Backend(mode, first, count);
@@ -989,7 +1144,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void MultiDrawArrays(GLenum mode, const GLint* first, const GLsizei* count, GLsizei drawcount) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (drawcount < 0) {
             MG_State::pGLContext->RecordError(
@@ -1003,7 +1158,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     void MultiDrawElements(GLenum mode, const GLsizei* count, GLenum type, const void* const* indices,
                            GLsizei drawcount) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         MultiDrawElements_Backend(mode, count, type, indices, drawcount);
     }
@@ -1011,7 +1166,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     void MultiDrawElementsBaseVertex(GLenum mode, const GLsizei* count, GLenum type, const void* const* indices,
                                      GLsizei drawcount, const GLint* basevertex) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         if (!ValidateDrawElementsIndexType(__func__, type)) return;
         if (!ValidateNonNegativeDrawArgument(__func__, "drawcount", drawcount)) return;
@@ -1035,7 +1190,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void DrawElements(GLenum mode, GLsizei count, GLenum type, const void* indices) {
         if (!ValidatePrimitiveModeEnum(__func__, mode)) return;
-        if (!ValidateCurrentProgramForExecution(__func__)) return;
+        if (!PrepareCurrentProgramForDraw(__func__)) return;
         if (!ValidatePrimitiveModeForBackend(__func__, mode)) return;
         AccountTransformFeedbackPrimitives(mode, count);
         DrawElements_Backend(mode, count, type, indices);
@@ -1459,7 +1614,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     // (GL 4.6 core 10.3.7).
     static void DrawTransformFeedbackImpl(const char* functionName, GLenum mode, GLuint id, GLuint stream,
                                           GLsizei instancecount) {
-        if (!ValidateCurrentProgramForExecution(functionName)) return;
+        if (!PrepareCurrentProgramForDraw(functionName)) return;
         if (!ValidatePrimitiveModeForBackend(functionName, mode)) return;
         if (instancecount < 0) {
             MG_State::pGLContext->RecordError(
@@ -1482,8 +1637,13 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              std::to_string(id) + " is not a transform feedback object name."));
             return;
         }
-        // GL_MAX_VERTEX_STREAMS is 1, so stream 0 is the only one that exists.
-        if (stream != 0) {
+        // GL 4.6 core 10.3.7 bounds `stream` by GL_MAX_VERTEX_STREAMS, which this implementation
+        // answers as 1 - so stream 0 is the only one that exists and anything else is
+        // INVALID_VALUE. Read from the getter rather than written as `stream != 0` so the two can
+        // never drift: if vertex-stream support ever lands, this bound moves with the limit.
+        GLint maxVertexStreams = 1;
+        GetIntegerv(GL_MAX_VERTEX_STREAMS, &maxVertexStreams);
+        if (stream >= static_cast<GLuint>(std::max(maxVertexStreams, 1))) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
@@ -1501,6 +1661,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        // `stream` is provably 0 here (the bound above is 1), so this is stream 0's record.
         const Uint64 vertices = MG_State::pGLContext->GetTransformFeedbackRecordedVertices(id);
         if (vertices == 0) return;
         const auto count = static_cast<GLsizei>(vertices);

MobileGL/MG_Impl/GLImpl/Drawing/GL_Drawing.h

@@ -32,8 +32,10 @@ namespace MobileGL::MG_Impl::GLImpl {
     void DispatchCompute(GLuint numGroupsX, GLuint numGroupsY, GLuint numGroupsZ);
     void DispatchComputeIndirect(GLintptr indirect);
     void PatchParameteri(GLenum pname, GLint value);
+    void PatchParameterfv(GLenum pname, const GLfloat* values);
     void MemoryBarrier(GLbitfield barriers);
     void MemoryBarrierByRegion(GLbitfield barriers);
+    void TextureBarrier();
     void MultiDrawElementsIndirect(GLenum mode, GLenum type, const void* indirect, GLsizei drawcount, GLsizei stride);
     void MultiDrawArraysIndirect(GLenum mode, const void* indirect, GLsizei drawcount, GLsizei stride);
     void MultiDrawElementsIndirectCount(GLenum mode, GLenum type, const void* indirect, GLintptr drawcount,

MobileGL/MG_Impl/GLImpl/Exporting/Definitions.cpp

@@ -160,7 +160,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, ReleaseShaderCompiler) DECLARE_GL_FUNCTION_S
 DECLARE_GL_FUNCTION_HEAD(void, RenderbufferStorage, GLenum target, GLenum internalformat, GLsizei width, GLsizei height) DECLARE_GL_FUNCTION_END_NO_RETURN(void, RenderbufferStorage, target, internalformat, width, height)
 DECLARE_GL_FUNCTION_HEAD(void, SampleCoverage, GLfloat value, GLboolean invert) DECLARE_GL_FUNCTION_END_NO_RETURN(void, SampleCoverage, value, invert)
 DECLARE_GL_FUNCTION_HEAD(void, Scissor, GLint x, GLint y, GLsizei width, GLsizei height) DECLARE_GL_FUNCTION_END_NO_RETURN(void, Scissor, x, y, width, height)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, ShaderBinary, GLsizei count, const GLuint* shaders, GLenum binaryformat, const void* binary, GLsizei length) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ShaderBinary, count, shaders, binaryformat, binary, length)
+DECLARE_GL_FUNCTION_HEAD(void, ShaderBinary, GLsizei count, const GLuint* shaders, GLenum binaryformat, const void* binary, GLsizei length) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ShaderBinary, count, shaders, binaryformat, binary, length)
 DECLARE_GL_FUNCTION_HEAD(void, ShaderSource, GLuint shader, GLsizei count, const GLchar* const* string, const GLint* length) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ShaderSource, shader, count, string, length)
 DECLARE_GL_FUNCTION_HEAD(void, StencilFunc, GLenum func, GLint ref, GLuint mask) DECLARE_GL_FUNCTION_END_NO_RETURN(void, StencilFunc, func, ref, mask)
 DECLARE_GL_FUNCTION_HEAD(void, StencilFuncSeparate, GLenum face, GLenum func, GLint ref, GLuint mask) DECLARE_GL_FUNCTION_END_NO_RETURN(void, StencilFuncSeparate, face, func, ref, mask)
@@ -411,7 +411,7 @@ DECLARE_GL_FUNCTION_HEAD(void, ReadnPixels, GLint x, GLint y, GLsizei width, GLs
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnUniformfv, GLuint program, GLint location, GLsizei bufSize, GLfloat* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnUniformfv, program, location, bufSize, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnUniformiv, GLuint program, GLint location, GLsizei bufSize, GLint* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnUniformiv, program, location, bufSize, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnUniformuiv, GLuint program, GLint location, GLsizei bufSize, GLuint* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnUniformuiv, program, location, bufSize, params)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, MinSampleShading, GLfloat value) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, MinSampleShading, value)
+DECLARE_GL_FUNCTION_HEAD(void, MinSampleShading, GLfloat value) DECLARE_GL_FUNCTION_END_NO_RETURN(void, MinSampleShading, value)
 DECLARE_GL_FUNCTION_HEAD(void, PatchParameteri, GLenum pname, GLint value) DECLARE_GL_FUNCTION_END_NO_RETURN(void, PatchParameteri, pname, value)
 DECLARE_GL_FUNCTION_HEAD(void, TexParameterIiv, GLenum target, GLenum pname, const GLint* params) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TexParameterIiv, target, pname, params)
 DECLARE_GL_FUNCTION_HEAD(void, TexParameterIuiv, GLenum target, GLenum pname, const GLuint* params) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TexParameterIuiv, target, pname, params)
@@ -923,7 +923,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, GetActiveSubroutineName, GLuint program, GLe
 DECLARE_GL_FUNCTION_STUB_HEAD(void, UniformSubroutinesuiv, GLenum shadertype, GLsizei count, const GLuint* indices) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, UniformSubroutinesuiv, shadertype, count, indices)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetUniformSubroutineuiv, GLenum shadertype, GLint location, GLuint* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetUniformSubroutineuiv, shadertype, location, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetProgramStageiv, GLuint program, GLenum shadertype, GLenum pname, GLint* values) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetProgramStageiv, program, shadertype, pname, values)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, PatchParameterfv, GLenum pname, const GLfloat* values) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PatchParameterfv, pname, values)
+DECLARE_GL_FUNCTION_HEAD(void, PatchParameterfv, GLenum pname, const GLfloat* values) DECLARE_GL_FUNCTION_END_NO_RETURN(void, PatchParameterfv, pname, values)
 DECLARE_GL_FUNCTION_HEAD(void, DrawTransformFeedback, GLenum mode, GLuint id) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawTransformFeedback, mode, id)
 DECLARE_GL_FUNCTION_HEAD(void, DrawTransformFeedbackStream, GLenum mode, GLuint id, GLuint stream) DECLARE_GL_FUNCTION_END_NO_RETURN(void, DrawTransformFeedbackStream, mode, id, stream)
 DECLARE_GL_FUNCTION_HEAD(void, BeginQueryIndexed, GLenum target, GLuint index, GLuint id) DECLARE_GL_FUNCTION_END_NO_RETURN(void, BeginQueryIndexed, target, index, id)
@@ -994,7 +994,7 @@ DECLARE_GL_FUNCTION_HEAD(void, BindTextures, GLuint first, GLsizei count, const
 DECLARE_GL_FUNCTION_HEAD(void, BindSamplers, GLuint first, GLsizei count, const GLuint* samplers) DECLARE_GL_FUNCTION_END_NO_RETURN(void, BindSamplers, first, count, samplers)
 DECLARE_GL_FUNCTION_HEAD(void, BindImageTextures, GLuint first, GLsizei count, const GLuint* textures) DECLARE_GL_FUNCTION_END_NO_RETURN(void, BindImageTextures, first, count, textures)
 DECLARE_GL_FUNCTION_HEAD(void, BindVertexBuffers, GLuint first, GLsizei count, const GLuint* buffers, const GLintptr* offsets, const GLsizei* strides) DECLARE_GL_FUNCTION_END_NO_RETURN(void, BindVertexBuffers, first, count, buffers, offsets, strides)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, ClipControl, GLenum origin, GLenum depth) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ClipControl, origin, depth)
+DECLARE_GL_FUNCTION_HEAD(void, ClipControl, GLenum origin, GLenum depth) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ClipControl, origin, depth)
 DECLARE_GL_FUNCTION_HEAD(void, CreateTransformFeedbacks, GLsizei n, GLuint* ids) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CreateTransformFeedbacks, n, ids)
 DECLARE_GL_FUNCTION_HEAD(void, TransformFeedbackBufferBase, GLuint xfb, GLuint index, GLuint buffer) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TransformFeedbackBufferBase, xfb, index, buffer)
 DECLARE_GL_FUNCTION_HEAD(void, TransformFeedbackBufferRange, GLuint xfb, GLuint index, GLuint buffer, GLintptr offset, GLsizeiptr size) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TransformFeedbackBufferRange, xfb, index, buffer, offset, size)
@@ -1107,11 +1107,11 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnConvolutionFilter, GLenum target, GLenum
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnSeparableFilter, GLenum target, GLenum format, GLenum type, GLsizei rowBufSize, void* row, GLsizei columnBufSize, void* column, void* span) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnSeparableFilter, target, format, type, rowBufSize, row, columnBufSize, column, span)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnHistogram, GLenum target, GLboolean reset, GLenum format, GLenum type, GLsizei bufSize, void* values) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnHistogram, target, reset, format, type, bufSize, values)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetnMinmax, GLenum target, GLboolean reset, GLenum format, GLenum type, GLsizei bufSize, void* values) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetnMinmax, target, reset, format, type, bufSize, values)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, TextureBarrier, void) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TextureBarrier, )
-DECLARE_GL_FUNCTION_STUB_HEAD(void, SpecializeShader, GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants, const GLuint* pConstantIndex, const GLuint* pConstantValue) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, SpecializeShader, shader, pEntryPoint, numSpecializationConstants, pConstantIndex, pConstantValue)
+DECLARE_GL_FUNCTION_HEAD(void, TextureBarrier, void) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TextureBarrier, )
+DECLARE_GL_FUNCTION_HEAD(void, SpecializeShader, GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants, const GLuint* pConstantIndex, const GLuint* pConstantValue) DECLARE_GL_FUNCTION_END_NO_RETURN(void, SpecializeShader, shader, pEntryPoint, numSpecializationConstants, pConstantIndex, pConstantValue)
 DECLARE_GL_FUNCTION_HEAD(void, MultiDrawArraysIndirectCount, GLenum mode, const void* indirect, GLintptr drawcount, GLsizei maxdrawcount, GLsizei stride) DECLARE_GL_FUNCTION_END_NO_RETURN(void, MultiDrawArraysIndirectCount, mode, indirect, drawcount, maxdrawcount, stride)
 DECLARE_GL_FUNCTION_HEAD(void, MultiDrawElementsIndirectCount, GLenum mode, GLenum type, const void* indirect, GLintptr drawcount, GLsizei maxdrawcount, GLsizei stride) DECLARE_GL_FUNCTION_END_NO_RETURN(void, MultiDrawElementsIndirectCount, mode, type, indirect, drawcount, maxdrawcount, stride)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, PolygonOffsetClamp, GLfloat factor, GLfloat units, GLfloat clamp) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PolygonOffsetClamp, factor, units, clamp)
+DECLARE_GL_FUNCTION_HEAD(void, PolygonOffsetClamp, GLfloat factor, GLfloat units, GLfloat clamp) DECLARE_GL_FUNCTION_END_NO_RETURN(void, PolygonOffsetClamp, factor, units, clamp)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, PrimitiveBoundingBoxARB, GLfloat minX, GLfloat minY, GLfloat minZ, GLfloat minW, GLfloat maxX, GLfloat maxY, GLfloat maxZ, GLfloat maxW) DECLARE_GL_FUNCTION_STUB_END(void, PrimitiveBoundingBoxARB, minX, minY, minZ, minW, maxX, maxY, maxZ, maxW)
 DECLARE_GL_FUNCTION_STUB_HEAD(GLuint64, GetTextureHandleARB, GLuint texture) DECLARE_GL_FUNCTION_STUB_END(GLuint64, GetTextureHandleARB, texture)
 DECLARE_GL_FUNCTION_STUB_HEAD(GLuint64, GetTextureSamplerHandleARB, GLuint texture, GLuint sampler) DECLARE_GL_FUNCTION_STUB_END(GLuint64, GetTextureSamplerHandleARB, texture, sampler)
@@ -1150,7 +1150,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, GetProgramLocalParameterdvARB, GLenum target
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetProgramLocalParameterfvARB, GLenum target, GLuint index, GLfloat* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetProgramLocalParameterfvARB, target, index, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetProgramStringARB, GLenum target, GLenum pname, void* string) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetProgramStringARB, target, pname, string)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, FramebufferTextureFaceARB, GLenum target, GLenum attachment, GLuint texture, GLint level, GLenum face) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, FramebufferTextureFaceARB, target, attachment, texture, level, face)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, SpecializeShaderARB, GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants, const GLuint* pConstantIndex, const GLuint* pConstantValue) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, SpecializeShaderARB, shader, pEntryPoint, numSpecializationConstants, pConstantIndex, pConstantValue)
+DECLARE_GL_FUNCTION_HEAD(void, SpecializeShaderARB, GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants, const GLuint* pConstantIndex, const GLuint* pConstantValue) DECLARE_GL_FUNCTION_END_NO_RETURN(void, SpecializeShader, shader, pEntryPoint, numSpecializationConstants, pConstantIndex, pConstantValue)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, Uniform1i64ARB, GLint location, GLint64 x) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, Uniform1i64ARB, location, x)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, Uniform2i64ARB, GLint location, GLint64 x, GLint64 y) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, Uniform2i64ARB, location, x, y)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, Uniform3i64ARB, GLint location, GLint64 x, GLint64 y, GLint64 z) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, Uniform3i64ARB, location, x, y, z)
@@ -2049,7 +2049,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, GetPixelTransformParameterivEXT, GLenum targ
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetPixelTransformParameterfvEXT, GLenum target, GLenum pname, GLfloat* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetPixelTransformParameterfvEXT, target, pname, params)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, PointParameterfEXT, GLenum pname, GLfloat param) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PointParameterfEXT, pname, param)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, PointParameterfvEXT, GLenum pname, const GLfloat* params) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PointParameterfvEXT, pname, params)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, PolygonOffsetClampEXT, GLfloat factor, GLfloat units, GLfloat clamp) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, PolygonOffsetClampEXT, factor, units, clamp)
+DECLARE_GL_FUNCTION_HEAD(void, PolygonOffsetClampEXT, GLfloat factor, GLfloat units, GLfloat clamp) DECLARE_GL_FUNCTION_END_NO_RETURN(void, PolygonOffsetClamp, factor, units, clamp)
 DECLARE_GL_FUNCTION_HEAD(void, ProvokingVertexEXT, GLenum mode) DECLARE_GL_FUNCTION_END_NO_RETURN(void, ProvokingVertex, mode)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, RasterSamplesEXT, GLuint samples, GLboolean fixedsamplelocations) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, RasterSamplesEXT, samples, fixedsamplelocations)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, SecondaryColor3bEXT, GLbyte red, GLbyte green, GLbyte blue) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, SecondaryColor3bEXT, red, green, blue)
@@ -2546,7 +2546,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, ShadingRateImageBarrierNV, GLboolean synchro
 DECLARE_GL_FUNCTION_STUB_HEAD(void, ShadingRateImagePaletteNV, GLuint viewport, GLuint first, GLsizei count, const GLenum* rates) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ShadingRateImagePaletteNV, viewport, first, count, rates)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, ShadingRateSampleOrderNV, GLenum order) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ShadingRateSampleOrderNV, order)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, ShadingRateSampleOrderCustomNV, GLenum rate, GLuint samples, const GLint* locations) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, ShadingRateSampleOrderCustomNV, rate, samples, locations)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, TextureBarrierNV, void) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TextureBarrierNV, )
+DECLARE_GL_FUNCTION_HEAD(void, TextureBarrierNV, void) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TextureBarrier, )
 DECLARE_GL_FUNCTION_STUB_HEAD(void, TexImage2DMultisampleCoverageNV, GLenum target, GLsizei coverageSamples, GLsizei colorSamples, GLint internalFormat, GLsizei width, GLsizei height, GLboolean fixedSampleLocations) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TexImage2DMultisampleCoverageNV, target, coverageSamples, colorSamples, internalFormat, width, height, fixedSampleLocations)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, TexImage3DMultisampleCoverageNV, GLenum target, GLsizei coverageSamples, GLsizei colorSamples, GLint internalFormat, GLsizei width, GLsizei height, GLsizei depth, GLboolean fixedSampleLocations) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TexImage3DMultisampleCoverageNV, target, coverageSamples, colorSamples, internalFormat, width, height, depth, fixedSampleLocations)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, TextureImage2DMultisampleNV, GLuint texture, GLenum target, GLsizei samples, GLint internalFormat, GLsizei width, GLsizei height, GLboolean fixedSampleLocations) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, TextureImage2DMultisampleNV, texture, target, samples, internalFormat, width, height, fixedSampleLocations)

MobileGL/MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.cpp

@@ -474,6 +474,75 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
         }
 
+        // GL 4.6 core 9.2.8 conditions that depend only on the framebuffer and the attachment
+        // point. Shared, because glFramebufferTexture / 1D / 2D / 3D / TextureLayer are aliases of
+        // one another in that section and a CTS case that walks the family must not get five
+        // different answers - which is exactly what happened when these lived in one helper that
+        // only two of the five went through.
+        Bool ValidateFramebufferTextureAttachmentPoint(const char* functionName,
+                                                       const SharedPtr<MG_State::GLState::FramebufferObject>&
+                                                           framebufferObject,
+                                                       FramebufferAttachmentType attachmentType) {
+            // "An INVALID_OPERATION error is generated if COLOR_ATTACHMENTm is used with m greater
+            // than or equal to MAX_COLOR_ATTACHMENTS."
+            if (!FramebufferImpl::ValidateColorAttachmentInRange(attachmentType, functionName)) return false;
+            // "An INVALID_OPERATION error is generated if zero is bound to target." MobileGL keeps
+            // a real FramebufferObject for framebuffer 0, so a null test can never see this - the
+            // object is always there, and framebuffer 0 has to be recognised by identity instead,
+            // the same comparison DrawBuffers_State makes. Without this an attach onto the default
+            // framebuffer silently REPLACED its colour attachment, permanently desynchronising it
+            // from what the swapchain keeps publishing.
+            const auto& defaultFramebufferInfo = FramebufferImpl::pDefaultFramebufferInfo;
+            if (!framebufferObject ||
+                (defaultFramebufferInfo && framebufferObject == defaultFramebufferInfo->defaultFBO)) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", functionName,
+                        "No framebuffer object is bound to the target; the default framebuffer's attachments "
+                        "cannot be named."));
+                return false;
+            }
+            return true;
+        }
+
+        // The other half of 9.2.8: "level must be greater than or equal to zero", and for a
+        // texture with immutable storage it "must be smaller than the number of levels the texture
+        // has". Split from the attachment-point half because the caller only has a texture object
+        // once the detach (texture == 0) case is behind it.
+        Bool ValidateFramebufferTextureLevel(const char* functionName,
+                                             const SharedPtr<MG_State::GLState::ITextureObject>& textureObject,
+                                             GLint level) {
+            if (level < 0) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
+                                                 "Texture level must be non-negative."));
+                return false;
+            }
+            if (!textureObject || !textureObject->IsImmutable()) {
+                // A mutable texture has no level bound here: a level it has not specified yet is
+                // not an error, it just leaves the framebuffer incomplete.
+                return true;
+            }
+            // GetAddressableLevelCount(), NOT GetImmutableLevels(): for a VIEW the latter is
+            // deliberately the ORIGINAL texture's count (GL 4.6 core 8.18 defines
+            // TEXTURE_IMMUTABLE_LEVELS on a view that way), which is far too large a bound - a
+            // two-level view onto a ten-level texture would accept level 5 and attach an image
+            // nothing can draw into.
+            const Uint levelBound = textureObject->GetAddressableLevelCount();
+            if (static_cast<Uint>(level) >= levelBound) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", functionName,
+                        std::format("Texture level {} is beyond the {} level(s) this texture has.", level,
+                                    levelBound)));
+                return false;
+            }
+            return true;
+        }
+
         void AttachFramebufferTextureWithUploadTarget(const char* functionName, GLenum target, GLenum attachment,
                                                       GLuint texture, GLint level,
                                                       TextureUploadTarget textureUploadTarget, Bool layered = false) {
@@ -482,10 +551,24 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
 
             if (attachment == GL_DEPTH_STENCIL_ATTACHMENT) {
+                // `layered` has to travel with the split. GL_DEPTH_STENCIL_ATTACHMENT is only a
+                // shorthand for attaching the same image to both halves (GL 4.6 core 9.2.6), so
+                // whether glFramebufferTexture made it LAYERED is a property of the call, not of
+                // which half is being recorded - and dropping it here (the parameter defaults to
+                // false) recorded a non-layered depth/stencil attachment beside a layered colour
+                // one for every layered target. That is an inconsistent framebuffer by 9.4.1's
+                // own rule, and downstream it means the depth/stencil attachment covers layer 0
+                // alone: DirectVulkan built its view with layerCount 1 under a framebuffer
+                // declaring N layers (VUID-VkFramebufferCreateInfo-flags-04535), and DirectGLES
+                // attached one layer of it beside a layered colour target, which the driver
+                // answers with GL_FRAMEBUFFER_INCOMPLETE_LAYER_TARGETS - every draw silently
+                // produced nothing. This is the shape
+                // texture_cube_map_array.stencil_attachments_*_layered and
+                // geometry_shader.layered_framebuffer.stencil_support are built on.
                 AttachFramebufferTextureWithUploadTarget(functionName, target, GL_DEPTH_ATTACHMENT, texture, level,
-                                                        textureUploadTarget);
+                                                        textureUploadTarget, layered);
                 AttachFramebufferTextureWithUploadTarget(functionName, target, GL_STENCIL_ATTACHMENT, texture, level,
-                                                        textureUploadTarget);
+                                                        textureUploadTarget, layered);
                 return;
             }
 
@@ -497,13 +580,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
             auto& bindingSlot = MG_State::pGLContext->GetFramebufferBindingSlot(framebufferTarget);
             auto& framebufferObject = bindingSlot.GetBoundObject();
-            if (!framebufferObject) {
-                MG_State::pGLContext->RecordError(
-                    ErrorCode::InvalidOperation,
-                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
-                                                 "Framebuffer target is bound to no framebuffer object."));
-                return;
-            }
+            if (!ValidateFramebufferTextureAttachmentPoint(functionName, framebufferObject, attachmentType)) return;
 
             if (texture == 0) {
                 framebufferObject->Detach(attachmentType);
@@ -518,6 +595,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                                  std::format("Texture object {} is not valid.", texture)));
                 return;
             }
+            if (!ValidateFramebufferTextureLevel(functionName, textureObject, level)) return;
 
             const auto expectedTextureTarget = MG_Util::ConvertTextureUploadTargetToTextureTarget(textureUploadTarget);
             if (expectedTextureTarget == TextureTarget::Unknown ||
@@ -624,16 +702,33 @@ namespace MobileGL::MG_Impl::GLImpl {
     // GL_MAX_SAMPLES is the ceiling over all formats; an integer format has its own
     // (GL_MAX_INTEGER_SAMPLES) and GL 4.6 core 9.2.4 makes exceeding it INVALID_OPERATION.
     // The multisample TEXTURE path resolves the limit per format the same way
-    // (GL_Texture.cpp, GetMaxSupportedTextureSamples). Both are floored to the value MobileGL
-    // advertises: on a driver where the two differ - Adreno reports GL_MAX_SAMPLES 4 and
-    // GL_MAX_INTEGER_SAMPLES 1 - rejecting the advertised count here only moves the failure
-    // from the driver into MobileGL, so the frontend accepts it and the backend clamps the
-    // count it actually hands the driver.
+    // (GL_Texture.cpp, GetMaxSupportedTextureSamples), and both now enforce exactly what their
+    // pname advertises. The integer ceiling used to be floored at GL_MAX_SAMPLES so that the
+    // frontend would accept a count it had advertised globally - but on Adreno and Mali the
+    // integer path is genuinely one sample, and accepting four only moved the failure from an
+    // honest INVALID_OPERATION here to a silently under-allocated renderbuffer.
+    // The head of the per-format renderbuffer sample list the backend probed, or 0 when nothing
+    // was probed for it. Same shape as GetProbedMaxTextureSamples in GL_Texture.cpp, and reads
+    // the same cache glGetInternalformativ(GL_RENDERBUFFER, ..., GL_SAMPLES) answers from.
+    static Int GetProbedMaxRenderbufferSamples(TextureInternalFormat format) {
+        if (MG_Backend::pActiveBackendObject == nullptr) {
+            return 0;
+        }
+        const SizeT targetIndex = MG_Backend::GetRenderbufferFormatCapabilityTargetIndex();
+        const SizeT formatIndex = static_cast<SizeT>(format);
+        if (targetIndex >= MG_Backend::kFormatCapabilityTargetCount ||
+            formatIndex >= MG_Backend::kFormatCapabilityFormatCount) {
+            return 0;
+        }
+        const auto& sampleCounts =
+            MG_Backend::pActiveBackendObject->GetFormatCapabilities().SampleCounts[targetIndex][formatIndex];
+        return sampleCounts.empty() ? 0 : sampleCounts.front();
+    }
+
     Int GetMaxRenderbufferSamplesForFormat_State(TextureInternalFormat format) {
         if (MG_Backend::pActiveBackendObject == nullptr) {
             return std::numeric_limits<Int>::max();
         }
-        const auto& dynamicParameters = MG_Backend::pActiveBackendObject->GetDynamicParameters();
 
         GLenum normalizedInternalFormat = MG_Util::ConvertTextureInternalFormatToGLEnum(format);
         GLenum normalizedFormat = GL_RGBA;
@@ -644,13 +739,24 @@ namespace MobileGL::MG_Impl::GLImpl {
                                                               &normalizedType);
         const Bool isIntegerFormat = normalizedFormat == GL_RED_INTEGER || normalizedFormat == GL_RG_INTEGER ||
                                      normalizedFormat == GL_RGB_INTEGER || normalizedFormat == GL_RGBA_INTEGER;
+        // The per-format probe first, for the same reason the texture path takes it first: GL 4.6
+        // core 9.2.4 words the error as "samples is greater than the maximum number of samples
+        // supported for internalformat (see GetInternalformativ)", and
+        // glGetInternalformativ(GL_RENDERBUFFER, ..., GL_SAMPLES) is answered from exactly this
+        // list. It was never consulted here - the TODO that deferred it was written before the
+        // query was backed and had gone stale - so a format whose multisample probes fail inside
+        // a category that allows four was accepted at four, quietly allocated at one by
+        // ClampSamplesToBackendSupport, and then reported as four by
+        // glGetRenderbufferParameteriv(GL_RENDERBUFFER_SAMPLES).
+        const Int probedMaxSamples = GetProbedMaxRenderbufferSamples(format);
+        if (probedMaxSamples > 0) {
+            return probedMaxSamples;
+        }
         if (!isIntegerFormat) {
             return GetMaxRenderbufferSamples_State();
         }
-        // Per-format still, but never below the ceiling glGetIntegerv(GL_MAX_SAMPLES) promised:
-        // the driver's raw GL_MAX_INTEGER_SAMPLES stays the *backend* limit and the backend
-        // clamps to it, while the frontend honours what it advertised.
-        return std::max(dynamicParameters.MaxIntegerSamples, GetAdvertisedMaxSamples());
+        // Exactly what glGetIntegerv(GL_MAX_INTEGER_SAMPLES) reports.
+        return GetAdvertisedIntegerMaxSamples();
     }
 
     Bool ValidateRenderbufferStorageSize_State(GLsizei width, GLsizei height, const char* caller) {
@@ -682,8 +788,10 @@ namespace MobileGL::MG_Impl::GLImpl {
             return false;
         }
 
-        // TODO: Resolve the remaining per-internalformat renderbuffer sample limits once
-        // glGetInternalformativ is backed; integer formats are handled below.
+        // Per-internalformat, from the probe list glGetInternalformativ answers with, falling back
+        // to the format's category pname where nothing was probed. (This carried a TODO deferring
+        // the per-format resolution "once glGetInternalformativ is backed"; it has been backed for
+        // both renderbuffers and multisample textures since, so the deferral was collected.)
         const Int maxSamples = GetMaxRenderbufferSamplesForFormat_State(format);
         if (samples > maxSamples) {
             // GL 4.6 core 9.2.4 makes asking for more samples than the format supports
@@ -1048,13 +1156,7 @@ namespace MobileGL::MG_Impl::GLImpl {
 
         auto& bindingSlot = MG_State::pGLContext->GetFramebufferBindingSlot(framebufferTarget);
         auto& framebufferObject = bindingSlot.GetBoundObject();
-        if (!framebufferObject) {
-            MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidOperation,
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,
-                                             "Framebuffer target is bound to no framebuffer object."));
-            return;
-        }
+        if (!ValidateFramebufferTextureAttachmentPoint(functionName, framebufferObject, attachmentType)) return;
 
         if (texture == 0) {
             framebufferObject->Detach(attachmentType);
@@ -1069,6 +1171,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              std::format("Texture object {} is not valid.", texture)));
             return;
         }
+        if (!ValidateFramebufferTextureLevel(functionName, textureObject, level)) return;
         if (layer < 0) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
@@ -1191,6 +1294,13 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Framebuffer target is bound to no framebuffer object."));
             return;
         }
+        // glFramebufferTexture2D is by far the most-used member of the family and the only one
+        // that inlines its own logic instead of going through the shared helper, so the 9.2.8
+        // conditions have to be asked here explicitly.
+        if (!ValidateFramebufferTextureAttachmentPoint("FramebufferTexture2D_State", framebufferObject,
+                                                       attachmentType)) {
+            return;
+        }
 
         if (texture == 0) {
             framebufferObject->Detach(attachmentType);
@@ -1205,6 +1315,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              std::format("Texture object {} is not valid.", texture)));
             return;
         }
+        if (!ValidateFramebufferTextureLevel("FramebufferTexture2D_State", textureObject, level)) return;
 
         const auto expectedTextureTarget = MG_Util::ConvertTextureUploadTargetToTextureTarget(textureUploadTarget);
         if (expectedTextureTarget == TextureTarget::Unknown ||
@@ -1241,6 +1352,12 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        // The name's validity is an INVALID_VALUE condition (GL 4.6 core 9.2.8), and it has to be
+        // asked BEFORE the object is resolved: reporting the miss as the INVALID_OPERATION below
+        // pre-empted the shared helper's ValidateTextureName and answered the wrong error code for
+        // every texture name that was never generated.
+        if (!TextureImpl::ValidateTextureName(texture, true)) return;
+
         auto& textureObject = MG_State::pGLContext->GetTextureObject(texture);
         if (!textureObject) {
             MG_State::pGLContext->RecordError(
@@ -1291,13 +1408,10 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              std::format("Texture object {} is not valid.", texture)));
             return;
         }
-        if (level < 0) {
-            MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidValue,
-                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "NamedFramebufferTexture_State",
-                                             "Texture level must be non-negative."));
-            return;
-        }
+        // The whole level condition, not just its negative half: glNamedFramebufferTexture and
+        // glFramebufferTexture are equivalent in 9.2.8, so an out-of-range immutable level has to
+        // be rejected on both or a CTS case gets two answers for one rule.
+        if (!ValidateFramebufferTextureLevel("NamedFramebufferTexture_State", textureObject, level)) return;
 
         TextureUploadTarget textureUploadTarget = TextureUploadTarget::Unknown;
         Bool layered = false;

MobileGL/MG_Impl/GLImpl/Getter/GL_Getter.cpp

@@ -7,7 +7,9 @@
 // End of Source File Header
 
 #include "GL_Getter.h"
+#include <algorithm>
 #include <cmath>
+#include <limits>
 #include <Config.h>
 #include <MGGitHash.h>
 #include <MG_Impl/GLImpl/Debug/GL_Debug.h>
@@ -93,8 +95,15 @@ namespace MobileGL::MG_Impl::GLImpl {
         // limits they advertise still have to be legal.
         constexpr GLint kFrontendMaxDebugGroupStackDepth = 64;
         constexpr GLint kFrontendMaxDebugLoggedMessages = 1;
-        constexpr GLint kFrontendMaxVertexUniformComponents = 4096;
-        constexpr GLint kFrontendMaxVertexUniformVectors = 128;
+        // The *_VECTORS answers are the *_COMPONENTS ones divided by four, never a second
+        // literal: they used to be independent (4096 components against 128 vectors, 64 varying
+        // components against 8 varying vectors) and could not both be describing the same
+        // capacity. Both are shared with BuildTBuiltInResource through Types.h, because
+        // gl_MaxVertexUniformVectors and gl_MaxVaryingVectors expand from the same numbers.
+        constexpr GLint kFrontendMaxVertexUniformComponents =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_VERTEX_UNIFORM_COMPONENTS);
+        constexpr GLint kFrontendMaxVertexUniformVectors =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_VERTEX_UNIFORM_VECTORS);
         constexpr GLint kFrontendMaxVertexUniformBlocks = 14;
         constexpr GLint kFrontendMaxVertexOutputComponents = 64;
         constexpr GLint kFrontendMaxFragmentInputComponents = 128;
@@ -106,21 +115,61 @@ namespace MobileGL::MG_Impl::GLImpl {
         constexpr GLint kFrontendMaxGeometryTextureImageUnits = 16;
         constexpr GLint kFrontendMaxGeometryUniformComponents = 1024;
         constexpr GLint kFrontendMaxGeometryUniformBlocks = 14;
-        constexpr GLint kFrontendMaxCombinedUniformBlocks = kFrontendMaxVertexUniformBlocks +
-                                                            kFrontendMaxGeometryUniformBlocks +
-                                                            kFrontendMaxFragmentUniformBlocks;
-        constexpr GLint kFrontendMaxVaryingComponents = 64;
-        constexpr GLint kFrontendMaxVaryingVectors = 8;
+        // ARB_geometry_shader4's per-invocation count. No TBuiltInResource field and no
+        // gl_MaxGeometryShaderInvocations built-in exists to keep in step, so this is a getter
+        // answer only; 32 is the GL 4.6 core minimum (table 23.57).
+        constexpr GLint kFrontendMaxGeometryShaderInvocations = 32;
+        constexpr GLint kFrontendMaxTessControlUniformBlocks = 14;
+        constexpr GLint kFrontendMaxTessEvaluationUniformBlocks = 14;
+        // The compute stage's share of the combined sum below. Compute's own per-stage answer is
+        // backend-derived (GL_MAX_COMPUTE_UNIFORM_BLOCKS reads dynamicParameters), so this is not
+        // what that query returns - it is the GL 4.3 core minimum, present here only so the
+        // combined total covers all SIX stages.
+        constexpr GLint kFrontendMaxComputeUniformBlocksShare = 14;
+        // GL 4.6 table 23.64 orders MAX_UNIFORM_BUFFER_BINDINGS >= MAX_COMBINED_UNIFORM_BLOCKS >=
+        // every per-stage count, and the sum has to run over SIX stages, not three and not five.
+        // Three (42) was the original bug. Five (70) replaced it and broke the middle term the
+        // other way: compute's per-stage count is backend-derived and clamps at the binding count,
+        // so a device reporting descriptor-indexing-scale uniform buffers (Adreno reports
+        // maxPerStageDescriptorUniformBuffers = 16777216) advertised 84 compute blocks against a
+        // combined 70. Six stages x 14 = 84, which is also exactly the binding-point count and the
+        // arithmetic the GL 4.5 minimum of 84 bindings is built from, so the ordering is now tight
+        // rather than accidental.
+        constexpr GLint kFrontendMaxCombinedUniformBlocks =
+            kFrontendMaxVertexUniformBlocks + kFrontendMaxTessControlUniformBlocks +
+            kFrontendMaxTessEvaluationUniformBlocks + kFrontendMaxGeometryUniformBlocks +
+            kFrontendMaxFragmentUniformBlocks + kFrontendMaxComputeUniformBlocksShare;
+        constexpr GLint kFrontendMaxVaryingComponents =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_VARYING_COMPONENTS);
+        constexpr GLint kFrontendMaxVaryingVectors =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_VARYING_VECTORS);
         constexpr GLint kFrontendMaxProgramTexelOffset = 7;
         constexpr GLint kFrontendMinProgramTexelOffset = -8;
         constexpr GLint kFrontendMaxTransformFeedbackInterleavedComponents = 64;
         constexpr GLint kFrontendMaxTransformFeedbackSeparateAttribs = 4;
         constexpr GLint kFrontendMaxTransformFeedbackSeparateComponents = 4;
+        // ARB_transform_feedback3's vertex-stream count. One is what this implementation can
+        // actually emit to; see the GL_MAX_VERTEX_STREAMS case for why it is not four.
+        constexpr GLint kFrontendMaxVertexStreams = 1;
         constexpr GLint kFrontendMaxGeometryOutputVertices = 256;
         constexpr GLint kFrontendMaxGeometryTotalOutputComponents = 1024;
-        constexpr GLint kFrontendMinUniformBufferBindings = 36;
+        // GL 4.5 core table 23.64 requires 84 indexed uniform binding points, and that is exactly
+        // how wide the state layer's array is (BufferState::BufferBindingPointCount) - see the
+        // GL_MAX_UNIFORM_BUFFER_BINDINGS case for why the ES driver's own, smaller count is not
+        // the ceiling here.
+        constexpr GLint kFrontendMinUniformBufferBindings = 84;
         constexpr GLint kFrontendSubpixelBits = 4;
-        constexpr GLint kFrontendMaxSamples = 4;
+        constexpr GLint kFrontendMaxSamples =
+            static_cast<GLint>(MG_Util::ShaderTranspiler::MIN_ADVERTISED_MAX_SAMPLES);
+        // ARB_shader_subroutine's two limits. NOTHING IMPLEMENTS SUBROUTINES: there is no
+        // glGetSubroutineIndex / glUniformSubroutinesuiv, only the program-interface enum
+        // plumbing. These are answered - with the GL 4.5 core minimums - because the conformance
+        // suite queries them before it checks for the feature and an INVALID_ENUM both leaves the
+        // caller reading its own uninitialised stack slot and strands an error for the next
+        // unrelated call to trip over. The extension is deliberately NOT advertised, so the
+        // numbers are a table entry, not a capability claim.
+        constexpr GLint kFrontendMaxSubroutines = 256;
+        constexpr GLint kFrontendMaxSubroutineUniformLocations = 1024;
 
         // The floors under GL_MAX_COMPUTE_WORK_GROUP_COUNT / _SIZE. Shared with the compile
         // pipeline (CaptureCompileEnv floors the same driver answers at them, and
@@ -134,9 +183,19 @@ namespace MobileGL::MG_Impl::GLImpl {
             return index < 3 ? static_cast<GLint>(MG_Util::ShaderTranspiler::MIN_COMPUTE_WORK_GROUP_SIZE[index]) : 0;
         }
 
+        // GL 4.6 core table 23.64: components + blocks * (blockSize / 4). The product has to be
+        // formed in 64 bits and saturated on the way out - it overflowed a signed 32-bit int on
+        // every Vulkan host that reports a large maxUniformBufferRange. A Mali driver answering
+        // 0xFFFFFFFF saturates to INT32_MAX in the loader, and 14 * (2147483647 / 4) + 4096 wraps
+        // to -1073737742, which the conformance suite read back as a limit "smaller than 58368".
+        // Saturating instead of wrapping is also the only honest answer: an implementation that
+        // can serve more components than a GLint holds still has to report a GLint.
         GLint GetMaxCombinedUniformComponents(GLint maxDefaultUniformComponents, GLint maxUniformBlocks,
                                               GLint maxUniformBlockSizeBytes) {
-            return maxDefaultUniformComponents + maxUniformBlocks * (maxUniformBlockSizeBytes / 4);
+            const Int64 blocks = std::max<Int64>(static_cast<Int64>(maxUniformBlocks), 0);
+            const Int64 componentsPerBlock = std::max<Int64>(static_cast<Int64>(maxUniformBlockSizeBytes), 0) / 4;
+            const Int64 total = static_cast<Int64>(maxDefaultUniformComponents) + blocks * componentsPerBlock;
+            return static_cast<GLint>(std::min<Int64>(total, std::numeric_limits<GLint>::max()));
         }
 
         bool TryDecodeIndexedBufferQuery(GLenum pname, BufferTarget& bufferTarget, IndexedBufferQueryKind& queryKind) {
@@ -304,24 +363,6 @@ namespace MobileGL::MG_Impl::GLImpl {
             return true;
         }
 
-        GLint ResolveDrawFramebufferSampleCount() {
-            const auto& drawFbo =
-                MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Draw).GetBoundObject();
-            if (!drawFbo) return 0;
-
-            GLint maxSamples = 0;
-            for (const auto& attachment : drawFbo->GetAllAttachmentObjects()) {
-                if (attachment.IsRenderbuffer() && attachment.GetRenderbuffer()) {
-                    maxSamples = std::max(maxSamples, static_cast<GLint>(attachment.GetRenderbuffer()->GetSamples()));
-                } else if (attachment.IsTexture() && attachment.GetTexture()) {
-                    // Multisample texture attachments count too (GL_SAMPLE_BUFFERS must
-                    // report 1 for any multisampled draw framebuffer).
-                    maxSamples = std::max(maxSamples, static_cast<GLint>(attachment.GetTexture()->GetSamples()));
-                }
-            }
-            return maxSamples;
-        }
-
         void RecordIndexedOnlyGetterError(const char* functionName, GLenum pname) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidEnum,
@@ -473,10 +514,18 @@ namespace MobileGL::MG_Impl::GLImpl {
     } // namespace
 
     // GL 4.6 core table 23.53 requires GL_MAX_SAMPLES >= 4, so the driver's value is floored
-    // before it is advertised. Every other multisample ceiling MobileGL advertises has to be
-    // floored the same way: promising 4 samples globally while answering GL_MAX_INTEGER_SAMPLES
-    // 1 - which is exactly what Adreno reports - makes the frontend reject the very count it
-    // just told the application to use. The backends clamp the realised count instead.
+    // before it is advertised. gl_MaxSamples expands from the same floored number
+    // (BuildTBuiltInResource), which is also what sizes gl_SampleMask[].
+    //
+    // THE FLOOR STOPS HERE, and that is the point. It used to be applied to
+    // GL_MAX_INTEGER_SAMPLES, GL_MAX_COLOR_TEXTURE_SAMPLES and GL_MAX_DEPTH_TEXTURE_SAMPLES too,
+    // on the reasoning that an application reads GL_MAX_SAMPLES once and hands that count to
+    // every glTexStorage*Multisample. Table 23.53 gives those three a minimum of ONE, and the
+    // reasoning had it backwards: Adreno and Mali back an integer multisample texture with a
+    // single sample, so flooring the query at 4 did not make four samples exist - it made the
+    // backend silently under-allocate (ClampSamplesToBackendSupport) while the application wrote
+    // per-sample data it could never read back. Reporting what was probed turns that into an
+    // honest "unsupported" the application can branch on.
     GLint GetAdvertisedMaxSamples() {
         if (MG_Backend::pActiveBackendObject == nullptr) {
             return kFrontendMaxSamples;
@@ -484,6 +533,50 @@ namespace MobileGL::MG_Impl::GLImpl {
         return std::max(MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxSamples, kFrontendMaxSamples);
     }
 
+    // GL 4.6 core table 23.53 minimum for the per-category multisample ceilings. One, not four:
+    // see the note on GetAdvertisedMaxSamples. A zero would be a probe that never ran, so it is
+    // floored rather than trusted.
+    namespace {
+        GLint AdvertisedCategoryMaxSamples(Int MG_Backend::DynamicBackendParameters::*categoryLimit) {
+            if (MG_Backend::pActiveBackendObject == nullptr) {
+                return 1;
+            }
+            return std::max(MG_Backend::pActiveBackendObject->GetDynamicParameters().*categoryLimit, 1);
+        }
+    } // namespace
+
+    GLint GetAdvertisedColorTextureMaxSamples() {
+        return AdvertisedCategoryMaxSamples(&MG_Backend::DynamicBackendParameters::MaxColorTextureSamples);
+    }
+
+    GLint GetAdvertisedDepthTextureMaxSamples() {
+        return AdvertisedCategoryMaxSamples(&MG_Backend::DynamicBackendParameters::MaxDepthTextureSamples);
+    }
+
+    GLint GetAdvertisedIntegerMaxSamples() {
+        return AdvertisedCategoryMaxSamples(&MG_Backend::DynamicBackendParameters::MaxIntegerSamples);
+    }
+
+    // Declared in GL_Getter.h, so that the draw path can feed the same number to the reserved
+    // gl_NumSamples stand-in that glGetIntegerv(GL_SAMPLES) reports.
+    GLint ResolveDrawFramebufferSampleCount() {
+        const auto& drawFbo =
+            MG_State::pGLContext->GetFramebufferBindingSlot(FramebufferTarget::Draw).GetBoundObject();
+        if (!drawFbo) return 0;
+
+        GLint maxSamples = 0;
+        for (const auto& attachment : drawFbo->GetAllAttachmentObjects()) {
+            if (attachment.IsRenderbuffer() && attachment.GetRenderbuffer()) {
+                maxSamples = std::max(maxSamples, static_cast<GLint>(attachment.GetRenderbuffer()->GetSamples()));
+            } else if (attachment.IsTexture() && attachment.GetTexture()) {
+                // Multisample texture attachments count too (GL_SAMPLE_BUFFERS must
+                // report 1 for any multisampled draw framebuffer).
+                maxSamples = std::max(maxSamples, static_cast<GLint>(attachment.GetTexture()->GetSamples()));
+            }
+        }
+        return maxSamples;
+    }
+
     /* @INSERTION_POINT:FUNCTION_IMPLEMENTATION@ */
     const GLubyte* GetString(GLenum name) {
         static String vendorString;
@@ -680,12 +773,30 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         case GL_MIN_FRAGMENT_INTERPOLATION_OFFSET:
         case GL_MAX_FRAGMENT_INTERPOLATION_OFFSET:
-        case GL_FRAGMENT_INTERPOLATION_OFFSET_BITS: {
+        case GL_FRAGMENT_INTERPOLATION_OFFSET_BITS:
+        // Same reason as the three above: the integer fallback would round the fraction to 0
+        // or 1 first, so a 0.25 sample-shading rate would answer GL_FALSE.
+        case GL_MIN_SAMPLE_SHADING_VALUE: {
             GLfloat value = 0.0f;
             GetFloatv(pname, &value);
             *params = value != 0.0f ? GL_TRUE : GL_FALSE;
             return;
         }
+        // Float-native state, so GL 4.6 core 2.2.2's "zero becomes FALSE, every other value
+        // becomes TRUE" has to be applied to the VALUE. Answering these through the integer getter
+        // below instead - which rounds - reported GL_FALSE for a perfectly non-zero level of 0.25,
+        // and every other float state in this function already reads through GetFloatv for exactly
+        // that reason.
+        case GL_PATCH_DEFAULT_OUTER_LEVEL:
+        case GL_PATCH_DEFAULT_INNER_LEVEL: {
+            const GLsizei componentCount = pname == GL_PATCH_DEFAULT_OUTER_LEVEL ? 4 : 2;
+            GLfloat levels[4] = {};
+            GetFloatv(pname, levels);
+            for (GLsizei i = 0; i < componentCount; ++i) {
+                params[i] = levels[i] != 0.0f ? GL_TRUE : GL_FALSE;
+            }
+            return;
+        }
         default:
             break;
         }
@@ -735,6 +846,22 @@ namespace MobileGL::MG_Impl::GLImpl {
             params[1] = depthRange.y();
             return;
         }
+        // glPatchParameterfv's two states. Float-native, so they are answered here rather than
+        // through the integer fallback below - which rounds, and would report 0 for a level of 0.5.
+        case GL_PATCH_DEFAULT_OUTER_LEVEL: {
+            const FloatVec4& outer = MG_State::pGLContext->GetPatchDefaultOuterLevel();
+            params[0] = outer.x();
+            params[1] = outer.y();
+            params[2] = outer.z();
+            params[3] = outer.w();
+            return;
+        }
+        case GL_PATCH_DEFAULT_INNER_LEVEL: {
+            const FloatVec2& inner = MG_State::pGLContext->GetPatchDefaultInnerLevel();
+            params[0] = inner.x();
+            params[1] = inner.y();
+            return;
+        }
         case GL_VIEWPORT_BOUNDS_RANGE: {
             const auto& dynamicParameters = MG_Backend::pActiveBackendObject->GetDynamicParameters();
             params[0] = dynamicParameters.ViewportBoundsRangeMin;
@@ -800,6 +927,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_POLYGON_OFFSET_UNITS:
             params[0] = MG_State::pGLContext->GetPolygonOffsetUnits();
             return;
+        case GL_POLYGON_OFFSET_CLAMP:
+            // Float-native state, so it is answered here rather than through the integer
+            // fallback: glPolygonOffsetClamp(1, 1, 0.5) must read back as 0.5, not as 0.
+            params[0] = MG_State::pGLContext->GetPolygonOffsetClamp();
+            return;
         case GL_SMOOTH_LINE_WIDTH_RANGE: {
             const auto& dynamicParameters = MG_Backend::pActiveBackendObject->GetDynamicParameters();
             params[0] = dynamicParameters.SmoothLineWidthRangeMin;
@@ -815,6 +947,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_SAMPLE_COVERAGE_VALUE:
             params[0] = MG_State::pGLContext->GetSampleCoverageValue();
             return;
+        case GL_MIN_SAMPLE_SHADING_VALUE:
+            // Float state, so it has to be answered here rather than through the integer
+            // fallback: glMinSampleShading(0.5) must read back as 0.5 and not as 0.
+            params[0] = MG_State::pGLContext->GetMinSampleShadingValue();
+            return;
         case GL_POINT_FADE_THRESHOLD_SIZE:
             // Float state: read it directly so the fractional part is not lost to the integer path.
             params[0] = MG_State::pGLContext->GetPointFadeThresholdSize();
@@ -1186,6 +1323,13 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
 
         switch (pname) {
+        case GL_MAX_ELEMENT_INDEX:
+            // The largest value a GL_UNSIGNED_INT index may take. It has to be answered HERE and
+            // not left to the 32-bit fallback below: the conformance suite reads it with
+            // glGetInteger64v, and widening the saturated GLint would report INT32_MAX where the
+            // spec requires 2^32-1.
+            params[0] = 0xFFFFFFFFLL;
+            return;
         case GL_MAX_SHADER_STORAGE_BLOCK_SIZE:
             if (MG_Backend::pActiveBackendObject) {
                 params[0] = static_cast<GLint64>(
@@ -1222,12 +1366,17 @@ namespace MobileGL::MG_Impl::GLImpl {
         GLint ints[4] = {};
         GetIntegerv(pname, ints);
 
+        // GL 4.6 core 22.1 gives glGetInteger64v the same accepted-pname set as glGetIntegerv, so
+        // every pname the integer getter answers with several components owes them all here too.
+        // A pname that reaches the `default:` arm writes params[0] and leaves the caller's other
+        // components holding whatever they held, with no error to say so.
         switch (pname) {
         case GL_BLEND_COLOR:
         case GL_COLOR_CLEAR_VALUE:
         case GL_COLOR_WRITEMASK:
         case GL_SCISSOR_BOX:
         case GL_VIEWPORT:
+        case GL_PATCH_DEFAULT_OUTER_LEVEL:
             for (int i = 0; i < 4; ++i) {
                 params[i] = static_cast<GLint64>(ints[i]);
             }
@@ -1237,6 +1386,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_MAX_VIEWPORT_DIMS:
         case GL_POINT_SIZE_RANGE:
         case GL_VIEWPORT_BOUNDS_RANGE:
+        case GL_PATCH_DEFAULT_INNER_LEVEL:
             params[0] = static_cast<GLint64>(ints[0]);
             params[1] = static_cast<GLint64>(ints[1]);
             return;
@@ -1268,6 +1418,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_POINT_SIZE_RANGE:
         case GL_SMOOTH_LINE_WIDTH_RANGE:
         case GL_MAX_VIEWPORT_DIMS:
+        case GL_PATCH_DEFAULT_INNER_LEVEL:
             count = 2;
             break;
         case GL_BLEND_COLOR:
@@ -1275,6 +1426,7 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_VIEWPORT:
         case GL_SCISSOR_BOX:
         case GL_COLOR_WRITEMASK:
+        case GL_PATCH_DEFAULT_OUTER_LEVEL:
             count = 4;
             break;
         default:
@@ -1314,6 +1466,15 @@ namespace MobileGL::MG_Impl::GLImpl {
                 *params = 0;
             return;
         }
+        // GL_TEXTURE_BUFFER_BINDING and GL_TEXTURE_BUFFER are the same token (0x8C2A): as a
+        // glGetIntegerv pname it asks which BUFFER object is bound to the buffer-texture target,
+        // not which texture is (that one is GL_TEXTURE_BINDING_BUFFER, handled by the texture-unit
+        // decoder above).
+        case GL_TEXTURE_BUFFER_BINDING: {
+            auto& obj = MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::Texture).GetBoundObject();
+            *params = obj ? static_cast<GLint>(obj->GetExternalIndex()) : 0;
+            return;
+        }
         case GL_BLEND:
             *params = MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::Blend) ? GL_TRUE : GL_FALSE;
             return;
@@ -1369,6 +1530,16 @@ namespace MobileGL::MG_Impl::GLImpl {
             // this single case serves every getter flavor.
             *params = static_cast<GLint>(MG_State::pGLContext->GetClampReadColor());
             return;
+        // glClipControl's two state variables (GL 4.5 core table 23.7). They answer from the
+        // state the entry point records, which is what the conformance suite's initial-value and
+        // set-then-get cases read - the RASTERIZATION half of clip control is a separate,
+        // backend-side question and does not gate the query.
+        case GL_CLIP_ORIGIN:
+            *params = static_cast<GLint>(MG_State::pGLContext->GetClipOrigin());
+            return;
+        case GL_CLIP_DEPTH_MODE:
+            *params = static_cast<GLint>(MG_State::pGLContext->GetClipDepthMode());
+            return;
         case GL_COLOR_CLEAR_VALUE: {
             const FloatVec4& clearColor = MG_State::pGLContext->GetClearColor();
             params[0] = static_cast<GLint>(clearColor.x());
@@ -1657,6 +1828,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_MAX_GEOMETRY_UNIFORM_COMPONENTS:
             *params = kFrontendMaxGeometryUniformComponents;
             return;
+        case GL_MAX_GEOMETRY_SHADER_INVOCATIONS:
+            *params = kFrontendMaxGeometryShaderInvocations;
+            return;
         case GL_MAX_IMAGE_SAMPLES:
             *params = 0; // multisampled image load/store is not exposed by the DirectGLES frontend
             return;
@@ -1710,6 +1884,59 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params =
                 StageStorageBlockCount(&MG_Backend::DynamicBackendParameters::MaxTessEvaluationShaderStorageBlocks);
             return;
+        // The tessellation per-stage resource limits. Every one of these is ALSO a GLSL built-in
+        // constant that BuildTBuiltInResource expands, and the two must report the same number
+        // (KHR-GL45.limits.max_tess_* compares them directly) - which is why the values come from
+        // the shared block in MG_Util/ShaderTranspiler/Types.h rather than from literals here.
+        // They were the whole per-stage tess family: the table had been filled in only where the
+        // honest answer was zero (the atomic counters, the image uniforms) or where a driver
+        // query existed (GL_MAX_PATCH_VERTICES, GL_MAX_TESS_GEN_LEVEL), so every pname whose
+        // answer is a real resource count fell through to GL_INVALID_ENUM.
+        case GL_MAX_TESS_CONTROL_INPUT_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_INPUT_COMPONENTS);
+            return;
+        case GL_MAX_TESS_CONTROL_OUTPUT_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_OUTPUT_COMPONENTS);
+            return;
+        case GL_MAX_TESS_CONTROL_TOTAL_OUTPUT_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_TOTAL_OUTPUT_COMPONENTS);
+            return;
+        case GL_MAX_TESS_CONTROL_TEXTURE_IMAGE_UNITS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_TEXTURE_IMAGE_UNITS);
+            return;
+        case GL_MAX_TESS_CONTROL_UNIFORM_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_UNIFORM_COMPONENTS);
+            return;
+        case GL_MAX_TESS_EVALUATION_INPUT_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_EVALUATION_INPUT_COMPONENTS);
+            return;
+        case GL_MAX_TESS_EVALUATION_OUTPUT_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_EVALUATION_OUTPUT_COMPONENTS);
+            return;
+        case GL_MAX_TESS_EVALUATION_TEXTURE_IMAGE_UNITS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_EVALUATION_TEXTURE_IMAGE_UNITS);
+            return;
+        case GL_MAX_TESS_EVALUATION_UNIFORM_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_EVALUATION_UNIFORM_COMPONENTS);
+            return;
+        case GL_MAX_TESS_PATCH_COMPONENTS:
+            *params = static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_PATCH_COMPONENTS);
+            return;
+        // Routed through the same clamp as every other per-stage block count so the
+        // MAX_UNIFORM_BUFFER_BINDINGS >= MAX_COMBINED_UNIFORM_BLOCKS >= per-stage ordering of
+        // GL 4.6 table 23.64 cannot be broken by the two families moving independently.
+        case GL_MAX_TESS_CONTROL_UNIFORM_BLOCKS:
+            *params = ClampUniformBlockCount(kFrontendMaxTessControlUniformBlocks);
+            return;
+        case GL_MAX_TESS_EVALUATION_UNIFORM_BLOCKS:
+            *params = ClampUniformBlockCount(kFrontendMaxTessEvaluationUniformBlocks);
+            return;
+        case GL_MAX_SUBROUTINES:
+            *params = kFrontendMaxSubroutines;
+            return;
+        case GL_MAX_SUBROUTINE_UNIFORM_LOCATIONS:
+            *params = kFrontendMaxSubroutineUniformLocations;
+            return;
         case GL_MAX_TEXTURE_LOD_BIAS:
             *params = 15; // TODO
             return;
@@ -1755,8 +1982,21 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_NUM_PROGRAM_BINARY_FORMATS:
             *params = 0;
             return;
+        // GL_ARB_spirv_extensions / GL 4.6 core 22.2. An implementation that advertises no
+        // SPIR-V extension answers zero here, and glGetStringi(GL_SPIR_V_EXTENSIONS, i) is then
+        // never legally called - MobileGL runs the module through its own translation pipeline
+        // and relies on no SPIR-V extension to do it, so zero is the true answer rather than a
+        // placeholder.
+        case GL_NUM_SPIR_V_EXTENSIONS:
+            *params = 0;
+            return;
+        // GL_ARB_gl_spirv, core since 4.6: exactly one shader binary format, and the pair has to
+        // agree - an application sizes its GL_SHADER_BINARY_FORMATS array from the count.
         case GL_NUM_SHADER_BINARY_FORMATS:
-            *params = 0; // ShaderBinary entrypoints are stubbed
+            *params = 1;
+            return;
+        case GL_SHADER_BINARY_FORMATS:
+            *params = static_cast<GLint>(GL_SHADER_BINARY_FORMAT_SPIR_V);
             return;
         case GL_PACK_ALIGNMENT:
             *params = MG_State::pGLContext->GetPixelStoreParam(PixelStoreParam::PackAlignment);
@@ -1815,6 +2055,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_PRIMITIVE_RESTART_INDEX:
             *params = static_cast<GLint>(MG_State::pGLContext->GetPrimitiveRestartIndex());
             return;
+        case GL_POLYGON_OFFSET_CLAMP:
+            // Float state (see GetFloatv); rounded to nearest for the integer query per GL 4.6
+            // core 22.1's float-to-integer rule.
+            *params = static_cast<GLint>(std::lround(MG_State::pGLContext->GetPolygonOffsetClamp()));
+            return;
         case GL_PROGRAM_BINARY_FORMATS:
             *params = 0; // program-binary entrypoints are stubbed
             return;
@@ -1900,6 +2145,13 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_SAMPLE_MASK:
             *params = MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::SampleMask) ? GL_TRUE : GL_FALSE;
             return;
+        case GL_SAMPLE_SHADING:
+            *params = MG_State::pGLContext->IsCapabilityEnabled(CapabilityInput::SampleShading) ? GL_TRUE : GL_FALSE;
+            return;
+        case GL_MIN_SAMPLE_SHADING_VALUE:
+            // GL 4.6 core 22.2: a floating-point value queried as an integer rounds to nearest.
+            *params = static_cast<GLint>(std::lround(MG_State::pGLContext->GetMinSampleShadingValue()));
+            return;
         case GL_SAMPLE_MASK_VALUE:
             *params = static_cast<GLint>(MG_State::pGLContext->GetSampleMaskValue());
             return;
@@ -2118,7 +2370,12 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
         case GL_MAX_ELEMENT_INDEX:
-            *params = 1024 * 1024; // TODO
+            // 64-bit state (see GetInteger64v); the 32-bit query saturates, per the GL
+            // state-query conversion rules - the same shape GL_MAX_SHADER_STORAGE_BLOCK_SIZE
+            // uses. The real answer is 2^32-1 because both backends draw with GL_UNSIGNED_INT
+            // indices and neither bounds an index value; the old `1024 * 1024` was a placeholder
+            // that no draw path ever consulted.
+            *params = INT32_MAX;
             return;
         case GL_CONTEXT_PROFILE_MASK:
             // Reports the requested context profile (EGL defaults 3.x contexts to core);
@@ -2174,8 +2431,12 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = dynamicParameters.MaxComputeTextureImageUnits;
             break;
         case GL_MAX_COMBINED_COMPUTE_UNIFORM_COMPONENTS:
+            // The CLAMPED block count, i.e. exactly what GL_MAX_COMPUTE_UNIFORM_BLOCKS answers.
+            // GL 4.6 table 23.64 defines this as the components reachable through the blocks a
+            // stage may declare, so deriving it from the raw backend number described 256 blocks
+            // an application is only ever allowed 84 of.
             *params = GetMaxCombinedUniformComponents(kFrontendMaxComputeUniformComponents,
-                                                      dynamicParameters.MaxComputeUniformBlocks,
+                                                      ClampUniformBlockCount(dynamicParameters.MaxComputeUniformBlocks),
                                                       dynamicParameters.MaxUniformBlockSize);
             break;
         case GL_MAX_COMPUTE_WORK_GROUP_INVOCATIONS:
@@ -2219,16 +2480,16 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = static_cast<GLint>(dynamicParameters.ViewportIndexProvokingVertex);
             break;
         case GL_MAX_COLOR_TEXTURE_SAMPLES:
-            *params = std::max(dynamicParameters.MaxColorTextureSamples, GetAdvertisedMaxSamples());
+            *params = GetAdvertisedColorTextureMaxSamples();
             break;
         case GL_MAX_COMBINED_FRAGMENT_UNIFORM_COMPONENTS:
             *params = GetMaxCombinedUniformComponents(kFrontendMaxFragmentUniformComponents,
-                                                      kFrontendMaxFragmentUniformBlocks,
+                                                      ClampUniformBlockCount(kFrontendMaxFragmentUniformBlocks),
                                                       dynamicParameters.MaxUniformBlockSize);
             break;
         case GL_MAX_COMBINED_GEOMETRY_UNIFORM_COMPONENTS:
             *params = GetMaxCombinedUniformComponents(kFrontendMaxGeometryUniformComponents,
-                                                      kFrontendMaxGeometryUniformBlocks,
+                                                      ClampUniformBlockCount(kFrontendMaxGeometryUniformBlocks),
                                                       dynamicParameters.MaxUniformBlockSize);
             break;
         case GL_MAX_GEOMETRY_OUTPUT_VERTICES:
@@ -2242,14 +2503,14 @@ namespace MobileGL::MG_Impl::GLImpl {
             break;
         case GL_MAX_COMBINED_VERTEX_UNIFORM_COMPONENTS:
             *params = GetMaxCombinedUniformComponents(kFrontendMaxVertexUniformComponents,
-                                                      kFrontendMaxVertexUniformBlocks,
+                                                      ClampUniformBlockCount(kFrontendMaxVertexUniformBlocks),
                                                       dynamicParameters.MaxUniformBlockSize);
             break;
         case GL_MAX_CUBE_MAP_TEXTURE_SIZE:
             *params = dynamicParameters.MaxCubeMapTextureSize;
             break;
         case GL_MAX_DEPTH_TEXTURE_SAMPLES:
-            *params = std::max(dynamicParameters.MaxDepthTextureSamples, GetAdvertisedMaxSamples());
+            *params = GetAdvertisedDepthTextureMaxSamples();
             break;
         case GL_MAX_FRAMEBUFFER_WIDTH:
             *params = dynamicParameters.MaxFramebufferWidth;
@@ -2276,7 +2537,7 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = dynamicParameters.MaxComputeImageUniforms;
             break;
         case GL_MAX_INTEGER_SAMPLES:
-            *params = std::max(dynamicParameters.MaxIntegerSamples, GetAdvertisedMaxSamples());
+            *params = GetAdvertisedIntegerMaxSamples();
             break;
         case GL_MAX_RENDERBUFFER_SIZE:
             *params = dynamicParameters.MaxRenderbufferSize;
@@ -2287,12 +2548,56 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_PATCH_VERTICES:
             *params = static_cast<GLint>(MG_State::pGLContext->GetPatchVertices());
             break;
+        // Float state, so glGetIntegerv rounds it (GL 4.6 core 2.2.2) - the exact values come back
+        // through glGetFloatv. Answered here so glGetBooleanv, which delegates to this getter for
+        // everything its own switch does not handle, does not report INVALID_ENUM for them.
+        case GL_PATCH_DEFAULT_OUTER_LEVEL: {
+            const FloatVec4& outer = MG_State::pGLContext->GetPatchDefaultOuterLevel();
+            for (Uint i = 0; i < 4; ++i) params[i] = static_cast<GLint>(std::lround(outer[i]));
+            break;
+        }
+        case GL_PATCH_DEFAULT_INNER_LEVEL: {
+            const FloatVec2& inner = MG_State::pGLContext->GetPatchDefaultInnerLevel();
+            for (Uint i = 0; i < 2; ++i) params[i] = static_cast<GLint>(std::lround(inner[i]));
+            break;
+        }
+        // GL 4.6 core table 23.66: whether the primitive-restart index terminates a patch.
+        // GL_FALSE is a legal answer and the true one - neither backend cuts a patch short, and
+        // the DirectVulkan draw path relies on this staying false (it resolves primitive restart
+        // to "never" for a PATCH_LIST topology on the strength of it).
+        case GL_PRIMITIVE_RESTART_FOR_PATCHES_SUPPORTED:
+            *params = GL_FALSE;
+            break;
         case GL_MAX_PATCH_VERTICES:
             *params = dynamicParameters.MaxPatchVertices;
             break;
         case GL_MAX_TESS_GEN_LEVEL:
             *params = dynamicParameters.MaxTessGenLevel;
             break;
+        // Same helper, and so the same arithmetic, as every other GL_MAX_COMBINED_*_UNIFORM_
+        // COMPONENTS: default-block components + blocks * (block size / 4). It reproduces the
+        // conformance suite's own formula exactly, so the two cannot drift.
+        case GL_MAX_COMBINED_TESS_CONTROL_UNIFORM_COMPONENTS:
+            *params = GetMaxCombinedUniformComponents(
+                static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_CONTROL_UNIFORM_COMPONENTS),
+                ClampUniformBlockCount(kFrontendMaxTessControlUniformBlocks), dynamicParameters.MaxUniformBlockSize);
+            break;
+        case GL_MAX_COMBINED_TESS_EVALUATION_UNIFORM_COMPONENTS:
+            *params = GetMaxCombinedUniformComponents(
+                static_cast<GLint>(MG_Util::ShaderTranspiler::MAX_TESS_EVALUATION_UNIFORM_COMPONENTS),
+                ClampUniformBlockCount(kFrontendMaxTessEvaluationUniformBlocks), dynamicParameters.MaxUniformBlockSize);
+            break;
+        // ARB_cull_distance. Backend-derived exactly like GL_MAX_CLIP_DISTANCES beside it, and
+        // for a stronger reason: a cull distance discards the whole primitive, so advertising
+        // eight the rasterizer cannot serve turns every culling draw into a silent no-op. Zero is
+        // the honest answer on a host with no cull-distance route, and the conformance suite then
+        // skips the functional cases instead of failing them deep inside a pixel comparison.
+        case GL_MAX_CULL_DISTANCES:
+            *params = dynamicParameters.MaxCullDistances;
+            break;
+        case GL_MAX_COMBINED_CLIP_AND_CULL_DISTANCES:
+            *params = dynamicParameters.MaxCombinedClipAndCullDistances;
+            break;
         case GL_MIN_PROGRAM_TEXTURE_GATHER_OFFSET:
             *params = dynamicParameters.MinProgramTextureGatherOffset;
             break;
@@ -2343,7 +2648,25 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = kFrontendMaxTransformFeedbackSeparateAttribs;
             break;
         case GL_MAX_VERTEX_STREAMS:
-            *params = 1;
+            // ONE, which is under the GL 4.5 core table 23.62 minimum of four and is a known,
+            // deliberate non-conformance. It was briefly raised to 4 on the theory that streams
+            // 1..3 could exist and be permanently empty; measuring that decision refuted it.
+            // Raising the limit un-gates two CTS cases per package across KHR-GL40..GL46 -
+            // transform_feedback.draw_xfb_stream_test (which stops being skipped) and
+            // transform_feedback3.multiple_streams (which stops reporting NotSupported) - and
+            // both then fail, because nothing in the shader pipeline supports layout(stream = N),
+            // EmitStreamVertex or EndStreamPrimitive, and because the query state machine tracks
+            // one active query per TARGET rather than per (target, stream). That is 14 new
+            // failures against 2 gained limits passes, and a 4 nothing can back is the
+            // advertised-caps lie with the sign flipped.
+            //
+            // The real fix is the feature, not the number: per-stream capture needs
+            // layout(stream = N) through the transpiler plus per-(target, stream) query slots,
+            // which DirectVulkan could back with VK_EXT_transform_feedback's geometryStreams and
+            // DirectGLES cannot back at all (ES has no vertex streams). Until that lands, one is
+            // the honest count and every stream-addressing entry point bounds itself by THIS
+            // query, so raising it later moves them all together.
+            *params = kFrontendMaxVertexStreams;
             break;
         case GL_TRANSFORM_FEEDBACK_ACTIVE:
             *params = MG_State::pGLContext->IsTransformFeedbackActive() ? 1 : 0;
@@ -2360,15 +2683,36 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_MAX_TEXTURE_SIZE:
             *params = dynamicParameters.MaxTextureSize;
             break;
-        case GL_MAX_UNIFORM_BUFFER_BINDINGS:
+        case GL_MAX_UNIFORM_BUFFER_BINDINGS: {
             // Never advertise more bindings than the state layer's indexed-binding array can track
             // (BufferState::BufferBindingPointCount): glBindBufferBase rejects indices past that
             // capacity, and the GL CTS per-case state reset calls glBindBufferBase on every
-            // advertised index and expects no error. The floor equals the GL 3.3 core minimum
-            // (36), so the clamp never under-advertises.
+            // advertised index and expects no error. The floor is the GL 4.5 core minimum, and
+            // the array was widened to exactly it, so the two coincide by construction.
+            //
+            // WHY THE BACKEND'S OWN COUNT IS NOT THE CEILING HERE, unlike the shader-storage
+            // family. A GL uniform binding point is where an APPLICATION parks a buffer; it is
+            // not a driver binding point. Neither backend forwards it as one on the draw path:
+            // DirectGLES rebinds the blocks a program declares onto COMPACTED ES points
+            // (BindCurrentProgramWithResources maps block i to ES point i+1) and DirectVulkan
+            // resolves each block to a descriptor. So what the host driver's count bounds is how
+            // many blocks ONE PROGRAM may use, not how many points an application may bind.
+            //
+            // That per-program number is NOT GL_MAX_COMBINED_UNIFORM_BLOCKS (84, the six-stage
+            // sum): no single program can reach it. A graphics program is bounded by the five
+            // graphics stages' per-stage counts, 14 each, so 70 blocks plus the global UBO at ES
+            // point 0 = 71 - inside the ES 3.2 minimum of 72. A compute program is bounded by
+            // GL_MAX_COMPUTE_UNIFORM_BLOCKS, which on DirectGLES is the ES driver's own count
+            // (GL-scale, ~14) and on DirectVulkan is served from descriptors with no ES binding
+            // points involved. Raising any per-stage graphics count past 14 is what would break
+            // this, so that is the edit to check against the ES ceiling - not this one.
+            static_assert(static_cast<GLint>(MG_State::GLState::BufferBindingPointCount) >=
+                              kFrontendMinUniformBufferBindings,
+                          "the indexed-binding array must be able to hold every advertised uniform binding point");
             *params = std::clamp(dynamicParameters.MaxUniformBufferBindings, kFrontendMinUniformBufferBindings,
                                  static_cast<GLint>(MG_State::GLState::BufferBindingPointCount));
             break;
+        }
         case GL_MAX_UNIFORM_BLOCK_SIZE:
             *params = dynamicParameters.MaxUniformBlockSize;
             break;

MobileGL/MG_Impl/GLImpl/Getter/GL_Getter.h

@@ -25,7 +25,24 @@ namespace MobileGL::MG_Impl::GLImpl {
     GLenum GetError();
     GLenum GetGraphicsResetStatus();
     // The GL_MAX_SAMPLES value MobileGL advertises, i.e. the driver's value floored to the GL
-    // core minimum. Frontend multisample validators have to honour this ceiling for every
-    // format, otherwise MobileGL rejects a sample count it advertised itself.
+    // core minimum of 4. This is the RENDERBUFFER ceiling; the three per-category texture
+    // ceilings below have a minimum of one and are reported as probed.
     GLint GetAdvertisedMaxSamples();
+    // Exactly what GL_MAX_COLOR_TEXTURE_SAMPLES / GL_MAX_DEPTH_TEXTURE_SAMPLES /
+    // GL_MAX_INTEGER_SAMPLES report: the probed backend limit floored at the GL 4.6 core minimum
+    // of ONE (table 23.53). Exported so the frontend's storage validation enforces exactly what
+    // the query promised - it used to floor both at 4 and then let the backend quietly
+    // under-allocate whatever the driver could not actually provide.
+    GLint GetAdvertisedColorTextureMaxSamples();
+    GLint GetAdvertisedDepthTextureMaxSamples();
+    GLint GetAdvertisedIntegerMaxSamples();
+    // What glGetIntegerv(GL_SAMPLES) answers for the CURRENT draw framebuffer: the largest sample
+    // count over its attachments, and 0 for a single-sample or default framebuffer (GL 4.6 core
+    // 9.2.3 / 22.2 - GL_SAMPLE_BUFFERS is 1 exactly when this is non-zero).
+    //
+    // Shared rather than duplicated because two callers need the identical number and disagreeing
+    // would be a silent bug: the query itself, and the draw path's write of the reserved
+    // gl_NumSamples stand-in - a shader comparing gl_NumSamples against glGetIntegerv(GL_SAMPLES)
+    // is exactly what the sample_variables CTS does.
+    GLint ResolveDrawFramebufferSampleCount();
 } // namespace MobileGL::MG_Impl::GLImpl

MobileGL/MG_Impl/GLImpl/Program/GL_Program.cpp

@@ -11,6 +11,8 @@
 #include "Config.h"
 #include <cmath>
 #include <limits>
+#include <set>
+#include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
 #include <MG_Impl/GLImpl/VertexArray/Validators.h>
 #include <MG_State/GLState/Core.h>
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
@@ -30,10 +32,22 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     static bool CheckShaderNameValidity(Uint shader) {
         if (shader == 0 || !MG_State::pGLContext->ValidateShaderName(shader)) {
+            // The mirror of CheckProgramNameValidity below, and for the same reason: programs and
+            // shaders are drawn from ONE name space (ProgramState hands both out of a single
+            // generator), so a name that exists but belongs to a PROGRAM is the wrong kind of
+            // object - GL 3.3 core 2.11.x makes that INVALID_OPERATION - while a name GL never
+            // handed out is INVALID_VALUE. This half of the split was missing, so every shader
+            // entry point handed a program name reported INVALID_VALUE; the conformance suite
+            // reads exactly that code back from glSpecializeShader.
+            const ErrorCode error = (shader != 0 && MG_State::pGLContext->ValidateProgramName(shader))
+                ? ErrorCode::InvalidOperation
+                : ErrorCode::InvalidValue;
             MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidValue,
+                error,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
-                                             std::to_string(shader) + " is not a valid name."));
+                                             std::to_string(shader) +
+                                                 (error == ErrorCode::InvalidOperation ? " is not a shader object."
+                                                                                       : " is not a valid name.")));
             return false;
         }
         return true;
@@ -245,6 +259,30 @@ namespace MobileGL::MG_Impl::GLImpl {
         return true;
     }
 
+    // GL 4.6 core 7.6.3: INVALID_VALUE when uniformBlockBinding >= MAX_UNIFORM_BUFFER_BINDINGS.
+    // The storage-block twin below has always had this check; the uniform one never did, and the
+    // value it stores is used as a RAW SUBSCRIPT into the state layer's fixed indexed-binding
+    // array on every draw and dispatch (DirectGLES's per-program UBO rebind, DirectVulkan's
+    // descriptor resolve, whose only guard is a MOBILEGL_ASSERT that compiles away in release).
+    // An out-of-range binding therefore did not merely go unreported - it read past the array and
+    // dereferenced whatever SharedPtr it found there.
+    bool ValidateUniformBlockBinding(GLuint binding) {
+        // Exactly what glGetIntegerv(GL_MAX_UNIFORM_BUFFER_BINDINGS) advertises: the state
+        // layer's array width, which the getter clamps to as well.
+        const SizeT maxBindingCount = MG_State::pGLContext->GetBufferBindingPointCount(BufferTarget::Uniform);
+        if (binding < maxBindingCount) {
+            return true;
+        }
+
+        MG_State::pGLContext->RecordError(
+            ErrorCode::InvalidValue,
+            MakeUnique<GenericErrorInfo>(
+                "MG_Impl/GLImpl", __func__,
+                std::format("Uniform block binding {} is not less than GL_MAX_UNIFORM_BUFFER_BINDINGS ({}).", binding,
+                            maxBindingCount)));
+        return false;
+    }
+
     bool ValidateShaderStorageBlockBinding(GLuint binding) {
         SizeT maxBindingCount = MG_State::pGLContext->GetBufferBindingPointCount(BufferTarget::ShaderStorage);
         if (MG_Backend::pActiveBackendObject) {
@@ -307,9 +345,195 @@ namespace MobileGL::MG_Impl::GLImpl {
     void CompileShader_State(GLuint shader) {
         auto& shaderObject = TryToGetShaderObject(shader);
         if (!shaderObject) return;
+        // ARB_gl_spirv: "INVALID_OPERATION is generated by CompileShader if shader has been
+        // associated with a SPIR-V binary". Such an object has no GLSL source to compile - it is
+        // waiting for glSpecializeShader, which is the operation that compiles it.
+        if (shaderObject->HasSpirvBinary()) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", __func__,
+                    "shader " + std::to_string(shader) +
+                        " holds a SPIR-V binary; use glSpecializeShader instead of glCompileShader."));
+            return;
+        }
         shaderObject->Compile();
     }
 
+    // ---------------------------------------------------------------------------------------
+    // GL_ARB_gl_spirv
+    // ---------------------------------------------------------------------------------------
+
+    void ShaderBinary_State(GLsizei count, const GLuint* shaders, GLenum binaryformat, const void* binary,
+                            GLsizei length) {
+        if (count < 0 || length < 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "count and length must be non-negative."));
+            return;
+        }
+        // GL_NUM_SHADER_BINARY_FORMATS advertises exactly one format, so every other value is
+        // INVALID_ENUM (GL 4.6 core 7.2). This is the check that used to be missing entirely -
+        // the entry point was a silent stub, so an application handed a format nothing supports
+        // and was told nothing.
+        if (binaryformat != GL_SHADER_BINARY_FORMAT_SPIR_V) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "binaryformat must be GL_SHADER_BINARY_FORMAT_SPIR_V."));
+            return;
+        }
+        if (count == 0) return;
+        if (shaders == nullptr || (length > 0 && binary == nullptr)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "shaders and binary must not be null."));
+            return;
+        }
+        // A SPIR-V module is a sequence of 32-bit words, so a length that is not a multiple of
+        // four cannot be one (ARB_gl_spirv makes this INVALID_VALUE).
+        if ((length % 4) != 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "length must be a multiple of four for a SPIR-V module."));
+            return;
+        }
+
+        // EVERY name is validated before ANY of them is written: the entry point is all-or-
+        // nothing, and half-applying it would leave some objects holding a module the call was
+        // rejected for. The duplicate check is the extension's own ("INVALID_VALUE ... if the
+        // same shader object is specified more than once").
+        std::set<GLuint> seen;
+        for (GLsizei i = 0; i < count; ++i) {
+            if (!seen.insert(shaders[i]).second) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                 "shader " + std::to_string(shaders[i]) +
+                                                     " appears more than once in `shaders`."));
+                return;
+            }
+            if (!MG_State::pGLContext->ValidateShaderName(shaders[i])) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                 std::to_string(shaders[i]) + " is not the name of a shader object."));
+                return;
+            }
+        }
+
+        const SizeT wordCount = static_cast<SizeT>(length) / 4;
+        Vector<Uint32> module(wordCount);
+        if (wordCount != 0) {
+            Memcpy(module.data(), binary, static_cast<SizeT>(length));
+        }
+        // spirv-val here, not at glSpecializeShader: this is where the words arrive, and past it
+        // they reach SPIRV-Cross, which parses rather than validates. ARB_gl_spirv lets an
+        // implementation reject an invalid module at either call; rejecting at the earlier one
+        // means the application's error is reported next to the data that caused it.
+        if (const auto validated = MG_Util::ShaderTranspiler::ShaderCompiler::ValidateSpirvModule(module);
+            !validated) {
+            MGLOG_D("%s: rejected SPIR-V module: %s", __func__, validated.error().log.c_str());
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, validated.error().log));
+            return;
+        }
+
+        for (GLsizei i = 0; i < count; ++i) {
+            auto& shaderObject = TryToGetShaderObject(shaders[i]);
+            if (!shaderObject) continue;
+            // A copy per object, not a shared buffer: each shader object may be specialized with
+            // different constants, and each specialization re-reads its own original words.
+            Vector<Uint32> perObject = module;
+            shaderObject->SetSpirvBinary(Move(perObject));
+        }
+    }
+
+    void SpecializeShader_State(GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants,
+                                const GLuint* pConstantIndex, const GLuint* pConstantValue) {
+        auto& shaderObject = TryToGetShaderObject(shader);
+        if (!shaderObject) return;
+        if (!shaderObject->HasSpirvBinary()) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "shader " + std::to_string(shader) +
+                                                 " has no SPIR-V binary; call glShaderBinary first."));
+            return;
+        }
+        // ARB_gl_spirv: a shader that has already been specialized may not be specialized again
+        // until glShaderBinary re-associates a module with it.
+        if (shaderObject->HasBeenSpecialized()) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "shader " + std::to_string(shader) +
+                                                 " has already been specialized; re-associate its module with "
+                                                 "glShaderBinary before specializing it again."));
+            return;
+        }
+        // pEntryPoint names the entry point to specialize; there is no default. A null pointer
+        // cannot name one, and neither can the empty string.
+        if (pEntryPoint == nullptr || *pEntryPoint == '\0') {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "pEntryPoint must name an entry point."));
+            return;
+        }
+        if (numSpecializationConstants > 0 && (pConstantIndex == nullptr || pConstantValue == nullptr)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "pConstantIndex and pConstantValue must not be null."));
+            return;
+        }
+        // "INVALID_VALUE is generated if any value in pConstantIndex is repeated" - checked before
+        // anything is applied, for the same all-or-nothing reason glShaderBinary checks its names
+        // up front.
+        Vector<Uint32> constantIds(pConstantIndex, pConstantIndex + numSpecializationConstants);
+        Vector<Uint32> constantValues(pConstantValue, pConstantValue + numSpecializationConstants);
+        {
+            std::set<Uint32> seen;
+            for (const Uint32 id : constantIds) {
+                if (seen.insert(id).second) continue;
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                 "constant index " + std::to_string(id) + " is repeated."));
+                return;
+            }
+        }
+
+        const String entryPoint(pEntryPoint);
+        const GLenum shaderType = MG_Util::ConvertShaderStageToGLEnum(shaderObject->GetShaderStage());
+        using SpecializationFailure = MG_Util::ShaderTranspiler::ShaderCompiler::SpecializationFailure;
+        SpecializationFailure failure = SpecializationFailure::None;
+        auto specialized = MG_Util::ShaderTranspiler::ShaderCompiler::SpecializeAndDecompileSpirvModule(
+            shaderObject->GetSpirvBinary(), shaderType, entryPoint, constantIds, constantValues, failure);
+        if (!specialized) {
+            MGLOG_D("%s: specialization failed for shader %u: %s", __func__, shader,
+                    specialized.error().log.c_str());
+            // The two conditions ARB_gl_spirv ENUMERATES are GL errors, and an erroring GL command
+            // must have no other effect - so the shader object is left exactly as it was rather
+            // than being pushed into a failed-compile state. Anything else is a genuine compile
+            // failure of a well-formed request, which the extension routes through COMPILE_STATUS
+            // and the info log exactly as glCompileShader does.
+            if (failure == SpecializationFailure::UnknownEntryPoint ||
+                failure == SpecializationFailure::UnknownConstantId) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidValue,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, specialized.error().log));
+                return;
+            }
+            shaderObject->RecordSpecializationFailure(String(specialized.error().log));
+            return;
+        }
+        shaderObject->SpecializeFromSpirv(Move(specialized.value().glsl), Move(specialized.value().xfbVaryings),
+                                          specialized.value().xfbBufferMode);
+    }
+
     // glMaxShaderCompilerThreadsKHR / glMaxShaderCompilerThreadsARB - one implementation,
     // because GL_KHR_parallel_shader_compile and GL_ARB_parallel_shader_compile define the
     // same entry point with the same semantics and GetProcAddress.cpp maps both spellings.
@@ -744,12 +968,77 @@ namespace MobileGL::MG_Impl::GLImpl {
             *params = programObject->GetBinaryRetrievableHint() ? GL_TRUE : GL_FALSE;
             break;
         case GL_PROGRAM_SEPARABLE:
-            *params = programObject->GetSeparable() ? GL_TRUE : GL_FALSE;
+            // The LATCHED flag, not the live one: glProgramParameteri's write takes effect at the
+            // next link (GL 4.6 core 7.3), so a program told to be separable and then never
+            // linked still reports GL_FALSE.
+            *params = programObject->GetLinkedSeparable() ? GL_TRUE : GL_FALSE;
             break;
 
+        // The geometry and tessellation link properties (GL 4.6 core table 23.35). Same shape as
+        // GL_COMPUTE_WORK_GROUP_SIZE above, and for the same reason: "a linked program object
+        // with a geometry shader" is one whose EXECUTABLE has the stage, so an
+        // attached-but-not-yet-linked shader must give INVALID_OPERATION rather than the previous
+        // link's value. The geometry three used to be listed here only to fall through into the
+        // INVALID_ENUM default, and the tessellation five were not listed at all.
         case GL_GEOMETRY_VERTICES_OUT:
         case GL_GEOMETRY_INPUT_TYPE:
         case GL_GEOMETRY_OUTPUT_TYPE:
+        case GL_GEOMETRY_SHADER_INVOCATIONS: {
+            if (!programObject->GetLinkStatus() || !programObject->HasLinkedShaderStage(ShaderStage::Geometry)) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                                 std::to_string(program) +
+                                                     " is not a linked program object with a geometry shader."));
+                return;
+            }
+            switch (pname) {
+            case GL_GEOMETRY_VERTICES_OUT: *params = programObject->GetGeometryVerticesOut(); break;
+            case GL_GEOMETRY_INPUT_TYPE: *params = static_cast<GLint>(programObject->GetGeometryInputType()); break;
+            case GL_GEOMETRY_OUTPUT_TYPE: *params = static_cast<GLint>(programObject->GetGeometryOutputType()); break;
+            default: *params = programObject->GetGeometryShaderInvocations(); break;
+            }
+            MGLOG_D("%s: %s = %d", __func__, MG_Util::ConvertGLEnumToString(pname).c_str(), *params);
+            break;
+        }
+        case GL_TESS_CONTROL_OUTPUT_VERTICES: {
+            if (!programObject->GetLinkStatus() || !programObject->HasLinkedShaderStage(ShaderStage::TessControl)) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", __func__,
+                        std::to_string(program) +
+                            " is not a linked program object with a tessellation control shader."));
+                return;
+            }
+            *params = programObject->GetTessControlOutputVertices();
+            MGLOG_D("%s: %s = %d", __func__, MG_Util::ConvertGLEnumToString(pname).c_str(), *params);
+            break;
+        }
+        case GL_TESS_GEN_MODE:
+        case GL_TESS_GEN_SPACING:
+        case GL_TESS_GEN_VERTEX_ORDER:
+        case GL_TESS_GEN_POINT_MODE: {
+            if (!programObject->GetLinkStatus() || !programObject->HasLinkedShaderStage(ShaderStage::TessEval)) {
+                MG_State::pGLContext->RecordError(
+                    ErrorCode::InvalidOperation,
+                    MakeUnique<GenericErrorInfo>(
+                        "MG_Impl/GLImpl", __func__,
+                        std::to_string(program) +
+                            " is not a linked program object with a tessellation evaluation shader."));
+                return;
+            }
+            switch (pname) {
+            case GL_TESS_GEN_MODE: *params = static_cast<GLint>(programObject->GetTessGenMode()); break;
+            case GL_TESS_GEN_SPACING: *params = static_cast<GLint>(programObject->GetTessGenSpacing()); break;
+            case GL_TESS_GEN_VERTEX_ORDER:
+                *params = static_cast<GLint>(programObject->GetTessGenVertexOrder());
+                break;
+            default: *params = programObject->GetTessGenPointMode() ? GL_TRUE : GL_FALSE; break;
+            }
+            MGLOG_D("%s: %s = %d", __func__, MG_Util::ConvertGLEnumToString(pname).c_str(), *params);
+            break;
+        }
         default:
             MGLOG_D("%s: %s", __func__, MG_Util::ConvertGLEnumToString(pname).c_str());
             MG_State::pGLContext->RecordError(
@@ -811,8 +1100,19 @@ namespace MobileGL::MG_Impl::GLImpl {
             }
             *params = shaderObject->GetInfoLog().empty() ? 0 : (GLint)shaderObject->GetInfoLog().length() + 1;
             break;
-        case GL_SHADER_SOURCE_LENGTH:
-            *params = shaderObject->GetShaderSource().empty() ? 0 : (GLint)shaderObject->GetShaderSource().length() + 1;
+        case GL_SHADER_SOURCE_LENGTH: {
+            // The APPLICATION's source, which is empty for a shader that came from glShaderBinary -
+            // see ShaderObject::GetApplicationShaderSource.
+            const auto& source = shaderObject->GetApplicationShaderSource();
+            *params = source.empty() ? 0 : (GLint)source.length() + 1;
+            break;
+        }
+        // GL_ARB_gl_spirv. GL_SPIR_V_BINARY and GL_SPIR_V_BINARY_ARB are the same token: TRUE
+        // while the object stands for an application-supplied module. It is the FIRST thing the
+        // conformance suite asks after glShaderBinary, and it used to fall into the terminal
+        // default arm below and take the whole test with it.
+        case GL_SPIR_V_BINARY:
+            *params = shaderObject->HasSpirvBinary() ? GL_TRUE : GL_FALSE;
             break;
         // GL_KHR_parallel_shader_compile. THIS CASE MUST NOT JOIN - see the identical case in
         // GetProgramiv_State. GL_COMPILE_STATUS two cases up deliberately DOES join (it has
@@ -858,13 +1158,23 @@ namespace MobileGL::MG_Impl::GLImpl {
         auto& shaderObject = TryToGetShaderObject(shader);
         if (!shaderObject) return;
 
-        auto& src = shaderObject->GetShaderSource();
+        auto& src = shaderObject->GetApplicationShaderSource();
         CopyStr(bufSize, length, source, src.c_str(), (GLsizei)src.length());
     }
 
     GLint GetUniformLocation_State(GLuint program, const GLchar* name) {
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return -1;
+        // GL 4.6 core 7.6: "INVALID_OPERATION is generated if program has not been successfully
+        // linked". Answering -1 silently is not the same thing - the conformance suite reads the
+        // error, not the location.
+        if (!programObject->GetLinkStatus()) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "program " + std::to_string(program) + " is not linked."));
+            return -1;
+        }
         auto loc = programObject->GetUniformLocation(name);
         MGLOG_D("%s: loc %02d = %s", __func__, loc, name);
         return loc;
@@ -1277,11 +1587,13 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     template <GLsizei ItemCount, typename T>
     void ProgramUniformv_State(GLuint program, GLint location, GLsizei count, T* value) {
-        if (location == -1) return;
-
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
 
+        // The link check comes BEFORE the location == -1 early-out, not after. GL 4.6 core 7.6
+        // makes an unlinked program INVALID_OPERATION regardless of the location, and -1 is
+        // exactly the location an application holds after glGetUniformLocation on such a program -
+        // so checking -1 first swallowed the very case the rule exists for.
         if (!programObject->GetLinkStatus()) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidOperation,
@@ -1289,6 +1601,10 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        // "If location is equal to -1, the data passed in will be silently ignored and the
+        // specified uniform variable will not be changed" - after the program itself has been
+        // found acceptable.
+        if (location == -1) return;
 
         for (GLint offset = 0; offset < count; offset++) {
             if (offset > 0 && !programObject->UniformLocationsAliasSameUniform(location, location + offset)) {
@@ -1699,8 +2015,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix2fv_State(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                        const GLfloat* value) {
-        if (location == -1) return;
-
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
 
@@ -1712,14 +2026,14 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        if (location == -1) return;
+
         UniformMatrixfv_Object(*programObject, __func__, location, count, transpose, value, 2, 2,
                                "program " + std::to_string(program));
     }
 
     void ProgramUniformMatrix3fv_State(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                        const GLfloat* value) {
-        if (location == -1) return;
-
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
 
@@ -1731,6 +2045,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        if (location == -1) return;
+
         for (GLint i = 0; i < count; i++) {
             if (i > 0 && !programObject->UniformLocationsAliasSameUniform(location, location + i)) {
                 // Values for elements beyond the end of the uniform array are ignored.
@@ -1756,8 +2072,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix4fv_State(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                        const GLfloat* value) {
-        if (location == -1) return;
-
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
 
@@ -1769,6 +2083,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        if (location == -1) return;
+
         for (GLint i = 0; i < count; i++) {
             if (i > 0 && !programObject->UniformLocationsAliasSameUniform(location, location + i)) {
                 // Values for elements beyond the end of the uniform array are ignored.
@@ -1790,8 +2106,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrixNonSquarefv_State(const char* caller, GLuint program, GLint location, GLsizei count,
                                                GLboolean transpose, const GLfloat* value, Int columns, Int rows) {
-        if (location == -1) return;
-
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
 
@@ -1803,6 +2117,8 @@ namespace MobileGL::MG_Impl::GLImpl {
             return;
         }
 
+        if (location == -1) return;
+
         UniformMatrixfv_Object(*programObject, caller, location, count, transpose, value, columns, rows,
                                "program " + std::to_string(program));
     }
@@ -1836,6 +2152,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "Program object" + std::to_string(program) + " that has been linked."));
             return;
         }
+        if (!ValidateUniformBlockBinding(uniformBlockBinding)) return;
         if (!programObject->IsActiveGlUniformBlock(uniformBlockIndex)) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
@@ -2083,6 +2400,15 @@ namespace MobileGL::MG_Impl::GLImpl {
         BindAttribLocation_State(program, index, name);
     }
 
+    void ShaderBinary(GLsizei count, const GLuint* shaders, GLenum binaryformat, const void* binary, GLsizei length) {
+        ShaderBinary_State(count, shaders, binaryformat, binary, length);
+    }
+
+    void SpecializeShader(GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants,
+                          const GLuint* pConstantIndex, const GLuint* pConstantValue) {
+        SpecializeShader_State(shader, pEntryPoint, numSpecializationConstants, pConstantIndex, pConstantValue);
+    }
+
     void CompileShader(GLuint shader) {
         CompileShader_State(shader);
     }
@@ -2342,7 +2668,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix2dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2352,6 +2677,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 2, 2);
     }
     void UniformMatrix3dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2368,7 +2694,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix3dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2378,6 +2703,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 3, 3);
     }
     void UniformMatrix4dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2394,7 +2720,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix4dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2404,6 +2729,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 4, 4);
     }
     void UniformMatrix2x3dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2420,7 +2746,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix2x3dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2430,6 +2755,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 2, 3);
     }
     void UniformMatrix2x4dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2446,7 +2772,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix2x4dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2456,6 +2781,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 2, 4);
     }
     void UniformMatrix3x2dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2472,7 +2798,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix3x2dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2482,6 +2807,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 3, 2);
     }
     void UniformMatrix3x4dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2498,7 +2824,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix3x4dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2508,6 +2833,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 3, 4);
     }
     void UniformMatrix4x2dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2524,7 +2850,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix4x2dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2534,6 +2859,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 4, 2);
     }
     void UniformMatrix4x3dv(GLint location, GLsizei count, GLboolean transpose, const GLdouble* value) {
@@ -2550,7 +2876,6 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     void ProgramUniformMatrix4x3dv(GLuint program, GLint location, GLsizei count, GLboolean transpose,
                                       const GLdouble* value) {
-        if (location == -1) return;
         auto& programObject = TryToGetProgramObject(program);
         if (!programObject) return;
         if (!programObject->GetLinkStatus()) {
@@ -2560,6 +2885,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              "program " + std::to_string(program) + " is not linked."));
             return;
         }
+        if (location == -1) return;
         UniformMatrixdv_Object(*programObject, location, count, transpose, value, 4, 3);
     }
     void GetUniformdv(GLuint program, GLint location, GLdouble* params) {

MobileGL/MG_Impl/GLImpl/Program/GL_Program.h

@@ -13,6 +13,12 @@ namespace MobileGL::MG_Impl::GLImpl {
     void AttachShader(GLuint program, GLuint shader);
     void BindAttribLocation(GLuint program, GLuint index, const GLchar* name);
     void CompileShader(GLuint shader);
+    // GL_ARB_gl_spirv, core since 4.6. The pair is a two-step operation: glShaderBinary attaches
+    // the module to one or more shader objects, glSpecializeShader names its entry point and
+    // supplies its specialization constants and is what actually compiles them.
+    void ShaderBinary(GLsizei count, const GLuint* shaders, GLenum binaryformat, const void* binary, GLsizei length);
+    void SpecializeShader(GLuint shader, const GLchar* pEntryPoint, GLuint numSpecializationConstants,
+                          const GLuint* pConstantIndex, const GLuint* pConstantValue);
     GLuint CreateProgram(void);
     GLuint CreateShader(GLenum type);
     void DeleteProgram(GLuint program);

MobileGL/MG_Impl/GLImpl/Program/GL_ProgramPipeline.cpp

@@ -192,6 +192,15 @@ namespace MobileGL::MG_Impl::GLImpl {
                                     std::format("Program {} has not been linked successfully.", program));
                 return;
             }
+            // GL 4.6 core 7.4: "INVALID_OPERATION is generated if program was not linked with its
+            // PROGRAM_SEPARABLE status set". The LATCHED flag is the one that decides - a program
+            // whose live flag was cleared after a separable link is still a legal stage, and a
+            // program whose live flag was set after a non-separable link is not.
+            if (!programObject->GetLinkedSeparable()) {
+                RecordPipelineError(ErrorCode::InvalidOperation, __func__,
+                                    std::format("Program {} was not linked as a separable program.", program));
+                return;
+            }
         }
 
         const GLbitfield selected = stages == GL_ALL_SHADER_BITS ? kAllStageBits : stages;

MobileGL/MG_Impl/GLImpl/Query/GL_Query.cpp

@@ -59,6 +59,62 @@ namespace MobileGL::MG_Impl::GLImpl {
         GLuint g_activePrimitivesGeneratedQueryId = 0;
         // Id of the query active on GL_SAMPLES_PASSED (0 = none).
         GLuint g_activeSamplesPassedQueryId = 0;
+        // Ids of the queries active on the GL_ARB_pipeline_statistics_query targets, one slot per
+        // target (0 = none). A map rather than a field per target: the eleven behave identically
+        // and none of them has any state beyond "which object is counting".
+        UnorderedMap<GLenum, GLuint> g_activePipelineStatisticsQueryIds;
+
+        // Whether MobileGL puts GL_ARB_tessellation_shader in its extension string. Read from the
+        // ADVERTISED list rather than from a capability bit for the same reason
+        // BackendSupportsTextureViews does (GL_Texture.cpp): it makes "MobileGL claims tessellation
+        // support" and "the tessellation-conditional API surface is open" the same fact by
+        // construction, so the day a backend starts advertising the string the surface below opens
+        // with it and no second edit is owed.
+        Bool AdvertisesTessellationShaderExtension() {
+            const auto& activeBackendObject = MG_Backend::pActiveBackendObject;
+            if (!activeBackendObject) return false;
+            const auto& extensions = activeBackendObject->GetRendererInfo().RendererGLInfo.Extensions;
+            return std::find(extensions.begin(), extensions.end(), E_GL_ARB_tessellation_shader) != extensions.end();
+        }
+
+        // The eleven pipeline-statistics counters (GL 4.6 core table 4.3 / ARB_pipeline_statistics_query).
+        // A 4.6 core context ACCEPTS the nine unconditional ones at glBeginQuery - there is no query
+        // by which an application could learn otherwise before calling. MobileGL instruments none of
+        // them, and says so the way GL 4.6 core 4.2.1 provides for: GL_QUERY_COUNTER_BITS answers
+        // zero for these targets, which is the spec's own signal that the counter is unsupported and
+        // its results indeterminate. That is an honest zero, not an advertised capability - the
+        // alternative, GL_INVALID_ENUM on a core entry point, is both non-conformant AND less
+        // informative.
+        //
+        // The two TESSELLATION targets are the exception, because ARB_pipeline_statistics_query
+        // makes them conditional on tessellation support rather than unconditional, and the only
+        // thing an application (or the conformance suite) can read to decide whether an
+        // implementation has it is the GL_ARB_tessellation_shader string. MobileGL does not emit it
+        // today, so these two answer GL_INVALID_ENUM: an API surface that accepts a
+        // tessellation-conditional token while withholding the string that announces the condition
+        // is self-contradictory, and it is the contradiction the suite catches
+        // (KHR-GL46.pipeline_statistics_query_tests_ARB.api_coverage_unsupported_calls, whose
+        // support probe is gl4cPipelineStatisticsQueryTests.cpp:1166-1176). The gate is the
+        // advertisement itself, not a hardcoded "no", so this is one switch and not two.
+        Bool IsPipelineStatisticsQueryTarget(GLenum target) {
+            switch (target) {
+            case GL_VERTICES_SUBMITTED:
+            case GL_PRIMITIVES_SUBMITTED:
+            case GL_VERTEX_SHADER_INVOCATIONS:
+            case GL_GEOMETRY_SHADER_INVOCATIONS:
+            case GL_GEOMETRY_SHADER_PRIMITIVES_EMITTED:
+            case GL_FRAGMENT_SHADER_INVOCATIONS:
+            case GL_COMPUTE_SHADER_INVOCATIONS:
+            case GL_CLIPPING_INPUT_PRIMITIVES:
+            case GL_CLIPPING_OUTPUT_PRIMITIVES:
+                return true;
+            case GL_TESS_CONTROL_SHADER_PATCHES:
+            case GL_TESS_EVALUATION_SHADER_INVOCATIONS:
+                return AdvertisesTessellationShaderExtension();
+            default:
+                return false;
+            }
+        }
 
         Bool TimerQueryDisabled() {
             return MG_Config::Features.DisableTimerQuery;
@@ -370,6 +426,9 @@ namespace MobileGL::MG_Impl::GLImpl {
                     }
                     queryObject->active = false;
                     g_activeSamplesPassedQueryId = 0;
+                } else if (IsPipelineStatisticsQueryTarget(queryObject->target)) {
+                    queryObject->active = false;
+                    g_activePipelineStatisticsQueryIds[queryObject->target] = 0;
                 } else if (queryObject->target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN ||
                            queryObject->target == GL_PRIMITIVES_GENERATED) {
                     queryObject->active = false;
@@ -410,7 +469,9 @@ namespace MobileGL::MG_Impl::GLImpl {
             (target == GL_SAMPLES_PASSED || target == GL_ANY_SAMPLES_PASSED ||
              target == GL_ANY_SAMPLES_PASSED_CONSERVATIVE) &&
             MG_Backend::gBackendFunctionsTable.GL.BeginOcclusionQuery != nullptr;
-        if (target != GL_TIME_ELAPSED && !isTransformFeedbackQuery && !isOcclusionQuery) {
+        const Bool isPipelineStatisticsQuery = IsPipelineStatisticsQueryTarget(target);
+        if (target != GL_TIME_ELAPSED && !isTransformFeedbackQuery && !isOcclusionQuery &&
+            !isPipelineStatisticsQuery) {
             // GL_TIMESTAMP is not a valid BeginQuery target; the occlusion targets
             // need backend support.
             RecordQueryError(ErrorCode::InvalidEnum, __FUNCTION__, "Query target is not supported.");
@@ -426,10 +487,12 @@ namespace MobileGL::MG_Impl::GLImpl {
             RecordQueryError(ErrorCode::InvalidOperation, __FUNCTION__, "Query object does not exist.");
             return;
         }
-        GLuint& activeQueryId = isTransformFeedbackQuery
-            ? (target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN ? g_activePrimitivesWrittenQueryId
-                                                                  : g_activePrimitivesGeneratedQueryId)
-            : (isOcclusionQuery ? g_activeSamplesPassedQueryId : g_activeTimeElapsedQueryId);
+        GLuint& activeQueryId = isPipelineStatisticsQuery
+            ? g_activePipelineStatisticsQueryIds[target]
+            : (isTransformFeedbackQuery
+                   ? (target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN ? g_activePrimitivesWrittenQueryId
+                                                                         : g_activePrimitivesGeneratedQueryId)
+                   : (isOcclusionQuery ? g_activeSamplesPassedQueryId : g_activeTimeElapsedQueryId));
         if (activeQueryId != 0) {
             RecordQueryError(ErrorCode::InvalidOperation, __FUNCTION__,
                              "A query is already active on this target.");
@@ -448,7 +511,11 @@ namespace MobileGL::MG_Impl::GLImpl {
         ResetQueryObjectLocked(queryObject); // discard any previous result
         queryObject->target = target;
         queryObject->active = true;
-        if (isTransformFeedbackQuery) {
+        if (isPipelineStatisticsQuery) {
+            // Nothing to start: the counter is uninstrumented and GL_QUERY_COUNTER_BITS says so.
+            // The object still becomes a real, target-latched query so every other rule about it
+            // (re-use with another target, double-begin, EndQuery pairing) keeps holding.
+        } else if (isTransformFeedbackQuery) {
             // Prefer real GPU transform-feedback queries (exact with geometry shaders);
             // the CPU accounting delta stays as the fallback when the backend lacks them.
             const auto beginXfbPrimitivesQuery = MG_Backend::gBackendFunctionsTable.GL.BeginXfbPrimitivesQuery;
@@ -476,15 +543,19 @@ namespace MobileGL::MG_Impl::GLImpl {
             (target == GL_SAMPLES_PASSED || target == GL_ANY_SAMPLES_PASSED ||
              target == GL_ANY_SAMPLES_PASSED_CONSERVATIVE) &&
             MG_Backend::gBackendFunctionsTable.GL.BeginOcclusionQuery != nullptr;
-        if (target != GL_TIME_ELAPSED && !isTransformFeedbackQuery && !isOcclusionQuery) {
+        const Bool isPipelineStatisticsQuery = IsPipelineStatisticsQueryTarget(target);
+        if (target != GL_TIME_ELAPSED && !isTransformFeedbackQuery && !isOcclusionQuery &&
+            !isPipelineStatisticsQuery) {
             RecordQueryError(ErrorCode::InvalidEnum, __FUNCTION__, "Query target is not supported.");
             return;
         }
         const std::lock_guard<std::mutex> lock(g_queryObjectsMutex);
-        GLuint& activeQueryId = isTransformFeedbackQuery
-            ? (target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN ? g_activePrimitivesWrittenQueryId
-                                                                  : g_activePrimitivesGeneratedQueryId)
-            : (isOcclusionQuery ? g_activeSamplesPassedQueryId : g_activeTimeElapsedQueryId);
+        GLuint& activeQueryId = isPipelineStatisticsQuery
+            ? g_activePipelineStatisticsQueryIds[target]
+            : (isTransformFeedbackQuery
+                   ? (target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN ? g_activePrimitivesWrittenQueryId
+                                                                         : g_activePrimitivesGeneratedQueryId)
+                   : (isOcclusionQuery ? g_activeSamplesPassedQueryId : g_activeTimeElapsedQueryId));
         if (activeQueryId == 0) {
             RecordQueryError(ErrorCode::InvalidOperation, __FUNCTION__, "No query is active on this target.");
             return;
@@ -494,6 +565,17 @@ namespace MobileGL::MG_Impl::GLImpl {
             activeQueryId = 0; // should not happen; keep state consistent
             return;
         }
+        if (isPipelineStatisticsQuery) {
+            // The result is a definite zero rather than an unread backend handle, so a later
+            // GetQueryObject* answers immediately and never waits on something that was never
+            // started. GL_QUERY_COUNTER_BITS = 0 is what marks that zero indeterminate.
+            queryObject->cachedResult = 0;
+            queryObject->resultCached = true;
+            queryObject->active = false;
+            queryObject->ended = true;
+            activeQueryId = 0;
+            return;
+        }
         if (isTransformFeedbackQuery) {
             if (queryObject->backendHandle) {
                 if (const auto endXfbPrimitivesQuery = MG_Backend::gBackendFunctionsTable.GL.EndXfbPrimitivesQuery) {
@@ -657,7 +739,12 @@ namespace MobileGL::MG_Impl::GLImpl {
                 *params = static_cast<GLint>(g_activePrimitivesGeneratedQueryId);
                 break;
             default:
-                *params = 0;
+                if (IsPipelineStatisticsQueryTarget(target)) {
+                    const auto it = g_activePipelineStatisticsQueryIds.find(target);
+                    *params = it != g_activePipelineStatisticsQueryIds.end() ? static_cast<GLint>(it->second) : 0;
+                } else {
+                    *params = 0;
+                }
                 break;
             }
             return;
@@ -668,6 +755,14 @@ namespace MobileGL::MG_Impl::GLImpl {
             // entry points / timestamp valid bits at call time, not at table
             // init), and the MOBILEGL_DISABLE_TIMERQUERY kill switch always
             // wins.
+            if (IsPipelineStatisticsQueryTarget(target)) {
+                // Zero: GL 4.6 core 4.2.1's way of saying the counter is not implemented and its
+                // results are indeterminate. The conformance suite reads exactly this and skips
+                // the functional half of each such target, which is the outcome an uninstrumented
+                // counter should produce.
+                *params = 0;
+                return;
+            }
             if (target == GL_SAMPLES_PASSED || target == GL_ANY_SAMPLES_PASSED ||
                 target == GL_ANY_SAMPLES_PASSED_CONSERVATIVE) {
                 const Bool occlusionSupported = MG_Backend::gBackendFunctionsTable.GL.BeginOcclusionQuery != nullptr;
@@ -741,14 +836,24 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     namespace {
+        Bool IsPerVertexStreamQueryTarget(GLenum target) {
+            return target == GL_PRIMITIVES_GENERATED || target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN;
+        }
+
         // The indexed query entry points differ from the plain ones only in the vertex
         // stream they address (GL 4.6 core 4.2.1): index must be below GL_MAX_VERTEX_STREAMS
-        // for the two transform feedback targets and zero for every other target. With a
-        // single vertex stream both bounds are 1, so a valid call is always index 0 and
-        // forwards to the unindexed implementation.
+        // for the two transform feedback targets and zero for every other target. MobileGL
+        // implements ONE vertex stream, so both bounds are 1 and a valid call is always index 0 -
+        // which is what makes the three forwards below equivalent to the unindexed entry points.
+        //
+        // THAT EQUIVALENCE IS THE WHOLE JUSTIFICATION, and it is read out of the getter rather
+        // than assumed: the moment GL_MAX_VERTEX_STREAMS answers more than one, index 1..3 starts
+        // reaching EndQueryIndexed and GetQueryIndexediv, which resolve the active query from
+        // per-TARGET globals and would end - or report - a query begun on a different stream.
+        // Raising that limit therefore means giving each active query a stream index and
+        // comparing it here, not just changing the number.
         Bool ValidateQueryStreamIndex(const char* function, GLenum target, GLuint index) {
-            const Bool perStreamTarget =
-                target == GL_PRIMITIVES_GENERATED || target == GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN;
+            const Bool perStreamTarget = IsPerVertexStreamQueryTarget(target);
             GLint maxVertexStreams = 1;
             if (perStreamTarget) {
                 GetIntegerv(GL_MAX_VERTEX_STREAMS, &maxVertexStreams);
@@ -761,6 +866,7 @@ namespace MobileGL::MG_Impl::GLImpl {
                                              : "index must be zero for this query target.");
             return false;
         }
+
     } // namespace
 
     void BeginQueryIndexed(GLenum target, GLuint index, GLuint id) {

MobileGL/MG_Impl/GLImpl/RenderState/GL_RenderState.cpp

@@ -328,10 +328,50 @@ namespace MobileGL::MG_Impl::GLImpl {
         MG_State::pGLContext->SetSampleCoverage(std::clamp(static_cast<Float>(value), 0.0f, 1.0f), invert == GL_TRUE);
     }
 
+    // ARB_sample_shading / GL 4.6 core 14.3.1: "value is clamped to [0, 1] when specified", so
+    // there is no error to raise - a caller that asks for 2.0 gets 1.0 and GL_MIN_SAMPLE_SHADING_-
+    // VALUE reads back 1.0. Was a logging no-op while ARB_sample_shading was advertised, which
+    // let an application enable GL_SAMPLE_SHADING and then quietly get the driver's default rate.
+    void MinSampleShading_State(GLfloat value) {
+        MG_State::pGLContext->SetMinSampleShadingValue(std::clamp(static_cast<Float>(value), 0.0f, 1.0f));
+    }
+
     void PolygonOffset_State(GLfloat factor, GLfloat units) {
         MG_State::pGLContext->SetPolygonOffset(static_cast<Float>(factor), static_cast<Float>(units));
     }
 
+    void PolygonOffsetClamp_State(GLfloat factor, GLfloat units, GLfloat clamp) {
+        // GL 4.6 core 14.6.5 / GL_EXT_polygon_offset_clamp. No error cases: any three floats are
+        // legal, and clamp = 0 is exactly glPolygonOffset. Whether the backend can APPLY the clamp
+        // is a separate question (see the DirectGLES/DirectVulkan forwarding); the state is
+        // recorded either way, because GL_POLYGON_OFFSET_CLAMP has to read back what was written.
+        MG_State::pGLContext->SetPolygonOffsetClamped(static_cast<Float>(factor), static_cast<Float>(units),
+                                                      static_cast<Float>(clamp));
+    }
+
+    void ClipControl_State(GLenum origin, GLenum depth) {
+        // GL 4.5 core 13.5: both arguments are strict enums, and either being wrong is
+        // GL_INVALID_ENUM with the state left untouched.
+        if (origin != GL_LOWER_LEFT && origin != GL_UPPER_LEFT) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "glClipControl origin must be GL_LOWER_LEFT or GL_UPPER_LEFT; got " +
+                                                 MG_Util::ConvertGLEnumToString(origin) + "."));
+            return;
+        }
+        if (depth != GL_NEGATIVE_ONE_TO_ONE && depth != GL_ZERO_TO_ONE) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>(
+                    "MG_Impl/GLImpl", __func__,
+                    "glClipControl depth must be GL_NEGATIVE_ONE_TO_ONE or GL_ZERO_TO_ONE; got " +
+                        MG_Util::ConvertGLEnumToString(depth) + "."));
+            return;
+        }
+        MG_State::pGLContext->SetClipControl(origin, depth);
+    }
+
     void PolygonMode_State(GLenum face, GLenum mode) {
         // GL 3.3 core: separate front/back polygon modes were removed in 3.1, so the only legal
         // face is GL_FRONT_AND_BACK. GL_FRONT / GL_BACK must be rejected (some desktop drivers
@@ -1013,10 +1053,22 @@ namespace MobileGL::MG_Impl::GLImpl {
         SampleCoverage_State(value, invert);
     }
 
+    void MinSampleShading(GLfloat value) {
+        MinSampleShading_State(value);
+    }
+
     void PolygonOffset(GLfloat factor, GLfloat units) {
         PolygonOffset_State(factor, units);
     }
 
+    void PolygonOffsetClamp(GLfloat factor, GLfloat units, GLfloat clamp) {
+        PolygonOffsetClamp_State(factor, units, clamp);
+    }
+
+    void ClipControl(GLenum origin, GLenum depth) {
+        ClipControl_State(origin, depth);
+    }
+
     void PolygonMode(GLenum face, GLenum mode) {
         PolygonMode_State(face, mode);
     }

MobileGL/MG_Impl/GLImpl/RenderState/GL_RenderState.h

@@ -38,7 +38,10 @@ namespace MobileGL::MG_Impl::GLImpl {
     void StencilFunc(GLenum func, GLint ref, GLuint mask);
     void Scissor(GLint x, GLint y, GLsizei width, GLsizei height);
     void SampleCoverage(GLfloat value, GLboolean invert);
+    void MinSampleShading(GLfloat value);
     void PolygonOffset(GLfloat factor, GLfloat units);
+    void PolygonOffsetClamp(GLfloat factor, GLfloat units, GLfloat clamp);
+    void ClipControl(GLenum origin, GLenum depth);
     void PolygonMode(GLenum face, GLenum mode);
     void PointSize(GLfloat size);
     void PointParameterf(GLenum pname, GLfloat param);

MobileGL/MG_Impl/GLImpl/Sampler/GL_Sampler.cpp

@@ -13,6 +13,7 @@
 #include <MG_State/GLState/Core.h>
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
 #include <MG_Util/Converters/MGToGL/TextureEnumConverter.h>
+#include <MG_Util/Math/FixedPointConversion.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     namespace {
@@ -22,6 +23,50 @@ namespace MobileGL::MG_Impl::GLImpl {
             return static_cast<Float>(*(const GLint*)param);
         }
 
+        // GL_TEXTURE_BORDER_COLOR is the only sampler parameter with more than one component, and it
+        // is also the only one whose meaning depends on WHICH entry point wrote it. Everything else
+        // reads exactly one component and does not care.
+        Bool IsVectorOnlySamplerPname(GLenum pname) {
+            return pname == GL_TEXTURE_BORDER_COLOR;
+        }
+
+        // A state query returns the value CONVERTED to the type the caller asked for (GL 4.6 core
+        // 2.2.2 / 6.1), never the other type's bits. These two are the sampler side of the numeric
+        // casts GetTexParameterfv_State/GetTexParameteriv_State already do on the texture side; the
+        // sampler path funnels all three spellings through one void* function, which is precisely how
+        // it came to write a fixed type regardless of the caller.
+        //
+        // Truncation rather than rounding for the float -> integer direction, matching the texture
+        // twin (GetTexParameteriv_State's static_cast<GLint> on MIN_LOD/MAX_LOD/LOD_BIAS): the two
+        // spellings of the same state disagreeing is the bug being fixed here, and a texture and a
+        // sampler queried the same way must answer the same number.
+        void StoreSamplerScalar(void* params, Bool isFloat, Bool isUnsignedInteger, Float value) {
+            if (isFloat) {
+                *(GLfloat*)params = value;
+                return;
+            }
+            // Via GLint in both integer spellings: a direct float -> GLuint cast of a negative value
+            // (GL_TEXTURE_MIN_LOD defaults to -1000) is undefined behaviour, while the two-step
+            // conversion is the well-defined modular one, and it is what the texture-side
+            // GetTexParameterIuiv fallback does.
+            const GLint asInt = static_cast<GLint>(value);
+            if (isUnsignedInteger) {
+                *(GLuint*)params = static_cast<GLuint>(asInt);
+            } else {
+                *(GLint*)params = asInt;
+            }
+        }
+
+        void StoreSamplerEnum(void* params, Bool isFloat, Bool isUnsignedInteger, GLenum value) {
+            if (isFloat) {
+                *(GLfloat*)params = static_cast<GLfloat>(value);
+            } else if (isUnsignedInteger) {
+                *(GLuint*)params = value;
+            } else {
+                *(GLint*)params = static_cast<GLint>(value);
+            }
+        }
+
         Bool ValidateSamplerParameterValue(GLenum pname, const void* param, Bool isFloat, Bool isUnsignedInteger) {
             if (param == nullptr) return false;
 
@@ -56,8 +101,15 @@ namespace MobileGL::MG_Impl::GLImpl {
         }
     } // namespace
 
+    // `isIntegerCommand` distinguishes the "I" spellings (glSamplerParameterIiv / Iuiv) from the
+    // plain ones. It only matters for GL_TEXTURE_BORDER_COLOR, and there it decides everything:
+    // GL 4.6 core 8.10 says the I forms store the components unmodified with an integer internal
+    // type, while glSamplerParameteriv converts them to floating point with equation 2.2. Routing
+    // both to the same setter - which is what this file used to do - meant glSamplerParameteriv
+    // stored raw integers (so a border of 255 became float 255.0 instead of the spec's ~1.19e-7)
+    // and glSamplerParameterIiv lost the fact that it was ever an integer at all.
     void SetSamplerParam_State(GLuint sampler, GLenum pname, const void* param, bool isFloat,
-                               bool isUnsignedInteger) {
+                               bool isUnsignedInteger, bool isIntegerCommand) {
         if (param == nullptr) return;
         if (!SamplerImpl::ValidateSamplerName(sampler)) return;
 
@@ -112,6 +164,13 @@ namespace MobileGL::MG_Impl::GLImpl {
             if (isFloat) {
                 const auto* values = (const GLfloat*)param;
                 samplerObj->SetBorderColor(FloatVec4(values[0], values[1], values[2], values[3]));
+            } else if (!isIntegerCommand) {
+                // glSamplerParameteriv: GL 4.6 core equation 2.2 into the FLOAT border colour.
+                const auto* values = (const GLint*)param;
+                samplerObj->SetBorderColor(FloatVec4(MG_Util::SignedNormalizedInt32ToFloat(values[0]),
+                                                     MG_Util::SignedNormalizedInt32ToFloat(values[1]),
+                                                     MG_Util::SignedNormalizedInt32ToFloat(values[2]),
+                                                     MG_Util::SignedNormalizedInt32ToFloat(values[3])));
             } else if (isUnsignedInteger) {
                 const auto* values = (const GLuint*)param;
                 samplerObj->SetBorderColorUI(UintVec4(values[0], values[1], values[2], values[3]));
@@ -128,7 +187,7 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void GetSamplerParam_State(GLuint sampler, GLenum pname, void* params, bool isFloat,
-                               bool isUnsignedInteger) {
+                               bool isUnsignedInteger, bool isIntegerCommand) {
         if (params == nullptr) return;
         if (!SamplerImpl::ValidateSamplerName(sampler)) return;
 
@@ -141,47 +200,56 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (!SamplerImpl::ValidateSamplerObject(sampler)) return;
 
         using namespace MG_Util;
+        // Every scalar pname goes through StoreSamplerScalar/StoreSamplerEnum so the CALLER'S form
+        // decides the destination type. Writing a fixed type regardless - which is what these case
+        // labels used to do - hands back the other type's bit pattern rather than a converted value:
+        // glGetSamplerParameterfv(GL_TEXTURE_WRAP_S) deposited the integer 10497 into a GLfloat and
+        // the caller read 1.47e-41, and glGetSamplerParameteriv(GL_TEXTURE_MIN_LOD) deposited the
+        // IEEE bits of -1000.0f and the caller read -998637568. Sixteen (pname, entry-point) pairs
+        // were broken this way; only MAX_ANISOTROPY_EXT and BORDER_COLOR branched correctly, which is
+        // how the same bug class was already found and fixed once for a single pname.
         switch (pname) {
         case GL_TEXTURE_WRAP_S:
-            *(GLuint*)params = MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapS());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapS()));
             break;
         case GL_TEXTURE_WRAP_T:
-            *(GLuint*)params = MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapT());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapT()));
             break;
         case GL_TEXTURE_WRAP_R:
-            *(GLuint*)params = MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapR());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerWrapModeToGLEnum(samplerObj->GetWrapR()));
             break;
         case GL_TEXTURE_MIN_FILTER:
-            *(GLuint*)params =
-                MG_Util::ConvertSamplerFilterModeToGLEnum(samplerObj->GetMinFilter(), samplerObj->GetMipmapMode());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerFilterModeToGLEnum(samplerObj->GetMinFilter(),
+                                                                       samplerObj->GetMipmapMode()));
             break;
         case GL_TEXTURE_MAG_FILTER:
-            *(GLuint*)params =
-                MG_Util::ConvertSamplerFilterModeToGLEnum(samplerObj->GetMagFilter(), SamplerMipmapMode::None);
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerFilterModeToGLEnum(samplerObj->GetMagFilter(),
+                                                                       SamplerMipmapMode::None));
             break;
         case GL_TEXTURE_MIN_LOD:
-            *(GLfloat*)params = samplerObj->GetMinLod();
+            StoreSamplerScalar(params, isFloat, isUnsignedInteger, samplerObj->GetMinLod());
             break;
         case GL_TEXTURE_MAX_LOD:
-            *(GLfloat*)params = samplerObj->GetMaxLod();
+            StoreSamplerScalar(params, isFloat, isUnsignedInteger, samplerObj->GetMaxLod());
             break;
         case GL_TEXTURE_LOD_BIAS:
-            *(GLfloat*)params = samplerObj->GetLodBias();
+            StoreSamplerScalar(params, isFloat, isUnsignedInteger, samplerObj->GetLodBias());
             break;
         case GL_TEXTURE_MAX_ANISOTROPY_EXT:
-            if (isFloat) {
-                *(GLfloat*)params = samplerObj->GetMaxAnisotropy();
-            } else if (isUnsignedInteger) {
-                *(GLuint*)params = static_cast<GLuint>(samplerObj->GetMaxAnisotropy());
-            } else {
-                *(GLint*)params = static_cast<GLint>(samplerObj->GetMaxAnisotropy());
-            }
+            StoreSamplerScalar(params, isFloat, isUnsignedInteger, samplerObj->GetMaxAnisotropy());
             break;
         case GL_TEXTURE_COMPARE_MODE:
-            *(GLuint*)params = MG_Util::ConvertSamplerCompareModeToGLEnum(samplerObj->GetCompareMode());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerCompareModeToGLEnum(samplerObj->GetCompareMode()));
             break;
         case GL_TEXTURE_COMPARE_FUNC:
-            *(GLuint*)params = MG_Util::ConvertSamplerCompareFuncToGLEnum(samplerObj->GetSamplerCompareFunc());
+            StoreSamplerEnum(params, isFloat, isUnsignedInteger,
+                             MG_Util::ConvertSamplerCompareFuncToGLEnum(samplerObj->GetSamplerCompareFunc()));
             break;
         case GL_TEXTURE_BORDER_COLOR: {
             if (isFloat) {
@@ -191,6 +259,16 @@ namespace MobileGL::MG_Impl::GLImpl {
                 out[1] = color.y();
                 out[2] = color.z();
                 out[3] = color.w();
+            } else if (!isIntegerCommand) {
+                // glGetSamplerParameteriv: the inverse of the write side, GL 4.6 core equation 2.3.
+                // Exactly inverse, so a {0,1,2,4} written with glSamplerParameteriv reads back as
+                // {0,1,2,4}; a bare truncating cast answered {0,0,0,0}.
+                const auto& color = samplerObj->GetBorderColor();
+                auto* out = (GLint*)params;
+                out[0] = MG_Util::FloatToSignedNormalizedInt32(color.x());
+                out[1] = MG_Util::FloatToSignedNormalizedInt32(color.y());
+                out[2] = MG_Util::FloatToSignedNormalizedInt32(color.z());
+                out[3] = MG_Util::FloatToSignedNormalizedInt32(color.w());
             } else if (isUnsignedInteger) {
                 const auto& color = samplerObj->GetBorderColorUI();
                 auto* out = (GLuint*)params;
@@ -293,16 +371,10 @@ namespace MobileGL::MG_Impl::GLImpl {
         if (sampler == 0) {
             textureUnit.SetSamplerObject(nullptr);
         } else {
-            // GL 3.3 core 3.8.2: BindSampler on a name GenSamplers never returned - or one already
-            // deleted - is INVALID_OPERATION. SamplerParameter* raises INVALID_VALUE for the same
-            // name, which is why this cannot go through the shared SamplerImpl validator.
-            if (!MG_State::pGLContext->ValidateSamplerName(sampler)) {
-                MG_State::pGLContext->RecordError(
-                    ErrorCode::InvalidOperation,
-                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "BindSampler_State",
-                                                 std::format("Invalid sampler name {}", sampler)));
-                return;
-            }
+            // GL 4.6 core 8.2: BindSampler on a name GenSamplers never returned - or one already
+            // deleted - is INVALID_OPERATION, and so is every other sampler entry point on such a
+            // name, so the shared validator answers for all of them.
+            if (!SamplerImpl::ValidateSamplerName(sampler)) return;
             Bool doesSamplerObjectCreated = MG_State::pGLContext->ValidateSamplerObject(sampler);
             if (!doesSamplerObjectCreated) {
                 MG_State::pGLContext->CreateSamplerObject(sampler);
@@ -356,30 +428,50 @@ namespace MobileGL::MG_Impl::GLImpl {
 
     /* @INSERTION_POINT:FUNCTION_IMPLEMENTATION@ */
     void GetSamplerParameteriv(GLuint sampler, GLenum pname, GLint* params) {
-        GetSamplerParam_State(sampler, pname, params, false, false);
+        GetSamplerParam_State(sampler, pname, params, false, false, false);
     }
 
     void SamplerParameterIuiv(GLuint sampler, GLenum pname, const GLuint* param) {
-        SetSamplerParam_State(sampler, pname, param, false, true);
+        SetSamplerParam_State(sampler, pname, param, false, true, true);
     }
 
     void SamplerParameterIiv(GLuint sampler, GLenum pname, const GLint* param) {
-        SetSamplerParam_State(sampler, pname, param, false, false);
+        SetSamplerParam_State(sampler, pname, param, false, false, true);
     }
 
     void SamplerParameteriv(GLuint sampler, GLenum pname, const GLint* param) {
-        SetSamplerParam_State(sampler, pname, param, false, false);
+        SetSamplerParam_State(sampler, pname, param, false, false, false);
     }
 
     void SamplerParameterfv(GLuint sampler, GLenum pname, const GLfloat* param) {
-        SetSamplerParam_State(sampler, pname, param, true, false);
+        SetSamplerParam_State(sampler, pname, param, true, false, false);
     }
 
+    // GL 4.6 core 8.10: the scalar spellings take "the value of pname", so a pname with more than one
+    // component is INVALID_ENUM here rather than something to read four components of. Guarding at
+    // the entry point rather than downstream is also what stops the vector path reading twelve bytes
+    // past the caller's single stack scalar - taking the address of a by-value argument and handing
+    // it to a four-component reader is what these used to do. The texture-side twins already answer
+    // INVALID_ENUM for GL_TEXTURE_BORDER_COLOR (TexParameteri/f name it as unsupported outright).
     void SamplerParameteri(GLuint sampler, GLenum pname, GLint param) {
+        if (IsVectorOnlySamplerPname(pname)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "SamplerParameteri",
+                                             "pname has more than one component and needs a vector form."));
+            return;
+        }
         SamplerParameteriv(sampler, pname, &param);
     }
 
     void SamplerParameterf(GLuint sampler, GLenum pname, GLfloat param) {
+        if (IsVectorOnlySamplerPname(pname)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "SamplerParameterf",
+                                             "pname has more than one component and needs a vector form."));
+            return;
+        }
         SamplerParameterfv(sampler, pname, &param);
     }
 
@@ -388,15 +480,15 @@ namespace MobileGL::MG_Impl::GLImpl {
     }
 
     void GetSamplerParameterIuiv(GLuint sampler, GLenum pname, GLuint* params) {
-        GetSamplerParam_State(sampler, pname, params, false, true);
+        GetSamplerParam_State(sampler, pname, params, false, true, true);
     }
 
     void GetSamplerParameterIiv(GLuint sampler, GLenum pname, GLint* params) {
-        GetSamplerParam_State(sampler, pname, params, false, false);
+        GetSamplerParam_State(sampler, pname, params, false, false, true);
     }
 
     void GetSamplerParameterfv(GLuint sampler, GLenum pname, GLfloat* params) {
-        GetSamplerParam_State(sampler, pname, params, true, false);
+        GetSamplerParam_State(sampler, pname, params, true, false, false);
     }
 
     void GenSamplers(GLsizei count, GLuint* samplers) {

MobileGL/MG_Impl/GLImpl/Sampler/Validators.cpp

@@ -12,11 +12,17 @@
 #include <MG_Util/Converters/GLToMG/TextureEnumConverter.h>
 
 namespace MobileGL::MG_Impl::GLImpl::SamplerImpl {
+    // GL 4.6 core 8.2: "An INVALID_OPERATION error is generated if sampler is not the name of a
+    // sampler object previously returned from a call to GenSamplers." That class is shared by every
+    // sampler entry point - BindSampler, SamplerParameter*, GetSamplerParameter* - so this one gate
+    // answers for all of them. It used to report INVALID_VALUE (the GL 3.3 wording), which forced
+    // BindSampler to carry a bespoke duplicate of the same check just to get the class right.
     Bool ValidateSamplerName(GLuint sampler) {
         if (!MG_State::pGLContext->ValidateSamplerName(sampler)) {
             MG_State::pGLContext->RecordError(
-                ErrorCode::InvalidValue, MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "ValidateSamplerName",
-                                                                      std::format("Invalid sampler name {}", sampler)));
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", "ValidateSamplerName",
+                                             std::format("Invalid sampler name {}", sampler)));
             return false;
         }
         return true;

MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.h

@@ -8,9 +8,24 @@
 
 #pragma once
 #include <Includes.h>
+#include <MG_State/GLState/TextureState/TextureObject.h>
 
 namespace MobileGL::MG_Impl::GLImpl {
     /* @INSERTION_POINT:FUNCTION_DECLARATION@ */
+    // Answers a texture-image query straight out of the CPU shadow, into client memory or a bound
+    // PIXEL_PACK_BUFFER. This is the whole of glGetTexImage on a build with no backend readback, and
+    // it is also the sound fallback for a backend that has no GPU image to read: with no image,
+    // nothing GPU-side can ever have written the texture, so the shadow IS its content.
+    //
+    // It answers a NARROWER contract than glGetTexImage's, and refuses what it cannot do rather than
+    // answering wrongly. The copy is verbatim: it performs no format or type conversion, and it packs
+    // rows tightly, honouring only GL_PACK_SWAP_BYTES and the bitmap GL_PACK_LSB_FIRST path. A
+    // request whose (format, type) texel size differs from the texture's own, or a pixel-store state
+    // that adds row padding / a row-length override / a skip offset, is rejected with
+    // GL_INVALID_OPERATION (see ValidateShadowReadbackLayout, which spells out why each is unsafe).
+    void CopyTextureImageToClientOrPBO_State(const SharedPtr<MG_State::GLState::ITextureObject>& textureObject,
+                                             TextureUploadTarget textureUploadTarget, GLint level, GLenum format,
+                                             GLenum type, GLsizei bufSize, void* pixels, const char* caller);
     // The sized internal formats a buffer texture accepts (GL 4.6 core table 8.16). The buffer
     // clears take the same list, so it is shared rather than written out twice.
     Bool IsBufferTextureInternalFormat(GLenum internalformat);

MobileGL/MG_Impl/GLImpl/Texture/Validators.cpp

@@ -103,6 +103,28 @@ namespace MobileGL::MG_Impl::GLImpl::TextureImpl {
         return true;
     }
 
+    Bool ValidateCubeMapArrayShape(TextureUploadTarget target, GLsizei width, GLsizei height, GLsizei depth,
+                                   const char* caller) {
+        if (target != TextureUploadTarget::CubeMapArray && target != TextureUploadTarget::ProxyCubeMapArray) {
+            return true;
+        }
+        if (width != height) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
+                                             "Cube map array levels must be square (width == height)"));
+            return false;
+        }
+        if (depth % 6 != 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
+                                             "Cube map array depth must be a multiple of six"));
+            return false;
+        }
+        return true;
+    }
+
     Bool ValidateTextureSizeWithTextureUploadTarget(TextureUploadTarget target, GLsizei width, GLsizei height) {
         if (target == TextureUploadTarget::CubeMapPositiveX || target == TextureUploadTarget::CubeMapNegativeX ||
             target == TextureUploadTarget::CubeMapPositiveY || target == TextureUploadTarget::CubeMapNegativeY ||

MobileGL/MG_Impl/GLImpl/Texture/Validators.h

@@ -20,6 +20,13 @@ namespace MobileGL::MG_Impl::GLImpl::TextureImpl {
     Bool ValidateTexturePixelDataType(TexturePixelDataType texturePixelDataType);
     Bool ValidateTextureLevelNumber(Int level);
     Bool ValidateTextureSizeWithTextureUploadTarget(TextureUploadTarget target, GLsizei width, GLsizei height);
+    // The two shape rules a cube-map-array level owes (GL 4.6 core 8.5): its faces are square, and
+    // its depth counts whole cubes. Both are GL_INVALID_VALUE. This used to be spelled inline in
+    // glTexStorage3D only, which is why glTexImage3D let both violations through - every entry
+    // point that DEFINES a cube-array level calls this now, so the two cannot drift again. A
+    // non-cube-array upload target answers true untouched.
+    Bool ValidateCubeMapArrayShape(TextureUploadTarget target, GLsizei width, GLsizei height, GLsizei depth,
+                                   const char* caller);
     Bool ValidateTextureSizeRange(Int width, Int height, Int depth);
     Bool ValidateTextureInternalFormat(TextureInternalFormat format);
     Bool ValidateTextureBorderNumber(Int border);

MobileGL/MG_Impl/GLImpl/VertexArray/Validators.cpp

@@ -12,15 +12,15 @@
 #include <MG_State/GLState/ErrorState/Error.h>
 #include <MG_Util/Converters/MGToGL/DataTypeConverter.h>
 #include <MG_Util/Converters/MGToStr/DataTypeConverter.h>
+#include <MG_Util/ShaderTranspiler/CompileEnv.h>
 
 namespace MobileGL::MG_Impl::GLImpl::VertexArrayImpl {
     Uint GetMaxVertexAttribs() {
-        constexpr Uint capacity = static_cast<Uint>(MG_State::GLState::VertexArrayObject::MAX_VERTEX_ATTRIBS);
-        if (!MG_Backend::pActiveBackendObject) return capacity;
-
-        const Int backendLimit = MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxVertexAttribs;
-        if (backendLimit <= 0) return capacity;
-        return std::min(static_cast<Uint>(backendLimit), capacity);
+        // Shared with reflection's limit and with gl_MaxVertexAttribs; see ResolveMaxVertexAttribs.
+        const Bool hasBackend = MG_Backend::pActiveBackendObject != nullptr;
+        const Int backendLimit =
+            hasBackend ? MG_Backend::pActiveBackendObject->GetDynamicParameters().MaxVertexAttribs : 0;
+        return static_cast<Uint>(MG_Util::ShaderTranspiler::ResolveMaxVertexAttribs(hasBackend, backendLimit));
     }
 
     Uint GetMaxVertexAttribBindings() {

MobileGL/MG_IntegrationTest/CMakeLists.txt

@@ -58,13 +58,18 @@ add_executable(MobileGLIntegrationTest
     Scenarios/DrawParametersScenario.cpp
     Scenarios/AsyncCompileScenario.cpp
     Scenarios/XfbAfterClipDistanceScenario.cpp
+    Scenarios/UnwrittenPositionOutputScenario.cpp
+    Scenarios/SampleMaskScopeScenario.cpp
+    Scenarios/SampledSetStalenessScenario.cpp
     Scenarios/ThreeChannelAttachmentScenario.cpp
     Scenarios/SnormAttachmentScenario.cpp
     Scenarios/PipelineFailureScenario.cpp
     Scenarios/AdvertisedLimitsScenario.cpp
     Scenarios/PixelStoreSweepScenario.cpp
+    Scenarios/PrimitiveRestartScenario.cpp
     Scenarios/FragCoordOriginScenario.cpp
     Scenarios/ClearThenReadPixelsScenario.cpp
+    Scenarios/SampleVariablesScenario.cpp
     Scenarios/DepthStencilReadbackScenario.cpp
     Scenarios/DepthStencilReadbackMatrixScenario.cpp
     Scenarios/DepthStencilReadbackAttachmentShapeScenario.cpp
@@ -86,6 +91,7 @@ add_executable(MobileGLIntegrationTest
     Scenarios/SsboDeclarationFormScenario.cpp
     Scenarios/Glsl420DeclarationScenario.cpp
     Scenarios/IoBlockNameCollisionScenario.cpp
+    Scenarios/UnlocatedIoBlockScenario.cpp
     Scenarios/TessellationDrawModeScenario.cpp
     Scenarios/GeometryDrawModeScenario.cpp
     Scenarios/PostLinkAttachScenario.cpp
@@ -95,19 +101,31 @@ add_executable(MobileGLIntegrationTest
     Scenarios/VertexAttribBindingScenario.cpp
     Scenarios/XfbCaptureBufferReuseScenario.cpp
     Scenarios/XfbPrimitiveQueryScenario.cpp
+    Scenarios/PrimitivesGeneratedNoXfbScenario.cpp
+    Scenarios/XfbRepeatedCaptureScenario.cpp
+    Scenarios/TessellationXfbCaptureScenario.cpp
+    Scenarios/PointSizeDemotionScenario.cpp
     Scenarios/VertexArrayEnableDisableScenario.cpp
     Scenarios/CopyImageLevelRangeScenario.cpp
     Scenarios/CopyImageLayeredScenario.cpp
+    Scenarios/CopyImagePacked16Scenario.cpp
     Scenarios/TextureViewScenario.cpp
     Scenarios/PackedWordReadbackScenario.cpp
     Scenarios/LayeredAttachmentBarrierScenario.cpp
+    Scenarios/LayeredAttachmentShapeScenario.cpp
     Scenarios/LayeredTextureReadbackScenario.cpp
     Scenarios/AtomicCounterScenario.cpp
+    Scenarios/LargeArenaAdoptionScenario.cpp
     Scenarios/SsboArrayDynamicIndexScenario.cpp
     Scenarios/StorageBufferRegrowScenario.cpp
+    Scenarios/SpirvShaderBinaryScenario.cpp
     Scenarios/RelinkStageSetScenario.cpp
     Scenarios/GuiBatchScenario.cpp
     Scenarios/UnboundImageDescriptorScenario.cpp
+    Scenarios/IntegerBorderColorScenario.cpp
+    Scenarios/ClearTexImageUndefinedLevelZeroScenario.cpp
+    Scenarios/RenderbufferBlendFormatScenario.cpp
+    Scenarios/DualSourceBlendScenario.cpp
 )
 
 target_include_directories(MobileGLIntegrationTest PRIVATE
@@ -273,9 +291,9 @@ if (MOBILEGL_ITEST_VK_ICD)
     if (MOBILEGL_ITEST_VK_ICD MATCHES "lvp_icd|lavapipe")
         message(STATUS "Integration tests: lavapipe ICD - forcing the iterationRP repairs on")
         list(APPEND MGL_ITEST_VULKAN_ENV
-            "MOBILEGL_FIX_ITERATIONRP_SUBGROUP_SCRATCH=1"
-            "MOBILEGL_DERIVE_NUM_SUBGROUPS=1"
-            "MOBILEGL_ITERATIONRP_FIX_BARRIER=1")
+            "MOBILEGL_MAGMA_FIX_ITERATIONRP_SUBGROUP_SCRATCH=1"
+            "MOBILEGL_MAGMA_DERIVE_NUM_SUBGROUPS=1"
+            "MOBILEGL_MAGMA_ITERATIONRP_FIX_BARRIER=1")
     endif()
 endif()
 
@@ -338,7 +356,37 @@ mgl_itest_join_environment(MGL_ITEST_VULKAN_OPTIMISTIC_ENVIRONMENT
     "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_ASYNC_SHADER_COMPILE=1"
     "MOBILEGL_ASYNC_OPTIMISTIC_SHADER_STATUS=1" ${MGL_ITEST_VULKAN_ENV})
 mgl_itest_join_environment(MGL_ITEST_GLES_NO_VIEWPORT_EMULATION_ENVIRONMENT
-    "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_FORCE_VIEWPORT_ARRAY_EMULATION=0" ${MGL_ITEST_COMMON_ENV})
+    "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_ESPRYT_FORCE_VIEWPORT_ARRAY_EMULATION=0" ${MGL_ITEST_COMMON_ENV})
+# MOBILEGL_LOG_FILE_PATH alongside the pin, because the arming assertion needs somewhere to
+# read the library's own report from. The strip's arming signal is a latched MGLOG_I and there
+# is no other way for a test process to learn that it fired - MG_Config is not reachable from
+# this module on Android, where it links the shipping library. The path is per-lane so nothing
+# else appends to it, and the case only trusts the bytes written after it started.
+mgl_itest_join_environment(MGL_ITEST_GLES_UNLOCATED_IO_BLOCKS_ENVIRONMENT
+    "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS=1"
+    "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/unlocated-io-blocks.log"
+    ${MGL_ITEST_COMMON_ENV})
+mgl_itest_join_environment(MGL_ITEST_GLES_WIDENED_PACKED16_ENVIRONMENT
+    "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE=1" ${MGL_ITEST_COMMON_ENV})
+# Same shape as the UnlocatedIoBlocks entry: the log path is where the reroute's latched
+# MGLOG_I lands, and the arming case only trusts the bytes written after it started.
+mgl_itest_join_environment(MGL_ITEST_VULKAN_PRIMGEN_REROUTE_ENVIRONMENT
+    "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE=1"
+    "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/primgen-query-reroute.log"
+    ${MGL_ITEST_VULKAN_ENV})
+# The point-size demotion pinned on, per backend, with a per-lane log file for the arming
+# assertion - the same MOBILEGL_LOG_FILE_PATH reasoning as the UnlocatedIoBlocks lane above.
+# Two lanes because the demotion runs in the SHARED phase-B chain and each backend then
+# consumes it differently (Espryt respells the driver-side capture request, Magma binds the
+# SPIR-V Xfb decorations to the carrier).
+mgl_itest_join_environment(MGL_ITEST_GLES_POINT_SIZE_DEMOTION_ENVIRONMENT
+    "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_POINT_SIZE_DEMOTION=1"
+    "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/point-size-demotion-gles.log"
+    ${MGL_ITEST_COMMON_ENV})
+mgl_itest_join_environment(MGL_ITEST_VULKAN_POINT_SIZE_DEMOTION_ENVIRONMENT
+    "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_POINT_SIZE_DEMOTION=1"
+    "MOBILEGL_LOG_FILE_PATH=${CMAKE_CURRENT_BINARY_DIR}/point-size-demotion-vulkan.log"
+    ${MGL_ITEST_VULKAN_ENV})
 
 # TIMEOUT on every entry: a GPU test that wedges must fail the run, not hang it.
 set(MGL_ITEST_TIMEOUT 120)
@@ -405,6 +453,23 @@ gtest_discover_tests(MobileGLIntegrationTest
         ENVIRONMENT "${MGL_ITEST_GLES_FORCED_DS_ENVIRONMENT}"
 )
 
+# UnlocatedIoBlockScenario with the interface-block location strip PINNED ON, for the same
+# reason the depth/stencil entry above pins its emulation: without it this scenario is
+# UNFALSIFIABLE on the machines this suite runs on. llvmpipe carries a located interface block
+# correctly, so the driver POST that arms the strip on Mali answers "healthy" here and the
+# emulation never runs - the ambient registration would be exercising the un-stripped path
+# twice and calling it coverage. With the variable set, the blocks really are emitted with no
+# location and the assertion is about the spelling the device gets.
+gtest_discover_tests(MobileGLIntegrationTest
+    TEST_PREFIX "DirectGLES.UnlocatedIoBlocks."
+    TEST_FILTER "UnlocatedIoBlockScenario.*"
+    DISCOVERY_TIMEOUT 30
+    PROPERTIES
+        LABELS integration-gpu
+        TIMEOUT ${MGL_ITEST_TIMEOUT}
+        ENVIRONMENT "${MGL_ITEST_GLES_UNLOCATED_IO_BLOCKS_ENVIRONMENT}"
+)
+
 # AsyncCompileScenario, with asynchronous compilation PINNED ON per backend.
 #
 # Not a duplicate of what the two ambient registrations already run: they run whatever
@@ -501,3 +566,67 @@ gtest_discover_tests(MobileGLIntegrationTest
         TIMEOUT ${MGL_ITEST_TIMEOUT}
         ENVIRONMENT "${MGL_ITEST_GLES_NO_VIEWPORT_EMULATION_ENVIRONMENT}"
 )
+
+# PrimitivesGeneratedNoXfbScenario again, with the GL_PRIMITIVES_GENERATED statistics
+# reroute PINNED ON. The ambient DirectVulkan registration runs the same cases under the
+# bring-up probe's Auto verdict, so between the two entries both accounting paths answer
+# the same GL questions and must produce the same numbers - the "two pools must agree"
+# gate this machine can hold that the affected device cannot. The pinned entry is also
+# the only one whose arming case runs: it asserts the renderer's latched MGLOG_I, so a
+# silently-disarmed reroute (an inverted override mapping, a lost gate) fails here
+# instead of leaving every equality case vacuously green. DirectVulkan only - the flag
+# steers nothing on DirectGLES.
+gtest_discover_tests(MobileGLIntegrationTest
+    TEST_PREFIX "DirectVulkan.PrimGenReroute."
+    TEST_FILTER "PrimitivesGeneratedNoXfbScenario.*"
+    DISCOVERY_TIMEOUT 30
+    PROPERTIES
+        LABELS integration-gpu
+        TIMEOUT ${MGL_ITEST_TIMEOUT}
+        ENVIRONMENT "${MGL_ITEST_VULKAN_PRIMGEN_REROUTE_ENVIRONMENT}"
+)
+
+# The packed16 copy scenarios again, with the 8-bit storage widening PINNED ON. The ambient
+# registrations above cover the narrow storage - on every CI driver the widening's POST
+# probe finds no field-order mirror, so Auto keeps the native 16-bit path - which means the
+# storage every AFFECTED device will actually run would otherwise execute nowhere at all:
+# no CI driver has the Mali bug that arms it. This lane is what proves the widened storage
+# is client-invisible (same packed words in and out on every leg the 18 failing CTS bodies
+# used, the renderbuffer one included). DirectGLES only - the flag steers nothing on
+# DirectVulkan, which has always stored these formats widened.
+gtest_discover_tests(MobileGLIntegrationTest
+    TEST_PREFIX "DirectGLES.WidenedPacked16."
+    TEST_FILTER "CopyImagePacked16Scenario.*"
+    DISCOVERY_TIMEOUT 30
+    PROPERTIES
+        LABELS integration-gpu
+        TIMEOUT ${MGL_ITEST_TIMEOUT}
+        ENVIRONMENT "${MGL_ITEST_GLES_WIDENED_PACKED16_ENVIRONMENT}"
+)
+
+# PointSizeDemotionScenario with the demotion PINNED ON, per backend, for the reason every
+# pinned lane above exists: llvmpipe and lavapipe both HOST gl_PointSize in tessellation and
+# geometry stages, so the ambient registrations run these captures through the built-in and
+# the demotion - the path every affected Mali device actually takes - would execute nowhere.
+# The ambient runs stay the negative control: same scenario, same CPU-computed bytes, native
+# path. Both backends, because the demotion is shared phase-B work with two different
+# consumers (the ESSL capture respelling vs the SPIR-V Xfb carrier binding).
+gtest_discover_tests(MobileGLIntegrationTest
+    TEST_PREFIX "DirectGLES.PointSizeDemotion."
+    TEST_FILTER "PointSizeDemotionScenario.*"
+    DISCOVERY_TIMEOUT 30
+    PROPERTIES
+        LABELS integration-gpu
+        TIMEOUT ${MGL_ITEST_TIMEOUT}
+        ENVIRONMENT "${MGL_ITEST_GLES_POINT_SIZE_DEMOTION_ENVIRONMENT}"
+)
+
+gtest_discover_tests(MobileGLIntegrationTest
+    TEST_PREFIX "DirectVulkan.PointSizeDemotion."
+    TEST_FILTER "PointSizeDemotionScenario.*"
+    DISCOVERY_TIMEOUT 30
+    PROPERTIES
+        LABELS integration-gpu
+        TIMEOUT ${MGL_ITEST_TIMEOUT}
+        ENVIRONMENT "${MGL_ITEST_VULKAN_POINT_SIZE_DEMOTION_ENVIRONMENT}"
+)

MobileGL/MG_IntegrationTest/Scenarios/AdvertisedLimitsScenario.cpp

@@ -56,7 +56,13 @@ namespace MGITest {
 
         const std::vector<LimitBound>& BufferLimitTable() {
             static const std::vector<LimitBound> table = {
-                {GL_MAX_UNIFORM_BUFFER_BINDINGS, "GL_MAX_UNIFORM_BUFFER_BINDINGS", 36, 256},
+                // 84 is the GL 4.5 core table 23.64 minimum, and also the width of the state
+                // layer's indexed-binding array - the two were made to coincide when the array
+                // was widened from 36, which had made the clamp in GL_Getter degenerate.
+                {GL_MAX_UNIFORM_BUFFER_BINDINGS, "GL_MAX_UNIFORM_BUFFER_BINDINGS", 84, 256},
+                // 14 uniform blocks on each of the FIVE graphics stages. The sum used to count
+                // three, and the two tessellation stages were simply missing from it.
+                {GL_MAX_COMBINED_UNIFORM_BLOCKS, "GL_MAX_COMBINED_UNIFORM_BLOCKS", 70, 256},
                 {GL_MAX_COMPUTE_UNIFORM_BLOCKS, "GL_MAX_COMPUTE_UNIFORM_BLOCKS", 12, 256},
                 {GL_MAX_COMPUTE_SHADER_STORAGE_BLOCKS, "GL_MAX_COMPUTE_SHADER_STORAGE_BLOCKS", 8, 256},
                 {GL_MAX_COMBINED_SHADER_STORAGE_BLOCKS, "GL_MAX_COMBINED_SHADER_STORAGE_BLOCKS", 8, 256},
@@ -133,6 +139,49 @@ namespace MGITest {
                     << relation.blocksName << " = " << blocks << " exceeds " << relation.bindingsName << " = "
                     << bindings << "; a shader may declare more blocks than there are binding points to bind them to";
             }
+
+            // THE MIDDLE TERM, which the relation quoted above always had and this case never
+            // checked. It is the one that actually broke: widening the binding-point array to 84
+            // raised what every PER-STAGE count clamps to, while the combined value was a
+            // five-stage sum of 70 - so a device reporting descriptor-indexing-scale uniform
+            // buffers (Adreno: maxPerStageDescriptorUniformBuffers = 16777216) advertised 84
+            // compute uniform blocks inside a combined limit of 70. Per-stage <= combined is
+            // exactly the assertion that says so, and it costs one glGetIntegerv per row.
+            struct StageAgainstCombined {
+                GLenum stage;
+                const char* stageName;
+                GLenum combined;
+                const char* combinedName;
+            };
+            const StageAgainstCombined stageRelations[] = {
+                {GL_MAX_COMPUTE_UNIFORM_BLOCKS, "GL_MAX_COMPUTE_UNIFORM_BLOCKS", GL_MAX_COMBINED_UNIFORM_BLOCKS,
+                 "GL_MAX_COMBINED_UNIFORM_BLOCKS"},
+                {GL_MAX_VERTEX_UNIFORM_BLOCKS, "GL_MAX_VERTEX_UNIFORM_BLOCKS", GL_MAX_COMBINED_UNIFORM_BLOCKS,
+                 "GL_MAX_COMBINED_UNIFORM_BLOCKS"},
+                {GL_MAX_TESS_CONTROL_UNIFORM_BLOCKS, "GL_MAX_TESS_CONTROL_UNIFORM_BLOCKS",
+                 GL_MAX_COMBINED_UNIFORM_BLOCKS, "GL_MAX_COMBINED_UNIFORM_BLOCKS"},
+                {GL_MAX_TESS_EVALUATION_UNIFORM_BLOCKS, "GL_MAX_TESS_EVALUATION_UNIFORM_BLOCKS",
+                 GL_MAX_COMBINED_UNIFORM_BLOCKS, "GL_MAX_COMBINED_UNIFORM_BLOCKS"},
+                {GL_MAX_GEOMETRY_UNIFORM_BLOCKS, "GL_MAX_GEOMETRY_UNIFORM_BLOCKS", GL_MAX_COMBINED_UNIFORM_BLOCKS,
+                 "GL_MAX_COMBINED_UNIFORM_BLOCKS"},
+                {GL_MAX_FRAGMENT_UNIFORM_BLOCKS, "GL_MAX_FRAGMENT_UNIFORM_BLOCKS", GL_MAX_COMBINED_UNIFORM_BLOCKS,
+                 "GL_MAX_COMBINED_UNIFORM_BLOCKS"},
+                {GL_MAX_COMPUTE_SHADER_STORAGE_BLOCKS, "GL_MAX_COMPUTE_SHADER_STORAGE_BLOCKS",
+                 GL_MAX_COMBINED_SHADER_STORAGE_BLOCKS, "GL_MAX_COMBINED_SHADER_STORAGE_BLOCKS"},
+                {GL_MAX_FRAGMENT_SHADER_STORAGE_BLOCKS, "GL_MAX_FRAGMENT_SHADER_STORAGE_BLOCKS",
+                 GL_MAX_COMBINED_SHADER_STORAGE_BLOCKS, "GL_MAX_COMBINED_SHADER_STORAGE_BLOCKS"},
+            };
+            for (const StageAgainstCombined& relation : stageRelations) {
+                GLint stage = -1;
+                GLint combined = -1;
+                glGetIntegerv(relation.stage, &stage);
+                glGetIntegerv(relation.combined, &combined);
+                ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR)) << relation.stageName;
+                EXPECT_LE(stage, combined)
+                    << relation.stageName << " = " << stage << " exceeds " << relation.combinedName << " = "
+                    << combined << "; GL 4.6 table 23.64 orders MAX_*_BUFFER_BINDINGS >= MAX_COMBINED_*_BLOCKS >= "
+                       "every per-stage count, and a single-stage program may use its whole per-stage allowance";
+            }
         }
 
         // KHR-GL44.multi_bind.functional_bind_buffers_range sizes each of an indexed target's
@@ -199,6 +248,80 @@ namespace MGITest {
                    "derived component limits are computed in";
         }
 
+        // The GL 4.5 core minimums that had no case in the getter at all, or that were still
+        // carrying an ES/GL3.3-tier number. Every one of these answered GL_INVALID_ENUM or a
+        // too-small value against a context advertising 4.6, and each is the FIRST call its
+        // conformance case makes - so the case died before it could measure anything.
+        //
+        // The cull pair is deliberately absent: zero is a legal answer there (a backend with no
+        // cull-distance route MUST report it), so it is checked for answerability only, below.
+        TEST_F(AdvertisedLimitsScenario, EveryGL45CoreMinimumIsMet) {
+            const std::vector<LimitBound> table = {
+                {GL_MAX_VARYING_VECTORS, "GL_MAX_VARYING_VECTORS", 15, 256},
+                {GL_MAX_VERTEX_UNIFORM_VECTORS, "GL_MAX_VERTEX_UNIFORM_VECTORS", 256, 1 << 20},
+                {GL_MAX_VARYING_COMPONENTS, "GL_MAX_VARYING_COMPONENTS", 60, 1 << 20},
+                // GL_MAX_VERTEX_STREAMS is deliberately absent. GL 4.5 requires 4 and MobileGL
+                // answers 1, which is a KNOWN non-conformance rather than an oversight: raising
+                // the number un-gates two transform-feedback CTS cases per package across
+                // KHR-GL40..GL46 that then fail, because no part of the shader pipeline supports
+                // layout(stream = N). See the GL_MAX_VERTEX_STREAMS case in GL_Getter.cpp. Adding
+                // a row here would pin a number the implementation cannot back.
+                {GL_MAX_GEOMETRY_SHADER_INVOCATIONS, "GL_MAX_GEOMETRY_SHADER_INVOCATIONS", 32, 256},
+                {GL_MAX_SUBROUTINES, "GL_MAX_SUBROUTINES", 256, 1 << 20},
+                {GL_MAX_SUBROUTINE_UNIFORM_LOCATIONS, "GL_MAX_SUBROUTINE_UNIFORM_LOCATIONS", 1024, 1 << 20},
+                {GL_MAX_TESS_CONTROL_INPUT_COMPONENTS, "GL_MAX_TESS_CONTROL_INPUT_COMPONENTS", 128, 1 << 16},
+                {GL_MAX_TESS_CONTROL_OUTPUT_COMPONENTS, "GL_MAX_TESS_CONTROL_OUTPUT_COMPONENTS", 128, 1 << 16},
+                {GL_MAX_TESS_CONTROL_TOTAL_OUTPUT_COMPONENTS, "GL_MAX_TESS_CONTROL_TOTAL_OUTPUT_COMPONENTS", 4096,
+                 1 << 20},
+                {GL_MAX_TESS_CONTROL_TEXTURE_IMAGE_UNITS, "GL_MAX_TESS_CONTROL_TEXTURE_IMAGE_UNITS", 16, 256},
+                {GL_MAX_TESS_CONTROL_UNIFORM_COMPONENTS, "GL_MAX_TESS_CONTROL_UNIFORM_COMPONENTS", 1024, 1 << 20},
+                {GL_MAX_TESS_CONTROL_UNIFORM_BLOCKS, "GL_MAX_TESS_CONTROL_UNIFORM_BLOCKS", 14, 256},
+                {GL_MAX_TESS_EVALUATION_INPUT_COMPONENTS, "GL_MAX_TESS_EVALUATION_INPUT_COMPONENTS", 128, 1 << 16},
+                {GL_MAX_TESS_EVALUATION_OUTPUT_COMPONENTS, "GL_MAX_TESS_EVALUATION_OUTPUT_COMPONENTS", 128, 1 << 16},
+                {GL_MAX_TESS_EVALUATION_TEXTURE_IMAGE_UNITS, "GL_MAX_TESS_EVALUATION_TEXTURE_IMAGE_UNITS", 16, 256},
+                {GL_MAX_TESS_EVALUATION_UNIFORM_COMPONENTS, "GL_MAX_TESS_EVALUATION_UNIFORM_COMPONENTS", 1024,
+                 1 << 20},
+                {GL_MAX_TESS_EVALUATION_UNIFORM_BLOCKS, "GL_MAX_TESS_EVALUATION_UNIFORM_BLOCKS", 14, 256},
+                {GL_MAX_TESS_PATCH_COMPONENTS, "GL_MAX_TESS_PATCH_COMPONENTS", 120, 1 << 16},
+                {GL_MAX_COMBINED_TESS_CONTROL_UNIFORM_COMPONENTS, "GL_MAX_COMBINED_TESS_CONTROL_UNIFORM_COMPONENTS",
+                 58368, 1 << 30},
+                {GL_MAX_COMBINED_TESS_EVALUATION_UNIFORM_COMPONENTS,
+                 "GL_MAX_COMBINED_TESS_EVALUATION_UNIFORM_COMPONENTS", 58368, 1 << 30},
+            };
+            for (const LimitBound& bound : table) {
+                GLint value = -424242;
+                glGetIntegerv(bound.pname, &value);
+                const unsigned int error = FirstGLError();
+                EXPECT_EQ(error, GLenum(GL_NO_ERROR)) << bound.name << " is not answerable: " << GLErrorName(error);
+                if (error != GL_NO_ERROR) continue;
+                EXPECT_GE(value, bound.minimum) << bound.name << " = " << value << " is below the GL 4.5 minimum "
+                                                << bound.minimum;
+                EXPECT_LE(value, bound.ceiling) << bound.name << " = " << value << " exceeds the ceiling "
+                                                << bound.ceiling;
+            }
+
+            // ARB_cull_distance's pair. Zero is honest on a backend with no cull-distance route,
+            // so only answerability and the combined-limit ordering are checked here.
+            GLint cull = -1;
+            GLint clip = -1;
+            GLint combined = -1;
+            glGetIntegerv(GL_MAX_CULL_DISTANCES, &cull);
+            glGetIntegerv(GL_MAX_CLIP_DISTANCES, &clip);
+            glGetIntegerv(GL_MAX_COMBINED_CLIP_AND_CULL_DISTANCES, &combined);
+            ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR)) << "the ARB_cull_distance queries must not error";
+            EXPECT_GE(cull, 0);
+            EXPECT_GE(combined, cull) << "GL 4.6 core 11.1.3.10: the combined limit is at least the cull one";
+            EXPECT_GE(combined, clip) << "GL 4.6 core 11.1.3.10: the combined limit is at least the clip one";
+
+            // GL_MAX_ELEMENT_INDEX is 64-bit state: the required 2^32-1 does not fit a GLint, so
+            // the wide query must answer it and the narrow one must saturate rather than wrap.
+            GLint64 elementIndex = -1;
+            glGetInteger64v(GL_MAX_ELEMENT_INDEX, &elementIndex);
+            ASSERT_EQ(FirstGLError(), GLenum(GL_NO_ERROR));
+            EXPECT_GE(elementIndex, static_cast<GLint64>(4294967295LL))
+                << "GL 4.5 core table 23.55 sets the GL_MAX_ELEMENT_INDEX minimum at 2^32-1";
+        }
+
         // ARB_viewport_array's own limits. They are advertised from three different places -
         // GL_MAX_VIEWPORTS from the frontend's indexed state width, the bounds range and the
         // subpixel bits from the backend caps table - and each backend fills that table from a

MobileGL/MG_IntegrationTest/Scenarios/AtomicCounterScenario.cpp

@@ -225,4 +225,43 @@ void main() {
         EXPECT_EQ(values[1], reseed[1] + 2 * kInvocations) << "the re-seeded value at offset 4 did not reach the shader";
     }
 
+    // A CPU glBufferSubData issued AFTER a dispatch, read back with NO further GPU work in
+    // between. Each backend has its own way to invert this pair, and both are pinned here.
+    // DirectGLES queues app SubData ranges for the draw-time staged-copy flush (the upload
+    // ring) instead of uploading in place, and readback of a GPU-written buffer overwrites
+    // the frontend shadow with the driver copy - so if the readback path forgets to flush the
+    // queued range first, the newer CPU write is REVERTED by the readback and offset 0 reads
+    // the dispatch's value instead of the reseed. DirectVulkan adopts the buffer into
+    // coherent GPU memory the moment the dispatch resolves its descriptor, so the SubData
+    // write lands in the very bytes the GPU reads - while the dispatch still sits recorded in
+    // the deferred frame command buffer. Unless the frontend retires that pending work before
+    // writing the adopted store (BufferObject::UploadSubData), the dispatch executes ON TOP
+    // of the reseed and offset 0 reads reseed + increments instead of the reseed. Offset 4
+    // pins the other direction for both: the upload must leave bytes outside its range - the
+    // dispatch's results - untouched.
+    TEST_F(AtomicCounterScenario, SubDataAfterDispatchSurvivesAnImmediateReadback) {
+        if (!Ready() || IsSkipped()) return;
+
+        const GLuint zero = MakeCounterBuffer(0, {0u, 0u});
+        MakeCounterBuffer(1, {0u});
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        Dispatch();
+
+        const unsigned int reseed = 4242u;
+        glBindBuffer(GL_ATOMIC_COUNTER_BUFFER, zero);
+        glBufferSubData(GL_ATOMIC_COUNTER_BUFFER, 0, sizeof(reseed), &reseed);
+        glBindBuffer(GL_ATOMIC_COUNTER_BUFFER, 0);
+        ASSERT_EQ(FirstGLError(), 0u) << "re-seeding the counter buffer raised a GL error";
+
+        const std::vector<unsigned int> values = ReadCounters(zero, 2);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_EQ(values[0], reseed)
+            << "offset 0 read back " << values[0] << "; the dispatch's value (" << kInvocations
+            << ") means the readback ran before the queued SubData range was flushed and reverted it";
+        EXPECT_EQ(values[1], 2 * kInvocations)
+            << "offset 4 read back " << values[1] << "; the SubData flush must leave bytes outside its "
+            << "range untouched";
+    }
+
 } // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/ClearTexImageUndefinedLevelZeroScenario.cpp

@@ -0,0 +1,250 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/ClearTexImageUndefinedLevelZeroScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - glClearTexImage ON A TEXTURE WHOSE GL LEVEL 0 WAS NEVER DEFINED.
+//
+// KHR-GL4[456].clear_tex_image.* builds exactly one shape: fillTexture() issues ONE
+// glTexImage2D(GL_TEXTURE_2D, m_texLevel, ...) - the only texImage2D in the whole format/level
+// family - sets GL_TEXTURE_MAX_LEVEL to that level, clears it and reads it back with
+// glGetTexImage(..., m_texLevel, ...). For m_texLevel > 0 the levels BELOW the defined one have no
+// storage at all, and the split in the conformance results was on that alone: every texLevel_0 body
+// passed on DirectVulkan and every texLevel != 0 body failed, across all four internal formats and
+// all three entry points.
+//
+// The frontend understands this shape - the clear is a pure CPU-shadow write, and
+// ValidateTextureImageQuery deliberately does not demand mip completeness for a readback. The
+// Vulkan backend did not: VkTextureManager takes storage mip 0 as the physical image extent, so a
+// texture with no level 0 got no VkImage, SyncTextureAndGetDescriptor answered nullptr, and
+// VulkanRenderer::GetTextureImage took a silent early return - leaving the caller's buffer exactly
+// as it found it. The conformance failures carried no <Text> at all, because nothing raised a GL
+// error: the destination was simply never written, so the test compared its own zero-initialized
+// buffer against the clear value.
+//
+// The fix this pins is the readback fallback: with NO VkImage, nothing GPU-side can ever have
+// written the texture, so the CPU shadow IS its content and is the correct answer. It is gated on
+// "no image exists at all" and not on "syncing was inconvenient - a blanket shadow answer would
+// return stale bytes for every render-to-texture result instead.
+//
+// NOT covered here, and deliberately: such a texture still has no VkImage, so it remains invisible
+// to SAMPLING and rendering on DirectVulkan. Backing the image from the lowest defined level is a
+// separate change (it moves every GL-level-to-subresource translation in the backend); this
+// scenario asserts the readback contract only, and the DirectGLES leg - which has always been able
+// to define a lone level N - is the built-in control for what the answer should be.
+
+#include <array>
+#include <cstdint>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // The conformance family's own shape: a mid-chain level of a texture that has nothing else.
+        constexpr GLint kDefinedLevel = 3;
+        constexpr GLsizei kLevelExtent = 8;
+
+        struct Texel8 {
+            GLubyte r = 0, g = 0, b = 0, a = 0;
+            bool operator==(const Texel8& other) const {
+                return r == other.r && g == other.g && b == other.b && a == other.a;
+            }
+        };
+
+        std::ostream& operator<<(std::ostream& os, const Texel8& c) {
+            return os << "rgba(" << int(c.r) << "," << int(c.g) << "," << int(c.b) << "," << int(c.a) << ")";
+        }
+
+        // The conformance test's clear value is a single repeated component; 5 is what it uses, and
+        // it is deliberately neither 0 (an unwritten destination) nor 255 (a saturated one).
+        constexpr Texel8 kClearValue{5, 5, 5, 5};
+        constexpr Texel8 kInitialValue{200, 100, 50, 255};
+
+        class ClearTexImageUndefinedLevelZeroScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                DrainErrors();
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                if (m_texture != 0) {
+                    glBindTexture(GL_TEXTURE_2D, 0);
+                    glDeleteTextures(1, &m_texture);
+                    m_texture = 0;
+                }
+                DrainErrors();
+            }
+
+            static void DrainErrors() {
+                for (int i = 0; i < 16 && glGetError() != GL_NO_ERROR; ++i) {
+                }
+            }
+
+            // One level and nothing else, through glTexImage2D - deliberately NOT glTexStorage2D,
+            // which would define the whole chain and could not express "level 0 does not exist".
+            void MakeTextureWithOnlyLevel(GLint level) {
+                if (m_texture != 0) glDeleteTextures(1, &m_texture);
+                glGenTextures(1, &m_texture);
+                glBindTexture(GL_TEXTURE_2D, m_texture);
+                const std::vector<Texel8> initial(static_cast<std::size_t>(kLevelExtent) * kLevelExtent, kInitialValue);
+                glTexImage2D(GL_TEXTURE_2D, level, GL_RGBA8, kLevelExtent, kLevelExtent, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+                             initial.data());
+                // What the conformance case does: MAX_LEVEL names the one level that exists, and
+                // BASE_LEVEL is left at its default 0 - which is what makes level 0 undefined AND
+                // nominally the base level, the shape the backend could not express.
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAX_LEVEL, level);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                ASSERT_EQ(FirstGLError(), 0u) << "texture setup with only level " << level;
+            }
+
+            std::vector<Texel8> ReadLevel(GLint level) {
+                std::vector<Texel8> pixels(static_cast<std::size_t>(kLevelExtent) * kLevelExtent, Texel8{0, 0, 0, 0});
+                glBindTexture(GL_TEXTURE_2D, m_texture);
+                glGetTexImage(GL_TEXTURE_2D, level, GL_RGBA, GL_UNSIGNED_BYTE, pixels.data());
+                EXPECT_EQ(FirstGLError(), 0u) << "glGetTexImage(level " << level << ") left a GL error behind";
+                return pixels;
+            }
+
+            void ExpectAllTexels(const char* what, const std::vector<Texel8>& pixels, Texel8 expected) {
+                std::size_t offenders = 0;
+                Texel8 firstBad{};
+                for (const Texel8& pixel : pixels) {
+                    if (pixel == expected) continue;
+                    if (offenders == 0) firstBad = pixel;
+                    ++offenders;
+                }
+                EXPECT_EQ(offenders, 0u) << what << ": got " << firstBad << " instead of " << expected << " ("
+                                         << offenders << " of " << pixels.size() << " texels wrong)";
+            }
+
+            // Level 0 defined, a GAP, then `level` defined. GL keeps the intervening levels at a zero
+            // extent, so the backend's mip walk stops at the gap and the VkImage ends up with FEWER
+            // mip levels than the GL level count - which is a different shape from "no image at all"
+            // and is why the readback has to bound the level against the IMAGE.
+            void MakeTextureWithAGapBefore(GLint level) {
+                if (m_texture != 0) glDeleteTextures(1, &m_texture);
+                glGenTextures(1, &m_texture);
+                glBindTexture(GL_TEXTURE_2D, m_texture);
+                const std::vector<Texel8> base(static_cast<std::size_t>(kLevelExtent) * kLevelExtent, kInitialValue);
+                glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, kLevelExtent, kLevelExtent, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+                             base.data());
+                const std::vector<Texel8> gapped(static_cast<std::size_t>(kLevelExtent) * kLevelExtent, kInitialValue);
+                glTexImage2D(GL_TEXTURE_2D, level, GL_RGBA8, kLevelExtent, kLevelExtent, 0, GL_RGBA,
+                             GL_UNSIGNED_BYTE, gapped.data());
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAX_LEVEL, level);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                ASSERT_EQ(FirstGLError(), 0u) << "texture setup with a gap before level " << level;
+            }
+
+            GLuint m_texture = 0;
+        };
+
+    } // namespace
+
+    // The regression. Before the fix glGetTexImage wrote nothing at all on DirectVulkan, so the
+    // caller's buffer kept whatever it already held - which is why the conformance failures showed
+    // the test's own zero-initialized memory and carried no GL error.
+    TEST_F(ClearTexImageUndefinedLevelZeroScenario, ClearAndReadBackALevelWhoseLowerLevelsDoNotExist) {
+        if (!Ready()) GTEST_SKIP();
+        MakeTextureWithOnlyLevel(kDefinedLevel);
+
+        // Pre-flight: the level reads back as what was uploaded. This is what makes the assertion
+        // after the clear falsifiable - without it, a readback that silently wrote nothing could not
+        // be told from one that wrote the right answer.
+        ExpectAllTexels("before the clear", ReadLevel(kDefinedLevel), kInitialValue);
+
+        glClearTexImage(m_texture, kDefinedLevel, GL_RGBA, GL_UNSIGNED_BYTE, &kClearValue);
+        EXPECT_EQ(FirstGLError(), 0u) << "glClearTexImage was rejected";
+
+        ExpectAllTexels("after the clear", ReadLevel(kDefinedLevel), kClearValue);
+        Gl().EndFrame();
+    }
+
+    // The same shape through glClearTexSubImage, which is a separate entry point in the conformance
+    // family and failed on exactly the same bodies.
+    TEST_F(ClearTexImageUndefinedLevelZeroScenario, ClearSubImageOfALevelWhoseLowerLevelsDoNotExist) {
+        if (!Ready()) GTEST_SKIP();
+        MakeTextureWithOnlyLevel(kDefinedLevel);
+
+        glClearTexSubImage(m_texture, kDefinedLevel, 0, 0, 0, kLevelExtent, kLevelExtent, 1, GL_RGBA,
+                           GL_UNSIGNED_BYTE, &kClearValue);
+        EXPECT_EQ(FirstGLError(), 0u) << "glClearTexSubImage was rejected";
+
+        ExpectAllTexels("after the sub-image clear", ReadLevel(kDefinedLevel), kClearValue);
+        Gl().EndFrame();
+    }
+
+    // The negative control: an ORDINARY texture, whose level 0 does exist, must keep answering from
+    // the GPU image rather than being diverted onto the shadow. A fallback that fired unconditionally
+    // would pass the two tests above and this one too - but it would also hand back stale bytes for
+    // anything the GPU had written, which is why the partial-clear check below matters: the readback
+    // has to see a region the backend cleared and a region it did not, in one image.
+    TEST_F(ClearTexImageUndefinedLevelZeroScenario, AnOrdinaryLevelZeroTextureStillReadsBackCorrectly) {
+        if (!Ready()) GTEST_SKIP();
+        MakeTextureWithOnlyLevel(0);
+
+        ExpectAllTexels("before the clear", ReadLevel(0), kInitialValue);
+
+        // Clear only the left half, so the answer is neither "all initial" nor "all cleared".
+        glClearTexSubImage(m_texture, 0, 0, 0, 0, kLevelExtent / 2, kLevelExtent, 1, GL_RGBA, GL_UNSIGNED_BYTE,
+                           &kClearValue);
+        EXPECT_EQ(FirstGLError(), 0u) << "glClearTexSubImage was rejected";
+
+        const std::vector<Texel8> pixels = ReadLevel(0);
+        ASSERT_EQ(pixels.size(), static_cast<std::size_t>(kLevelExtent) * kLevelExtent);
+        for (int y = 0; y < kLevelExtent; ++y) {
+            for (int x = 0; x < kLevelExtent; ++x) {
+                const Texel8 expected = x < kLevelExtent / 2 ? kClearValue : kInitialValue;
+                const Texel8 actual = pixels[static_cast<std::size_t>(y) * kLevelExtent + x];
+                ASSERT_EQ(actual, expected) << "at (" << x << "," << y << ")";
+            }
+        }
+        Gl().EndFrame();
+    }
+
+    // The adjacent shape the first fix did NOT cover: level 0 defined, a gap, then the level being
+    // read. This one DOES get a VkImage - just one with fewer mip levels than GL thinks the texture
+    // has - so the "no VkImage" test passes and the GL level was written straight into
+    // imageSubresource.mipLevel and into a VkImageMemoryBarrier's baseMipLevel. An out-of-range
+    // subresource is a promise the driver takes at face value; the glCopyImageSubData path two
+    // functions away grew the same guard after it SIGSEGV'd inside the Adreno driver.
+    //
+    // The level being read really does hold its own data (the shadow is its only copy, since nothing
+    // ever uploaded it), so the correct answer is the uploaded bytes - not a decline.
+    TEST_F(ClearTexImageUndefinedLevelZeroScenario, ReadBackALevelSeparatedFromLevelZeroByAGap) {
+        if (!Ready()) GTEST_SKIP();
+        MakeTextureWithAGapBefore(kDefinedLevel);
+
+        ExpectAllTexels("before the clear", ReadLevel(kDefinedLevel), kInitialValue);
+
+        glClearTexImage(m_texture, kDefinedLevel, GL_RGBA, GL_UNSIGNED_BYTE, &kClearValue);
+        EXPECT_EQ(FirstGLError(), 0u) << "glClearTexImage was rejected";
+
+        ExpectAllTexels("after the clear", ReadLevel(kDefinedLevel), kClearValue);
+
+        // Level 0 is backed by the real image and must still read back from it, so the level bound is
+        // about the level and not about the texture.
+        ExpectAllTexels("level 0 after clearing level 3", ReadLevel(0), kInitialValue);
+        Gl().EndFrame();
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/CopyImagePacked16Scenario.cpp

@@ -0,0 +1,375 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/CopyImagePacked16Scenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - glCopyImageSubData PRESERVES 16-BIT PACKED WORDS ACROSS AN ARRAY MIP LEVEL.
+//
+// The shape is lifted verbatim from the 18 Espryt bodies of KHR-GL4x.copy_image.functional
+// that survived every earlier wave: the three internal formats MobileGL can keep as 16-bit
+// packed ES storage - GL_RGB5 (stored GL_RGB565), GL_RGB5_A1, GL_RGBA4 - crossed with the
+// target pairs that put a GL_TEXTURE_2D_ARRAY's MIP LEVEL 1 on one side of the copy. On the
+// affected Mali the mirrored *_REV field order is a property of WHOLE ALLOCATIONS (shape-
+// and context-dependent; the failing 30x30x12 arrays carry it at every level, the small
+// arrays of the suite's passing iterations do not), and glCopyImageSubData - a raw
+// texel-block move - between a mirrored allocation and a plain one lands the fields
+// reversed: src word 0x0047 arrives as 0x8C20 (its 5_5_5_1 -> 1_5_5_5_REV re-encoding),
+// 0x0007 as 0x3800, byte-exact on every failing body. Uploads and readbacks of the same
+// image are clean (the driver decodes its own layout consistently), which is why only the
+// copy path ever crossed the two layouts and why the CTS's "source image was not modified"
+// checks always passed.
+//
+// The array is 30x30x12 with THREE levels and the flat endpoint is 7x7 with three levels
+// (7/3/1) because that is the allocation the failures pin - the CTS builds every functional
+// texture with FUNCTIONAL_TEST_N_LEVELS = 3 (makeTextureComplete(0, 2)) - and any deviation
+// from the measured shape might sit on the clean side of whatever allocation heuristic picks
+// the driver's layout.
+//
+// The repair under test is the packed16 storage widening
+// (PixelFormatNormalizeOptionBit::WidenPacked16Norm): where the POST probe
+// (SelfTest::CopyImageMirrorsPacked16FieldOrder) measures the mirror - or
+// MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE forces it - the three formats are stored as
+// GL_RGB8/GL_RGBA8, leaving no 16-bit packed image for a copy to disagree about. The client
+// word still round-trips exactly: the canonical shadow is already UNorm8, and an n-bit field
+// encodes to UNorm8 and back losslessly for every n <= 8.
+//
+// This scenario runs in BOTH configurations, and both must hand back identical client words:
+//   * the ambient registrations take the narrow path on a clean driver (llvmpipe has no
+//     mirror, so Auto keeps the native 16-bit storage - the pre-existing behaviour stays
+//     covered);
+//   * the DirectGLES.WidenedPacked16. registration pins MOBILEGL_ESPRYT_WIDEN_PACKED16_STORAGE=1,
+//     which is the storage every affected device will actually run - without it the repair
+//     is unfalsifiable off-device, because no CI driver has the bug that arms it.
+// The Mali mirror itself CANNOT be reproduced here; only the on-device CTS run can show the
+// widening killing the 18 bodies. What this scenario pins is that the widened storage is
+// client-invisible: same words in, same words out, on every leg the failing bodies used.
+//
+// DirectVulkan is the control - Magma has always resolved these formats to RGBA8 - so a
+// failure on both backends means the scenario is wrong, and a failure on DirectGLES alone
+// means the widening (or the narrow path it replaces) is.
+
+#include <algorithm>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr int kBaseSize = 30; // array level 0; level 1 is 15x15
+        constexpr int kLevel1Size = kBaseSize / 2;
+        constexpr int kLayers = 12;
+        constexpr int kFlatSize = 7; // the plain-2D / renderbuffer endpoint, level 0
+        // Copies cover the whole flat endpoint and land at (8, 8) inside the 15x15 level so
+        // that offsets are honoured, not just texel (0, 0): 8 + 7 == 15 reaches the far edge.
+        constexpr int kRegion = kFlatSize;
+        constexpr int kArrayOffset = 8;
+
+        struct PackedFormatCase {
+            GLenum internalFormat; // the spelling the CTS uses
+            GLenum transferFormat;
+            GLenum transferType;
+            const char* name;
+        };
+
+        // Per-texel varying words, every field inside its width, so a swapped field order (or
+        // a mis-addressed row) cannot cancel out the way a uniform fill would let it.
+        GLushort MakeWord(GLenum type, int i) {
+            switch (type) {
+            case GL_UNSIGNED_SHORT_5_6_5: {
+                const int r = i % 32, g = (i * 7 + 3) % 64, b = (i * 5 + 11) % 32;
+                return static_cast<GLushort>((r << 11) | (g << 5) | b);
+            }
+            case GL_UNSIGNED_SHORT_4_4_4_4: {
+                const int r = i % 16, g = (i * 3 + 1) % 16, b = (i * 7 + 5) % 16, a = (i * 5 + 2) % 16;
+                return static_cast<GLushort>((r << 12) | (g << 8) | (b << 4) | a);
+            }
+            case GL_UNSIGNED_SHORT_5_5_5_1: {
+                const int r = i % 32, g = (i * 7 + 3) % 32, b = (i * 3 + 11) % 32, a = i % 2;
+                return static_cast<GLushort>((r << 11) | (g << 6) | (b << 1) | a);
+            }
+            default:
+                return 0;
+            }
+        }
+
+        std::vector<GLushort> MakeWords(GLenum type, int count, int seed) {
+            std::vector<GLushort> words(static_cast<size_t>(count));
+            for (int i = 0; i < count; ++i) {
+                words[static_cast<size_t>(i)] = MakeWord(type, i + seed);
+            }
+            return words;
+        }
+
+        class CopyImagePacked16Scenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                // 16-bit rows are 2-byte aligned; the default 4-byte row alignment would pad
+                // every odd-width row of the 15x15 level and shear the comparisons.
+                glPixelStorei(GL_UNPACK_ALIGNMENT, 2);
+                glPixelStorei(GL_PACK_ALIGNMENT, 2);
+                if (!CopyImageSubDataUsable()) {
+                    GTEST_SKIP() << "glCopyImageSubData is unavailable on backend " << Gl().BackendName();
+                }
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glPixelStorei(GL_UNPACK_ALIGNMENT, 4);
+                glPixelStorei(GL_PACK_ALIGNMENT, 4);
+                for (const GLuint texture : m_textures) {
+                    glDeleteTextures(1, &texture);
+                }
+                m_textures.clear();
+                if (m_renderbuffer != 0) {
+                    glDeleteRenderbuffers(1, &m_renderbuffer);
+                    m_renderbuffer = 0;
+                }
+                if (m_fbo != 0) {
+                    glBindFramebuffer(GL_FRAMEBUFFER, 0);
+                    glDeleteFramebuffers(1, &m_fbo);
+                    m_fbo = 0;
+                }
+            }
+
+            bool CopyImageSubDataUsable() {
+                GLuint probe[2] = {0, 0};
+                glGenTextures(2, probe);
+                for (const GLuint texture : probe) {
+                    glBindTexture(GL_TEXTURE_2D_ARRAY, texture);
+                    glTexStorage3D(GL_TEXTURE_2D_ARRAY, 1, GL_RGBA8, 1, 1, 1);
+                }
+                glBindTexture(GL_TEXTURE_2D_ARRAY, 0);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                glCopyImageSubData(probe[0], GL_TEXTURE_2D_ARRAY, 0, 0, 0, 0, probe[1], GL_TEXTURE_2D_ARRAY, 0, 0, 0,
+                                   0, 1, 1, 1);
+                const bool usable = glGetError() == GL_NO_ERROR;
+                glDeleteTextures(2, probe);
+                return usable;
+            }
+
+            // The CTS's own mutable shape: glTexImage3D per level, filter NEAREST, THREE levels
+            // (30/15/7) with the chain clamped to them. Level 2 carries its own fill so nothing
+            // below can pass by reading a level that was never written.
+            GLuint MakeArrayTexture(const PackedFormatCase& format, const std::vector<GLushort>& level0,
+                                    const std::vector<GLushort>& level1) {
+                GLuint texture = 0;
+                glGenTextures(1, &texture);
+                m_textures.push_back(texture);
+                glBindTexture(GL_TEXTURE_2D_ARRAY, texture);
+                glTexParameteri(GL_TEXTURE_2D_ARRAY, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D_ARRAY, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D_ARRAY, GL_TEXTURE_MAX_LEVEL, 2);
+                glTexImage3D(GL_TEXTURE_2D_ARRAY, 0, static_cast<GLint>(format.internalFormat), kBaseSize, kBaseSize,
+                             kLayers, 0, format.transferFormat, format.transferType, level0.data());
+                glTexImage3D(GL_TEXTURE_2D_ARRAY, 1, static_cast<GLint>(format.internalFormat), kLevel1Size,
+                             kLevel1Size, kLayers, 0, format.transferFormat, format.transferType, level1.data());
+                const int level2Size = kLevel1Size / 2;
+                const auto level2 = MakeWords(format.transferType, level2Size * level2Size * kLayers, 211);
+                glTexImage3D(GL_TEXTURE_2D_ARRAY, 2, static_cast<GLint>(format.internalFormat), level2Size,
+                             level2Size, kLayers, 0, format.transferFormat, format.transferType, level2.data());
+                glBindTexture(GL_TEXTURE_2D_ARRAY, 0);
+                return texture;
+            }
+
+            // Three levels (7/3/1) like the CTS's plain endpoints; `texels` is level 0, the one
+            // every assertion reads.
+            GLuint MakeFlatTexture(const PackedFormatCase& format, const std::vector<GLushort>& texels) {
+                GLuint texture = 0;
+                glGenTextures(1, &texture);
+                m_textures.push_back(texture);
+                glBindTexture(GL_TEXTURE_2D, texture);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAX_LEVEL, 2);
+                glTexImage2D(GL_TEXTURE_2D, 0, static_cast<GLint>(format.internalFormat), kFlatSize, kFlatSize, 0,
+                             format.transferFormat, format.transferType, texels.data());
+                for (int level = 1; level <= 2; ++level) {
+                    const int size = std::max(kFlatSize >> level, 1);
+                    const auto fill = MakeWords(format.transferType, size * size, 97 + level);
+                    glTexImage2D(GL_TEXTURE_2D, level, static_cast<GLint>(format.internalFormat), size, size, 0,
+                                 format.transferFormat, format.transferType, fill.data());
+                }
+                glBindTexture(GL_TEXTURE_2D, 0);
+                return texture;
+            }
+
+            std::vector<GLushort> ReadTexImage(GLenum target, GLuint texture, int level,
+                                               const PackedFormatCase& format, size_t texelCount) {
+                std::vector<GLushort> words(texelCount, 0);
+                glBindTexture(target, texture);
+                glGetTexImage(target, level, format.transferFormat, format.transferType, words.data());
+                glBindTexture(target, 0);
+                return words;
+            }
+
+            // Every word of `got` inside the kRegion-square at (x0, y0) of a width-wide layer-0
+            // image equals the corresponding source word, and every word outside it still holds
+            // `fill`'s. Failures name the texel and both words, which is what turns a field-order
+            // regression into a one-line diagnosis.
+            void ExpectRegion(const std::vector<GLushort>& got, int width, int x0, int y0,
+                              const std::vector<GLushort>& source, int sourceWidth, int sourceX0, int sourceY0,
+                              const std::vector<GLushort>& fill, const char* what) {
+                for (int y = 0; y < width; ++y) {
+                    for (int x = 0; x < width && static_cast<size_t>(y * width + x) < got.size(); ++x) {
+                        const bool inRegion =
+                            x >= x0 && x < x0 + kRegion && y >= y0 && y < y0 + kRegion;
+                        const GLushort actual = got[static_cast<size_t>(y * width + x)];
+                        const GLushort expected =
+                            inRegion ? source[static_cast<size_t>((sourceY0 + y - y0) * sourceWidth + sourceX0 +
+                                                                  (x - x0))]
+                                     : fill[static_cast<size_t>(y * width + x)];
+                        EXPECT_EQ(actual, expected)
+                            << what << ": texel (" << x << ", " << y << ")"
+                            << (inRegion ? " (copied)" : " (untouched)") << " holds 0x" << std::hex << actual
+                            << ", expected 0x" << expected;
+                        if (actual != expected) return; // one texel names the defect; 224 more would bury it
+                    }
+                }
+            }
+
+            std::vector<GLuint> m_textures;
+            GLuint m_renderbuffer = 0;
+            GLuint m_fbo = 0;
+        };
+
+        const PackedFormatCase kFormats[] = {
+            {GL_RGB5, GL_RGB, GL_UNSIGNED_SHORT_5_6_5, "rgb5"},
+            {GL_RGB5_A1, GL_RGBA, GL_UNSIGNED_SHORT_5_5_5_1, "rgb5_a1"},
+            {GL_RGBA4, GL_RGBA, GL_UNSIGNED_SHORT_4_4_4_4, "rgba4"},
+        };
+
+        // texture_2d (the ES image behind GL_TEXTURE_RECTANGLE too) -> the array's level 1:
+        // the array-as-destination direction of 12 of the 18 failing bodies.
+        TEST_F(CopyImagePacked16Scenario, FlatImageLandsInArrayMipLevelIntact) {
+            if (!Ready() || IsSkipped()) return;
+            for (const PackedFormatCase& format : kFormats) {
+                const auto level0 = MakeWords(format.transferType, kBaseSize * kBaseSize * kLayers, 1);
+                const auto level1 = MakeWords(format.transferType, kLevel1Size * kLevel1Size * kLayers, 7);
+                const auto flat = MakeWords(format.transferType, kFlatSize * kFlatSize, 131);
+                const GLuint array = MakeArrayTexture(format, level0, level1);
+                const GLuint source = MakeFlatTexture(format, flat);
+                ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR)) << format.name << ": setup failed";
+
+                glCopyImageSubData(source, GL_TEXTURE_2D, 0, 0, 0, 0, array, GL_TEXTURE_2D_ARRAY, 1, kArrayOffset,
+                                   kArrayOffset, 0, kRegion, kRegion, 1);
+                ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR))
+                    << format.name << ": glCopyImageSubData raised an error";
+
+                const auto got = ReadTexImage(GL_TEXTURE_2D_ARRAY, array, 1, format,
+                                              static_cast<size_t>(kLevel1Size) * kLevel1Size * kLayers);
+                ExpectRegion(got, kLevel1Size, kArrayOffset, kArrayOffset, flat, kFlatSize, 0, 0, level1,
+                             (std::string("2d->2d_array level 1, ") + format.name).c_str());
+                // The source must not have moved - the CTS asserts this before it ever looks at
+                // the destination, and it is what pins the corruption to the copy itself.
+                const auto sourceAfter =
+                    ReadTexImage(GL_TEXTURE_2D, source, 0, format, static_cast<size_t>(kFlatSize) * kFlatSize);
+                ExpectRegion(sourceAfter, kFlatSize, 0, 0, flat, kFlatSize, 0, 0, flat,
+                             (std::string("source after 2d->2d_array, ") + format.name).c_str());
+            }
+        }
+
+        // The array's level 1 -> texture_2d: the array-as-source direction of the other 6
+        // bodies (2d_array -> 3d and 2d_array -> rectangle both read the level-1 array).
+        TEST_F(CopyImagePacked16Scenario, ArrayMipLevelLandsInFlatImageIntact) {
+            if (!Ready() || IsSkipped()) return;
+            for (const PackedFormatCase& format : kFormats) {
+                const auto level0 = MakeWords(format.transferType, kBaseSize * kBaseSize * kLayers, 1);
+                const auto level1 = MakeWords(format.transferType, kLevel1Size * kLevel1Size * kLayers, 7);
+                const auto fill = MakeWords(format.transferType, kFlatSize * kFlatSize, 131);
+                const GLuint array = MakeArrayTexture(format, level0, level1);
+                const GLuint destination = MakeFlatTexture(format, fill);
+                ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR)) << format.name << ": setup failed";
+
+                glCopyImageSubData(array, GL_TEXTURE_2D_ARRAY, 1, kArrayOffset, kArrayOffset, 0, destination,
+                                   GL_TEXTURE_2D, 0, 0, 0, 0, kRegion, kRegion, 1);
+                ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR))
+                    << format.name << ": glCopyImageSubData raised an error";
+
+                const auto got = ReadTexImage(GL_TEXTURE_2D, destination, 0, format,
+                                              static_cast<size_t>(kFlatSize) * kFlatSize);
+                ExpectRegion(got, kFlatSize, 0, 0, level1, kLevel1Size, kArrayOffset, kArrayOffset, fill,
+                             (std::string("2d_array level 1 -> 2d, ") + format.name).c_str());
+            }
+        }
+
+        // renderbuffer -> the array's level 1: the leg the remaining 3 bodies use, and the one
+        // that requires the renderbuffer's ES storage to move together with the textures' -
+        // glCopyImageSubData needs both endpoints in the same driver format, so a widening that
+        // reached textures alone would break exactly here.
+        TEST_F(CopyImagePacked16Scenario, RenderbufferLandsInArrayMipLevelIntact) {
+            if (!Ready() || IsSkipped()) return;
+            for (const PackedFormatCase& format : kFormats) {
+                const auto level0 = MakeWords(format.transferType, kBaseSize * kBaseSize * kLayers, 1);
+                const auto level1 = MakeWords(format.transferType, kLevel1Size * kLevel1Size * kLayers, 7);
+                const GLuint array = MakeArrayTexture(format, level0, level1);
+
+                if (m_renderbuffer == 0) glGenRenderbuffers(1, &m_renderbuffer);
+                glBindRenderbuffer(GL_RENDERBUFFER, m_renderbuffer);
+                glRenderbufferStorage(GL_RENDERBUFFER, format.internalFormat, kFlatSize, kFlatSize);
+                if (m_fbo == 0) glGenFramebuffers(1, &m_fbo);
+                glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+                glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_RENDERBUFFER, m_renderbuffer);
+                ASSERT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE))
+                    << format.name << ": the renderbuffer is not attachable";
+                // Field values picked to encode exactly in the narrow fields AND in their
+                // UNorm8 expansions, so the expected word is the same whichever storage the
+                // configuration picked - which is the point of the whole scenario.
+                const int maxG = format.transferType == GL_UNSIGNED_SHORT_5_6_5 ? 63 : 31;
+                const int max = format.transferType == GL_UNSIGNED_SHORT_4_4_4_4 ? 15 : 31;
+                const int maxGreen = format.transferType == GL_UNSIGNED_SHORT_4_4_4_4 ? 15 : maxG;
+                const GLfloat clearColor[4] = {static_cast<GLfloat>(8 % (max + 1)) / max,
+                                               static_cast<GLfloat>(maxGreen / 2) / maxGreen,
+                                               static_cast<GLfloat>(max - 2) / max, 1.0f};
+                // The context is shared with every scenario in this process; a scissor left on
+                // would clip the clear and hand the copy undefined renderbuffer texels.
+                glDisable(GL_SCISSOR_TEST);
+                glClearBufferfv(GL_COLOR, 0, clearColor);
+                glBindFramebuffer(GL_FRAMEBUFFER, 0);
+                ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR)) << format.name << ": setup failed";
+
+                glCopyImageSubData(m_renderbuffer, GL_RENDERBUFFER, 0, 0, 0, 0, array, GL_TEXTURE_2D_ARRAY, 1,
+                                   kArrayOffset, kArrayOffset, 0, kRegion, kRegion, 1);
+                ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR))
+                    << format.name << ": glCopyImageSubData raised an error";
+
+                GLushort clearedWord = 0;
+                switch (format.transferType) {
+                case GL_UNSIGNED_SHORT_5_6_5:
+                    clearedWord = static_cast<GLushort>((8 << 11) | ((maxGreen / 2) << 5) | (max - 2));
+                    break;
+                case GL_UNSIGNED_SHORT_5_5_5_1:
+                    clearedWord = static_cast<GLushort>((8 << 11) | ((maxGreen / 2) << 6) | ((max - 2) << 1) | 1);
+                    break;
+                case GL_UNSIGNED_SHORT_4_4_4_4:
+                    clearedWord = static_cast<GLushort>((8 << 12) | ((maxGreen / 2) << 8) | ((max - 2) << 4) | 15);
+                    break;
+                default:
+                    break;
+                }
+                std::vector<GLushort> expectedRegion(static_cast<size_t>(kRegion) * kRegion, clearedWord);
+                const auto got = ReadTexImage(GL_TEXTURE_2D_ARRAY, array, 1, format,
+                                              static_cast<size_t>(kLevel1Size) * kLevel1Size * kLayers);
+                ExpectRegion(got, kLevel1Size, kArrayOffset, kArrayOffset, expectedRegion, kRegion, 0, 0, level1,
+                             (std::string("renderbuffer -> 2d_array level 1, ") + format.name).c_str());
+            }
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/DualSourceBlendScenario.cpp

@@ -0,0 +1,238 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/DualSourceBlendScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - A DUAL-SOURCE BLEND DRAW HAS TO SURVIVE ON EVERY DRIVER.
+//
+// GL_SRC1_COLOR / GL_ONE_MINUS_SRC1_COLOR / GL_SRC1_ALPHA / GL_ONE_MINUS_SRC1_ALPHA
+// (ARB_blend_func_extended, core since 3.3) need a backend capability that not every device has:
+// GL_EXT_blend_func_extended on the ES driver, or the dualSrcBlend device feature on Vulkan. When
+// the capability IS there both backends translate the factors properly, and that has always
+// worked. When it is NOT, both backends used to THROW_EXCEPTION at draw time - and
+// MG_Util/Types.h's THROW_EXCEPTION is a plain `throw`, with no catch anywhere in MG_Impl or
+// MG_Backend, so the exception unwound out through the C GL ABI and killed the process. An
+// application asking for a blend factor the device cannot do is a picture problem, never a reason
+// to take the process down.
+//
+// Both are now a DECLINE: the attachment is drawn with blending off and neutral One/Zero factors,
+// and the loss is logged once. So a dual-source draw has exactly two defined outcomes, and this
+// scenario pins that it lands on one of them and never on a crash:
+//
+//   capability present - src0 * src1 + dst * (1 - src1)
+//   capability absent  - src0, written straight through
+//
+// What each CI lane actually reaches: lavapipe has dualSrcBlend, so the DirectVulkan lane runs the
+// whole sequence and measures the blend. Mesa's GLES front end on llvmpipe has no
+// GL_EXT_blend_func_extended, so the ESSL stage carrying `layout(index = 1)` never compiles and the
+// program renders nothing - the DirectGLES lane therefore SKIPS on the capability probe in SetUp
+// rather than measuring a picture the driver never produced. The DECLINE arm itself - the path this
+// scenario exists for - is unit-tested against stubbed capabilities in
+// MG_Test/Framebuffer/FramebufferTest.cpp (DualSourceBlendIsDeclinedRatherThanThrownWhenTheExtensionIsMissing),
+// which is the only place it can be reached without a driver that lacks the extension.
+//
+// The Vulkan half has a second edge the last case covers: the dual-source VUIDs
+// (VUID-VkPipelineColorBlendAttachmentState-srcColorBlendFactor-00608 and its three siblings)
+// forbid a VK_BLEND_FACTOR_SRC1_* anywhere in VkPipelineColorBlendAttachmentState without the
+// feature, whatever blendEnable says - so leaving the factors in place while clearing the enable
+// would still be invalid pipeline state.
+
+#include <cstdint>
+#include <string>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr int kExtent = 16;
+
+        constexpr const char* kVertexSource = R"(#version 330 core
+void main()
+{
+    switch (gl_VertexID)
+    {
+      case 0: gl_Position = vec4(-1.0, 1.0, 0.0, 1.0); break;
+      case 1: gl_Position = vec4( 1.0, 1.0, 0.0, 1.0); break;
+      case 2: gl_Position = vec4(-1.0,-1.0, 0.0, 1.0); break;
+      case 3: gl_Position = vec4( 1.0,-1.0, 0.0, 1.0); break;
+    }
+}
+)";
+
+        // Two outputs on the SAME location, indices 0 and 1: the shader-side spelling of
+        // dual-source output (GLSL 3.30 4.4.2, the `index` layout qualifier). No
+        // glBindFragDataLocationIndexed needed, which keeps the program buildable through the
+        // harness's compile-and-link helper.
+        constexpr const char* kDualSourceFragmentSource = R"(#version 330 core
+uniform vec4 uSrc0;
+uniform vec4 uSrc1;
+layout(location = 0, index = 0) out vec4 fragColor0;
+layout(location = 0, index = 1) out vec4 fragColor1;
+void main()
+{
+    fragColor0 = uSrc0;
+    fragColor1 = uSrc1;
+}
+)";
+
+        class DualSourceBlendScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                glGenVertexArrays(1, &m_vao);
+                glGenRenderbuffers(1, &m_renderbuffer);
+                glBindRenderbuffer(GL_RENDERBUFFER, m_renderbuffer);
+                glRenderbufferStorage(GL_RENDERBUFFER, GL_RGBA8, kExtent, kExtent);
+                glGenFramebuffers(1, &m_fbo);
+                glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+                glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_RENDERBUFFER, m_renderbuffer);
+                ASSERT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+
+                std::string error;
+                m_program = CompileProgram(kVertexSource, kDualSourceFragmentSource, &error);
+                m_programError = error;
+                glViewport(0, 0, kExtent, kExtent);
+                glDisable(GL_SCISSOR_TEST);
+                glDisable(GL_DEPTH_TEST);
+
+                // Capability probe, not an assertion. A GL link that succeeded is not proof that
+                // the BACKEND can run the program: DirectGLES transpiles to ESSL lazily at first
+                // use, and GLSL ES has no `index` layout qualifier outside
+                // GL_EXT_blend_func_extended, so on a driver without it the stage never compiles
+                // and the draw renders nothing. One unblended white draw tells the two apart, and
+                // the cases skip rather than measure a picture the driver never produced.
+                if (m_program != 0) {
+                    glDisable(GL_BLEND);
+                    glBlendFunc(GL_ONE, GL_ZERO);
+                    Draw(/*src0=*/1.0f, /*src1=*/1.0f);
+                    glFinish();
+                    const Image probe = ReadPixels(kExtent, kExtent);
+                    m_programRenders =
+                        !probe.Empty() && static_cast<int>(probe.At(kExtent / 2, kExtent / 2).r) > 245;
+                }
+                for (int i = 0; i < 16 && glGetError() != GL_NO_ERROR; ++i) {
+                }
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glDisable(GL_BLEND);
+                glBlendFunc(GL_ONE, GL_ZERO);
+                glBindFramebuffer(GL_FRAMEBUFFER, 0);
+                if (m_fbo != 0) glDeleteFramebuffers(1, &m_fbo);
+                if (m_renderbuffer != 0) glDeleteRenderbuffers(1, &m_renderbuffer);
+                if (m_program != 0) glDeleteProgram(m_program);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+            }
+
+            void Draw(float src0, float src1) {
+                glUseProgram(m_program);
+                glUniform4f(glGetUniformLocation(m_program, "uSrc0"), src0, src0, src0, 1.0f);
+                glUniform4f(glGetUniformLocation(m_program, "uSrc1"), src1, src1, src1, 1.0f);
+                glBindVertexArray(m_vao);
+                glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+                glBindVertexArray(0);
+                glUseProgram(0);
+            }
+
+            // Both cases share this gate: nothing below can be measured on a backend that cannot
+            // run a dual-source fragment program at all. Returns the skip reason, empty when the
+            // program runs - NOT a void helper that calls GTEST_SKIP itself, because GTEST_SKIP
+            // expands to a `return` and would leave only the HELPER, letting the case run its
+            // assertions anyway and report Failed instead of Skipped.
+            std::string WhyTheProgramCannotRun() const {
+                if (m_program == 0) {
+                    return "this driver cannot build a dual-source fragment shader: " + m_programError;
+                }
+                if (!m_programRenders) {
+                    return "this backend links a dual-source fragment program but renders nothing with it "
+                           "(GLSL ES has no `index` layout qualifier without GL_EXT_blend_func_extended)";
+                }
+                return {};
+            }
+
+            GLuint m_renderbuffer = 0;
+            GLuint m_fbo = 0;
+            GLuint m_vao = 0;
+            unsigned int m_program = 0;
+            bool m_programRenders = false;
+            std::string m_programError;
+        };
+
+    } // namespace
+
+    // The whole point of the scenario: this sequence used to be a process kill on any device
+    // without the capability, and it has to be a picture either way.
+    //
+    // dst is black, src0 is white and src1 is mid-grey, with SRC1_COLOR / ONE_MINUS_SRC1_COLOR.
+    //   blended  = 1.0 * 0.5 + 0.0 * 0.5 = 0.5  -> ~128
+    //   declined = 1.0                          ->  255
+    // Anything else means the factors were mistranslated rather than either honoured or declined.
+    TEST_F(DualSourceBlendScenario, DualSourceBlendDrawProducesOneOfTheTwoDefinedResults) {
+        if (!Ready()) GTEST_SKIP();
+        if (const std::string reason = WhyTheProgramCannotRun(); !reason.empty()) GTEST_SKIP() << reason;
+
+        glDisable(GL_BLEND);
+        glBlendFunc(GL_ONE, GL_ZERO);
+        Draw(/*src0=*/0.0f, /*src1=*/0.0f);
+
+        glEnable(GL_BLEND);
+        glBlendFunc(GL_SRC1_COLOR, GL_ONE_MINUS_SRC1_COLOR);
+        EXPECT_EQ(FirstGLError(), 0u) << "glBlendFunc must accept the GL_SRC1_* factors - they are core since 3.3";
+        Draw(/*src0=*/1.0f, /*src1=*/0.5f);
+        glFinish();
+        glDisable(GL_BLEND);
+        EXPECT_EQ(FirstGLError(), 0u) << "the dual-source draw left a GL error behind";
+
+        const Image image = ReadPixels(kExtent, kExtent);
+        ASSERT_FALSE(image.Empty());
+        const Rgba8 centre = image.At(kExtent / 2, kExtent / 2);
+        const int red = static_cast<int>(centre.r);
+        const bool blended = red > 100 && red < 160;
+        const bool declined = red > 245;
+        EXPECT_TRUE(blended || declined)
+            << "got " << centre << ", which is neither the dual-source blend (~128) nor the declined "
+            << "straight-through source (255) - the SRC1 factors were mistranslated";
+        Gl().EndFrame();
+    }
+
+    // The same factors with blending DISABLED. Nothing may blend, and on the Vulkan side nothing
+    // may reach VkPipelineColorBlendAttachmentState carrying a VK_BLEND_FACTOR_SRC1_* on a device
+    // without dualSrcBlend - the VUIDs bind to the struct, not to blendEnable. The picture is the
+    // source either way, so this case is really "no crash, no error, no surprise".
+    TEST_F(DualSourceBlendScenario, DualSourceFactorsWithBlendingDisabledJustWriteTheSource) {
+        if (!Ready()) GTEST_SKIP();
+        if (const std::string reason = WhyTheProgramCannotRun(); !reason.empty()) GTEST_SKIP() << reason;
+
+        glDisable(GL_BLEND);
+        glBlendFunc(GL_ONE, GL_ZERO);
+        Draw(/*src0=*/0.0f, /*src1=*/0.0f);
+
+        glBlendFunc(GL_SRC1_ALPHA, GL_ONE_MINUS_SRC1_ALPHA);
+        Draw(/*src0=*/1.0f, /*src1=*/0.25f);
+        glFinish();
+        EXPECT_EQ(FirstGLError(), 0u) << "a draw with SRC1 factors and blending off left a GL error behind";
+
+        const Image image = ReadPixels(kExtent, kExtent);
+        ASSERT_FALSE(image.Empty());
+        const Rgba8 centre = image.At(kExtent / 2, kExtent / 2);
+        EXPECT_GT(static_cast<int>(centre.r), 245)
+            << "got " << centre << ": blending is disabled, so the source has to be written straight through";
+        Gl().EndFrame();
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/IntegerBorderColorScenario.cpp

@@ -0,0 +1,391 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/IntegerBorderColorScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - AN INTEGER GL_TEXTURE_BORDER_COLOR REACHES AN isampler2D AS AN INTEGER.
+//
+// KHR-GL46.texture_border_clamp.Texture2D{R32I,R32UI} (and the 2DArray/3D siblings) set the border
+// colour with glSamplerParameterIiv/Iuiv, sample outside the texture through an integer sampler and
+// expect the value back. MobileGL returned 1132396544 on Espryt - which is 0x437F0000, the IEEE-754
+// bits of 255.0f, i.e. the float border-colour register read through an integer sampler - and 0 on
+// Magma, where the border fell through to VK_BORDER_COLOR_FLOAT_TRANSPARENT_BLACK.
+//
+// Two independent halves, and this scenario covers both because it goes through the frontend:
+//
+//   * the STATE had no record of which entry point wrote the border colour. All three
+//     representations are kept numerically in step, so the value alone cannot say whether the
+//     application called glTexParameterfv or glTexParameterIiv.
+//   * each backend then had exactly one border-colour call site: glTexParameterfv /
+//     glSamplerParameterfv on DirectGLES, and a snap-to-one-of-four-predefined-values on
+//     DirectVulkan that never emitted the VK_BORDER_COLOR_INT_* family at all.
+//
+// The border value is deliberately outside every predefined VkBorderColor and outside anything a
+// float register could round-trip: (255, -1, 7, 3) is neither transparent black, nor opaque black,
+// nor opaque white, so on DirectVulkan it can only be delivered through VK_EXT_custom_border_color.
+// That makes the scenario a real test of the extension path on lavapipe rather than a palette hit.
+//
+// Both an integer image view and an integer border colour are involved, which is the other half of
+// the Vulkan rule: VK_BORDER_COLOR_FLOAT_* on an integer image view is undefined behaviour
+// regardless of the value, so even a border of (0,0,0,1) has to resolve to INT_OPAQUE_BLACK.
+// InsideTexelsAreUnaffected is what keeps that from being asserted vacuously.
+
+#include <array>
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr int kOutputWidth = 8;
+        constexpr int kOutputHeight = 8;
+
+        // The texture's own texel, and the border. Neither is a Vulkan palette entry, and the border
+        // is deliberately not derivable from the texel.
+        constexpr std::int32_t kInsideTexel[4] = {11, 22, 33, 44};
+        constexpr std::int32_t kBorderColor[4] = {255, -1, 7, 3};
+
+        constexpr const char* kVertexSource = R"(#version 330 core
+void main()
+{
+    switch (gl_VertexID)
+    {
+      case 0: gl_Position = vec4(-1.0, 1.0, 0.0, 1.0); break;
+      case 1: gl_Position = vec4( 1.0, 1.0, 0.0, 1.0); break;
+      case 2: gl_Position = vec4(-1.0,-1.0, 0.0, 1.0); break;
+      case 3: gl_Position = vec4( 1.0,-1.0, 0.0, 1.0); break;
+    }
+}
+)";
+
+        // One channel per draw, so a failure names the component that is wrong. The coordinate is a
+        // uniform rather than a literal so the same program serves the border sample and the inside
+        // sample and nothing can be constant-folded differently between them.
+        std::string FragmentSource(int channel) {
+            static const char* kChannels[4] = {"x", "y", "z", "w"};
+            return std::string("#version 330 core\n\nuniform isampler2D smp;\nuniform vec2 uCoord;\n\n"
+                               "out int out_color;\n\nvoid main()\n{\n    out_color = texture(smp, uCoord).") +
+                   kChannels[channel] + ";\n}\n";
+        }
+
+        class IntegerBorderColorScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                // 2x2 RGBA32I. Integer textures are not filterable, so NEAREST is mandatory.
+                const std::int32_t texels[4][4] = {{kInsideTexel[0], kInsideTexel[1], kInsideTexel[2], kInsideTexel[3]},
+                                                  {kInsideTexel[0], kInsideTexel[1], kInsideTexel[2], kInsideTexel[3]},
+                                                  {kInsideTexel[0], kInsideTexel[1], kInsideTexel[2], kInsideTexel[3]},
+                                                  {kInsideTexel[0], kInsideTexel[1], kInsideTexel[2], kInsideTexel[3]}};
+                glGenTextures(1, &m_sourceTexture);
+                glBindTexture(GL_TEXTURE_2D, m_sourceTexture);
+                glTexStorage2D(GL_TEXTURE_2D, 1, GL_RGBA32I, 2, 2);
+                glTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 2, 2, GL_RGBA_INTEGER, GL_INT, texels);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_BORDER);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_BORDER);
+                ASSERT_EQ(FirstGLError(), 0u) << "source texture setup left a GL error behind";
+
+                // 8x8 R32I render target: an integer readback, so nothing is normalized on the way
+                // out and a wrong value is reported as the number it actually was.
+                glGenTextures(1, &m_outputTexture);
+                glBindTexture(GL_TEXTURE_2D, m_outputTexture);
+                glTexStorage2D(GL_TEXTURE_2D, 1, GL_R32I, kOutputWidth, kOutputHeight);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                glGenFramebuffers(1, &m_fbo);
+                glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+                glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_outputTexture, 0);
+                ASSERT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER), GLenum(GL_FRAMEBUFFER_COMPLETE));
+                glGenVertexArrays(1, &m_vao);
+                ASSERT_EQ(FirstGLError(), 0u) << "output framebuffer setup left a GL error behind";
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                if (m_sampler != 0) {
+                    glBindSampler(0, 0);
+                    glDeleteSamplers(1, &m_sampler);
+                    m_sampler = 0;
+                }
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                if (m_fbo != 0) glDeleteFramebuffers(1, &m_fbo);
+                if (m_outputTexture != 0) glDeleteTextures(1, &m_outputTexture);
+                if (m_sourceTexture != 0) glDeleteTextures(1, &m_sourceTexture);
+                if (m_narrowTexture != 0) glDeleteTextures(1, &m_narrowTexture);
+                glBindFramebuffer(GL_FRAMEBUFFER, 0);
+            }
+
+            // Samples `coord` through the integer sampler and returns every texel the draw wrote.
+            std::vector<std::int32_t> RenderChannel(int channel, float coordX, float coordY) {
+                const std::string fragment = FragmentSource(channel);
+                std::string error;
+                const unsigned int program = CompileProgram(kVertexSource, fragment.c_str(), &error);
+                if (program == 0) {
+                    ADD_FAILURE() << "channel " << channel << ": program did not build: " << error;
+                    return {};
+                }
+
+                glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+                glViewport(0, 0, kOutputWidth, kOutputHeight);
+                glDisable(GL_SCISSOR_TEST);
+                glDisable(GL_DEPTH_TEST);
+                // A clear value nothing under test can produce, so an undrawn target is not mistaken
+                // for a correct one.
+                const GLint clearValue[4] = {-559038737, 0, 0, 0};
+                glClearBufferiv(GL_COLOR, 0, clearValue);
+
+                glUseProgram(program);
+                glActiveTexture(GL_TEXTURE0);
+                glBindTexture(GL_TEXTURE_2D, m_sourceTexture);
+                glUniform1i(glGetUniformLocation(program, "smp"), 0);
+                glUniform2f(glGetUniformLocation(program, "uCoord"), coordX, coordY);
+                glBindVertexArray(m_vao);
+                glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+                glBindVertexArray(0);
+
+                std::vector<std::int32_t> texels(static_cast<std::size_t>(kOutputWidth) * kOutputHeight, 0);
+                glReadPixels(0, 0, kOutputWidth, kOutputHeight, GL_RED_INTEGER, GL_INT, texels.data());
+                glUseProgram(0);
+                glDeleteProgram(program);
+                return texels;
+            }
+
+            void ExpectAllTexels(const char* what, int channel, std::int32_t expected,
+                                 const std::vector<std::int32_t>& texels) {
+                if (texels.empty()) return;
+                std::size_t offenders = 0;
+                std::int32_t firstBad = 0;
+                for (const std::int32_t texel : texels) {
+                    if (texel == expected) continue;
+                    if (offenders == 0) firstBad = texel;
+                    ++offenders;
+                }
+                EXPECT_EQ(offenders, 0u) << what << " component " << channel << " returned " << firstBad
+                                         << " instead of " << expected << " (" << offenders << " of " << texels.size()
+                                         << " texels wrong)";
+            }
+
+            // Every component of the border, in one place, so both the texture-object and the
+            // sampler-object case assert exactly the same thing.
+            void ExpectBorderIsDelivered(const char* what) {
+                for (int channel = 0; channel < 4; ++channel) {
+                    // (-0.5, -0.5) is a full texture width outside the image on both axes, so
+                    // CLAMP_TO_BORDER can only answer with the border colour.
+                    const std::vector<std::int32_t> texels = RenderChannel(channel, -0.5f, -0.5f);
+                    EXPECT_EQ(FirstGLError(), 0u) << what << ": the border draw left a GL error behind";
+                    ExpectAllTexels(what, channel, kBorderColor[channel], texels);
+                }
+            }
+
+            // A narrow-format source built on demand, for the clamp cases. Returns the texture, which
+            // the caller owns until TearDown deletes it through m_narrowTexture.
+            void MakeNarrowSource(GLenum internalFormat, GLenum clientFormat, const void* texels,
+                                  const GLint* border, bool borderIsUnsigned) {
+                glGenTextures(1, &m_narrowTexture);
+                glBindTexture(GL_TEXTURE_2D, m_narrowTexture);
+                glTexStorage2D(GL_TEXTURE_2D, 1, internalFormat, 2, 2);
+                glTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 2, 2, clientFormat,
+                                internalFormat == GL_R8UI ? GL_UNSIGNED_BYTE : GL_BYTE, texels);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_BORDER);
+                glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_BORDER);
+                if (borderIsUnsigned) {
+                    const GLuint asUnsigned[4] = {static_cast<GLuint>(border[0]), static_cast<GLuint>(border[1]),
+                                                  static_cast<GLuint>(border[2]), static_cast<GLuint>(border[3])};
+                    glTexParameterIuiv(GL_TEXTURE_2D, GL_TEXTURE_BORDER_COLOR, asUnsigned);
+                } else {
+                    glTexParameterIiv(GL_TEXTURE_2D, GL_TEXTURE_BORDER_COLOR, border);
+                }
+                ASSERT_EQ(FirstGLError(), 0u) << "narrow source setup left a GL error behind";
+            }
+
+            // The narrow sources are single-channel, so only component 0 carries anything, and the
+            // sampler declaration has to match the format's signedness.
+            std::vector<std::int32_t> RenderNarrowBorder(bool isUnsignedSampler) {
+                const std::string fragment =
+                    std::string("#version 330 core\n\nuniform ") + (isUnsignedSampler ? "usampler2D" : "isampler2D") +
+                    " smp;\nuniform vec2 uCoord;\n\nout int out_color;\n\nvoid main()\n{\n"
+                    "    out_color = int(texture(smp, uCoord).x);\n}\n";
+                std::string error;
+                const unsigned int program = CompileProgram(kVertexSource, fragment.c_str(), &error);
+                if (program == 0) {
+                    ADD_FAILURE() << "narrow-border program did not build: " << error;
+                    return {};
+                }
+                glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+                glViewport(0, 0, kOutputWidth, kOutputHeight);
+                glDisable(GL_SCISSOR_TEST);
+                glDisable(GL_DEPTH_TEST);
+                const GLint clearValue[4] = {-559038737, 0, 0, 0};
+                glClearBufferiv(GL_COLOR, 0, clearValue);
+                glUseProgram(program);
+                glActiveTexture(GL_TEXTURE0);
+                glBindTexture(GL_TEXTURE_2D, m_narrowTexture);
+                glUniform1i(glGetUniformLocation(program, "smp"), 0);
+                glUniform2f(glGetUniformLocation(program, "uCoord"), -0.5f, -0.5f);
+                glBindVertexArray(m_vao);
+                glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+                glBindVertexArray(0);
+                std::vector<std::int32_t> texels(static_cast<std::size_t>(kOutputWidth) * kOutputHeight, 0);
+                glReadPixels(0, 0, kOutputWidth, kOutputHeight, GL_RED_INTEGER, GL_INT, texels.data());
+                glUseProgram(0);
+                glDeleteProgram(program);
+                return texels;
+            }
+
+            GLuint m_sourceTexture = 0;
+            GLuint m_outputTexture = 0;
+            GLuint m_fbo = 0;
+            GLuint m_vao = 0;
+            GLuint m_sampler = 0;
+            GLuint m_narrowTexture = 0;
+        };
+
+    } // namespace
+
+    // The floor, and the control that keeps the two tests below from passing vacuously: an INSIDE
+    // sample has to fetch the texture's own texel. If this fails the sampler, the shader or the
+    // integer readback is broken and nothing about the border colour has been measured.
+    TEST_F(IntegerBorderColorScenario, InsideTexelsAreUnaffectedByTheBorderColour) {
+        if (!Ready()) GTEST_SKIP();
+
+        glBindTexture(GL_TEXTURE_2D, m_sourceTexture);
+        glTexParameterIiv(GL_TEXTURE_2D, GL_TEXTURE_BORDER_COLOR, kBorderColor);
+        ASSERT_EQ(FirstGLError(), 0u) << "glTexParameterIiv(GL_TEXTURE_BORDER_COLOR) was rejected";
+
+        for (int channel = 0; channel < 4; ++channel) {
+            const std::vector<std::int32_t> texels = RenderChannel(channel, 0.5f, 0.5f);
+            EXPECT_EQ(FirstGLError(), 0u) << "the inside draw left a GL error behind";
+            ExpectAllTexels("inside sample", channel, kInsideTexel[channel], texels);
+        }
+        Gl().EndFrame();
+    }
+
+    // The regression, texture-object spelling. glTexParameterIiv is the entry point the frontend
+    // already accepted and then flattened into the same FloatVec4 every other spelling wrote.
+    TEST_F(IntegerBorderColorScenario, TexParameterIivBorderColourSurvivesToAnIntegerSampler) {
+        if (!Ready()) GTEST_SKIP();
+
+        glBindTexture(GL_TEXTURE_2D, m_sourceTexture);
+        glTexParameterIiv(GL_TEXTURE_2D, GL_TEXTURE_BORDER_COLOR, kBorderColor);
+        ASSERT_EQ(FirstGLError(), 0u) << "glTexParameterIiv(GL_TEXTURE_BORDER_COLOR) was rejected";
+
+        ExpectBorderIsDelivered("glTexParameterIiv");
+        Gl().EndFrame();
+    }
+
+    // The regression, sampler-object spelling - which is the one the conformance cases actually use,
+    // and a separate code path in both backends (BackendSamplerObject::Sync on DirectGLES, and the
+    // sampler cache key on DirectVulkan, where a border colour that is not part of the key would
+    // alias two samplers that differ only in it).
+    TEST_F(IntegerBorderColorScenario, SamplerParameterIivBorderColourSurvivesToAnIntegerSampler) {
+        if (!Ready()) GTEST_SKIP();
+
+        glGenSamplers(1, &m_sampler);
+        ASSERT_NE(m_sampler, 0u);
+        glSamplerParameteri(m_sampler, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+        glSamplerParameteri(m_sampler, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+        glSamplerParameteri(m_sampler, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_BORDER);
+        glSamplerParameteri(m_sampler, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_BORDER);
+        glSamplerParameterIiv(m_sampler, GL_TEXTURE_BORDER_COLOR, kBorderColor);
+        ASSERT_EQ(FirstGLError(), 0u) << "sampler-object setup was rejected";
+
+        // The texture object carries a DIFFERENT border colour, so a pass here cannot come from the
+        // texture's own state leaking through: GL 4.6 core 8.10 says a bound sampler object's state
+        // wins over the texture's for every sampling parameter.
+        const std::int32_t decoyBorder[4] = {0, 0, 0, 0};
+        glBindTexture(GL_TEXTURE_2D, m_sourceTexture);
+        glTexParameterIiv(GL_TEXTURE_2D, GL_TEXTURE_BORDER_COLOR, decoyBorder);
+        glBindSampler(0, m_sampler);
+        ASSERT_EQ(FirstGLError(), 0u) << "binding the sampler object was rejected";
+
+        ExpectBorderIsDelivered("glSamplerParameterIiv");
+        glBindSampler(0, 0);
+        Gl().EndFrame();
+    }
+
+    // GL 4.6 core 8.14.2: "For floating-point and integer formats, border values are clamped to the
+    // representable range of the format." A border of 300 on a GL_R8I texture is 127, not 300 - and
+    // VK_BORDER_COLOR_INT_CUSTOM_EXT delivers whatever it is handed, with format VK_FORMAT_UNDEFINED
+    // there is nothing for the driver to clamp against, so the clamp has to happen before the value
+    // leaves MobileGL. DirectGLES gets it right for free (the ES driver knows the texture format),
+    // which is what makes this a cross-backend divergence and not only a spec one.
+    TEST_F(IntegerBorderColorScenario, ASignedIntegerBorderIsClampedToTheFormatsRepresentableRange) {
+        if (!Ready()) GTEST_SKIP();
+
+        const std::int8_t texels[4] = {1, 1, 1, 1};
+        const GLint border[4] = {300, 0, 0, 1};
+        MakeNarrowSource(GL_R8I, GL_RED_INTEGER, texels, border, /*borderIsUnsigned=*/false);
+
+        const std::vector<std::int32_t> sampled = RenderNarrowBorder(/*isUnsignedSampler=*/false);
+        EXPECT_EQ(FirstGLError(), 0u) << "the clamped-border draw left a GL error behind";
+        ExpectAllTexels("R8I border 300", 0, 127, sampled);
+        Gl().EndFrame();
+    }
+
+    // The reciprocal half, and the one that decides how the two integer forms relate: -1 written
+    // through glTexParameterIiv against an UNSIGNED format. GL 4.6 core 8.10 stores an "I"-form
+    // border unmodified with an integer internal data type and defines no sign conversion between
+    // the two integer forms, so the stored bits are reinterpreted in the sampled format's own
+    // signedness: 0xFFFFFFFF, clamped to the format's maximum of 255.
+    //
+    // That is the DRIVER's answer, established by running this case rather than by reading the spec:
+    // clamping to 0 is an equally defensible reading of the same paragraph, and DirectVulkan can be
+    // made to produce either - but DirectGLES forwards the value to the ES driver verbatim and cannot
+    // deviate, so choosing 0 would mean the same program sampling 0 on Magma and 255 on Espryt. The
+    // whole point of carrying the border colour's form is to stop that class of divergence, so the
+    // backends agree on the driver's answer.
+    //
+    // The clamp itself is still doing the work: without it the value reaches the driver as
+    // 0xFFFFFFFF against a format whose maximum is 255, with format VK_FORMAT_UNDEFINED and so
+    // nothing for the driver to clamp against.
+    TEST_F(IntegerBorderColorScenario, ANegativeBorderOnAnUnsignedFormatClampsToTheFormatsMaximum) {
+        if (!Ready()) GTEST_SKIP();
+
+        const std::uint8_t texels[4] = {1, 1, 1, 1};
+        const GLint border[4] = {-1, 0, 0, 1};
+        MakeNarrowSource(GL_R8UI, GL_RED_INTEGER, texels, border, /*borderIsUnsigned=*/false);
+
+        const std::vector<std::int32_t> sampled = RenderNarrowBorder(/*isUnsignedSampler=*/true);
+        EXPECT_EQ(FirstGLError(), 0u) << "the clamped-border draw left a GL error behind";
+        ExpectAllTexels("R8UI border -1", 0, 255, sampled);
+        Gl().EndFrame();
+    }
+
+    // The same clamp from the unambiguous side: a value written through the UNSIGNED form that is
+    // simply too large for the format. No sign reinterpretation is involved, so both backends and
+    // the spec agree that 5000 on a GL_R8UI texture is 255.
+    TEST_F(IntegerBorderColorScenario, AnOversizedUnsignedBorderIsClampedToTheFormatsMaximum) {
+        if (!Ready()) GTEST_SKIP();
+
+        const std::uint8_t texels[4] = {1, 1, 1, 1};
+        const GLint border[4] = {5000, 0, 0, 1};
+        MakeNarrowSource(GL_R8UI, GL_RED_INTEGER, texels, border, /*borderIsUnsigned=*/true);
+
+        const std::vector<std::int32_t> sampled = RenderNarrowBorder(/*isUnsignedSampler=*/true);
+        EXPECT_EQ(FirstGLError(), 0u) << "the clamped-border draw left a GL error behind";
+        ExpectAllTexels("R8UI border 5000", 0, 255, sampled);
+        Gl().EndFrame();
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/IterationRPFirstReductionScenario.cpp

@@ -137,7 +137,7 @@ namespace MGITest {
             // invocations, i.e. an advertised subgroup width in [16, 256]. A device
             // outside that window (lavapipe's 8-lane subgroups give 64 subgroups) cannot
             // run the fixture's verbatim reduction at all, so the scenario SKIPS there -
-            // the pack itself replays through the FixIterationRPSubgroupScratch patch, which
+            // the pack itself replays through the MagmaFixIterationRPSubgroupScratch patch, which
             // this probe deliberately does not model. The width only gates the domain;
             // lane placement and group counts still come from observed values alone.
             bool SubgroupWidthInSourceDomain() const {

MobileGL/MG_IntegrationTest/Scenarios/LargeArenaAdoptionScenario.cpp

@@ -0,0 +1,375 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/LargeArenaAdoptionScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - MESH-ARENA-SIZED BUFFERS, END TO END.
+//
+// A buffer store of at least 16MiB is adopted into the backend's persistently and
+// coherently mapped GPU storage the moment it is defined (BufferObject::
+// TryAdoptLargeStorage): the CPU shadow is dropped and every later write lands
+// directly in GPU-visible memory with no per-write driver call. Minecraft 26.3
+// streams chunk meshes into 128MB vertex arenas with plain glNamedBufferSubData -
+// on Mali, every driver-mediated route for that write into a busy mutable store
+// either parks the calling thread or ghost-copies the whole arena on a driver
+// worker (~167ms per touched arena: the recurring in-world hiccup this adoption
+// removed). Every existing buffer scenario uses stores far below the threshold,
+// so without this file the adopted path would have zero coverage.
+//
+// What is pinned, deliberately through the same API mix Minecraft uses:
+//   * a glBufferSubData written AFTER the arena was drawn (in flight) reaches the
+//     next draw - the write-visibility contract adoption must not weaken;
+//   * GetBufferSubData reads back the latest CPU write - the shadow IS the map;
+//   * a compute-shader write through an SSBO binding of the same arena is read
+//     back - the GPU-written path for adopted stores (glFinish + direct read).
+
+#include <array>
+#include <cstring>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // Comfortably past the 16MiB adoption threshold, and the vertex payload sits
+        // deep inside the store so an implementation that quietly clamped or aliased
+        // the adopted range would miss it.
+        constexpr GLsizeiptr kArenaBytes = GLsizeiptr(24) * 1024 * 1024;
+        constexpr GLintptr kVertexOffset = GLintptr(20) * 1024 * 1024;
+
+        constexpr const char* kVertexSource = R"(#version 430 core
+layout(location = 0) in vec2 a_pos;
+layout(location = 1) in vec3 a_color;
+out vec3 v_color;
+void main() {
+    v_color = a_color;
+    gl_Position = vec4(a_pos, 0.0, 1.0);
+}
+)";
+
+        constexpr const char* kFragmentSource = R"(#version 430 core
+in vec3 v_color;
+out vec4 o_color;
+void main() { o_color = vec4(v_color, 1.0); }
+)";
+
+        constexpr const char* kMarkerComputeSource = R"(#version 430 core
+layout(local_size_x = 1) in;
+layout(std430, binding = 0) buffer Arena { uint word; };
+void main() { word = 0xC0FFEEu; }
+)";
+
+        struct Vertex {
+            float x, y;
+            float r, g, b;
+        };
+
+        // A full-viewport quad, colored uniformly so one center readback speaks for
+        // the whole draw.
+        std::vector<Vertex> QuadVertices(float r, float g, float b) {
+            return {
+                {-1.f, -1.f, r, g, b}, {1.f, -1.f, r, g, b}, {1.f, 1.f, r, g, b},
+                {-1.f, -1.f, r, g, b}, {1.f, 1.f, r, g, b},  {-1.f, 1.f, r, g, b},
+            };
+        }
+
+        class LargeArenaAdoptionScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                m_program = LinkProgram(kVertexSource, kFragmentSource);
+                ASSERT_NE(m_program, 0u) << m_buildLog;
+
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                glGenBuffers(1, &m_arena);
+                glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+                // The NULL-data definition is the adoption point (and Minecraft's
+                // arena-creation idiom).
+                glBufferData(GL_ARRAY_BUFFER, kArenaBytes, nullptr, GL_DYNAMIC_DRAW);
+                ConfigureVertexArray(m_vao);
+            }
+
+            void ConfigureVertexArray(GLuint vao) {
+                glBindVertexArray(vao);
+                glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+                glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, sizeof(Vertex),
+                                      reinterpret_cast<void*>(kVertexOffset));
+                glVertexAttribPointer(1, 3, GL_FLOAT, GL_FALSE, sizeof(Vertex),
+                                      reinterpret_cast<void*>(kVertexOffset + 2 * sizeof(float)));
+                glEnableVertexAttribArray(0);
+                glEnableVertexAttribArray(1);
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                glBindVertexArray(0);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                if (m_arena != 0) glDeleteBuffers(1, &m_arena);
+                if (m_program != 0) glDeleteProgram(m_program);
+                if (m_compute != 0) glDeleteProgram(m_compute);
+                m_vao = 0;
+                m_arena = 0;
+                m_program = 0;
+                m_compute = 0;
+            }
+
+            unsigned int CompileStage(GLenum stage, const char* source) {
+                const GLuint shader = glCreateShader(stage);
+                glShaderSource(shader, 1, &source, nullptr);
+                glCompileShader(shader);
+                GLint compiled = 0;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("shader did not compile: ") + log;
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                return shader;
+            }
+
+            unsigned int LinkProgram(const char* vs, const char* fs) {
+                const GLuint v = CompileStage(GL_VERTEX_SHADER, vs);
+                if (v == 0) return 0;
+                const GLuint f = CompileStage(GL_FRAGMENT_SHADER, fs);
+                if (f == 0) {
+                    glDeleteShader(v);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, v);
+                glAttachShader(program, f);
+                glLinkProgram(program);
+                glDeleteShader(v);
+                glDeleteShader(f);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    m_buildLog = std::string("program did not link: ") + log;
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+
+            void UploadQuad(float r, float g, float b) {
+                const auto vertices = QuadVertices(r, g, b);
+                glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+                glBufferSubData(GL_ARRAY_BUFFER, kVertexOffset,
+                                GLsizeiptr(vertices.size() * sizeof(Vertex)), vertices.data());
+            }
+
+            void DrawQuad(GLuint vao = 0) {
+                glViewport(0, 0, Gl().Width(), Gl().Height());
+                glClearColor(0.f, 0.f, 0.f, 1.f);
+                glClear(GL_COLOR_BUFFER_BIT);
+                glUseProgram(m_program);
+                glBindVertexArray(vao != 0 ? vao : m_vao);
+                glDrawArrays(GL_TRIANGLES, 0, 6);
+            }
+
+            std::array<unsigned char, 4> CenterPixel() {
+                std::array<unsigned char, 4> px = {0, 0, 0, 0};
+                glReadPixels(Gl().Width() / 2, Gl().Height() / 2, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE,
+                             px.data());
+                return px;
+            }
+
+            unsigned int m_program = 0;
+            unsigned int m_compute = 0;
+            unsigned int m_vao = 0;
+            unsigned int m_arena = 0;
+            std::string m_buildLog;
+        };
+
+    } // namespace
+
+    // The Minecraft shape: the arena is drawn, the frame retires, and a
+    // glBufferSubData rewrites the SAME vertex bytes while the previous frame's
+    // draw may still be in flight. The next draw must show the NEW bytes.
+    TEST_F(LargeArenaAdoptionScenario, SubDataAfterAnInFlightDrawReachesTheNextDraw) {
+        if (!Ready() || IsSkipped()) return;
+
+        UploadQuad(1.f, 0.f, 0.f);
+        DrawQuad();
+        auto px = CenterPixel();
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_GT(px[0], 200) << "the first draw from the adopted arena never landed";
+        EXPECT_LT(px[1], 50);
+
+        Gl().EndFrame();
+
+        UploadQuad(0.f, 1.f, 0.f);
+        DrawQuad();
+        px = CenterPixel();
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_GT(px[1], 200) << "the cross-frame rewrite of the adopted arena did not reach the draw; "
+                                 "the old color means the write went to bytes the draw no longer reads";
+        EXPECT_LT(px[0], 50) << "the draw still shows the previous frame's bytes";
+    }
+
+    // Respecifying a frontend buffer preserves its VAO attachments even when the
+    // backend replaces the adopted store's GL name. Keep every attribute binding
+    // unchanged so a stale backend VAO cannot be repaired by a frontend rebind.
+    TEST_F(LargeArenaAdoptionScenario, RespecifiedVertexArenaKeepsVaoBindings) {
+        if (!Ready() || IsSkipped()) return;
+
+        UploadQuad(1.f, 0.f, 0.f);
+        DrawQuad();
+        ASSERT_GT(CenterPixel()[0], 200);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        GLuint otherVao = 0;
+        glGenVertexArrays(1, &otherVao);
+        ConfigureVertexArray(otherVao);
+        DrawQuad(otherVao);
+        EXPECT_GT(CenterPixel()[0], 200);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        constexpr std::array<GLsizeiptr, 3> sizes = {
+            kArenaBytes, kArenaBytes + 4096, kArenaBytes - 4096,
+        };
+        constexpr std::array<std::array<float, 3>, 3> colors = {{
+            {0.f, 1.f, 0.f}, {0.f, 0.f, 1.f}, {1.f, 0.f, 0.f},
+        }};
+        for (std::size_t i = 0; i < sizes.size(); ++i) {
+            SCOPED_TRACE(sizes[i]);
+            glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+            glBufferData(GL_ARRAY_BUFFER, sizes[i], nullptr, GL_DYNAMIC_DRAW);
+            UploadQuad(colors[i][0], colors[i][1], colors[i][2]);
+            // The unbound VAO can retain the deleted store; the current VAO's
+            // attachments can be cleared by deletion. Both must be repaired.
+            for (GLuint vao : {m_vao, otherVao}) {
+                SCOPED_TRACE(vao);
+                DrawQuad(vao);
+                const auto px = CenterPixel();
+                EXPECT_EQ(FirstGLError(), 0u);
+                for (std::size_t channel = 0; channel < 3; ++channel) {
+                    if (colors[i][channel] != 0.f) {
+                        EXPECT_GT(px[channel], 200) << "VAO did not fetch the replacement vertex store";
+                    } else {
+                        EXPECT_LT(px[channel], 50) << "VAO still fetched the previous vertex store";
+                    }
+                }
+            }
+        }
+        glDeleteVertexArrays(1, &otherVao);
+    }
+
+    TEST_F(LargeArenaAdoptionScenario, RespecifiedIndexArenaKeepsVaoBinding) {
+        if (!Ready() || IsSkipped()) return;
+
+        auto vertices = QuadVertices(1.f, 0.f, 0.f);
+        const auto green = QuadVertices(0.f, 1.f, 0.f);
+        vertices.insert(vertices.end(), green.begin(), green.end());
+        glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+        glBufferSubData(GL_ARRAY_BUFFER, kVertexOffset,
+                        GLsizeiptr(vertices.size() * sizeof(Vertex)), vertices.data());
+
+        GLuint indices = 0;
+        glGenBuffers(1, &indices);
+        glBindVertexArray(m_vao);
+        glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, indices);
+        // Redefine through COPY_WRITE_BUFFER so the element binding slot never
+        // changes. The small final store also exercises returning to shadow storage.
+        glBindBuffer(GL_COPY_WRITE_BUFFER, indices);
+        constexpr std::array<GLsizeiptr, 4> sizes = {
+            kArenaBytes, kArenaBytes, kArenaBytes + 4096, 4096,
+        };
+        for (std::size_t i = 0; i < sizes.size(); ++i) {
+            SCOPED_TRACE(sizes[i]);
+            const GLuint first = (i % 2) == 0 ? 0u : 6u;
+            const std::array<GLuint, 6> elements = {
+                first, first + 1, first + 2, first + 3, first + 4, first + 5,
+            };
+            glBufferData(GL_COPY_WRITE_BUFFER, sizes[i], nullptr, GL_DYNAMIC_DRAW);
+            glBufferSubData(GL_COPY_WRITE_BUFFER, 0, sizeof(elements), elements.data());
+            glViewport(0, 0, Gl().Width(), Gl().Height());
+            glClearColor(0.f, 0.f, 0.f, 1.f);
+            glClear(GL_COLOR_BUFFER_BIT);
+            glUseProgram(m_program);
+            glDrawElements(GL_TRIANGLES, 6, GL_UNSIGNED_INT, nullptr);
+            const auto px = CenterPixel();
+            EXPECT_EQ(FirstGLError(), 0u);
+            EXPECT_GT(px[first == 0 ? 0 : 1], 200) << "VAO did not fetch the replacement index store";
+            EXPECT_LT(px[first == 0 ? 1 : 0], 50) << "VAO still fetched the previous index store";
+        }
+        glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, 0);
+        glBindBuffer(GL_COPY_WRITE_BUFFER, 0);
+        glDeleteBuffers(1, &indices);
+    }
+
+    // The shadow IS the mapping: a readback straight after a CPU write must hand
+    // back exactly those bytes.
+    TEST_F(LargeArenaAdoptionScenario, ReadbackSeesTheLatestCpuWrite) {
+        if (!Ready() || IsSkipped()) return;
+
+        const auto vertices = QuadVertices(0.25f, 0.5f, 0.75f);
+        glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+        glBufferSubData(GL_ARRAY_BUFFER, kVertexOffset,
+                        GLsizeiptr(vertices.size() * sizeof(Vertex)), vertices.data());
+        std::vector<Vertex> read(vertices.size());
+        glGetBufferSubData(GL_ARRAY_BUFFER, kVertexOffset,
+                           GLsizeiptr(read.size() * sizeof(Vertex)), read.data());
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_EQ(0, std::memcmp(read.data(), vertices.data(), read.size() * sizeof(Vertex)))
+            << "GetBufferSubData of the adopted arena returned different bytes than the SubData wrote";
+    }
+
+    // A GPU write through an SSBO binding of the adopted arena must be visible to
+    // a CPU readback - the path that waits out the GPU and reads the coherent
+    // mapping directly.
+    TEST_F(LargeArenaAdoptionScenario, GpuWriteIntoTheArenaIsReadBack) {
+        if (!Ready() || IsSkipped()) return;
+
+        GLint maxComputeStorageBlocks = 0;
+        glGetIntegerv(GL_MAX_COMPUTE_SHADER_STORAGE_BLOCKS, &maxComputeStorageBlocks);
+        if (maxComputeStorageBlocks < 1) {
+            GTEST_SKIP() << "no compute shader storage blocks on this driver";
+        }
+        const GLuint compute = CompileStage(GL_COMPUTE_SHADER, kMarkerComputeSource);
+        ASSERT_NE(compute, 0u) << m_buildLog;
+        m_compute = glCreateProgram();
+        glAttachShader(m_compute, compute);
+        glLinkProgram(m_compute);
+        glDeleteShader(compute);
+        GLint linked = 0;
+        glGetProgramiv(m_compute, GL_LINK_STATUS, &linked);
+        ASSERT_EQ(linked, GL_TRUE);
+
+        const unsigned int seed = 0u;
+        glBindBuffer(GL_ARRAY_BUFFER, m_arena);
+        glBufferSubData(GL_ARRAY_BUFFER, 0, sizeof(seed), &seed);
+        glBindBufferRange(GL_SHADER_STORAGE_BUFFER, 0, m_arena, 0, sizeof(unsigned int));
+        glUseProgram(m_compute);
+        glDispatchCompute(1, 1, 1);
+        glMemoryBarrier(GL_SHADER_STORAGE_BARRIER_BIT | GL_BUFFER_UPDATE_BARRIER_BIT);
+
+        unsigned int marker = 0;
+        glGetBufferSubData(GL_ARRAY_BUFFER, 0, sizeof(marker), &marker);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_EQ(marker, 0xC0FFEEu)
+            << "the compute write into the adopted arena did not reach the CPU readback";
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/PointSizeDemotionScenario.cpp

@@ -0,0 +1,522 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/PointSizeDemotionScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - THE gl_PointSize DEMOTION IS CLIENT-INVISIBLE, AND IT ACTUALLY ARMS.
+//
+// On a device that hosts the built-in in tessellation/geometry stages (llvmpipe and
+// lavapipe both do), gl_PointSize travels as itself; on one that does not (the Mali
+// devices this exists for), phase B demotes it to an ordinary varying
+// (ShaderCompiler::DemoteTessellationGeometryPointSizeForProgram) and the capture
+// machinery follows it there. This scenario runs in BOTH configurations and must hand
+// back identical bytes: the ambient registrations take the native path, and the
+// PointSizeDemotion. registrations pin MOBILEGL_POINT_SIZE_DEMOTION=1 so the demotion
+// runs on the same healthy drivers - CopyImagePacked16Scenario's dual-configuration
+// contract, applied to a value chain instead of a storage format.
+//
+// The VALUE is the whole contract: every case writes gl_PointSize in one stage, reads it
+// back out of gl_in[] in the next, and captures it by name under rasterizer discard, so
+// one wrong link anywhere in VS -> TCS -> TES -> GS -> capture lands in the readback.
+// The RASTERIZED size is deliberately not asserted anywhere: with the built-in unhosted
+// it falls back to 1.0 by spec on both targets, which is exactly the honest residue the
+// demotion documents (point_rendering-style bodies keep failing truthfully).
+//
+// The assertions are on the captured BYTES against a CPU-computed reference, never on
+// the absence of a GL error: every failure this guards against is silent.
+
+#include <cmath>
+#include <cstdint>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr float kPoison = -987654.0f;
+
+        const char* const kFragmentSource = R"(#version 460 core
+layout(location = 0) out vec4 fragColor;
+void main()
+{
+    fragColor = vec4(1.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        // The full chain, with per-vertex VARIATION seeded in the vertex stage so a control
+        // invocation that read or wrote the wrong slot changes the sum: 2,3,4 arrive, 3,4,5
+        // leave, the evaluation stage sums its patch to 12, the geometry stage doubles what
+        // it read to 24.
+        const char* const kChainVertexSource = R"(#version 460 core
+void main()
+{
+    gl_Position  = vec4(0.0, 0.0, 0.0, 1.0);
+    gl_PointSize = 2.0 + float(gl_VertexID);
+}
+)";
+
+        const char* const kChainTessControlSource = R"(#version 460 core
+layout(vertices = 3) out;
+void main()
+{
+    gl_out[gl_InvocationID].gl_Position  = gl_in[gl_InvocationID].gl_Position;
+    gl_out[gl_InvocationID].gl_PointSize = gl_in[gl_InvocationID].gl_PointSize + 1.0;
+    gl_TessLevelOuter[0] = 1.0;
+    gl_TessLevelOuter[1] = 1.0;
+    gl_TessLevelOuter[2] = 1.0;
+    gl_TessLevelInner[0] = 1.0;
+}
+)";
+
+        const char* const kChainTessEvalSource = R"(#version 460 core
+layout(triangles, equal_spacing, cw, point_mode) in;
+void main()
+{
+    gl_Position  = vec4(0.0, 0.0, 0.0, 1.0);
+    gl_PointSize = gl_in[0].gl_PointSize + gl_in[1].gl_PointSize + gl_in[2].gl_PointSize;
+}
+)";
+
+        const char* const kChainGeometrySource = R"(#version 460 core
+layout(points) in;
+layout(points, max_vertices = 1) out;
+void main()
+{
+    gl_Position  = gl_in[0].gl_Position;
+    gl_PointSize = gl_in[0].gl_PointSize * 2.0;
+    EmitVertex();
+    EndPrimitive();
+}
+)";
+
+        // The geometry-only chain: no tessellation required of the stack at all.
+        const char* const kPointVertexSource = R"(#version 460 core
+void main()
+{
+    gl_Position  = vec4(0.0, 0.0, 0.0, 1.0);
+    gl_PointSize = 7.0;
+}
+)";
+
+        const char* const kPointGeometrySource = R"(#version 460 core
+layout(points) in;
+layout(points, max_vertices = 1) out;
+void main()
+{
+    gl_Position  = gl_in[0].gl_Position;
+    gl_PointSize = gl_in[0].gl_PointSize + 1.0;
+    EmitVertex();
+    EndPrimitive();
+}
+)";
+
+        // A capture stage that only READS the incoming point size and never writes its own.
+        // Legal GL, and the shape that separates "the demotion arms" from "the demotion knows
+        // a capture is coming": with the built-in gone, only the capture request can put a
+        // carrier back for a by-name capture to bind to.
+        const char* const kReadOnlyGeometrySource = R"(#version 460 core
+layout(points) in;
+layout(points, max_vertices = 1) out;
+out float g_echo;
+void main()
+{
+    gl_Position = gl_in[0].gl_Position;
+    g_echo      = gl_in[0].gl_PointSize;
+    EmitVertex();
+    EndPrimitive();
+}
+)";
+
+        const char* const kEchoFragmentSource = R"(#version 460 core
+in float g_echo;
+layout(location = 0) out vec4 fragColor;
+void main()
+{
+    fragColor = vec4(g_echo, 0.0, 0.0, 1.0);
+}
+)";
+
+        class PointSizeDemotionScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                DrainErrors();
+            }
+
+            void TearDown() override {
+                if (Ready()) {
+                    glUseProgram(0);
+                    for (const GLuint program : m_programs) {
+                        glDeleteProgram(program);
+                    }
+                    m_programs.clear();
+                    glBindVertexArray(0);
+                    if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                    m_vao = 0;
+                }
+                ScenarioTest::TearDown();
+            }
+
+            static void DrainErrors() {
+                for (int i = 0; i < 16 && glGetError() != GL_NO_ERROR; ++i) {
+                }
+            }
+
+            static bool BackendHostsTessellation() {
+                GLint maxTessGenLevel = 0;
+                glGetIntegerv(GL_MAX_TESS_GEN_LEVEL, &maxTessGenLevel);
+                DrainErrors();
+                return maxTessGenLevel >= 1;
+            }
+
+            static std::string InfoLog(GLuint object, bool isShader) {
+                GLint length = 0;
+                if (isShader) {
+                    glGetShaderiv(object, GL_INFO_LOG_LENGTH, &length);
+                } else {
+                    glGetProgramiv(object, GL_INFO_LOG_LENGTH, &length);
+                }
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                if (isShader) {
+                    glGetShaderInfoLog(object, length + 1, nullptr, buffer.data());
+                } else {
+                    glGetProgramInfoLog(object, length + 1, nullptr, buffer.data());
+                }
+                return buffer.data();
+            }
+
+            GLuint BuildCaptureProgram(const std::vector<std::pair<GLenum, const char*>>& stages,
+                                       const std::vector<const char*>& varyings) {
+                m_buildLog.clear();
+                std::vector<GLuint> shaders;
+                bool ok = true;
+                for (const auto& [stage, source] : stages) {
+                    const GLuint shader = glCreateShader(stage);
+                    glShaderSource(shader, 1, &source, nullptr);
+                    glCompileShader(shader);
+                    GLint compiled = 0;
+                    glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                    shaders.push_back(shader);
+                    if (compiled == GL_FALSE) {
+                        m_buildLog = InfoLog(shader, true) + "\n--- source ---\n" + source;
+                        ok = false;
+                        break;
+                    }
+                }
+                GLuint program = 0;
+                if (ok) {
+                    program = glCreateProgram();
+                    for (const GLuint shader : shaders) {
+                        glAttachShader(program, shader);
+                    }
+                    glTransformFeedbackVaryings(program, static_cast<GLsizei>(varyings.size()),
+                                                varyings.data(), GL_INTERLEAVED_ATTRIBS);
+                    glLinkProgram(program);
+                    GLint linked = GL_FALSE;
+                    glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                    if (linked == GL_FALSE) {
+                        m_buildLog = InfoLog(program, false);
+                        glDeleteProgram(program);
+                        program = 0;
+                    }
+                }
+                for (const GLuint shader : shaders) {
+                    glDeleteShader(shader);
+                }
+                if (program != 0) m_programs.push_back(program);
+                return program;
+            }
+
+            // One capture span over `vertexCount` vertices of `drawMode`, recorded as
+            // GL_POINTS. The buffer is poison-filled first so bytes the capture never wrote
+            // name themselves.
+            std::vector<float> RunCaptureSpan(GLuint program, GLenum drawMode, GLsizei vertexCount,
+                                              std::size_t capturedFloats) {
+                const std::vector<float> poison(capturedFloats, kPoison);
+                GLuint xfbBuffer = 0;
+                glGenBuffers(1, &xfbBuffer);
+                glBindBuffer(GL_ARRAY_BUFFER, xfbBuffer);
+                glBufferData(GL_ARRAY_BUFFER, static_cast<GLsizeiptr>(capturedFloats * sizeof(float)),
+                             poison.data(), GL_STATIC_COPY);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+
+                glBindVertexArray(m_vao);
+                glUseProgram(program);
+                glEnable(GL_RASTERIZER_DISCARD);
+                glBeginTransformFeedback(GL_POINTS);
+                glDrawArrays(drawMode, 0, vertexCount);
+                glEndTransformFeedback();
+                glDisable(GL_RASTERIZER_DISCARD);
+
+                std::vector<float> readback(capturedFloats, kPoison);
+                glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0,
+                                   static_cast<GLsizeiptr>(capturedFloats * sizeof(float)),
+                                   readback.data());
+                glUseProgram(0);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+                glDeleteBuffers(1, &xfbBuffer);
+                return readback;
+            }
+
+            static ::testing::AssertionResult ComponentIs(const std::vector<float>& data,
+                                                          std::size_t index, float expected,
+                                                          float epsilon = 1e-4f) {
+                if (index >= data.size()) {
+                    return ::testing::AssertionFailure()
+                           << "component " << index << " is past the capture buffer";
+                }
+                const float actual = data[index];
+                if (actual == kPoison) {
+                    return ::testing::AssertionFailure()
+                           << "component " << index << " still holds the poison value - the capture "
+                           << "never reached these bytes (expected " << expected << ")";
+                }
+                if (std::isnan(actual) || std::abs(actual - expected) > epsilon) {
+                    return ::testing::AssertionFailure()
+                           << "component " << index << " is " << actual << ", expected " << expected;
+                }
+                return ::testing::AssertionSuccess();
+            }
+
+            // The library log, for the arming case. Same machinery and same reasoning as
+            // UnlocatedIoBlockScenario: MOBILEGL_LOG_FILE_PATH is read at log-init, the file
+            // is appended to by every process in the lane, and only bytes appended after the
+            // snapshot may satisfy an assertion.
+            static std::filesystem::path LibraryLogPath() {
+                const char* path = std::getenv("MOBILEGL_LOG_FILE_PATH");
+                return (path != nullptr && *path != '\0') ? std::filesystem::path(path)
+                                                          : std::filesystem::path();
+            }
+
+            static std::uintmax_t LibraryLogSize() {
+                std::error_code ec;
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return 0;
+                const std::uintmax_t size = std::filesystem::file_size(path, ec);
+                return ec ? 0 : size;
+            }
+
+            static std::string LibraryLogSince(std::uintmax_t offset) {
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return {};
+                std::ifstream file(path, std::ios::binary);
+                if (!file.good()) return {};
+                file.seekg(static_cast<std::streamoff>(offset));
+                return std::string((std::istreambuf_iterator<char>(file)),
+                                   std::istreambuf_iterator<char>());
+            }
+
+            std::string m_buildLog;
+
+        private:
+            GLuint m_vao = 0;
+            std::vector<GLuint> m_programs;
+        };
+
+        // The five-stage chain. 24.0 can only arrive if the vertex mirror, both control-stage
+        // redirects (read AND write), the evaluation stage's three gl_in reads and the
+        // geometry stage's read all carried the right value - one wrong link and the sum
+        // moves. point_mode with every level at 1 emits three points; the first record proves
+        // the mechanism, exactly as TessellationXfbCaptureScenario reasons.
+        TEST_F(PointSizeDemotionScenario, TheValueSurvivesTheFiveStageChainIntoTheCapture) {
+            if (!Ready()) return;
+            if (!BackendHostsTessellation()) {
+                GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " ("
+                             << Gl().RendererString() << ")";
+            }
+            glPatchParameteri(GL_PATCH_VERTICES, 3);
+            DrainErrors();
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kChainVertexSource},
+                                                        {GL_TESS_CONTROL_SHADER, kChainTessControlSource},
+                                                        {GL_TESS_EVALUATION_SHADER, kChainTessEvalSource},
+                                                        {GL_GEOMETRY_SHADER, kChainGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_PointSize"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            const std::vector<float> captured = RunCaptureSpan(program, GL_PATCHES, 3, 3);
+            EXPECT_TRUE(ComponentIs(captured, 0, 24.0f));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // The same chain without a geometry stage: the capture then binds to the evaluation
+        // stage's value (the sum, 12.0) - which is also the boundary where a demoted program
+        // switches its capture carrier from the Io chain to the capture name.
+        TEST_F(PointSizeDemotionScenario, TheEvaluationStageOwnsTheCaptureWithoutAGeometryStage) {
+            if (!Ready()) return;
+            if (!BackendHostsTessellation()) {
+                GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " ("
+                             << Gl().RendererString() << ")";
+            }
+            glPatchParameteri(GL_PATCH_VERTICES, 3);
+            DrainErrors();
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kChainVertexSource},
+                                                        {GL_TESS_CONTROL_SHADER, kChainTessControlSource},
+                                                        {GL_TESS_EVALUATION_SHADER, kChainTessEvalSource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_PointSize"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            const std::vector<float> captured = RunCaptureSpan(program, GL_PATCHES, 3, 3);
+            EXPECT_TRUE(ComponentIs(captured, 0, 12.0f));
+
+            // The GL query surface keeps the truthful spelling whatever the backends renamed
+            // underneath: reflection is a phase-A product and the demotion happens after it.
+            char varyingName[64] = {};
+            GLsizei nameLength = 0;
+            GLsizei varyingSize = 0;
+            GLenum varyingType = 0;
+            glGetTransformFeedbackVarying(program, 0, sizeof(varyingName), &nameLength, &varyingSize,
+                                          &varyingType, varyingName);
+            EXPECT_STREQ(varyingName, "gl_PointSize");
+            EXPECT_EQ(varyingType, static_cast<GLenum>(GL_FLOAT));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // The geometry-only chain: gl_in[0].gl_PointSize read straight off the vertex stage,
+        // no tessellation involved - the VS -> GS boundary of the demotion on its own.
+        TEST_F(PointSizeDemotionScenario, AGeometryOnlyChainCarriesTheVertexValue) {
+            if (!Ready()) return;
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPointVertexSource},
+                                                        {GL_GEOMETRY_SHADER, kPointGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_PointSize"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            const std::vector<float> captured = RunCaptureSpan(program, GL_POINTS, 1, 1);
+            EXPECT_TRUE(ComponentIs(captured, 0, 8.0f));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // THE CAPTURE-REQUEST PATH, END TO END - the half no unit test can reach, because the
+        // request travels from glTransformFeedbackVaryings through phase A's resolved capture
+        // set and the phase-B handoff before it reaches the demotion.
+        //
+        // The geometry stage READS gl_in[0].gl_PointSize and never writes gl_PointSize, which
+        // is enough to arm the demotion (glslang declares GeometryPointSize on a read) but not
+        // enough to create an output carrier on its own. Only the capture request can, and if
+        // that request never arrives the program does not merely lose the point-size column:
+        // DirectGLES respells the driver-side capture to a name no stage declares and the
+        // WHOLE capture set fails to link, while DirectVulkan mirrors a built-in the demotion
+        // just removed and can unwind far enough to drop the Xfb execution mode. Either way
+        // g_echo - an ordinary varying with nothing to do with point size - comes back poison,
+        // which is what this asserts. gl_PointSize itself is captured but never asserted: no
+        // stage writes it, so GL leaves its value undefined.
+        TEST_F(PointSizeDemotionScenario, ACaptureSurvivesAStageThatOnlyReadsThePointSize) {
+            if (!Ready()) return;
+            // The NATIVE Espryt path cannot do this at all, and never could: with the built-in
+            // hosted, the geometry stage's ESSL simply does not declare gl_PointSize unless it
+            // writes it, so the driver rejects the capture request with "varying undeclared"
+            // and the program becomes unusable. That is a pre-existing ES limitation the
+            // demotion happens to REPAIR - the carrier is a real, seeded, declared varying -
+            // so this case has something to assert only where the demotion is armed. Magma
+            // consumes SPIR-V and answers on both paths, which keeps the negative control.
+            if (Gl().BackendName() == "DirectGLES" &&
+                AmbientQuirkFromEnvironment("MOBILEGL_POINT_SIZE_DEMOTION") != AmbientQuirk::On) {
+                GTEST_SKIP() << "Espryt cannot capture a gl_PointSize its capture stage never "
+                                "writes without the demotion; the PointSizeDemotion. ctest entry "
+                                "runs this same case with MOBILEGL_POINT_SIZE_DEMOTION=1";
+            }
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPointVertexSource},
+                                                        {GL_GEOMETRY_SHADER, kReadOnlyGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kEchoFragmentSource}},
+                                                       {"g_echo", "gl_PointSize"});
+            ASSERT_NE(program, 0u)
+                << "the capture set failed to link. On a demoting configuration this is the "
+                   "capture request never reaching the demotion, so the point-size capture was "
+                   "respelled to a carrier no stage declares. Build log: "
+                << m_buildLog;
+
+            const std::vector<float> captured = RunCaptureSpan(program, GL_POINTS, 1, 2);
+            EXPECT_TRUE(ComponentIs(captured, 0, 7.0f))
+                << "the unrelated varying captured alongside gl_PointSize did not survive; the "
+                   "point-size capture took the whole set with it";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // THE ONE CASE THAT CAN FAIL WHEN THE DEMOTION SILENTLY STOPS BEING ARMED.
+        //
+        // Everything above captures the right bytes on llvmpipe and lavapipe whether the
+        // demotion ran or not - these machines host the built-in - so those cases pin that
+        // the demotion does no HARM and can say nothing about whether it happened. The
+        // arming is where the cheap mistake lives: MOBILEGL_POINT_SIZE_DEMOTION maps onto
+        // the two Supports*PointSize capability bits INVERTED (forcing the demotion on
+        // means declaring the built-in UNHOSTED), and a swap of those arms - or a dropped
+        // env bit anywhere between ConfigLoader, the backend init, CompileEnv and the L1
+        // key - would disable the device repair with every rendering case still green.
+        //
+        // Same machinery as UnlocatedIoBlockScenario's arming case: the environment says
+        // the demotion is pinned on, therefore the library must SAY it demoted something.
+        // The observable is the latched MGLOG_I each backend emits when it first builds a
+        // demoted program; both spell "demoted to an ordinary varying", so this one case
+        // covers both pinned lanes without a backend gate.
+        TEST_F(PointSizeDemotionScenario, TheDemotionIsActuallyArmedWhenTheEnvironmentPinsItOn) {
+            if (!Ready()) return;
+            if (AmbientQuirkFromEnvironment("MOBILEGL_POINT_SIZE_DEMOTION") != AmbientQuirk::On) {
+                GTEST_SKIP() << "this case needs the demotion pinned ON for the whole process, which "
+                                "is what the PointSizeDemotion. ctest entries do with "
+                                "MOBILEGL_POINT_SIZE_DEMOTION=1; with the variable unset the detected "
+                                "capabilities decide, and on this machine the built-in is hosted - so "
+                                "there would be nothing to observe";
+            }
+            if (LibraryLogPath().empty()) {
+                GTEST_SKIP() << "MOBILEGL_POINT_SIZE_DEMOTION is pinned on but MOBILEGL_LOG_FILE_PATH "
+                                "is not set, so the library has nowhere to record that it demoted "
+                                "anything; the PointSizeDemotion. ctest entries set both";
+            }
+
+            // Taken BEFORE the program is built, so the line this looks for can only be one
+            // this process wrote.
+            const std::uintmax_t before = LibraryLogSize();
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPointVertexSource},
+                                                        {GL_GEOMETRY_SHADER, kPointGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_PointSize"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+            // Drawn as well as built, so a stack that defers its backend program to first
+            // use still reaches the build the latched line fires in - and the capture must
+            // STILL be right through the carrier.
+            const std::vector<float> captured = RunCaptureSpan(program, GL_POINTS, 1, 1);
+            EXPECT_TRUE(ComponentIs(captured, 0, 8.0f))
+                << "the pinned-on lane did not even capture correctly";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+
+            const std::string appended = LibraryLogSince(before);
+            EXPECT_NE(appended.find("demoted to an ordinary varying"), std::string::npos)
+                << "MOBILEGL_POINT_SIZE_DEMOTION is pinned ON, a geometry program reading and "
+                   "writing gl_PointSize was built and captured, and no backend ever reported "
+                   "demoting it. The demotion is not armed - check the override mapping in the "
+                   "backend inits (it is inverted on purpose), the CompileEnv accessors, and "
+                   "ProgramSpirvTask's verdict plumbing. Log appended by this test:\n"
+                << appended;
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/PrimitiveRestartScenario.cpp

@@ -0,0 +1,404 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/PrimitiveRestartScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - DESKTOP GL_PRIMITIVE_RESTART WITH AN APPLICATION-CHOSEN INDEX.
+//
+// Desktop GL restarts on whatever glPrimitiveRestartIndex named; GLES and Vulkan both restart
+// only on the all-ones value of the index type. DirectGLES used to THROW_EXCEPTION on the
+// mismatch, and a throw out of a GL entry point unwinds a C++ exception through the C ABI and
+// kills the process - which is how KHR-GL4x.geometry_shader.primitive_counter.*_rp took the whole
+// conformance runner down, nine bodies at a time, losing every result in the chunk with it.
+//
+// So the first thing this asserts is simply that the process is still here. The second is that
+// the restart actually happened: the substitution rewrites the index data so the driver restarts
+// where the application asked, and the difference between "restart honoured" and "restart
+// silently dropped" is a triangle strip that welds its two halves together across the gap.
+//
+// Needs a real context on purpose. The GPU-free suite cannot reach a backend at all, and this is
+// entirely about what the backend does with the index buffer.
+
+#include <cstddef>
+#include <iterator>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr GLsizei kSurface = 64;
+
+        const char* const kVertexSource = R"(#version 420 core
+layout(location = 0) in vec2 a_position;
+void main()
+{
+    gl_Position = vec4(a_position, 0.0, 1.0);
+}
+)";
+
+        const char* const kFragmentSource = R"(#version 420 core
+out vec4 fragColor;
+void main()
+{
+    fragColor = vec4(0.0, 1.0, 0.0, 1.0);
+}
+)";
+
+        // Two triangles with a gap down the middle, plus two spare vertices parked at the origin.
+        //
+        // The spares exist so the restart index is a LEGAL vertex index: if the restart were
+        // dropped the driver would still fetch a real vertex rather than read out of bounds, so
+        // the negative case is defined behaviour and the test measures the restart rather than
+        // whatever robust-buffer-access does.
+        constexpr GLfloat kVertices[] = {
+            -0.9f, -0.9f, // 0 - left triangle
+            -0.1f, -0.9f, // 1
+            -0.9f,  0.9f, // 2
+             0.1f, -0.9f, // 3 - right triangle
+             0.9f, -0.9f, // 4
+             0.9f,  0.9f, // 5
+             0.0f,  0.0f, // 6 - spare
+             0.0f,  0.0f, // 7 - spare, and the application's restart index
+        };
+        constexpr GLuint kRestartIndex = 7;
+
+        // A triangle STRIP, restarted in the middle: honoured, it is exactly the two triangles
+        // above. Dropped, the strip welds vertices 2, 7 and 3 into extra triangles that spill
+        // across the gap - which is what the middle probe below catches.
+        constexpr GLuint kIndices[] = {0, 1, 2, kRestartIndex, 3, 4, 5};
+
+        struct Pixel {
+            GLubyte r = 0, g = 0, b = 0, a = 0;
+        };
+
+        class PrimitiveRestartScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+
+                glGenBuffers(1, &m_vbo);
+                glBindBuffer(GL_ARRAY_BUFFER, m_vbo);
+                glBufferData(GL_ARRAY_BUFFER, sizeof(kVertices), kVertices, GL_STATIC_DRAW);
+                glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 2 * sizeof(GLfloat), nullptr);
+                glEnableVertexAttribArray(0);
+
+                glGenBuffers(1, &m_ebo);
+                glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, m_ebo);
+                glBufferData(GL_ELEMENT_ARRAY_BUFFER, sizeof(kIndices), kIndices, GL_STATIC_DRAW);
+
+                glGenTextures(1, &m_colorTexture);
+                glBindTexture(GL_TEXTURE_2D, m_colorTexture);
+                glTexStorage2D(GL_TEXTURE_2D, 1, GL_RGBA8, kSurface, kSurface);
+                glGenFramebuffers(1, &m_fbo);
+                glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+                glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_colorTexture, 0);
+                ASSERT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER),
+                          static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+                glViewport(0, 0, kSurface, kSurface);
+
+                m_program = BuildProgram();
+                ASSERT_NE(m_program, 0u) << "the flat-colour program did not build: " << m_buildLog;
+                glUseProgram(m_program);
+                DrainErrors();
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glDisable(GL_PRIMITIVE_RESTART);
+                glDisable(GL_PRIMITIVE_RESTART_FIXED_INDEX);
+                glPrimitiveRestartIndex(0);
+                glUseProgram(0);
+                if (m_program != 0) glDeleteProgram(m_program);
+                glBindFramebuffer(GL_FRAMEBUFFER, 0);
+                if (m_fbo != 0) glDeleteFramebuffers(1, &m_fbo);
+                if (m_colorTexture != 0) glDeleteTextures(1, &m_colorTexture);
+                glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, 0);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+                if (m_ebo != 0) glDeleteBuffers(1, &m_ebo);
+                if (m_vbo != 0) glDeleteBuffers(1, &m_vbo);
+                glBindVertexArray(0);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                DrainErrors();
+            }
+
+            static void DrainErrors() {
+                for (int i = 0; i < 16 && glGetError() != GL_NO_ERROR; ++i) {
+                }
+            }
+
+            GLuint BuildProgram() {
+                const GLuint vs = glCreateShader(GL_VERTEX_SHADER);
+                glShaderSource(vs, 1, &kVertexSource, nullptr);
+                glCompileShader(vs);
+                const GLuint fs = glCreateShader(GL_FRAGMENT_SHADER);
+                glShaderSource(fs, 1, &kFragmentSource, nullptr);
+                glCompileShader(fs);
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, vs);
+                glAttachShader(program, fs);
+                glLinkProgram(program);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                glDeleteShader(vs);
+                glDeleteShader(fs);
+                if (!linked) {
+                    GLint length = 0;
+                    glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+                    std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                    glGetProgramInfoLog(program, length + 1, nullptr, buffer.data());
+                    m_buildLog = buffer.data();
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+
+            // The whole surface, so a failure can report the three probes together rather than
+            // three separate readbacks that might disagree about which draw they saw.
+            std::vector<Pixel> DrawAndRead() {
+                glClearColor(0.0f, 0.0f, 0.0f, 1.0f);
+                glClear(GL_COLOR_BUFFER_BIT);
+                glDrawElements(GL_TRIANGLE_STRIP, static_cast<GLsizei>(std::size(kIndices)), GL_UNSIGNED_INT,
+                               nullptr);
+                std::vector<Pixel> pixels(static_cast<std::size_t>(kSurface) * kSurface);
+                glReadPixels(0, 0, kSurface, kSurface, GL_RGBA, GL_UNSIGNED_BYTE, pixels.data());
+                return pixels;
+            }
+
+            static const Pixel& At(const std::vector<Pixel>& pixels, int x, int y) {
+                return pixels[static_cast<std::size_t>(y) * kSurface + x];
+            }
+
+            static bool IsGreen(const Pixel& p) { return p.g > 128 && p.r < 128; }
+
+            // NDC (-0.5, -0.5): well inside the left triangle whichever way the restart went.
+            static constexpr int kLeftX = 16, kLeftY = 16;
+            // NDC (0.6, -0.5): well inside the right triangle, and outside every welded one.
+            static constexpr int kRightX = 51, kRightY = 16;
+            // NDC (0.2, -0.5): in the gap between the two triangles, and INSIDE the triangle the
+            // strip welds out of vertices 7, 3 and 4 when the restart is dropped. This is the
+            // probe that distinguishes a working restart from a silently ignored one.
+            static constexpr int kGapX = 38, kGapY = 16;
+
+            GLuint m_vao = 0;
+            GLuint m_vbo = 0;
+            GLuint m_ebo = 0;
+            GLuint m_fbo = 0;
+            GLuint m_colorTexture = 0;
+            GLuint m_program = 0;
+            std::string m_buildLog;
+        };
+
+        // THE crash regression. Before the fix this call never returned: DirectGLES threw
+        // std::runtime_error out of glDrawElements and the process died on the spot. Reaching the
+        // assertion at all is most of the point.
+        TEST_F(PrimitiveRestartScenario, AnArbitraryRestartIndexDrawsInsteadOfKillingTheProcess) {
+            if (!Ready()) GTEST_SKIP();
+
+            glEnable(GL_PRIMITIVE_RESTART);
+            glPrimitiveRestartIndex(kRestartIndex);
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+            const std::vector<Pixel> pixels = DrawAndRead();
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR))
+                << "an arbitrary restart index is legal desktop GL and must raise no error";
+
+            EXPECT_TRUE(IsGreen(At(pixels, kLeftX, kLeftY))) << "the first strip half did not render";
+            EXPECT_TRUE(IsGreen(At(pixels, kRightX, kRightY))) << "the second strip half did not render";
+            EXPECT_FALSE(IsGreen(At(pixels, kGapX, kGapY)))
+                << "the gap between the two halves is covered, so the restart was dropped and the "
+                   "strip welded across it";
+        }
+
+        // The other half of the state: an application that sets the restart index TO the fixed
+        // all-ones value needs no rewriting at all, and the cap must map straight onto the
+        // driver's own fixed-index restart. Same picture, different path through the backend.
+        TEST_F(PrimitiveRestartScenario, TheFixedIndexValueTakesTheForwardingPath) {
+            if (!Ready()) GTEST_SKIP();
+
+            // Index 0xFFFFFFFF is not a vertex this draw uses, so the strip is the same shape.
+            const GLuint fixedIndices[] = {0, 1, 2, 0xFFFFFFFFu, 3, 4, 5};
+            glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, m_ebo);
+            glBufferSubData(GL_ELEMENT_ARRAY_BUFFER, 0, sizeof(fixedIndices), fixedIndices);
+
+            glEnable(GL_PRIMITIVE_RESTART);
+            glPrimitiveRestartIndex(0xFFFFFFFFu);
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+            const std::vector<Pixel> pixels = DrawAndRead();
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+            EXPECT_TRUE(IsGreen(At(pixels, kLeftX, kLeftY)));
+            EXPECT_TRUE(IsGreen(At(pixels, kRightX, kRightY)));
+            EXPECT_FALSE(IsGreen(At(pixels, kGapX, kGapY)));
+
+            // Put the buffer back for whatever runs next in this fixture.
+            glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, m_ebo);
+            glBufferSubData(GL_ELEMENT_ARRAY_BUFFER, 0, sizeof(kIndices), kIndices);
+            DrainErrors();
+        }
+
+        // With the cap off, the same index data is just data - nothing restarts, and the strip
+        // welds across the gap. The negative control for the probe above: without it, a backend
+        // that lost the whole draw would pass the test by rendering nothing in the gap.
+        TEST_F(PrimitiveRestartScenario, WithoutTheCapTheStripWeldsAcrossTheGap) {
+            if (!Ready()) GTEST_SKIP();
+
+            glDisable(GL_PRIMITIVE_RESTART);
+            glPrimitiveRestartIndex(kRestartIndex);
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+            const std::vector<Pixel> pixels = DrawAndRead();
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+            EXPECT_TRUE(IsGreen(At(pixels, kLeftX, kLeftY))) << "the draw itself must still happen";
+            EXPECT_TRUE(IsGreen(At(pixels, kGapX, kGapY)))
+                << "with restart disabled the strip is continuous, so the gap must be covered - if "
+                   "it is not, the probe above proves nothing";
+        }
+
+        // A second draw with a DIFFERENT restart index has to be rewritten again. The substitution
+        // stages through one scratch buffer, so a cached or half-restored element-array binding
+        // would show up here as the second draw reusing the first one's data.
+        TEST_F(PrimitiveRestartScenario, ChangingTheRestartIndexBetweenDrawsIsHonoured) {
+            if (!Ready()) GTEST_SKIP();
+
+            glEnable(GL_PRIMITIVE_RESTART);
+            glPrimitiveRestartIndex(kRestartIndex);
+            const std::vector<Pixel> restarted = DrawAndRead();
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+            EXPECT_FALSE(IsGreen(At(restarted, kGapX, kGapY)));
+
+            // 6 is the other spare vertex, and it appears nowhere in the index data - so nothing
+            // restarts and the strip is continuous again, from the very same buffer.
+            glPrimitiveRestartIndex(6);
+            const std::vector<Pixel> notRestarted = DrawAndRead();
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+            EXPECT_TRUE(IsGreen(At(notRestarted, kLeftX, kLeftY)));
+            EXPECT_TRUE(IsGreen(At(notRestarted, kGapX, kGapY)))
+                << "the second draw restarted on an index that is not in its data";
+        }
+
+        // A NON-indexed draw has no index stream, so GL primitive restart cannot affect it - and a
+        // list topology is the shape DirectVulkan has to refuse when the device lacks
+        // VK_EXT_primitive_topology_list_restart. Deriving the pipeline's primitiveRestartEnable
+        // from the capability bits alone conflated the two: an application that enables
+        // GL_PRIMITIVE_RESTART once at init and then draws its UI with glDrawArrays(GL_TRIANGLES)
+        // had every one of those draws silently dropped on such a device.
+        TEST_F(PrimitiveRestartScenario, ANonIndexedListTopologyDrawIsUnaffectedByTheCap) {
+            if (!Ready()) GTEST_SKIP();
+
+            glEnable(GL_PRIMITIVE_RESTART);
+            glPrimitiveRestartIndex(kRestartIndex);
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+            glClearColor(0.0f, 0.0f, 0.0f, 1.0f);
+            glClear(GL_COLOR_BUFFER_BIT);
+            // Vertices 0,1,2 are the left triangle; GL_TRIANGLES is a list topology.
+            glDrawArrays(GL_TRIANGLES, 0, 3);
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+            std::vector<Pixel> pixels(static_cast<std::size_t>(kSurface) * kSurface);
+            glReadPixels(0, 0, kSurface, kSurface, GL_RGBA, GL_UNSIGNED_BYTE, pixels.data());
+            EXPECT_TRUE(IsGreen(At(pixels, kLeftX, kLeftY)))
+                << "primitive restart has no meaning for glDrawArrays, so the draw must render "
+                   "normally whatever the device supports";
+            DrainErrors();
+        }
+
+        // GL 4.6 core 10.3.6 compares the fetched index, zero-extended, against the full 32-bit
+        // PRIMITIVE_RESTART_INDEX. A restart index the index type cannot hold therefore matches
+        // nothing and the draw restarts NOWHERE - it does not restart on the truncated value, and
+        // it does not restart on the type's all-ones value either, which is what the driver's own
+        // fixed-index restart would have done if it had been left enabled.
+        TEST_F(PrimitiveRestartScenario, ARestartIndexTooLargeForTheIndexTypeRestartsNowhere) {
+            if (!Ready()) GTEST_SKIP();
+
+            // 16-bit indices with a restart index of 0x10007: the low half (7) IS a real index in
+            // the data, so a truncating comparison would split the strip exactly where a correct
+            // one leaves it whole.
+            const GLushort shortIndices[] = {0, 1, 2, static_cast<GLushort>(kRestartIndex), 3, 4, 5};
+            glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, m_ebo);
+            glBufferData(GL_ELEMENT_ARRAY_BUFFER, sizeof(shortIndices), shortIndices, GL_STATIC_DRAW);
+
+            glEnable(GL_PRIMITIVE_RESTART);
+            glPrimitiveRestartIndex(0x10000u + kRestartIndex);
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+            glClearColor(0.0f, 0.0f, 0.0f, 1.0f);
+            glClear(GL_COLOR_BUFFER_BIT);
+            glDrawElements(GL_TRIANGLE_STRIP, static_cast<GLsizei>(std::size(shortIndices)), GL_UNSIGNED_SHORT,
+                           nullptr);
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+            std::vector<Pixel> pixels(static_cast<std::size_t>(kSurface) * kSurface);
+            glReadPixels(0, 0, kSurface, kSurface, GL_RGBA, GL_UNSIGNED_BYTE, pixels.data());
+            EXPECT_TRUE(IsGreen(At(pixels, kLeftX, kLeftY)));
+            EXPECT_TRUE(IsGreen(At(pixels, kGapX, kGapY)))
+                << "no 16-bit index can equal 0x10007, so nothing restarts and the strip is "
+                   "continuous - truncating the restart index to 7 would split it here";
+
+            glBufferData(GL_ELEMENT_ARRAY_BUFFER, sizeof(kIndices), kIndices, GL_STATIC_DRAW);
+            DrainErrors();
+        }
+
+        // The all-ones value of an index type is an ordinary vertex index whenever the array uses
+        // the type's full range, which is exactly why an application picks an arbitrary restart
+        // index in the first place. Substituting the sentinel in place would either steal that
+        // vertex or spuriously restart on it, so the copy widens instead - and the draw has to be
+        // issued with the widened type, which is the part that is easy to forget.
+        TEST_F(PrimitiveRestartScenario, AnAllOnesVertexIndexSurvivesTheSubstitution) {
+            if (!Ready()) GTEST_SKIP();
+
+            // The buffer carries the 16-bit all-ones value as an ordinary element. It sits past
+            // the seven indices this draw reads, because the vertex array has only eight entries
+            // and fetching index 65535 would be out of range - what is under test is that its
+            // mere PRESENCE forces the widened copy, and that the draw still finds its own
+            // indices at the right offsets in a copy whose element width has changed underneath
+            // it. Narrowly substituting in place instead would rewrite this element to 0xFFFE.
+            const GLushort shortIndices[] = {0, 1, 2, static_cast<GLushort>(kRestartIndex), 3, 4, 5, 0xFFFFu};
+            glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, m_ebo);
+            glBufferData(GL_ELEMENT_ARRAY_BUFFER, sizeof(shortIndices), shortIndices, GL_STATIC_DRAW);
+
+            glEnable(GL_PRIMITIVE_RESTART);
+            glPrimitiveRestartIndex(kRestartIndex);
+            ASSERT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+            glClearColor(0.0f, 0.0f, 0.0f, 1.0f);
+            glClear(GL_COLOR_BUFFER_BIT);
+            // Only the first seven indices are drawn, so the 0xFFFF element is never fetched - what
+            // is under test is that its PRESENCE does not break the substitution or the offsets.
+            glDrawElements(GL_TRIANGLE_STRIP, 7, GL_UNSIGNED_SHORT, nullptr);
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+
+            std::vector<Pixel> pixels(static_cast<std::size_t>(kSurface) * kSurface);
+            glReadPixels(0, 0, kSurface, kSurface, GL_RGBA, GL_UNSIGNED_BYTE, pixels.data());
+            EXPECT_TRUE(IsGreen(At(pixels, kLeftX, kLeftY))) << "the first strip half did not render";
+            EXPECT_TRUE(IsGreen(At(pixels, kRightX, kRightY))) << "the second strip half did not render";
+            EXPECT_FALSE(IsGreen(At(pixels, kGapX, kGapY)))
+                << "the restart still has to happen once the copy has been widened";
+
+            glBufferData(GL_ELEMENT_ARRAY_BUFFER, sizeof(kIndices), kIndices, GL_STATIC_DRAW);
+            DrainErrors();
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/PrimitivesGeneratedNoXfbScenario.cpp

@@ -0,0 +1,554 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/PrimitivesGeneratedNoXfbScenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - GL_PRIMITIVES_GENERATED COUNTS DRAWS MADE WITH TRANSFORM FEEDBACK
+// INACTIVE.
+//
+// GL 4.6 core 13.4: the query counts what the last vertex processing stage emits,
+// capture or no capture. The CTS leans its whole tessellation suite on that - the
+// tessellator's output is MEASURED by an XFB-inactive PATCHES draw under
+// rasterizer discard inside a GENERATED query, and the capture buffers of ~29
+// tessellation tests are sized from the answer - so a backend that answers 0
+// hands them a zero-byte buffer and an INVALID_OPERATION off its zero-length map.
+//
+// DirectVulkan serves the query from the transform-feedback stream query's
+// primitivesNeeded, which VK_EXT_transform_feedback defines to count whether or
+// not a capture span is open. Both the Mali-G1-Ultra driver AND Mesa lavapipe
+// disagree with that definition: with no vkCmdBeginTransformFeedbackEXT recorded,
+// the pair reads back 0. Where the bring-up probe measures that defect with a
+// working control - or MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE=1 pins it on - the
+// renderer accumulates XFB-inactive draws through the best proven substitute
+// pool: VK_QUERY_TYPE_PRIMITIVES_GENERATED_EXT (which lavapipe hosts and passes,
+// rasterizer discard included), else pipeline statistics over clipping-stage
+// invocations (GL's CLIPPING_INPUT_PRIMITIVES). These cases assert the GL-visible
+// answer, so on this machine they hold the reroute to the same numbers the
+// healthy stream path must produce - the "two pools must agree" assertion - and
+// on a healthy driver they pin the stream path itself.
+//
+// DirectVulkan only: DirectGLES has no GPU counter for an XFB-inactive draw at
+// all (ES has no PRIMITIVES_GENERATED without a capture), and its CPU accounting
+// is a different mechanism with its own tests.
+
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <functional>
+#include <initializer_list>
+#include <iterator>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        GLuint CompileShaderStage(GLenum type, const char* source, std::string* log) {
+            const GLuint shader = glCreateShader(type);
+            glShaderSource(shader, 1, &source, nullptr);
+            glCompileShader(shader);
+            GLint status = GL_FALSE;
+            glGetShaderiv(shader, GL_COMPILE_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetShaderInfoLog(shader, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteShader(shader);
+                return 0;
+            }
+            return shader;
+        }
+
+        // A capture-capable vertex-only program: the varying gives glBeginTransformFeedback
+        // something to capture for the mixed-span case; the XFB-inactive cases draw with the
+        // same program and simply never begin a span.
+        const char* const kVertexSource = R"(#version 430 core
+out vec4 vs_out_value;
+void main() {
+  const vec2 corners[3] = vec2[3](vec2(-1.0, -1.0), vec2(3.0, -1.0), vec2(-1.0, 3.0));
+  vs_out_value = vec4(1.0);
+  gl_Position = vec4(corners[gl_VertexID % 3], 0.0, 1.0);
+}
+)";
+
+        // A passthrough tessellation pipeline whose all-1 levels emit exactly one
+        // triangle per patch - the count the tessellation cases assert.
+        const char* const kTessVertexSource = R"(#version 430 core
+void main() {
+  gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+        const char* const kTessControlSource = R"(#version 430 core
+layout(vertices = 1) out;
+void main() {
+  gl_TessLevelOuter[0] = 1.0;
+  gl_TessLevelOuter[1] = 1.0;
+  gl_TessLevelOuter[2] = 1.0;
+  gl_TessLevelOuter[3] = 1.0;
+  gl_TessLevelInner[0] = 1.0;
+  gl_TessLevelInner[1] = 1.0;
+}
+)";
+        const char* const kTessEvalSource = R"(#version 430 core
+layout(triangles, equal_spacing, cw) in;
+void main() {
+  gl_Position = vec4(gl_TessCoord.xy * 2.0 - 1.0, 0.0, 1.0);
+}
+)";
+
+        // The same tessellation pipeline with something to capture, so that
+        // glBeginTransformFeedback accepts it: the paused-span PATCHES case needs an
+        // open (but paused) capture span AND a tessellator in one program.
+        const char* const kTessEvalCaptureSource = R"(#version 430 core
+layout(triangles, equal_spacing, cw) in;
+out vec4 te_out_value;
+void main() {
+  te_out_value = vec4(1.0);
+  gl_Position = vec4(gl_TessCoord.xy * 2.0 - 1.0, 0.0, 1.0);
+}
+)";
+
+        class PrimitivesGeneratedNoXfbScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                if (Gl().BackendName() != std::string("DirectVulkan")) {
+                    GTEST_SKIP() << "the stream-query defect and its reroute are DirectVulkan's; "
+                                 << Gl().BackendName()
+                                 << " answers this query from a different mechanism";
+                }
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                glGenQueries(2, m_queries);
+                ASSERT_NE(m_queries[0], 0u);
+                ASSERT_NE(m_queries[1], 0u);
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                if (m_queries[0] != 0 || m_queries[1] != 0) glDeleteQueries(2, m_queries);
+                m_queries[0] = m_queries[1] = 0;
+                for (const GLuint program : m_programs) {
+                    glDeleteProgram(program);
+                }
+                m_programs.clear();
+                glBindVertexArray(0);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                m_vao = 0;
+                ScenarioTest::TearDown();
+            }
+
+            // captureVarying: the name to record with glTransformFeedbackVaryings, or
+            // nullptr for a program that can never open a capture span.
+            GLuint BuildProgram(std::initializer_list<std::pair<GLenum, const char*>> stages,
+                                const char* captureVarying) {
+                std::vector<GLuint> shaders;
+                for (const auto& [type, source] : stages) {
+                    const GLuint shader = CompileShaderStage(type, source, &m_buildLog);
+                    if (shader == 0) {
+                        for (const GLuint built : shaders) glDeleteShader(built);
+                        return 0;
+                    }
+                    shaders.push_back(shader);
+                }
+                const GLuint program = glCreateProgram();
+                for (const GLuint shader : shaders) glAttachShader(program, shader);
+                if (captureVarying != nullptr) {
+                    glTransformFeedbackVaryings(program, 1, &captureVarying, GL_INTERLEAVED_ATTRIBS);
+                }
+                glLinkProgram(program);
+                for (const GLuint shader : shaders) glDeleteShader(shader);
+                GLint status = GL_FALSE;
+                glGetProgramiv(program, GL_LINK_STATUS, &status);
+                if (status == GL_FALSE) {
+                    GLint length = 0;
+                    glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+                    std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                    glGetProgramInfoLog(program, length + 1, nullptr, buffer.data());
+                    m_buildLog = buffer.data();
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                m_programs.push_back(program);
+                return program;
+            }
+
+            GLuint BuildCaptureProgram() {
+                return BuildProgram({{GL_VERTEX_SHADER, kVertexSource}}, "vs_out_value");
+            }
+
+            GLuint BuildTessellationProgram(bool withCaptureVarying = false) {
+                GLint maxTessGenLevel = 0;
+                glGetIntegerv(GL_MAX_TESS_GEN_LEVEL, &maxTessGenLevel);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                if (maxTessGenLevel < 1) return 0;
+                return BuildProgram(
+                    {{GL_VERTEX_SHADER, kTessVertexSource},
+                     {GL_TESS_CONTROL_SHADER, kTessControlSource},
+                     {GL_TESS_EVALUATION_SHADER,
+                      withCaptureVarying ? kTessEvalCaptureSource : kTessEvalSource}},
+                    withCaptureVarying ? "te_out_value" : nullptr);
+            }
+
+            // A capture span that is open but PAUSED. The pause closes the capture, so
+            // every draw inside it is XFB-inactive at the backend - the stream query's
+            // silent case - while the GL span stays active. `program` must be the one
+            // that is bound: GL requires the same program at resume.
+            void BeginPausedSpan() {
+                glGenBuffers(1, &m_captureBuffer);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, m_captureBuffer);
+                glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, 64 * sizeof(float), nullptr, GL_DYNAMIC_DRAW);
+                glBeginTransformFeedback(GL_TRIANGLES);
+                glPauseTransformFeedback();
+            }
+
+            void EndPausedSpan() {
+                glResumeTransformFeedback();
+                glEndTransformFeedback();
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+                if (m_captureBuffer != 0) glDeleteBuffers(1, &m_captureBuffer);
+                m_captureBuffer = 0;
+            }
+
+            // GENERATED query around `record()`, answered with GL_QUERY_RESULT.
+            GLuint QueryGenerated(const std::function<void()>& record) {
+                glBeginQuery(GL_PRIMITIVES_GENERATED, m_queries[1]);
+                record();
+                glEndQuery(GL_PRIMITIVES_GENERATED);
+                GLuint generated = 0xFFFFFFFFu;
+                glGetQueryObjectuiv(m_queries[1], GL_QUERY_RESULT, &generated);
+                return generated;
+            }
+
+            static GLenum DrainGLErrors() {
+                const GLenum first = glGetError();
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return first;
+            }
+
+            const std::string& BuildLog() const { return m_buildLog; }
+
+            static std::filesystem::path LibraryLogPath() {
+                const char* path = std::getenv("MOBILEGL_LOG_FILE_PATH");
+                return (path != nullptr && *path != '\0') ? std::filesystem::path(path)
+                                                          : std::filesystem::path();
+            }
+
+            static std::uintmax_t LibraryLogSize() {
+                std::error_code ec;
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return 0;
+                const std::uintmax_t size = std::filesystem::file_size(path, ec);
+                return ec ? 0 : size;
+            }
+
+            static std::string LibraryLogSince(std::uintmax_t offset) {
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return {};
+                std::ifstream file(path, std::ios::binary);
+                if (!file.good()) return {};
+                file.seekg(static_cast<std::streamoff>(offset));
+                return std::string((std::istreambuf_iterator<char>(file)),
+                                   std::istreambuf_iterator<char>());
+            }
+
+            GLuint m_vao = 0;
+            GLuint m_queries[2] = {0, 0}; // [0]=written, [1]=generated
+            GLuint m_captureBuffer = 0;
+            std::vector<GLuint> m_programs;
+            std::string m_buildLog;
+        };
+
+        // The plain shape: no capture object was ever bound, no span begun, no
+        // rasterizer discard - just a GENERATED query around two triangles. On a
+        // healthy driver the stream query answers it; on an affected one the armed
+        // reroute must produce the same 2.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, CountsADrawMadeWithNoCaptureSpan) {
+            if (!Ready()) return;
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            const GLuint generated = QueryGenerated([]() { glDrawArrays(GL_TRIANGLES, 0, 6); });
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            EXPECT_EQ(generated, 2u)
+                << "GL_PRIMITIVES_GENERATED must count a draw made while transform feedback is "
+                   "inactive (GL 4.6 core 13.4)";
+        }
+
+        // THE CTS SHAPE (esextcTessellationShaderUtils.cpp, captureTessellationData):
+        // rasterizer discard ON, transform feedback INACTIVE, the draw inside a
+        // GENERATED query. This is the exact query whose 0 sizes ~29 tessellation
+        // tests' capture buffers on the affected device.
+        //
+        // On lavapipe this case holds through the dedicated
+        // VK_QUERY_TYPE_PRIMITIVES_GENERATED_EXT reroute (its discard feature is
+        // what makes a discarded draw countable there - llvmpipe's clipping
+        // statistics AND stream query both read 0 under discard).
+        //
+        // The value-conditioned skip below is deliberate and narrow, for a stack
+        // with NO counter that survives discard: there this case is unfalsifiable,
+        // and a red would indict MobileGL for a hole the bring-up probe already
+        // measures and reports (StatisticsSubstitutePlainOnly / Unfixable). The
+        // exact-zero answer IS the capability signal - any wrong nonzero count
+        // still fails - and on every driver that counts discarded draws at all the
+        // full assertion runs. The device probe list holds this shape on the Mali.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, CountsUnderRasterizerDiscardWithNoCaptureSpan) {
+            if (!Ready()) return;
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            glEnable(GL_RASTERIZER_DISCARD);
+            const GLuint generated = QueryGenerated([]() { glDrawArrays(GL_TRIANGLES, 0, 6); });
+            glDisable(GL_RASTERIZER_DISCARD);
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            if (generated == 0u) {
+                GTEST_SKIP() << "no counter this backend can reach (stream query, dedicated "
+                                "primitives-generated query, clipping statistics) survives "
+                                "rasterizer discard for an XFB-inactive draw on this stack - the "
+                                "shape is unfalsifiable here; the bring-up probe measures the same "
+                                "hole and the POST row reports it";
+            }
+            EXPECT_EQ(generated, 2u)
+                << "rasterizer discard drops primitives after clipping and must not hide them from "
+                   "GL_PRIMITIVES_GENERATED - this is the exact shape the CTS measures the "
+                   "tessellator with";
+        }
+
+        // The tessellation flavour: a PATCHES draw whose all-1 levels emit exactly
+        // one triangle - the count the CTS's getAmountOfVerticesGeneratedByTessellator
+        // protocol derives everything from. Undiscarded, so that the answer is
+        // holdable on this machine through whichever accounting path is armed (the
+        // discard interaction is the case above's business, measured separately).
+        TEST_F(PrimitivesGeneratedNoXfbScenario, CountsATessellatedPatchWithNoCaptureSpan) {
+            if (!Ready()) return;
+            const GLuint program = BuildTessellationProgram();
+            if (program == 0) {
+                GTEST_SKIP() << "no tessellation stages on this stack: " << BuildLog();
+            }
+            glUseProgram(program);
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+
+            const GLuint generated = QueryGenerated([]() { glDrawArrays(GL_PATCHES, 0, 1); });
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            EXPECT_EQ(generated, 1u)
+                << "a triangles-domain patch with every level 1 tessellates to exactly one "
+                   "triangle, and GL_PRIMITIVES_GENERATED must say so with no capture active";
+        }
+
+        // One query span holding BOTH kinds of draw: an XFB-inactive draw, then a
+        // captured one, then another XFB-inactive one. The GENERATED answer must
+        // accumulate across the two accounting paths the armed reroute splits them
+        // into (stream slots for the captured draw, statistics slots for the
+        // others), and WRITTEN must stay exactly the captured draw's count - the
+        // pairing the stream path exists to keep exact. Undiscarded, so the
+        // accumulation invariant is holdable on this machine (see the discard
+        // case's comment); the triangles rasterize into the harness framebuffer,
+        // which nothing here reads.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, ASpanMixingActiveAndInactiveDrawsAccumulatesBoth) {
+            if (!Ready()) return;
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            GLuint captureBuffer = 0;
+            glGenBuffers(1, &captureBuffer);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, captureBuffer);
+            glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, 3 * 4 * sizeof(float), nullptr, GL_DYNAMIC_DRAW);
+
+            glBeginQuery(GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN, m_queries[0]);
+            const GLuint generated = QueryGenerated([]() {
+                glDrawArrays(GL_TRIANGLES, 0, 3); // XFB inactive
+                glBeginTransformFeedback(GL_TRIANGLES);
+                glDrawArrays(GL_TRIANGLES, 0, 3); // captured
+                glEndTransformFeedback();
+                glDrawArrays(GL_TRIANGLES, 0, 3); // XFB inactive again
+            });
+            glEndQuery(GL_TRANSFORM_FEEDBACK_PRIMITIVES_WRITTEN);
+
+            GLuint written = 0xFFFFFFFFu;
+            glGetQueryObjectuiv(m_queries[0], GL_QUERY_RESULT, &written);
+            glDeleteBuffers(1, &captureBuffer);
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            EXPECT_EQ(generated, 3u) << "one triangle before the span, one inside it, one after";
+            EXPECT_EQ(written, 1u) << "only the draw inside the span writes anything";
+        }
+
+        // ===================== DRAWS INSIDE A PAUSED SPAN =====================
+        //
+        // glPauseTransformFeedback closes the capture without closing the span, so a
+        // draw made while paused is XFB-INACTIVE at the backend - the stream query is
+        // exactly as silent for it as for a draw with no span at all - while
+        // GL_PRIMITIVES_GENERATED must still count what the last vertex processing
+        // stage emitted (GL 4.6 core 13.4; the WRITTEN query is the one the pause
+        // silences). The frontend does keep a CPU counter for paused draws, but it can
+        // price only 3 of the ~15 draw entry points and answers 0 for GL_PATCHES, so
+        // these draws are the reroute's business like any other - and the trap on the
+        // other side is counting them TWICE, once in each accounting.
+        //
+        // Each case measures the SAME draw twice: once with no span open at all (the
+        // capability control - what this stack can count) and once inside the paused
+        // span, and requires the two to agree. That differential is what makes these
+        // cases falsifying rather than vacuous: a stack where no counter reaches a
+        // capture-less draw fails the control and skips, while a stack that counts the
+        // unpaused draw and answers 0 for the paused one - which is what excluding
+        // paused draws from the reroute produced - fails, instead of skipping into
+        // green.
+
+        // The draw the CPU counter CAN price: if the span both reroutes it and adds the
+        // CPU delta, this reads 2.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, APausedSpanCountsACpuPricedDrawExactlyOnce) {
+            if (!Ready()) return;
+            if (AmbientQuirkFromEnvironment("MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE") == AmbientQuirk::Off) {
+                GTEST_SKIP() << "the negative control replays the pre-probe accounting, whose paused "
+                                "draws are CPU-counted on top of whatever the stream query says";
+            }
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            const GLuint unpaused = QueryGenerated([]() { glDrawArrays(GL_TRIANGLES, 0, 3); });
+            BeginPausedSpan();
+            const GLuint paused = QueryGenerated([]() { glDrawArrays(GL_TRIANGLES, 0, 3); });
+            EndPausedSpan();
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            if (unpaused == 0u) {
+                GTEST_SKIP() << "no counter this backend can reach answers a capture-less draw on this "
+                                "stack, so the paused half of the comparison proves nothing; the "
+                                "bring-up probe measures the same hole and the POST row reports it";
+            }
+            EXPECT_EQ(unpaused, 1u) << "the control itself: one triangle is one primitive";
+            EXPECT_EQ(paused, unpaused)
+                << "one triangle drawn while the capture span is paused is still one primitive "
+                   "generated - counted once, by whichever accounting owns it, never by two of them "
+                   "(a reroute slot AND the frontend's CPU paused counter reads 2)";
+        }
+
+        // The draw the CPU counter CANNOT price: GL_PATCHES, whose amplification is not
+        // knowable on the CPU (CountPrimitivesForDraw answers 0 for it by design) - and
+        // the CTS's tessellator-measuring shape. Excluding paused draws from the
+        // reroute left this counted by nothing at all on the affected device.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, APausedSpanCountsATessellatedPatchExactlyOnce) {
+            if (!Ready()) return;
+            const GLuint program = BuildTessellationProgram(/*withCaptureVarying=*/true);
+            if (program == 0) {
+                GTEST_SKIP() << "no tessellation stages on this stack: " << BuildLog();
+            }
+            glUseProgram(program);
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+
+            const GLuint unpaused = QueryGenerated([]() { glDrawArrays(GL_PATCHES, 0, 1); });
+            BeginPausedSpan();
+            const GLuint paused = QueryGenerated([]() { glDrawArrays(GL_PATCHES, 0, 1); });
+            EndPausedSpan();
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            if (unpaused == 0u) {
+                GTEST_SKIP() << "no counter this backend can reach answers a capture-less patch draw "
+                                "on this stack, so the paused half proves nothing; the bring-up probe "
+                                "measures the same hole and the POST row reports it";
+            }
+            EXPECT_EQ(unpaused, 1u)
+                << "the control itself: a triangles-domain patch with every level 1 tessellates to "
+                   "exactly one triangle";
+            EXPECT_EQ(paused, unpaused)
+                << "pausing the capture does not stop the tessellator from generating that triangle, "
+                   "and the frontend's CPU paused counter answers 0 for GL_PATCHES - so a paused "
+                   "patch draw left out of the reroute is counted by nothing at all";
+        }
+
+        // The other half of the same hole: the instanced entry points never reach the
+        // frontend's paused accounting either, so a paused instanced draw excluded from
+        // the reroute is likewise counted by nothing.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, APausedSpanCountsAnInstancedDrawExactlyOnce) {
+            if (!Ready()) return;
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            const GLuint unpaused =
+                QueryGenerated([]() { glDrawArraysInstanced(GL_TRIANGLES, 0, 3, 4); });
+            BeginPausedSpan();
+            const GLuint paused = QueryGenerated([]() { glDrawArraysInstanced(GL_TRIANGLES, 0, 3, 4); });
+            EndPausedSpan();
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            if (unpaused == 0u) {
+                GTEST_SKIP() << "no counter this backend can reach answers a capture-less draw on this "
+                                "stack, so the paused half proves nothing";
+            }
+            EXPECT_EQ(unpaused, 4u) << "the control itself: four instances of one triangle";
+            EXPECT_EQ(paused, unpaused)
+                << "four instances generate four primitives whether or not the capture span is "
+                   "paused, and no instanced entry point reaches the frontend's paused accounting";
+        }
+
+        // THE ONE CASE THAT CAN FAIL WHEN THE REROUTE SILENTLY STOPS BEING ARMED -
+        // the UnlocatedIoBlockScenario shape, for the same reason: every case above
+        // is green here whether the reroute ran or not (that is the "two pools
+        // agree" point), so none of them can say the pinned lane actually exercised
+        // a reroute pool. This one asserts a LIBRARY OBSERVABLE against the
+        // environment: with MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE pinned on, an
+        // XFB-inactive draw inside a GENERATED span must make the renderer say -
+        // through its latched MGLOG_I - that it engaged the reroute. It reads
+        // MG_Config not at all (on Android this module links the shipping library)
+        // and trusts only the log bytes appended after it started.
+        TEST_F(PrimitivesGeneratedNoXfbScenario, TheRerouteIsActuallyArmedWhenTheEnvironmentPinsItOn) {
+            if (!Ready()) return;
+            if (AmbientQuirkFromEnvironment("MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE") != AmbientQuirk::On) {
+                GTEST_SKIP() << "this case needs the reroute pinned ON for the whole process, which "
+                                "is what the PrimGenReroute. ctest entry does with "
+                                "MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE=1; unset, the bring-up probe "
+                                "decides and this machine's verdict is its own business";
+            }
+            if (LibraryLogPath().empty()) {
+                GTEST_SKIP() << "MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE is pinned on but "
+                                "MOBILEGL_LOG_FILE_PATH is not set, so the library has nowhere to "
+                                "record that it rerouted anything; the PrimGenReroute. ctest "
+                                "entry sets both";
+            }
+
+            const GLuint program = BuildCaptureProgram();
+            ASSERT_NE(program, 0u) << BuildLog();
+            glUseProgram(program);
+
+            // Taken BEFORE the draw, so the line this looks for can only be one this
+            // process wrote for this span. The latch fires on the FIRST rerouted
+            // draw, which is inside the query below.
+            const std::uintmax_t before = LibraryLogSize();
+            const GLuint generated = QueryGenerated([]() { glDrawArrays(GL_TRIANGLES, 0, 3); });
+            EXPECT_EQ(DrainGLErrors(), 0u);
+            EXPECT_EQ(generated, 1u) << "the pinned-on lane did not even count correctly";
+
+            const std::string appended = LibraryLogSince(before);
+            EXPECT_NE(appended.find("PRIMITIVES_GENERATED reroute engaged"), std::string::npos)
+                << "MOBILEGL_MAGMA_PRIMGEN_QUERY_REROUTE is pinned ON, an XFB-inactive draw ran inside "
+                   "a GENERATED query, and the renderer never reported engaging the reroute. The "
+                   "quirk is not armed - check the override mapping "
+                   "(ChoosePrimitivesGeneratedReroute) and the arming gate in "
+                   "VulkanRenderer::BeginXfbQueryForDraw. Log appended by this test:\n"
+                << appended;
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/RenderbufferBlendFormatScenario.cpp

@@ -0,0 +1,227 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/RenderbufferBlendFormatScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - BLENDING WORKS ON A RENDERBUFFER WHOSE GL FORMAT HAS NO EXACT VkFormat.
+//
+// DirectVulkan force-disables blending on an attachment whose VkFormat lacks
+// VK_FORMAT_FEATURE_COLOR_ATTACHMENT_BLEND_BIT, which is the right thing to do - blending on such a
+// format is invalid pipeline state. The probe has to ask about the format the attachment ACTUALLY
+// has, and for renderbuffers it asked a different question from the one that created the image: the
+// image comes from ResolveTextureFormatInfo (which widens GL formats with no Vulkan twin onto a real
+// one) while the probe used the strict 1:1 converter, which answers VK_FORMAT_UNDEFINED for RGBA2,
+// RGBA12, RGB10, RGB12, RGB16 and the three-channel formats, and the 16-bit packed formats for RGBA4
+// and RGB5_A1.
+//
+// VkFormatProperties for VK_FORMAT_UNDEFINED are all zero, so the probe concluded "not blendable"
+// and every pipeline for that attachment was built with blendEnable = VK_FALSE - permanently, and
+// silently apart from one log line. The source colour then overwrites the destination instead of
+// blending with it, which is a wrong PICTURE, not a wrong error code.
+//
+// GL_RGB8 is the ordinary shape and is what this scenario leads with: it is a required
+// colour-renderable format, its image has been R8G8B8A8_UNORM all along, and the probe asked about
+// the 24-bit R8G8B8_UNORM that most drivers do not support at all. GL_RGBA4 covers the other half -
+// a format whose probe answered a real-but-different VkFormat.
+//
+// DirectGLES is the control: it forwards the renderbuffer to the ES driver and blends whatever the
+// driver blends, so a disagreement between the two backends is the defect.
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr int kExtent = 16;
+
+        constexpr const char* kVertexSource = R"(#version 330 core
+void main()
+{
+    switch (gl_VertexID)
+    {
+      case 0: gl_Position = vec4(-1.0, 1.0, 0.0, 1.0); break;
+      case 1: gl_Position = vec4( 1.0, 1.0, 0.0, 1.0); break;
+      case 2: gl_Position = vec4(-1.0,-1.0, 0.0, 1.0); break;
+      case 3: gl_Position = vec4( 1.0,-1.0, 0.0, 1.0); break;
+    }
+}
+)";
+
+        constexpr const char* kFragmentSource = R"(#version 330 core
+uniform vec4 uColor;
+out vec4 fragColor;
+void main()
+{
+    fragColor = uColor;
+}
+)";
+
+        class RenderbufferBlendFormatScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                glGenVertexArrays(1, &m_vao);
+                std::string error;
+                m_program = CompileProgram(kVertexSource, kFragmentSource, &error);
+                ASSERT_NE(m_program, 0u) << "program did not build: " << error;
+                ASSERT_EQ(FirstGLError(), 0u);
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                Destroy();
+                if (m_program != 0) glDeleteProgram(m_program);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                glBindFramebuffer(GL_FRAMEBUFFER, 0);
+            }
+
+            void Destroy() {
+                if (m_fbo != 0) {
+                    glBindFramebuffer(GL_FRAMEBUFFER, 0);
+                    glDeleteFramebuffers(1, &m_fbo);
+                    m_fbo = 0;
+                }
+                if (m_renderbuffer != 0) {
+                    glDeleteRenderbuffers(1, &m_renderbuffer);
+                    m_renderbuffer = 0;
+                }
+            }
+
+            // Returns false (having skipped, not failed) when the driver will not give us a complete
+            // framebuffer for this format - GL only requires a subset of formats to be
+            // colour-renderable, and the point of the scenario is blending, not format support.
+            bool MakeTarget(GLenum internalFormat) {
+                Destroy();
+                glGenRenderbuffers(1, &m_renderbuffer);
+                glBindRenderbuffer(GL_RENDERBUFFER, m_renderbuffer);
+                glRenderbufferStorage(GL_RENDERBUFFER, internalFormat, kExtent, kExtent);
+                glGenFramebuffers(1, &m_fbo);
+                glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+                glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_RENDERBUFFER, m_renderbuffer);
+                const GLenum status = glCheckFramebufferStatus(GL_FRAMEBUFFER);
+                for (int i = 0; i < 16 && glGetError() != GL_NO_ERROR; ++i) {
+                }
+                return status == GL_FRAMEBUFFER_COMPLETE;
+            }
+
+            void DrawColor(float r, float g, float b, float a) {
+                glUseProgram(m_program);
+                glUniform4f(glGetUniformLocation(m_program, "uColor"), r, g, b, a);
+                glBindVertexArray(m_vao);
+                glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+                glBindVertexArray(0);
+                glUseProgram(0);
+            }
+
+            GLuint m_renderbuffer = 0;
+            GLuint m_fbo = 0;
+            GLuint m_vao = 0;
+            unsigned int m_program = 0;
+        };
+
+        // One draw of opaque black, then a 50%-alpha white draw over it with the ordinary
+        // SRC_ALPHA / ONE_MINUS_SRC_ALPHA function. Blending gives mid-grey; a pipeline built with
+        // blendEnable = VK_FALSE gives white, because the source simply overwrites.
+        //
+        // The tolerance is wide on purpose: RGBA4 has four bits per channel, so "mid-grey" is one of
+        // a handful of representable values and the test must not become a quantisation test.
+        void ExpectBlendedRatherThanOverwritten(const char* what) {
+            const Image image = ReadPixels(kExtent, kExtent);
+            ASSERT_FALSE(image.Empty()) << what;
+            const Rgba8 centre = image.At(kExtent / 2, kExtent / 2);
+            EXPECT_GT(int(centre.r), 40) << what << ": got " << centre << ", which is darker than a blend of "
+                                                              "black and 50% white";
+            EXPECT_LT(int(centre.r), 215) << what << ": got " << centre
+                                          << ", which is the source colour - blending was disabled";
+        }
+
+    } // namespace
+
+    // The ordinary case, and the one broken today rather than only after the format table was
+    // unified: a three-channel colour renderbuffer. Its image has been R8G8B8A8_UNORM all along while
+    // the blend probe asked about R8G8B8_UNORM, which most drivers do not support at all.
+    TEST_F(RenderbufferBlendFormatScenario, BlendingWorksOnAThreeChannelRenderbuffer) {
+        if (!Ready()) GTEST_SKIP();
+        if (!MakeTarget(GL_RGB8)) GTEST_SKIP() << "GL_RGB8 renderbuffer is not framebuffer-complete here";
+
+        glViewport(0, 0, kExtent, kExtent);
+        glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_DEPTH_TEST);
+        glDisable(GL_BLEND);
+        DrawColor(0.0f, 0.0f, 0.0f, 1.0f);
+
+        glEnable(GL_BLEND);
+        glBlendFunc(GL_SRC_ALPHA, GL_ONE_MINUS_SRC_ALPHA);
+        DrawColor(1.0f, 1.0f, 1.0f, 0.5f);
+        glDisable(GL_BLEND);
+        EXPECT_EQ(FirstGLError(), 0u) << "the blended draw left a GL error behind";
+
+        ExpectBlendedRatherThanOverwritten("GL_RGB8");
+        Gl().EndFrame();
+    }
+
+    // The other half: a format whose strict converter answers a real-but-different VkFormat
+    // (R4G4B4A4_UNORM_PACK16) while the image is R8G8B8A8_UNORM. Blend support for the packed 16-bit
+    // formats is optional in Vulkan, so the probe could legitimately answer "no" for a format the
+    // attachment does not have.
+    TEST_F(RenderbufferBlendFormatScenario, BlendingWorksOnALowBitPackedRenderbuffer) {
+        if (!Ready()) GTEST_SKIP();
+        if (!MakeTarget(GL_RGBA4)) GTEST_SKIP() << "GL_RGBA4 renderbuffer is not framebuffer-complete here";
+
+        glViewport(0, 0, kExtent, kExtent);
+        glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_DEPTH_TEST);
+        glDisable(GL_BLEND);
+        DrawColor(0.0f, 0.0f, 0.0f, 1.0f);
+
+        glEnable(GL_BLEND);
+        glBlendFunc(GL_SRC_ALPHA, GL_ONE_MINUS_SRC_ALPHA);
+        DrawColor(1.0f, 1.0f, 1.0f, 0.5f);
+        glDisable(GL_BLEND);
+        EXPECT_EQ(FirstGLError(), 0u) << "the blended draw left a GL error behind";
+
+        ExpectBlendedRatherThanOverwritten("GL_RGBA4");
+        Gl().EndFrame();
+    }
+
+    // The control that keeps both of the above honest: the same sequence on the format whose probe
+    // and image always agreed. If this one ever fails, the scenario is measuring the blend setup
+    // rather than the format resolution.
+    TEST_F(RenderbufferBlendFormatScenario, BlendingWorksOnAnRgba8Renderbuffer) {
+        if (!Ready()) GTEST_SKIP();
+        if (!MakeTarget(GL_RGBA8)) GTEST_SKIP() << "GL_RGBA8 renderbuffer is not framebuffer-complete here";
+
+        glViewport(0, 0, kExtent, kExtent);
+        glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_DEPTH_TEST);
+        glDisable(GL_BLEND);
+        DrawColor(0.0f, 0.0f, 0.0f, 1.0f);
+
+        glEnable(GL_BLEND);
+        glBlendFunc(GL_SRC_ALPHA, GL_ONE_MINUS_SRC_ALPHA);
+        DrawColor(1.0f, 1.0f, 1.0f, 0.5f);
+        glDisable(GL_BLEND);
+        EXPECT_EQ(FirstGLError(), 0u) << "the blended draw left a GL error behind";
+
+        ExpectBlendedRatherThanOverwritten("GL_RGBA8");
+        Gl().EndFrame();
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/SampleMaskScopeScenario.cpp

@@ -0,0 +1,178 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/SampleMaskScopeScenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - GL_SAMPLE_MASK IS A MULTISAMPLE FRAGMENT OPERATION, SO IT DOES NOTHING AT ONE SAMPLE.
+//
+// GL 4.6 core 17.3.3 groups alpha-to-coverage, sample coverage and the sample mask together and
+// says they make no change "if MULTISAMPLE is disabled, or if the value of SAMPLE_BUFFERS is not
+// one". SAMPLE_BUFFERS is 0 for a single-sample framebuffer, so on one the mask is inert whatever
+// glSampleMaski last wrote.
+//
+// Vulkan has no such rule. VkPipelineMultisampleStateCreateInfo::pSampleMask is ANDed with
+// rasterization coverage at every rasterizationSamples, and at one sample that coverage is bit 0
+// alone - so a mask with bit 0 clear discards every fragment of every primitive. Plumbing
+// glSampleMaski straight into pSampleMask therefore turned an ordinary and legal GL sequence into
+// a fully black draw:
+//
+//     glEnable(GL_SAMPLE_MASK); glSampleMaski(0, 0x2);   // while an MSAA target is bound
+//     ... render ...
+//     glBindFramebuffer(GL_FRAMEBUFFER, 0); draw a fullscreen quad to present
+//
+// Neither piece of state is per-framebuffer, so nothing resets it when the target changes, and
+// dEQP/GL-CTS multisample cases leave exactly these masks behind. That is the MSAA-then-present
+// shape every application uses.
+//
+// The cases below are single-sample by construction (the scenario harness's colour FBO), so each
+// one asserts that the mask changed nothing.
+
+#include <string>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr int kFboSize = 32;
+
+        constexpr const char* kQuadVertexSource = R"(#version 430 core
+void main() {
+    vec2 corner = vec2((gl_VertexID & 1) == 0 ? -1.0 : 1.0,
+                       (gl_VertexID & 2) == 0 ? -1.0 : 1.0);
+    gl_Position = vec4(corner, 0.0, 1.0);
+}
+)";
+
+        constexpr const char* kGreenFragmentSource = R"(#version 430 core
+out vec4 o_color;
+void main() {
+    o_color = vec4(0.0, 1.0, 0.0, 1.0);
+}
+)";
+
+        class SampleMaskScopeScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                m_target = MakeColorFbo(kFboSize, kFboSize);
+                ASSERT_NE(m_target.fbo, 0u) << "could not create the render target";
+                glGenVertexArrays(1, &m_vao);
+                std::string error;
+                m_program = CompileProgram(kQuadVertexSource, kGreenFragmentSource, &error);
+                ASSERT_NE(m_program, 0u) << error;
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                // Process-wide GL state: leaving it set would hand the next scenario in this
+                // process the very bug under test.
+                glDisable(GL_SAMPLE_MASK);
+                glSampleMaski(0, 0xFFFFFFFFu);
+                glBindVertexArray(0);
+                glUseProgram(0);
+                if (m_program != 0) glDeleteProgram(m_program);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                DestroyColorFbo(m_target);
+                ScenarioTest::TearDown();
+            }
+
+            void ExpectQuadStillPaints(const char* what) {
+                BindFbo(m_target);
+                ClearTo(0.0f, 0.0f, 0.0f, 1.0f);
+                glBindVertexArray(m_vao);
+                glUseProgram(m_program);
+                glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+                glBindVertexArray(0);
+                EXPECT_EQ(FirstGLError(), 0u) << what << ": the draw raised a GL error";
+
+                const Image image = ReadPixels(kFboSize, kFboSize);
+                ASSERT_FALSE(image.Empty()) << what << ": the readback came back empty";
+                EXPECT_TRUE(RegionIsMostly(image, 0, kFboSize - 1, 0, kFboSize - 1, "green", 0.0, what))
+                    << what << ": an all-black target means the sample mask discarded every fragment, "
+                    << "which GL says it cannot do on a single-sample framebuffer";
+            }
+
+            ColorFbo m_target{};
+            GLuint m_vao = 0;
+            unsigned int m_program = 0;
+        };
+
+    } // namespace
+
+    // The exact reported shape: bit 0 clear, so the single sample of a single-sample target is
+    // masked off if the mask is applied at all.
+    TEST_F(SampleMaskScopeScenario, AMaskWithBitZeroClearDoesNotDiscardASingleSampleDraw) {
+        if (!Ready() || IsSkipped()) return;
+        glEnable(GL_SAMPLE_MASK);
+        glSampleMaski(0, 0x2);
+        ASSERT_EQ(FirstGLError(), 0u) << "setting the sample mask raised a GL error";
+        ExpectQuadStillPaints("GL_SAMPLE_MASK enabled with mask 0x2");
+    }
+
+    // Zero is the strongest form of the same thing, and the mask value the CTS's mask_zero cases
+    // set.
+    TEST_F(SampleMaskScopeScenario, AZeroMaskDoesNotDiscardASingleSampleDraw) {
+        if (!Ready() || IsSkipped()) return;
+        glEnable(GL_SAMPLE_MASK);
+        glSampleMaski(0, 0x0);
+        ASSERT_EQ(FirstGLError(), 0u) << "setting the sample mask raised a GL error";
+        ExpectQuadStillPaints("GL_SAMPLE_MASK enabled with mask 0");
+    }
+
+    // Control: the same mask word with the capability disabled has never had any effect, so this
+    // one passed before the fix too. It is here so a regression that ignores the enable bit
+    // instead of the sample count is still caught.
+    TEST_F(SampleMaskScopeScenario, ADisabledSampleMaskDoesNotDiscardASingleSampleDraw) {
+        if (!Ready() || IsSkipped()) return;
+        glDisable(GL_SAMPLE_MASK);
+        glSampleMaski(0, 0x0);
+        ASSERT_EQ(FirstGLError(), 0u) << "setting the sample mask raised a GL error";
+        ExpectQuadStillPaints("GL_SAMPLE_MASK disabled with mask 0");
+    }
+
+    // The mask is state, not a draw parameter, so a second draw after the first must not inherit
+    // a pipeline built while the memo word and the payload disagreed. Two draws either side of a
+    // mask change, both to the same single-sample target, both required to paint.
+    TEST_F(SampleMaskScopeScenario, ChangingTheMaskBetweenSingleSampleDrawsKeepsBothPainting) {
+        if (!Ready() || IsSkipped()) return;
+        glEnable(GL_SAMPLE_MASK);
+        glSampleMaski(0, 0xFFFFFFFFu);
+        ExpectQuadStillPaints("first draw, full mask");
+        glSampleMaski(0, 0x2);
+        ASSERT_EQ(FirstGLError(), 0u) << "changing the sample mask raised a GL error";
+        ExpectQuadStillPaints("second draw, mask 0x2");
+    }
+
+    // GL_MAX_SAMPLE_MASK_WORDS must be 1 on both backends: MobileGL stores one word and
+    // SampleMaski_State raises GL_INVALID_VALUE for any maskNumber above 0, so advertising more
+    // makes dEQP's per-case gluStateReset - which issues glSampleMaski up to the advertised count
+    // - fail every case. DirectGLES clamped; DirectVulkan forwarded the raw device limit.
+    TEST_F(SampleMaskScopeScenario, TheAdvertisedSampleMaskWordCountMatchesWhatSampleMaskiAccepts) {
+        if (!Ready() || IsSkipped()) return;
+        GLint words = 0;
+        glGetIntegerv(GL_MAX_SAMPLE_MASK_WORDS, &words);
+        ASSERT_EQ(FirstGLError(), 0u) << "querying GL_MAX_SAMPLE_MASK_WORDS raised a GL error";
+        EXPECT_EQ(words, 1) << "every word below the advertised count must be writable, and only word 0 is";
+        for (GLint word = 0; word < words; ++word) {
+            glSampleMaski(static_cast<GLuint>(word), 0xFFFFFFFFu);
+            EXPECT_EQ(FirstGLError(), 0u) << "glSampleMaski(" << word << ", ...) was refused although "
+                                          << "GL_MAX_SAMPLE_MASK_WORDS advertises " << words << " words";
+        }
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/SampleVariablesScenario.cpp

@@ -0,0 +1,274 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/SampleVariablesScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - gl_NumSamples REACHES THE SHADER, AND IT FOLLOWS THE DRAW FRAMEBUFFER.
+//
+// glslang declares gl_NumSamples only when it is NOT targeting SPIR-V - both the desktop and the
+// ES branch of Initialize.cpp wrap `uniform int gl_NumSamples;` in `if (spvVersion.spv == 0)`,
+// because SPIR-V has no NumSamples builtin to lower it to - and MobileGL always targets SPIR-V.
+// Every fragment shader that read the built-in therefore died at COMPILE time with
+// "'gl_NumSamples' : undeclared identifier", which is all 144 KHR-GL46.sample_variables.mask.*
+// bodies plus their es_31_compatibility twins.
+//
+// The source pipeline now lowers it onto a reserved default-block uniform and the draw path writes
+// the current draw framebuffer's sample count into it. Two claims, and the second is the one a
+// compile-only test cannot make: the value must be the DRAW FRAMEBUFFER's, so one program drawn
+// into a multisample target and then into a single-sample target has to report both counts. A
+// link-time bake would pass the first assertion and fail the second, which is exactly why the
+// write lives per draw.
+//
+// llvmpipe and lavapipe both offer 4x multisample RGBA8, so this runs for real in CI rather than
+// skipping; the skips below are for a driver that offers no multisample renderbuffer at all.
+
+#include <algorithm>
+#include <string>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr const char* kVS = R"(#version 400 core
+in vec2 aPos;
+void main() { gl_Position = vec4(aPos, 0.0, 1.0); }
+)";
+
+        // gl_NumSamples scaled so each count lands on its own well-separated 8-bit value: 1 -> 16,
+        // 2 -> 32, 4 -> 64. Every sample of the fragment gets the same colour, so the resolve blit
+        // averages identical values and the readback is exact rather than approximate.
+        constexpr const char* kFS = R"(#version 400 core
+out vec4 o_color;
+void main() { o_color = vec4(float(gl_NumSamples) * (16.0 / 255.0), 0.0, 0.0, 1.0); }
+)";
+
+        class SampleVariablesScenario : public ScenarioTest {};
+
+        void DrawFullViewportQuad(unsigned int program) {
+            static const float kQuad[] = {-1.0f, -1.0f, 1.0f, -1.0f, -1.0f, 1.0f, 1.0f, 1.0f};
+            GLuint vao = 0, vbo = 0;
+            glGenVertexArrays(1, &vao);
+            glBindVertexArray(vao);
+            glGenBuffers(1, &vbo);
+            glBindBuffer(GL_ARRAY_BUFFER, vbo);
+            glBufferData(GL_ARRAY_BUFFER, sizeof(kQuad), kQuad, GL_STATIC_DRAW);
+            glEnableVertexAttribArray(0);
+            glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 2 * sizeof(float), nullptr);
+            glUseProgram(program);
+            glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+            glBindVertexArray(0);
+            glDeleteBuffers(1, &vbo);
+            glDeleteVertexArrays(1, &vao);
+        }
+
+    } // namespace
+
+    TEST_F(SampleVariablesScenario, GlNumSamplesFollowsTheDrawFramebuffersSampleCount) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+        const int width = gl.Width();
+        const int height = gl.Height();
+        ASSERT_GE(width, 8);
+        ASSERT_GE(height, 8);
+
+        std::string error;
+        const unsigned int program = CompileProgram(kVS, kFS, &error);
+        // The compile failure this scenario exists for lands here, with glslang's own text.
+        ASSERT_NE(program, 0u) << error;
+
+        GLint maxSamples = 0;
+        glGetIntegerv(GL_MAX_SAMPLES, &maxSamples);
+        const GLint requestedSamples = std::min<GLint>(maxSamples, 4);
+        if (requestedSamples < 2) {
+            glDeleteProgram(program);
+            GTEST_SKIP() << "GL_MAX_SAMPLES is " << maxSamples << "; this needs a multisample renderbuffer";
+        }
+
+        glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_DEPTH_TEST);
+
+        // ---- multisample target ----
+        GLuint msFbo = 0, msRbo = 0;
+        glGenFramebuffers(1, &msFbo);
+        glBindFramebuffer(GL_FRAMEBUFFER, msFbo);
+        glGenRenderbuffers(1, &msRbo);
+        glBindRenderbuffer(GL_RENDERBUFFER, msRbo);
+        glRenderbufferStorageMultisample(GL_RENDERBUFFER, requestedSamples, GL_RGBA8, width, height);
+        glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_RENDERBUFFER, msRbo);
+        if (glCheckFramebufferStatus(GL_FRAMEBUFFER) != GL_FRAMEBUFFER_COMPLETE) {
+            glDeleteRenderbuffers(1, &msRbo);
+            glDeleteFramebuffers(1, &msFbo);
+            glBindFramebuffer(GL_FRAMEBUFFER, 0);
+            glDeleteProgram(program);
+            GTEST_SKIP() << "no complete " << requestedSamples << "x multisample RGBA8 renderbuffer on this driver";
+        }
+
+        // What the driver actually allocated - a request is a lower bound, and the shader has to
+        // agree with the query rather than with what was asked for.
+        GLint realizedSamples = 0;
+        glGetIntegerv(GL_SAMPLES, &realizedSamples);
+        ASSERT_GE(realizedSamples, 2) << "the multisample framebuffer reports GL_SAMPLES " << realizedSamples;
+
+        glViewport(0, 0, width, height);
+        ClearTo(0.0f, 0.0f, 0.0f, 1.0f);
+        DrawFullViewportQuad(program);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        // Resolve into the default framebuffer to read it back.
+        BindDefaultFramebuffer();
+        glViewport(0, 0, width, height);
+        ClearTo(0.0f, 0.0f, 0.0f, 1.0f);
+        glBindFramebuffer(GL_READ_FRAMEBUFFER, msFbo);
+        glBindFramebuffer(GL_DRAW_FRAMEBUFFER, 0);
+        glBlitFramebuffer(0, 0, width, height, 0, 0, width, height, GL_COLOR_BUFFER_BIT, GL_NEAREST);
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        {
+            const Image resolved = ReadPixels(width, height);
+            const Rgba8 centre = resolved.At(width / 2, height / 2);
+            EXPECT_NEAR(centre.r, 16 * realizedSamples, 2)
+                << "gl_NumSamples read " << (centre.r / 16.0) << " into a " << realizedSamples
+                << "-sample framebuffer; 1 means the reserved uniform was never written, 0 means it was "
+                << "written but never uploaded";
+        }
+        gl.EndFrame();
+
+        // ---- the SAME program into a single-sample target ----
+        // A link-time bake of the sample count would keep reporting the multisample value here.
+        GLuint ssFbo = 0, ssRbo = 0;
+        glGenFramebuffers(1, &ssFbo);
+        glBindFramebuffer(GL_FRAMEBUFFER, ssFbo);
+        glGenRenderbuffers(1, &ssRbo);
+        glBindRenderbuffer(GL_RENDERBUFFER, ssRbo);
+        glRenderbufferStorage(GL_RENDERBUFFER, GL_RGBA8, width, height);
+        glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_RENDERBUFFER, ssRbo);
+        ASSERT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+
+        glViewport(0, 0, width, height);
+        ClearTo(0.0f, 0.0f, 0.0f, 1.0f);
+        DrawFullViewportQuad(program);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        {
+            const Image single = ReadPixels(width, height);
+            const Rgba8 centre = single.At(width / 2, height / 2);
+            // GL 4.6 core 15.2.2: gl_NumSamples is ONE for a non-multisample framebuffer, where
+            // glGetIntegerv(GL_SAMPLES) answers zero.
+            EXPECT_NEAR(centre.r, 16, 2)
+                << "gl_NumSamples read " << (centre.r / 16.0)
+                << " into a single-sample framebuffer; the value is a property of the DRAW FRAMEBUFFER, "
+                << "so re-using the program must re-write it";
+        }
+
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        glDeleteRenderbuffers(1, &ssRbo);
+        glDeleteFramebuffers(1, &ssFbo);
+        glDeleteRenderbuffers(1, &msRbo);
+        glDeleteFramebuffers(1, &msFbo);
+        glDeleteProgram(program);
+        gl.EndFrame();
+    }
+
+    // ARB_sample_shading is advertised, and until now glMinSampleShading was a logging no-op while
+    // glEnable(GL_SAMPLE_SHADING) fell out of RenderState::SetCapability's default arm - so an
+    // application could ask for a shading rate and get silence from both halves.
+    //
+    // What this can and cannot assert. The RATE itself is not observable from a portable shader:
+    // GL 4.6 core 14.3.1 makes any use of gl_SampleID or gl_SamplePosition force per-sample
+    // evaluation on its own, so the very built-ins that would report the rate defeat the
+    // measurement. What IS worth pinning is that the state now reaches both backends without
+    // damage: DirectGLES forwards glEnable(GL_SAMPLE_SHADING) + glMinSampleShading to the ES
+    // driver (and must not, on a driver that has neither, push an INVALID_ENUM into the
+    // application's error queue), and DirectVulkan bakes sampleShadingEnable/minSampleShading into
+    // a NEW pipeline - which it may only do with the device's sampleRateShading feature enabled.
+    TEST_F(SampleVariablesScenario, SampleShadingStateReachesTheBackendWithoutDisturbingTheDraw) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+        const int width = gl.Width();
+        const int height = gl.Height();
+
+        std::string error;
+        const unsigned int program = CompileProgram(kVS, kFS, &error);
+        ASSERT_NE(program, 0u) << error;
+
+        GLint maxSamples = 0;
+        glGetIntegerv(GL_MAX_SAMPLES, &maxSamples);
+        const GLint requestedSamples = std::min<GLint>(maxSamples, 4);
+        if (requestedSamples < 2) {
+            glDeleteProgram(program);
+            GTEST_SKIP() << "GL_MAX_SAMPLES is " << maxSamples << "; sample shading needs a multisample target";
+        }
+
+        GLuint msFbo = 0, msRbo = 0;
+        glGenFramebuffers(1, &msFbo);
+        glBindFramebuffer(GL_FRAMEBUFFER, msFbo);
+        glGenRenderbuffers(1, &msRbo);
+        glBindRenderbuffer(GL_RENDERBUFFER, msRbo);
+        glRenderbufferStorageMultisample(GL_RENDERBUFFER, requestedSamples, GL_RGBA8, width, height);
+        glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_RENDERBUFFER, msRbo);
+        if (glCheckFramebufferStatus(GL_FRAMEBUFFER) != GL_FRAMEBUFFER_COMPLETE) {
+            glDeleteRenderbuffers(1, &msRbo);
+            glDeleteFramebuffers(1, &msFbo);
+            glBindFramebuffer(GL_FRAMEBUFFER, 0);
+            glDeleteProgram(program);
+            GTEST_SKIP() << "no complete " << requestedSamples << "x multisample RGBA8 renderbuffer on this driver";
+        }
+
+        GLint realizedSamples = 0;
+        glGetIntegerv(GL_SAMPLES, &realizedSamples);
+        glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_DEPTH_TEST);
+        glViewport(0, 0, width, height);
+
+        glEnable(GL_SAMPLE_SHADING);
+        glMinSampleShading(1.0f);
+        EXPECT_EQ(glIsEnabled(GL_SAMPLE_SHADING), static_cast<GLboolean>(GL_TRUE));
+        GLfloat rate = -1.0f;
+        glGetFloatv(GL_MIN_SAMPLE_SHADING_VALUE, &rate);
+        EXPECT_FLOAT_EQ(rate, 1.0f);
+        EXPECT_EQ(FirstGLError(), 0u) << "enabling sample shading raised a GL error";
+
+        ClearTo(0.0f, 0.0f, 0.0f, 1.0f);
+        DrawFullViewportQuad(program);
+        EXPECT_EQ(FirstGLError(), 0u) << "the sample-shading draw raised a GL error";
+
+        BindDefaultFramebuffer();
+        glViewport(0, 0, width, height);
+        ClearTo(0.0f, 0.0f, 0.0f, 1.0f);
+        glBindFramebuffer(GL_READ_FRAMEBUFFER, msFbo);
+        glBindFramebuffer(GL_DRAW_FRAMEBUFFER, 0);
+        glBlitFramebuffer(0, 0, width, height, 0, 0, width, height, GL_COLOR_BUFFER_BIT, GL_NEAREST);
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+
+        const Image resolved = ReadPixels(width, height);
+        const Rgba8 centre = resolved.At(width / 2, height / 2);
+        // The rate changes how OFTEN the shader runs, never what it computes - so the same
+        // gl_NumSamples reading has to come back.
+        EXPECT_NEAR(centre.r, 16 * realizedSamples, 2)
+            << "the draw changed its result once sample shading was enabled";
+
+        glMinSampleShading(0.0f);
+        glDisable(GL_SAMPLE_SHADING);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        glDeleteRenderbuffers(1, &msRbo);
+        glDeleteFramebuffers(1, &msFbo);
+        glDeleteProgram(program);
+        gl.EndFrame();
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/SampledSetStalenessScenario.cpp

@@ -0,0 +1,231 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/SampledSetStalenessScenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - A TEXTURE THAT BECOMES COMPLETE WITHOUT A REBIND MUST RE-ENTER THE SAMPLED SET.
+//
+// DirectVulkan does not bind a texture GL calls incomplete: it substitutes a fallback so the
+// sampler reads (0,0,0,1) instead of losing the draw. That decision is made twice per draw - once
+// by CollectSampledTextures, which builds the list SetupDraw syncs, materialises pending clears
+// for and transitions to a sampled layout BEFORE the render pass opens, and once by the descriptor
+// resolve inside the pass. Both ask SamplesAsIncompleteTexture.
+//
+// The per-draw memo that lets the first of those be skipped was keyed only on the program, the
+// transform flags and the texture BIND generation. Completeness is not a function of any of them:
+// it moves on a filter change (glTexParameteri / glSamplerParameteri), on a level-range change,
+// and on an upload that fills the mip chain - none of which bind anything. So a texture that went
+// incomplete -> complete under a fixed binding kept being answered out of the memo as "not in the
+// set", and the work SetupDraw does for the set never happened for it:
+//
+//   * its queued clear was never materialised, so the draw sampled pre-clear content - wrong
+//     pixels, no validation layer needed, which is what the case below detects; and
+//   * its layout transition moved into the descriptor resolve, which records
+//     vkCmdPipelineBarrier inside an already-open render pass whose subpass declares no
+//     self-dependency - the exact hazard CollectSampledTextures exists to prevent.
+//
+// The fix adds the sampling-resolution generation to that memo key, which is the counter the
+// codebase already maintains for "what a unit resolves to changed without a bind" and which both
+// TextureObjectBase::BumpShapeVersion and SamplerObject::BumpVersion move.
+
+#include <cstddef>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr int kFboSize = 32;
+        constexpr int kTexSize = 8;
+
+        constexpr const char* kQuadVertexSource = R"(#version 430 core
+void main() {
+    vec2 corner = vec2((gl_VertexID & 1) == 0 ? -1.0 : 1.0,
+                       (gl_VertexID & 2) == 0 ? -1.0 : 1.0);
+    gl_Position = vec4(corner, 0.0, 1.0);
+}
+)";
+
+        // texelFetch, not texture(): the point is WHICH image is sampled, and a fetch cannot be
+        // explained away by filtering.
+        constexpr const char* kSampleFragmentSource = R"(#version 430 core
+uniform sampler2D u_tex;
+out vec4 o_color;
+void main() {
+    o_color = texelFetch(u_tex, ivec2(0, 0), 0);
+}
+)";
+
+        class SampledSetStalenessScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                m_target = MakeColorFbo(kFboSize, kFboSize);
+                ASSERT_NE(m_target.fbo, 0u) << "could not create the render target";
+                glGenVertexArrays(1, &m_vao);
+                std::string error;
+                m_program = CompileProgram(kQuadVertexSource, kSampleFragmentSource, &error);
+                ASSERT_NE(m_program, 0u) << error;
+
+                // The sampled texture: ONE level, and no glTexParameteri at all, so MIN_FILTER
+                // keeps its initial GL_NEAREST_MIPMAP_LINEAR and GL calls it mipmap-incomplete.
+                glGenTextures(1, &m_texture);
+                glActiveTexture(GL_TEXTURE0);
+                glBindTexture(GL_TEXTURE_2D, m_texture);
+                std::vector<unsigned char> green(static_cast<std::size_t>(kTexSize * kTexSize * 4), 0);
+                for (std::size_t i = 0; i < green.size(); i += 4) {
+                    green[i + 1] = 255;
+                    green[i + 3] = 255;
+                }
+                glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, kTexSize, kTexSize, 0, GL_RGBA, GL_UNSIGNED_BYTE,
+                             green.data());
+                ASSERT_EQ(FirstGLError(), 0u) << "defining the sampled texture raised a GL error";
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glBindVertexArray(0);
+                glUseProgram(0);
+                glActiveTexture(GL_TEXTURE0);
+                glBindTexture(GL_TEXTURE_2D, 0);
+                if (m_texture != 0) glDeleteTextures(1, &m_texture);
+                if (m_program != 0) glDeleteProgram(m_program);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                DestroyColorFbo(m_target);
+                ScenarioTest::TearDown();
+            }
+
+            // One draw of the fullscreen quad sampling texel (0,0) of whatever unit 0 holds, and
+            // NO readback. That matters: a readback submits and waits, which ends the command
+            // buffer and resets the per-draw memos with it - so a case that read back between its
+            // two draws would never leave a stale entry to catch. The two draws here have to land
+            // in one recording.
+            void DrawOnly() {
+                BindFbo(m_target);
+                glBindVertexArray(m_vao);
+                glUseProgram(m_program);
+                glActiveTexture(GL_TEXTURE0);
+                glBindTexture(GL_TEXTURE_2D, m_texture);
+                const GLint location = glGetUniformLocation(m_program, "u_tex");
+                if (location != -1) glUniform1i(location, 0);
+                glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+                glBindVertexArray(0);
+                EXPECT_EQ(FirstGLError(), 0u) << "the sampling draw raised a GL error";
+            }
+
+            ColorFbo m_target{};
+            GLuint m_vao = 0;
+            GLuint m_texture = 0;
+            unsigned int m_program = 0;
+        };
+
+    } // namespace
+
+    // The full sequence, ordered so the ONLY state change between the two draws is the filter.
+    TEST_F(SampledSetStalenessScenario, AQueuedClearIsMaterialisedWhenAFilterChangeCompletesTheTexture) {
+        if (!Ready() || IsSkipped()) return;
+
+        // 1. Queue a clear on the texture through an FBO and take it straight back out, with no
+        //    draw in between - the "attach -> clear -> detach" shape that leaves the clear
+        //    pending for whoever samples the texture next.
+        GLuint clearFbo = 0;
+        glGenFramebuffers(1, &clearFbo);
+        glBindFramebuffer(GL_FRAMEBUFFER, clearFbo);
+        glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_texture, 0);
+        ASSERT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+        const GLfloat red[4] = {1.0f, 0.0f, 0.0f, 1.0f};
+        glClearBufferfv(GL_COLOR, 0, red);
+        glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, 0, 0);
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        glDeleteFramebuffers(1, &clearFbo);
+        ASSERT_EQ(FirstGLError(), 0u) << "queueing the clear raised a GL error";
+
+        BindFbo(m_target);
+        ClearTo(0.0f, 0.0f, 1.0f, 1.0f);
+
+        // 2. Draw while the texture is still incomplete. The backend substitutes its fallback,
+        //    and the per-draw memo records the resulting sampled set.
+        DrawOnly();
+
+        // 3. Make it complete. No bind, no upload, no program change - one filter write, which is
+        //    exactly the state the old memo key could not see.
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+        ASSERT_EQ(FirstGLError(), 0u) << "changing the filter raised a GL error";
+
+        // 4. Draw again, into the same recording, and only now read back. The texture is in the
+        //    sampled set now, so its queued clear has to be materialised before the pass opens and
+        //    the fetch has to see RED. Reading the green the texture was uploaded with means the
+        //    clear was never materialised, i.e. the texture never entered the set - the stale-memo
+        //    bug. Black means the fallback was still being handed out.
+        DrawOnly();
+        const Image afterFlip = ReadPixels(kFboSize, kFboSize);
+        ASSERT_FALSE(afterFlip.Empty()) << "the readback came back empty";
+        EXPECT_TRUE(RegionIsMostly(afterFlip, 0, kFboSize - 1, 0, kFboSize - 1, "red", 0.0,
+                                   "the draw after the completeness flip"))
+            << "green means the queued clear was never materialised, so the texture never re-entered "
+               "the sampled set after the filter change; blue means the draw did not happen at all";
+    }
+
+    // The same flip driven from a SAMPLER OBJECT rather than the texture's own parameters. It is
+    // the other half of what feeds the completeness predicate, it moves the same generation, and
+    // it likewise binds nothing.
+    TEST_F(SampledSetStalenessScenario, AQueuedClearIsMaterialisedWhenASamplerObjectCompletesTheTexture) {
+        if (!Ready() || IsSkipped()) return;
+
+        GLuint sampler = 0;
+        glGenSamplers(1, &sampler);
+        // Bound BEFORE the first draw, still carrying the mipmapping default, so binding it is
+        // not what changes between the two draws.
+        glSamplerParameteri(sampler, GL_TEXTURE_MIN_FILTER, GL_NEAREST_MIPMAP_LINEAR);
+        glBindSampler(0, sampler);
+        ASSERT_EQ(FirstGLError(), 0u) << "binding the sampler object raised a GL error";
+
+        GLuint clearFbo = 0;
+        glGenFramebuffers(1, &clearFbo);
+        glBindFramebuffer(GL_FRAMEBUFFER, clearFbo);
+        glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, m_texture, 0);
+        ASSERT_EQ(glCheckFramebufferStatus(GL_FRAMEBUFFER), static_cast<GLenum>(GL_FRAMEBUFFER_COMPLETE));
+        const GLfloat red[4] = {1.0f, 0.0f, 0.0f, 1.0f};
+        glClearBufferfv(GL_COLOR, 0, red);
+        glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, 0, 0);
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        glDeleteFramebuffers(1, &clearFbo);
+        ASSERT_EQ(FirstGLError(), 0u) << "queueing the clear raised a GL error";
+
+        BindFbo(m_target);
+        ClearTo(0.0f, 0.0f, 1.0f, 1.0f);
+        DrawOnly();
+
+        // One parameter write on an ALREADY-BOUND sampler object.
+        glSamplerParameteri(sampler, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+        ASSERT_EQ(FirstGLError(), 0u) << "changing the sampler filter raised a GL error";
+
+        DrawOnly();
+        const Image afterFlip = ReadPixels(kFboSize, kFboSize);
+        ASSERT_FALSE(afterFlip.Empty()) << "the readback came back empty";
+        EXPECT_TRUE(RegionIsMostly(afterFlip, 0, kFboSize - 1, 0, kFboSize - 1, "red", 0.0,
+                                   "the draw after the sampler-object flip"))
+            << "green means the queued clear was never materialised after the sampler parameter change";
+
+        glBindSampler(0, 0);
+        glDeleteSamplers(1, &sampler);
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/SpirvShaderBinaryScenario.cpp

@@ -0,0 +1,339 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/SpirvShaderBinaryScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - AN APPLICATION-SUPPLIED SPIR-V MODULE RENDERS, END TO END.
+//
+// GL_ARB_gl_spirv is core in 4.6 and MobileGL advertises a 4.6 context, but glShaderBinary and
+// glSpecializeShader were DECLARE_GL_FUNCTION_STUB entry points: they took their arguments,
+// recorded no error and did nothing, and glGetShaderiv(GL_SPIR_V_BINARY) raised GL_INVALID_ENUM.
+// Every gl_spirv conformance body died on the first of those two calls.
+//
+// This scenario is the end-to-end proof that the path now WORKS rather than merely answers: two
+// modules that glslang compiled ahead of time (embedded below as words, so the test depends on
+// no toolchain at run time), handed to glShaderBinary, specialized with a scale and a channel
+// index, linked, drawn, and read back. It runs on both backends and, in CI, on llvmpipe/lavapipe.
+//
+// The two specialization constants are the load-bearing part. The vertex module scales its
+// position by constant id 3 and the fragment module writes 1.0 into the channel named by constant
+// id 7 - so a specialization that silently did nothing would leave the default scale of 1.0 (a
+// full-viewport quad instead of a quarter-sized one) and the default channel 0 (red instead of
+// green), and BOTH would show up in the readback. A "specialization" that merely stored the
+// values without folding them in is exactly the failure mode this shape is built to catch.
+//
+// The GLSL the modules came from:
+//     vertex:   layout(location = 0) in vec2 aPos;
+//               layout(constant_id = 3) const float uScale = 1.0;
+//               void main() { gl_Position = vec4(aPos * uScale, 0.0, 1.0); }
+//     fragment: layout(location = 0) out vec4 oColor;
+//               layout(constant_id = 7) const int uChannel = 0;
+//               void main() { vec4 c = vec4(0,0,0,1); c[uChannel] = 1.0; oColor = c; }
+// compiled with `glslangValidator -G --target-env opengl`.
+
+#include <cstring>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+#ifndef GL_SHADER_BINARY_FORMAT_SPIR_V
+#define GL_SHADER_BINARY_FORMAT_SPIR_V 0x9551
+#endif
+#ifndef GL_SPIR_V_BINARY
+#define GL_SPIR_V_BINARY 0x9552
+#endif
+
+namespace MGITest {
+    namespace {
+
+        class SpirvShaderBinaryScenario : public ScenarioTest {};
+
+        // 255 words
+        const unsigned int kVertexModule[] = {
+            0x07230203u, 0x00010000u, 0x0008000bu, 0x00000020u, 0x00000000u, 0x00020011u, 0x00000001u, 0x0006000bu,
+            0x00000001u, 0x4c534c47u, 0x6474732eu, 0x3035342eu, 0x00000000u, 0x0003000eu, 0x00000000u, 0x00000001u,
+            0x0009000fu, 0x00000000u, 0x00000004u, 0x6e69616du, 0x00000000u, 0x0000000du, 0x00000012u, 0x0000001eu,
+            0x0000001fu, 0x00030003u, 0x00000002u, 0x000001c2u, 0x00040005u, 0x00000004u, 0x6e69616du, 0x00000000u,
+            0x00060005u, 0x0000000bu, 0x505f6c67u, 0x65567265u, 0x78657472u, 0x00000000u, 0x00060006u, 0x0000000bu,
+            0x00000000u, 0x505f6c67u, 0x7469736fu, 0x006e6f69u, 0x00070006u, 0x0000000bu, 0x00000001u, 0x505f6c67u,
+            0x746e696fu, 0x657a6953u, 0x00000000u, 0x00070006u, 0x0000000bu, 0x00000002u, 0x435f6c67u, 0x4470696cu,
+            0x61747369u, 0x0065636eu, 0x00070006u, 0x0000000bu, 0x00000003u, 0x435f6c67u, 0x446c6c75u, 0x61747369u,
+            0x0065636eu, 0x00030005u, 0x0000000du, 0x00000000u, 0x00040005u, 0x00000012u, 0x736f5061u, 0x00000000u,
+            0x00040005u, 0x00000014u, 0x61635375u, 0x0000656cu, 0x00050005u, 0x0000001eu, 0x565f6c67u, 0x65747265u,
+            0x00444978u, 0x00060005u, 0x0000001fu, 0x495f6c67u, 0x6174736eu, 0x4965636eu, 0x00000044u, 0x00030047u,
+            0x0000000bu, 0x00000002u, 0x00050048u, 0x0000000bu, 0x00000000u, 0x0000000bu, 0x00000000u, 0x00050048u,
+            0x0000000bu, 0x00000001u, 0x0000000bu, 0x00000001u, 0x00050048u, 0x0000000bu, 0x00000002u, 0x0000000bu,
+            0x00000003u, 0x00050048u, 0x0000000bu, 0x00000003u, 0x0000000bu, 0x00000004u, 0x00040047u, 0x00000012u,
+            0x0000001eu, 0x00000000u, 0x00040047u, 0x00000014u, 0x00000001u, 0x00000003u, 0x00040047u, 0x0000001eu,
+            0x0000000bu, 0x00000005u, 0x00040047u, 0x0000001fu, 0x0000000bu, 0x00000006u, 0x00020013u, 0x00000002u,
+            0x00030021u, 0x00000003u, 0x00000002u, 0x00030016u, 0x00000006u, 0x00000020u, 0x00040017u, 0x00000007u,
+            0x00000006u, 0x00000004u, 0x00040015u, 0x00000008u, 0x00000020u, 0x00000000u, 0x0004002bu, 0x00000008u,
+            0x00000009u, 0x00000001u, 0x0004001cu, 0x0000000au, 0x00000006u, 0x00000009u, 0x0006001eu, 0x0000000bu,
+            0x00000007u, 0x00000006u, 0x0000000au, 0x0000000au, 0x00040020u, 0x0000000cu, 0x00000003u, 0x0000000bu,
+            0x0004003bu, 0x0000000cu, 0x0000000du, 0x00000003u, 0x00040015u, 0x0000000eu, 0x00000020u, 0x00000001u,
+            0x0004002bu, 0x0000000eu, 0x0000000fu, 0x00000000u, 0x00040017u, 0x00000010u, 0x00000006u, 0x00000002u,
+            0x00040020u, 0x00000011u, 0x00000001u, 0x00000010u, 0x0004003bu, 0x00000011u, 0x00000012u, 0x00000001u,
+            0x00040032u, 0x00000006u, 0x00000014u, 0x3f800000u, 0x0004002bu, 0x00000006u, 0x00000016u, 0x00000000u,
+            0x0004002bu, 0x00000006u, 0x00000017u, 0x3f800000u, 0x00040020u, 0x0000001bu, 0x00000003u, 0x00000007u,
+            0x00040020u, 0x0000001du, 0x00000001u, 0x0000000eu, 0x0004003bu, 0x0000001du, 0x0000001eu, 0x00000001u,
+            0x0004003bu, 0x0000001du, 0x0000001fu, 0x00000001u, 0x00050036u, 0x00000002u, 0x00000004u, 0x00000000u,
+            0x00000003u, 0x000200f8u, 0x00000005u, 0x0004003du, 0x00000010u, 0x00000013u, 0x00000012u, 0x0005008eu,
+            0x00000010u, 0x00000015u, 0x00000013u, 0x00000014u, 0x00050051u, 0x00000006u, 0x00000018u, 0x00000015u,
+            0x00000000u, 0x00050051u, 0x00000006u, 0x00000019u, 0x00000015u, 0x00000001u, 0x00070050u, 0x00000007u,
+            0x0000001au, 0x00000018u, 0x00000019u, 0x00000016u, 0x00000017u, 0x00050041u, 0x0000001bu, 0x0000001cu,
+            0x0000000du, 0x0000000fu, 0x0003003eu, 0x0000001cu, 0x0000001au, 0x000100fdu, 0x00010038u,
+        };
+
+        // 134 words
+        const unsigned int kFragmentModule[] = {
+            0x07230203u, 0x00010000u, 0x0008000bu, 0x00000014u, 0x00000000u, 0x00020011u, 0x00000001u, 0x0006000bu,
+            0x00000001u, 0x4c534c47u, 0x6474732eu, 0x3035342eu, 0x00000000u, 0x0003000eu, 0x00000000u, 0x00000001u,
+            0x0006000fu, 0x00000004u, 0x00000004u, 0x6e69616du, 0x00000000u, 0x00000012u, 0x00030010u, 0x00000004u,
+            0x00000008u, 0x00030003u, 0x00000002u, 0x000001c2u, 0x00040005u, 0x00000004u, 0x6e69616du, 0x00000000u,
+            0x00030005u, 0x00000009u, 0x00000063u, 0x00050005u, 0x0000000eu, 0x61684375u, 0x6c656e6eu, 0x00000000u,
+            0x00040005u, 0x00000012u, 0x6c6f436fu, 0x0000726fu, 0x00040047u, 0x0000000eu, 0x00000001u, 0x00000007u,
+            0x00040047u, 0x00000012u, 0x0000001eu, 0x00000000u, 0x00020013u, 0x00000002u, 0x00030021u, 0x00000003u,
+            0x00000002u, 0x00030016u, 0x00000006u, 0x00000020u, 0x00040017u, 0x00000007u, 0x00000006u, 0x00000004u,
+            0x00040020u, 0x00000008u, 0x00000007u, 0x00000007u, 0x0004002bu, 0x00000006u, 0x0000000au, 0x00000000u,
+            0x0004002bu, 0x00000006u, 0x0000000bu, 0x3f800000u, 0x0007002cu, 0x00000007u, 0x0000000cu, 0x0000000au,
+            0x0000000au, 0x0000000au, 0x0000000bu, 0x00040015u, 0x0000000du, 0x00000020u, 0x00000001u, 0x00040032u,
+            0x0000000du, 0x0000000eu, 0x00000000u, 0x00040020u, 0x0000000fu, 0x00000007u, 0x00000006u, 0x00040020u,
+            0x00000011u, 0x00000003u, 0x00000007u, 0x0004003bu, 0x00000011u, 0x00000012u, 0x00000003u, 0x00050036u,
+            0x00000002u, 0x00000004u, 0x00000000u, 0x00000003u, 0x000200f8u, 0x00000005u, 0x0004003bu, 0x00000008u,
+            0x00000009u, 0x00000007u, 0x0003003eu, 0x00000009u, 0x0000000cu, 0x00050041u, 0x0000000fu, 0x00000010u,
+            0x00000009u, 0x0000000eu, 0x0003003eu, 0x00000010u, 0x0000000bu, 0x0004003du, 0x00000007u, 0x00000013u,
+            0x00000009u, 0x0003003eu, 0x00000012u, 0x00000013u, 0x000100fdu, 0x00010038u,
+        };
+
+
+        // The quad the vertex module transforms. Full-viewport before the scale, so a scale of
+        // 0.5 covers exactly the middle half of each axis and the corners stay background.
+        const float kQuad[] = {-1.0f, -1.0f, 1.0f, -1.0f, -1.0f, 1.0f, 1.0f, 1.0f};
+
+        // The specialization constant ids the two modules declare.
+        constexpr unsigned int kScaleConstantId = 3;
+        constexpr unsigned int kChannelConstantId = 7;
+
+        unsigned int MakeSpirvShader(GLenum type, const unsigned int* words, size_t wordCount,
+                                     unsigned int constantId, unsigned int constantValue, std::string* outLog) {
+            const GLuint shader = glCreateShader(type);
+            glShaderBinary(1, &shader, GL_SHADER_BINARY_FORMAT_SPIR_V, words,
+                           static_cast<GLsizei>(wordCount * sizeof(unsigned int)));
+            if (glGetError() != GL_NO_ERROR) {
+                if (outLog) *outLog = "glShaderBinary rejected the module";
+                glDeleteShader(shader);
+                return 0;
+            }
+
+            GLint isSpirv = GL_FALSE;
+            glGetShaderiv(shader, GL_SPIR_V_BINARY, &isSpirv);
+            if (glGetError() != GL_NO_ERROR || isSpirv != GL_TRUE) {
+                if (outLog) *outLog = "GL_SPIR_V_BINARY did not read TRUE after glShaderBinary";
+                glDeleteShader(shader);
+                return 0;
+            }
+
+            glSpecializeShader(shader, "main", 1, &constantId, &constantValue);
+            GLint compiled = GL_FALSE;
+            glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+            if (compiled != GL_TRUE) {
+                if (outLog) {
+                    GLint length = 0;
+                    glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &length);
+                    std::vector<char> log(static_cast<size_t>(length > 0 ? length : 1), '\0');
+                    glGetShaderInfoLog(shader, static_cast<GLsizei>(log.size()), nullptr, log.data());
+                    *outLog = std::string(log.data());
+                }
+                glDeleteShader(shader);
+                return 0;
+            }
+            return shader;
+        }
+
+    } // namespace
+
+    TEST_F(SpirvShaderBinaryScenario, ShaderBinaryFormatIsAdvertisedExactlyOnce) {
+        if (!Ready()) return;
+
+        GLint formatCount = -1;
+        glGetIntegerv(GL_NUM_SHADER_BINARY_FORMATS, &formatCount);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ASSERT_EQ(formatCount, 1) << "a 4.6 context supports exactly the SPIR-V shader binary format";
+
+        std::vector<GLint> formats(static_cast<size_t>(formatCount), 0);
+        glGetIntegerv(GL_SHADER_BINARY_FORMATS, formats.data());
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_EQ(formats[0], static_cast<GLint>(GL_SHADER_BINARY_FORMAT_SPIR_V))
+            << "the count and the list have to describe the same thing";
+    }
+
+    TEST_F(SpirvShaderBinaryScenario, AnUnsupportedBinaryFormatIsRejectedInsteadOfSilentlyAccepted) {
+        if (!Ready()) return;
+
+        const GLuint shader = glCreateShader(GL_VERTEX_SHADER);
+        // 0x8DF9 is GL_SHADER_BINARY_FORMATS' neighbour, not a format: any value but
+        // GL_SHADER_BINARY_FORMAT_SPIR_V is GL_INVALID_ENUM. The stub used to return silently.
+        glShaderBinary(1, &shader, 0x8DF9, kVertexModule, sizeof(kVertexModule));
+        EXPECT_EQ(FirstGLError(), static_cast<unsigned int>(GL_INVALID_ENUM));
+
+        GLint isSpirv = GL_TRUE;
+        glGetShaderiv(shader, GL_SPIR_V_BINARY, &isSpirv);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_EQ(isSpirv, GL_FALSE) << "a rejected glShaderBinary must not have attached anything";
+
+        glDeleteShader(shader);
+    }
+
+    TEST_F(SpirvShaderBinaryScenario, CompileShaderOnASpirvShaderIsInvalidOperationAndShaderSourceTakesItBack) {
+        if (!Ready()) return;
+
+        const GLuint shader = glCreateShader(GL_VERTEX_SHADER);
+        glShaderBinary(1, &shader, GL_SHADER_BINARY_FORMAT_SPIR_V, kVertexModule, sizeof(kVertexModule));
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        glCompileShader(shader);
+        EXPECT_EQ(FirstGLError(), static_cast<unsigned int>(GL_INVALID_OPERATION))
+            << "glSpecializeShader, not glCompileShader, is what compiles a SPIR-V shader";
+
+        // glShaderSource takes the object back to being a GLSL shader, and GL_SPIR_V_BINARY with
+        // it - the transition the conformance suite checks explicitly.
+        const char* source = "#version 450\nvoid main() { gl_Position = vec4(0.0); }\n";
+        glShaderSource(shader, 1, &source, nullptr);
+        ASSERT_EQ(FirstGLError(), 0u);
+        GLint isSpirv = GL_TRUE;
+        glGetShaderiv(shader, GL_SPIR_V_BINARY, &isSpirv);
+        EXPECT_EQ(isSpirv, GL_FALSE);
+        glCompileShader(shader);
+        EXPECT_EQ(FirstGLError(), 0u) << "the object is an ordinary GLSL shader again";
+
+        glDeleteShader(shader);
+    }
+
+    TEST_F(SpirvShaderBinaryScenario, SpecializeShaderErrorSurfaceMatchesTheExtension) {
+        if (!Ready()) return;
+
+        const GLuint shader = glCreateShader(GL_VERTEX_SHADER);
+        glShaderBinary(1, &shader, GL_SHADER_BINARY_FORMAT_SPIR_V, kVertexModule, sizeof(kVertexModule));
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        // 4242 is not one of the module's constant ids. ARB_gl_spirv enumerates that as
+        // GL_INVALID_VALUE, and an erroring GL command has no other effect - so the shader is left
+        // untouched rather than pushed into a failed-compile state.
+        const unsigned int badId = 4242;
+        const unsigned int value = 0;
+        glSpecializeShader(shader, "main", 1, &badId, &value);
+        EXPECT_EQ(FirstGLError(), static_cast<unsigned int>(GL_INVALID_VALUE));
+
+        // Same for an entry point the module does not carry.
+        glSpecializeShader(shader, "notMain", 0, nullptr, nullptr);
+        EXPECT_EQ(FirstGLError(), static_cast<unsigned int>(GL_INVALID_VALUE));
+
+        // Neither refusal specialized the shader, so a well-formed call still works.
+        glSpecializeShader(shader, "main", 0, nullptr, nullptr);
+        EXPECT_EQ(FirstGLError(), 0u);
+        GLint compiled = GL_FALSE;
+        glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+        EXPECT_EQ(compiled, GL_TRUE);
+
+        // But a SECOND specialization of a shader that HAS been specialized is INVALID_OPERATION
+        // until glShaderBinary re-associates the module.
+        glSpecializeShader(shader, "main", 0, nullptr, nullptr);
+        EXPECT_EQ(FirstGLError(), static_cast<unsigned int>(GL_INVALID_OPERATION));
+        glShaderBinary(1, &shader, GL_SHADER_BINARY_FORMAT_SPIR_V, kVertexModule, sizeof(kVertexModule));
+        glSpecializeShader(shader, "main", 0, nullptr, nullptr);
+        EXPECT_EQ(FirstGLError(), 0u) << "re-associating the module makes specialization legal again";
+
+        glDeleteShader(shader);
+    }
+
+    TEST_F(SpirvShaderBinaryScenario, SpecializedModulesLinkAndRenderWithTheirConstantsApplied) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+        const int width = gl.Width();
+        const int height = gl.Height();
+        ASSERT_GE(width, 16);
+        ASSERT_GE(height, 16);
+
+        std::string log;
+        // Scale 0.5 as a float, handed over as the GLuint bit pattern the extension specifies.
+        unsigned int halfBits = 0;
+        const float half = 0.5f;
+        std::memcpy(&halfBits, &half, sizeof(halfBits));
+
+        const unsigned int vs = MakeSpirvShader(GL_VERTEX_SHADER, kVertexModule,
+                                                sizeof(kVertexModule) / sizeof(kVertexModule[0]),
+                                                kScaleConstantId, halfBits, &log);
+        ASSERT_NE(vs, 0u) << "vertex: " << log;
+        // Channel 1 is green; the module's own default is 0 (red), so a specialization that did
+        // nothing paints the wrong colour.
+        const unsigned int fs = MakeSpirvShader(GL_FRAGMENT_SHADER, kFragmentModule,
+                                                sizeof(kFragmentModule) / sizeof(kFragmentModule[0]),
+                                                kChannelConstantId, 1u, &log);
+        ASSERT_NE(fs, 0u) << "fragment: " << log;
+
+        const GLuint program = glCreateProgram();
+        glAttachShader(program, vs);
+        glAttachShader(program, fs);
+        glLinkProgram(program);
+        GLint linked = GL_FALSE;
+        glGetProgramiv(program, GL_LINK_STATUS, &linked);
+        if (linked != GL_TRUE) {
+            GLint length = 0;
+            glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+            std::vector<char> programLog(static_cast<size_t>(length > 0 ? length : 1), '\0');
+            glGetProgramInfoLog(program, static_cast<GLsizei>(programLog.size()), nullptr, programLog.data());
+            FAIL() << "linking two specialized SPIR-V modules failed: " << programLog.data();
+        }
+
+        BindDefaultFramebuffer();
+        glViewport(0, 0, width, height);
+        glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_DEPTH_TEST);
+        ClearTo(0.0f, 0.0f, 0.0f, 1.0f);
+
+        GLuint vao = 0, vbo = 0;
+        glGenVertexArrays(1, &vao);
+        glBindVertexArray(vao);
+        glGenBuffers(1, &vbo);
+        glBindBuffer(GL_ARRAY_BUFFER, vbo);
+        glBufferData(GL_ARRAY_BUFFER, sizeof(kQuad), kQuad, GL_STATIC_DRAW);
+        glEnableVertexAttribArray(0);
+        glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 2 * sizeof(float), nullptr);
+        glUseProgram(program);
+        glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        const Image painted = ReadPixels(width, height);
+        const Rgba8 centre = painted.At(width / 2, height / 2);
+        EXPECT_LT(centre.r, 32) << "the fragment module wrote the wrong channel; constant id 7 was not applied";
+        EXPECT_GT(centre.g, 224) << "the centre of a 0.5-scaled quad must be painted";
+
+        // A pixel just inside the corner is OUTSIDE the 0.5-scaled quad and must still be the
+        // clear colour - which is what proves constant id 3 reached the vertex module. At the
+        // default scale of 1.0 the quad covers the whole viewport and this pixel would be green.
+        const Rgba8 corner = painted.At(1, 1);
+        EXPECT_LT(corner.g, 32) << "the quad was not scaled; the vertex specialization constant was not applied";
+
+        glBindVertexArray(0);
+        glDeleteBuffers(1, &vbo);
+        glDeleteVertexArrays(1, &vao);
+        glDeleteProgram(program);
+        glDeleteShader(vs);
+        glDeleteShader(fs);
+        gl.EndFrame();
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/TessellationXfbCaptureScenario.cpp

@@ -0,0 +1,896 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/TessellationXfbCaptureScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - WHAT A TESSELLATION EVALUATION STAGE OWES A TRANSFORM FEEDBACK CAPTURE.
+//
+// XfbRepeatedCaptureScenario already pins that a capture from a GL_PATCHES draw records
+// AT ALL. Everything below is the part of the same pipeline it does not reach, and every
+// case here is the reduced form of a conformance body that fails on a device:
+//
+//   * CAPTURING THE BUILT-INS BY NAME. glTransformFeedbackVaryings("gl_Position") /
+//     ("gl_PointSize") on a program whose last vertex-processing stage is the evaluation
+//     shader. Nothing in the tree captured a built-in from a tessellation stage, and the
+//     two backends reach it by completely different routes - DirectGLES has to name a
+//     real ESSL output on the driver's own glTransformFeedbackVaryings, DirectVulkan has
+//     to decorate a SPIR-V built-in that lives inside gl_PerVertex.
+//
+//   * THE PER-VERTEX PAYLOAD THE CONTROL STAGE HANDS OVER. gl_PointSize and a
+//     user-declared per-vertex interface block, both read back out of gl_in[] by the
+//     evaluation stage and only then captured. This is the shape of
+//     KHR-GL4x.tessellation_shader.tessellation_control_to_tessellation_evaluation.
+//     gl_MaxPatchVertices_Position_PointSize, which is 216 of the ~240 conformance bodies
+//     the family still fails: gl_Position arrives, and everything travelling beside it in
+//     the same patch does not.
+//
+// The assertions are on the captured BYTES against a CPU-computed reference, never on the
+// absence of a GL error: every failure this guards against is silent.
+
+#include <cmath>
+#include <cstring>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // Nothing a capture can legitimately produce, so a component that still reads it
+        // names the failure instead of looking like an ordinary numeric mismatch.
+        constexpr float kPoison = -987654.0f;
+
+        const char* const kFragmentSource = R"(#version 420 core
+out vec4 fragColor;
+void main()
+{
+    fragColor = vec4(1.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        class TessellationXfbCaptureScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                DrainErrors();
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                for (const GLuint program : m_programs) {
+                    glDeleteProgram(program);
+                }
+                m_programs.clear();
+                glBindVertexArray(0);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                m_vao = 0;
+                ScenarioTest::TearDown();
+            }
+
+            static void DrainErrors() {
+                for (int i = 0; i < 16 && glGetError() != GL_NO_ERROR; ++i) {
+                }
+            }
+
+            static bool BackendHostsTessellation() {
+                GLint maxTessGenLevel = 0;
+                glGetIntegerv(GL_MAX_TESS_GEN_LEVEL, &maxTessGenLevel);
+                DrainErrors();
+                return maxTessGenLevel >= 1;
+            }
+
+            static GLint MaxPatchVertices() {
+                GLint value = 0;
+                glGetIntegerv(GL_MAX_PATCH_VERTICES, &value);
+                DrainErrors();
+                return value;
+            }
+
+            static std::string InfoLog(GLuint object, bool isShader) {
+                GLint length = 0;
+                if (isShader) {
+                    glGetShaderiv(object, GL_INFO_LOG_LENGTH, &length);
+                } else {
+                    glGetProgramiv(object, GL_INFO_LOG_LENGTH, &length);
+                }
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                if (isShader) {
+                    glGetShaderInfoLog(object, length + 1, nullptr, buffer.data());
+                } else {
+                    glGetProgramInfoLog(object, length + 1, nullptr, buffer.data());
+                }
+                return buffer.data();
+            }
+
+            GLuint BuildCaptureProgram(const std::vector<std::pair<GLenum, std::string>>& stages,
+                                       const std::vector<const char*>& varyings) {
+                m_buildLog.clear();
+                std::vector<GLuint> shaders;
+                bool ok = true;
+                for (const auto& [stage, source] : stages) {
+                    const GLuint shader = glCreateShader(stage);
+                    const char* text = source.c_str();
+                    glShaderSource(shader, 1, &text, nullptr);
+                    glCompileShader(shader);
+                    GLint compiled = 0;
+                    glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                    shaders.push_back(shader);
+                    if (compiled == GL_FALSE) {
+                        m_buildLog = InfoLog(shader, true) + "\n--- source ---\n" + source;
+                        ok = false;
+                        break;
+                    }
+                }
+                GLuint program = 0;
+                if (ok) {
+                    program = glCreateProgram();
+                    for (const GLuint shader : shaders) {
+                        glAttachShader(program, shader);
+                    }
+                    glTransformFeedbackVaryings(program, static_cast<GLsizei>(varyings.size()), varyings.data(),
+                                                GL_INTERLEAVED_ATTRIBS);
+                    glLinkProgram(program);
+                    GLint linked = GL_FALSE;
+                    glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                    if (linked == GL_FALSE) {
+                        m_buildLog = InfoLog(program, false);
+                        glDeleteProgram(program);
+                        program = 0;
+                    }
+                }
+                for (const GLuint shader : shaders) {
+                    glDeleteShader(shader);
+                }
+                if (program != 0) m_programs.push_back(program);
+                return program;
+            }
+
+            // One capture span over a single patch. Returns the capture buffer read back as
+            // floats; `capturedFloats` is the whole buffer, poison-filled beforehand.
+            std::vector<float> RunPatchCaptureSpan(GLuint program, GLenum captureMode, std::size_t capturedFloats) {
+                const std::vector<float> poison(capturedFloats, kPoison);
+                GLuint xfbBuffer = 0;
+                glGenBuffers(1, &xfbBuffer);
+                glBindBuffer(GL_ARRAY_BUFFER, xfbBuffer);
+                glBufferData(GL_ARRAY_BUFFER, static_cast<GLsizeiptr>(capturedFloats * sizeof(float)), poison.data(),
+                             GL_STATIC_COPY);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+
+                glBindVertexArray(m_vao);
+                glUseProgram(program);
+                glEnable(GL_RASTERIZER_DISCARD);
+                glBeginTransformFeedback(captureMode);
+                glDrawArrays(GL_PATCHES, 0, 1);
+                glEndTransformFeedback();
+                glDisable(GL_RASTERIZER_DISCARD);
+
+                std::vector<float> readback(capturedFloats, kPoison);
+                glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0,
+                                   static_cast<GLsizeiptr>(capturedFloats * sizeof(float)), readback.data());
+                glUseProgram(0);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+                glDeleteBuffers(1, &xfbBuffer);
+                return readback;
+            }
+
+            static ::testing::AssertionResult ComponentIs(const std::vector<float>& data, std::size_t index,
+                                                          float expected, float epsilon = 1e-4f) {
+                if (index >= data.size()) {
+                    return ::testing::AssertionFailure() << "component " << index << " is past the capture buffer";
+                }
+                const float actual = data[index];
+                if (actual == kPoison) {
+                    return ::testing::AssertionFailure()
+                           << "component " << index << " still holds the poison value - the capture never reached "
+                           << "these bytes (expected " << expected << ")";
+                }
+                if (std::isnan(actual) || std::abs(actual - expected) > epsilon) {
+                    return ::testing::AssertionFailure()
+                           << "component " << index << " is " << actual << ", expected " << expected;
+                }
+                return ::testing::AssertionSuccess();
+            }
+
+            // Defined below the shader builders it uses. `withPointSize` is the conformance
+            // body's own should_pass_pointsize_data axis.
+            void RunPerVertexPayloadCase(bool withPointSize);
+
+            // Why the gl_PointSize cases cannot be run here, or empty when they can.
+            //
+            // gl_PointSize from a tessellation stage is a real DRIVER capability on both
+            // targets - GL_EXT/OES_tessellation_point_size on an ES driver, the
+            // shaderTessellationAndGeometryPointSize feature on a Vulkan device - and desktop GL
+            // has no query that reports either, so this probes for it by running a program.
+            //
+            // The probe is deliberately NOT a gl_PointSize capture: it captures an ordinary user
+            // varying out of a tessellation evaluation stage that ALSO writes gl_PointSize, and
+            // compares that against the identical program without the write. A backend that
+            // cannot express the built-in loses the whole stage (DirectGLES fails to compile it
+            // and binds program 0; DirectVulkan cannot build the pipeline), so the plain varying
+            // comes back untouched too - which is a capability answer, not a capture answer. If
+            // BOTH come back untouched the probe itself is meaningless and it returns empty, so
+            // the cases run and FAIL rather than skipping on an unrelated breakage.
+            //
+            // Returns the reason as a string instead of skipping directly: GTEST_SKIP expands to
+            // a `return`, so a void helper would leave only the helper and let the case run its
+            // assertions anyway and report Failed instead of Skipped.
+            std::string WhyPointSizeCasesCannotRun();
+
+            // The geometry stage's own answer, and it has to BE its own answer: the two ESSL
+            // extensions are independent (Loader models them as two PointSizeTier fields fed by
+            // four distinct strings, and neither implies the other), so a driver with
+            // tessellation point size and no geometry point size passes the probe above and
+            // still cannot run the case below. Same two-program shape, one stage over.
+            //
+            // It also replaces a guard that could never fire: GL_MAX_GEOMETRY_OUTPUT_VERTICES is
+            // a hardcoded frontend constant (256) with no capability behind it, so "does this
+            // stack have a geometry stage at all" can only be answered by trying to build one -
+            // which is what this does, exactly as IoBlockNameCollisionScenario does for the same
+            // reason.
+            std::string WhyGeometryPointSizeCaseCannotRun();
+
+            std::vector<GLuint> m_programs;
+            std::string m_buildLog;
+            GLuint m_vao = 0;
+        };
+
+        // ---------------------------------------------------------------------------------
+        // Built-ins captured BY NAME from the evaluation stage.
+        // ---------------------------------------------------------------------------------
+
+        const char* const kMinimalVertexSource = R"(#version 420 core
+void main()
+{
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        const char* const kMinimalTessControlSource = R"(#version 420 core
+layout(vertices = 1) out;
+void main()
+{
+    gl_out[gl_InvocationID].gl_Position = gl_in[0].gl_Position;
+    gl_TessLevelOuter[0] = 1.0;
+    gl_TessLevelOuter[1] = 1.0;
+    gl_TessLevelOuter[2] = 1.0;
+    gl_TessLevelInner[0] = 1.0;
+}
+)";
+
+        // Values no stale buffer would hold by accident. The two sources differ ONLY by
+        // gl_PointSize, so the pair isolates it: on a backend that lowers to ESSL the
+        // built-in is not even declared in a tessellation stage without
+        // GL_EXT_tessellation_point_size, and the whole shader then fails to compile.
+        const char* const kPositionTessEvalSource = R"(#version 420 core
+layout(triangles, equal_spacing, cw, point_mode) in;
+void main()
+{
+    gl_Position  = vec4(11.0, 12.0, 13.0, 14.0);
+}
+)";
+
+        const char* const kPositionAndPointSizeTessEvalSource = R"(#version 420 core
+layout(triangles, equal_spacing, cw, point_mode) in;
+void main()
+{
+    gl_Position  = vec4(11.0, 12.0, 13.0, 14.0);
+    gl_PointSize = 5.0;
+}
+)";
+
+        // The two probe programs. They differ by one statement; both capture `probe_value`,
+        // which has nothing to do with point size.
+        const char* const kPointSizeProbeTessEvalSource = R"(#version 420 core
+layout(triangles, equal_spacing, cw, point_mode) in;
+out float probe_value;
+void main()
+{
+    probe_value  = 42.0;
+    gl_Position  = vec4(0.0, 0.0, 0.0, 1.0);
+    gl_PointSize = 3.0;
+}
+)";
+
+        const char* const kPointSizeFreeProbeTessEvalSource = R"(#version 420 core
+layout(triangles, equal_spacing, cw, point_mode) in;
+out float probe_value;
+void main()
+{
+    probe_value = 42.0;
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        std::string TessellationXfbCaptureScenario::WhyPointSizeCasesCannotRun() {
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+            DrainErrors();
+
+            const auto probeCaptures = [&](const char* tessEvalSource) {
+                const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kMinimalVertexSource},
+                                                            {GL_TESS_CONTROL_SHADER, kMinimalTessControlSource},
+                                                            {GL_TESS_EVALUATION_SHADER, tessEvalSource},
+                                                            {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                           {"probe_value"});
+                if (program == 0) return false;
+                const std::vector<float> captured = RunPatchCaptureSpan(program, GL_POINTS, 3);
+                DrainErrors();
+                return captured[0] == 42.0f;
+            };
+
+            const bool withPointSize = probeCaptures(kPointSizeProbeTessEvalSource);
+            if (withPointSize) return {};
+            if (!probeCaptures(kPointSizeFreeProbeTessEvalSource)) {
+                // The control failed too, so nothing here is about point size.
+                return {};
+            }
+            return "this backend cannot express gl_PointSize in a tessellation stage at all - the same "
+                   "program captures an ordinary varying with the gl_PointSize write removed and captures "
+                   "nothing with it present (an ES driver without GL_EXT/OES_tessellation_point_size, or a "
+                   "Vulkan device without shaderTessellationAndGeometryPointSize)";
+        }
+
+        TEST_F(TessellationXfbCaptureScenario, CapturesGlPositionByNameFromTheEvaluationStage) {
+            if (!Ready()) GTEST_SKIP();
+            if (!BackendHostsTessellation()) {
+                GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " (" << Gl().RendererString()
+                             << ")";
+            }
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+            DrainErrors();
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kMinimalVertexSource},
+                                                        {GL_TESS_CONTROL_SHADER, kMinimalTessControlSource},
+                                                        {GL_TESS_EVALUATION_SHADER, kPositionTessEvalSource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_Position"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            // point_mode with every level at 1 emits three points, all carrying the same
+            // constant; only the first record has to be right for the mechanism to be proven.
+            const std::vector<float> captured = RunPatchCaptureSpan(program, GL_POINTS, 4 * 3);
+            EXPECT_TRUE(ComponentIs(captured, 0, 11.0f));
+            EXPECT_TRUE(ComponentIs(captured, 1, 12.0f));
+            EXPECT_TRUE(ComponentIs(captured, 2, 13.0f));
+            EXPECT_TRUE(ComponentIs(captured, 3, 14.0f));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        TEST_F(TessellationXfbCaptureScenario, CapturesGlPositionAndGlPointSizeByNameFromTheEvaluationStage) {
+            if (!Ready()) GTEST_SKIP();
+            if (!BackendHostsTessellation()) {
+                GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " (" << Gl().RendererString()
+                             << ")";
+            }
+            if (const std::string reason = WhyPointSizeCasesCannotRun(); !reason.empty()) GTEST_SKIP() << reason;
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+            DrainErrors();
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kMinimalVertexSource},
+                                                        {GL_TESS_CONTROL_SHADER, kMinimalTessControlSource},
+                                                        {GL_TESS_EVALUATION_SHADER, kPositionAndPointSizeTessEvalSource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_Position", "gl_PointSize"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            const std::vector<float> captured = RunPatchCaptureSpan(program, GL_POINTS, 5 * 3);
+            EXPECT_TRUE(ComponentIs(captured, 0, 11.0f));
+            EXPECT_TRUE(ComponentIs(captured, 1, 12.0f));
+            EXPECT_TRUE(ComponentIs(captured, 2, 13.0f));
+            EXPECT_TRUE(ComponentIs(captured, 3, 14.0f));
+            EXPECT_TRUE(ComponentIs(captured, 4, 5.0f));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // ---------------------------------------------------------------------------------
+        // The per-vertex payload the control stage hands to the evaluation stage.
+        // ---------------------------------------------------------------------------------
+
+        // The conformance body's own shapes, reduced to one patch and parameterised by the
+        // output patch size so the caller can run the real GL_MAX_PATCH_VERTICES. The
+        // `withPointSize` axis is the conformance body's own `should_pass_pointsize_data`,
+        // which it varies together with point_mode - and which decides whether the whole
+        // program even involves the per-vertex built-in that ESSL gates behind an extension.
+        std::string PayloadVertexSource(bool withPointSize) {
+            return R"(#version 420 core
+out gl_PerVertex {
+    vec4  gl_Position;
+)" + std::string(withPointSize ? "    float gl_PointSize;\n" : "") +
+                   R"(};
+void main()
+{
+}
+)";
+        }
+
+        std::string PayloadTessControlSource(int outputVertices, bool withPointSize) {
+            const std::string perVertexTail = withPointSize ? "    float gl_PointSize;\n" : "";
+            return R"(#version 420 core
+layout(vertices = )" + std::to_string(outputVertices) +
+                   R"() out;
+in gl_PerVertex {
+    vec4  gl_Position;
+)" + perVertexTail +
+                   R"(} gl_in[gl_MaxPatchVertices];
+out gl_PerVertex {
+    vec4  gl_Position;
+)" + perVertexTail +
+                   R"(} gl_out[];
+out OUT_TC
+{
+     vec2 value1;
+    ivec4 value2;
+} result[];
+void main()
+{
+)" + std::string(withPointSize
+                                        ? "    gl_out[gl_InvocationID].gl_PointSize = 1.0 / float(gl_InvocationID + 1);\n"
+                                        : "") +
+                   R"(    gl_out[gl_InvocationID].gl_Position  = vec4(float(gl_InvocationID * 4 + 0), float(gl_InvocationID * 4 + 1),
+                                                float(gl_InvocationID * 4 + 2), float(gl_InvocationID * 4 + 3));
+    result[gl_InvocationID].value1       = vec2(1.0 / float(gl_InvocationID + 1), 1.0 / float(gl_InvocationID + 2));
+    result[gl_InvocationID].value2       = ivec4(gl_InvocationID + 1, gl_InvocationID + 2,
+                                                 gl_InvocationID + 3, gl_InvocationID + 4);
+    gl_TessLevelInner[0] = 1.0;
+    gl_TessLevelInner[1] = 1.0;
+    gl_TessLevelOuter[0] = 1.0;
+    gl_TessLevelOuter[1] = 1.0;
+    gl_TessLevelOuter[2] = 1.0;
+    gl_TessLevelOuter[3] = 1.0;
+}
+)";
+        }
+
+        // Deliberately NEVER writes gl_Position, exactly as the conformance shader does not:
+        // the redeclared block is there so the evaluation stage can READ gl_in[], and an
+        // output nothing stores is what UnwrittenPositionOutputScenario pins separately.
+        std::string PayloadTessEvalSource(int inputVertices, bool withPointSize) {
+            const std::string perVertexTail = withPointSize ? "    float gl_PointSize;\n" : "";
+            return R"(#version 420 core
+layout(isolines, equal_spacing, ccw, point_mode) in;
+in gl_PerVertex {
+    vec4  gl_Position;
+)" + perVertexTail +
+                   R"(} gl_in[gl_MaxPatchVertices];
+out gl_PerVertex {
+    vec4  gl_Position;
+)" + perVertexTail +
+                   R"(};
+in OUT_TC
+{
+     vec2 value1;
+    ivec4 value2;
+} tc_data[];
+
+)" + std::string(withPointSize ? "out      float te_pointsize;\n" : "") +
+                   R"(out       vec4 te_position;
+out       vec2 te_value1;
+out flat ivec4 te_value2;
+
+void main()
+{
+)" + std::string(withPointSize ? "    te_pointsize = 0.0;\n" : "") +
+                   R"(    te_position  = vec4 (0.0);
+    te_value1    = vec2 (0.0);
+    te_value2    = ivec4(0);
+
+    for (int n = 0; n < )" + std::to_string(inputVertices) +
+                   R"(; ++n)
+    {
+)" + std::string(withPointSize ? "        te_pointsize += gl_in  [n].gl_PointSize;\n" : "") +
+                   R"(        te_position  += gl_in  [n].gl_Position;
+        te_value1    += tc_data[n].value1;
+        te_value2    += tc_data[n].value2;
+    }
+}
+)";
+        }
+
+        // The reduced conformance body. `withPointSize` selects between its two halves;
+        // everything else - one input vertex, an output patch of GL_MAX_PATCH_VERTICES, a
+        // user per-vertex block travelling beside gl_PerVertex, the capture taken off the
+        // evaluation stage - is the same on both.
+        void TessellationXfbCaptureScenario::RunPerVertexPayloadCase(bool withPointSize) {
+            if (!Ready()) GTEST_SKIP();
+            if (!BackendHostsTessellation()) {
+                GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " (" << Gl().RendererString()
+                             << ")";
+            }
+            if (withPointSize) {
+                if (const std::string reason = WhyPointSizeCasesCannotRun(); !reason.empty()) GTEST_SKIP() << reason;
+            }
+            const GLint patchVertices = MaxPatchVertices();
+            ASSERT_GE(patchVertices, 32) << "GL_MAX_PATCH_VERTICES is below the guaranteed minimum";
+
+            // One input vertex per patch, an output patch of GL_MAX_PATCH_VERTICES vertices:
+            // the control stage runs that many invocations and every one of them contributes.
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+            DrainErrors();
+
+            std::vector<const char*> varyings = {"te_position", "te_value1", "te_value2"};
+            if (withPointSize) varyings.push_back("te_pointsize");
+
+            const GLuint program =
+                BuildCaptureProgram({{GL_VERTEX_SHADER, PayloadVertexSource(withPointSize)},
+                                     {GL_TESS_CONTROL_SHADER, PayloadTessControlSource(patchVertices, withPointSize)},
+                                     {GL_TESS_EVALUATION_SHADER, PayloadTessEvalSource(patchVertices, withPointSize)},
+                                     {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                    varyings);
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            float referencePointSize = 0.0f;
+            float referencePosition[4] = {0.0f, 0.0f, 0.0f, 0.0f};
+            float referenceValue1[2] = {0.0f, 0.0f};
+            int referenceValue2[4] = {0, 0, 0, 0};
+            for (int n = 0; n < patchVertices; ++n) {
+                referencePointSize += 1.0f / static_cast<float>(n + 1);
+                for (int c = 0; c < 4; ++c) {
+                    referencePosition[c] += static_cast<float>(n * 4 + c);
+                    referenceValue2[c] += n + 1 + c;
+                }
+                referenceValue1[0] += 1.0f / static_cast<float>(n + 1);
+                referenceValue1[1] += 1.0f / static_cast<float>(n + 2);
+            }
+
+            // isolines with every level at 1 emits two points; the record stride is
+            // vec4 + vec2 + ivec4 [+ float] components.
+            const std::size_t stride = withPointSize ? 11 : 10;
+            const std::vector<float> captured = RunPatchCaptureSpan(program, GL_POINTS, stride * 4);
+            for (int c = 0; c < 4; ++c) {
+                EXPECT_TRUE(ComponentIs(captured, static_cast<std::size_t>(c), referencePosition[c], 1e-2f))
+                    << "te_position." << c << " (gl_in[].gl_Position)";
+            }
+            for (int c = 0; c < 2; ++c) {
+                EXPECT_TRUE(ComponentIs(captured, static_cast<std::size_t>(4 + c), referenceValue1[c], 1e-3f))
+                    << "te_value1." << c << " (the user per-vertex block the control stage wrote)";
+            }
+            for (int c = 0; c < 4; ++c) {
+                const std::size_t index = static_cast<std::size_t>(6 + c);
+                ASSERT_LT(index, captured.size());
+                int actual = 0;
+                std::memcpy(&actual, &captured[index], sizeof(actual));
+                EXPECT_EQ(actual, referenceValue2[c])
+                    << "te_value2." << c << " (the user per-vertex block's integer member)";
+            }
+            if (withPointSize) {
+                EXPECT_TRUE(ComponentIs(captured, 10, referencePointSize, 1e-3f))
+                    << "te_pointsize (gl_in[].gl_PointSize)";
+            }
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        TEST_F(TessellationXfbCaptureScenario, TheEvaluationStageSeesTheUserPerVertexBlockOfItsPatch) {
+            RunPerVertexPayloadCase(false);
+        }
+
+        // ---------------------------------------------------------------------------------
+        // The same built-in, one stage over.
+        // ---------------------------------------------------------------------------------
+
+        // ESSL gates gl_PointSize behind a per-stage extension in BOTH non-vertex
+        // vertex-processing stages - EXT/OES_tessellation_point_size for the two tessellation
+        // stages, EXT/OES_geometry_point_size for the geometry one - and they are separate
+        // extensions that do not imply each other, so the geometry arm is a second code path
+        // rather than the same one. Nothing else in the tree writes gl_PointSize from a geometry
+        // shader, so without this case the arm ships untested.
+        const char* const kPointSizeGeometrySource = R"(#version 420 core
+layout(points) in;
+layout(points, max_vertices = 1) out;
+out float gs_value;
+void main()
+{
+    gs_value     = 7.0;
+    gl_Position  = gl_in[0].gl_Position;
+    gl_PointSize = 4.0;
+    EmitVertex();
+}
+)";
+
+        // The control: identical but for the gl_PointSize write, so the pair answers "can this
+        // stack host a geometry stage that names the built-in" without asking anything about
+        // capture.
+        const char* const kPointSizeFreeGeometrySource = R"(#version 420 core
+layout(points) in;
+layout(points, max_vertices = 1) out;
+out float gs_value;
+void main()
+{
+    gs_value    = 7.0;
+    gl_Position = gl_in[0].gl_Position;
+    EmitVertex();
+}
+)";
+
+        std::string TessellationXfbCaptureScenario::WhyGeometryPointSizeCaseCannotRun() {
+            const auto probeCaptures = [&](const char* geometrySource) {
+                const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kMinimalVertexSource},
+                                                            {GL_GEOMETRY_SHADER, geometrySource},
+                                                            {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                           {"gs_value"});
+                if (program == 0) return false;
+                const std::vector<float> poison(1, kPoison);
+                GLuint xfbBuffer = 0;
+                glGenBuffers(1, &xfbBuffer);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+                glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, static_cast<GLsizeiptr>(sizeof(float)), poison.data(),
+                             GL_STATIC_DRAW);
+                glBindVertexArray(m_vao);
+                glUseProgram(program);
+                glEnable(GL_RASTERIZER_DISCARD);
+                glBeginTransformFeedback(GL_POINTS);
+                glDrawArrays(GL_POINTS, 0, 1);
+                glEndTransformFeedback();
+                glDisable(GL_RASTERIZER_DISCARD);
+                float captured = kPoison;
+                glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0, static_cast<GLsizeiptr>(sizeof(float)),
+                                   &captured);
+                glUseProgram(0);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+                glDeleteBuffers(1, &xfbBuffer);
+                DrainErrors();
+                return captured == 7.0f;
+            };
+
+            if (probeCaptures(kPointSizeGeometrySource)) return {};
+            if (!probeCaptures(kPointSizeFreeGeometrySource)) {
+                // The control failed too, so this stack cannot run a capturing geometry stage at
+                // all - which is not what this case is about, and is the question the dead
+                // GL_MAX_GEOMETRY_OUTPUT_VERTICES guard was trying to ask. Skipping rather than
+                // failing loses nothing: XfbRepeatedCaptureScenario pins plain geometry capture
+                // and goes red on its own if that is what actually broke.
+                return "this backend cannot capture from a geometry stage at all, with or without gl_PointSize";
+            }
+            return "this backend cannot express gl_PointSize in a geometry stage - the same program captures an "
+                   "ordinary varying with the gl_PointSize write removed and captures nothing with it present "
+                   "(an ES driver without GL_EXT/OES_geometry_point_size, which is a SEPARATE extension from the "
+                   "tessellation one, or a Vulkan device without shaderTessellationAndGeometryPointSize)";
+        }
+
+        TEST_F(TessellationXfbCaptureScenario, CapturesGlPointSizeByNameFromTheGeometryStage) {
+            if (!Ready()) GTEST_SKIP();
+            if (const std::string reason = WhyGeometryPointSizeCaseCannotRun(); !reason.empty()) {
+                GTEST_SKIP() << reason << " (" << Gl().BackendName() << ", " << Gl().RendererString() << ")";
+            }
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kMinimalVertexSource},
+                                                        {GL_GEOMETRY_SHADER, kPointSizeGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gs_value", "gl_PointSize"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            GLuint xfbBuffer = 0;
+            glGenBuffers(1, &xfbBuffer);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+            const std::vector<float> poison(2, kPoison);
+            glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, static_cast<GLsizeiptr>(poison.size() * sizeof(float)),
+                         poison.data(), GL_STATIC_DRAW);
+
+            glBindVertexArray(m_vao);
+            glUseProgram(program);
+            glEnable(GL_RASTERIZER_DISCARD);
+            glBeginTransformFeedback(GL_POINTS);
+            glDrawArrays(GL_POINTS, 0, 1);
+            glEndTransformFeedback();
+            glDisable(GL_RASTERIZER_DISCARD);
+
+            std::vector<float> captured(2, kPoison);
+            glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0,
+                               static_cast<GLsizeiptr>(captured.size() * sizeof(float)), captured.data());
+            EXPECT_TRUE(ComponentIs(captured, 0, 7.0f)) << "gs_value - an ordinary varying, which is lost too when "
+                                                           "the stage carrying it fails to compile";
+            EXPECT_TRUE(ComponentIs(captured, 1, 4.0f)) << "gl_PointSize";
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+
+            glUseProgram(0);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+            glDeleteBuffers(1, &xfbBuffer);
+        }
+
+        // ---------------------------------------------------------------------------------
+        // The conformance body's own READBACK, which is not glGetBufferSubData.
+        // ---------------------------------------------------------------------------------
+
+        // Every case above reads the capture back with glGetBufferSubData because that is the
+        // shortest path to the bytes. The conformance bodies do something else: they respecify
+        // the buffer through the GENERIC GL_TRANSFORM_FEEDBACK_BUFFER binding with glBufferData
+        // while it is simultaneously bound to indexed capture point 0, and then read it with
+        // glMapBufferRange / glUnmapBuffer - twice, once per iteration of the same case, with no
+        // fresh buffer in between. On a device the tessellation bodies stop at exactly that map
+        // call, so the sequence itself is worth pinning: none of the map path's error conditions
+        // may fire, and the mapped bytes must be the captured ones.
+        TEST_F(TessellationXfbCaptureScenario, MapsTheCaptureBufferAfterEachOfTwoPatchDraws) {
+            if (!Ready()) GTEST_SKIP();
+            if (!BackendHostsTessellation()) {
+                GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " (" << Gl().RendererString()
+                             << ")";
+            }
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+            DrainErrors();
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kMinimalVertexSource},
+                                                        {GL_TESS_CONTROL_SHADER, kMinimalTessControlSource},
+                                                        {GL_TESS_EVALUATION_SHADER, kPositionTessEvalSource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       {"gl_Position"});
+            ASSERT_NE(program, 0u) << "program failed to build: " << m_buildLog;
+
+            GLuint xfbBuffer = 0;
+            glGenBuffers(1, &xfbBuffer);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "binding the capture point";
+
+            constexpr std::size_t kFloats = 4 * 3;
+            constexpr GLsizeiptr kBytes = static_cast<GLsizeiptr>(kFloats * sizeof(float));
+            for (int iteration = 0; iteration < 2; ++iteration) {
+                // Respecified through the generic binding, exactly as the conformance body does,
+                // while the same buffer is still bound to capture point 0.
+                const std::vector<float> poison(kFloats, kPoison);
+                glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, kBytes, poison.data(), GL_STATIC_DRAW);
+                ASSERT_EQ(glGetError(), GL_NO_ERROR) << "glBufferData, iteration " << iteration;
+
+                glBindVertexArray(m_vao);
+                glUseProgram(program);
+                glEnable(GL_RASTERIZER_DISCARD);
+                glBeginTransformFeedback(GL_POINTS);
+                ASSERT_EQ(glGetError(), GL_NO_ERROR) << "glBeginTransformFeedback, iteration " << iteration;
+                glDrawArrays(GL_PATCHES, 0, 1);
+                ASSERT_EQ(glGetError(), GL_NO_ERROR) << "glDrawArrays, iteration " << iteration;
+                glEndTransformFeedback();
+                glDisable(GL_RASTERIZER_DISCARD);
+                ASSERT_EQ(glGetError(), GL_NO_ERROR) << "glEndTransformFeedback, iteration " << iteration;
+
+                const auto* mapped =
+                    static_cast<const float*>(glMapBufferRange(GL_TRANSFORM_FEEDBACK_BUFFER, 0, kBytes,
+                                                               GL_MAP_READ_BIT));
+                ASSERT_EQ(glGetError(), GL_NO_ERROR) << "glMapBufferRange, iteration " << iteration;
+                ASSERT_NE(mapped, nullptr) << "iteration " << iteration;
+                const std::vector<float> captured(mapped, mapped + kFloats);
+                EXPECT_EQ(glUnmapBuffer(GL_TRANSFORM_FEEDBACK_BUFFER), GL_TRUE) << "iteration " << iteration;
+                EXPECT_EQ(glGetError(), GL_NO_ERROR) << "glUnmapBuffer, iteration " << iteration;
+
+                EXPECT_TRUE(ComponentIs(captured, 0, 11.0f)) << "iteration " << iteration;
+                EXPECT_TRUE(ComponentIs(captured, 1, 12.0f)) << "iteration " << iteration;
+                EXPECT_TRUE(ComponentIs(captured, 2, 13.0f)) << "iteration " << iteration;
+                EXPECT_TRUE(ComponentIs(captured, 3, 14.0f)) << "iteration " << iteration;
+                glUseProgram(0);
+            }
+
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+            glDeleteBuffers(1, &xfbBuffer);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // The same patch with gl_PointSize travelling in gl_PerVertex beside gl_Position.
+        // In ESSL gl_PointSize does not EXIST in a tessellation stage unless
+        // GL_EXT_tessellation_point_size is requested, so a backend that lowers to ESSL
+        // without asking for it does not merely lose the value - the stage fails to compile
+        // and the whole program is replaced by program 0.
+        TEST_F(TessellationXfbCaptureScenario, TheEvaluationStageSeesGlPointSizeAcrossItsPatch) {
+            RunPerVertexPayloadCase(true);
+        }
+
+        // ---------------------------------------------------------------------------------
+        // The same capture through a PROGRAM PIPELINE OBJECT.
+        // ---------------------------------------------------------------------------------
+
+        // The conformance body runs each of its configurations twice: once with a monolithic
+        // program object and once with a pipeline of four separable programs, the capture
+        // declared on the separable EVALUATION program. That second shape goes through the
+        // hidden composite the pipeline object builds for the draw, and it is the only place a
+        // tessellation capture and the composite meet - so the capture list has to survive being
+        // taken from a program that is not the one bound.
+        TEST_F(TessellationXfbCaptureScenario, CapturesFromASeparableEvaluationProgramInAPipelineObject) {
+            if (!Ready()) GTEST_SKIP();
+            if (!BackendHostsTessellation()) {
+                GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " (" << Gl().RendererString()
+                             << ")";
+            }
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+            DrainErrors();
+
+            // One separable program per stage. Only the evaluation program carries the capture
+            // list, because it is the one whose outputs are captured.
+            const auto buildSeparable = [&](GLenum stage, const char* source,
+                                            const std::vector<const char*>& varyings) -> GLuint {
+                const GLuint shader = glCreateShader(stage);
+                glShaderSource(shader, 1, &source, nullptr);
+                glCompileShader(shader);
+                GLint compiled = 0;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    m_buildLog = InfoLog(shader, true);
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glProgramParameteri(program, GL_PROGRAM_SEPARABLE, GL_TRUE);
+                glAttachShader(program, shader);
+                if (!varyings.empty()) {
+                    glTransformFeedbackVaryings(program, static_cast<GLsizei>(varyings.size()), varyings.data(),
+                                                GL_INTERLEAVED_ATTRIBS);
+                }
+                glLinkProgram(program);
+                GLint linked = GL_FALSE;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                glDeleteShader(shader);
+                if (linked == GL_FALSE) {
+                    m_buildLog = InfoLog(program, false);
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                m_programs.push_back(program);
+                return program;
+            };
+
+            m_buildLog.clear();
+            const GLuint vertexProgram = buildSeparable(GL_VERTEX_SHADER, kMinimalVertexSource, {});
+            ASSERT_NE(vertexProgram, 0u) << "separable vertex program: " << m_buildLog;
+            const GLuint controlProgram = buildSeparable(GL_TESS_CONTROL_SHADER, kMinimalTessControlSource, {});
+            ASSERT_NE(controlProgram, 0u) << "separable control program: " << m_buildLog;
+            const GLuint evalProgram =
+                buildSeparable(GL_TESS_EVALUATION_SHADER, kPositionTessEvalSource, {"gl_Position"});
+            ASSERT_NE(evalProgram, 0u) << "separable evaluation program: " << m_buildLog;
+            const GLuint fragmentProgram = buildSeparable(GL_FRAGMENT_SHADER, kFragmentSource, {});
+            ASSERT_NE(fragmentProgram, 0u) << "separable fragment program: " << m_buildLog;
+
+            GLuint pipeline = 0;
+            glGenProgramPipelines(1, &pipeline);
+            glUseProgramStages(pipeline, GL_VERTEX_SHADER_BIT, vertexProgram);
+            glUseProgramStages(pipeline, GL_TESS_CONTROL_SHADER_BIT, controlProgram);
+            glUseProgramStages(pipeline, GL_TESS_EVALUATION_SHADER_BIT, evalProgram);
+            glUseProgramStages(pipeline, GL_FRAGMENT_SHADER_BIT, fragmentProgram);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "assembling the pipeline object";
+
+            constexpr std::size_t kFloats = 4 * 3;
+            const std::vector<float> poison(kFloats, kPoison);
+            GLuint xfbBuffer = 0;
+            glGenBuffers(1, &xfbBuffer);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+            glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, static_cast<GLsizeiptr>(kFloats * sizeof(float)),
+                         poison.data(), GL_STATIC_DRAW);
+
+            glBindVertexArray(m_vao);
+            glUseProgram(0);
+            glBindProgramPipeline(pipeline);
+            glEnable(GL_RASTERIZER_DISCARD);
+            glBeginTransformFeedback(GL_POINTS);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR) << "glBeginTransformFeedback on a pipeline object";
+            glDrawArrays(GL_PATCHES, 0, 1);
+            glEndTransformFeedback();
+            glDisable(GL_RASTERIZER_DISCARD);
+
+            std::vector<float> captured(kFloats, kPoison);
+            glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0,
+                               static_cast<GLsizeiptr>(kFloats * sizeof(float)), captured.data());
+            EXPECT_TRUE(ComponentIs(captured, 0, 11.0f));
+            EXPECT_TRUE(ComponentIs(captured, 1, 12.0f));
+            EXPECT_TRUE(ComponentIs(captured, 2, 13.0f));
+            EXPECT_TRUE(ComponentIs(captured, 3, 14.0f));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+
+            glBindProgramPipeline(0);
+            glDeleteProgramPipelines(1, &pipeline);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+            glDeleteBuffers(1, &xfbBuffer);
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/UnboundImageDescriptorScenario.cpp

@@ -119,6 +119,73 @@ void main() {
     imageStore(u_unbound, int(index), uvec4(7u));
     g_data[index] = index + 1u;
 }
+)";
+
+        // A plain sampler2D on a unit the test leaves alone. Two cases point at it: a unit with
+        // nothing bound at all, and a unit whose DEFAULT texture (name 0) has been given a base
+        // level and no mip chain - GL calls the second one incomplete for the initial
+        // NEAREST_MIPMAP_LINEAR filter, and both must resolve to the fallback rather than to a
+        // texture the backend then fails to back.
+        constexpr const char* kSampler2DFragmentSource = R"(#version 430 core
+uniform sampler2D u_unbound;
+uniform int u_readUnbound;
+out vec4 o_color;
+void main() {
+    vec4 color = vec4(0.0, 1.0, 0.0, 1.0);
+    if (u_readUnbound != 0) {
+        color = texture(u_unbound, vec2(0.0));
+    }
+    o_color = color;
+}
+)";
+
+        // The multisample spelling of the same thing. GL_ARB_sample_variables' own conformance
+        // cases declare a sampler2D and a sampler2DMS side by side and deliberately point the
+        // unused one at an empty unit, so whichever of the two is unused has to have a
+        // placeholder - a multisample descriptor demands a multisample view, so the 2D fallback
+        // cannot stand in for it.
+        constexpr const char* kSampler2DMSFragmentSource = R"(#version 430 core
+uniform sampler2DMS u_unbound;
+uniform int u_readUnbound;
+out vec4 o_color;
+void main() {
+    vec4 color = vec4(0.0, 1.0, 0.0, 1.0);
+    if (u_readUnbound != 0) {
+        color = texelFetch(u_unbound, ivec2(0), 0);
+    }
+    o_color = color;
+}
+)";
+
+        // The integer spellings of the same thing. These are the ones a plain RGBA8 multisample
+        // placeholder cannot serve: a multisample image can never carry MUTABLE_FORMAT, so the
+        // reinterpreting view an integer sampler would need over UNORM texels is unbuildable and
+        // the descriptor resolve used to fail, losing the draw after the placeholder had already
+        // been created.
+        constexpr const char* kUsampler2DMSFragmentSource = R"(#version 430 core
+uniform usampler2DMS u_unbound;
+uniform int u_readUnbound;
+out vec4 o_color;
+void main() {
+    vec4 color = vec4(0.0, 1.0, 0.0, 1.0);
+    if (u_readUnbound != 0) {
+        color = vec4(texelFetch(u_unbound, ivec2(0), 0));
+    }
+    o_color = color;
+}
+)";
+
+        constexpr const char* kIsampler2DMSFragmentSource = R"(#version 430 core
+uniform isampler2DMS u_unbound;
+uniform int u_readUnbound;
+out vec4 o_color;
+void main() {
+    vec4 color = vec4(0.0, 1.0, 0.0, 1.0);
+    if (u_readUnbound != 0) {
+        color = vec4(texelFetch(u_unbound, ivec2(0), 0));
+    }
+    o_color = color;
+}
 )";
 
         constexpr const char* kImage2DFragmentSource = R"(#version 430 core
@@ -369,6 +436,65 @@ void main() {
         ExpectDrawStillRuns(kImage2DFragmentSource, "image2D");
     }
 
+    // ---- sampler2D / sampler2DMS (VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER) ----------------
+
+    TEST_F(UnboundImageDescriptorScenario, ADeclaredButUnboundSampler2DDoesNotLoseTheDraw) {
+        if (!Ready() || IsSkipped()) return;
+        ExpectDrawStillRuns(kSampler2DFragmentSource, "sampler2D");
+    }
+
+    // The regression this file exists for, in its sharpest form: a sampler pointing at a texture
+    // unit whose DEFAULT texture object has an image but no mip chain.
+    //
+    // DirectVulkan resolved such a binding twice, through two different predicates that
+    // disagreed. The collect pass (CollectSampledTextures -> ResolveSampledBinding), which
+    // pre-syncs and transitions every texture the draw will sample, asked only whether the
+    // default texture was UNDEFINED - texture 0 with an image is not - and kept it. The
+    // descriptor pass (ResolveSamplerDescriptor) asked the real GL question, whether it
+    // SAMPLES AS INCOMPLETE for the filter in effect, and swapped it for the fallback. So the
+    // collect pass synced a texture no descriptor would ever hold, VkTextureManager declined it
+    // ("mipmap not complete") and returned nullptr, and SetupDraw dereferenced that nullptr -
+    // a SIGSEGV inside the draw, not a degraded picture.
+    //
+    // The GL-CTS reaches this on its own: its between-case state reset gives the default 2D
+    // texture a base level, so the FIRST case in a process survived and every later one with an
+    // unbound sampler2D died. That is the whole of the 380-record sample_variables crash family
+    // on Mali-G1-Ultra. Any application that uploads to texture 0 has the same shape.
+    TEST_F(UnboundImageDescriptorScenario, ASamplerOnAUnitWhoseDefaultTextureIsIncompleteDoesNotLoseTheDraw) {
+        if (!Ready() || IsSkipped()) return;
+
+        // Unit 0 is where the sampler's default uniform value points. Give the DEFAULT texture
+        // object bound there a FORMAT and a zero-sized level - which is what a bare
+        // glTexImage2D(..., 0, 0, ...) with no data does, and what the GL-CTS's between-case
+        // state reset issues for every texture target. That combination is the whole point:
+        //   * it is DEFINED, so IsUndefinedDefaultTexture (the collect path's old test) is false
+        //     and the texture stays in the sampled set;
+        //   * it is INCOMPLETE, so SamplesAsIncompleteTexture (the descriptor path's test) is
+        //     true and the descriptor holds the fallback instead;
+        //   * and it has no valid mip level, so the sync declines and hands back nullptr.
+        glActiveTexture(GL_TEXTURE0);
+        glBindTexture(GL_TEXTURE_2D, 0);
+        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, 0, 0, 0, GL_RGBA, GL_UNSIGNED_BYTE, nullptr);
+        ASSERT_EQ(FirstGLError(), 0u) << "defining a zero-sized level 0 on the default texture raised a GL error";
+
+        ExpectDrawStillRuns(kSampler2DFragmentSource, "sampler2D on an incomplete default texture");
+    }
+
+    TEST_F(UnboundImageDescriptorScenario, ADeclaredButUnboundSampler2DMSDoesNotLoseTheDraw) {
+        if (!Ready() || IsSkipped()) return;
+        ExpectDrawStillRuns(kSampler2DMSFragmentSource, "sampler2DMS");
+    }
+
+    TEST_F(UnboundImageDescriptorScenario, ADeclaredButUnboundUnsignedSampler2DMSDoesNotLoseTheDraw) {
+        if (!Ready() || IsSkipped()) return;
+        ExpectDrawStillRuns(kUsampler2DMSFragmentSource, "usampler2DMS");
+    }
+
+    TEST_F(UnboundImageDescriptorScenario, ADeclaredButUnboundSignedSampler2DMSDoesNotLoseTheDraw) {
+        if (!Ready() || IsSkipped()) return;
+        ExpectDrawStillRuns(kIsampler2DMSFragmentSource, "isampler2DMS");
+    }
+
     TEST_F(UnboundImageDescriptorScenario, AFormatlessWriteonlyImage2DLeftUnboundDoesNotLoseTheDispatch) {
         if (!Ready() || IsSkipped()) return;
         if (!LimitIsAtLeastOne(GL_MAX_COMPUTE_IMAGE_UNIFORMS)) {

MobileGL/MG_IntegrationTest/Scenarios/UnlocatedIoBlockScenario.cpp

@@ -0,0 +1,526 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/UnlocatedIoBlockScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - AN INTER-STAGE INTERFACE BLOCK STILL FINDS ITS OTHER END WITH ITS LOCATION
+// QUALIFIER REMOVED.
+//
+// The Mali-G1-Ultra ES driver delivers NOTHING through an interface block that carries an
+// explicit layout(location=) once a tessellation or geometry stage is in the pipeline: the
+// stages compile, the program links with an empty info log, the draw runs, and the consuming
+// stage reads zeroes. Measured with no MobileGL in the process - a bare EGL/GLES 3.2 program
+// built from the five ESSL stages MobileGL emits reproduces it, and removing the qualifier
+// from the blocks (and changing nothing else) makes the same program carry its payload. The
+// locations are not the application's in the first place: these shaders declare none, and
+// glslang's cross-stage IO resolver invents them.
+//
+// DirectGLES answers by dropping the decoration for those programs (StripIoBlockLocationsPass),
+// leaving ES to match the blocks by block name and member sequence. THAT is what this scenario
+// guards: with the strip forced on, a five-stage pipeline whose four block boundaries carry no
+// location must still deliver its payload end to end. It is the assertion the affected device
+// cannot make about itself in CI, and the one the healthy machines here CAN make - which is
+// the opposite of IoBlockNameCollisionScenario's position, where the machines that run it
+// cannot reproduce the defect at all.
+//
+// The strip is armed for this suite by MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS=1 on the ctest
+// entry, because llvmpipe carries a located block correctly and the driver POST would
+// therefore never turn the emulation on here. The SAME cases also run under the ambient
+// registrations with the emulation off, so both spellings of the interface are covered and a
+// regression in either shows up.
+//
+// Colour code, so a failure names its own cause:
+//   green  - the payload crossed all four stage boundaries, which is the pass.
+//   blue   - the clear colour: nothing was drawn at all (the program did not link, or the
+//            backend program was rejected and every draw became a no-op).
+//   red    - the pipeline ran but the plain (non-block) varying did not arrive, i.e. the
+//            failure is not about interface blocks.
+//   black  - the pipeline ran, the plain varying arrived, and the BLOCK payload came back
+//            zeroed. That is what an interface whose two ends stopped matching looks like.
+
+#include <cstdio>
+#include <cstdlib>
+#include <filesystem>
+#include <fstream>
+#include <iterator>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // NOTHING in these five stages declares a location. Every location the emitted ESSL
+        // carries is invented by the cross-stage resolver, which is exactly the shape the
+        // affected driver mishandles and exactly what the strip removes.
+        //
+        // Two members per block, of different types, because an interface that is matched by
+        // name and member sequence rather than by location has to agree on the sequence too -
+        // a repair that silently reordered or dropped a member would still light up green with
+        // one member in the block.
+        const char* const kVertexSource = R"(#version 420 core
+out VsData {
+    vec4 payload;
+    vec2 tint;
+} vs_out;
+out float vs_tcs_alive;
+void main()
+{
+    vs_out.payload = vec4(0.0, 1.0, 0.0, 1.0);
+    vs_out.tint = vec2(0.25, 0.5);
+    vs_tcs_alive = 1.0;
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        const char* const kTessControlSource = R"(#version 420 core
+layout(vertices = 1) out;
+in VsData {
+    vec4 payload;
+    vec2 tint;
+} tcs_in[];
+in float vs_tcs_alive[];
+out TcsData {
+    vec4 payload;
+    vec2 tint;
+} tcs_out[];
+out float tcs_tes_alive[];
+void main()
+{
+    tcs_out[gl_InvocationID].payload = tcs_in[gl_InvocationID].payload;
+    tcs_out[gl_InvocationID].tint = tcs_in[gl_InvocationID].tint;
+    tcs_tes_alive[gl_InvocationID] = vs_tcs_alive[gl_InvocationID];
+    gl_TessLevelOuter[0] = 1.0;
+    gl_TessLevelOuter[1] = 1.0;
+    gl_TessLevelOuter[2] = 1.0;
+    gl_TessLevelOuter[3] = 1.0;
+    gl_TessLevelInner[0] = 1.0;
+    gl_TessLevelInner[1] = 1.0;
+}
+)";
+
+        // Distinct block names, so this case is about the LOCATION and nothing else; the
+        // one-name-in-both-directions shape is the case below.
+        const char* const kDistinctTessEvalSource = R"(#version 420 core
+layout(isolines, point_mode) in;
+in TcsData {
+    vec4 payload;
+    vec2 tint;
+} tes_in[];
+in float tcs_tes_alive[];
+out TesData {
+    vec4 payload;
+    vec2 tint;
+} tes_out;
+out float tes_gs_alive;
+void main()
+{
+    tes_out.payload = tes_in[0].payload;
+    tes_out.tint = tes_in[0].tint;
+    tes_gs_alive = tcs_tes_alive[0];
+}
+)";
+
+        // The 420pack shape: ONE name for the block this stage consumes and the block it
+        // produces. Legal desktop GLSL, and the case where the two repairs have to compose -
+        // the rename gives the two blocks one spelling per producing stage, the strip takes
+        // their locations off, and the interfaces still have to meet.
+        const char* const kCollidingTessEvalSource = R"(#version 420 core
+layout(isolines, point_mode) in;
+in TcsData {
+    vec4 payload;
+    vec2 tint;
+} tes_in[];
+in float tcs_tes_alive[];
+out TcsData {
+    vec4 payload;
+    vec2 tint;
+} tes_out;
+out float tes_gs_alive;
+void main()
+{
+    tes_out.payload = tes_in[0].payload;
+    tes_out.tint = tes_in[0].tint;
+    tes_gs_alive = tcs_tes_alive[0];
+}
+)";
+
+        // One geometry source per evaluation stage, because the block it consumes is named
+        // after the block the evaluation stage produced.
+        const char* const kDistinctGeometrySource = R"(#version 420 core
+layout(points) in;
+layout(triangle_strip, max_vertices = 4) out;
+in TesData {
+    vec4 payload;
+    vec2 tint;
+} gs_in[];
+in float tes_gs_alive[];
+out GsData {
+    vec4 payload;
+    vec2 tint;
+} gs_out;
+out float gs_fs_alive;
+void EmitCorner(vec2 corner)
+{
+    gs_out.payload = gs_in[0].payload;
+    gs_out.tint = gs_in[0].tint;
+    gs_fs_alive = tes_gs_alive[0];
+    gl_Position = vec4(corner, 0.0, 1.0);
+    EmitVertex();
+}
+void main()
+{
+    EmitCorner(vec2(-1.0, -1.0));
+    EmitCorner(vec2(-1.0,  1.0));
+    EmitCorner(vec2( 1.0, -1.0));
+    EmitCorner(vec2( 1.0,  1.0));
+}
+)";
+
+        const char* const kCollidingGeometrySource = R"(#version 420 core
+layout(points) in;
+layout(triangle_strip, max_vertices = 4) out;
+in TcsData {
+    vec4 payload;
+    vec2 tint;
+} gs_in[];
+in float tes_gs_alive[];
+out GsData {
+    vec4 payload;
+    vec2 tint;
+} gs_out;
+out float gs_fs_alive;
+void EmitCorner(vec2 corner)
+{
+    gs_out.payload = gs_in[0].payload;
+    gs_out.tint = gs_in[0].tint;
+    gs_fs_alive = tes_gs_alive[0];
+    gl_Position = vec4(corner, 0.0, 1.0);
+    EmitVertex();
+}
+void main()
+{
+    EmitCorner(vec2(-1.0, -1.0));
+    EmitCorner(vec2(-1.0,  1.0));
+    EmitCorner(vec2( 1.0, -1.0));
+    EmitCorner(vec2( 1.0,  1.0));
+}
+)";
+
+        // Green ONLY when both block members arrived: a repair that kept the first member and
+        // lost the second would otherwise pass. Red when the plain varying is missing too, so
+        // "the pipeline is broken" and "the block is broken" cannot be confused.
+        const char* const kFragmentSource = R"(#version 420 core
+in GsData {
+    vec4 payload;
+    vec2 tint;
+} fs_in;
+in float gs_fs_alive;
+out vec4 fragColor;
+void main()
+{
+    if (gs_fs_alive <= 0.5) {
+        fragColor = vec4(1.0, 0.0, 0.0, 1.0);
+    } else if (abs(fs_in.tint.x - 0.25) > 0.01 || abs(fs_in.tint.y - 0.5) > 0.01) {
+        fragColor = vec4(0.0, 0.0, 0.0, 1.0);
+    } else {
+        fragColor = fs_in.payload;
+    }
+}
+)";
+
+        class UnlocatedIoBlockScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                if (!BackendHostsTessellationAndGeometry()) {
+                    GTEST_SKIP() << "no tessellation/geometry stages on " << Gl().BackendName() << " ("
+                                 << Gl().RendererString() << "); there is no five-stage pipeline to "
+                                 << "carry a block through";
+                }
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                for (const GLuint program : m_programs) {
+                    glDeleteProgram(program);
+                }
+                m_programs.clear();
+                glBindVertexArray(0);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                m_vao = 0;
+            }
+
+            // Same calibration IoBlockNameCollisionScenario uses, and for the same reason:
+            // GL_MAX_TESS_GEN_LEVEL is a real backend answer while GL_MAX_GEOMETRY_* are
+            // frontend constants, so a stack with no five-stage pipeline is recognised by
+            // trying to build one, not by asking.
+            static bool BackendHostsTessellationAndGeometry() {
+                GLint maxTessGenLevel = 0;
+                glGetIntegerv(GL_MAX_TESS_GEN_LEVEL, &maxTessGenLevel);
+                GLint maxGeometryOutputVertices = 0;
+                glGetIntegerv(GL_MAX_GEOMETRY_OUTPUT_VERTICES, &maxGeometryOutputVertices);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return maxTessGenLevel >= 1 && maxGeometryOutputVertices >= 4;
+            }
+
+            GLuint BuildPipeline(const char* tessEvalSource, const char* geometrySource) {
+                const GLenum stages[] = {GL_VERTEX_SHADER, GL_TESS_CONTROL_SHADER,
+                                         GL_TESS_EVALUATION_SHADER, GL_GEOMETRY_SHADER,
+                                         GL_FRAGMENT_SHADER};
+                const char* const sources[] = {kVertexSource, kTessControlSource, tessEvalSource,
+                                               geometrySource, kFragmentSource};
+
+                GLuint shaders[5] = {0, 0, 0, 0, 0};
+                bool ok = true;
+                for (int i = 0; i < 5; ++i) {
+                    shaders[i] = glCreateShader(stages[i]);
+                    glShaderSource(shaders[i], 1, &sources[i], nullptr);
+                    glCompileShader(shaders[i]);
+                    GLint compiled = 0;
+                    glGetShaderiv(shaders[i], GL_COMPILE_STATUS, &compiled);
+                    if (!compiled) {
+                        m_buildLog = InfoLog(shaders[i], true);
+                        ok = false;
+                        break;
+                    }
+                }
+                if (!ok) {
+                    for (const GLuint shader : shaders) {
+                        if (shader != 0) glDeleteShader(shader);
+                    }
+                    return 0;
+                }
+
+                const GLuint program = glCreateProgram();
+                for (const GLuint shader : shaders) {
+                    glAttachShader(program, shader);
+                }
+                glLinkProgram(program);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                for (const GLuint shader : shaders) {
+                    glDeleteShader(shader);
+                }
+                if (!linked) {
+                    m_buildLog = InfoLog(program, false);
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                m_programs.push_back(program);
+                return program;
+            }
+
+            // Clears to BLUE, so "the draw painted nothing" is a colour of its own rather
+            // than something that could be mistaken for a zeroed payload.
+            Rgba8 DrawAndReadCentre(GLuint program) const {
+                glViewport(0, 0, Gl().Width(), Gl().Height());
+                glClearColor(0.0f, 0.0f, 1.0f, 1.0f);
+                glClear(GL_COLOR_BUFFER_BIT);
+                glUseProgram(program);
+                glPatchParameteri(GL_PATCH_VERTICES, 1);
+                glDrawArrays(GL_PATCHES, 0, 1);
+
+                Rgba8 pixel{};
+                glReadPixels(Gl().Width() / 2, Gl().Height() / 2, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, &pixel);
+                return pixel;
+            }
+
+            static bool IsGreen(const Rgba8& pixel) {
+                return pixel.r < 64 && pixel.g > 192 && pixel.b < 64;
+            }
+
+            const std::string& BuildLog() const { return m_buildLog; }
+
+            // The library log this process is writing, or an empty path when none was
+            // configured. MOBILEGL_LOG_FILE_PATH is read at log-init, before anything this
+            // fixture can reach, so the ctest entry sets it and this only reads it back.
+            static std::filesystem::path LibraryLogPath() {
+                const char* path = std::getenv("MOBILEGL_LOG_FILE_PATH");
+                return (path != nullptr && *path != '\0') ? std::filesystem::path(path)
+                                                          : std::filesystem::path();
+            }
+
+            // How many bytes the library log already holds. Everything this fixture asserts on
+            // is searched from here forward, because the file is APPENDED to by every process
+            // in the lane and a line left behind by an earlier one would otherwise satisfy the
+            // assertion without this process having done anything at all.
+            static std::uintmax_t LibraryLogSize() {
+                std::error_code ec;
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return 0;
+                const std::uintmax_t size = std::filesystem::file_size(path, ec);
+                return ec ? 0 : size;
+            }
+
+            static std::string LibraryLogSince(std::uintmax_t offset) {
+                const std::filesystem::path path = LibraryLogPath();
+                if (path.empty()) return {};
+                std::ifstream file(path, std::ios::binary);
+                if (!file.good()) return {};
+                file.seekg(static_cast<std::streamoff>(offset));
+                return std::string((std::istreambuf_iterator<char>(file)),
+                                   std::istreambuf_iterator<char>());
+            }
+
+            static GLenum FirstGLError() {
+                const GLenum first = glGetError();
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return first;
+            }
+
+        private:
+            static std::string InfoLog(GLuint object, bool isShader) {
+                GLint length = 0;
+                if (isShader) {
+                    glGetShaderiv(object, GL_INFO_LOG_LENGTH, &length);
+                } else {
+                    glGetProgramiv(object, GL_INFO_LOG_LENGTH, &length);
+                }
+                std::vector<char> log(static_cast<std::size_t>(length > 1 ? length : 1), '\0');
+                if (isShader) {
+                    glGetShaderInfoLog(object, static_cast<GLsizei>(log.size()), nullptr, log.data());
+                } else {
+                    glGetProgramInfoLog(object, static_cast<GLsizei>(log.size()), nullptr, log.data());
+                }
+                return std::string(log.data());
+            }
+
+            GLuint m_vao = 0;
+            std::vector<GLuint> m_programs;
+            std::string m_buildLog;
+        };
+
+        TEST_F(UnlocatedIoBlockScenario, BlocksCarryTheirPayloadThroughFiveStages) {
+            if (!Ready()) return;
+
+            const GLuint program = BuildPipeline(kDistinctTessEvalSource, kDistinctGeometrySource);
+            if (program == 0) {
+                GTEST_SKIP() << "this stack cannot build a five-stage tessellation+geometry program on "
+                             << Gl().BackendName() << ", so there is no block to carry through: "
+                             << BuildLog();
+            }
+
+            const Rgba8 centre = DrawAndReadCentre(program);
+            EXPECT_EQ(FirstGLError(), 0u);
+            EXPECT_TRUE(IsGreen(centre))
+                << "a four-boundary interface-block chain did not deliver its payload: " << centre
+                << " (blue: nothing drew; red: the plain varying was lost too; black: a block "
+                   "member arrived wrong, i.e. the interface stopped matching)";
+        }
+
+        // The two repairs together. The rename is what makes the evaluation stage's two
+        // TcsData blocks one spelling per producing stage; the strip then takes the locations
+        // off the names the rename just settled. Either one alone leaves a working program on
+        // these machines, so this case is here to catch the two of them disagreeing.
+        TEST_F(UnlocatedIoBlockScenario, BlocksNamedInBothDirectionsStillMeetWithoutLocations) {
+            if (!Ready()) return;
+
+            if (BuildPipeline(kDistinctTessEvalSource, kDistinctGeometrySource) == 0) {
+                GTEST_SKIP() << "this stack cannot build a five-stage tessellation+geometry program on "
+                             << Gl().BackendName() << ", so there is no block to carry through: "
+                             << BuildLog();
+            }
+
+            const GLuint program = BuildPipeline(kCollidingTessEvalSource, kCollidingGeometrySource);
+            ASSERT_NE(program, 0u)
+                << "an interface block name reused across the two directions of one stage is legal "
+                   "desktop GLSL, but the program did not build: "
+                << BuildLog();
+
+            const Rgba8 centre = DrawAndReadCentre(program);
+            EXPECT_EQ(FirstGLError(), 0u);
+            EXPECT_TRUE(IsGreen(centre))
+                << "the renamed-and-unlocated interface chain lost its payload: " << centre;
+        }
+
+        // THE ONE CASE THAT CAN FAIL WHEN THE REPAIR SILENTLY STOPS BEING ARMED.
+        //
+        // Everything above renders green on llvmpipe whether the blocks were stripped or not -
+        // this machine carries a located block correctly - so those cases pin that the strip
+        // does no HARM and can say nothing about whether it happened. That leaves the arming
+        // itself untested, and the arming is where the cheap mistake lives: Loader.cpp maps
+        // MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS onto the capability INVERTED (forcing the
+        // emulation on means declaring located blocks UNSUPPORTED), and a one-line swap of
+        // those two arms would disable the device repair with every test here still green.
+        //
+        // So this case asserts a LIBRARY OBSERVABLE against the environment, the shape
+        // AsyncCompileScenario::ExtensionStringMatchesTheConfiguration uses: the environment
+        // says the emulation is pinned on, therefore the library must SAY it stripped
+        // something. The observable is the latched MGLOG_I DirectGLES emits the first time the
+        // pass fires (Managers.cpp); it is INFO rather than DEBUG precisely so that this
+        // assertion is possible in the builds CI runs.
+        //
+        // Two things it deliberately does NOT do: it does not read MG_Config (on Android this
+        // module links the shipping library, which exports nothing internal - the reason
+        // ViewportArrayScenario's control moved to the environment), and it does not trust the
+        // whole log file, only the bytes appended after this test started.
+        TEST_F(UnlocatedIoBlockScenario, TheEmulationIsActuallyArmedWhenTheEnvironmentPinsItOn) {
+            if (!Ready()) return;
+
+            if (AmbientQuirkFromEnvironment("MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS") != AmbientQuirk::On) {
+                GTEST_SKIP() << "this case needs the emulation pinned ON for the whole process, which "
+                                "is what the UnlocatedIoBlocks. ctest entry does with "
+                                "MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS=1; with the variable unset the "
+                                "driver POST decides, and on this machine it decides the blocks are "
+                                "fine - so there would be nothing to observe";
+            }
+            if (LibraryLogPath().empty()) {
+                GTEST_SKIP() << "MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS is pinned on but "
+                                "MOBILEGL_LOG_FILE_PATH is not set, so the library has nowhere to "
+                                "record that it stripped anything; the UnlocatedIoBlocks. ctest entry "
+                                "sets both";
+            }
+            if (Gl().BackendName() != std::string("DirectGLES")) {
+                GTEST_SKIP() << "the strip is DirectGLES's; " << Gl().BackendName()
+                             << " hands the module to the driver as SPIR-V, where Location is how "
+                                "interfaces are matched";
+            }
+
+            // Taken BEFORE the program is built, so the line this looks for can only be one
+            // this process wrote. The latch means it is emitted at the FIRST stage of the
+            // FIRST affected program, which is inside the build below.
+            const std::uintmax_t before = LibraryLogSize();
+
+            const GLuint program = BuildPipeline(kDistinctTessEvalSource, kDistinctGeometrySource);
+            if (program == 0) {
+                GTEST_SKIP() << "this stack cannot build a five-stage tessellation+geometry program on "
+                             << Gl().BackendName() << ", so nothing would arm the strip: " << BuildLog();
+            }
+            // Drawn as well as built, so a stack that defers its backend program to first use
+            // still reaches the transpile this is asserting about.
+            const Rgba8 centre = DrawAndReadCentre(program);
+            EXPECT_EQ(FirstGLError(), 0u);
+            EXPECT_TRUE(IsGreen(centre)) << "the pinned-on lane did not even render correctly: " << centre;
+
+            const std::string appended = LibraryLogSince(before);
+            EXPECT_NE(appended.find("WITHOUT their layout(location) qualifier"), std::string::npos)
+                << "MOBILEGL_ESPRYT_UNLOCATED_IO_BLOCKS is pinned ON, a five-stage program with four "
+                   "interface-block boundaries was built and drawn, and DirectGLES never reported "
+                   "stripping a single location. The emulation is not armed - check the override "
+                   "mapping in Loader.cpp (it is inverted on purpose) and the arming gate in "
+                   "Managers.cpp. Log appended by this test:\n"
+                << appended;
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/UnwrittenPositionOutputScenario.cpp

@@ -0,0 +1,276 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/UnwrittenPositionOutputScenario.cpp
+// Copyright (c) 2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - A SHADER REDECLARES gl_PerVertex AND NEVER WRITES gl_Position.
+//
+// Legal, ordinary GLSL, and until now a process kill on DirectVulkan. The chain, all of it
+// inside MobileGL's own SPIR-V plumbing:
+//
+//   1. glslang emits every DECLARED interface variable, used or not, and lists it on
+//      OpEntryPoint. So `out gl_PerVertex { vec4 gl_Position; };` with no write still produces
+//      the OpVariable, the OpMemberDecorate BuiltIn Position, and an interface slot.
+//   2. At link, ShaderCompiler::SanitizeAndOptimizeBinary runs AggressiveDCE(remove_outputs =
+//      false) - which may never delete an Output - and then RemoveUnusedInterfaceVariables,
+//      which rebuilds the interface list from the variables instructions actually reference.
+//      The OpVariable and its BuiltIn decoration SURVIVE; the interface slot is DELISTED.
+//   3. At pipeline build, ProgramFactory picks the last pre-rasterisation stage and runs two
+//      passes over it. GlToVulkanPositionFixPass finds the position target through the
+//      surviving ANNOTATION and injects a load-modify-STORE through it. When gl_Position is in
+//      the transform-feedback capture list, XfbCaptureDecoratePass::MirrorPositionForCapture
+//      also injects an access chain and a LOAD through it.
+//   4. Either injection is a static use of a variable that is no longer on the entry point's
+//      interface, which is invalid SPIR-V ("Interface variable id <N> is used by entry point
+//      'main' id <M>, but is not listed as an interface"). Mali r54 does not reject such a
+//      module - it faults inside pipeline creation and takes the process down.
+//
+// Measured on a Mali-G1-Ultra as 216 KHR-GL44/45/46.tessellation_shader.tessellation_control_
+// to_tessellation_evaluation.gl_MaxPatchVertices_Position_PointSize_* crashes; the CTS's TES
+// there is exactly the shape below. It is not tessellation-specific and not XFB-specific: a
+// vertex shader is enough, which is what these cases use.
+//
+// Every test captures a USER varying through transform feedback under GL_RASTERIZER_DISCARD.
+// Position is undefined in the first two by construction, so it is never asserted on - what is
+// asserted is that the capture came back at all, which it can only do if the driver accepted
+// the module and built a pipeline.
+
+#include <cstddef>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr std::size_t kCaptureFloats = 4;
+        constexpr GLsizeiptr kCaptureBytes = static_cast<GLsizeiptr>(kCaptureFloats * sizeof(float));
+
+        // The defect's shape: gl_PerVertex redeclared, gl_Position never assigned.
+        constexpr const char* kUnwrittenPositionVertexSource = R"(#version 430 core
+layout(location = 0) in vec4 vs_in_value;
+out gl_PerVertex {
+    vec4 gl_Position;
+};
+out vec4 vs_out_value;
+void main() {
+  vs_out_value = vs_in_value;
+}
+)";
+
+        // The control that isolates the redeclaration: identical but for the one assignment.
+        // This one keeps its interface slot through the sanitize chain, so both injections were
+        // always legal on it - it must stay working.
+        constexpr const char* kWrittenPositionVertexSource = R"(#version 430 core
+layout(location = 0) in vec4 vs_in_value;
+out gl_PerVertex {
+    vec4 gl_Position;
+};
+out vec4 vs_out_value;
+void main() {
+  gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+  vs_out_value = vs_in_value;
+}
+)";
+
+        // The second control, and the one the CTS calls data_pass_through: no gl_PerVertex
+        // redeclaration at all, so there is no Position annotation for the passes to find and
+        // nothing to delist. It was never affected and proves the crash needs the redeclaration.
+        constexpr const char* kNoPositionBlockVertexSource = R"(#version 430 core
+layout(location = 0) in vec4 vs_in_value;
+out vec4 vs_out_value;
+void main() {
+  vs_out_value = vs_in_value;
+}
+)";
+
+        GLuint CompileVertexShader(const std::string& source, std::string* log) {
+            const GLuint shader = glCreateShader(GL_VERTEX_SHADER);
+            const char* text = source.c_str();
+            glShaderSource(shader, 1, &text, nullptr);
+            glCompileShader(shader);
+            GLint status = GL_FALSE;
+            glGetShaderiv(shader, GL_COMPILE_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetShaderInfoLog(shader, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteShader(shader);
+                return 0;
+            }
+            return shader;
+        }
+
+        // `captureNames` is what goes to glTransformFeedbackVaryings. Passing gl_Position in it
+        // is what puts MirrorPositionForCapture on the path.
+        GLuint BuildCaptureProgram(const char* vertexSource, const std::vector<const char*>& captureNames,
+                                   std::string* log) {
+            const GLuint vertexShader = CompileVertexShader(vertexSource, log);
+            if (vertexShader == 0) return 0;
+            const GLuint program = glCreateProgram();
+            glAttachShader(program, vertexShader);
+            glTransformFeedbackVaryings(program, static_cast<GLsizei>(captureNames.size()), captureNames.data(),
+                                        GL_INTERLEAVED_ATTRIBS);
+            glLinkProgram(program);
+            glDeleteShader(vertexShader);
+            GLint status = GL_FALSE;
+            glGetProgramiv(program, GL_LINK_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetProgramInfoLog(program, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteProgram(program);
+                return 0;
+            }
+            return program;
+        }
+
+        class UnwrittenPositionOutputScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                glGenBuffers(1, &m_vbo);
+                glBindBuffer(GL_ARRAY_BUFFER, m_vbo);
+                const float vertex[kCaptureFloats] = {1.0f, 2.0f, 3.0f, 4.0f};
+                glBufferData(GL_ARRAY_BUFFER, kCaptureBytes, vertex, GL_STATIC_DRAW);
+                glVertexAttribPointer(0, 4, GL_FLOAT, GL_FALSE, 0, nullptr);
+                glEnableVertexAttribArray(0);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+                glBindVertexArray(0);
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glBindVertexArray(0);
+                glUseProgram(0);
+                if (m_vbo != 0) glDeleteBuffers(1, &m_vbo);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                ScenarioTest::TearDown();
+            }
+
+            // Links `vertexSource` with `captureNames`, runs one captured point, and checks that
+            // the USER varying came back. `captureStride` is how many floats one captured vertex
+            // occupies, so the user varying can be read out from behind a captured gl_Position.
+            void ExpectUserVaryingIsCaptured(const char* vertexSource, const std::vector<const char*>& captureNames,
+                                             std::size_t captureStride, std::size_t userVaryingOffset,
+                                             const char* what) {
+                std::string log;
+                const GLuint program = BuildCaptureProgram(vertexSource, captureNames, &log);
+                ASSERT_NE(program, 0u) << what << ": the capture program failed to build: " << log;
+
+                const GLsizeiptr captureBytes = static_cast<GLsizeiptr>(captureStride * sizeof(float));
+                GLuint xfbBuffer = 0;
+                glGenBuffers(1, &xfbBuffer);
+                glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, xfbBuffer);
+                // Pre-fill with a value the shader cannot produce, so "captured nothing" is
+                // distinguishable from "captured the wrong thing".
+                const std::vector<float> poison(captureStride, -1.0f);
+                glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, captureBytes, poison.data(), GL_DYNAMIC_READ);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+                ASSERT_EQ(FirstGLError(), 0u) << what << ": setting up the capture buffer raised a GL error";
+
+                glEnable(GL_RASTERIZER_DISCARD);
+                glUseProgram(program);
+                glBindVertexArray(m_vao);
+                glBeginTransformFeedback(GL_POINTS);
+                glDrawArrays(GL_POINTS, 0, 1);
+                glEndTransformFeedback();
+                glBindVertexArray(0);
+                glUseProgram(0);
+                glDisable(GL_RASTERIZER_DISCARD);
+                EXPECT_EQ(FirstGLError(), 0u) << what << ": the captured draw raised a GL error";
+
+                std::vector<float> readback(captureStride, -2.0f);
+                glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, xfbBuffer);
+                glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0, captureBytes, readback.data());
+                for (std::size_t i = 0; i < kCaptureFloats; ++i) {
+                    EXPECT_FLOAT_EQ(readback[userVaryingOffset + i], static_cast<float>(i + 1))
+                        << what << ": captured float " << i << " came back as "
+                        << readback[userVaryingOffset + i]
+                        << "; the pre-fill value means the draw never produced a vertex, which is what an "
+                           "invalid shader module looks like from out here";
+                }
+
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+                glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, 0);
+                glDeleteBuffers(1, &xfbBuffer);
+                glDeleteProgram(program);
+            }
+
+            GLuint m_vao = 0;
+            GLuint m_vbo = 0;
+        };
+
+    } // namespace
+
+    // The clip fixup's half: PositionZRemap is on for every draw, so the fixup runs on this
+    // program and used to inject a store through the delisted block.
+    TEST_F(UnwrittenPositionOutputScenario, ARedeclaredButUnwrittenPositionStillDraws) {
+        if (!Ready() || IsSkipped()) return;
+        ExpectUserVaryingIsCaptured(kUnwrittenPositionVertexSource, {"vs_out_value"}, kCaptureFloats, 0,
+                                    "redeclared, never written");
+    }
+
+    // The XFB half: capturing gl_Position adds an access chain and a LOAD through the same
+    // delisted block, which the interface rule covers exactly as it covers the store. Position
+    // itself is undefined here - only the user varying behind it is asserted.
+    TEST_F(UnwrittenPositionOutputScenario, CapturingAnUnwrittenPositionStillDraws) {
+        if (!Ready() || IsSkipped()) return;
+        // DirectVulkan only, and not because the defect was backend-specific in principle - the
+        // injection this pins lives in DirectVulkan's ProgramFactory, and DirectGLES cannot
+        // reach the case at all: capturing gl_Position BY NAME off a shader that never writes it
+        // comes back empty there, because the ESSL the transpiler emits has no such output for
+        // the capture list to name. That is a known, separate DirectGLES gap (the same one that
+        // blocks gl_Position/gl_PointSize capture in the tessellation capture segment), tracked
+        // outside this scenario; asserting it here would only re-report it.
+        if (Gl().BackendName() != "DirectVulkan") {
+            GTEST_SKIP() << "capturing an unwritten gl_Position by name is a separate, known "
+                         << "DirectGLES gap; this case pins the DirectVulkan injection";
+        }
+        ExpectUserVaryingIsCaptured(kUnwrittenPositionVertexSource, {"gl_Position", "vs_out_value"},
+                                    kCaptureFloats * 2, kCaptureFloats, "capturing an unwritten gl_Position");
+    }
+
+    // Control: the same shader with the one assignment restored. Its block is never delisted,
+    // so it exercises the path the fixup is actually for and must keep working.
+    TEST_F(UnwrittenPositionOutputScenario, AWrittenRedeclaredPositionStillDraws) {
+        if (!Ready() || IsSkipped()) return;
+        ExpectUserVaryingIsCaptured(kWrittenPositionVertexSource, {"vs_out_value"}, kCaptureFloats, 0,
+                                    "redeclared and written");
+    }
+
+    TEST_F(UnwrittenPositionOutputScenario, CapturingAWrittenPositionStillDraws) {
+        if (!Ready() || IsSkipped()) return;
+        ExpectUserVaryingIsCaptured(kWrittenPositionVertexSource, {"gl_Position", "vs_out_value"},
+                                    kCaptureFloats * 2, kCaptureFloats, "capturing a written gl_Position");
+    }
+
+    // Control: no gl_PerVertex redeclaration, so no Position annotation and nothing to delist.
+    TEST_F(UnwrittenPositionOutputScenario, AShaderWithNoPositionBlockStillDraws) {
+        if (!Ready() || IsSkipped()) return;
+        ExpectUserVaryingIsCaptured(kNoPositionBlockVertexSource, {"vs_out_value"}, kCaptureFloats, 0,
+                                    "no gl_PerVertex block");
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/ViewportArrayScenario.cpp

@@ -525,7 +525,7 @@ void main() { fragColor = vec4(float(gsIndex) * 16.0 / 255.0, 0.0, 0.0, 1.0); }
         //
         // Everything above is a claim about pixels, and a claim about pixels cannot tell an
         // emulation that works from a backend that was going to be right anyway. This case builds
-        // the SAME program in a process started with MOBILEGL_FORCE_VIEWPORT_ARRAY_EMULATION=0
+        // the SAME program in a process started with MOBILEGL_ESPRYT_FORCE_VIEWPORT_ARRAY_EMULATION=0
         // (the NoViewportArrayEmulation. ctest entry) and requires case 1's
         // result to COLLAPSE: with no routing, every geometry invocation rasterizes against
         // viewport 0's rectangle, so the last invocation paints the whole surface and every cell
@@ -551,10 +551,10 @@ void main() { fragColor = vec4(float(gsIndex) * 16.0 / 255.0, 0.0, 0.0, 1.0); }
             // entry for it, so the control still runs in every ctest run; anywhere else - the
             // ambient ctest entries, or the binary run straight from a device shell - the
             // emulation is on and this case skips.
-            if (AmbientQuirkFromEnvironment("MOBILEGL_FORCE_VIEWPORT_ARRAY_EMULATION") != AmbientQuirk::Off) {
+            if (AmbientQuirkFromEnvironment("MOBILEGL_ESPRYT_FORCE_VIEWPORT_ARRAY_EMULATION") != AmbientQuirk::Off) {
                 GTEST_SKIP() << "this is the negative control for the emulation and needs it off for the "
                                 "whole process; the NoViewportArrayEmulation. ctest entry runs it with "
-                                "MOBILEGL_FORCE_VIEWPORT_ARRAY_EMULATION=0";
+                                "MOBILEGL_ESPRYT_FORCE_VIEWPORT_ARRAY_EMULATION=0";
             }
 
             IntTarget target = MakeIntTarget(kSurfaceSide, kSurfaceSide);

MobileGL/MG_IntegrationTest/Scenarios/XfbRepeatedCaptureScenario.cpp

@@ -0,0 +1,657 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/XfbRepeatedCaptureScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - A CAPTURE MUST STILL RECORD WHEN IT IS NOT THE FIRST ONE IN THE PROCESS,
+// AND THE CAPTURE STAGE MAY BE ANY OF THE FOUR THAT CAN BE THE LAST ONE.
+//
+// The conformance suite exposed a whole family of transform feedback failures that no
+// existing scenario could reproduce, because every one of them ran ONE capture, from a
+// VERTEX stage, in a freshly initialised process. What the suite actually does is
+// different in three ways at once, and each of them turned out to matter:
+//
+//   * it runs case after case in ONE GL context, resetting state between them - and the
+//     reset is not a fresh context. Its transform feedback part
+//     (framework/opengl/gluStateReset.cpp resetStateGLCore) unbinds the generic
+//     GL_TRANSFORM_FEEDBACK_BUFFER and then clears every indexed capture point from 0 to
+//     GL_MAX_TRANSFORM_FEEDBACK_SEPARATE_ATTRIBS, which permanently raises MobileGL's
+//     touched-binding-point high-water mark. Every later capture that uses fewer points
+//     than that - i.e. every INTERLEAVED_ATTRIBS capture - then had the unused tail
+//     re-cleared on the driver immediately before glBeginTransformFeedback.
+//     ReplayDeqpStateReset below is that reset, reduced to the calls that touch capture
+//     state, so a defect that only appears from the second capture onwards is reachable
+//     here instead of only on a device.
+//
+//   * the capture stage is frequently a GEOMETRY or a TESSELLATION EVALUATION shader,
+//     never a plain vertex shader. The tree had zero coverage for either: none of the
+//     Xfb* scenarios mentioned tessellation and neither TessellationDrawModeScenario nor
+//     GeometryDrawModeScenario mentioned transform feedback.
+//
+//   * the capture program frequently has NO FRAGMENT STAGE at all, because it draws
+//     under GL_RASTERIZER_DISCARD and never rasterises anything. That is legal in
+//     desktop GL and the shape most "use transform feedback as a readback channel"
+//     tests are built on.
+//
+// Every case here asserts the captured BYTES, never just the absence of a GL error: the
+// failure this guards against writes nothing and raises nothing, so a buffer that kept
+// its poison is the only thing that distinguishes it from success.
+
+#include <cmath>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // Nothing a capture can legitimately produce, so a component that still reads it
+        // names the failure ("the capture never reached these bytes") instead of looking
+        // like an ordinary numeric mismatch.
+        constexpr int kPoison = -987654;
+
+        const char* const kPassthroughVertexSource = R"(#version 420 core
+layout(location = 0) in int vs_in_value;
+flat out int vs_out_value;
+void main()
+{
+    vs_out_value = vs_in_value;
+    gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+}
+)";
+
+        // The primitive_counter shape: one flat int per emitted vertex, several vertices
+        // per input primitive, so the capture is geometry-AMPLIFIED and the CPU-side
+        // primitive model cannot predict its length.
+        const char* const kPointAmplifyingGeometrySource = R"(#version 420 core
+layout(points) in;
+layout(points, max_vertices = 2) out;
+flat in int vs_out_value[];
+flat out int gs_out_value;
+void main()
+{
+    for (int i = 0; i < 2; ++i)
+    {
+        gs_out_value = vs_out_value[0];
+        gl_Position = gl_in[0].gl_Position;
+        EmitVertex();
+        EndPrimitive();
+    }
+}
+)";
+
+        // Adjacency input. Only a geometry stage can consume it, and CountPrimitivesForDraw
+        // used to answer 0 for every adjacency mode, which silently excluded the whole draw
+        // from the capture accounting.
+        const char* const kAdjacencyGeometrySource = R"(#version 420 core
+layout(lines_adjacency) in;
+layout(points, max_vertices = 1) out;
+flat in int vs_out_value[];
+flat out int gs_out_value;
+void main()
+{
+    gs_out_value = vs_out_value[1];
+    gl_Position = gl_in[1].gl_Position;
+    EmitVertex();
+    EndPrimitive();
+}
+)";
+
+        const char* const kTessControlSource = R"(#version 420 core
+layout(vertices = 1) out;
+flat in int vs_out_value[];
+patch out int tcs_out_value;
+void main()
+{
+    tcs_out_value = vs_out_value[0];
+    gl_TessLevelOuter[0] = 1.0;
+    gl_TessLevelOuter[1] = 1.0;
+    gl_TessLevelOuter[2] = 1.0;
+    gl_TessLevelInner[0] = 1.0;
+    gl_out[gl_InvocationID].gl_Position = gl_in[0].gl_Position;
+}
+)";
+
+        const char* const kTessEvalSource = R"(#version 420 core
+layout(triangles, equal_spacing, cw) in;
+patch in int tcs_out_value;
+flat out int tes_out_value;
+void main()
+{
+    tes_out_value = tcs_out_value;
+    gl_Position = gl_in[0].gl_Position;
+}
+)";
+
+        const char* const kFragmentSource = R"(#version 420 core
+flat in int gs_out_value;
+out vec4 fragColor;
+void main()
+{
+    fragColor = vec4(float(gs_out_value), 0.0, 0.0, 1.0);
+}
+)";
+
+        class XfbRepeatedCaptureScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                glGenBuffers(1, &m_vbo);
+                glBindBuffer(GL_ARRAY_BUFFER, m_vbo);
+                const int values[kInputVertices] = {10, 11, 12, 13};
+                glBufferData(GL_ARRAY_BUFFER, sizeof(values), values, GL_STATIC_DRAW);
+                glVertexAttribIPointer(0, 1, GL_INT, 0, nullptr);
+                glEnableVertexAttribArray(0);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+                DrainErrors();
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                for (const GLuint program : m_programs) {
+                    glDeleteProgram(program);
+                }
+                m_programs.clear();
+                glBindVertexArray(0);
+                if (m_vbo != 0) glDeleteBuffers(1, &m_vbo);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                m_vbo = 0;
+                m_vao = 0;
+                ScenarioTest::TearDown();
+            }
+
+            static constexpr int kInputVertices = 4;
+
+            static void DrainErrors() {
+                for (int i = 0; i < 16 && glGetError() != GL_NO_ERROR; ++i) {
+                }
+            }
+
+            static bool BackendHostsGeometry() {
+                GLint maxGeometryOutputVertices = 0;
+                glGetIntegerv(GL_MAX_GEOMETRY_OUTPUT_VERTICES, &maxGeometryOutputVertices);
+                DrainErrors();
+                return maxGeometryOutputVertices >= 2;
+            }
+
+            static bool BackendHostsTessellation() {
+                GLint maxTessGenLevel = 0;
+                glGetIntegerv(GL_MAX_TESS_GEN_LEVEL, &maxTessGenLevel);
+                DrainErrors();
+                return maxTessGenLevel >= 1;
+            }
+
+            // The transform-feedback-relevant half of deqp's resetStateGLCore, in its order.
+            // It runs between EVERY pair of conformance cases, and running one capture
+            // through it is the difference between "the first capture in the process" and
+            // every other one.
+            static void ReplayDeqpStateReset() {
+                glBindVertexArray(0);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+                glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, 0);
+                glDisable(GL_RASTERIZER_DISCARD);
+                glUseProgram(0);
+                GLint maxSeparateAttribs = 0;
+                glGetIntegerv(GL_MAX_TRANSFORM_FEEDBACK_SEPARATE_ATTRIBS, &maxSeparateAttribs);
+                glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, 0);
+                for (GLint index = 0; index < maxSeparateAttribs; ++index) {
+                    glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, static_cast<GLuint>(index), 0);
+                }
+                DrainErrors();
+            }
+
+            static std::string InfoLog(GLuint object, bool isShader) {
+                GLint length = 0;
+                if (isShader) {
+                    glGetShaderiv(object, GL_INFO_LOG_LENGTH, &length);
+                } else {
+                    glGetProgramiv(object, GL_INFO_LOG_LENGTH, &length);
+                }
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                if (isShader) {
+                    glGetShaderInfoLog(object, length + 1, nullptr, buffer.data());
+                } else {
+                    glGetProgramInfoLog(object, length + 1, nullptr, buffer.data());
+                }
+                return buffer.data();
+            }
+
+            GLuint BuildCaptureProgram(const std::vector<std::pair<GLenum, const char*>>& stages,
+                                       const char* varying) {
+                return BuildCaptureProgram(stages, std::vector<const char*>{varying});
+            }
+
+            // Builds a capture program out of `stages` capturing `varyings` interleaved.
+            // Returns 0 and fills m_buildLog on failure.
+            GLuint BuildCaptureProgram(const std::vector<std::pair<GLenum, const char*>>& stages,
+                                       const std::vector<const char*>& varyings) {
+                m_buildLog.clear();
+                std::vector<GLuint> shaders;
+                bool ok = true;
+                for (const auto& [stage, source] : stages) {
+                    const GLuint shader = glCreateShader(stage);
+                    glShaderSource(shader, 1, &source, nullptr);
+                    glCompileShader(shader);
+                    GLint compiled = 0;
+                    glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                    shaders.push_back(shader);
+                    if (compiled == GL_FALSE) {
+                        m_buildLog = InfoLog(shader, true);
+                        ok = false;
+                        break;
+                    }
+                }
+                GLuint program = 0;
+                if (ok) {
+                    program = glCreateProgram();
+                    for (const GLuint shader : shaders) {
+                        glAttachShader(program, shader);
+                    }
+                    glTransformFeedbackVaryings(program, static_cast<GLsizei>(varyings.size()), varyings.data(),
+                                                GL_INTERLEAVED_ATTRIBS);
+                    glLinkProgram(program);
+                    GLint linked = GL_FALSE;
+                    glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                    if (linked == GL_FALSE) {
+                        m_buildLog = InfoLog(program, false);
+                        glDeleteProgram(program);
+                        program = 0;
+                    }
+                }
+                for (const GLuint shader : shaders) {
+                    glDeleteShader(shader);
+                }
+                if (program != 0) m_programs.push_back(program);
+                return program;
+            }
+
+            // One capture span. `captureMode` is the transform feedback primitive mode,
+            // `drawMode`/`count` the draw. Returns the capture buffer's contents.
+            std::vector<int> RunCaptureSpan(GLuint program, GLenum captureMode, GLenum drawMode, GLsizei count,
+                                            std::size_t capturedInts) {
+                std::vector<int> poison(capturedInts, kPoison);
+                GLuint xfbBuffer = 0;
+                glGenBuffers(1, &xfbBuffer);
+                glBindBuffer(GL_ARRAY_BUFFER, xfbBuffer);
+                glBufferData(GL_ARRAY_BUFFER, static_cast<GLsizeiptr>(capturedInts * sizeof(int)), poison.data(),
+                             GL_STATIC_COPY);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+                // The capture point is the ONLY thing bound; the generic
+                // GL_TRANSFORM_FEEDBACK_BUFFER binding comes along for the ride, exactly as
+                // the conformance tests rely on (GL 4.6 core 6.1.1).
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+
+                glBindVertexArray(m_vao);
+                glUseProgram(program);
+                glEnable(GL_RASTERIZER_DISCARD);
+                glBeginTransformFeedback(captureMode);
+                glDrawArrays(drawMode, 0, count);
+                glEndTransformFeedback();
+                glDisable(GL_RASTERIZER_DISCARD);
+
+                std::vector<int> readback(capturedInts, kPoison);
+                glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0,
+                                   static_cast<GLsizeiptr>(capturedInts * sizeof(int)), readback.data());
+                glUseProgram(0);
+                glDeleteBuffers(1, &xfbBuffer);
+                return readback;
+            }
+
+            static ::testing::AssertionResult CapturedNothing(const std::vector<int>& data) {
+                for (std::size_t i = 0; i < data.size(); ++i) {
+                    if (data[i] != kPoison) {
+                        return ::testing::AssertionFailure() << "component " << i << " is " << data[i];
+                    }
+                }
+                return ::testing::AssertionSuccess();
+            }
+
+            static ::testing::AssertionResult CapturedIs(const std::vector<int>& data,
+                                                         const std::vector<int>& expected) {
+                if (data.size() != expected.size()) {
+                    return ::testing::AssertionFailure()
+                           << "captured " << data.size() << " value(s), expected " << expected.size();
+                }
+                for (std::size_t i = 0; i < data.size(); ++i) {
+                    if (data[i] != expected[i]) {
+                        ::testing::AssertionResult failure = ::testing::AssertionFailure();
+                        failure << "component " << i << " is " << data[i] << ", expected " << expected[i];
+                        if (data[i] == kPoison) {
+                            failure << " (the capture never reached these bytes)";
+                        }
+                        return failure;
+                    }
+                }
+                return ::testing::AssertionSuccess();
+            }
+
+            std::vector<GLuint> m_programs;
+            std::string m_buildLog;
+            GLuint m_vao = 0;
+            GLuint m_vbo = 0;
+        };
+
+        // THE REGRESSION GUARD FOR THE WHOLE FAMILY. Two geometry-stage captures in one
+        // process with the conformance suite's own state reset between them; the assertion
+        // that matters is on the SECOND one, which is the one every device run failed while
+        // whichever body happened to land first in its process passed.
+        TEST_F(XfbRepeatedCaptureScenario, ASecondGeometryCaptureAfterADeqpStateResetStillRecords) {
+            if (!Ready()) GTEST_SKIP();
+            if (!BackendHostsGeometry()) {
+                GTEST_SKIP() << "no geometry stage on " << Gl().BackendName() << " (" << Gl().RendererString() << ")";
+            }
+
+            // Two vertices emitted per input point, so the capture is amplified beyond what
+            // the CPU primitive model can predict from the draw alone.
+            const std::vector<int> expected = {10, 10, 11, 11, 12, 12, 13, 13};
+
+            for (int capture = 0; capture < 3; ++capture) {
+                // A fresh program per capture, because that is what a fresh conformance case
+                // builds - and it is what makes the driver recycle program and buffer names.
+                const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPassthroughVertexSource},
+                                                            {GL_GEOMETRY_SHADER, kPointAmplifyingGeometrySource},
+                                                            {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                           "gs_out_value");
+                ASSERT_NE(program, 0u) << "capture " << capture << " program failed to build: " << m_buildLog;
+
+                const std::vector<int> captured =
+                    RunCaptureSpan(program, GL_POINTS, GL_POINTS, kInputVertices, expected.size());
+                EXPECT_TRUE(CapturedIs(captured, expected))
+                    << "capture " << capture << " of 3 in this process"
+                    << (capture == 0 ? "" : " (every earlier one was followed by a deqp-shaped state reset)");
+                EXPECT_EQ(glGetError(), GL_NO_ERROR) << "capture " << capture;
+
+                glDeleteProgram(program);
+                m_programs.pop_back();
+                ReplayDeqpStateReset();
+                glBindVertexArray(m_vao);
+            }
+        }
+
+        // The tessellation half, which had no coverage anywhere in the tree: a capture taken
+        // from a GL_PATCHES draw, whose last vertex-processing stage is the evaluation shader
+        // and whose record count only the tessellator knows.
+        TEST_F(XfbRepeatedCaptureScenario, ACaptureFromAPatchesDrawRecords) {
+            if (!Ready()) GTEST_SKIP();
+            if (!BackendHostsTessellation()) {
+                GTEST_SKIP() << "no tessellation stages on " << Gl().BackendName() << " (" << Gl().RendererString()
+                             << ")";
+            }
+
+            // One input patch of one vertex, all levels at 1: the tessellator emits exactly
+            // one triangle, so three captured vertices all carrying the first input value.
+            glPatchParameteri(GL_PATCH_VERTICES, 1);
+            DrainErrors();
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPassthroughVertexSource},
+                                                        {GL_TESS_CONTROL_SHADER, kTessControlSource},
+                                                        {GL_TESS_EVALUATION_SHADER, kTessEvalSource}},
+                                                       "tes_out_value");
+            ASSERT_NE(program, 0u) << "patch capture program failed to build: " << m_buildLog;
+
+            const std::vector<int> expected = {10, 10, 10};
+            const std::vector<int> captured = RunCaptureSpan(program, GL_TRIANGLES, GL_PATCHES, 1, expected.size());
+            EXPECT_TRUE(CapturedIs(captured, expected));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // A capture program with NO FRAGMENT STAGE, drawn under GL_RASTERIZER_DISCARD. Legal
+        // in desktop GL, and the shape most transform-feedback-as-readback tests use; the
+        // program above only differs from it by the fragment shader, so a failure here is
+        // specifically about the missing stage.
+        TEST_F(XfbRepeatedCaptureScenario, ACaptureFromAFragmentlessProgramRecords) {
+            if (!Ready()) GTEST_SKIP();
+            if (!BackendHostsGeometry()) {
+                GTEST_SKIP() << "no geometry stage on " << Gl().BackendName() << " (" << Gl().RendererString() << ")";
+            }
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPassthroughVertexSource},
+                                                        {GL_GEOMETRY_SHADER, kPointAmplifyingGeometrySource}},
+                                                       "gs_out_value");
+            ASSERT_NE(program, 0u) << "fragmentless capture program failed to build: " << m_buildLog;
+
+            const std::vector<int> expected = {10, 10, 11, 11, 12, 12, 13, 13};
+            const std::vector<int> captured =
+                RunCaptureSpan(program, GL_POINTS, GL_POINTS, kInputVertices, expected.size());
+            EXPECT_TRUE(CapturedIs(captured, expected));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // An ADJACENCY draw feeding the capture. CountPrimitivesForDraw answered 0 for all
+        // four adjacency modes, which made the transform feedback accounting skip the draw
+        // entirely - so neither the captured-vertex counter nor the geometry-capture-draw
+        // flag moved, and anything downstream of either was working from "nothing happened".
+        TEST_F(XfbRepeatedCaptureScenario, ACaptureFromAnAdjacencyDrawRecords) {
+            if (!Ready()) GTEST_SKIP();
+            if (!BackendHostsGeometry()) {
+                GTEST_SKIP() << "no geometry stage on " << Gl().BackendName() << " (" << Gl().RendererString() << ")";
+            }
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPassthroughVertexSource},
+                                                        {GL_GEOMETRY_SHADER, kAdjacencyGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       "gs_out_value");
+            ASSERT_NE(program, 0u) << "adjacency capture program failed to build: " << m_buildLog;
+
+            // Four vertices of GL_LINES_ADJACENCY are one line primitive; the shader emits
+            // the second vertex of the four, which is the line's first real endpoint.
+            const std::vector<int> expected = {11};
+            const std::vector<int> captured =
+                RunCaptureSpan(program, GL_POINTS, GL_LINES_ADJACENCY, kInputVertices, expected.size());
+            EXPECT_TRUE(CapturedIs(captured, expected));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // An adjacency draw with NO geometry stage. GL 4.6 core table 13.1 admits
+        // GL_LINES_ADJACENCY and GL_LINE_STRIP_ADJACENCY under capture mode GL_LINES (and the
+        // triangle pair under GL_TRIANGLES): without a geometry shader the adjacent vertices
+        // are ignored and the primitive assembled is a plain line, so the combination is legal
+        // and must capture. MobileGL's active-capture primitive-mode table listed only the
+        // non-adjacency modes, so this raised GL_INVALID_OPERATION and dropped the draw
+        // entirely - the buffer kept its pre-draw bytes and the application saw an error the
+        // spec does not allow. Distinct from ACaptureFromAnAdjacencyDrawRecords above, which
+        // HAS a geometry stage and therefore bypasses that table completely.
+        TEST_F(XfbRepeatedCaptureScenario, AVertexOnlyAdjacencyCaptureRecords) {
+            if (!Ready()) GTEST_SKIP();
+
+            const GLuint program =
+                BuildCaptureProgram({{GL_VERTEX_SHADER, kPassthroughVertexSource}}, "vs_out_value");
+            ASSERT_NE(program, 0u) << "vertex-only capture program failed to build: " << m_buildLog;
+
+            // Four vertices of GL_LINES_ADJACENCY are one line whose real endpoints are the
+            // middle pair, so the capture is those two vertices in order.
+            const std::vector<int> expected = {11, 12};
+            const std::vector<int> captured =
+                RunCaptureSpan(program, GL_LINES, GL_LINES_ADJACENCY, kInputVertices, expected.size());
+
+            // THE GUARD FOR THE DEFECT ITSELF, and it is backend-independent: the frontend
+            // validator must not reject the combination. It used to record
+            // GL_INVALID_OPERATION and return before the draw was ever issued.
+            EXPECT_EQ(glGetError(), GL_NO_ERROR)
+                << "a capture-mode/draw-mode pair GL 4.6 core table 13.1 admits must raise no error";
+
+            // Whether the capture then RECORDS is a backend question, and the two answer it
+            // differently. ES 3.2 (10.1) supports the adjacency primitive types only for a
+            // pipeline with a geometry shader, so DirectGLES has nothing to forward this draw
+            // to; desktop GL and Vulkan both assemble the plain line and capture it. Asserting
+            // the data unconditionally would be asserting that DirectGLES emulates a whole ES
+            // restriction away, which is a separate piece of work and not what this guards.
+            if (Gl().BackendName() == "DirectGLES") {
+                GTEST_SKIP() << "DirectGLES cannot forward a geometry-shader-less adjacency draw: ES 3.2 10.1 "
+                                "supports the adjacency primitive types only with a geometry stage. The frontend "
+                                "no longer rejects the draw (checked above), which is the defect this covers.";
+            }
+            EXPECT_TRUE(CapturedIs(captured, expected));
+        }
+
+        // A CAPTURE MUST NEVER LAND IN A BUFFER THE APPLICATION DID NOT BIND FOR IT.
+        //
+        // A capture list may legally begin with gl_NextBuffer, which leaves capture buffer 0
+        // with stride 0 and nothing to capture - so glBeginTransformFeedback does not require a
+        // buffer at point 0 and the application binds only point 1. The driver-side program is
+        // a single-buffer interleaved capture (the pseudo-varyings are consumed at link time),
+        // so it writes capture point 0, and MobileGL redirects that into scratch storage and
+        // scatters the records afterwards.
+        //
+        // Two ways that went wrong, both fixed here: the scratch was sized by reading each
+        // target's stride at its POSITION in a list that skips unbound buffers, which for this
+        // layout read stride 0 for everything and produced a zero capacity; and when the
+        // scratch then failed to bind, the span opened anyway onto whatever capture point 0
+        // still held from an earlier capture in the process - silently overwriting an unrelated
+        // application buffer. The first span below exists purely to leave such a binding behind.
+        TEST_F(XfbRepeatedCaptureScenario, ACaptureListBeginningWithGlNextBufferSparesTheEarlierBuffer) {
+            if (!Ready()) GTEST_SKIP();
+
+            const std::size_t capturedInts = 4;
+            const GLsizeiptr captureBytes = static_cast<GLsizeiptr>(capturedInts * sizeof(int));
+
+            // Span A: an ordinary capture, so capture point 0 is left holding bufferA.
+            const GLuint programA =
+                BuildCaptureProgram({{GL_VERTEX_SHADER, kPassthroughVertexSource}}, "vs_out_value");
+            ASSERT_NE(programA, 0u) << "plain capture program failed to build: " << m_buildLog;
+
+            std::vector<int> poison(capturedInts, kPoison);
+            GLuint bufferA = 0;
+            glGenBuffers(1, &bufferA);
+            glBindBuffer(GL_ARRAY_BUFFER, bufferA);
+            glBufferData(GL_ARRAY_BUFFER, captureBytes, poison.data(), GL_STATIC_COPY);
+            glBindBuffer(GL_ARRAY_BUFFER, 0);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, bufferA);
+
+            glBindVertexArray(m_vao);
+            glUseProgram(programA);
+            glEnable(GL_RASTERIZER_DISCARD);
+            glBeginTransformFeedback(GL_POINTS);
+            glDrawArrays(GL_POINTS, 0, kInputVertices);
+            glEndTransformFeedback();
+            glDisable(GL_RASTERIZER_DISCARD);
+            glUseProgram(0);
+
+            std::vector<int> afterA(capturedInts, kPoison);
+            glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0, captureBytes, afterA.data());
+            const std::vector<int> spanAExpected = {10, 11, 12, 13};
+            ASSERT_TRUE(CapturedIs(afterA, spanAExpected)) << "the setup span itself did not capture";
+
+            // Span B: gl_NextBuffer first, so buffer 0 captures nothing and only point 1 is bound.
+            const GLuint programB = BuildCaptureProgram({{GL_VERTEX_SHADER, kPassthroughVertexSource}},
+                                                        {"gl_NextBuffer", "vs_out_value"});
+            if (programB == 0) {
+                GTEST_SKIP() << "gl_NextBuffer capture lists are not linkable on " << Gl().BackendName() << " ("
+                             << Gl().RendererString() << "): " << m_buildLog;
+            }
+
+            GLuint bufferB = 0;
+            glGenBuffers(1, &bufferB);
+            glBindBuffer(GL_ARRAY_BUFFER, bufferB);
+            glBufferData(GL_ARRAY_BUFFER, captureBytes, poison.data(), GL_STATIC_COPY);
+            glBindBuffer(GL_ARRAY_BUFFER, 0);
+            // Point 0 released, point 1 is the only destination this capture asks for.
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, 0);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 1, bufferB);
+
+            glUseProgram(programB);
+            glEnable(GL_RASTERIZER_DISCARD);
+            glBeginTransformFeedback(GL_POINTS);
+            glDrawArrays(GL_POINTS, 0, kInputVertices);
+            glEndTransformFeedback();
+            glDisable(GL_RASTERIZER_DISCARD);
+            glUseProgram(0);
+
+            // THE ASSERTION THAT MATTERS: bufferA was not a destination of this capture, so it
+            // must still read exactly what span A left in it. A failure here is the corruption.
+            std::vector<int> bufferAAfterB(capturedInts, 0);
+            glBindBuffer(GL_ARRAY_BUFFER, bufferA);
+            glGetBufferSubData(GL_ARRAY_BUFFER, 0, captureBytes, bufferAAfterB.data());
+            glBindBuffer(GL_ARRAY_BUFFER, 0);
+            EXPECT_TRUE(CapturedIs(bufferAAfterB, spanAExpected))
+                << "the gl_NextBuffer capture wrote into the buffer the PREVIOUS span had bound";
+
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+
+            // ...and, where the backend places this layout at all, the buffer it WAS asked to
+            // write gets the records. That placement is the DirectGLES scatter path, whose
+            // scratch sizing used to read each target's stride at its POSITION in a list that
+            // skips unbound capture buffers - which for a leading gl_NextBuffer read stride 0
+            // for every target and sized the scratch at zero. DirectVulkan does not implement a
+            // leading-gl_NextBuffer layout at all (it captures nothing into bufferB); that is a
+            // pre-existing gap of its own, and the assertion above - that it corrupts nothing
+            // while declining - is what matters for it.
+            const bool backendPlacesLeadingNextBuffer = Gl().BackendName() != "DirectVulkan";
+            if (backendPlacesLeadingNextBuffer) {
+                std::vector<int> bufferBAfter(capturedInts, kPoison);
+                glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0, captureBytes, bufferBAfter.data());
+                EXPECT_TRUE(CapturedIs(bufferBAfter, spanAExpected));
+            }
+
+            // Unbound and deleted BEFORE any skip: a capture point left pointing at a buffer
+            // this test deleted would follow the process into the next scenario.
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 1, 0);
+            glDeleteBuffers(1, &bufferA);
+            glDeleteBuffers(1, &bufferB);
+
+            if (!backendPlacesLeadingNextBuffer) {
+                GTEST_SKIP() << "DirectVulkan does not place a capture list beginning with gl_NextBuffer; it "
+                                "captures nothing, which the no-corruption assertion above has already covered.";
+            }
+        }
+
+        // The control for all of the above: a span that never draws must leave the capture
+        // buffer alone. Without it "the buffer kept its poison" could be read as the correct
+        // outcome of some path rather than as the bug, and the tightened early returns in
+        // StartPendingTransformFeedback have to keep this legal case legal.
+        TEST_F(XfbRepeatedCaptureScenario, ASpanThatNeverDrawsLeavesTheCaptureBufferAlone) {
+            if (!Ready()) GTEST_SKIP();
+            if (!BackendHostsGeometry()) {
+                GTEST_SKIP() << "no geometry stage on " << Gl().BackendName() << " (" << Gl().RendererString() << ")";
+            }
+
+            const GLuint program = BuildCaptureProgram({{GL_VERTEX_SHADER, kPassthroughVertexSource},
+                                                        {GL_GEOMETRY_SHADER, kPointAmplifyingGeometrySource},
+                                                        {GL_FRAGMENT_SHADER, kFragmentSource}},
+                                                       "gs_out_value");
+            ASSERT_NE(program, 0u) << "capture program failed to build: " << m_buildLog;
+
+            const std::size_t capturedInts = 8;
+            std::vector<int> poison(capturedInts, kPoison);
+            GLuint xfbBuffer = 0;
+            glGenBuffers(1, &xfbBuffer);
+            glBindBuffer(GL_ARRAY_BUFFER, xfbBuffer);
+            glBufferData(GL_ARRAY_BUFFER, static_cast<GLsizeiptr>(capturedInts * sizeof(int)), poison.data(),
+                         GL_STATIC_COPY);
+            glBindBuffer(GL_ARRAY_BUFFER, 0);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+
+            glUseProgram(program);
+            glBeginTransformFeedback(GL_POINTS);
+            glEndTransformFeedback();
+            glUseProgram(0);
+
+            std::vector<int> readback(capturedInts, 0);
+            glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0,
+                               static_cast<GLsizeiptr>(capturedInts * sizeof(int)), readback.data());
+            EXPECT_TRUE(CapturedNothing(readback));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+
+            glDeleteBuffers(1, &xfbBuffer);
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_State/GLState/BufferState/BufferObject.cpp

@@ -8,6 +8,8 @@
 
 #include "BufferObject.h"
 
+#include <Config.h>
+
 #include <atomic>
 
 namespace MobileGL::MG_State::GLState {
@@ -65,6 +67,14 @@ namespace MobileGL::MG_State::GLState {
     }
 
     void BufferObject::NotifyContentWrite(SizeT offset, SizeT size) {
+        if (size == 0) {
+            // An empty write moves the serial and nothing else, exactly as NotifySubData
+            // and NotifyFlushMappedRange do: it wrote no byte, so it must not promote an
+            // undefined store to "has content" - that would cost the next orphaning
+            // respecification a full-size upload of bytes the application never wrote.
+            ++m_changeSerial;
+            return;
+        }
         m_hasDefinedContent = true;
         if (m_resource.IsGpuResident()) {
             // The write already landed in coherent GPU memory; the backend has no separate
@@ -109,7 +119,10 @@ namespace MobileGL::MG_State::GLState {
     }
 
     void BufferObject::Respecify(SizeT size, const void* data) {
-        ReleaseMemory();
+        // The store a live mapping wrote into is about to be replaced, so landing those
+        // bytes into it would copy a whole mapped range (an adopted arena's map is the
+        // arena) into storage the next line hands back.
+        ReleaseMemory(false);
         RedefineStorage(size);
         if (data && size > 0) {
             Memcpy(m_resource.Bytes(), data, size);
@@ -126,6 +139,7 @@ namespace MobileGL::MG_State::GLState {
         // distinguishes the two cases, and it is cleared just above.
         m_storageFlags = GL_DYNAMIC_STORAGE_BIT | GL_MAP_READ_BIT | GL_MAP_WRITE_BIT;
         NotifyRespecify();
+        TryAdoptLargeStorage();
     }
 
     void BufferObject::Resize(SizeT size) {
@@ -133,7 +147,9 @@ namespace MobileGL::MG_State::GLState {
     }
 
     void BufferObject::AllocateImmutableStorage(SizeT size, const void* data, GLbitfield storageFlags) {
-        ReleaseMemory();
+        // Same as Respecify: the bytes a live mapping staged have nowhere to land, the
+        // store they belong to is being replaced.
+        ReleaseMemory(false);
         RedefineStorage(size);
         if (data) {
             Memcpy(m_resource.Bytes(), data, size);
@@ -144,6 +160,33 @@ namespace MobileGL::MG_State::GLState {
         m_isImmutableStorage = true;
         m_storageFlags = storageFlags;
         NotifyRespecify();
+        TryAdoptLargeStorage();
+    }
+
+    // Back a LARGE store with the backend's persistently+coherently mapped GPU
+    // storage the moment it is (re)defined, without waiting for the app to map it.
+    // Minecraft 26.3 streams chunk meshes into 128MB vertex arenas with plain
+    // glNamedBufferSubData - the one write API that carries no synchronization
+    // hint - and on Mali every route that hands the driver a write into a busy
+    // MUTABLE store either parks the calling thread (glBufferSubData, and
+    // glMapBufferRange even with GL_MAP_UNSYNCHRONIZED_BIT) or ghost-copies the
+    // whole destination on a driver worker (staged glCopyBufferSubData, and a
+    // range-invalidating map: ~167ms per touched arena, the recurring in-world
+    // hiccup). An adopted coherent map is the one shape with NO per-write driver
+    // call at all: every SubData lands as a plain memcpy into GPU-visible memory,
+    // and the shadow copy is dropped (a 128MB arena stops costing 128MB of RAM).
+    // Only attempted for stores the size of mesh arenas: small buffers keep the
+    // shadow model whose draw-time flush already prices them correctly.
+    void BufferObject::TryAdoptLargeStorage() {
+        constexpr SizeT kLargeBufferAdoptBytes = 16u * 1024u * 1024u;
+        if (MG_Config::Features.DisableLargeBufferAdoption) return;
+        if (m_size < kLargeBufferAdoptBytes) return;
+        if (m_resource.IsGpuResident()) return;
+        if (m_isMapped) return;
+        if (g_bufferBackendOps == nullptr || g_bufferBackendOps->AcquirePersistentMap == nullptr) return;
+        if (void* base = g_bufferBackendOps->AcquirePersistentMap(*this)) {
+            m_resource.AdoptPersistentMap(base);
+        }
     }
 
     void BufferObject::UploadData(DataPtr data, SizeT atOffset) {
@@ -160,24 +203,45 @@ namespace MobileGL::MG_State::GLState {
         m_usage = usage;
     }
 
-    void BufferObject::ReleaseMemory() {
+    void BufferObject::ReleaseMemory(Bool landStagedWrites) {
         if (!m_isMapped) return;
 
-        if (m_mappingAccess & BufferMappingAccessBit::Write) { // if we wrote to the buffer
-            // A persistent GPU-resident map wrote straight into coherent GPU memory, so
-            // there is nothing to copy back and no range to push down on unmap.
-            if (!m_resource.IsGpuResident() &&
-                !(m_mappingAccess & BufferMappingAccessBit::FlushExplicit)) { // if we didn't flush explicitly
-                if (!(m_mappingAccess & BufferMappingAccessBit::Persistent)) {
-                    Memcpy(m_resource.Bytes() + m_mappedRange.start, m_stagingData.data() + m_stagingBias,
-                           m_mappedRange.end - m_mappedRange.start);
+        if (landStagedWrites &&
+            (m_mappingAccess & BufferMappingAccessBit::Write)) { // if we wrote to the buffer
+            if (!(m_mappingAccess & BufferMappingAccessBit::FlushExplicit)) { // if we didn't flush explicitly
+                const SizeT mappedLength = m_mappedRange.end - m_mappedRange.start;
+                if (m_resource.IsGpuResident()) {
+                    // A persistent map of an adopted store wrote straight into coherent
+                    // GPU memory: nothing to copy back, no range to push down. A
+                    // NON-persistent write map is a different thing: the application
+                    // wrote a staging copy (glMapBuffer and glMapBufferRange hand one out
+                    // regardless of where the store lives), and GL requires those bytes
+                    // to be visible to every later command the moment glUnmapBuffer
+                    // returns. Residency used to come only from a coherent persistent
+                    // map, which never has a staging copy, so the copy-back was simply
+                    // skipped for a resident store; residency now also comes from a
+                    // shader storage binding (EnsureGpuResidentStorage at draw time) and
+                    // from large-store adoption (TryAdoptLargeStorage), both of which an
+                    // application then re-initialises through an ordinary map/write/unmap.
+                    // Skipping the copy-back dropped every one of those writes. Land the
+                    // staged bytes through the same route glBufferSubData takes into an
+                    // adopted store - the backend's flush op is for stores it keeps a
+                    // separate copy of and must not run here.
+                    if (!(m_mappingAccess & BufferMappingAccessBit::Persistent)) {
+                        LandBytesIntoResidentStore(m_mappedRange.start,
+                                                   {m_stagingData.data() + m_stagingBias, mappedLength});
+                    }
+                } else {
+                    if (!(m_mappingAccess & BufferMappingAccessBit::Persistent)) {
+                        Memcpy(m_resource.Bytes() + m_mappedRange.start, m_stagingData.data() + m_stagingBias,
+                               mappedLength);
+                    }
+                    NotifyFlushMappedRange(m_mappedRange, m_mappingAccess);
                 }
-                NotifyFlushMappedRange(m_mappedRange, m_mappingAccess);
             }
-
-            m_stagingData.clear();
         }
 
+        m_stagingData.clear();
         m_isMapped = false;
         m_mappingAccess = BufferMappingAccessBit::Null;
         m_mappedRange = {0, 0};
@@ -197,8 +261,21 @@ namespace MobileGL::MG_State::GLState {
         MOBILEGL_ASSERT(end <= m_mappedRange.end, "Flush range out of bounds: mappedRange.end (%zu) < end (%zu)",
                         m_mappedRange.end, end);
 
-        // FLUSH_EXPLICIT maps are never GPU-resident (only coherent maps are adopted), so
-        // the staged bytes must be copied into the shadow before the backend reads them.
+        // A FLUSH_EXPLICIT map can sit on an adopted store: the map itself never adopts
+        // (only a coherent persistent one does), but a shader storage binding or
+        // large-store adoption may have made the buffer resident before the map. The
+        // flushed bytes then take the same landing as any other CPU write into an
+        // adopted store - a persistent map already wrote them in place and only has
+        // to publish the change, a non-persistent map staged them and has to land
+        // them. The backend's flush op is for stores it keeps a separate copy of.
+        if (m_resource.IsGpuResident()) {
+            if (m_mappingAccess & BufferMappingAccessBit::Persistent) {
+                NotifyContentWrite(start, length);
+            } else {
+                LandBytesIntoResidentStore(start, {m_stagingData.data() + m_stagingBias + offset, length});
+            }
+            return;
+        }
         if (!(m_mappingAccess & BufferMappingAccessBit::Persistent)) {
             Memcpy(m_resource.Bytes() + start, m_stagingData.data() + m_stagingBias + offset, length);
         }
@@ -253,10 +330,51 @@ namespace MobileGL::MG_State::GLState {
                         "UploadSubData out of bounds: atOffset (%zu) + data.size (%zu) > m_size (%zu)", atOffset,
                         data.size, m_size);
 
+        // An adopted store's Bytes() IS the memory in-flight frames are reading, and
+        // GL orders a glBufferSubData after those already-submitted reads: the write
+        // has to take the resident landing, never a plain host write into the mapping.
+        // Shadow-backed stores need none of this: the Memcpy below touches only the
+        // shadow, and the backend's SubData op does its own ordering against in-flight
+        // work.
+        if (m_resource.IsGpuResident()) {
+            LandBytesIntoResidentStore(atOffset, data);
+            return;
+        }
+
         Memcpy(m_resource.Bytes() + atOffset, data.data, data.size);
         NotifyContentWrite(atOffset, data.size);
     }
 
+    // A backend that can land the bytes on the GPU timeline takes them here, untouched
+    // by the mapping - an in-place host write into coherent memory tore the frames
+    // still reading the old bytes (Minecraft patches LIVE chunk sections this way).
+    // The bytes are then not current in the mapping until the backend's ordered copy
+    // executes, so reads reconcile through the same gate GPU-written buffers use.
+    //
+    // Without that op the write lands in place, after retiring the GPU writes this store
+    // is known to be waiting on: a backend that defers work (DirectVulkan's frame command
+    // buffer) may still be holding a recorded-but-unsubmitted dispatch that GL orders this
+    // write AFTER, and writing the mapping now would land the bytes underneath that
+    // dispatch - its increments then execute on top of the newer data and invert the call
+    // order. That gate only knows about work that WROTE the store (MarkGpuWritten); work
+    // that merely READS it - a draw sourcing an adopted vertex arena - is not tracked here,
+    // so a backend without the op still owes the ordering against its own recorded reads.
+    // NotifyContentWrite on a resident store only bumps the serial: the backend has no
+    // separate copy to sync, so no transfer op runs.
+    void BufferObject::LandBytesIntoResidentStore(SizeT offset, DataPtr bytes) {
+        if (bytes.size > 0 && g_bufferBackendOps && g_bufferBackendOps->ResidentSubData) {
+            g_bufferBackendOps->ResidentSubData(*this, offset, bytes);
+            m_hasDefinedContent = true;
+            ++m_changeSerial;
+            m_gpuWritePending = true;
+            return;
+        }
+
+        SyncGpuWrites();
+        Memcpy(m_resource.Bytes() + offset, bytes.data, bytes.size);
+        NotifyContentWrite(offset, bytes.size);
+    }
+
     void BufferObject::FillSubData(DataPtr pattern, SizeT atOffset, SizeT size) {
         MOBILEGL_ASSERT(pattern.data != nullptr && pattern.size > 0,
                         "FillSubData requires a non-empty pattern.");
@@ -269,9 +387,29 @@ namespace MobileGL::MG_State::GLState {
                         "Cannot fill data while buffer is non-persistently mapped.");
         if (size == 0) return;
 
-        // A clear is ordered after all earlier GPU writes. Partial clears additionally need the
-        // retained shadow bytes; whole-store clears need the same synchronization before writing
-        // an adopted persistent mapping that the GPU may still be accessing.
+        // An adopted store takes the same landing as UploadSubData: the in-place write
+        // below would tear in-flight readers of the mapping. The pattern is expanded
+        // first because the landing takes the final bytes, not a repeat rule - which is
+        // why only a backend that actually takes them comes through here. Without that
+        // op the landing would memcpy the expansion into the mapping the loop below
+        // fills in place anyway, so a whole-arena clear would allocate a whole arena
+        // for nothing.
+        if (m_resource.IsGpuResident() && g_bufferBackendOps && g_bufferBackendOps->ResidentSubData) {
+            Vector<Uint8> expanded(size);
+            if (pattern.size == 1) {
+                Memset(expanded.data(), *static_cast<const Uint8*>(pattern.data), size);
+            } else {
+                for (SizeT at = 0; at < size; at += pattern.size) {
+                    Memcpy(expanded.data() + at, pattern.data, pattern.size);
+                }
+            }
+            LandBytesIntoResidentStore(atOffset, {expanded.data(), size});
+            return;
+        }
+
+        // A clear is ordered after all earlier GPU writes; partial clears additionally need
+        // the retained shadow bytes, and a resident store the backend cannot take the bytes
+        // for is written in place, which needs the same synchronization the landing does.
         SyncGpuWrites();
 
         Uint8* dst = m_resource.Bytes() + atOffset;
@@ -305,6 +443,14 @@ namespace MobileGL::MG_State::GLState {
                         size, m_size);
 
         src->SyncGpuWrites();
+        // An adopted DESTINATION takes the same landing as UploadSubData: the in-place
+        // write below would tear in-flight readers of the mapping, and pending recorded
+        // GPU writes to it must retire before the copy lands or they would execute on
+        // top of it.
+        if (m_resource.IsGpuResident()) {
+            LandBytesIntoResidentStore(dstOffset, {src->m_resource.Bytes() + srcOffset, size});
+            return;
+        }
         Memcpy(m_resource.Bytes() + dstOffset, src->m_resource.Bytes() + srcOffset, size);
         NotifyContentWrite(dstOffset, size);
     }
@@ -340,6 +486,16 @@ namespace MobileGL::MG_State::GLState {
         if (m_resource.IsGpuResident()) {
             return true;
         }
+        // Adoption releases the CPU shadow, and a live mapping may BE that shadow: a
+        // persistent map that did not itself adopt (a FLUSH_EXPLICIT one, or a read map)
+        // handed the application shadow + offset, and GL keeps that pointer valid while
+        // the buffer is drawn with - which is exactly when this runs, on the storage
+        // binding walk. Freeing it under the application is a use-after-free, so a mapped
+        // buffer keeps the shadow model until it is unmapped; the binding that follows
+        // adopts then. Same rule as TryAdoptLargeStorage.
+        if (m_isMapped) {
+            return false;
+        }
         if (m_size == 0 || g_bufferBackendOps == nullptr || g_bufferBackendOps->AcquirePersistentMap == nullptr) {
             return false;
         }
@@ -358,7 +514,20 @@ namespace MobileGL::MG_State::GLState {
         // The app is about to look at the bytes; a shader may have rewritten them since
         // the shadow was last authoritative. Also needed for a write map without an
         // invalidate bit, whose staging copy is seeded from the shadow.
-        SyncGpuWrites();
+        //
+        // One map shape looks at nothing: a non-persistent write map that discards the
+        // range it maps gets a staging copy the seeding below skips, so no reader of the
+        // store exists between here and the unmap. Reconciling an ADOPTED store would
+        // still cost the backend's full drain-and-wait (its queued landings are made
+        // visible to the CPU by finishing the pipeline), once per map, on exactly the
+        // streaming arena the adoption exists to keep cheap. The outstanding-write flag
+        // stays set, so the first read that DOES look at the bytes still pays for it.
+        const Bool discardsWhatItMaps =
+            (access & BufferMappingAccessBit::Write) && !(access & BufferMappingAccessBit::Persistent) &&
+            (access & (BufferMappingAccessBit::InvalidateRange | BufferMappingAccessBit::InvalidateBuffer));
+        if (!(m_resource.IsGpuResident() && discardsWhatItMaps)) {
+            SyncGpuWrites();
+        }
         m_isMapped = true;
         m_mappingAccess = access;
         m_mappedRange = range;

MobileGL/MG_State/GLState/BufferState/BufferObject.h

@@ -80,6 +80,19 @@ namespace MobileGL {
             void (*Respecify)(BufferObject& bufferObject) = nullptr;
             // Contents update of [offset, offset + size) from the shadow.
             void (*SubData)(BufferObject& bufferObject, SizeT offset, SizeT size) = nullptr;
+            // Contents update of an ADOPTED (GPU-resident) store. `data` holds the app's
+            // bytes, valid for the duration of the call only (a write map's staging
+            // store is freed the moment the unmap that lands it returns); the frontend
+            // has NOT touched the resident mapping. GL orders a
+            // glBufferSubData after already-submitted GPU reads of the store, and an
+            // in-place host write into the coherent mapping tears the frames still
+            // reading the old bytes (Minecraft patches LIVE chunk sections this way -
+            // the tear shows as one-frame wrong geometry/UVs during fast movement). The
+            // backend lands the bytes on the GPU timeline instead: after in-flight
+            // readers, before the next consumer. The frontend marks the buffer
+            // gpu-write-pending so reads reconcile through ReadbackFromGpu. Backends
+            // without this op keep the legacy ordered in-place host write.
+            void (*ResidentSubData)(BufferObject& bufferObject, SizeT offset, DataPtr data) = nullptr;
             // Write-map flush (glUnmapBuffer / glFlushMappedBufferRange). Carries the
             // app's real mapping flags so the backend can honour INVALIDATE_* /
             // UNSYNCHRONIZED semantics per call instead of merging them.
@@ -146,9 +159,14 @@ namespace MobileGL {
             // Adopt backend host-visible coherent GPU storage as the source of truth
             // (used for GPU-written targets like transform feedback capture, so
             // MapBuffer/GetBufferSubData read real GPU results). No-op when already
-            // resident or when the backend declines.
+            // resident, while the buffer is mapped (adoption releases the shadow a
+            // mapping may have handed the application), or when the backend declines.
             Bool EnsureGpuResidentStorage();
-            void ReleaseMemory();
+            // Unmap. A write map's staged bytes land in the store on the way out, unless
+            // the caller is about to replace that store (a respecification) and passes
+            // false - landing them there would copy a whole mapped range into storage
+            // being handed back on the next line.
+            void ReleaseMemory(Bool landStagedWrites = true);
             void FlushMemoryRange(SizeT offset, SizeT length);
 
             // Pushes the persistently-mapped write range to the backend; called by
@@ -211,6 +229,10 @@ namespace MobileGL {
             // Sizes the store for a (re)definition, renewing an adopted GPU-resident
             // mapping across it. See the definition for why the renewal is not optional.
             void RedefineStorage(SizeT size);
+            // Backend-initiated coherent adoption for mesh-arena-sized stores; see the
+            // definition for the driver behavior that makes every other write route to
+            // a busy large mutable store a frame-scale stall.
+            void TryAdoptLargeStorage();
             void NotifyRespecify();
             void NotifySubData(SizeT offset, SizeT size);
             void NotifyFlushMappedRange(Range1D range, Flags<BufferMappingAccessBit> appAccess);
@@ -219,6 +241,12 @@ namespace MobileGL {
             // so this only bumps the change serial; otherwise it dispatches a backend
             // SubData transfer to sync the backend's separate GPU copy.
             void NotifyContentWrite(SizeT offset, SizeT size);
+            // The one route CPU-sourced bytes take into an ADOPTED (GPU-resident) store:
+            // glBufferSubData, a buffer clear, a buffer copy, and the landing of a
+            // non-persistent write map at unmap / explicit flush all go through it, so
+            // the routes cannot drift apart again. Carries no mapping asserts on
+            // purpose - the unmap landing runs while the buffer is still mapped.
+            void LandBytesIntoResidentStore(SizeT offset, DataPtr bytes);
 
             static Uint64 AllocateLifetimeId();
 

MobileGL/MG_State/GLState/BufferState/BufferState.h

@@ -19,7 +19,14 @@ namespace MobileGL::MG_State::GLState {
                 BufferTarget::DrawIndirect, BufferTarget::Parameter, BufferTarget::ShaderStorage);
     constexpr const auto BufferBindPointTargets = ToArray(BufferTarget::Uniform, BufferTarget::TransformFeedback,
                                                           BufferTarget::AtomicCounter, BufferTarget::ShaderStorage);
-    constexpr SizeT BufferBindingPointCount = 36;
+    // How many indexed binding points each of BufferBindPointTargets gets. 84 is the GL 4.5 core
+    // minimum for GL_MAX_UNIFORM_BUFFER_BINDINGS (table 23.64) and this array is the capacity
+    // that limit is clamped against - at 36 the clamp in GL_Getter was degenerate (lo == hi) and
+    // no application could ever be told about, or bind to, a binding point past the 36th. The
+    // other three targets advertise their own, smaller ceilings out of
+    // GetIndexedBufferQueryPointCount, so widening this does not widen what they promise; it only
+    // costs the unused tail of three arrays.
+    constexpr SizeT BufferBindingPointCount = 84;
 
     class BufferState {
     public:

MobileGL/MG_State/GLState/Core.cpp

@@ -650,6 +650,12 @@ namespace MobileGL::MG_State {
             // a graphics program carrying a compute module, which Adreno 830 does not reject
             // from vkCreateGraphicsPipelines - it SIGSEGVs inside it.
             Bool anyStage = false;
+            // Which stages the composite ACTUALLY got a shader for. Not the same question as
+            // "which stages have a stage program bound": one program bound with
+            // GL_ALL_SHADER_BITS occupies every slot while contributing a shader to only the
+            // stages it was linked with. The transform-feedback capture stage is chosen off this,
+            // because it has to be the stage that will exist in the composite's own link.
+            Bool compositeHasStage[ProgramPipelineObject::kGraphicsStageCount] = {};
             for (SizeT stage = 0; stage < ProgramPipelineObject::kGraphicsStageCount; ++stage) {
                 const auto& stageProgram = pipeline->GetStageProgram(static_cast<ShaderStage>(stage));
                 if (!stageProgram) continue;
@@ -665,9 +671,64 @@ namespace MobileGL::MG_State {
                     if (!ref.shader || static_cast<SizeT>(ref.shader->GetShaderStage()) != stage) continue;
                     composite->AttachShaderWithPinnedLinkInput(ref);
                     anyStage = true;
+                    compositeHasStage[stage] = true;
                 }
             }
             if (!anyStage) return nullProgram;
+            // Transform feedback captures the output of the LAST vertex-processing stage
+            // (GL 4.6 core 11.1.2.1), and glTransformFeedbackVaryings is per-PROGRAM state that
+            // only the stage program carrying that stage can have been given. The composite is
+            // assembled out of the stage programs' shaders and inherits none of their
+            // GL-thread-owned state, so without this it links with an empty capture list and
+            // glBeginTransformFeedback rejects the draw with INVALID_OPERATION ("the program has
+            // no transform feedback varyings") even though glValidateProgramPipeline had passed.
+            //
+            // TWO RULES, both easy to get subtly wrong and both load-bearing:
+            //
+            // (1) THE LINKED LIST, NOT THE PENDING REQUEST. glTransformFeedbackVaryings does not
+            //     take effect until the program's next link (GL 4.6 core 7.3/11.1.2.1), and it
+            //     deliberately bumps no version - so a request written after the stage program's
+            //     last link is invisible to the composite cache's signature yet would be picked up
+            //     by the next rebuild, making the capture list depend on whether some unrelated
+            //     event happened to invalidate the cache. Worse, a name that is not an output of
+            //     the capture stage fails the composite's OWN link, and a failed composite makes
+            //     every draw through the pipeline report INVALID_OPERATION. Reading the LINKED
+            //     snapshot removes the whole class: linked state only moves at a link, and a link
+            //     is exactly what ComputeDrawProgramSignature's per-stage link version tracks, so
+            //     the existing cache key is sufficient by construction.
+            //     GetTransformFeedbackInterfaceNames() is the right accessor rather than the
+            //     resolved xfbVaryings: it is the request as that link consumed it, pseudo-varyings
+            //     (gl_NextBuffer / gl_SkipComponentsN) included, which is what re-issuing it needs.
+            //
+            // (2) THE FIRST STAGE THAT EXISTS, not the first with something to capture. This is
+            //     the rule ProgramLinkTask::ResolveTransformFeedbackVaryings applies (it breaks on
+            //     getIntermediate(stage) != nullptr), and the two MUST agree: this loop picks
+            //     WHOSE list, the link task picks WHICH stage's outputs the names resolve against.
+            //     Skipping a geometry stage that has no capture list and installing the vertex
+            //     stage's instead made them disagree, and the composite then resolved a vertex
+            //     program's names against the geometry intermediate - capturing where GL says it
+            //     must not, or failing the link and killing every draw. A capture stage with an
+            //     empty list is not a reason to look further down: it is the answer, and
+            //     glBeginTransformFeedback's INVALID_OPERATION is the correct consequence.
+            //
+            // The order is the pipeline read backwards and includes the tessellation CONTROL
+            // stage, which is a vertex-processing stage too (GL 4.6 core 11): it can only be
+            // the last one in a pipeline that has a TCS but no evaluation or geometry stage,
+            // which is why it sits after TessEval. Same four stages, same order, as
+            // ProgramLinkTask::ResolveTransformFeedbackVaryings - see rule (2).
+            for (const ShaderStage captureStage:
+                 {ShaderStage::Geometry, ShaderStage::TessEval, ShaderStage::TessControl,
+                  ShaderStage::Vertex}) {
+                if (!compositeHasStage[static_cast<SizeT>(captureStage)]) continue;
+                const auto& captureProgram = pipeline->GetStageProgram(captureStage);
+                if (!captureProgram) continue;
+                const auto& linkedNames = captureProgram->GetTransformFeedbackInterfaceNames();
+                if (!linkedNames.empty()) {
+                    composite->SetTransformFeedbackVaryings(Vector<String>(linkedNames),
+                                                            captureProgram->GetTransformFeedbackBufferMode());
+                }
+                break;
+            }
             // A pipeline with no fragment stage still rasterises, so the default fragment
             // shader is wanted here even though the separable stage programs never get one.
             composite->Link(true);
@@ -812,6 +873,22 @@ namespace MobileGL::MG_State {
             m_renderState.SetPatchVertices(vertices);
         }
 
+        void GLContext::SetPatchDefaultOuterLevel(const FloatVec4& levels) {
+            m_renderState.SetPatchDefaultOuterLevel(levels);
+        }
+
+        const FloatVec4& GLContext::GetPatchDefaultOuterLevel() const {
+            return m_renderState.GetPatchDefaultOuterLevel();
+        }
+
+        void GLContext::SetPatchDefaultInnerLevel(const FloatVec2& levels) {
+            m_renderState.SetPatchDefaultInnerLevel(levels);
+        }
+
+        const FloatVec2& GLContext::GetPatchDefaultInnerLevel() const {
+            return m_renderState.GetPatchDefaultInnerLevel();
+        }
+
         Uint GLContext::GetPatchVertices() const {
             return m_renderState.GetPatchVertices();
         }
@@ -832,6 +909,26 @@ namespace MobileGL::MG_State {
             return m_renderState.GetPolygonOffsetUnits();
         }
 
+        void GLContext::SetPolygonOffsetClamped(Float factor, Float units, Float clamp) {
+            m_renderState.SetPolygonOffsetClamped(factor, units, clamp);
+        }
+
+        Float GLContext::GetPolygonOffsetClamp() const {
+            return m_renderState.GetPolygonOffsetClamp();
+        }
+
+        void GLContext::SetClipControl(GLenum origin, GLenum depth) {
+            m_renderState.SetClipControl(origin, depth);
+        }
+
+        GLenum GLContext::GetClipOrigin() const {
+            return m_renderState.GetClipOrigin();
+        }
+
+        GLenum GLContext::GetClipDepthMode() const {
+            return m_renderState.GetClipDepthMode();
+        }
+
         void GLContext::SetCapability(CapabilityInput cap, Bool enabled) {
             m_renderState.SetCapability(cap, enabled);
         }
@@ -1009,6 +1106,14 @@ namespace MobileGL::MG_State {
             return m_renderState.GetSampleMaskValue();
         }
 
+        void GLContext::SetMinSampleShadingValue(Float value) {
+            m_renderState.SetMinSampleShadingValue(value);
+        }
+
+        Float GLContext::GetMinSampleShadingValue() const {
+            return m_renderState.GetMinSampleShadingValue();
+        }
+
         void GLContext::SetPixelStoreParam(PixelStoreParam param, Int value) {
             m_renderState.SetPixelStoreParam(param, value);
         }

MobileGL/MG_State/GLState/Core.h

@@ -213,9 +213,18 @@ namespace MobileGL {
                 Float GetPointSize() const;
                 void SetPatchVertices(Uint vertices);
                 Uint GetPatchVertices() const;
+                void SetPatchDefaultOuterLevel(const FloatVec4& levels);
+                const FloatVec4& GetPatchDefaultOuterLevel() const;
+                void SetPatchDefaultInnerLevel(const FloatVec2& levels);
+                const FloatVec2& GetPatchDefaultInnerLevel() const;
                 void SetPolygonOffset(Float factor, Float units);
+                void SetPolygonOffsetClamped(Float factor, Float units, Float clamp);
                 Float GetPolygonOffsetFactor() const;
                 Float GetPolygonOffsetUnits() const;
+                Float GetPolygonOffsetClamp() const;
+                void SetClipControl(GLenum origin, GLenum depth);
+                GLenum GetClipOrigin() const;
+                GLenum GetClipDepthMode() const;
                 void SetHint(GLenum target, GLenum mode);
                 GLenum GetHint(GLenum target) const;
                 void SetPointFadeThresholdSize(Float size);
@@ -276,6 +285,8 @@ namespace MobileGL {
                 Bool GetSampleCoverageInvert() const;
                 void SetSampleMaskValue(Uint32 mask);
                 Uint32 GetSampleMaskValue() const;
+                void SetMinSampleShadingValue(Float value);
+                Float GetMinSampleShadingValue() const;
                 void SetPixelStoreParam(PixelStoreParam param, Int value);
                 Int GetPixelStoreParam(PixelStoreParam param) const;
                 PixelStoreParameters GetPixelStoreParameters(Bool isUnpack) const;

MobileGL/MG_State/GLState/ProgramState/ProgramLinkTask.cpp

@@ -10,6 +10,7 @@
 
 #include <MG_State/GLState/ProgramState/ProgramTranslationCache.h>
 
+#include <MG_State/GLState/BufferState/BufferState.h>
 #include <MG_State/GLState/VertexArrayState/VertexArrayObject.h>
 #include <MG_Util/Async/ShaderCompilePool.h>
 #include <MG_Util/Converters/GLToStr/GLEnumConverter.h>
@@ -29,13 +30,11 @@ namespace {
     // capacity, which is also the width of the Uint32 masks backends build from it.
     static MobileGL::Int GetReflectionVertexAttribLimit(
         const MobileGL::MG_Util::ShaderTranspiler::CompileEnv& env) {
-        constexpr MobileGL::Int capacity =
-            static_cast<MobileGL::Int>(MobileGL::MG_State::GLState::VertexArrayObject::MAX_VERTEX_ATTRIBS);
-        if (!env.HasBackend()) return capacity;
-
-        const MobileGL::Int backendLimit = env.params.MaxVertexAttribs;
-        if (backendLimit <= 0) return capacity;
-        return std::min(backendLimit, capacity);
+        // One shared definition with glGetIntegerv(GL_MAX_VERTEX_ATTRIBS) and with
+        // BuildTBuiltInResource's gl_MaxVertexAttribs - the three used to carry three copies of
+        // this formula and glslang's copy was a hardcoded 64.
+        return MobileGL::MG_Util::ShaderTranspiler::ResolveMaxVertexAttribs(env.HasBackend(),
+                                                                            env.params.MaxVertexAttribs);
     }
 
     // Everything the post-link query surface ever asks a glslang::TType, flattened into a
@@ -518,7 +517,9 @@ namespace MobileGL::MG_State::GLState {
         };
     } // namespace
 
-    void ProgramLinkTask::DeferLog(String line) { diagnostics.logLines.push_back(Move(line)); }
+    void ProgramLinkTask::DeferLog(String line, const Int level) {
+        diagnostics.logLines.push_back({level, Move(line)});
+    }
 
     void ProgramLinkTask::SubmitAfter(const Vector<SharedPtr<ShaderCompileTask>>& deps) {
         // +1 for the guard this function releases itself. Without it, a dependency that
@@ -622,13 +623,21 @@ namespace MobileGL::MG_State::GLState {
         // mapper's collect callback is the last point at which a resource's qualifier still
         // says what the SHADER declared rather than what glslang assigned, so both captures
         // have to be taken from inside the link. See TMglGlslIoResolver::reserverResourceSlot.
+        // The binding-range rule (GLSL 4.30 4.4.5): its ceilings in, and the first violation the
+        // resolver finds out. Enforced at the link because mapIO's collect callback is the last
+        // point at which a resource's qualifier still says what the SHADER declared - see
+        // TMglGlslIoResolver::CheckDeclaredBindingRange.
+        String resourceBindingViolation;
         ProgramAttrib attrib{.shaders = Move(shaders),
                              .explicitVertexInLocations = in.explicitAttribLocations,
                              .explicitFragmentOutLocations = in.explicitFragDataLocation,
                              .explicitFragmentOutIndices = in.explicitFragDataIndex,
                              .explicitOpaqueUniformBindings = &artifacts.explicitOpaqueUniformBindings,
                              .storageBlocksWithoutBinding = &artifacts.storageBlocksWithoutBinding,
-                             .uniformBlocksWithoutBinding = &artifacts.uniformBlocksWithoutBinding};
+                             .uniformBlocksWithoutBinding = &artifacts.uniformBlocksWithoutBinding,
+                             .resourceBindingLimits = in.env ? ResolveResourceBindingLimits(*in.env)
+                                                             : MG_Util::ShaderTranspiler::ResourceBindingLimits{},
+                             .resourceBindingViolation = &resourceBindingViolation};
 
         MGLOG_D("ProgramObject %u: Calling ShaderCompiler::LinkProgram", in.externalIndex);
         auto result = ShaderCompiler::LinkProgram(attrib);
@@ -672,9 +681,14 @@ namespace MobileGL::MG_State::GLState {
             return;
         }
 
-        // GL_GEOMETRY_INPUT_TYPE. A draw's primitive type has to be compatible with it
-        // (GL 4.6 core 11.3.1), so it is resolved for every link, not only a capturing one.
+        // The geometry stage's link properties. GL_GEOMETRY_INPUT_TYPE is load-bearing beyond the
+        // query surface - a draw's primitive type has to be compatible with it (GL 4.6 core
+        // 11.3.1) - so this block runs for every link, not only a capturing one. The other three
+        // are pure glGetProgramiv answers that previously had no source at all.
         artifacts.gsInputPrimitive = GL_NONE;
+        artifacts.gsOutputPrimitive = GL_NONE;
+        artifacts.gsMaxVertices = 0;
+        artifacts.gsInvocations = 0;
         if (const glslang::TIntermediate* gs = artifacts.program->getIntermediate(EShLangGeometry)) {
             switch (gs->getInputPrimitive()) {
             case glslang::ElgPoints: artifacts.gsInputPrimitive = GL_POINTS; break;
@@ -684,6 +698,77 @@ namespace MobileGL::MG_State::GLState {
             case glslang::ElgTrianglesAdjacency: artifacts.gsInputPrimitive = GL_TRIANGLES_ADJACENCY; break;
             default: break;
             }
+            switch (gs->getOutputPrimitive()) {
+            case glslang::ElgPoints: artifacts.gsOutputPrimitive = GL_POINTS; break;
+            case glslang::ElgLineStrip: artifacts.gsOutputPrimitive = GL_LINE_STRIP; break;
+            case glslang::ElgTriangleStrip: artifacts.gsOutputPrimitive = GL_TRIANGLE_STRIP; break;
+            default: break;
+            }
+            // glslang leaves both at TQualifier::layoutNotSet (-1) when the shader declared no
+            // such layout, and `invocations` defaults to one per GLSL 4.60 4.4.2.2 - so clamp
+            // rather than forward, or GL_GEOMETRY_SHADER_INVOCATIONS reports the sentinel.
+            artifacts.gsMaxVertices = std::max(gs->getVertices(), 0);
+            artifacts.gsInvocations = std::max(gs->getInvocations(), 1);
+        }
+
+        // The tessellation evaluation stage's link properties, GL 4.6 core table 23.35: the
+        // primitive generator's mode, spacing, winding and point mode. (The control stage's
+        // output patch size is captured below, together with the limit check that goes with it.)
+        artifacts.tessGenMode = GL_NONE;
+        artifacts.tessGenSpacing = GL_NONE;
+        artifacts.tessGenVertexOrder = GL_NONE;
+        artifacts.tessGenPointMode = false;
+        if (const glslang::TIntermediate* tes = artifacts.program->getIntermediate(EShLangTessEvaluation)) {
+            switch (tes->getInputPrimitive()) {
+            case glslang::ElgTriangles: artifacts.tessGenMode = GL_TRIANGLES; break;
+            case glslang::ElgQuads: artifacts.tessGenMode = GL_QUADS; break;
+            case glslang::ElgIsolines: artifacts.tessGenMode = GL_ISOLINES; break;
+            default: break;
+            }
+            // GLSL 4.60 4.4.2.3: equal_spacing and ccw are the defaults, which is what an unset
+            // qualifier means here.
+            switch (tes->getVertexSpacing()) {
+            case glslang::EvsFractionalEven: artifacts.tessGenSpacing = GL_FRACTIONAL_EVEN; break;
+            case glslang::EvsFractionalOdd: artifacts.tessGenSpacing = GL_FRACTIONAL_ODD; break;
+            default: artifacts.tessGenSpacing = GL_EQUAL; break;
+            }
+            switch (tes->getVertexOrder()) {
+            case glslang::EvoCw: artifacts.tessGenVertexOrder = GL_CW; break;
+            default: artifacts.tessGenVertexOrder = GL_CCW; break;
+            }
+            artifacts.tessGenPointMode = tes->getPointMode();
+        }
+
+        // GL_TESS_CONTROL_OUTPUT_VERTICES, i.e. the `layout(vertices = N) out` the control stage
+        // declared, and the limit that goes with it.
+        //
+        // GL 4.6 core 11.2.1.1: the LINK fails when N is greater than MAX_PATCH_VERTICES. Nothing
+        // enforced it - glslang's layout handling only rejects N <= 0 (ParseHelper.cpp "must be
+        // greater than 0") and carries maxPatchVertices in TBuiltInResource purely so
+        // gl_MaxPatchVertices can expand from it, exactly the gap ValidateImageUniformLimits
+        // documents for image uniforms. Checked at LINK rather than at compile on purpose: the CTS
+        // requires the offending shader to COMPILE ("Compilation passed as allowed") and only the
+        // link to fail, and turning it into a parse error would newly break an application that
+        // compiles such a shader and never links it.
+        //
+        // The limit is the one glGetIntegerv answers (GL_Getter.cpp reads the same
+        // DynamicBackendParameters field), so the advertised number and the enforced number cannot
+        // drift apart.
+        artifacts.tcsOutputVertices = 0;
+        if (const glslang::TIntermediate* tcs = artifacts.program->getIntermediate(EShLangTessControl)) {
+            artifacts.tcsOutputVertices = static_cast<Int>(tcs->getVertices());
+            if (artifacts.tcsOutputVertices > env.params.MaxPatchVertices) {
+                artifacts.linkStatus = false;
+                // Same invariant as the compute local-size gate above: a rejected link leaves no
+                // TProgram behind for a query surface to find.
+                artifacts.program.reset();
+                artifacts.infoLog = std::format(
+                    "Tessellation control shader declares an output patch of {} vertices, more than the {} "
+                    "GL_MAX_PATCH_VERTICES allows.",
+                    artifacts.tcsOutputVertices, env.params.MaxPatchVertices);
+                DeferLog(std::format("ProgramObject {}: Link failed - {}", in.externalIndex, artifacts.infoLog));
+                return;
+            }
         }
 
         // ---- everything below this line up to GenerateSpirv() is the GL query surface ----
@@ -772,6 +857,18 @@ namespace MobileGL::MG_State::GLState {
         spirvHandoff.reflection.uniformReflection = artifacts.uniformReflection;
         spirvHandoff.reflection.blockReflection = artifacts.blockReflection;
         spirvHandoff.reflection.tProgramBlockIndexToGl = artifacts.tProgramBlockIndexToGl;
+        // The capture set is NOT part of that slice (see the handoff's own comment), and the
+        // point-size demotion needs exactly one bit out of it: whether anything asked to
+        // capture gl_PointSize. Derived here, where ResolveTransformFeedbackVaryings has
+        // just filled artifacts.xfbVaryings and before the join moves them away, because a
+        // capture stage that only READS the built-in still has to declare the carrier the
+        // capture binds to - and phase B has no other way to learn that.
+        for (const ProgramObject::XfbVarying& varying : artifacts.xfbVaryings) {
+            if (varying.name == "gl_PointSize") {
+                spirvHandoff.captureRequestsPointSize = true;
+                break;
+            }
+        }
         // Phase B pairs this with its own SpirvArtifacts to insert the completed front end.
         // A COPY, because the GL-thread join moves `artifacts` out of this node before phase B
         // runs - and with the TProgram dropped, because a memo must never hold a glslang arena.
@@ -813,6 +910,11 @@ namespace MobileGL::MG_State::GLState {
         // env snapshot ProgramSpirvTask hands the chain, so the key and the bytes can never
         // disagree.
         keyInputs.nativeFloat64 = env.ConsumesFloat64Natively();
+        // The second and third capability bits, under exactly the same rule: each arms a
+        // phase-B rewrite of the cached modules (the point-size demotion), read from the
+        // same env snapshot that phase B will consult, so key and bytes cannot disagree.
+        keyInputs.demoteTessellationPointSize = env.DemotesTessellationPointSize();
+        keyInputs.demoteGeometryPointSize = env.DemotesGeometryPointSize();
         keyInputs.stages.reserve(in.shaders.size());
         for (const LinkShaderInput& shader : in.shaders) {
             const ShaderCompileArtifacts& compiled = CompiledArtifacts(shader.compiled);
@@ -1104,6 +1206,20 @@ namespace MobileGL::MG_State::GLState {
                         in.externalIndex, uniform.name.c_str());
                 continue;
             }
+            // The gl_NumSamples stand-in InjectNumSamplesBuiltinShim declared. It is a driver
+            // uniform, not the application's: gl_NumSamples is a BUILT-IN, so a conformant
+            // implementation reports nothing for it in GL_ACTIVE_UNIFORMS, glGetActiveUniform or
+            // glGetUniformLocation, and nothing may write it through glUniform* either. Filtering
+            // it here does both, and costs it no storage: BuildGlobalUboRouting takes its offset
+            // from the SPIR-V metadata by name, not from the GL location space.
+            if (isGlobalUboMember(uniform) &&
+                uniform.name == MG_Util::ShaderTranspiler::NUM_SAMPLES_UNIFORM_NAME) {
+                artifacts.usesReservedNumSamples = true;
+                MGLOG_D("ProgramObject %u: Reflection - reserved gl_NumSamples stand-in '%s' hidden from the GL "
+                        "uniform surface",
+                        in.externalIndex, uniform.name.c_str());
+                continue;
+            }
             if (isBufferVariable(uniform)) {
                 MGLOG_D("ProgramObject %u: Reflection - buffer variable '%s' filtered from the GL uniform "
                         "surface",
@@ -1595,6 +1711,25 @@ namespace MobileGL::MG_State::GLState {
                 artifacts.uniformBlocksWithoutBinding.contains(blockTypeName) ? 0 : ubo.getBinding();
             artifacts.uniformBlockBinding[i] =
                 declaredBinding < 0 ? declaredBinding : declaredBinding + BlockArrayElement(ubo.name);
+            // The second way a binding reaches the state layer's indexed-binding array, and the
+            // one glUniformBlockBinding's new bound cannot see. glslang does not range-check a
+            // uniform block's layout(binding = N) against anything - TBuiltInResource has no
+            // maxUniformBufferBindings field at all, and ParseHelper bounds only samplers and
+            // atomic counters - so `layout(binding = 5000) uniform Blk {...}` compiled and linked
+            // clean and then had both backends subscript the array at 5000 on the first draw.
+            // Stated against the same ceiling glGetIntegerv(GL_MAX_UNIFORM_BUFFER_BINDINGS)
+            // advertises; an instance array whose LAST element passes it is a link error even
+            // though its base fits, same rule as the explicit-location check above.
+            if (artifacts.uniformBlockBinding[i] >=
+                static_cast<Int>(MG_State::GLState::BufferBindingPointCount)) {
+                artifacts.infoLog =
+                    std::format("Uniform block '{}' declares binding {}, which is not less than "
+                                "GL_MAX_UNIFORM_BUFFER_BINDINGS ({}).",
+                                ubo.name, artifacts.uniformBlockBinding[i],
+                                static_cast<Int>(MG_State::GLState::BufferBindingPointCount));
+                ProgramObject::ResetLinkArtifacts(artifacts);
+                return false;
+            }
             MGLOG_D("ProgramObject %u: Reflection - UBO[%d] name='%s' size=%u binding=%d", in.externalIndex, i,
                     ubo.name.c_str(), ubo.size, ubo.getBinding());
         }
@@ -1740,7 +1875,13 @@ namespace MobileGL::MG_State::GLState {
         // them to the draw-buffer range fails the link of every such program.
         if (artifacts.program->getIntermediate(EShLangFragment) == nullptr) return true;
 
-        UnorderedMap<Int, String> colorNumberOwners;
+        // Keyed on (colour number, COLOUR INDEX), not on the colour number alone. Two fragment
+        // outputs may share a location as long as their index differs - that pair IS dual-source
+        // blending (GL 4.6 core 11.1.3 / ARB_blend_func_extended, core since 3.3), spelled either
+        // `layout(location = 0, index = 0)` + `layout(location = 0, index = 1)` in the shader or
+        // through two glBindFragDataLocationIndexed calls. Aliasing on the number alone made every
+        // such program fail to link with "alias color number 0", which is the whole feature.
+        UnorderedMap<Int64, String> colorSlotOwners;
         const Int outputCount = artifacts.program->getNumPipeOutputs();
         for (Int index = 0; index < outputCount; ++index) {
             const auto& output = artifacts.program->getPipeOutput(index);
@@ -1753,6 +1894,46 @@ namespace MobileGL::MG_State::GLState {
             const Int location = explicitLocation != in.explicitFragDataLocation.end()
                                      ? static_cast<Int>(explicitLocation->second)
                                      : static_cast<Int>(output.layoutLocation());
+            // The colour INDEX, under the one precedence rule the whole codebase uses: a NON-ZERO
+            // glBindFragDataLocationIndexed index wins, and a zero (or absent) one falls back to
+            // the shader's own layout(index = N).
+            //
+            // Zero has to mean "no override" rather than "index 0", because glBindFragDataLocation
+            // IS glBindFragDataLocationIndexed with index 0 (GL_Program.cpp) and writes a real 0
+            // into this map. Reading that 0 as an override made a blanket
+            // `glBindFragDataLocation(prog, 0, "b")` over a shader that declares
+            // `layout(location = 0, index = 1) out vec4 b;` collapse b onto slot (0,0) next to the
+            // index-0 output and fail the link as an alias - while the IO resolver had left b's
+            // qualifier at 1, the SPIR-V still carried Index 1, and glGetProgramResourceLocationIndex
+            // still answered 1. Validation was rejecting a program the backend had already emitted
+            // correctly, which is the one case where this branch can change the answer at all: this
+            // runs AFTER ShaderCompiler::LinkProgram/mapIO, so for every other shape the qualifier
+            // already carries the resolver's verdict.
+            //
+            // The two other consumers spell the same rule: TMglGlslIoResolver only writes the API
+            // index into the qualifier when it is non-zero, and ProgramInterface falls back to
+            // type.layoutIndex when GetFragmentDataIndex answers 0. All three now agree.
+            //
+            // Against the spec (GL 4.6 core 15.2.3): where a fragment output's index is given by a
+            // shader layout qualifier, that value is used and anything bound through
+            // BindFragDataLocation(Indexed) is IGNORED - the same precedence layout(location) has
+            // over glBindAttribLocation. That is stricter than "non-zero API wins", and the two
+            // differ in exactly one shape: an explicit `index = 0` in the shader against an API
+            // index of 1, where the spec keeps 0 and this codebase takes 1. That divergence lives
+            // in the resolver (it decides what is emitted); it is pre-existing, out of scope here,
+            // and deliberately not re-litigated in a third place - matching the resolver is what
+            // keeps validation checking what was actually built.
+            Int colorIndex = 0;
+            if (const auto explicitIndex = in.explicitFragDataIndex.find(outputName);
+                explicitIndex != in.explicitFragDataIndex.end()) {
+                colorIndex = static_cast<Int>(explicitIndex->second);
+            }
+            if (colorIndex == 0) {
+                if (const glslang::TType* outputType = output.getType();
+                    outputType != nullptr && outputType->getQualifier().hasIndex()) {
+                    colorIndex = static_cast<Int>(outputType->getQualifier().layoutIndex);
+                }
+            }
             const Int span = std::max<Int>(output.size, 1);
 
             if (location < 0 || location + span > in.maxFragmentOutputColorNumber) {
@@ -1765,10 +1946,16 @@ namespace MobileGL::MG_State::GLState {
             }
 
             for (Int colorNumber = location; colorNumber < location + span; ++colorNumber) {
-                auto [owner, inserted] = colorNumberOwners.emplace(colorNumber, outputName);
+                const Int64 slot = (static_cast<Int64>(colorIndex) << 32) |
+                                   static_cast<Int64>(static_cast<Uint32>(colorNumber));
+                auto [owner, inserted] = colorSlotOwners.emplace(slot, outputName);
                 if (!inserted) {
-                    artifacts.infoLog = std::format("Fragment outputs '{}' and '{}' alias color number {}.",
-                                                    owner->second, outputName, colorNumber);
+                    artifacts.infoLog =
+                        colorIndex == 0
+                            ? std::format("Fragment outputs '{}' and '{}' alias color number {}.", owner->second,
+                                          outputName, colorNumber)
+                            : std::format("Fragment outputs '{}' and '{}' alias color number {} at index {}.",
+                                          owner->second, outputName, colorNumber, colorIndex);
                     DeferLog(std::format("ProgramObject {}: Link failed - {}", in.externalIndex, artifacts.infoLog));
                     ProgramObject::ResetLinkArtifacts(artifacts);
                     return false;
@@ -1794,10 +1981,18 @@ namespace MobileGL::MG_State::GLState {
             return true;
         }
 
-        // Capture happens at the last vertex-processing stage (geometry, then
-        // tessellation evaluation, then vertex).
+        // Capture happens at the last vertex-processing stage (geometry, then tessellation
+        // evaluation, then tessellation CONTROL, then vertex). All four are vertex-processing
+        // stages in GL 4.6 core 11 - the control shader included - and in a separable program
+        // whose only stage is a TCS it is the last one that exists, so it is the capture stage
+        // and such a program MUST link (GL 4.6 core 7.3/11.1.2.1; the conformance suite spells
+        // the API split out at esextcTessellationShaderXFB.cpp:390-416, where a non-ES context
+        // takes should_succeed=true). TessControl sits AFTER TessEvaluation so a complete
+        // pipeline still captures at the evaluation stage and only a TCS-only program falls
+        // through to it. If MobileGL ever serves an ES context this arm has to be gated on the
+        // advertised API: ES requires the very same link to FAIL.
         const glslang::TIntermediate* captureIntermediate = nullptr;
-        for (EShLanguage stage : {EShLangGeometry, EShLangTessEvaluation, EShLangVertex}) {
+        for (EShLanguage stage : {EShLangGeometry, EShLangTessEvaluation, EShLangTessControl, EShLangVertex}) {
             captureIntermediate = artifacts.program->getIntermediate(stage);
             if (captureIntermediate != nullptr) {
                 break;

MobileGL/MG_State/GLState/ProgramState/ProgramLinkTask.h

@@ -117,6 +117,19 @@ namespace MobileGL::MG_State::GLState {
             // for phase B after the join has moved `artifacts` away.
             ProgramObject::LinkArtifacts reflection;
 
+            // Whether the RESOLVED transform-feedback capture set names gl_PointSize - the
+            // one fact about `artifacts.xfbVaryings` phase B needs, carried as a derived
+            // bool rather than by widening the slice above, which is deliberately the five
+            // (now eight) fields BuildGlobalUboRouting consumes and nothing else.
+            //
+            // It has to be here and cannot be re-derived: the point-size demotion forces the
+            // capture-capable stage to declare its carrier even when that stage never WRITES
+            // the built-in (ShaderCompiler::DemoteTessellationGeometryPointSizeForProgram's
+            // `captureRequestsPointSize`), and by phase B the only record of the request is
+            // this bit. No new L1 key material: the key already covers
+            // `requestedXfbVaryings`, of which this is a function.
+            Bool captureRequestsPointSize = false;
+
             // L1 shader-translation memo key for this program's SPIR-V (see
             // MG_Util/ShaderTranspiler/TranslationCache.h). Built HERE, at the tail of phase
             // A, and not by phase B - two reasons, both structural:
@@ -201,8 +214,10 @@ namespace MobileGL::MG_State::GLState {
         // Worker-side MGLOG replacement: appended to diagnostics.logLines and replayed by the
         // join, on the GL thread, where a serial implementation would have printed it.
         // Logging straight from a worker interleaves mid-line with the GL thread's output and
-        // lands out of order relative to the glLinkProgram that caused it.
-        void DeferLog(String line);
+        // lands out of order relative to the glLinkProgram that caused it. `level` is the
+        // severity the replay uses; DEBUG (the default) is compiled out of every shipped
+        // build, so a line that has to survive one names its own.
+        void DeferLog(String line, Int level = MOBILEGL_LOG_LEVEL_DEBUG);
 
         // Counts down to zero exactly once. Starts at deps + 1: the extra guard is released
         // by SubmitAfter itself, so a dependency that settles while the edges are still being

MobileGL/MG_State/GLState/ProgramState/ProgramObject.cpp

@@ -492,6 +492,10 @@ namespace MobileGL::MG_State::GLState {
         // time, for anything cached during the pending window itself.)
         ++m_backendStateVersion;
         BumpLinkObservableVersions();
+        // The separable flag takes effect HERE, at the link, and nowhere else (GL 4.6 core 7.3).
+        // Latched before the early-outs below so a link that fails still counts as a link -
+        // what must not update it is a link that never happened at all.
+        m_linkedSeparable = m_separable;
         // A whole-struct reset, unlike ResetLinkArtifacts(): during the pending window this
         // is what every gated reader sees, so it has to be the complete "not linked" state -
         // including the fields ResetLinkArtifacts deliberately preserves for its own callers.
@@ -536,6 +540,34 @@ namespace MobileGL::MG_State::GLState {
         task->in.explicitFragDataIndex = m_explicitFragDataIndex;
         task->in.requestedXfbVaryings = m_requestedXfbVaryings;
         task->in.requestedXfbBufferMode = m_requestedXfbBufferMode;
+        // ARB_gl_spirv: a program built from SPIR-V declares its transform feedback through
+        // XfbBuffer/XfbStride/Offset DECORATIONS, and glTransformFeedbackVaryings has no effect on
+        // it at all. glSpecializeShader translated those decorations into the equivalent name
+        // request (ShaderCompiler::SpecializeAndDecompileSpirvModule), and this is where it enters
+        // the link - so everything downstream, the frontend packer and both backends, sees one
+        // declaration form instead of two.
+        //
+        // The capture stage is the LAST vertex-processing stage the program has, which is the same
+        // rule ProgramLinkTask::ResolveTransformFeedbackVaryings resolves the names against. The
+        // application's own request wins if it made one: that can only happen on a mixed program,
+        // which is not a shape ARB_gl_spirv defines, and honouring what the application explicitly
+        // asked for is the safer of the two readings.
+        if (task->in.requestedXfbVaryings.empty()) {
+            for (const ShaderStage captureStage:
+                 {ShaderStage::Geometry, ShaderStage::TessEval, ShaderStage::TessControl,
+                  ShaderStage::Vertex}) {
+                Bool stagePresent = false;
+                for (const auto& shader : m_shaders) {
+                    if (!shader || shader->GetShaderStage() != captureStage) continue;
+                    stagePresent = true;
+                    if (shader->GetSpirvXfbVaryings().empty()) continue;
+                    task->in.requestedXfbVaryings = shader->GetSpirvXfbVaryings();
+                    task->in.requestedXfbBufferMode = shader->GetSpirvXfbBufferMode();
+                    break;
+                }
+                if (stagePresent) break;
+            }
+        }
         task->in.maxFragmentOutputColorNumber = m_maxFragmentOutputColorNumber;
 
         Vector<SharedPtr<ShaderCompileTask>> deps;

MobileGL/MG_State/GLState/ProgramState/ProgramObject.h

@@ -603,6 +603,11 @@ namespace MobileGL::MG_State::GLState {
         // other question about the global UBO's layout - and it is one: it decides how wide a
         // `double` uniform's slot is.
         Bool UsesNativeFloat64() const { return Spirv().nativeFloat64; }
+        // Whether gl_PointSize was demoted out of this program's tessellation/geometry
+        // modules into the ordinary carrier varying. Joins phase B: it is a fact about the
+        // generated modules, and its readers (the backends' capture-name respelling) already
+        // hold the phase-B join.
+        Bool PointSizeDemoted() const { return Spirv().pointSizeDemoted; }
         SizeT GetUniformStorageSpanInBytes(Uint location) const {
             return UniformStorageSpanInBytes(GetUniformTypeFacts(location), GetUniformSizesInBytes(location),
                                              UsesNativeFloat64());
@@ -787,6 +792,33 @@ namespace MobileGL::MG_State::GLState {
         void MarkUBOContentDirty() const {
             if (++m_uboContentVersion == ~0u) m_uboContentVersion = 0;
         }
+
+        // ---- the reserved gl_NumSamples stand-in (ShaderTranspiler::NUM_SAMPLES_UNIFORM_NAME) ----
+        //
+        // PHASE A: answerable without joining the SPIR-V job, which is what lets the draw path ask
+        // every program this question and pay nothing for the overwhelming majority that say no.
+        Bool UsesReservedNumSamples() const { return Artifacts().usesReservedNumSamples; }
+
+        // Publishes `samples` into the global-UBO shadow. Returns false when there is nowhere to
+        // put it - no shim in this program, no SPIR-V (a cancelled phase B), or the optimizer
+        // dropped the member because nothing read it after all - all of which are ordinary states,
+        // not errors. A value-identical write is dropped without bumping the content version, so a
+        // steady stream of draws into one framebuffer does not force a re-upload per draw.
+        Bool WriteReservedNumSamples(Int samples) {
+            if (!UsesReservedNumSamples()) return false;
+            SpirvArtifacts& spirv = Spirv();
+            const Uint offset = spirv.reservedNumSamplesOffset;
+            if (offset == kInvalidUniformOffset) return false;
+            if (static_cast<SizeT>(offset) + sizeof(Int) > spirv.globalUboScratch.size()) return false;
+
+            Uint8* const slot = spirv.globalUboScratch.data() + offset;
+            Int current = 0;
+            Memcpy(&current, slot, sizeof(Int));
+            if (current == samples) return true;
+            Memcpy(slot, &samples, sizeof(Int));
+            MarkUBOContentDirty();
+            return true;
+        }
         // ---- glUniform* inside the phase-A -> phase-B window ----
         //
         // True while the program is fully linked and fully queryable but its uniform shadow's
@@ -888,6 +920,14 @@ namespace MobileGL::MG_State::GLState {
         // subset of the stages of a program pipeline. Only takes effect on the next link,
         // which is why it is plain state here rather than something Link() consults.
         Bool GetSeparable() const { return m_separable; }
+        // What GL_PROGRAM_SEPARABLE actually reports, and what glUseProgramStages actually
+        // requires: the value the flag held at the program's LAST LINK, not the live flag.
+        // GL 4.6 core 7.3 - "the flag takes effect the next time the program is linked" - so a
+        // program that was told to be separable and then never linked is still NOT separable,
+        // which is precisely what es31cSeparateShaderObjsTests's PipelineApi and CreateShadProgApi
+        // assert. The live flag stays available as GetSeparable() for glGetProgramiv's sibling
+        // state and for the next link to latch.
+        Bool GetLinkedSeparable() const { return m_linkedSeparable; }
         void SetSeparable(Bool separable) {
             m_separable = separable;
             // ---- arming the uniform-write tracking latch ----
@@ -1296,6 +1336,14 @@ namespace MobileGL::MG_State::GLState {
             std::set<String> uniformBlocksWithoutBinding;
 
             Uint activeUniformCount = 0;
+            // This program's fragment stage read gl_NumSamples, so the source pipeline lowered it
+            // onto the reserved default-block uniform (ShaderTranspiler::NUM_SAMPLES_UNIFORM_NAME)
+            // and the draw path owes it the draw framebuffer's sample count before every draw.
+            //
+            // PHASE A on purpose, even though the byte offset it needs is phase-B output: the
+            // gate has to be answerable without joining the SPIR-V job, or every draw of every
+            // program would pay a join to discover it has nothing to write.
+            Bool usesReservedNumSamples = false;
             Uint maxUniformLocation = 0;
             Int uniformNameMaxLength = 0;
             Int attribInNameMaxLength = 0;
@@ -1317,6 +1365,27 @@ namespace MobileGL::MG_State::GLState {
             Vector<Uint32> gsStripTriangles;
             Bool gsStripCaptureFixup = false;
             GLenum gsInputPrimitive = GL_NONE;
+            // GL_TESS_CONTROL_OUTPUT_VERTICES: the `layout(vertices = N) out` of the linked
+            // tessellation control stage, or 0 when the program has none. Checked against
+            // GL_MAX_PATCH_VERTICES at link (GL 4.6 core 11.2.1.1).
+            Int tcsOutputVertices = 0;
+            // The rest of the geometry stage's link properties, and the tessellation evaluation
+            // stage's. Every one of these is a glGetProgramiv answer that had no source at all:
+            // the query surface listed the geometry pnames only to fall through to
+            // GL_INVALID_ENUM, and the GL_TESS_GEN_* pnames were not mentioned anywhere. They
+            // come from the linked intermediates for the same reason gsInputPrimitive and
+            // tcsOutputVertices do - glslang has already merged the compilation units' layout
+            // qualifiers and diagnosed contradictions, so the linked program is the thing that
+            // knows.
+            GLenum gsOutputPrimitive = GL_NONE;
+            Int gsMaxVertices = 0;
+            Int gsInvocations = 0;
+            // The tessellation evaluation stage's layout: GL_QUADS / GL_TRIANGLES / GL_ISOLINES,
+            // GL_EQUAL / GL_FRACTIONAL_EVEN / GL_FRACTIONAL_ODD, GL_CW / GL_CCW, and point mode.
+            GLenum tessGenMode = GL_NONE;
+            GLenum tessGenSpacing = GL_NONE;
+            GLenum tessGenVertexOrder = GL_NONE;
+            Bool tessGenPointMode = false;
             GLenum xfbBufferMode = GL_INTERLEAVED_ATTRIBS;
             Int xfbVaryingNameMaxLength = 0;
             Bool xfbNeedsScatteredCapture = false;
@@ -1344,6 +1413,11 @@ namespace MobileGL::MG_State::GLState {
             // kInvalidUniformOffset. Sized maxUniformLocation + 1 by the routing pass.
             Vector<Uint> uniformOffsets;
             Vector<Uint8> globalUboScratch;
+            // Byte offset of the reserved gl_NumSamples stand-in inside globalUboScratch, or
+            // kInvalidUniformOffset. Taken by NAME from the SPIR-V metadata rather than through
+            // uniformOffsets, because the member has no GL location at all: the link task keeps
+            // it out of the GL-visible uniform index space so no application can see or write it.
+            Uint reservedNumSamplesOffset = kInvalidUniformOffset;
             // False for a program whose SPIR-V was never produced (phase B cancelled at
             // teardown or by a relink) or whose optimizer run failed. GL has no way to
             // retract a LINK_STATUS it already reported true, so such a program stays
@@ -1360,6 +1434,18 @@ namespace MobileGL::MG_State::GLState {
             // table's offsets mean, and glUniform*d / glGetUniform*v have to write and read the
             // width the shader actually declares.
             Bool nativeFloat64 = false;
+            // Whether gl_PointSize was demoted out of THESE modules' tessellation/geometry
+            // stages into an ordinary varying (ShaderCompiler::
+            // DemoteTessellationGeometryPointSizeForProgram) because the backend cannot host
+            // the built-in there. Per PROGRAM by construction - a consumer whose producer
+            // kept the built-in would read garbage - and recorded here rather than
+            // re-derived because it cannot be: the rewrite's whole point is that the final
+            // bytes no longer declare the capability that armed it. The backends read it to
+            // respell a "gl_PointSize" transform-feedback capture as the carrier
+            // (ShaderCompiler::POINT_SIZE_CAPTURE_CARRIER_NAME). The GL reflection surface
+            // deliberately keeps answering "gl_PointSize": demotion happens after phase A,
+            // so every query keeps the truthful GL spelling.
+            Bool pointSizeDemoted = false;
         };
 
         // ---- artifacts-only helpers, shared with ProgramLinkTask ----
@@ -1467,6 +1553,14 @@ namespace MobileGL::MG_State::GLState {
             m_requestedXfbVaryings = Move(names);
             m_requestedXfbBufferMode = bufferMode;
         }
+        // NO ACCESSOR FOR THE PENDING REQUEST, deliberately. A program pipeline's draw composite
+        // needs the capture list of the stage program it flattens, and the obvious source - what
+        // glTransformFeedbackVaryings last recorded - is the wrong one: that request does not take
+        // effect until the stage program's next link, and it bumps no version, so reading it makes
+        // the composite's capture list depend on when the composite cache happened to be
+        // invalidated. GetTransformFeedbackInterfaceNames() below is the source that is correct
+        // AND cache-safe, because linked state only moves at a link and the composite signature
+        // already keys on the link version. See GLContext::GetProgramForDraw.
         GLenum GetTransformFeedbackBufferMode() const { return Artifacts().xfbBufferMode; }
         SizeT GetTransformFeedbackVaryingCount() const { return Artifacts().xfbVaryings.size(); }
         const XfbVarying* GetTransformFeedbackVarying(SizeT index) const {
@@ -1501,6 +1595,22 @@ namespace MobileGL::MG_State::GLState {
         // GL_LINES_ADJACENCY, GL_TRIANGLES or GL_TRIANGLES_ADJACENCY), or GL_NONE when the
         // program has no geometry stage. Draws must present a compatible primitive type.
         GLenum GetGeometryInputType() const { return Artifacts().gsInputPrimitive; }
+        // GL_GEOMETRY_OUTPUT_TYPE (GL_POINTS, GL_LINE_STRIP or GL_TRIANGLE_STRIP),
+        // GL_GEOMETRY_VERTICES_OUT and GL_GEOMETRY_SHADER_INVOCATIONS of the linked geometry
+        // stage. Meaningless without one - glGetProgramiv raises INVALID_OPERATION there.
+        GLenum GetGeometryOutputType() const { return Artifacts().gsOutputPrimitive; }
+        Int GetGeometryVerticesOut() const { return Artifacts().gsMaxVertices; }
+        Int GetGeometryShaderInvocations() const { return Artifacts().gsInvocations; }
+        // GL_TESS_CONTROL_OUTPUT_VERTICES of the linked tessellation control stage, or 0 when
+        // the program has no such stage. Never greater than GL_MAX_PATCH_VERTICES: a program
+        // that declared more does not link at all (GL 4.6 core 11.2.1.1).
+        Int GetTessControlOutputVertices() const { return Artifacts().tcsOutputVertices; }
+        // GL_TESS_GEN_MODE / _SPACING / _VERTEX_ORDER / _POINT_MODE of the linked tessellation
+        // evaluation stage.
+        GLenum GetTessGenMode() const { return Artifacts().tessGenMode; }
+        GLenum GetTessGenSpacing() const { return Artifacts().tessGenSpacing; }
+        GLenum GetTessGenVertexOrder() const { return Artifacts().tessGenVertexOrder; }
+        Bool GetTessGenPointMode() const { return Artifacts().tessGenPointMode; }
 
         Uint GetExternalIndex() const { return m_externalIndex; }
         // Globally-unique, never-reused id for this program object's lifetime. Unlike the GL
@@ -1626,6 +1736,11 @@ namespace MobileGL::MG_State::GLState {
         Bool m_deleteStatus = false;
         Bool m_binaryRetrievableHint = false;
         Bool m_separable = false;
+        // m_separable as of the last link; see GetLinkedSeparable. Latched by Link() rather than
+        // carried in LinkArtifacts because it is a GL-thread-owned decision made at enqueue time,
+        // not a result the worker computes - and because a FAILED link still latches it, exactly
+        // as a successful one does.
+        Bool m_linkedSeparable = false;
         // Monotone "this program may ever be a pipeline stage" latch; see SetSeparable for why
         // it is a latch and not just m_separable. Outside LinkArtifacts on purpose: a relink
         // clears the write SET, but a program that was separable is still separable after it.

MobileGL/MG_State/GLState/ProgramState/ProgramSpirvTask.cpp

@@ -16,10 +16,29 @@
 #include <MG_Util/ShaderTranspiler/TranslationCache.h>
 #include <MG_Util/ShaderTranspiler/Types.h>
 
+#include <atomic>
 #include <cstring>
 
 namespace MobileGL::MG_State::GLState {
-    void ProgramSpirvTask::DeferLog(String line) { diagnostics.logLines.push_back(Move(line)); }
+    namespace {
+        // The MGLOG_*_ONCE latch, moved to the SOURCE of a deferred line. It cannot live at
+        // the replay: Async::ApplyDeferredDiagnostics is ONE site shared by every job in the
+        // tree, so a latch there would silence unrelated lines. And it has to exist: a shader
+        // pack hands the same refusal to program after program, and a per-program WARN on a
+        // path like that is exactly the repeated production logging the house rule forbids.
+        // First occurrence at WARN - the one a bug report needs - every later one back at
+        // DEBUG, which shipped builds compile out.
+        Int FirstTimeWarnLevel(std::atomic_flag& latch) {
+            return latch.test_and_set(std::memory_order_relaxed) ? MOBILEGL_LOG_LEVEL_DEBUG
+                                                                 : MOBILEGL_LOG_LEVEL_WARN;
+        }
+        std::atomic_flag g_pointSizeDeclineReported;
+        std::atomic_flag g_pointSizeOptimizerFailureReported;
+    } // namespace
+
+    void ProgramSpirvTask::DeferLog(String line, const Int level) {
+        diagnostics.logLines.push_back({level, Move(line)});
+    }
 
     void ProgramSpirvTask::SubmitAfter(const SharedPtr<ProgramLinkTask>& phaseA) {
         MOBILEGL_ASSERT(phaseA != nullptr, "ProgramSpirvTask::SubmitAfter: the phase-A node is missing");
@@ -128,8 +147,15 @@ namespace MobileGL::MG_State::GLState {
         // with (ProgramLinkTask::BuildSpirvCacheKey reads the same env) or a memo written under
         // one answer could be handed back under the other.
         const Bool nativeFloat64 = m_phaseA->in.env != nullptr && m_phaseA->in.env->ConsumesFloat64Natively();
+        // The point-size demotion verdicts, read from the SAME snapshot for the same reason
+        // - and the same bits BuildSpirvCacheKey put in the L1 key, so a memo written under
+        // one answer can never be handed back under the other.
+        const Bool demoteTessellationPointSize =
+            m_phaseA->in.env != nullptr && m_phaseA->in.env->DemotesTessellationPointSize();
+        const Bool demoteGeometryPointSize =
+            m_phaseA->in.env != nullptr && m_phaseA->in.env->DemotesGeometryPointSize();
         GenerateSpirv(handoff, externalIndex, deferOutputValidationForDirectVulkan, enableSpirvValidation,
-                      nativeFloat64);
+                      nativeFloat64, demoteTessellationPointSize, demoteGeometryPointSize);
         // GlslangToSpv was the only consumer of the parsed ASTs; everything after this point
         // works on the SPIR-V and on the TProgram's own self-contained reflection pool. Drop
         // them here rather than at the end of the body, which is ~87% of this node's runtime
@@ -188,7 +214,9 @@ namespace MobileGL::MG_State::GLState {
 
     void ProgramSpirvTask::GenerateSpirv(const ProgramLinkTask::SpirvHandoff& handoff, const Uint externalIndex,
                                          const Bool deferOutputValidationForDirectVulkan,
-                                         const Bool enableSpirvValidation, const Bool nativeFloat64) {
+                                         const Bool enableSpirvValidation, const Bool nativeFloat64,
+                                         const Bool demoteTessellationPointSize,
+                                         const Bool demoteGeometryPointSize) {
         /* As we passed first stage compilation/linking,
          * we'll assume all the operations here should
          * pass. We may be able to employ some optimizations
@@ -267,6 +295,50 @@ namespace MobileGL::MG_State::GLState {
             }
         }
         artifacts.spirvStatus = allOptimized;
+
+        // The point-size demotion, program-wide and after the sanitize chain, so it works
+        // on the final shared bytes both backends consume and nothing downstream can trim
+        // the carriers it declares. Only the env half of the verdict lives here (and in the
+        // L1 key); whether the program actually declares the capability is probed inside,
+        // so the common case on an affected device - a program that never touches point
+        // size in those stages - pays one module parse per stage and no rewrite.
+        artifacts.pointSizeDemoted = false;
+        if (allOptimized && (demoteTessellationPointSize || demoteGeometryPointSize)) {
+            // Read off the HANDOFF's own derived bit, not off `handoff.reflection`: that
+            // field is the routing slice phase A fills with eight named members, and
+            // xfbVaryings is not one of them - reading it there answered "no capture ever
+            // asks for gl_PointSize" on every production link, which left a read-only
+            // capture stage without the carrier its capture binds to.
+            const Bool captureRequestsPointSize = handoff.captureRequestsPointSize;
+            ShaderCompiler::PointSizeDemotionOutcome outcome;
+            if (!ShaderCompiler::DemoteTessellationGeometryPointSizeForProgram(
+                    artifacts.generatedSpirv, handoff.shaderTypes, demoteTessellationPointSize,
+                    demoteGeometryPointSize, captureRequestsPointSize, outcome,
+                    !deferOutputValidationForDirectVulkan, enableSpirvValidation)) {
+                // Optimizer failure: modules untouched, so the capability is still declared
+                // and the backends' existing refusals stay in charge - honest, just slower.
+                DeferLog(std::format("ProgramObject {}: point-size demotion failed in the optimizer; the "
+                                     "program keeps its built-in and the device's declines apply",
+                                     externalIndex),
+                         FirstTimeWarnLevel(g_pointSizeOptimizerFailureReported));
+            } else if (outcome.demoted) {
+                artifacts.pointSizeDemoted = true;
+                DeferLog(std::format("ProgramObject {}: gl_PointSize demoted to an ordinary varying across "
+                                     "the tessellation/geometry chain (value preserved for capture and "
+                                     "gl_in reads; rasterized size falls back to 1.0)",
+                                     externalIndex));
+            } else if (!outcome.declineDetail.empty()) {
+                // THE MOST VALUABLE LINE THIS FEATURE PRODUCES: which module shape the pass
+                // refused, and therefore why an affected device is still about to lose the
+                // program. Nothing else records it - `declineDetail` has no other runtime
+                // surface - so at the deferred channel's DEBUG default it was formatted and
+                // then dropped by every INFO build, i.e. every device and every CI artifact.
+                DeferLog(std::format("ProgramObject {}: point-size demotion declined ({}); the program "
+                                     "keeps its built-in and the device's declines apply",
+                                     externalIndex, outcome.declineDetail),
+                         FirstTimeWarnLevel(g_pointSizeDeclineReported));
+            }
+        }
     }
 
     void ProgramSpirvTask::BuildGlobalUboRouting(const ProgramLinkTask::SpirvHandoff& handoff,
@@ -278,6 +350,7 @@ namespace MobileGL::MG_State::GLState {
 
         artifacts.uniformOffsets.clear();
         artifacts.globalUboScratch.clear();
+        artifacts.reservedNumSamplesOffset = ProgramObject::kInvalidUniformOffset;
         // kInvalidUniformOffset marks locations that end up without global-UBO backing
         // (e.g. the optimizer eliminated every use of the uniform); the fallback pass
         // below gives those locations tail storage so glUniform* always has a target.
@@ -311,6 +384,18 @@ namespace MobileGL::MG_State::GLState {
                     artifacts.globalUboScratch.resize(size);
                 }
                 for (const auto& [name, offset] : meta.plainUniformOffsetsInUBO) {
+                    // The gl_NumSamples stand-in is routed by NAME and nothing else. It has no GL
+                    // location to look up - DoReflection hides it from the GL uniform index space
+                    // precisely so no application can address it - so the lookup below would find
+                    // nothing and log it as unbacked. Only the fragment stage declares it, and
+                    // every stage's copy sits at the same offset in the one shared global UBO.
+                    if (name == NUM_SAMPLES_UNIFORM_NAME) {
+                        artifacts.reservedNumSamplesOffset = offset;
+                        MGLOG_D("ProgramObject %u: BuildGlobalUboRouting - reserved gl_NumSamples stand-in '%s' "
+                                "backed at UBO offset %u",
+                                externalIndex, name.c_str(), offset);
+                        continue;
+                    }
                     // SPIRV-Reflect leaf names never carry a "[0]" suffix; frontend
                     // reflection keys arrays as "arr[0]" (GL naming), so retry with the
                     // suffix before declaring the uniform unbacked.

MobileGL/MG_State/GLState/ProgramState/ProgramSpirvTask.h

@@ -67,12 +67,14 @@ namespace MobileGL::MG_State::GLState {
 
         void GenerateSpirv(const ProgramLinkTask::SpirvHandoff& handoff, Uint externalIndex,
                            Bool deferOutputValidationForDirectVulkan, Bool enableSpirvValidation,
-                           Bool nativeFloat64);
+                           Bool nativeFloat64, Bool demoteTessellationPointSize,
+                           Bool demoteGeometryPointSize);
         void BuildGlobalUboRouting(const ProgramLinkTask::SpirvHandoff& handoff, Uint externalIndex);
 
         // Worker-side MGLOG replacement, replayed by the join on the GL thread. Same reason as
-        // ProgramLinkTask::DeferLog.
-        void DeferLog(String line);
+        // ProgramLinkTask::DeferLog, and the same severity rule: DEBUG is compiled out of
+        // every shipped build, so a line that has to survive one names its own level.
+        void DeferLog(String line, Int level = MOBILEGL_LOG_LEVEL_DEBUG);
 
         SharedPtr<ProgramLinkTask> m_phaseA;
     };

MobileGL/MG_State/GLState/ProgramState/ShaderCompileTask.cpp

@@ -140,17 +140,21 @@ namespace {
         return std::nullopt;
     }
 
-    // What glGetIntegerv(GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS) answers, recomputed rather than
-    // queried: the compile runs on a worker with no context, and the pname is not a plain backend
-    // parameter - the getter caps the backend's count by the state layer's fixed binding-point
-    // array (GL_Getter's GetIndexedBufferQueryPointCount). A shader must be judged against the
-    // number the application was told, not against either half of it.
+    // What glGetIntegerv(GL_MAX_SHADER_STORAGE_BUFFER_BINDINGS) answers. Derived by the shared
+    // ResolveResourceBindingLimits so the compile-time scan below and the link-time general check
+    // (TMglGlslIoResolver::CheckDeclaredBindingRange) can never disagree about the number.
+    //
+    // Why BOTH still exist. GLSL makes an over-range binding a COMPILE-time error, and this scan
+    // is the only place MobileGL can raise one - glslang's own ceilings are switched off by the
+    // relaxed Vulkan parse and cannot be turned back on without changing the parse everything
+    // else depends on. The link-time check covers the four kinds a lexical scan of unexpanded
+    // source cannot see at all (samplers, images, uniform blocks, atomic counters, whose binding
+    // only survives inside a synthesized block NAME) and re-covers storage blocks as a backstop.
+    // The conformance predicate is compile AND link, so either site satisfies it; the split is
+    // about WHICH error GL reports, not about whether the shader is rejected.
     static MobileGL::Int MaxShaderStorageBufferBindings(
         const MobileGL::MG_Util::ShaderTranspiler::CompileEnv& env) {
-        const MobileGL::Int frontendPoints =
-            static_cast<MobileGL::Int>(MobileGL::MG_State::GLState::BufferBindingPointCount);
-        if (!env.HasBackend()) return frontendPoints;
-        return std::min<MobileGL::Int>(frontendPoints, std::max<MobileGL::Int>(env.params.MaxShaderStorageBufferBindings, 0));
+        return MobileGL::MG_State::GLState::ResolveResourceBindingLimits(env).MaxShaderStorageBufferBindings;
     }
 
     // The half of a compile that depends on nothing but the source text, the stage and the
@@ -380,12 +384,15 @@ namespace MobileGL::MG_State::GLState {
             // the log, for every failing shader. The info log is what names the offending
             // line; the source is recoverable from the application.
             const SizeT firstLineEnd = artifacts.infoLog.find('\n');
-            diagnostics.logLines.push_back(std::format(
-                "ShaderCompileTask: shader {} (stage {}) failed to compile; compileStatus = false. "
-                "Preprocessed source: {} bytes. First log line: {}",
-                externalIndex, static_cast<Int>(stage), shared.preprocessedSource.length(),
-                artifacts.infoLog.substr(0, firstLineEnd == String::npos ? artifacts.infoLog.length()
-                                                                        : firstLineEnd)));
+            diagnostics.logLines.push_back(
+                {MOBILEGL_LOG_LEVEL_DEBUG,
+                 std::format(
+                     "ShaderCompileTask: shader {} (stage {}) failed to compile; compileStatus = false. "
+                     "Preprocessed source: {} bytes. First log line: {}",
+                     externalIndex, static_cast<Int>(stage), shared.preprocessedSource.length(),
+                     artifacts.infoLog.substr(0, firstLineEnd == String::npos
+                                                     ? artifacts.infoLog.length()
+                                                     : firstLineEnd))});
             if (shouldPopulateCache) {
                 fresh->outcome = ShaderPreprocessOutcome::ParseFailed;
                 fresh->infoLog = artifacts.infoLog;

MobileGL/MG_State/GLState/ProgramState/ShaderCompileTask.h

@@ -10,9 +10,54 @@
 #include <Includes.h>
 #include <MG_Util/Async/JobNode.h>
 #include <MG_Util/ShaderTranspiler/CompileEnv.h>
+#include <MG_Util/ShaderTranspiler/Types.h>
+#include <MG_State/GLState/BufferState/BufferState.h>
 #include <MG_State/GLState/ProgramState/ShaderPreprocessCache.h>
 
 namespace MobileGL::MG_State::GLState {
+    // THE one derivation of the binding ceilings a shader-declared layout(binding = N) is judged
+    // against. Two readers have to agree on them - the compile-time storage-block scan below and
+    // the link-time general check in TMglGlslIoResolver - and the numbers are recomputed here
+    // rather than queried because both readers run on a worker with no context.
+    //
+    // Each is exactly what glGetIntegerv answers for the matching pname, and none of them is a
+    // plain backend parameter: the buffer families are additionally capped by the state layer's
+    // indexed-binding array (GL_Getter's GetIndexedBufferQueryPointCount does the same), because
+    // a shader must be judged against the number the APPLICATION was told, not against either
+    // half of it. Lives in MG_State rather than in MG_Util/ShaderTranspiler/Types.h purely
+    // because BufferBindingPointCount is state-layer knowledge that the transpiler layer must
+    // not reach up for.
+    inline MG_Util::ShaderTranspiler::ResourceBindingLimits ResolveResourceBindingLimits(
+        const MG_Util::ShaderTranspiler::CompileEnv& env) {
+        namespace ST = MG_Util::ShaderTranspiler;
+        ST::ResourceBindingLimits limits;
+        const Int bindingPoints = static_cast<Int>(BufferBindingPointCount);
+        // The atomic-counter ceiling is a frontend constant, so it holds even with no backend -
+        // and it is the number BuildTBuiltInResource compiles a layout(binding = N) atomic_uint
+        // against, which is what makes it enforceable at all.
+        limits.MaxAtomicCounterBufferBindings = std::min<Int>(bindingPoints, ST::MAX_ATOMIC_COUNTER_BUFFER_BINDINGS);
+        // So is the uniform-buffer one: GL_MAX_UNIFORM_BUFFER_BINDINGS is clamped to the indexed
+        // binding array in the getter and its floor (the GL 4.5 core minimum of 84) is that same
+        // array's width, so the backend's own number never moves it.
+        limits.MaxUniformBufferBindings = bindingPoints;
+        // The storage-buffer ceiling has the same shape as GetIndexedBufferQueryPointCount's: the
+        // backend's count capped by the array, and the array alone when there is no backend. That
+        // "no backend" arm is not a detail - it is what the GPU-free test binary runs under, and
+        // it has to keep matching what glGetIntegerv answers there.
+        limits.MaxShaderStorageBufferBindings =
+            env.HasBackend()
+                ? std::min<Int>(bindingPoints, std::max<Int>(env.params.MaxShaderStorageBufferBindings, 0))
+                : bindingPoints;
+        if (!env.HasBackend()) {
+            // The two genuinely per-DEVICE ceilings have nothing to be measured against here, and
+            // zero means "do not enforce this kind" rather than "reject everything".
+            return limits;
+        }
+        limits.MaxSamplerBindings = std::max<Int>(env.params.MaxCombinedTextureImageUnits, 0);
+        limits.MaxImageBindings = std::max<Int>(env.params.MaxImageUnits, 0);
+        return limits;
+    }
+
     // glslang has no "detach this thread" API in the vendored revision, but TShader::parse
     // leaves the calling thread's TLS pool allocator pointing at the shader's own pool and
     // never restores it. Left there, the next allocation this thread makes - in an unrelated

MobileGL/MG_State/GLState/ProgramState/ShaderObject.cpp

@@ -15,7 +15,77 @@
 #include <MG_Util/ShaderTranspiler/Types.h>
 
 namespace MobileGL::MG_State::GLState {
+    void ShaderObject::SetSpirvBinary(Vector<Uint32>&& binary) {
+        // A module replaces whatever this object stood for, so the compiled state of the old
+        // source goes with it - including a compile still in flight.
+        ReleaseCompileNode();
+        m_spirvBinary = Move(binary);
+        m_hasSpirvBinary = true;
+        m_specialized = false;
+        m_specializationFailed = false;
+        m_specializationInfoLog.clear();
+        m_spirvXfbVaryings.clear();
+        m_spirvXfbBufferMode = GL_INTERLEAVED_ATTRIBS;
+        m_source = MakeShared<const String>(String{});
+        InvalidateCompiledState();
+    }
+
+    const String& ShaderObject::GetApplicationShaderSource() const {
+        static const String kNoSource;
+        // Both the unspecialized and the specialized windows answer empty: in the first m_source
+        // already is empty, in the second it holds generated GLSL that the application never wrote.
+        return m_hasSpirvBinary ? kNoSource : *m_source;
+    }
+
+    void ShaderObject::SpecializeFromSpirv(String&& glsl, Vector<String>&& xfbVaryings, GLenum xfbBufferMode) {
+        ReleaseCompileNode();
+        // The latch goes up HERE and nowhere else - this is the one path that actually specialized
+        // the shader.
+        m_specialized = true;
+        m_specializationFailed = false;
+        m_specializationInfoLog.clear();
+        m_spirvXfbVaryings = Move(xfbVaryings);
+        m_spirvXfbBufferMode = xfbBufferMode;
+        // The GLSL the module specializes to enters the ORDINARY pipeline from here: preprocess,
+        // glslang parse, reflection, transpile, both backends. Nothing downstream needs to know
+        // the source was not written by the application - which is the whole reason this hop
+        // exists, and the reason a SPIR-V program's GL-visible surface (uniform locations, block
+        // indices, transform-feedback layout) is populated at all.
+        m_source = MakeShared<const String>(Move(glsl));
+        InvalidateCompiledState();
+        Compile();
+    }
+
+    void ShaderObject::RecordSpecializationFailure(String&& infoLog) {
+        ReleaseCompileNode();
+        m_source = MakeShared<const String>(String{});
+        InvalidateCompiledState();
+        m_specializationFailed = true;
+        m_specializationInfoLog = Move(infoLog);
+    }
+
     void ShaderObject::SetShaderSource(const String& source) {
+        // glShaderSource on a SPIR-V shader takes the object back to being a GLSL one, and
+        // GL_SPIR_V_BINARY must then read FALSE (ARB_gl_spirv; gl4cGlSpirvTests'
+        // spirv_modules_state_queries_test checks exactly this transition). The stored module goes
+        // with the flag - re-specializing it would be re-specializing a shader the application has
+        // already replaced. The memo below is skipped on purpose: the source may well be
+        // byte-identical to the empty string this object has been holding, and keeping the
+        // "compiled state" of that would keep the module's verdict too.
+        if (m_hasSpirvBinary || m_specializationFailed) {
+            m_hasSpirvBinary = false;
+            m_spirvBinary.clear();
+            m_spirvBinary.shrink_to_fit();
+            m_specialized = false;
+            m_specializationFailed = false;
+            m_specializationInfoLog.clear();
+            m_spirvXfbVaryings.clear();
+            m_spirvXfbBufferMode = GL_INTERLEAVED_ATTRIBS;
+            ReleaseCompileNode();
+            m_source = MakeShared<const String>(source);
+            InvalidateCompiledState();
+            return;
+        }
         // P0b layer 1. glShaderSource always REPLACES the source, but replacing it with a
         // byte-identical one cannot change what a compile would produce: the whole
         // pipeline (preprocess -> lexical checks -> glslang parse) is a pure function of
@@ -36,6 +106,10 @@ namespace MobileGL::MG_State::GLState {
     }
 
     void ShaderObject::SetShaderSource(String&& source) {
+        if (m_hasSpirvBinary || m_specializationFailed) {
+            SetShaderSource(static_cast<const String&>(source));
+            return;
+        }
         if (SourceMatchesCompiledState(source)) return;
         ReleaseCompileNode();
         m_source = MakeShared<const String>(Move(source));

MobileGL/MG_State/GLState/ProgramState/ShaderObject.h

@@ -65,6 +65,51 @@ namespace MobileGL {
             void SetShaderSource(const String& source);
             void SetShaderSource(String&& source);
             void Compile();
+
+            // ---- GL_ARB_gl_spirv ----
+            // glShaderBinary(GL_SHADER_BINARY_FORMAT_SPIR_V): the object stops standing for a
+            // GLSL source and starts standing for an application-supplied SPIR-V module. The
+            // module is held verbatim until glSpecializeShader names an entry point for it -
+            // ARB_gl_spirv makes the pair a two-step operation, and glCompileShader in between is
+            // INVALID_OPERATION rather than a compile of anything.
+            //
+            // Both directions clear the other: glShaderSource on a SPIR-V shader takes it back to
+            // being a GLSL shader with GL_SPIR_V_BINARY reading FALSE, which the conformance suite
+            // checks explicitly.
+            void SetSpirvBinary(Vector<Uint32>&& binary);
+            Bool HasSpirvBinary() const { return m_hasSpirvBinary; }
+            // ARB_gl_spirv: "Once specialized, a shader may not be re-specialized without first
+            // re-associating the original SPIR-V module with it, through ShaderBinary." A second
+            // glSpecializeShader is GL_INVALID_OPERATION, and this latch is what answers that.
+            //
+            // Set ONLY on the success path. A specialization that FAILED did not specialize the
+            // shader, and the conformance suite relies on that distinction: it deliberately fails
+            // specialization (a bad entry point, then an unknown constant id) on one shader object
+            // and then requires the next, well-formed call on that same object to be accepted.
+            Bool HasBeenSpecialized() const { return m_specialized; }
+            const Vector<Uint32>& GetSpirvBinary() const { return m_spirvBinary; }
+            // glSpecializeShader's half: hand the object the GLSL its module specializes to and
+            // let the ordinary pipeline compile it.
+            void SpecializeFromSpirv(String&& glsl, Vector<String>&& xfbVaryings, GLenum xfbBufferMode);
+            // The capture the object's SPIR-V module DECLARED, as the equivalent
+            // glTransformFeedbackVaryings request. Empty for a GLSL shader and for a SPIR-V module
+            // that declares no transform feedback. ProgramObject::Link picks this up from the
+            // program's last vertex-processing stage, because ARB_gl_spirv makes decorations the
+            // only declaration form for a SPIR-V program and glTransformFeedbackVaryings has no
+            // effect on one.
+            const Vector<String>& GetSpirvXfbVaryings() const { return m_spirvXfbVaryings; }
+            GLenum GetSpirvXfbBufferMode() const { return m_spirvXfbBufferMode; }
+            // What glGetShaderSource / GL_SHADER_SOURCE_LENGTH must answer. A shader created from
+            // glShaderBinary never had glShaderSource called on it, so GL 4.6 core 7.1 makes its
+            // source the empty string - even after glSpecializeShader, when m_source holds the
+            // SPIRV-Cross GLSL the module was translated into. That text is MobileGL's, not the
+            // application's, and handing it back invites an application to cache and re-submit it.
+            const String& GetApplicationShaderSource() const;
+            // The other half: specialization itself failed (a bad entry point, a constant id the
+            // module does not declare, a module spirv-val rejects). There is nothing to compile,
+            // so the verdict is recorded directly - COMPILE_STATUS false with this log - and both
+            // queries answer from it without touching the compile pipeline.
+            void RecordSpecializationFailure(String&& infoLog);
             // Gives up this object's claim on its compile node, cancelling the node only if
             // this object was its LAST claimant. Called at the points where the object's
             // compiled state stops being observable through THIS name: a real source change,
@@ -99,14 +144,16 @@ namespace MobileGL {
             const SharedPtr<const String>& GetShaderSourcePtr() const { return m_source; }
 
             const SharedPtr<glslang::TShader>& GetCompiledShader() const { return Compiled().shader; }
-            const String& GetInfoLog() const { return Compiled().infoLog; }
+            const String& GetInfoLog() const {
+                return m_specializationFailed ? m_specializationInfoLog : Compiled().infoLog;
+            }
             // Explicit layout(location = N) qualifiers on this shader's default-block
             // uniforms, as glslang recorded them at the point its Vulkan-relaxed remap
             // discarded them (see CollectExplicitUniformLocations).
             const UnorderedMap<String, Int>& GetExplicitUniformLocations() const {
                 return Compiled().explicitUniformLocations;
             }
-            Bool GetCompileStatus() const { return Compiled().compileStatus; }
+            Bool GetCompileStatus() const { return m_specializationFailed ? false : Compiled().compileStatus; }
             Bool GetDeleteStatus() const { return m_deleteStatus; }
 
             // Blocks until a pending compile has published its artifacts. Public for the
@@ -248,6 +295,25 @@ namespace MobileGL {
             // query optimistically for the current node. Cleared wherever the node
             // changes hands (AdoptCompileNode) or goes away (DropCompileNode).
             mutable Bool m_optimisticAnswerLatched = false;
+            // The application-supplied SPIR-V module and the flag GL_SPIR_V_BINARY reports. The
+            // module is kept after specialization too: glSpecializeShader may legally run again on
+            // the same object with different constants, and the second call has to re-specialize
+            // the ORIGINAL words rather than the ones the first call folded.
+            Vector<Uint32> m_spirvBinary;
+            Bool m_hasSpirvBinary = false;
+            // "This shader has been specialized"; see HasBeenSpecialized. Cleared by anything that
+            // re-associates a module (SetSpirvBinary) or turns the object back into a GLSL shader
+            // (either SetShaderSource overload) - which is exactly the re-association ARB_gl_spirv
+            // names as the way to make a second specialization legal again.
+            Bool m_specialized = false;
+            Vector<String> m_spirvXfbVaryings;
+            GLenum m_spirvXfbBufferMode = GL_INTERLEAVED_ATTRIBS;
+            // A specialization that failed before any compile could start. Kept beside the
+            // compile artifacts rather than inside them because there is no compile job to hang
+            // it on - see RecordSpecializationFailure. Cleared by anything that gives the object
+            // a new meaning (a new source, a new module, a fresh specialization).
+            Bool m_specializationFailed = false;
+            String m_specializationInfoLog;
         };
     } // namespace MG_State::GLState
 } // namespace MobileGL

MobileGL/MG_State/GLState/RenderState/RenderState.cpp

@@ -217,12 +217,43 @@ namespace MobileGL {
                 return m_parameters.PatchVertices;
             }
 
-            void RenderState::SetPolygonOffset(Float factor, Float units) {
-                if (m_parameters.PolygonOffsetFactor == factor && m_parameters.PolygonOffsetUnits == units) return;
+            // BumpVersions(), not just ++m_version, for the same reason SetPatchVertices does it:
+            // these levels are compiled INTO the synthesized pass-through tessellation control
+            // stage on both backends, so changing one makes an already-built program stale.
+            //
+            // The redundant-write guard compares BIT PATTERNS, not floats: glPatchParameterfv
+            // accepts NaN, and a float compare would let a re-set of the identical NaN tuple fall
+            // through and bump the pipeline-state version - invalidating DirectVulkan's pipeline
+            // memo and DirectGLES's render-state span - on every single call.
+            void RenderState::SetPatchDefaultOuterLevel(const FloatVec4& levels) {
+                if (BitwiseEqual(m_parameters.PatchDefaultOuterLevel, levels)) return;
 
-                m_parameters.PolygonOffsetFactor = factor;
-                m_parameters.PolygonOffsetUnits = units;
-                ++m_version;
+                m_parameters.PatchDefaultOuterLevel = levels;
+                BumpVersions();
+            }
+
+            const FloatVec4& RenderState::GetPatchDefaultOuterLevel() const {
+                return m_parameters.PatchDefaultOuterLevel;
+            }
+
+            void RenderState::SetPatchDefaultInnerLevel(const FloatVec2& levels) {
+                if (BitwiseEqual(m_parameters.PatchDefaultInnerLevel, levels)) return;
+
+                m_parameters.PatchDefaultInnerLevel = levels;
+                BumpVersions();
+            }
+
+            const FloatVec2& RenderState::GetPatchDefaultInnerLevel() const {
+                return m_parameters.PatchDefaultInnerLevel;
+            }
+
+            void RenderState::SetPolygonOffset(Float factor, Float units) {
+                // GL 4.6 core 14.6.5 defines PolygonOffset(factor, units) as EQUIVALENT to
+                // PolygonOffsetClamp(factor, units, 0) - the equivalence is total, so the clamp is
+                // written too, not merely left alone. Leaving it meant a glPolygonOffsetClamp(1, 1,
+                // 0.5) followed by a plain glPolygonOffset(3, 4) still reported a clamp of 0.5, and
+                // the early-out below could even skip the version bump while doing it.
+                SetPolygonOffsetClamped(factor, units, 0.0f);
             }
 
             Float RenderState::GetPolygonOffsetFactor() const {
@@ -233,6 +264,37 @@ namespace MobileGL {
                 return m_parameters.PolygonOffsetUnits;
             }
 
+            void RenderState::SetPolygonOffsetClamped(Float factor, Float units, Float clamp) {
+                if (m_parameters.PolygonOffsetFactor == factor && m_parameters.PolygonOffsetUnits == units &&
+                    m_parameters.PolygonOffsetClamp == clamp)
+                    return;
+
+                m_parameters.PolygonOffsetFactor = factor;
+                m_parameters.PolygonOffsetUnits = units;
+                m_parameters.PolygonOffsetClamp = clamp;
+                ++m_version;
+            }
+
+            Float RenderState::GetPolygonOffsetClamp() const {
+                return m_parameters.PolygonOffsetClamp;
+            }
+
+            void RenderState::SetClipControl(GLenum origin, GLenum depth) {
+                if (m_parameters.ClipOrigin == origin && m_parameters.ClipDepthMode == depth) return;
+
+                m_parameters.ClipOrigin = origin;
+                m_parameters.ClipDepthMode = depth;
+                ++m_version;
+            }
+
+            GLenum RenderState::GetClipOrigin() const {
+                return m_parameters.ClipOrigin;
+            }
+
+            GLenum RenderState::GetClipDepthMode() const {
+                return m_parameters.ClipDepthMode;
+            }
+
             // -------------------- Capabilities --------------------
             namespace {
                 // CapabilityInput lists ClipDistance0..7 contiguously (RenderState.h); the caller
@@ -270,6 +332,7 @@ namespace MobileGL {
                     SET_CAPABILITY(SampleAlphaToOne, enabled);
                     SET_CAPABILITY(SampleCoverage, enabled);
                     SET_CAPABILITY(SampleMask, enabled);
+                    SET_CAPABILITY(SampleShading, enabled);
                     SET_CAPABILITY(StencilTest, enabled);
                     SET_CAPABILITY(ProgramPointSize, enabled);
                 case CapabilityInput::Blend: {
@@ -344,6 +407,7 @@ namespace MobileGL {
                     RETURN_CAPABILITY(SampleAlphaToOne);
                     RETURN_CAPABILITY(SampleCoverage);
                     RETURN_CAPABILITY(SampleMask);
+                    RETURN_CAPABILITY(SampleShading);
                     RETURN_CAPABILITY(StencilTest);
                     RETURN_CAPABILITY(ProgramPointSize);
                 case CapabilityInput::Blend:
@@ -737,6 +801,20 @@ namespace MobileGL {
                 return m_parameters.SampleMaskValue;
             }
 
+            void RenderState::SetMinSampleShadingValue(Float value) {
+                if (m_parameters.MinSampleShadingValue == value) return;
+
+                m_parameters.MinSampleShadingValue = value;
+                // BumpVersions, not just ++m_version: DirectVulkan bakes the fraction into
+                // VkPipelineMultisampleStateCreateInfo::minSampleShading, so a cached pipeline
+                // built with the old value must not be reused.
+                BumpVersions();
+            }
+
+            Float RenderState::GetMinSampleShadingValue() const {
+                return m_parameters.MinSampleShadingValue;
+            }
+
             // -------------------- Pixel Store --------------------
             void RenderState::SetPixelStoreParam(PixelStoreParam param, Int value) {
 #define SET_PIXEL_STORE_PARAM(paramNameHead, paramNameTail, val)                                                       \

MobileGL/MG_State/GLState/RenderState/RenderState.h

@@ -240,8 +240,24 @@ namespace MobileGL {
         Float PointSize = 1.0f;
         // GL_PATCH_VERTICES: how many vertices one tessellation patch consumes.
         Uint PatchVertices = 3;
+        // GL_PATCH_DEFAULT_OUTER_LEVEL / GL_PATCH_DEFAULT_INNER_LEVEL (glPatchParameterfv). The
+        // tessellation levels used when a program has an evaluation stage and NO control stage -
+        // GL's fixed-function pass-through (4.6 core 11.2.2). Both backends have to synthesize
+        // that stage, and they bake these numbers into it, so a change here makes an already-built
+        // one stale exactly as PATCH_VERTICES does. Default 1.0, per table 23.44.
+        FloatVec4 PatchDefaultOuterLevel = FloatVec4(1.0f, 1.0f, 1.0f, 1.0f);
+        FloatVec2 PatchDefaultInnerLevel = FloatVec2(1.0f, 1.0f);
         Float PolygonOffsetFactor = 0.0f;
         Float PolygonOffsetUnits = 0.0f;
+        // GL_POLYGON_OFFSET_CLAMP (GL 4.6 core 14.6.5 / GL_EXT_polygon_offset_clamp): the maximum
+        // magnitude of the offset glPolygonOffsetClamp's third argument allows. Zero - the default
+        // - means "no clamp", which is exactly the behaviour glPolygonOffset leaves behind.
+        Float PolygonOffsetClamp = 0.0f;
+
+        // glClipControl (GL 4.5 core 13.5). Defaults per table 23.7 are the pre-4.5 fixed
+        // behaviour: origin at the lower left, depth mapped from -1..1.
+        GLenum ClipOrigin = GL_LOWER_LEFT;
+        GLenum ClipDepthMode = GL_NEGATIVE_ONE_TO_ONE;
 
         // Blending
         Array<PerBufferBlendState, MG_State::GLState::FramebufferObject::MAX_DRAW_BUFFERS> BlendStates;
@@ -271,6 +287,10 @@ namespace MobileGL {
         Float SampleCoverageValue = 1.0f;
         Bool SampleCoverageInvert = false;
         Uint32 SampleMaskValue = 0xffffffffu;
+        // glMinSampleShading (ARB_sample_shading / GL 4.0 core 14.3.1). The fraction of samples
+        // that get their own independent shading when GL_SAMPLE_SHADING is enabled; the initial
+        // value is 0, and the value is clamped to [0, 1] on the way in.
+        Float MinSampleShadingValue = 0.0f;
         Array<StencilFaceState, 2> StencilStates{};
 
         // Cull Face
@@ -319,6 +339,7 @@ namespace MobileGL {
         Bool SampleAlphaToOneEnabled = false;
         Bool SampleCoverageEnabled = false;
         Bool SampleMaskEnabled = false;
+        Bool SampleShadingEnabled = false;
         Bool StencilTestEnabled = false;
         Bool ProgramPointSizeEnabled = false;
         // glEnable(GL_SCISSOR_TEST) enables the test for EVERY viewport, glEnablei for one
@@ -374,9 +395,21 @@ namespace MobileGL {
                 Float GetPointSize() const;
                 void SetPatchVertices(Uint vertices);
                 Uint GetPatchVertices() const;
+                void SetPatchDefaultOuterLevel(const FloatVec4& levels);
+                const FloatVec4& GetPatchDefaultOuterLevel() const;
+                void SetPatchDefaultInnerLevel(const FloatVec2& levels);
+                const FloatVec2& GetPatchDefaultInnerLevel() const;
                 void SetPolygonOffset(Float factor, Float units);
+                // glPolygonOffsetClamp. Writes the same factor/units as glPolygonOffset plus the
+                // clamp, because that is what the entry point does - glPolygonOffset is the
+                // clamp = 0 case of it (GL 4.6 core 14.6.5).
+                void SetPolygonOffsetClamped(Float factor, Float units, Float clamp);
                 Float GetPolygonOffsetFactor() const;
                 Float GetPolygonOffsetUnits() const;
+                Float GetPolygonOffsetClamp() const;
+                void SetClipControl(GLenum origin, GLenum depth);
+                GLenum GetClipOrigin() const;
+                GLenum GetClipDepthMode() const;
                 // Hints. target must be one of the 4 GL 3.3 core hint targets (validated by the caller).
                 void SetHint(GLenum target, GLenum mode);
                 GLenum GetHint(GLenum target) const;
@@ -454,6 +487,9 @@ namespace MobileGL {
                 Bool GetSampleCoverageInvert() const;
                 void SetSampleMaskValue(Uint32 mask);
                 Uint32 GetSampleMaskValue() const;
+                // glMinSampleShading. `value` is stored as given; the entry point clamps.
+                void SetMinSampleShadingValue(Float value);
+                Float GetMinSampleShadingValue() const;
 
                 // Pixel Store
                 void SetPixelStoreParam(PixelStoreParam param, Int value);

MobileGL/MG_State/GLState/SamplerState/SamplerObject.cpp

@@ -155,9 +155,21 @@ namespace MobileGL {
             // an answer whichever form was written. Integer <-> float uses the plain value, matching
             // what glTexParameterIiv/Iuiv mean: those forms are for integer texture formats, whose
             // border components are the raw integers rather than a normalized fraction.
+            //
+            // Which of the three the application actually WROTE is recorded separately in
+            // borderColorForm, because the derived values erase it: a backend has to know whether to
+            // forward the colour through glSamplerParameterfv or glSamplerParameterIiv (and which
+            // VkBorderColor family to ask Vulkan for), and the numbers alone cannot say. That is also
+            // why every setter's early-out tests the form as well as the value - a float (0,0,0,1)
+            // followed by an integer (0,0,0,1) is a real state change even though nothing numeric
+            // moved, and swallowing it would leave the backend syncing the wrong entry point forever.
             void SamplerObject::SetBorderColor(const FloatVec4& color) {
-                if (color == m_samplerParameters.borderColor) return;
+                if (color == m_samplerParameters.borderColor &&
+                    m_samplerParameters.borderColorForm == BorderColorForm::Float) {
+                    return;
+                }
 
+                m_samplerParameters.borderColorForm = BorderColorForm::Float;
                 m_samplerParameters.borderColor = color;
                 m_samplerParameters.borderColorI =
                     IntVec4(static_cast<Int32>(color.x()), static_cast<Int32>(color.y()),
@@ -169,8 +181,12 @@ namespace MobileGL {
             }
 
             void SamplerObject::SetBorderColorI(const IntVec4& color) {
-                if (color == m_samplerParameters.borderColorI) return;
+                if (color == m_samplerParameters.borderColorI &&
+                    m_samplerParameters.borderColorForm == BorderColorForm::Int) {
+                    return;
+                }
 
+                m_samplerParameters.borderColorForm = BorderColorForm::Int;
                 m_samplerParameters.borderColorI = color;
                 m_samplerParameters.borderColorUI =
                     UintVec4(static_cast<Uint32>(color.x()), static_cast<Uint32>(color.y()),
@@ -182,8 +198,12 @@ namespace MobileGL {
             }
 
             void SamplerObject::SetBorderColorUI(const UintVec4& color) {
-                if (color == m_samplerParameters.borderColorUI) return;
+                if (color == m_samplerParameters.borderColorUI &&
+                    m_samplerParameters.borderColorForm == BorderColorForm::Uint) {
+                    return;
+                }
 
+                m_samplerParameters.borderColorForm = BorderColorForm::Uint;
                 m_samplerParameters.borderColorUI = color;
                 m_samplerParameters.borderColorI =
                     IntVec4(static_cast<Int32>(color.x()), static_cast<Int32>(color.y()),
@@ -206,6 +226,10 @@ namespace MobileGL {
                 return m_samplerParameters.borderColorUI;
             }
 
+            BorderColorForm SamplerObject::GetBorderColorForm() const {
+                return m_samplerParameters.borderColorForm;
+            }
+
             SamplerCompareMode SamplerObject::GetCompareMode() const {
                 return m_samplerParameters.compareMode;
             }

MobileGL/MG_State/GLState/SamplerState/SamplerObject.h

@@ -56,6 +56,19 @@ namespace MobileGL {
         Unknown = -1
     };
 
+    // Which of the three GL_TEXTURE_BORDER_COLOR entry-point families last wrote the border colour,
+    // and therefore which of the three stored representations is AUTHORITATIVE. GL 4.6 core 8.10:
+    // TexParameterIiv/Iuiv store an integer border colour "unmodified, with an internal data type of
+    // integer", TexParameterfv stores a floating-point one, and the derived forms are only a
+    // convenience for a getter of the other spelling. A backend cannot pick the right driver entry
+    // point (glSamplerParameterIiv vs fv) or the right VkBorderColor family without this: numerically
+    // the three representations are always populated, so the value alone says nothing about the form.
+    enum class BorderColorForm : Uint8 {
+        Float,
+        Int,
+        Uint
+    };
+
     struct SamplerParameters {
         SamplerWrapMode wrapS = SamplerWrapMode::Repeat;
         SamplerWrapMode wrapT = SamplerWrapMode::Repeat;
@@ -79,6 +92,7 @@ namespace MobileGL {
         FloatVec4 borderColor = {0.0f, 0.0f, 0.0f, 0.0f};
         IntVec4 borderColorI = {0, 0, 0, 0};
         UintVec4 borderColorUI = {0, 0, 0, 0};
+        BorderColorForm borderColorForm = BorderColorForm::Float;
     };
 
     namespace MG_State {
@@ -117,6 +131,7 @@ namespace MobileGL {
                 const FloatVec4& GetBorderColor() const;
                 const IntVec4& GetBorderColorI() const;
                 const UintVec4& GetBorderColorUI() const;
+                BorderColorForm GetBorderColorForm() const;
                 Uint GetExternalIndex() const;
                 Uint16 GetVersion() const;
                 // Globally-unique, never-reused id for this sampler object's lifetime. Lets a

MobileGL/MG_State/GLState/TextureState/TextureObject.cpp

@@ -113,8 +113,14 @@ namespace MobileGL {
                 return m_sampler->GetBorderColor();
             }
 
+            // The redundancy filters test the FORM as well as the value: the derived representations
+            // make a float (0,0,0,1) and an integer (0,0,0,1) numerically identical, but they are
+            // different GL state and the DirectGLES sync memoises on m_textureParamsVersion.
             void TextureObjectBase::SetBorderColor(const FloatVec4& color) {
-                if (color == m_sampler->GetBorderColor()) return;
+                if (color == m_sampler->GetBorderColor() &&
+                    m_sampler->GetBorderColorForm() == BorderColorForm::Float) {
+                    return;
+                }
 
                 m_sampler->SetBorderColor(color);
                 ++m_textureParamsVersion;
@@ -125,7 +131,10 @@ namespace MobileGL {
             }
 
             void TextureObjectBase::SetBorderColorI(const IntVec4& color) {
-                if (color == m_sampler->GetBorderColorI()) return;
+                if (color == m_sampler->GetBorderColorI() &&
+                    m_sampler->GetBorderColorForm() == BorderColorForm::Int) {
+                    return;
+                }
 
                 m_sampler->SetBorderColorI(color);
                 ++m_textureParamsVersion;
@@ -136,12 +145,19 @@ namespace MobileGL {
             }
 
             void TextureObjectBase::SetBorderColorUI(const UintVec4& color) {
-                if (color == m_sampler->GetBorderColorUI()) return;
+                if (color == m_sampler->GetBorderColorUI() &&
+                    m_sampler->GetBorderColorForm() == BorderColorForm::Uint) {
+                    return;
+                }
 
                 m_sampler->SetBorderColorUI(color);
                 ++m_textureParamsVersion;
             }
 
+            BorderColorForm TextureObjectBase::GetBorderColorForm() const {
+                return m_sampler->GetBorderColorForm();
+            }
+
             TextureSwizzleParam TextureObjectBase::GetSwizzleParam(TextureSwizzleParam param) const {
                 switch (param) {
                 case TextureSwizzleParam::Red:

MobileGL/MG_State/GLState/TextureState/TextureObject.h

@@ -40,6 +40,8 @@ namespace MobileGL::MG_State::GLState {
         virtual void SetBorderColorI(const IntVec4& color) = 0;
         virtual const UintVec4& GetBorderColorUI() const = 0;
         virtual void SetBorderColorUI(const UintVec4& color) = 0;
+        // Which of the three setters above last ran; see SamplerParameters::borderColorForm.
+        virtual BorderColorForm GetBorderColorForm() const = 0;
         virtual TextureSwizzleParam GetSwizzleParam(TextureSwizzleParam param) const = 0;
         virtual void SetSwizzleParam(TextureSwizzleParam param, TextureSwizzleParam value) = 0;
         virtual void SetSwizzleParamRGBA(const Vec4<TextureSwizzleParam>& values) = 0;
@@ -49,6 +51,12 @@ namespace MobileGL::MG_State::GLState {
         virtual void SetMaxLevel(Uint maxLevel) = 0;
         virtual Bool IsImmutable() const = 0;
         virtual Uint GetImmutableLevels() const = 0;
+        // How many levels THIS object can address, i.e. the bound a level argument has to
+        // stay under. The same number as GetImmutableLevels() for an ordinary immutable
+        // texture, but NOT for a view: GL 4.6 core 8.18 defines TEXTURE_IMMUTABLE_LEVELS on a
+        // view as the ORIGINAL texture's value, which says nothing about what the view itself
+        // can reach, and bounding by it lets a level the view does not have through.
+        virtual Uint GetAddressableLevelCount() const = 0;
         virtual void SetImmutableLevels(Uint levels) = 0;
         virtual Uint16 GetTextureParamsVersion() const = 0;
         // Monotonic counter bumped on every CPU-side pixel mutation (see MarkStorageDirty).
@@ -123,6 +131,7 @@ namespace MobileGL::MG_State::GLState {
         void SetBorderColorI(const IntVec4& color) override;
         const UintVec4& GetBorderColorUI() const override;
         void SetBorderColorUI(const UintVec4& color) override;
+        BorderColorForm GetBorderColorForm() const override;
         TextureSwizzleParam GetSwizzleParam(TextureSwizzleParam param) const override;
         const Vec4<TextureSwizzleParam>& GetAllSwizzleParams() const override;
         void SetSwizzleParam(TextureSwizzleParam param, TextureSwizzleParam value) override;
@@ -132,6 +141,10 @@ namespace MobileGL::MG_State::GLState {
         void SetMaxLevel(Uint maxLevel) override;
         Bool IsImmutable() const override;
         Uint GetImmutableLevels() const override;
+        // m_immutableLevels is already the VIEW-relative count for a view (its constructor
+        // stores <numlevels> there so the level-range clamp works in view coordinates), so
+        // this one accessor is correct for both and needs no override.
+        Uint GetAddressableLevelCount() const override { return m_immutableLevels; }
         void SetImmutableLevels(Uint levels) override;
         Uint16 GetTextureParamsVersion() const override;
         Uint64 GetContentVersion() const override;

MobileGL/MG_State/GLState/TextureState/TextureObjectView.cpp

@@ -97,27 +97,31 @@ namespace MobileGL::MG_State::GLState {
         return m_storageOwner->HasFixedSampleLocations();
     }
 
+    Uint TextureObjectView::ViewLayerIndex(TextureUploadTarget viewTarget) const {
+        if (GetTarget() != TextureTarget::TextureCubeMap) {
+            // One target, one layer: the view's origin is the whole answer.
+            return m_viewMinLayer;
+        }
+        for (Uint i = 0; i < static_cast<Uint>(m_uploadTargets.size()); ++i) {
+            if (m_uploadTargets[i] == viewTarget) return m_viewMinLayer + i;
+        }
+        return m_viewMinLayer;
+    }
+
     TextureUploadTarget TextureObjectView::ToOwnerUploadTarget(TextureUploadTarget viewTarget) const {
         const auto& ownerTargets = m_storageOwner->GetUploadTargets();
         MOBILEGL_ASSERT(!ownerTargets.empty(), "TextureObjectView: storage owner has no upload target");
         if (ownerTargets.size() == 1) {
-            // The owner keeps every layer in one blob, so there is nothing to choose.
+            // The owner keeps every layer in one blob, so there is nothing to choose HERE - which
+            // is exactly why a cube-map view over such an owner has to have its face carried by
+            // LayerByteOffset instead. See ViewLayerIndex.
             return ownerTargets[0];
         }
-        // The owner is a cube map: six independent blobs, one per face, and the view's layer
-        // index selects among them. A cube-map view of a cube map maps face to face; any other
-        // view target addresses layers, which for a cube-map owner ARE its faces.
+        // The owner is a cube map: six independent blobs, one per face, and the layer this view
+        // target names selects among them. A cube-map view of a cube map maps face to face; any
+        // other view target addresses layers, which for a cube-map owner ARE its faces.
         const Uint faceCount = static_cast<Uint>(ownerTargets.size());
-        Uint face = m_viewMinLayer;
-        if (GetTarget() == TextureTarget::TextureCubeMap) {
-            for (Uint i = 0; i < m_uploadTargets.size(); ++i) {
-                if (m_uploadTargets[i] == viewTarget) {
-                    face = m_viewMinLayer + i;
-                    break;
-                }
-            }
-        }
-        return ownerTargets[std::min(face, faceCount - 1)];
+        return ownerTargets[std::min(ViewLayerIndex(viewTarget), faceCount - 1)];
     }
 
     IntVec3 TextureObjectView::ToViewLevelSize(const IntVec3& ownerLevelSize) const {
@@ -151,7 +155,13 @@ namespace MobileGL::MG_State::GLState {
     }
 
     SizeT TextureObjectView::LayerByteOffset(TextureUploadTarget viewTarget, Uint mipmapLevel) const {
-        if (m_viewMinLayer == 0 || m_ownerMipmap == nullptr) return 0;
+        if (m_ownerMipmap == nullptr) return 0;
+        // The FACE is part of this, not just the view's origin: a cube-map view over a layered
+        // owner (a 2D array or a cube-map ARRAY) has only one blob to address, so the face its
+        // target token names lives here or nowhere. It used to live nowhere, and all six face
+        // tokens read the view's first layer-face - silently, with texels from a real layer.
+        const Uint layerIndex = ViewLayerIndex(viewTarget);
+        if (layerIndex == 0) return 0;
         const LayerAxis ownerAxis = LayerAxisOf(m_storageOwner->GetTarget());
         if (ownerAxis == LayerAxis::None) {
             // A cube-map owner keeps each face in its OWN blob, and ToOwnerUploadTarget already
@@ -173,23 +183,26 @@ namespace MobileGL::MG_State::GLState {
                                       ? static_cast<SizeT>(std::max(ownerSize.x(), 0))
                                       : static_cast<SizeT>(std::max(ownerSize.x(), 0)) *
                                             static_cast<SizeT>(std::max(ownerSize.y(), 0));
-        const SizeT offset = static_cast<SizeT>(m_viewMinLayer) * layerTexels * bytesPerTexel;
+        const SizeT offset = static_cast<SizeT>(layerIndex) * layerTexels * bytesPerTexel;
         return offset < ownerBytes ? offset : 0;
     }
 
-    IntVec3 TextureObjectView::ToOwnerRegionOffset(const IntVec3& viewOffset) const {
-        if (m_viewMinLayer == 0) return viewOffset;
+    IntVec3 TextureObjectView::ToOwnerRegionOffset(TextureUploadTarget viewTarget, const IntVec3& viewOffset) const {
+        const Uint layerIndex = ViewLayerIndex(viewTarget);
+        if (layerIndex == 0) return viewOffset;
         IntVec3 offset = viewOffset;
         // The dirty region is recorded in the OWNER's blob coordinates - that is the space its
-        // upload path walks - so the view's layer origin has to be added here even though
+        // upload path walks - so the layer this view target names has to be added here even though
         // MapMipmapData hands back an already-shifted POINTER. The two are not double-counting:
-        // one moves the bytes, the other tells the owner which of its layers moved.
+        // one moves the bytes, the other tells the owner which of its layers moved. They must agree
+        // on the layer, which is why both ask ViewLayerIndex rather than reading m_viewMinLayer -
+        // on a cube-map view the face is half the answer.
         switch (LayerAxisOf(m_storageOwner->GetTarget())) {
         case LayerAxis::Y:
-            offset.y() += static_cast<Int>(m_viewMinLayer);
+            offset.y() += static_cast<Int>(layerIndex);
             break;
         case LayerAxis::Z:
-            offset.z() += static_cast<Int>(m_viewMinLayer);
+            offset.z() += static_cast<Int>(layerIndex);
             break;
         case LayerAxis::None:
             break;
@@ -300,7 +313,7 @@ namespace MobileGL::MG_State::GLState {
                                                    IntVec3 size) {
         if (m_ownerMipmap == nullptr) return;
         m_ownerMipmap->MarkStorageDirtyRegion(ToOwnerUploadTarget(uploadTarget), ToOwnerLevel(mipmapLevel),
-                                              ToOwnerRegionOffset(offset), size);
+                                              ToOwnerRegionOffset(uploadTarget, offset), size);
     }
 
     MipmapDirtyRegion TextureObjectView::GetStorageDirtyRegion(TextureUploadTarget uploadTarget,

MobileGL/MG_State/GLState/TextureState/TextureObjectView.h

@@ -103,6 +103,18 @@ namespace MobileGL::MG_State::GLState {
         // target - arrays and cube-map arrays included - keeps all its layers in one blob, so
         // the mapping is "the owner's only target" unless one of the two sides is a cube map.
         TextureUploadTarget ToOwnerUploadTarget(TextureUploadTarget viewTarget) const;
+        // WHICH of the owner's layers a given view-side upload target names, in the owner's layer
+        // numbering. For every view target but a cube map that is just this view's layer origin -
+        // one target, one layer. A GL_TEXTURE_CUBE_MAP view addresses SIX of the owner's layers at
+        // once (GL 4.6 core 8.18), so the face its target token names is an index on top of that
+        // origin, and this is the only place that can express it when the owner keeps every layer
+        // in one blob: ToOwnerUploadTarget has a single blob to choose from there, so the face
+        // would otherwise vanish and all six tokens would read the view's first layer.
+        //
+        // Every place that turns this view into owner-side bytes goes through here - the blob
+        // choice, the byte offset, and the dirty region - so the three cannot disagree about which
+        // layer a face is.
+        Uint ViewLayerIndex(TextureUploadTarget viewTarget) const;
         Uint ToOwnerLevel(Uint viewLevel) const { return m_viewMinLevel + viewLevel; }
         // The owner's level extent rewritten into this view's shape: the owner's layer axis is
         // collapsed to one slice and the view's own layer count is imposed on the view's layer
@@ -114,8 +126,10 @@ namespace MobileGL::MG_State::GLState {
         // and a single row for a 1D array; a cube-map owner returns 0 because its faces are
         // separate blobs that ToOwnerUploadTarget already selects between.
         SizeT LayerByteOffset(TextureUploadTarget viewTarget, Uint mipmapLevel) const;
-        // A dirty-region origin moved from the view's layer space into the owner's.
-        IntVec3 ToOwnerRegionOffset(const IntVec3& viewOffset) const;
+        // A dirty-region origin moved from the view's layer space into the owner's. Takes the view
+        // target for the same reason LayerByteOffset does: on a cube-map view the target names the
+        // face, and the region has to name the same owner layer the bytes were written to.
+        IntVec3 ToOwnerRegionOffset(TextureUploadTarget viewTarget, const IntVec3& viewOffset) const;
 
         SharedPtr<ITextureObject> m_storageOwner;
         // Non-owning; m_storageOwner keeps it alive and is never a view, so this is set once in