Merge branch "feat/cts-followup-fp64-ds-imgbuf" into dev

CMakeLists.txt

@@ -284,6 +284,7 @@ set(SOURCE_FILES
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/RebaseInstanceIndexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/ZeroBaseVertexPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/NormalizeRectCoordinatesPass.cpp
+    MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/Lower1DArrayImagesPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/PrivateToEntryLocalPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/StripUniformLocationsPass.cpp
     MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/StripUboMemberRelaxedPrecisionPass.cpp

MobileGL/Config.h

@@ -117,6 +117,13 @@ namespace MobileGL::MG_Config {
         // per-draw glBufferSubData path instead of the persistent-mapped ring allocator
         // (negative control / driver-bug escape hatch).
         Bool DisableUboRing = false;
+        // MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION: make DirectGLES skip the native ES
+        // depth/stencil reads and always go through the shader-sampling emulation. Core GL
+        // ES has no depth or stencil readback, but some drivers accept it anyway (Mesa does,
+        // Adreno does not), which means the emulation is dead code on exactly the stack the
+        // headless suite runs on. This forces it live so the scenarios and the CTS can
+        // exercise the path, and gives the device an A/B lever over the same choice.
+        Bool EsprytForceDepthStencilReadbackEmulation = false;
         // MOBILEGL_RELAXED_SEMANTICS: relax strict core-profile rules (e.g. VAO-0 draws,
         // texture-name reuse after delete) even on contexts that explicitly requested a core
         // profile. Without it, relaxed semantics still apply to every context that did not

MobileGL/ConfigLoader.cpp

@@ -176,6 +176,8 @@ namespace MobileGL::MG_ConfigLoader {
         features.CoherentAsFlush = QueryEnvFlag("MOBILEGL_COHERENT_AS_FLUSH");
         features.TraceSkipAutodestroy = QueryEnvFlag("MOBILEGL_TRACE_SKIP_AUTODESTROY");
         features.DisableUboRing = QueryEnvFlag("MOBILEGL_DISABLE_UBO_RING");
+        features.EsprytForceDepthStencilReadbackEmulation =
+            QueryEnvFlag("MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION");
         features.RelaxedSemantics = QueryEnvFlag("MOBILEGL_RELAXED_SEMANTICS");
         features.SubgroupPrefixScanQuirk = QueryEnvQuirkOverride("MOBILEGL_QUIRK_SUBGROUP_PREFIX_SCAN");
         features.MagmaDisableBlendedDepthWriteQuirk =

MobileGL/MG_Backend/DirectGLES/BackendObject_DirectGLES.cpp

@@ -940,6 +940,17 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // picks a whole different shader for draw_buffers without
             // explicit_attrib_location. DirectVulkan advertises both.
             E_GL_ARB_explicit_attrib_location, E_GL_ARB_texture_multisample, E_GL_ARB_shader_image_size,
+            // Core since GL 3.1 and implemented for every version advertised here. The string
+            // matters because applications gate the ENTRY POINTS on it rather than on the
+            // version: a caller that finds the extension missing never resolves
+            // glGetUniformBlockIndex / glUniformBlockBinding, and one that then uses uniform
+            // blocks anyway calls through a null pointer.
+            E_GL_ARB_uniform_buffer_object,
+            // Sampling the stencil aspect through DEPTH_STENCIL_TEXTURE_MODE. Core from 4.3,
+            // so on a 4.0 context the string is the only way to reach it. The host ES driver
+            // has had the same texture parameter since ES 3.1, which every device MobileGL
+            // runs on provides.
+            E_GL_ARB_stencil_texturing,
             // Advertised with GL_NUM_PROGRAM_BINARY_FORMATS = 0, which the
             // extension explicitly permits. It is also the only thing that
             // exposes glProgramParameteri before GL 4.1.

MobileGL/MG_Backend/DirectGLES/Managers.cpp

@@ -358,8 +358,9 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 // Require working fences: recycling is gated on the frame-completion
                 // watermark, which only advances if Present can insert/poll fences.
                 return g_GLESFuncs.glFenceSync != nullptr && g_GLESFuncs.glGetSynciv != nullptr &&
-                       r.id != 0 && !r.persistentMapped && r.contextGeneration == g_bufferContextGeneration &&
+                       r.id != 0 && !r.persistentMapped && !r.immutableStorage &&
-                       r.storageInitialized && r.storageSize > 0 && r.storageSize <= kMaxPoolableBufferBytes;
+                       r.contextGeneration == g_bufferContextGeneration && r.storageInitialized &&
+                       r.storageSize > 0 && r.storageSize <= kMaxPoolableBufferBytes;
             }
 
             // Retire a buffer id into the pool (owning thread; caller verified IsPoolable).
@@ -555,6 +556,17 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     resource = created.get();
                     bufferObject.SetBackendResource(std::move(created));
                 }
+                // Before the generation is stamped, not after: everything on the resource
+                // describes a context that is gone, and the idempotency check below would
+                // otherwise hand the caller the dead context's mapped pointer.
+                if (resource->contextGeneration != g_bufferContextGeneration) {
+                    resource->id = 0;
+                    resource->persistentMapped = false;
+                    resource->persistentPtr = nullptr;
+                    resource->immutableStorage = false;
+                    resource->storageInitialized = false;
+                    resource->storageSize = 0;
+                }
                 resource->contextGeneration = g_bufferContextGeneration;
 
                 if (resource->persistentMapped && resource->persistentPtr && resource->storageSize == size) {
@@ -564,9 +576,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 // Need a fresh id: glBufferStorage fails on a buffer that already has
                 // immutable storage, and any prior mutable store is replaced anyway.
                 if (resource->id != 0) {
-                    ScrubBufferBindingShadowsForId(resource->id);
+                    NoteBufferIdDeleted(resource->id);
                     g_GLESFuncs.glDeleteBuffers(1, &resource->id);
                     resource->id = 0;
+                    resource->immutableStorage = false;
                 }
                 g_GLESFuncs.glGenBuffers(1, &resource->id);
                 if (resource->id == 0) return nullptr;
@@ -578,6 +591,10 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 g_GLESFuncs.glBufferStorageEXT(TempBufferTarget, static_cast<GLsizeiptr>(size), initial,
                                                GL_MAP_WRITE_BIT | kMapPersistentBit | kMapCoherentBit |
                                                    kDynamicStorageBit);
+                // Set as soon as the store exists, not once the map succeeds: the failure
+                // path below leaves this id holding immutable storage, and whoever touches
+                // it next has to know that glBufferData cannot redefine it.
+                resource->immutableStorage = true;
                 void* ptr = g_GLESFuncs.glMapBufferRange(TempBufferTarget, 0, static_cast<GLsizeiptr>(size),
                                                          GL_MAP_WRITE_BIT | kMapPersistentBit | kMapCoherentBit);
                 if (!ptr) {
@@ -603,7 +620,37 @@ namespace MobileGL::MG_Backend::DirectGLES {
             void Ops_Respecify(BufferObject& bufferObject) {
                 auto* resource = ResourceOf(bufferObject);
                 if (!resource) return; // lazy: EnsureBufferResource full-uploads on creation
-                if (resource->persistentMapped) return; // immutable persistent storage is never respecified
+                // The frontend hands an adopted mapping back before it redefines the store
+                // (BufferObject::RedefineStorage), so a resource that still carries the
+                // persistent state here describes the OLD store - and its storage is
+                // IMMUTABLE (glBufferStorageEXT), which the glBufferData below cannot
+                // respecify and which the driver would refuse in silence. Retire the id so
+                // EnsureBufferResource mints a mutable one, with a full upload from the
+                // shadow the frontend has just filled.
+                //
+                // Keyed on the STORAGE, not on persistentMapped: a glMapBufferRange that
+                // failed after its glBufferStorageEXT succeeded clears persistentMapped and
+                // still leaves an immutable store behind, and that one reached glBufferData.
+                if (resource->immutableStorage) {
+                    resource->persistentMapped = false;
+                    resource->persistentPtr = nullptr;
+                    if (resource->id != 0 && CanTouchGLNow() &&
+                        resource->contextGeneration == g_bufferContextGeneration) {
+                        NoteBufferIdDeleted(resource->id);
+                        g_GLESFuncs.glDeleteBuffers(1, &resource->id);
+                        resource->id = 0;
+                        resource->immutableStorage = false;
+                    }
+                    // Off the context thread the id cannot be deleted here, and dropping it
+                    // would leak an immutable, persistently mapped store. It stays put, and
+                    // stays flagged, until EnsureBufferResource retires it on the thread
+                    // that owns the context.
+                    resource->storageInitialized = false;
+                    resource->storageSize = 0;
+                    resource->pendingRespecify = true;
+                    resource->pendingRanges.clear();
+                    return;
+                }
                 if (!CanTouchGLNow() || resource->id == 0 ||
                     resource->contextGeneration != g_bufferContextGeneration) {
                     resource->pendingRespecify = true;
@@ -899,6 +946,21 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 // frontend re-acquires a fresh one on its next map.
                 resource->persistentMapped = false;
                 resource->persistentPtr = nullptr;
+                resource->immutableStorage = false;
+            }
+
+            // An immutable store nothing maps any more: a respecification of a buffer that
+            // had been persistently mapped, which Ops_Respecify could not retire because it
+            // ran off the context thread. glBufferData cannot redefine it, so it is retired
+            // here, on the thread that can, and the id is re-minted below.
+            if (resource->immutableStorage && !resource->persistentMapped && resource->id != 0) {
+                NoteBufferIdDeleted(resource->id);
+                g_GLESFuncs.glDeleteBuffers(1, &resource->id);
+                resource->id = 0;
+                resource->immutableStorage = false;
+                resource->storageInitialized = false;
+                resource->storageSize = 0;
+                resource->pendingRespecify = true;
             }
 
             // Zero-copy coherent persistent buffer: the app writes straight into the
@@ -1902,6 +1964,20 @@ namespace MobileGL::MG_Backend::DirectGLES {
             m_isInitialized = false;
             m_backendStorageImmutable = false;
             m_prevTextureInfo = {};
+            // The new ES texture starts at the ES defaults, so every parameter this object had
+            // already pushed onto the old one is gone. The change-detection caches below would
+            // otherwise still claim those values are in force and SyncTextureParamsToBackend
+            // would skip the whole pass on the unchanged params version, leaving the driver
+            // texture at defaults for the rest of its life. Latent for swizzle, LOD range and
+            // border colour long before GL_DEPTH_STENCIL_TEXTURE_MODE joined them; the mode
+            // makes it visible because falling back to the default silently samples the wrong
+            // aspect rather than merely mis-filtering.
+            m_cacheLodRange = {0, 1000};
+            m_cacheBorderColor = {0.0f, 0.0f, 0.0f, 0.0f};
+            m_cacheSwizzleParams = {TextureSwizzleParam::Red, TextureSwizzleParam::Green, TextureSwizzleParam::Blue,
+                                    TextureSwizzleParam::Alpha};
+            m_cacheDepthStencilTextureMode = GL_DEPTH_COMPONENT;
+            m_forceTextureParamsResync = true;
         }
 
         // Sets the backend GL unpack state to MobileGL's upload default for the scope,
@@ -3154,11 +3230,12 @@ namespace MobileGL::MG_Backend::DirectGLES {
             }
 
             Uint16 currentTextureParamsVersion = stateTextureObject->GetTextureParamsVersion();
-            if (m_syncedTextureParamsVersion == currentTextureParamsVersion) {
+            if (m_syncedTextureParamsVersion == currentTextureParamsVersion && !m_forceTextureParamsResync) {
                 MGLOG_D("Texture parameters have not changed for texture ID: %u, skipping sync.", m_backendTextureId);
                 return;
             }
             m_syncedTextureParamsVersion = currentTextureParamsVersion;
+            m_forceTextureParamsResync = false;
 
             MGLOG_D("Syncing texture params with backend ID %u to backend for state ID %u", m_backendTextureId,
                     stateTextureObject->GetExternalIndex());
@@ -3253,6 +3330,29 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     MGLOG_D("%s(%s:%d) ES error %s", func, file, line, MG_Util::ConvertGLEnumToString(err).c_str());
                 });
             }
+
+            // GL_DEPTH_STENCIL_TEXTURE_MODE (GL_ARB_stencil_texturing / ES 3.1 core): which aspect
+            // of a packed depth/stencil image a sampler reads. Until this was forwarded the
+            // frontend kept the mode as a pure shadow - glGetTexParameter answered it, sampling
+            // ignored it - so a usampler2D bound to a D24S8 texture in STENCIL_INDEX mode read the
+            // depth aspect. Texture state rather than sampler state, so multisample targets take
+            // it too (ES 3.1 8.10 lists it among the three pnames they accept). It is only sent
+            // when it has moved, which for the overwhelming majority of textures is never.
+            const Bool supportsStencilTextureMode =
+                g_GLESCapabilities.GLESVersion.Major > 3 ||
+                (g_GLESCapabilities.GLESVersion.Major == 3 && g_GLESCapabilities.GLESVersion.Minor >= 1);
+            if (supportsStencilTextureMode) {
+                const GLenum depthStencilTextureMode = stateTextureObject->GetDepthStencilTextureMode();
+                if (m_cacheDepthStencilTextureMode != depthStencilTextureMode) {
+                    g_GLESFuncs.glTexParameteri(target, GL_DEPTH_STENCIL_TEXTURE_MODE,
+                                                static_cast<GLint>(depthStencilTextureMode));
+                    m_cacheDepthStencilTextureMode = depthStencilTextureMode;
+                    DebugImpl::ErrorLopper::Loop([file = __FILE__, line = __LINE__, func = __func__](GLenum err) {
+                        MGLOG_D("%s(%s:%d) ES error %s", func, file, line,
+                                MG_Util::ConvertGLEnumToString(err).c_str());
+                    });
+                }
+            }
         }
 
         void ActivateTextureUnit(Uint unit) {
@@ -4605,6 +4705,20 @@ namespace MobileGL::MG_Backend::DirectGLES {
                     effectiveSpirv = &rectLoweredSpirv;
                 }
 
+                // ES has no 1D texture at all, so a 1D ARRAY is stored as a 2D array with height
+                // 1 (MapToBackendTextureTarget / GetBackendUploadSize). SPIRV-Cross emulates 1D
+                // as 2D for images without ever asking whether the type is arrayed, so a
+                // 1D-array image comes out as ivec2(ivec2(u, layer), 0) - three components in a
+                // two-component constructor, which every driver rejects, taking the whole
+                // program with it. The pass does the conversion properly - type to 2D array,
+                // coordinate to (u, 0, layer) - before SPIRV-Cross can apply its own.
+                Vector<unsigned int> arrayImageSpirv;
+                if (MG_Util::ShaderTranspiler::ShaderCompiler::Lower1DArrayImagesForEssl(*effectiveSpirv,
+                                                                                          arrayImageSpirv) &&
+                    !arrayImageSpirv.empty()) {
+                    effectiveSpirv = &arrayImageSpirv;
+                }
+
                 // GLSL ES demands a constant integral expression to index a fragment output
                 // array; SPIR-V does not, so a shader that writes coeff[i] from a loop
                 // reaches SPIRV-Cross intact and comes out as ESSL a strict driver rejects

MobileGL/MG_Backend/DirectGLES/Managers.h

@@ -286,6 +286,14 @@ namespace MobileGL::MG_Backend::DirectGLES {
             // context loss.
             Bool persistentMapped = false;
             void* persistentPtr = nullptr;
+            // The GL store behind `id` was created with glBufferStorageEXT and is
+            // therefore IMMUTABLE - glBufferData cannot respecify it and it must never be
+            // recycled through the size-keyed buffer pool. Tracked separately from
+            // persistentMapped because the two come apart: a glMapBufferRange that fails
+            // after its glBufferStorageEXT succeeded leaves immutable storage behind with
+            // no map, and a respecification then has to retire the id rather than hand it
+            // to glBufferData, which the driver would silently refuse.
+            Bool immutableStorage = false;
         };
 
         // Registered as the frontend's BufferBackendOps at backend init and on
@@ -691,8 +699,18 @@ namespace MobileGL::MG_Backend::DirectGLES {
             FloatVec4 m_cacheBorderColor = {0.0f, 0.0f, 0.0f, 0.0f};
             Vec4<TextureSwizzleParam> m_cacheSwizzleParams = {TextureSwizzleParam::Red, TextureSwizzleParam::Green,
                                                               TextureSwizzleParam::Blue, TextureSwizzleParam::Alpha};
+            // GL_DEPTH_STENCIL_TEXTURE_MODE. GL_DEPTH_COMPONENT is the GL and ES default, so a
+            // texture that never asks for the stencil aspect never emits the call. The
+            // depth/stencil readback and replicate-blit emulations also write this parameter
+            // raw, but only ever on their own scratch textures (never on an application
+            // texture), so they cannot desynchronise this cache.
+            GLenum m_cacheDepthStencilTextureMode = GL_DEPTH_COMPONENT;
             Uint16 m_syncedSamplerVersion = 0;
             Uint16 m_syncedTextureParamsVersion = 0;
+            // Set when the driver texture underneath was regenerated and has therefore lost every
+            // parameter already pushed onto it: the params-version early-out has to be overridden
+            // once, or an unchanged version would skip the re-push forever.
+            Bool m_forceTextureParamsResync = false;
         };
 
         void ActivateTextureUnit(Uint unit);

MobileGL/MG_Backend/DirectGLES/Utils.cpp

@@ -417,10 +417,27 @@ namespace MobileGL::MG_Backend::DirectGLES {
                 result = std::regex_replace(result, pattern, "$1flat $2");
             };
 
+            // Every stage that has an integer interface at all, on BOTH sides. Interpolation is
+            // only ever consumed at a fragment input, so the qualifier is semantically inert on
+            // a tessellation or geometry interface - but an ES linker still compares the two
+            // sides of every interface and rejects a program whose producer says `flat` and
+            // whose consumer does not. Covering only the stages that "need" it left exactly two
+            // holes, and a program that used tessellation fell into both:
+            //   vertex `flat out uint` -> tess-control `in uint`   (producer flat, consumer not)
+            //   tess-eval `out uint`   -> geometry `flat in uint`  (consumer flat, producer not)
+            // Adreno answers "output ... interpolation mismatch with other stage" and the whole
+            // program fails to link, which is a draw that silently paints nothing.
+            //
+            // Adding rather than stripping, because a fragment input's `flat` is load-bearing
+            // (ESSL forbids an interpolated integer) and would have to be put back for the last
+            // stage before the fragment shader anyway - so "everything integer is flat" is the
+            // one rule that is consistent no matter which stages a program happens to have.
             switch (shaderType) {
             case GL_VERTEX_SHADER:
                 addFlatQualifier("out");
                 break;
+            case GL_TESS_CONTROL_SHADER:
+            case GL_TESS_EVALUATION_SHADER:
             case GL_GEOMETRY_SHADER:
                 addFlatQualifier("in");
                 addFlatQualifier("out");

MobileGL/MG_Backend/DirectVulkan/BackendObject_DirectVulkan.cpp

@@ -517,6 +517,15 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             E_GL_ARB_gpu_shader_int64, E_GL_KHR_debug, E_GL_ARB_gpu_shader5, E_GL_ARB_multi_bind,
             E_GL_ARB_shading_language_420pack, E_GL_ARB_vertex_attrib_binding, E_GL_ARB_shader_image_size,
             E_GL_ARB_explicit_attrib_location,
+            // Core since GL 3.1 and implemented for every version advertised here. The string
+            // matters because applications gate the ENTRY POINTS on it rather than on the
+            // version: a caller that finds the extension missing never resolves
+            // glGetUniformBlockIndex / glUniformBlockBinding, and one that then uses uniform
+            // blocks anyway calls through a null pointer.
+            E_GL_ARB_uniform_buffer_object,
+            // Sampling the stencil aspect through DEPTH_STENCIL_TEXTURE_MODE. Core from 4.3,
+            // so on a 4.0 context the string is the only way to reach it.
+            E_GL_ARB_stencil_texturing,
             // Advertised with GL_NUM_PROGRAM_BINARY_FORMATS = 0, which the
             // extension explicitly permits. It is also the only thing that
             // exposes glProgramParameteri before GL 4.1.

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.cpp

@@ -1721,6 +1721,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 return ProgramFactory::DescriptorBindingKind::CombinedImageSampler;
             case SPV_REFLECT_DESCRIPTOR_TYPE_UNIFORM_TEXEL_BUFFER:
                 return ProgramFactory::DescriptorBindingKind::UniformTexelBuffer;
+            case SPV_REFLECT_DESCRIPTOR_TYPE_STORAGE_TEXEL_BUFFER:
+                return ProgramFactory::DescriptorBindingKind::StorageTexelBuffer;
             case SPV_REFLECT_DESCRIPTOR_TYPE_STORAGE_BUFFER:
                 return ProgramFactory::DescriptorBindingKind::StorageBuffer;
             case SPV_REFLECT_DESCRIPTOR_TYPE_STORAGE_IMAGE:
@@ -1750,6 +1752,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
             if (kind == ProgramFactory::DescriptorBindingKind::CombinedImageSampler ||
                 kind == ProgramFactory::DescriptorBindingKind::UniformTexelBuffer ||
+                kind == ProgramFactory::DescriptorBindingKind::StorageTexelBuffer ||
                 kind == ProgramFactory::DescriptorBindingKind::StorageImage) {
                 const auto arraySuffix = name.find("[0]");
                 if (arraySuffix != String::npos) {
@@ -1839,8 +1842,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     // UniformManager::BindProgramUniformBuffers: UBO instance arrays
                     // (uniform Block {...} b[N];), storage-block instance arrays, image uniform
                     // arrays, and combined-image-sampler arrays (uniform sampler2D s[N];).
-                    // Anything else - a uniform TEXEL buffer array is the one remaining kind -
+                    // Anything else - the two TEXEL buffer kinds are what remain, samplerBuffer[N]
-                    // must fail program creation cleanly rather than continue with corrupt state.
+                    // and imageBuffer[N] - must fail program creation cleanly rather than continue
+                    // with corrupt state. Their per-draw path writes pTexelBufferView as the
+                    // address of a vector element sized for one descriptor per binding, so an
+                    // array would not merely be unresolved, it would dangle.
                     //
                     // Getting listed here is not cosmetic: a kind that is rejected leaves
                     // GetOrCreateProgram's MOBILEGL_ASSERT(remapOk) as the only complaint, and
@@ -2661,6 +2667,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 const auto descriptorKind = ReflectDescriptorTypeToBindingKind(sampler->descriptor_type);
                 if (descriptorKind != DescriptorBindingKind::CombinedImageSampler &&
                     descriptorKind != DescriptorBindingKind::UniformTexelBuffer &&
+                    descriptorKind != DescriptorBindingKind::StorageTexelBuffer &&
                     descriptorKind != DescriptorBindingKind::StorageImage &&
                     descriptorKind != DescriptorBindingKind::StorageBuffer) {
                     continue;
@@ -2790,6 +2797,29 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                     }
                 }
 
+                if (descriptorKind == DescriptorBindingKind::StorageTexelBuffer) {
+                    // Only the declared format is recorded, and only so the per-draw resolve can
+                    // prefer it over the one glBindImageTexture named. Everything the StorageImage
+                    // branch above does about ARRAYS is deliberately absent: an imageBuffer array
+                    // is refused outright by the array gate in RemapDescriptorBindingsForVulkan,
+                    // exactly as a samplerBuffer array is, so bindingDescriptorCounts stays at the
+                    // default 1 and the descriptor write below may take the address of a vector
+                    // element without reserving room for extra elements.
+                    const VkFormat reflectedFormat =
+                        ConvertSpirvImageFormatToVkFormat(sampler->image.image_format);
+                    VkFormat& existingFormat = entry.storageImageFormatByBinding[binding];
+                    MOBILEGL_ASSERT(existingFormat == VK_FORMAT_UNDEFINED ||
+                                        reflectedFormat == VK_FORMAT_UNDEFINED ||
+                                        existingFormat == reflectedFormat,
+                                    "ProgramFactory::ReflectLayout: storage texel buffer binding %u ('%s') "
+                                    "has conflicting reflected formats (%d vs %d)",
+                                    binding, uniformName.c_str(), static_cast<Int>(existingFormat),
+                                    static_cast<Int>(reflectedFormat));
+                    if (existingFormat == VK_FORMAT_UNDEFINED) {
+                        existingFormat = reflectedFormat;
+                    }
+                }
+
                 const TextureTarget target = UniformTypeToTextureTarget(uniformType);
                 MOBILEGL_ASSERT(target != TextureTarget::Unknown,
                                 "ProgramFactory::ReflectLayout: failed to resolve texture target for '%s'",
@@ -2867,6 +2897,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 entry.dynamicBindings.push_back(binding);
             } else if (kind == DescriptorBindingKind::UniformTexelBuffer) {
                 layoutBinding.descriptorType = VK_DESCRIPTOR_TYPE_UNIFORM_TEXEL_BUFFER;
+            } else if (kind == DescriptorBindingKind::StorageTexelBuffer) {
+                layoutBinding.descriptorType = VK_DESCRIPTOR_TYPE_STORAGE_TEXEL_BUFFER;
             } else if (kind == DescriptorBindingKind::StorageBuffer) {
                 layoutBinding.descriptorType = VK_DESCRIPTOR_TYPE_STORAGE_BUFFER;
             } else if (kind == DescriptorBindingKind::StorageImage) {

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.h

@@ -33,7 +33,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             CombinedImageSampler,
             UniformTexelBuffer,
             StorageBuffer,
-            StorageImage
+            StorageImage,
+            // GLSL `imageBuffer` - a buffer texture reached through an IMAGE unit rather than a
+            // texture unit. Vulkan spells it VK_DESCRIPTOR_TYPE_STORAGE_TEXEL_BUFFER, which is a
+            // VkBufferView like UniformTexelBuffer and not a VkImageView like StorageImage: it is
+            // the one image uniform whose descriptor is a buffer. Appended, never inserted -
+            // DescriptorKeyHash mixes the enumerator's value.
+            StorageTexelBuffer
         };
 
         enum class CompileOptionBit : Uint {
@@ -103,6 +109,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             Vector<Int> samplerUniformLocationByBinding;
             Vector<TextureTarget> samplerTextureTargetByBinding;
             Vector<SamplerNumericDomain> samplerNumericDomainByBinding;
+            // Shared by StorageImage and StorageTexelBuffer bindings: a binding is one kind or
+            // the other, never both, and both need exactly the same thing - the format the
+            // shader declared, so the per-draw resolve can tell a typed declaration from a
+            // formatless one. Kept as one pair rather than two so the move operations below
+            // cannot drift out of sync with a field that only one kind populates.
             Vector<VkFormat> storageImageFormatByBinding;
             Vector<Bool> storageImageUsesBindingFormatByBinding;
             Vector<String> storageBlockNameByBinding;

MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.cpp

@@ -743,6 +743,150 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         return true;
     }
 
+    // GLSL `imageBuffer`. The one image uniform whose Vulkan descriptor is a VkBufferView rather
+    // than a VkImageView, so it is half ResolveStorageImageDescriptor (the resource comes from an
+    // IMAGE unit, i.e. from glBindImageTexture, not from a texture unit) and half
+    // ResolveTexelBufferDescriptor (the descriptor is a buffer view over the GL buffer the
+    // texture is attached to).
+    //
+    // Before this existed the descriptor kind reflected as SPV_REFLECT_DESCRIPTOR_TYPE_STORAGE_-
+    // TEXEL_BUFFER and fell into ReflectDescriptorTypeToBindingKind's `default:`, whose only
+    // complaint is an assert that compiles out above DEBUG - so a release build declared no
+    // binding at all for a uniform the shader still read, and lavapipe segfaulted inside pipeline
+    // creation on the JIT worker thread. KHR-GL44.multi_bind.dispatch_bind_image_textures is the
+    // case that carries it.
+    Bool UniformManager::ResolveStorageTexelBufferDescriptor(const MG_State::GLState::ProgramObject& program,
+                                                             const ProgramFactory::VkProgramObject& programObj,
+                                                             Uint32 binding, Uint32 frameIndex,
+                                                             VkBufferView& outBufferView) {
+        outBufferView = VK_NULL_HANDLE;
+        MOBILEGL_ASSERT(m_bufferManager != nullptr, "ResolveStorageTexelBufferDescriptor: buffer manager is null");
+        MOBILEGL_ASSERT(MG_State::pGLContext != nullptr, "ResolveStorageTexelBufferDescriptor: GL context is null");
+        MOBILEGL_ASSERT(frameIndex < m_frames.size(),
+                        "ResolveStorageTexelBufferDescriptor: frame index out of range");
+        MOBILEGL_ASSERT(binding < programObj.samplerUniformLocationByBinding.size(),
+                        "ResolveStorageTexelBufferDescriptor: binding %u out of range", binding);
+
+        const Int location = programObj.samplerUniformLocationByBinding[binding];
+        if (location < 0) {
+            MGLOG_E("ResolveStorageTexelBufferDescriptor: binding %u ('%s') has no uniform location", binding,
+                    programObj.samplerNameByBinding[binding].c_str());
+            return false;
+        }
+        const Int imageUnit = program.GetUniformSamplerOrImageUnitIndex(static_cast<Uint>(location));
+        if (imageUnit < 0 || imageUnit >= MG_State::GLState::TextureState::MAX_TEXTURE_IMAGE_UNITS) {
+            MGLOG_E("ResolveStorageTexelBufferDescriptor: image unit %d out of range for binding %u", imageUnit,
+                    binding);
+            return false;
+        }
+
+        auto& imageBinding = MG_State::pGLContext->GetImageTextureBinding(imageUnit);
+        const auto& texture = imageBinding.Texture;
+        if (texture == nullptr) {
+            MGLOG_E("ResolveStorageTexelBufferDescriptor: image unit %d is unbound for binding %u", imageUnit,
+                    binding);
+            return false;
+        }
+        if (texture->GetStorageType() != TextureStorageType::Buffer ||
+            texture->GetTarget() != TextureTarget::TextureBuffer) {
+            MGLOG_E("ResolveStorageTexelBufferDescriptor: binding %u ('%s') expected a texture buffer on image "
+                    "unit %d, got textureId=%u target=%d storage=%d",
+                    binding, programObj.samplerNameByBinding[binding].c_str(), imageUnit,
+                    texture->GetExternalIndex(), static_cast<Int>(texture->GetTarget()),
+                    static_cast<Int>(texture->GetStorageType()));
+            return false;
+        }
+
+        auto* textureBuffer = static_cast<MG_State::GLState::TextureObjectBuffer*>(texture.get());
+        const auto& bufferObject = textureBuffer->GetBufferBindingSlot().GetBoundObject();
+        if (bufferObject == nullptr) {
+            MGLOG_E("ResolveStorageTexelBufferDescriptor: texture buffer on image unit %d has no GL buffer bound",
+                    imageUnit);
+            return false;
+        }
+
+        // Unlike the sampled texel buffer, the shader MAY write this one, and those writes land
+        // in GPU memory behind the frontend's CPU shadow - which is what MapBuffer and
+        // GetBufferSubData read. Same two calls, and for the same reason, as the storage-block
+        // path above - but only the residency is unconditional. Marking a GL_READ_ONLY binding
+        // GPU-written would make the next map or readback wait for a dispatch that could not have
+        // changed a byte of it.
+        bufferObject->EnsureGpuResidentStorage();
+        if (imageBinding.Access != GL_READ_ONLY) {
+            bufferObject->MarkGpuWritten();
+        }
+
+        BufferSlice slice{};
+        if (!m_bufferManager->AcquireResidentSlice(BufferKind::TextureBuffer, bufferObject, slice) ||
+            !slice.IsValid()) {
+            MGLOG_E("ResolveStorageTexelBufferDescriptor: failed to sync GL buffer %u for texture buffer %u",
+                    bufferObject->GetExternalIndex(), texture->GetExternalIndex());
+            return false;
+        }
+
+        // The format the SHADER declared wins over the one glBindImageTexture named, on the same
+        // policy as a storage image: a typed `layout(r32ui) uniform uimageBuffer` must be read as
+        // r32ui whatever the texture's own attachment format says. Falling back, in order:
+        // reflected format, then the bind format, then the texture's attached format.
+        MOBILEGL_ASSERT(binding < programObj.storageImageFormatByBinding.size(),
+                        "ResolveStorageTexelBufferDescriptor: binding %u has no reflected format slot", binding);
+        const auto internalFormat = textureBuffer->GetFormat();
+        const VkFormat resourceFormat = MG_Util::ConvertTextureInternalFormatToVkEnum(internalFormat);
+        const VkFormat reflectedFormat = programObj.storageImageFormatByBinding[binding];
+        VkFormat vkFormat = reflectedFormat;
+        if (vkFormat == VK_FORMAT_UNDEFINED && imageBinding.Format != 0) {
+            vkFormat = MG_Util::ConvertTextureInternalFormatToVkEnum(
+                MG_Util::ConvertGLEnumToTextureInternalFormat(imageBinding.Format));
+        }
+        if (vkFormat == VK_FORMAT_UNDEFINED) {
+            vkFormat = resourceFormat;
+        }
+        if (vkFormat == VK_FORMAT_UNDEFINED) {
+            MGLOG_E("ResolveStorageTexelBufferDescriptor: unsupported image buffer format (internal=%d bind=0x%x)",
+                    static_cast<Int>(internalFormat), imageBinding.Format);
+            return false;
+        }
+
+        // Sized from the TEXTURE's attached format even though the view may carry a different
+        // one. That is not a shortcut: GL requires the shader's format qualifier, the format
+        // passed to glBindImageTexture and the texture's own internal format to belong to the
+        // same format CLASS (GL 4.6 core, table 8.27), and every member of a class has the same
+        // texel size. So the three can disagree on interpretation and never on bytes - which is
+        // what the range below has to be a whole multiple of.
+        const VkDeviceSize texelSize =
+            static_cast<VkDeviceSize>(MG_Util::GetSizedInternalFormatSizeInBytes(internalFormat));
+        const VkDeviceSize rangeOffset = static_cast<VkDeviceSize>(textureBuffer->GetBufferRangeOffset());
+        const VkDeviceSize rangeSize = static_cast<VkDeviceSize>(textureBuffer->GetBufferRangeSizeInBytes());
+        VkDeviceSize viewRange = std::min(rangeSize, slice.size > rangeOffset ? slice.size - rangeOffset : 0);
+        if (texelSize > 0) {
+            viewRange = (viewRange / texelSize) * texelSize;
+        }
+        if (viewRange == 0) {
+            MGLOG_E("ResolveStorageTexelBufferDescriptor: texture buffer %u has empty view range",
+                    texture->GetExternalIndex());
+            return false;
+        }
+
+        VkBufferViewCreateInfo viewInfo{};
+        viewInfo.sType = VK_STRUCTURE_TYPE_BUFFER_VIEW_CREATE_INFO;
+        viewInfo.buffer = slice.buffer;
+        viewInfo.format = vkFormat;
+        viewInfo.offset = slice.offset + rangeOffset;
+        viewInfo.range = viewRange;
+
+        VkBufferView bufferView = VK_NULL_HANDLE;
+        const VkResult result = vkCreateBufferView(m_device, &viewInfo, nullptr, &bufferView);
+        if (result != VK_SUCCESS || bufferView == VK_NULL_HANDLE) {
+            MGLOG_E("ResolveStorageTexelBufferDescriptor: vkCreateBufferView failed result=%d format=%d range=%zu",
+                    result, static_cast<Int>(vkFormat), static_cast<SizeT>(viewRange));
+            return false;
+        }
+
+        m_frames[frameIndex].texelBufferViews.push_back(bufferView);
+        outBufferView = bufferView;
+        return true;
+    }
+
     Bool UniformManager::ResolveStorageBufferDescriptor(const MG_State::GLState::ProgramObject& program,
                                                         const ProgramFactory::VkProgramObject& programObj,
                                                         Uint32 binding, Uint32 element,
@@ -1267,7 +1411,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
 
         const Uint32 descriptorCount = static_cast<Uint32>(descriptorCount64);
-        VkDescriptorPoolSize poolSizes[5]{};
+        VkDescriptorPoolSize poolSizes[6]{};
         poolSizes[0].type = VK_DESCRIPTOR_TYPE_UNIFORM_BUFFER_DYNAMIC;
         poolSizes[0].descriptorCount = descriptorCount;
         poolSizes[1].type = VK_DESCRIPTOR_TYPE_COMBINED_IMAGE_SAMPLER;
@@ -1278,6 +1422,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         poolSizes[3].descriptorCount = descriptorCount;
         poolSizes[4].type = VK_DESCRIPTOR_TYPE_STORAGE_IMAGE;
         poolSizes[4].descriptorCount = descriptorCount;
+        poolSizes[5].type = VK_DESCRIPTOR_TYPE_STORAGE_TEXEL_BUFFER;
+        poolSizes[5].descriptorCount = descriptorCount;
 
         VkDescriptorPoolCreateInfo poolInfo{};
         poolInfo.sType = VK_STRUCTURE_TYPE_DESCRIPTOR_POOL_CREATE_INFO;
@@ -1578,6 +1724,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         // is reachable wherever m_maxBindings is small (it clamps to ~16 on Adreno and Mali),
         // which is exactly where a 7-element CTS sampler array does not fit the slack.
         imageInfos.reserve(m_maxBindings + arrayDescriptorExtra);
+        // Exact, and safe only because it is: BOTH texel kinds (samplerBuffer and imageBuffer)
+        // refuse descriptor arrays at program creation, so each contributes at most one view and
+        // the total cannot exceed the binding count. The branches below take the address of
+        // back(), so making a texel kind array-capable without also giving this the surplus
+        // imageInfos gets would dangle every pTexelBufferView already recorded in `writes`.
         texelBufferViews.reserve(m_maxBindings);
         dynamicOffsets.reserve(programObj.dynamicBindings.size() + uboArrayExtra);
 
@@ -1644,6 +1795,25 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                 write.descriptorType = VK_DESCRIPTOR_TYPE_UNIFORM_TEXEL_BUFFER;
                 write.pTexelBufferView = &texelBufferViews.back();
                 writes.push_back(write);
+            } else if (kind == ProgramFactory::DescriptorBindingKind::StorageTexelBuffer) {
+                // Shares texelBufferViews with the sampled kind above, and may do so safely for
+                // the same reason: neither kind can be an array, so each contributes exactly one
+                // element and the reserve of m_maxBindings cannot be outrun - which is what keeps
+                // the &back() below from dangling when a later binding pushes.
+                VkBufferView bufferView = VK_NULL_HANDLE;
+                if (!ResolveStorageTexelBufferDescriptor(program, programObj, binding, frameIndex, bufferView) ||
+                    bufferView == VK_NULL_HANDLE) {
+                    MGLOG_E("UniformDescriptorBinder::BindProgramUniformBuffers failed: image buffer binding %u "
+                            "has no valid descriptor",
+                            binding);
+                    return false;
+                }
+
+                texelBufferViews.push_back(bufferView);
+                fastRebindKindsEligible = false;
+                write.descriptorType = VK_DESCRIPTOR_TYPE_STORAGE_TEXEL_BUFFER;
+                write.pTexelBufferView = &texelBufferViews.back();
+                writes.push_back(write);
             } else if (kind == ProgramFactory::DescriptorBindingKind::StorageBuffer) {
                 // One write per binding, but `descriptorCount` buffer infos: a GLSL block
                 // instance array occupies a single binding whose elements each come from their

MobileGL/MG_Backend/DirectVulkan/Renderer/UniformManager.h

@@ -175,6 +175,14 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         Bool ResolveTexelBufferDescriptor(const MG_State::GLState::ProgramObject& program,
                                           const ProgramFactory::VkProgramObject& programObj, Uint32 binding,
                                           Uint32 frameIndex, VkBufferView& outBufferView);
+        // GLSL `imageBuffer`: the same VkBufferView descriptor as the sampled texel buffer above,
+        // but resolved from an IMAGE unit (glBindImageTexture) rather than a texture unit, and
+        // made GPU-resident-writable because the shader may store to it. No `element` parameter:
+        // an imageBuffer ARRAY is refused at program creation, so a binding is always one
+        // descriptor (see the array gate in RemapDescriptorBindingsForVulkan).
+        Bool ResolveStorageTexelBufferDescriptor(const MG_State::GLState::ProgramObject& program,
+                                                 const ProgramFactory::VkProgramObject& programObj, Uint32 binding,
+                                                 Uint32 frameIndex, VkBufferView& outBufferView);
         // `element` indexes a block INSTANCE array's descriptors; it is 0 for every ordinary
         // block. Each element resolves through its own GL storage block, and so its own GL
         // binding point, buffer and glBindBufferRange window.

MobileGL/MG_Backend/DirectVulkan/Renderer/VkBufferManager.cpp

@@ -23,7 +23,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             VK_BUFFER_USAGE_VERTEX_BUFFER_BIT | VK_BUFFER_USAGE_INDEX_BUFFER_BIT |
             VK_BUFFER_USAGE_UNIFORM_BUFFER_BIT | VK_BUFFER_USAGE_STORAGE_BUFFER_BIT |
             VK_BUFFER_USAGE_INDIRECT_BUFFER_BIT | VK_BUFFER_USAGE_UNIFORM_TEXEL_BUFFER_BIT |
-            VK_BUFFER_USAGE_TRANSFER_SRC_BIT;
+            // "Every usage" has to mean every usage: a buffer texture reached through an IMAGE
+            // unit takes a VK_DESCRIPTOR_TYPE_STORAGE_TEXEL_BUFFER descriptor, and the write is
+            // invalid unless the buffer was created with this bit. Nothing asked for it until
+            // imageBuffer support existed, so the omission was invisible.
+            VK_BUFFER_USAGE_STORAGE_TEXEL_BUFFER_BIT | VK_BUFFER_USAGE_TRANSFER_SRC_BIT;
         // Appended to kPersistentBackedUsage when VK_EXT_transform_feedback is enabled
         // (see VkBufferManagerInitInfo::transformFeedbackUsageEnabled).
         constexpr VkBufferUsageFlags kTransformFeedbackUsage =
@@ -379,6 +383,12 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         BumpSliceEpoch(*resource);
         // Any cached streaming slice refers to the previous contents.
         resource->transientFrameSerial = 0;
+        // Redefining the store hands any adopted mapping back to the CPU shadow
+        // (BufferObject::RedefineStorage), so a buffer that reaches here persistent-mapped
+        // is an ordinary resident one again: it needs the busy-tracking and conditional
+        // orphan below, and the next AcquirePersistentMap has to mint storage for the new
+        // store rather than hand back a mapping of the old one.
+        resource->persistentMapped = false;
         if (!resource->buffer.IsValid()) {
             return; // streaming-only resource: shadow + serial are enough
         }
@@ -708,7 +718,13 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         case BufferKind::Uniform:
             return VK_BUFFER_USAGE_UNIFORM_BUFFER_BIT;
         case BufferKind::TextureBuffer:
-            return VK_BUFFER_USAGE_UNIFORM_TEXEL_BUFFER_BIT;
+            // Both texel roles, for the same reason vertex/index carry both bits: one GL buffer
+            // texture can be read as a samplerBuffer and written as an imageBuffer, and which of
+            // the two it is only becomes known when a shader that uses it is bound - long after
+            // the resident buffer was created. A VkBufferView for a storage-texel descriptor is
+            // invalid unless the buffer was created with the storage bit, so a buffer that
+            // acquired only the uniform bit could never be given one.
+            return VK_BUFFER_USAGE_UNIFORM_TEXEL_BUFFER_BIT | VK_BUFFER_USAGE_STORAGE_TEXEL_BUFFER_BIT;
         case BufferKind::ShaderStorage:
             return VK_BUFFER_USAGE_STORAGE_BUFFER_BIT | VK_BUFFER_USAGE_INDIRECT_BUFFER_BIT;
         case BufferKind::Indirect:

MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.cpp

@@ -950,7 +950,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
 
         const TextureFormatInfo formatInfo = ResolveTextureFormatInfo(texture.GetFormat());
         const VkComponentMapping sampledComponents = ResolveSampledViewComponents(texture, formatInfo);
-        const VkImageAspectFlags sampledAspect = ResolveSampledImageViewAspectMask(resource->aspect);
+        const VkImageAspectFlags sampledAspect =
+            ResolveSampledImageViewAspectMask(resource->aspect, texture.GetDepthStencilTextureMode());
         perMipSampledView = CreateImageView(resource->image, resource->format, sampledAspect, resource->viewType,
                                             mipLevel, 1, 0, resource->arrayLayers, &sampledComponents);
         if (perMipSampledView == VK_NULL_HANDLE) {
@@ -2238,7 +2239,8 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         if (resource.fullView == VK_NULL_HANDLE) {
             return false;
         }
-        const VkImageAspectFlags sampledAspect = ResolveSampledImageViewAspectMask(resource.aspect);
+        const VkImageAspectFlags sampledAspect =
+            ResolveSampledImageViewAspectMask(resource.aspect, texture.GetDepthStencilTextureMode());
         resource.sampledView = CreateImageView(resource.image, resource.format, sampledAspect, resource.viewType,
                                                baseMipLevel, levelCount, 0, resource.arrayLayers, &sampledComponents);
         if (resource.sampledView == VK_NULL_HANDLE) {
@@ -2860,10 +2862,19 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         }
     }
 
-    VkImageAspectFlags VkTextureManager::ResolveSampledImageViewAspectMask(VkImageAspectFlags imageAspect) {
+    VkImageAspectFlags VkTextureManager::ResolveSampledImageViewAspectMask(VkImageAspectFlags imageAspect,
+                                                                           GLenum depthStencilTextureMode) {
         if ((imageAspect & VK_IMAGE_ASPECT_COLOR_BIT) != 0) {
             return VK_IMAGE_ASPECT_COLOR_BIT;
         }
+        // A sampled view of a combined depth/stencil image may name exactly one aspect
+        // (VUID-VkDescriptorImageInfo-imageView-01976), and GL_DEPTH_STENCIL_TEXTURE_MODE is
+        // what picks it - the whole content of GL_ARB_stencil_texturing. Depth stays the
+        // default, so nothing that never sets the mode changes shape. The texture's params
+        // version moves with the mode, which is what makes the cached views be rebuilt.
+        if (depthStencilTextureMode == GL_STENCIL_INDEX && (imageAspect & VK_IMAGE_ASPECT_STENCIL_BIT) != 0) {
+            return VK_IMAGE_ASPECT_STENCIL_BIT;
+        }
         if ((imageAspect & VK_IMAGE_ASPECT_DEPTH_BIT) != 0) {
             return VK_IMAGE_ASPECT_DEPTH_BIT;
         }

MobileGL/MG_Backend/DirectVulkan/Renderer/VkTextureManager.h

@@ -379,7 +379,11 @@ public:
     // true - a false positive merely ends the render pass, a false negative would skip a barrier.
     Bool NeedsStorageImagePreparation(MG_State::GLState::ITextureObject& texture) const;
 
-    static VkImageAspectFlags ResolveSampledImageViewAspectMask(VkImageAspectFlags imageAspect);
+    // `depthStencilTextureMode` is the texture's GL_DEPTH_STENCIL_TEXTURE_MODE; it only decides
+    // anything for an image that carries both aspects. Defaulted so the call sites that have no
+    // texture in hand keep the depth-aspect answer they have always given.
+    static VkImageAspectFlags ResolveSampledImageViewAspectMask(VkImageAspectFlags imageAspect,
+                                                                GLenum depthStencilTextureMode = GL_DEPTH_COMPONENT);
     static VkFormat ResolveSampledImageViewFormat(VkFormat imageFormat, SamplerNumericDomain numericDomain);
     static Bool AreSampledImageViewFormatsCompatible(VkFormat imageFormat, VkFormat viewFormat);
     static Bool AreStorageImageViewFormatsCompatible(VkFormat imageFormat, VkFormat viewFormat);

MobileGL/MG_Impl/GLImpl/Drawing/GL_Drawing.cpp

@@ -1259,7 +1259,15 @@ namespace MobileGL::MG_Impl::GLImpl {
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName, "instancecount must be non-negative."));
             return;
         }
-        if (!MG_State::pGLContext->ValidateTransformFeedbackName(id)) {
+        // "id is not the name of a transform feedback object" has to mean the same thing here
+        // as it does to glIsTransformFeedback, and the two predicates are not interchangeable:
+        // a name glGenTransformFeedbacks handed out is only reserved until it is first bound,
+        // and only the bind turns it into an object (GL 4.6 core 13.2.1). ValidateTransformFeedbackName
+        // answers the reservation question - the right one for glBindTransformFeedback, which is
+        // what turns a reserved name into an object - so using it here let a generated-but-unbound
+        // name through to the completed-span check below and raised INVALID_OPERATION where the
+        // spec asks for INVALID_VALUE. Name 0 is the default object and always drawable.
+        if (id != 0 && !MG_State::pGLContext->IsTransformFeedbackObject(id)) {
             MG_State::pGLContext->RecordError(
                 ErrorCode::InvalidValue,
                 MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", functionName,

MobileGL/MG_Impl/GLImpl/Exporting/Definitions.cpp

@@ -1061,7 +1061,7 @@ DECLARE_GL_FUNCTION_HEAD(void, TextureSubImage1D, GLuint texture, GLint level, G
 DECLARE_GL_FUNCTION_HEAD(void, TextureSubImage2D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLenum type, const void* pixels) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TextureSubImage2D, texture, level, xoffset, yoffset, width, height, format, type, pixels)
 DECLARE_GL_FUNCTION_HEAD(void, TextureSubImage3D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type, const void* pixels) DECLARE_GL_FUNCTION_END_NO_RETURN(void, TextureSubImage3D, texture, level, xoffset, yoffset, zoffset, width, height, depth, format, type, pixels)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureSubImage1D, GLuint texture, GLint level, GLint xoffset, GLsizei width, GLenum format, GLsizei imageSize, const void* data) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureSubImage1D, texture, level, xoffset, width, format, imageSize, data)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureSubImage2D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLsizei imageSize, const void* data) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureSubImage2D, texture, level, xoffset, yoffset, width, height, format, imageSize, data)
+DECLARE_GL_FUNCTION_HEAD(void, CompressedTextureSubImage2D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLsizei imageSize, const void* data) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CompressedTextureSubImage2D, texture, level, xoffset, yoffset, width, height, format, imageSize, data)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureSubImage3D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLsizei imageSize, const void* data) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureSubImage3D, texture, level, xoffset, yoffset, zoffset, width, height, depth, format, imageSize, data)
 DECLARE_GL_FUNCTION_HEAD(void, CopyTextureSubImage1D, GLuint texture, GLint level, GLint xoffset, GLint x, GLint y, GLsizei width) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CopyTextureSubImage1D, texture, level, xoffset, x, y, width)
 DECLARE_GL_FUNCTION_HEAD(void, CopyTextureSubImage2D, GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint x, GLint y, GLsizei width, GLsizei height) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CopyTextureSubImage2D, texture, level, xoffset, yoffset, x, y, width, height)
@@ -1849,7 +1849,7 @@ DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureImage3DEXT, GLuint texture,
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureImage2DEXT, GLuint texture, GLenum target, GLint level, GLenum internalformat, GLsizei width, GLsizei height, GLint border, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureImage2DEXT, texture, target, level, internalformat, width, height, border, imageSize, bits)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureImage1DEXT, GLuint texture, GLenum target, GLint level, GLenum internalformat, GLsizei width, GLint border, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureImage1DEXT, texture, target, level, internalformat, width, border, imageSize, bits)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureSubImage3DEXT, GLuint texture, GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureSubImage3DEXT, texture, target, level, xoffset, yoffset, zoffset, width, height, depth, format, imageSize, bits)
-DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureSubImage2DEXT, GLuint texture, GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureSubImage2DEXT, texture, target, level, xoffset, yoffset, width, height, format, imageSize, bits)
+DECLARE_GL_FUNCTION_HEAD(void, CompressedTextureSubImage2DEXT, GLuint texture, GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width, GLsizei height, GLenum format, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_END_NO_RETURN(void, CompressedTextureSubImage2D, texture, level, xoffset, yoffset, width, height, format, imageSize, bits)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedTextureSubImage1DEXT, GLuint texture, GLenum target, GLint level, GLint xoffset, GLsizei width, GLenum format, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedTextureSubImage1DEXT, texture, target, level, xoffset, width, format, imageSize, bits)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, GetCompressedTextureImageEXT, GLuint texture, GLenum target, GLint lod, void* img) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, GetCompressedTextureImageEXT, texture, target, lod, img)
 DECLARE_GL_FUNCTION_STUB_HEAD(void, CompressedMultiTexImage3DEXT, GLenum texunit, GLenum target, GLint level, GLenum internalformat, GLsizei width, GLsizei height, GLsizei depth, GLint border, GLsizei imageSize, const void* bits) DECLARE_GL_FUNCTION_STUB_END_NO_RETURN(void, CompressedMultiTexImage3DEXT, texunit, target, level, internalformat, width, height, depth, border, imageSize, bits)

MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.cpp

@@ -1376,6 +1376,47 @@ namespace MobileGL::MG_Impl::GLImpl {
         return true;
     }
 
+    // The same rules for the COMPRESSED entry points, whose payload size is the imageSize the
+    // caller passed rather than something derived from a (format, type) pair - and which have no
+    // datum size, so the alignment rule above does not apply to them. Shared by
+    // glCompressedTexImage2D and glCompressedTexSubImage2D so the two cannot drift; the point
+    // that is easy to get wrong and that KHR-GL44.buffer_storage.map_persistent_texture exists to
+    // check is the first one: a PERSISTENT mapping stays a legal transfer source.
+    Bool ValidateCompressedUnpackBufferSource(const void* data, SizeT imageSize, const char* caller) {
+        const auto& unpackBuffer =
+            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::PixelUnpack).GetBoundObject();
+        if (!unpackBuffer) return true;
+
+        if (unpackBuffer->IsMapped() && !(unpackBuffer->GetMappingAccess() & BufferMappingAccessBit::Persistent)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller, "Pixel unpack buffer is currently mapped."));
+            return false;
+        }
+
+        const SizeT offset = reinterpret_cast<SizeT>(data);
+        const SizeT bufferSize = unpackBuffer->GetSize();
+        if (offset > bufferSize || imageSize > bufferSize - offset) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", caller,
+                                             "Unpacking would read past the end of the pixel unpack buffer."));
+            return false;
+        }
+        return true;
+    }
+
+    // Where a compressed upload reads its blocks from: `data` is an offset into the bound unpack
+    // buffer when there is one, and a client pointer otherwise. Only meaningful once
+    // ValidateCompressedUnpackBufferSource has passed. Null means there is nothing to read, which
+    // GL leaves undefined and which callers must not dereference.
+    const void* CompressedUnpackSource(const void* data) {
+        const auto& unpackBuffer =
+            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::PixelUnpack).GetBoundObject();
+        if (!unpackBuffer) return data;
+        return reinterpret_cast<const char*>(unpackBuffer->MappedData()) + reinterpret_cast<SizeT>(data);
+    }
+
     void TexSubImage3D_State(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width,
                              GLsizei height, GLsizei depth, GLenum format, GLenum type, const void* pixels) {
         TextureUploadTarget textureUploadTarget = MG_Util::ConvertGLEnumToTextureUploadTarget(target);
@@ -2238,6 +2279,23 @@ namespace MobileGL::MG_Impl::GLImpl {
             DiscardMipmapChainOnBaseRespecification(textureMipmapObject, textureUploadTarget, level);
             textureMipmapObject->AllocateStorage(textureUploadTarget, level,
                                                  {{width, height, 1}, internalBytes});
+            // GL 4.6 core 8.5: a SPECIFIC compressed internalformat (unlike a generic
+            // GL_COMPRESSED_* one, where the implementation is free to choose) commits the
+            // level to that format - GL_TEXTURE_COMPRESSED must then answer true for it and
+            // GL_TEXTURE_INTERNAL_FORMAT must report it, which is how an application asks for
+            // the size to hand glCompressedTexSubImage2D afterwards. Only the tag and the size
+            // are recorded: there is no BC/ETC codec here, so the texel shadow keeps the
+            // uncompressed storage this format resolved to (which is also what lets the level
+            // sample as the application's texels), and the compressed image the tag describes
+            // is zero-filled - the one reproducible answer glGetCompressedTexImage can give for
+            // an image nothing ever compressed. AllocateStorage above clears the tag, so this
+            // has to follow it.
+            const auto compressedInfo = MG_Util::GetCompressedFormatInfo(static_cast<GLenum>(internalformat));
+            if (compressedInfo.blockWidth != 0) {
+                textureMipmapObject->SetMipmapCompressedImage(
+                    textureUploadTarget, level, static_cast<GLenum>(internalformat), nullptr,
+                    MG_Util::CalculateCompressedTextureImageSize(compressedInfo, {width, height, 1}));
+            }
         }
 
         if (!originalPixels) {
@@ -2965,9 +3023,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_TEXTURE_INTERNAL_FORMAT:
             if (params) {
                 // A level stored compressed must report the token it was given, not the
-                // uncompressed format backing it (GL 4.6 core 8.11). Only glCompressedTexImage* sets
+                // uncompressed format backing it (GL 4.6 core 8.11). glCompressedTexImage2D sets
-                // that tag, so every level created by glTexImage*D - including one given a compressed
+                // that tag, and so does a glTexImage2D given a SPECIFIC compressed internalformat;
-                // internalformat - still answers with its resolved storage format.
+                // every other level answers with its resolved storage format.
                 const GLenum compressedFormat = GetCompressedLevelFormat(textureObject, textureUploadTarget, level);
                 *params = (compressedFormat != GL_NONE)
                               ? (GLint)compressedFormat
@@ -3103,9 +3161,9 @@ namespace MobileGL::MG_Impl::GLImpl {
         case GL_TEXTURE_INTERNAL_FORMAT:
             if (params) {
                 // A level stored compressed must report the token it was given, not the
-                // uncompressed format backing it (GL 4.6 core 8.11). Only glCompressedTexImage* sets
+                // uncompressed format backing it (GL 4.6 core 8.11). glCompressedTexImage2D sets
-                // that tag, so every level created by glTexImage*D - including one given a compressed
+                // that tag, and so does a glTexImage2D given a SPECIFIC compressed internalformat;
-                // internalformat - still answers with its resolved storage format.
+                // every other level answers with its resolved storage format.
                 const GLenum compressedFormat = GetCompressedLevelFormat(textureObject, textureUploadTarget, level);
                 *params = (GLfloat)((compressedFormat != GL_NONE)
                                         ? compressedFormat
@@ -3468,10 +3526,169 @@ namespace MobileGL::MG_Impl::GLImpl {
         RecordUnsupportedCompressedFormat(__func__);
     }
 
+    // Replaces a block-aligned rectangle of the compressed image glCompressedTexImage2D (or a
+    // compressed glTexImage2D) shadowed for this level. Same deviation as the image call it
+    // patches: the uncompressed texel shadow beside it is NOT touched, because there is no
+    // BC/ETC codec here to decode the incoming blocks with - so what changes is the image
+    // glGetCompressedTexImage hands back, not what the level samples as. Marking the texels
+    // dirty would therefore only re-upload bytes that did not change.
     void CompressedTexSubImage2D_State(GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width,
                                        GLsizei height, GLenum format, GLsizei imageSize, const void* data) {
-        // TODO: implement compressed upload - see CompressedTexImage2D_State.
+        // ======================= Converting ================================
+        const auto textureUploadTarget = MG_Util::ConvertGLEnumToTextureUploadTarget(target);
+        const auto textureTarget = MG_Util::ConvertGLEnumToTextureTarget(target);
+        // Zero block width doubles as "format is not a specific compressed format", the
+        // INVALID_ENUM case - one lookup answers both questions.
+        const auto compressedInfo = MG_Util::GetCompressedFormatInfo(format);
+
+        // ===================== Error Checking ==============================
+        if (!TextureImpl::ValidateTextureUploadTarget(textureUploadTarget)) return;
+        // A proxy holds no image to modify; only the glTexImage*/glCompressedTexImage* pair
+        // accepts one.
+        if (TextureImpl::IsProxyTextureTarget(textureUploadTarget)) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidEnum,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "A proxy target has no texture image to modify."));
+            return;
+        }
+        if (!TextureImpl::ValidateTextureLevelNumber(level)) return;
+        if (!TextureImpl::ValidateTextureLevelWithUploadTarget(textureUploadTarget, level)) return;
+        if (width < 0 || height < 0) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "width and height must be non-negative."));
+            return;
+        }
+        if (compressedInfo.blockWidth == 0) {
             RecordUnsupportedCompressedFormat(__func__);
+            return;
+        }
+
+        auto& textureObject = GetTextureObjectByTarget(textureUploadTarget, textureTarget);
+        if (!TextureImpl::ValidateTextureObject(textureObject)) return;
+        auto* textureMipmapObject = MG_State::GLState::AsMipmapTexture(textureObject.get());
+        if (textureMipmapObject == nullptr) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__, "Texture storage is not mipmap-backed."));
+            return;
+        }
+        // GL 4.6 core 8.7: INVALID_OPERATION unless the image being modified is stored in
+        // exactly this compressed format. That is also what makes the block arithmetic below
+        // sound - the level's grid is measured with THIS format's block size.
+        const GLenum levelFormat =
+            textureMipmapObject->GetMipmapCompressedFormat(textureUploadTarget, static_cast<Uint>(level));
+        if (levelFormat != format) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "format does not match the internal format of the texture image."));
+            return;
+        }
+
+        const IntVec3 levelSize = textureMipmapObject->GetMipmapTexelSize(textureUploadTarget, static_cast<Uint>(level));
+        // Written as a subtraction rather than `xoffset + width > levelSize.x()`: both operands
+        // are application-supplied GLints, so the sum is free to overflow, and a signed overflow
+        // is undefined behaviour that a compiler may resolve by assuming the check passes.
+        // levelSize is our own and non-negative, and the offsets are known non-negative by the
+        // time the subtraction runs, so this form cannot wrap.
+        if (xoffset < 0 || yoffset < 0 || width > levelSize.x() - xoffset || height > levelSize.y() - yoffset) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "The replaced region does not lie within the texture image."));
+            return;
+        }
+        // GL 4.6 core 8.7 for block-based formats: the region must start on a block boundary
+        // and must either be a whole number of blocks wide/high or run to the image's edge.
+        const Int blockWidth = static_cast<Int>(compressedInfo.blockWidth);
+        const Int blockHeight = static_cast<Int>(compressedInfo.blockHeight);
+        const Bool alignedX = (xoffset % blockWidth == 0) &&
+                              (width % blockWidth == 0 || xoffset + width == levelSize.x());
+        const Bool alignedY = (yoffset % blockHeight == 0) &&
+                              (height % blockHeight == 0 || yoffset + height == levelSize.y());
+        if (!alignedX || !alignedY) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "The replaced region is not aligned to the format's compressed blocks."));
+            return;
+        }
+        // Exactly the size the format and dimensions imply, which is also what keeps the copy
+        // below in bounds.
+        const SizeT expectedImageSize =
+            MG_Util::CalculateCompressedTextureImageSize(compressedInfo, {width, height, 1});
+        if (imageSize < 0 || static_cast<SizeT>(imageSize) != expectedImageSize) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidValue,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "imageSize does not match the compressed image size."));
+            return;
+        }
+
+        // ======================= Processing ================================
+        if (!ValidateCompressedUnpackBufferSource(data, expectedImageSize, __func__)) return;
+        const void* compressedBytes = CompressedUnpackSource(data);
+        if (expectedImageSize == 0) return; // a zero-sized region is a legal no-op
+        if (compressedBytes == nullptr) {
+            // No unpack buffer and a null client pointer: there is nothing to read. GL leaves
+            // this undefined rather than erroring, and dereferencing it is the one answer that
+            // is never acceptable.
+            MGLOG_D("%s: null data with no pixel unpack buffer bound, nothing to replace", __func__);
+            return;
+        }
+
+        // Once per process: the call is about to succeed, and what it does is narrower than what
+        // an application has every right to expect from it. Before this existed the call answered
+        // GL_INVALID_ENUM, which was wrong but at least visible; a silent success that leaves the
+        // sampled texels untouched is the kind of thing that costs a day to find from the other
+        // end. MGLOG_I, not _W: warnings are compiled out at the level everything ships at.
+        static std::atomic<Bool> announcedNoCodec{false};
+        if (!announcedNoCodec.exchange(true)) {
+            MGLOG_I("%s: the compressed blocks are stored verbatim and returned by "
+                    "glGetCompressedTexImage, but there is no BC/ETC decoder here, so they do not "
+                    "reach the texels this level SAMPLES as. Upload through glTexSubImage2D for "
+                    "that.",
+                    __func__);
+        }
+
+        // The level's compressed image is stored as one blob, so the rectangle is patched into
+        // a copy of it and the whole thing handed back. Compressed sub-image uploads are not a
+        // hot path, and this keeps the storage layer's compressed API to the two calls it has.
+        const SizeT blobSize =
+            textureMipmapObject->GetMipmapCompressedByteSize(textureUploadTarget, static_cast<Uint>(level));
+        const void* existing =
+            textureMipmapObject->MapMipmapCompressedImage(textureUploadTarget, static_cast<Uint>(level));
+        if (blobSize == 0 || existing == nullptr) {
+            MG_State::pGLContext->RecordError(
+                ErrorCode::InvalidOperation,
+                MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
+                                             "The texture level holds no compressed image to modify."));
+            return;
+        }
+        Vector<Uint8> blob(blobSize);
+        Memcpy(blob.data(), existing, blobSize);
+
+        const SizeT blockByteSize = compressedInfo.blockByteSize;
+        const SizeT levelBlocksX = (static_cast<SizeT>(levelSize.x()) + compressedInfo.blockWidth - 1) /
+                                   compressedInfo.blockWidth;
+        const SizeT levelRowBytes = levelBlocksX * blockByteSize;
+        const SizeT regionBlocksX = (static_cast<SizeT>(width) + compressedInfo.blockWidth - 1) /
+                                    compressedInfo.blockWidth;
+        const SizeT regionBlocksY = (static_cast<SizeT>(height) + compressedInfo.blockHeight - 1) /
+                                    compressedInfo.blockHeight;
+        const SizeT firstBlockX = static_cast<SizeT>(xoffset) / compressedInfo.blockWidth;
+        const SizeT firstBlockY = static_cast<SizeT>(yoffset) / compressedInfo.blockHeight;
+        const SizeT regionRowBytes = regionBlocksX * blockByteSize;
+        const auto* source = static_cast<const Uint8*>(compressedBytes);
+        for (SizeT row = 0; row < regionBlocksY; ++row) {
+            const SizeT destOffset = (firstBlockY + row) * levelRowBytes + firstBlockX * blockByteSize;
+            if (destOffset + regionRowBytes > blobSize) break; // a level whose blob predates its size
+            Memcpy(blob.data() + destOffset, source + row * regionRowBytes, regionRowBytes);
+        }
+        textureMipmapObject->SetMipmapCompressedImage(textureUploadTarget, static_cast<Uint>(level), format,
+                                                      blob.data(), blobSize);
     }
 
     void CompressedTexSubImage1D_State(GLenum target, GLint level, GLint xoffset, GLsizei width, GLenum format,
@@ -3564,28 +3781,8 @@ namespace MobileGL::MG_Impl::GLImpl {
         // SetMipmapCompressedImage re-arms it.
         textureMipmapObject->AllocateStorage(textureUploadTarget, level, {{width, height, 1}, internalBytes});
 
-        const void* compressedBytes = data;
+        if (!ValidateCompressedUnpackBufferSource(data, expectedImageSize, __func__)) return;
-        const auto& pixelUnpackBufferObject =
+        const void* compressedBytes = CompressedUnpackSource(data);
-            MG_State::pGLContext->GetBufferBindingSlot(BufferTarget::PixelUnpack).GetBoundObject();
-        if (pixelUnpackBufferObject) {
-            if (pixelUnpackBufferObject->IsMapped()) {
-                MG_State::pGLContext->RecordError(
-                    ErrorCode::InvalidOperation,
-                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
-                                                 "Pixel unpack buffer is currently mapped."));
-                return;
-            }
-            const SizeT offset = reinterpret_cast<SizeT>(data);
-            const SizeT bufferSize = pixelUnpackBufferObject->GetSize();
-            if (offset > bufferSize || expectedImageSize > bufferSize - offset) {
-                MG_State::pGLContext->RecordError(
-                    ErrorCode::InvalidOperation,
-                    MakeUnique<GenericErrorInfo>("MG_Impl/GLImpl", __func__,
-                                                 "Unpacking would read past the end of the pixel unpack buffer."));
-                return;
-            }
-            compressedBytes = reinterpret_cast<const char*>(pixelUnpackBufferObject->MappedData()) + offset;
-        }
         textureMipmapObject->SetMipmapCompressedImage(textureUploadTarget, level, internalformat, compressedBytes,
                                                       expectedImageSize);
         textureMipmapObject->MarkStorageDirty(textureUploadTarget, level, true);
@@ -4095,6 +4292,13 @@ namespace MobileGL::MG_Impl::GLImpl {
         // core 8.19). Allocating only the primary one left the object cube-incomplete, so every
         // framebuffer it was attached to reported GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT. Every other
         // 2D target has exactly one upload target, so this loop is a no-op change for them.
+        // A specific compressed internalformat commits every level it allocates to that
+        // format, the same way glTexImage2D does - and here it matters twice over, because
+        // immutable storage plus glCompressedTexSubImage2D IS the modern way to upload a
+        // compressed texture: without the tag that sub-image call finds an uncompressed
+        // level and refuses it. Zero width means a generic (implementation's choice)
+        // format, which MobileGL answers with uncompressed storage, so it is not tagged.
+        const auto compressedInfo = MG_Util::GetCompressedFormatInfo(internalformat);
         for (const auto uploadTarget : textureObject->GetUploadTargets()) {
             for (GLsizei level = 0; level < levels; ++level) {
                 const GLsizei levelWidth = std::max<GLsizei>(1, width >> level);
@@ -4103,6 +4307,13 @@ namespace MobileGL::MG_Impl::GLImpl {
                     static_cast<SizeT>(levelWidth) * static_cast<SizeT>(levelHeight) * bytesPerPixel;
                 textureMipmapObject->AllocateStorage(uploadTarget, level, {{levelWidth, levelHeight, 1}, byteSize});
                 textureMipmapObject->MarkStorageDirty(uploadTarget, level, false);
+                if (compressedInfo.blockWidth != 0) {
+                    // After AllocateStorage, which clears the tag.
+                    textureMipmapObject->SetMipmapCompressedImage(
+                        uploadTarget, static_cast<Uint>(level), internalformat, nullptr,
+                        MG_Util::CalculateCompressedTextureImageSize(compressedInfo,
+                                                                     {levelWidth, levelHeight, 1}));
+                }
             }
             // See TextureStorage1D.
             textureMipmapObject->TruncateMipmapLevels(uploadTarget, static_cast<Uint>(levels));
@@ -4472,6 +4683,14 @@ namespace MobileGL::MG_Impl::GLImpl {
         free(processedPixels);
     }
 
+    void CompressedTextureSubImage2D(GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLsizei width,
+                                     GLsizei height, GLenum format, GLsizei imageSize, const void* data) {
+        auto textureObject = GetTextureObjectByName(texture, __func__);
+        WithTemporarilyBoundNamedTexture(textureObject, [&](GLenum target) {
+            CompressedTexSubImage2D_State(target, level, xoffset, yoffset, width, height, format, imageSize, data);
+        });
+    }
+
     void TextureSubImage3D(GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width,
                            GLsizei height, GLsizei depth, GLenum format, GLenum type, const void* pixels) {
         auto textureObject = GetTextureObjectByName(texture, __func__);

MobileGL/MG_Impl/GLImpl/Texture/GL_Texture.h

@@ -37,6 +37,8 @@ namespace MobileGL::MG_Impl::GLImpl {
                            GLenum format, GLenum type, const void* pixels);
     void TextureSubImage3D(GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLint zoffset, GLsizei width,
                            GLsizei height, GLsizei depth, GLenum format, GLenum type, const void* pixels);
+    void CompressedTextureSubImage2D(GLuint texture, GLint level, GLint xoffset, GLint yoffset, GLsizei width,
+                                     GLsizei height, GLenum format, GLsizei imageSize, const void* data);
     void TextureParameterf(GLuint texture, GLenum pname, GLfloat param);
     void TextureParameterfv(GLuint texture, GLenum pname, const GLfloat* params);
     void TextureParameteri(GLuint texture, GLenum pname, GLint param);

MobileGL/MG_IntegrationTest/CMakeLists.txt

@@ -60,17 +60,23 @@ add_executable(MobileGLIntegrationTest
     Scenarios/FragCoordOriginScenario.cpp
     Scenarios/ClearThenReadPixelsScenario.cpp
     Scenarios/DepthStencilReadbackScenario.cpp
+    Scenarios/DepthStencilReadbackMatrixScenario.cpp
+    Scenarios/DepthStencilReadbackAttachmentShapeScenario.cpp
+    Scenarios/ClipDistanceScenario.cpp
     Scenarios/SsboArrayLengthScenario.cpp
     Scenarios/DoublePrecisionScenario.cpp
     Scenarios/UniformInitializerScenario.cpp
     Scenarios/SwizzleAccessRoutineScenario.cpp
     Scenarios/ProgramPipelineScenario.cpp
     Scenarios/ImageLoadStoreSsoScenario.cpp
+    Scenarios/ImageTargetKindScenario.cpp
     Scenarios/SsboDeclarationFormScenario.cpp
     Scenarios/Glsl420DeclarationScenario.cpp
     Scenarios/FragmentOutputArrayIndexScenario.cpp
     Scenarios/BufferTextureScenario.cpp
     Scenarios/VertexAttribBindingScenario.cpp
+    Scenarios/XfbCaptureBufferReuseScenario.cpp
+    Scenarios/VertexArrayEnableDisableScenario.cpp
 )
 
 target_include_directories(MobileGLIntegrationTest PRIVATE
@@ -238,6 +244,8 @@ mgl_itest_join_environment(MGL_ITEST_VULKAN_ENVIRONMENT
     "MOBILEGL_BACKEND_TYPE=DirectVulkan" ${MGL_ITEST_VULKAN_ENV})
 mgl_itest_join_environment(MGL_ITEST_VULKAN_ASYNC_ENVIRONMENT
     "MOBILEGL_BACKEND_TYPE=DirectVulkan" "MOBILEGL_ASYNC_SHADER_COMPILE=1" ${MGL_ITEST_VULKAN_ENV})
+mgl_itest_join_environment(MGL_ITEST_GLES_FORCED_DS_ENVIRONMENT
+    "MOBILEGL_BACKEND_TYPE=DirectGLES" "MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION=1" ${MGL_ITEST_COMMON_ENV})
 
 # TIMEOUT on every entry: a GPU test that wedges must fail the run, not hang it.
 set(MGL_ITEST_TIMEOUT 120)
@@ -285,3 +293,21 @@ gtest_discover_tests(MobileGLIntegrationTest
         TIMEOUT ${MGL_ITEST_TIMEOUT}
         ENVIRONMENT "${MGL_ITEST_VULKAN_ASYNC_ENVIRONMENT}"
 )
+
+# A fourth registration, of the depth/stencil readback scenarios, with the ES
+# shader-sampling emulation forced on. Not paranoia - without it these scenarios are
+# UNFALSIFIABLE on the machines this suite runs on: OpenGL ES has no depth or stencil
+# readback in core, but Mesa accepts the reads anyway, so on llvmpipe every one of them
+# goes green through a native path that the Adreno device does not have. Deleting the
+# entire emulation left all of them passing. With the flag the native spellings are off
+# the table and only the path the device actually takes remains. DirectGLES only - the
+# emulation is DirectGLES's.
+gtest_discover_tests(MobileGLIntegrationTest
+    TEST_PREFIX "DirectGLES.ForcedDepthStencilEmulation."
+    TEST_FILTER "DepthStencilReadback*Scenario.*"
+    DISCOVERY_TIMEOUT 30
+    PROPERTIES
+        LABELS integration-gpu
+        TIMEOUT ${MGL_ITEST_TIMEOUT}
+        ENVIRONMENT "${MGL_ITEST_GLES_FORCED_DS_ENVIRONMENT}"
+)

MobileGL/MG_IntegrationTest/Scenarios/BufferTextureScenario.cpp

@@ -33,6 +33,7 @@
 // branch on. The driver POST's "Buffer textures" row is where that verdict is stated.
 
 #include <cstdint>
+#include <cstring>
 #include <string>
 #include <vector>
 
@@ -73,7 +74,60 @@ out vec4 o_color;
 void main() { o_color = vec4(float(vFace) / 255.0, 0.0, 0.0, 1.0); }
 )";
 
-        class BufferTextureScenario : public ScenarioTest {};
+        // A buffer texture bound as a WRITABLE image: the shader reads one texel and writes
+        // another, so a single dispatch proves the read direction (which already worked) and
+        // the write direction (which is what this exists for) apart from each other.
+        constexpr const char* kImageBufferCS = R"(#version 430 core
+layout(local_size_x = 1) in;
+layout(binding = 0, rgba8) uniform imageBuffer uImage;
+void main() {
+    vec4 read = imageLoad(uImage, 1);
+    imageStore(uImage, 0, vec4(0.0, 1.0, 0.0, 1.0));
+    imageStore(uImage, 2, read);
+}
+)";
+
+        class BufferTextureScenario : public ScenarioTest {
+        protected:
+            bool ComputeImagesAreUsable() const {
+                GLint maxImageUnits = 0;
+                GLint maxComputeImageUniforms = 0;
+                glGetIntegerv(GL_MAX_IMAGE_UNITS, &maxImageUnits);
+                glGetIntegerv(GL_MAX_COMPUTE_IMAGE_UNIFORMS, &maxComputeImageUniforms);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return maxImageUnits >= 1 && maxComputeImageUniforms >= 1;
+            }
+
+            unsigned int MakeComputeProgram(const char* source) {
+                const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+                glShaderSource(shader, 1, &source, nullptr);
+                glCompileShader(shader);
+                GLint compiled = GL_FALSE;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[4096] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    ADD_FAILURE() << "the compute shader did not compile: " << log;
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, shader);
+                glLinkProgram(program);
+                glDeleteShader(shader);
+                GLint linked = GL_FALSE;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[4096] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    ADD_FAILURE() << "the compute program did not link: " << log;
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+        };
 
         // Draws the full-viewport quad and returns the red byte every fragment was painted with,
         // or -1 if the quad did not come out uniform (which would mean the flat varying, not the
@@ -171,4 +225,78 @@ void main() { o_color = vec4(float(vFace) / 255.0, 0.0, 0.0, 1.0); }
         EXPECT_EQ(FirstGLError(), 0u);
     }
 
+    // A shader may WRITE a buffer texture too, through an image unit, and the bytes it writes
+    // land in the backend's buffer - not in the frontend's CPU shadow, which is what MapBuffer
+    // and GetBufferSubData hand back. A storage-block write is flagged for exactly this reason
+    // and the shadow is refreshed on the next read; a buffer reached through an image unit is
+    // the same write through a different binding, and Espryt used to flag only the first, so
+    // an imageStore into a buffer texture was invisible to every CPU read that followed it -
+    // silently, with the correct value sitting in the driver's buffer the whole time.
+    //
+    // The read direction is asserted in the same dispatch (texel 2 is a copy of texel 1) so a
+    // failure here cannot be blamed on the image binding not working at all.
+    TEST_F(BufferTextureScenario, AnImageStoreIntoABufferTextureIsVisibleToTheCpu) {
+        if (!Ready()) return;
+        if (!ComputeImagesAreUsable()) GTEST_SKIP() << "no compute image units on this host";
+
+        constexpr GLuint kRed = 0x000000ffu;   // RGBA8 little-endian: r = 255
+        constexpr GLuint kGreen = 0xff00ff00u; // what the shader stores: (0, 1, 0, 1)
+        constexpr int kTexels = 16;
+
+        FirstGLError();
+
+        const unsigned int program = MakeComputeProgram(kImageBufferCS);
+        ASSERT_NE(program, 0u);
+
+        const std::vector<GLuint> texels(kTexels, kRed);
+        GLuint buffer = 0;
+        glGenBuffers(1, &buffer);
+        glBindBuffer(GL_TEXTURE_BUFFER, buffer);
+        glBufferData(GL_TEXTURE_BUFFER, static_cast<GLsizeiptr>(texels.size() * sizeof(GLuint)), texels.data(),
+                     GL_DYNAMIC_COPY);
+
+        GLuint texture = 0;
+        glGenTextures(1, &texture);
+        glBindTexture(GL_TEXTURE_BUFFER, texture);
+        glTexBuffer(GL_TEXTURE_BUFFER, GL_RGBA8, buffer);
+        EXPECT_EQ(FirstGLError(), 0u) << "glTexBuffer(GL_RGBA8) was refused";
+
+        glBindImageTexture(0, texture, 0, GL_FALSE, 0, GL_READ_WRITE, GL_RGBA8);
+        EXPECT_EQ(FirstGLError(), 0u) << "glBindImageTexture on a buffer texture was refused";
+
+        glUseProgram(program);
+        glDispatchCompute(1, 1, 1);
+        glMemoryBarrier(GL_ALL_BARRIER_BITS);
+
+        // Both CPU read paths, because they are two entry points onto the same refresh and a
+        // fix that reaches only one of them is not a fix. Everything below is EXPECT rather than
+        // ASSERT so that a failure still reaches the cleanup at the end: the harness shares one
+        // context across every scenario in the process, and a leaked buffer or image binding
+        // here would surface as a failure somewhere else entirely.
+        std::vector<GLuint> readBack(kTexels, 0u);
+        glBindBuffer(GL_TEXTURE_BUFFER, buffer);
+        glGetBufferSubData(GL_TEXTURE_BUFFER, 0, static_cast<GLsizeiptr>(readBack.size() * sizeof(GLuint)),
+                           readBack.data());
+        EXPECT_EQ(readBack[0], kGreen) << "glGetBufferSubData did not see the imageStore";
+        EXPECT_EQ(readBack[2], kRed) << "the imageLoad side of the same dispatch read the wrong texel";
+
+        const void* mapped = glMapBuffer(GL_TEXTURE_BUFFER, GL_READ_ONLY);
+        EXPECT_NE(mapped, nullptr) << "glMapBuffer(GL_READ_ONLY) on the texture's buffer failed";
+        if (mapped != nullptr) {
+            GLuint mappedTexel0 = 0;
+            std::memcpy(&mappedTexel0, mapped, sizeof(mappedTexel0));
+            EXPECT_EQ(mappedTexel0, kGreen) << "glMapBuffer did not see the imageStore";
+            glUnmapBuffer(GL_TEXTURE_BUFFER);
+        }
+
+        glBindImageTexture(0, 0, 0, GL_FALSE, 0, GL_READ_ONLY, GL_RGBA8);
+        glBindBuffer(GL_TEXTURE_BUFFER, 0);
+        glBindTexture(GL_TEXTURE_BUFFER, 0);
+        glUseProgram(0);
+        glDeleteProgram(program);
+        glDeleteTextures(1, &texture);
+        glDeleteBuffers(1, &buffer);
+        EXPECT_EQ(FirstGLError(), 0u);
+    }
+
 } // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/ClipDistanceScenario.cpp

@@ -0,0 +1,388 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/ClipDistanceScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - gl_ClipDistance ACTUALLY CLIPS, AND ONLY WHERE IT IS ENABLED.
+//
+// CapabilityInput::ClipDistance0..7 existed end to end - the GL enum converted to it, the
+// string converter named it, glEnable(GL_CLIP_DISTANCE0 + i) raised no error - and then
+// RenderState::SetCapability had no case for it and dropped it into `default: break`. Nothing
+// was stored, no version was bumped, and neither backend ever heard about it. The shader half
+// worked all along (SPIRV-Cross emits gl_ClipDistance with a
+// `#extension GL_EXT_clip_cull_distance : require` that Adreno accepts), so the distances were
+// computed and then ignored: no clipping ever happened on DirectGLES, which is the whole of
+// KHR-GLxx.clip_distance.functional. glIsEnabled lied about it too - it returned GL_FALSE
+// immediately after a successful glEnable.
+//
+// The assertions are behavioural, not query-shaped, because a query-only test passes against a
+// backend that stores the bit and never forwards it. Each case draws one full-viewport triangle
+// whose clip distance is positive on one side of the viewport and negative on the other, then
+// checks BOTH sides: the kept side proves the draw happened at all, and the clipped side is the
+// actual claim. The disabled case is the negative control - the identical shader with the
+// identical distances and the enable turned off must leave both sides painted, which is what
+// says the pixels below are being removed by clipping and not by something else.
+//
+// HONEST LIMIT OF THIS FILE IN CI. Of the four cases, only EnableIsObservableThroughIsEnabled is
+// falsifiable on the software rasterizers every automated lane runs on. llvmpipe and lavapipe
+// clip by EVERY declared gl_ClipDistance regardless of the enables, so
+// AnEnabledClipDistanceRemovesTheNegativeHalf goes green there against the broken tree as well,
+// and the two cases that need real per-distance semantics skip (see
+// DriverHonoursPerDistanceEnables). What actually pins the behaviour is Adreno, through
+// KHR-GLxx.clip_distance.functional - whose "without dynamic redeclaration" variants declare all
+// gl_MaxClipDistances slots and enable only the first N, i.e. exactly the subset semantics these
+// skipped cases assert. Read a green CI run here as "the state survives the frontend", not as
+// "clipping is correct"; the second claim is a device claim.
+//
+// Every case disables all eight distances on entry rather than assuming they start off:
+// XfbAfterClipDistanceScenario deliberately leaves one enabled for the rest of the process, and
+// forwarding the enables is what turned that leftover from inert bookkeeping into live driver
+// state.
+
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+#ifndef GL_CLIP_DISTANCE0
+#define GL_CLIP_DISTANCE0 0x3000
+#endif
+#ifndef GL_CLIP_DISTANCE1
+#define GL_CLIP_DISTANCE1 0x3001
+#endif
+
+namespace MGITest {
+    namespace {
+
+        // One clip distance per half of the viewport: distance 0 is positive on the right half
+        // (x > 0 in clip space) and distance 1 is positive on the top half. A vertex shader
+        // producing a full-screen triangle from gl_VertexID, so no buffers are needed.
+        const char* const kVertexSource = R"(#version 400 core
+out float gl_ClipDistance[2];
+void main() {
+    vec2 positions[3] = vec2[3](vec2(-1.0, -1.0), vec2(3.0, -1.0), vec2(-1.0, 3.0));
+    vec2 p = positions[gl_VertexID];
+    gl_Position = vec4(p, 0.0, 1.0);
+    gl_ClipDistance[0] = p.x;
+    gl_ClipDistance[1] = p.y;
+}
+)";
+
+        const char* const kFragmentSource = R"(#version 400 core
+out vec4 fragColor;
+void main() { fragColor = vec4(0.0, 1.0, 0.0, 1.0); }
+)";
+
+        class ClipDistanceScenario : public ScenarioTest {
+        protected:
+            GLuint BuildProgram() {
+                const GLuint vs = glCreateShader(GL_VERTEX_SHADER);
+                glShaderSource(vs, 1, &kVertexSource, nullptr);
+                glCompileShader(vs);
+                GLint compiled = 0;
+                glGetShaderiv(vs, GL_COMPILE_STATUS, &compiled);
+                if (!compiled) {
+                    m_buildLog = ShaderLog(vs);
+                    glDeleteShader(vs);
+                    return 0;
+                }
+                const GLuint fs = glCreateShader(GL_FRAGMENT_SHADER);
+                glShaderSource(fs, 1, &kFragmentSource, nullptr);
+                glCompileShader(fs);
+                glGetShaderiv(fs, GL_COMPILE_STATUS, &compiled);
+                if (!compiled) {
+                    m_buildLog = ShaderLog(fs);
+                    glDeleteShader(vs);
+                    glDeleteShader(fs);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                glAttachShader(program, vs);
+                glAttachShader(program, fs);
+                glLinkProgram(program);
+                GLint linked = 0;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                glDeleteShader(vs);
+                glDeleteShader(fs);
+                if (!linked) {
+                    GLint length = 0;
+                    glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+                    std::vector<char> log(static_cast<size_t>(length > 1 ? length : 1), '\0');
+                    glGetProgramInfoLog(program, static_cast<GLsizei>(log.size()), nullptr, log.data());
+                    m_buildLog = log.data();
+                    glDeleteProgram(program);
+                    return 0;
+                }
+                return program;
+            }
+
+            const std::string& BuildLog() const { return m_buildLog; }
+
+            // Paints the whole viewport red, then draws the clipped triangle in green.
+            void DrawClippedTriangle(GLuint program, GLuint vao) const {
+                glClearColor(1.0f, 0.0f, 0.0f, 1.0f);
+                glClear(GL_COLOR_BUFFER_BIT);
+                glUseProgram(program);
+                glBindVertexArray(vao);
+                glDrawArrays(GL_TRIANGLES, 0, 3);
+            }
+
+            static bool IsGreen(const unsigned char* px) {
+                return px[0] < 64 && px[1] > 192;
+            }
+
+            static bool IsRed(const unsigned char* px) {
+                return px[0] > 192 && px[1] < 64;
+            }
+
+            void PixelAt(int x, int y, unsigned char* out) const {
+                glReadPixels(x, y, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, out);
+            }
+
+            // Never assume the eight start disabled - see the header note about
+            // XfbAfterClipDistanceScenario leaving one on for the rest of the process.
+            static void DisableEveryClipDistance() {
+                for (int i = 0; i < 8; ++i) {
+                    glDisable(static_cast<GLenum>(GL_CLIP_DISTANCE0 + i));
+                }
+            }
+
+            // True when the driver under this backend actually implements PER-DISTANCE enable
+            // state, i.e. when a written-but-disabled gl_ClipDistance leaves its fragments
+            // alone. Not every stack does, and the difference is not MobileGL's to hide:
+            //
+            //   - Adreno's ES driver honours GL_CLIP_DISTANCE0_EXT..7_EXT, which is what makes
+            //     KHR-GLxx.clip_distance.functional pass on the device once the enables are
+            //     forwarded at all.
+            //   - Vulkan has no such state: every clip distance a shader declares is active,
+            //     always. DirectVulkan therefore clips by a disabled distance.
+            //   - Mesa's llvmpipe ES driver behaves like Vulkan here.
+            //
+            // Emulating GL's semantics on those two would mean forcing the disabled slots to a
+            // non-negative value inside the shader, which makes the enable mask part of the
+            // pipeline key - a feature, not a fix, and deliberately not attempted here. The
+            // cases that need the real semantics gate on this probe and say so when they skip,
+            // rather than being deleted or silently weakened.
+            bool DriverHonoursPerDistanceEnables(GLuint program, GLuint vao) const {
+                for (int i = 0; i < 8; ++i) {
+                    glDisable(static_cast<GLenum>(GL_CLIP_DISTANCE0 + i));
+                }
+                DrawClippedTriangle(program, vao);
+                unsigned char negativeSide[4] = {0, 0, 0, 0};
+                glReadPixels(Gl().Width() / 4, Gl().Height() / 2, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, negativeSide);
+                return IsGreen(negativeSide);
+            }
+
+        private:
+            static std::string ShaderLog(GLuint shader) {
+                GLint length = 0;
+                glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> log(static_cast<size_t>(length > 1 ? length : 1), '\0');
+                glGetShaderInfoLog(shader, static_cast<GLsizei>(log.size()), nullptr, log.data());
+                return log.data();
+            }
+
+            std::string m_buildLog;
+        };
+
+    } // namespace
+
+    // The state itself: glEnable must be observable through glIsEnabled. This is the cheap half
+    // of the bug - SetCapability's missing case made the query answer GL_FALSE for a capability
+    // that had just been enabled without error.
+    TEST_F(ClipDistanceScenario, EnableIsObservableThroughIsEnabled) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+
+        DisableEveryClipDistance();
+        EXPECT_EQ(glIsEnabled(GL_CLIP_DISTANCE0), GL_FALSE)
+            << "glDisable(GL_CLIP_DISTANCE0) is not observable through glIsEnabled";
+        glEnable(GL_CLIP_DISTANCE0);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_EQ(glIsEnabled(GL_CLIP_DISTANCE0), GL_TRUE)
+            << "glEnable(GL_CLIP_DISTANCE0) raised no error but glIsEnabled still reports it disabled";
+        EXPECT_EQ(glIsEnabled(GL_CLIP_DISTANCE1), GL_FALSE)
+            << "enabling distance 0 must not enable distance 1 - the eight are independent";
+
+        glEnable(GL_CLIP_DISTANCE1);
+        glDisable(GL_CLIP_DISTANCE0);
+        EXPECT_EQ(glIsEnabled(GL_CLIP_DISTANCE0), GL_FALSE);
+        EXPECT_EQ(glIsEnabled(GL_CLIP_DISTANCE1), GL_TRUE);
+
+        glDisable(GL_CLIP_DISTANCE1);
+        EXPECT_EQ(FirstGLError(), 0u);
+        gl.EndFrame();
+    }
+
+    // The claim: an enabled clip distance removes the fragments where it is negative.
+    TEST_F(ClipDistanceScenario, AnEnabledClipDistanceRemovesTheNegativeHalf) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+        const int width = gl.Width();
+        const int height = gl.Height();
+        ASSERT_GE(width, 8);
+        ASSERT_GE(height, 8);
+
+        GLuint vao = 0;
+        glGenVertexArrays(1, &vao);
+        const GLuint program = BuildProgram();
+        ASSERT_NE(program, 0u) << "the gl_ClipDistance program did not build: " << BuildLog();
+
+        BindDefaultFramebuffer();
+        glViewport(0, 0, width, height);
+        glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_DEPTH_TEST);
+        glDisable(GL_CULL_FACE);
+        glColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+
+        // Distance 1 is positive by a single pixel at the sampled row, so a stray enable on it
+        // would put the "kept" probe right on the clip boundary.
+        DisableEveryClipDistance();
+        glEnable(GL_CLIP_DISTANCE0);
+        DrawClippedTriangle(program, vao);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        unsigned char right[4] = {0, 0, 0, 0};
+        unsigned char left[4] = {0, 0, 0, 0};
+        PixelAt(width - 1 - width / 4, height / 2, right);
+        PixelAt(width / 4, height / 2, left);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        EXPECT_TRUE(IsGreen(right)) << "the kept half is not painted (" << int(right[0]) << "," << int(right[1])
+                                    << "," << int(right[2]) << ") - the draw itself did not happen, so the clipped "
+                                       "half below proves nothing";
+        EXPECT_TRUE(IsRed(left)) << "gl_ClipDistance[0] is negative on the left half and GL_CLIP_DISTANCE0 is "
+                                    "enabled, so those fragments must be clipped away; found ("
+                                 << int(left[0]) << "," << int(left[1]) << "," << int(left[2]) << ")";
+
+        glDisable(GL_CLIP_DISTANCE0);
+        glUseProgram(0);
+        glBindVertexArray(0);
+        glDeleteProgram(program);
+        glDeleteVertexArrays(1, &vao);
+        gl.EndFrame();
+    }
+
+    // The negative control: the same shader writing the same distances, with the enable off,
+    // must paint both halves. Without this a backend that clipped everything - or one whose
+    // draw simply failed - would pass the case above.
+    TEST_F(ClipDistanceScenario, ADisabledClipDistanceRemovesNothing) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+        const int width = gl.Width();
+        const int height = gl.Height();
+        ASSERT_GE(width, 8);
+        ASSERT_GE(height, 8);
+
+        GLuint vao = 0;
+        glGenVertexArrays(1, &vao);
+        const GLuint program = BuildProgram();
+        ASSERT_NE(program, 0u) << "the gl_ClipDistance program did not build: " << BuildLog();
+
+        BindDefaultFramebuffer();
+        glViewport(0, 0, width, height);
+        glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_DEPTH_TEST);
+        glDisable(GL_CULL_FACE);
+        DisableEveryClipDistance();
+
+        DrawClippedTriangle(program, vao);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        unsigned char right[4] = {0, 0, 0, 0};
+        unsigned char left[4] = {0, 0, 0, 0};
+        PixelAt(width - 1 - width / 4, height / 2, right);
+        PixelAt(width / 4, height / 2, left);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        EXPECT_TRUE(IsGreen(right)) << "with every clip distance disabled the whole triangle must survive";
+        const bool driverHonoursEnables = IsGreen(left);
+
+        glUseProgram(0);
+        glBindVertexArray(0);
+        glDeleteProgram(program);
+        glDeleteVertexArrays(1, &vao);
+        gl.EndFrame();
+        if (!driverHonoursEnables) {
+            GTEST_SKIP() << "renderer " << gl.RendererString()
+                         << " clips by a DISABLED gl_ClipDistance - it does not implement per-distance enable state "
+                            "(see DriverHonoursPerDistanceEnables). Emulating GL's semantics there needs shader-side "
+                            "masking keyed on the enable mask, which is a separate feature";
+        }
+    }
+
+    // The eight enables are independent: enabling only distance 1 must clip by distance 1 and
+    // leave distance 0 alone. A backend that forwarded "any clip distance enabled" as a single
+    // bit, or that always enables every declared distance (which is what Vulkan does natively),
+    // passes both cases above and fails this one.
+    TEST_F(ClipDistanceScenario, TheEnablesAreIndependentPerDistance) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+        const int width = gl.Width();
+        const int height = gl.Height();
+        ASSERT_GE(width, 8);
+        ASSERT_GE(height, 8);
+
+        GLuint vao = 0;
+        glGenVertexArrays(1, &vao);
+        const GLuint program = BuildProgram();
+        ASSERT_NE(program, 0u) << "the gl_ClipDistance program did not build: " << BuildLog();
+
+        BindDefaultFramebuffer();
+        glViewport(0, 0, width, height);
+        glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_DEPTH_TEST);
+        glDisable(GL_CULL_FACE);
+        if (!DriverHonoursPerDistanceEnables(program, vao)) {
+            glUseProgram(0);
+            glBindVertexArray(0);
+            glDeleteProgram(program);
+            glDeleteVertexArrays(1, &vao);
+            DisableEveryClipDistance();
+            gl.EndFrame();
+            GTEST_SKIP() << "renderer " << gl.RendererString()
+                         << " clips by every declared gl_ClipDistance regardless of the enables, so per-distance "
+                            "independence is not observable here";
+        }
+
+        DisableEveryClipDistance();
+        glEnable(GL_CLIP_DISTANCE1);
+
+        DrawClippedTriangle(program, vao);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        // Distance 1 is negative on the bottom half, distance 0 on the left half. With only
+        // distance 1 enabled, the bottom-left must survive (distance 0 is off) and the bottom
+        // must not.
+        unsigned char topLeft[4] = {0, 0, 0, 0};
+        unsigned char bottomRight[4] = {0, 0, 0, 0};
+        PixelAt(width / 4, height - 1 - height / 4, topLeft);
+        PixelAt(width - 1 - width / 4, height / 4, bottomRight);
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        EXPECT_TRUE(IsGreen(topLeft)) << "gl_ClipDistance[0] is negative here but GL_CLIP_DISTANCE0 is disabled, so "
+                                         "this fragment must survive";
+        EXPECT_TRUE(IsRed(bottomRight)) << "gl_ClipDistance[1] is negative here and GL_CLIP_DISTANCE1 is enabled, so "
+                                           "this fragment must be clipped";
+
+        glDisable(GL_CLIP_DISTANCE1);
+        glUseProgram(0);
+        glBindVertexArray(0);
+        glDeleteProgram(program);
+        glDeleteVertexArrays(1, &vao);
+        gl.EndFrame();
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/DepthStencilReadbackAttachmentShapeScenario.cpp

@@ -0,0 +1,370 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/DepthStencilReadbackAttachmentShapeScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - DEPTH/STENCIL READBACK WHEN THE ATTACHMENT IS NOT A PLAIN GL_TEXTURE_2D,
+// AND THE DEFAULT FRAMEBUFFER'S ADVERTISED DEPTH/STENCIL FORMAT.
+//
+// Three shipped defects, all of them invisible to a test that only ever attaches a 2D texture
+// or only ever asks the default framebuffer for a colour value.
+//
+// (1) The ES depth/stencil readback emulation identifies the source format by binding the
+//     attachment's texture NAME to GL_TEXTURE_2D and asking that target for its internal
+//     format. A name whose target is GL_TEXTURE_2D_ARRAY (attached by
+//     glFramebufferTextureLayer) makes the bind answer GL_INVALID_OPERATION and change
+//     nothing - so the query then truthfully describes whatever texture was already on
+//     GL_TEXTURE_2D, which on that path is the emulation's own staging scratch. A wrong
+//     answer that looks like a right one: the staging blit is issued between mismatched
+//     depth formats, ES rejects it, and the read reports nothing at all.
+//
+// (2) Adreno answers GL_NONE for GL_FRAMEBUFFER_ATTACHMENT_OBJECT_TYPE on an attachment made
+//     by glFramebufferTexture (a cube map, attached layered) while still reporting its depth
+//     and stencil bits correctly. The emulation took OBJECT_TYPE as the sole witness for "is
+//     there an aspect here at all" and declined the whole read.
+//
+// (3) DirectGLES never told the frontend what its default framebuffer's depth/stencil format
+//     actually is, so the placeholder from MG_Impl/Init.cpp - GL_DEPTH32F_STENCIL8 - was what
+//     every attachment query answered, whatever the surface really had. That is not cosmetic:
+//     GL blits depth/stencil only between IDENTICAL formats, so an application that reads
+//     GL_FRAMEBUFFER_ATTACHMENT_DEPTH_SIZE, allocates the buffer it was just told about and
+//     blits gets GL_INVALID_OPERATION - and a rejected glBlitFramebuffer transfers NOTHING,
+//     colour bits included. DirectVulkan has published its real format since the swapchain
+//     work; this is the half that was missing.
+//
+// Every case poisons its destination with a value the correct answer cannot be, so "the
+// backend wrote nothing" fails loudly instead of passing on stale memory. The plain
+// GL_TEXTURE_2D case at the end is the built-in control: it shares every line of the readback
+// path with the array and cube cases, so its passing is what says a failure above is about the
+// attachment's SHAPE and not about depth readback in general.
+//
+// The scenario name starts with DepthStencilReadback on purpose - that is the filter the
+// forced-emulation ctest registration uses (MG_IntegrationTest/CMakeLists.txt), and without
+// that registration these cases are unfalsifiable on llvmpipe, which accepts the native ES
+// depth reads that the Adreno device does not have.
+
+#include <cmath>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr float kDepthPoison = 0.2f;
+        constexpr int kStencilPoison = 50;
+        constexpr float kDepthValue = 0.75f;
+        constexpr int kStencilValue = 7;
+        constexpr int kSize = 16;
+
+        class DepthStencilReadbackAttachmentShapeScenario : public ScenarioTest {
+        protected:
+            float ReadDepthAt(int x, int y) const {
+                float depth = kDepthPoison;
+                glReadPixels(x, y, 1, 1, GL_DEPTH_COMPONENT, GL_FLOAT, &depth);
+                return depth;
+            }
+
+            int ReadStencilAt(int x, int y) const {
+                int stencil = kStencilPoison;
+                glReadPixels(x, y, 1, 1, GL_STENCIL_INDEX, GL_INT, &stencil);
+                return stencil;
+            }
+
+            // Clears the currently bound framebuffer's depth and stencil to the shared
+            // reference values, with both write masks explicitly open (glClear honours them,
+            // and a leftover mask from another scenario in this shared context would look
+            // exactly like the bug under test).
+            void ClearDepthStencil() const {
+                glDepthMask(GL_TRUE);
+                glStencilMask(0xFFu);
+                glDisable(GL_SCISSOR_TEST);
+                glClearDepth(kDepthValue);
+                glClearStencil(kStencilValue);
+                glClear(GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT);
+            }
+        };
+
+        // Fails the calling test if the framebuffer bound at both targets is not complete;
+        // an incomplete framebuffer would make every read below return the poison for a
+        // reason that has nothing to do with what is being tested.
+        ::testing::AssertionResult FramebufferIsComplete() {
+            const GLenum status = glCheckFramebufferStatus(GL_FRAMEBUFFER);
+            if (status == GL_FRAMEBUFFER_COMPLETE) return ::testing::AssertionSuccess();
+            return ::testing::AssertionFailure() << "framebuffer status 0x" << std::hex << status;
+        }
+
+    } // namespace
+
+    // (1) A depth slice of a 2D ARRAY texture, attached with glFramebufferTextureLayer.
+    // Pre-fix this read back the poison: the format probe answered with the staging scratch's
+    // GL_DEPTH24_STENCIL8 instead of the array's GL_DEPTH_COMPONENT24, and the mismatched
+    // staging blit was rejected.
+    TEST_F(DepthStencilReadbackAttachmentShapeScenario, DepthOfAnArrayLayerAttachmentReadsBack) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+
+        GLuint fbo = 0;
+        GLuint depthArray = 0;
+        glGenFramebuffers(1, &fbo);
+        glGenTextures(1, &depthArray);
+        glBindTexture(GL_TEXTURE_2D_ARRAY, depthArray);
+        glTexStorage3D(GL_TEXTURE_2D_ARRAY, 1, GL_DEPTH_COMPONENT24, kSize, kSize, 4);
+        glBindTexture(GL_TEXTURE_2D_ARRAY, 0);
+
+        glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+        // Layer 2, not layer 0: a backend that silently reads the wrong slice would still
+        // agree with a single-layer texture.
+        glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_DEPTH_ATTACHMENT, depthArray, 0, 2);
+        glDrawBuffer(GL_NONE);
+        glReadBuffer(GL_NONE);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ASSERT_TRUE(FramebufferIsComplete());
+
+        glViewport(0, 0, kSize, kSize);
+        ClearDepthStencil();
+
+        const float depth = ReadDepthAt(kSize / 2, kSize / 2);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_NEAR(depth, kDepthValue, 1.0f / 4096.0f)
+            << "glReadPixels(GL_DEPTH_COMPONENT) of a GL_TEXTURE_2D_ARRAY layer attachment returned " << depth
+            << (std::fabs(depth - kDepthPoison) < 1e-6f ? " - the destination was never written at all" : "");
+
+        BindDefaultFramebuffer();
+        glDeleteFramebuffers(1, &fbo);
+        glDeleteTextures(1, &depthArray);
+        gl.EndFrame();
+    }
+
+    // (2) A depth cube map, attached whole with glFramebufferTexture - a LAYERED attachment.
+    // Pre-fix the emulation declined outright, because the driver reports GL_NONE for that
+    // attachment's OBJECT_TYPE.
+    TEST_F(DepthStencilReadbackAttachmentShapeScenario, DepthOfALayeredCubeAttachmentReadsBack) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+
+        GLuint fbo = 0;
+        GLuint depthCube = 0;
+        glGenFramebuffers(1, &fbo);
+        glGenTextures(1, &depthCube);
+        glBindTexture(GL_TEXTURE_CUBE_MAP, depthCube);
+        glTexStorage2D(GL_TEXTURE_CUBE_MAP, 1, GL_DEPTH_COMPONENT24, kSize, kSize);
+        glBindTexture(GL_TEXTURE_CUBE_MAP, 0);
+
+        glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+        glFramebufferTexture(GL_FRAMEBUFFER, GL_DEPTH_ATTACHMENT, depthCube, 0);
+        glDrawBuffer(GL_NONE);
+        glReadBuffer(GL_NONE);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ASSERT_TRUE(FramebufferIsComplete());
+
+        glViewport(0, 0, kSize, kSize);
+        ClearDepthStencil();
+
+        const float depth = ReadDepthAt(kSize / 2, kSize / 2);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_NEAR(depth, kDepthValue, 1.0f / 4096.0f)
+            << "glReadPixels(GL_DEPTH_COMPONENT) of a layered GL_TEXTURE_CUBE_MAP attachment returned " << depth
+            << (std::fabs(depth - kDepthPoison) < 1e-6f ? " - the destination was never written at all" : "");
+
+        BindDefaultFramebuffer();
+        glDeleteFramebuffers(1, &fbo);
+        glDeleteTextures(1, &depthCube);
+        gl.EndFrame();
+    }
+
+    // Both aspects of a packed array attachment. The stencil half goes through a different
+    // sampling mode than the depth half, and only the depth half was covered above.
+    TEST_F(DepthStencilReadbackAttachmentShapeScenario, PackedArrayLayerAttachmentReadsBackBothAspects) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+
+        GLuint fbo = 0;
+        GLuint packedArray = 0;
+        glGenFramebuffers(1, &fbo);
+        glGenTextures(1, &packedArray);
+        glBindTexture(GL_TEXTURE_2D_ARRAY, packedArray);
+        glTexStorage3D(GL_TEXTURE_2D_ARRAY, 1, GL_DEPTH24_STENCIL8, kSize, kSize, 3);
+        glBindTexture(GL_TEXTURE_2D_ARRAY, 0);
+
+        glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+        glFramebufferTextureLayer(GL_FRAMEBUFFER, GL_DEPTH_STENCIL_ATTACHMENT, packedArray, 0, 1);
+        glDrawBuffer(GL_NONE);
+        glReadBuffer(GL_NONE);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ASSERT_TRUE(FramebufferIsComplete());
+
+        glViewport(0, 0, kSize, kSize);
+        ClearDepthStencil();
+
+        const float depth = ReadDepthAt(kSize / 2, kSize / 2);
+        const int stencil = ReadStencilAt(kSize / 2, kSize / 2);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_NEAR(depth, kDepthValue, 1.0f / 4096.0f)
+            << "depth of a packed GL_TEXTURE_2D_ARRAY layer attachment returned " << depth;
+        EXPECT_EQ(stencil, kStencilValue)
+            << "stencil of a packed GL_TEXTURE_2D_ARRAY layer attachment returned " << stencil
+            << (stencil == kStencilPoison ? " - the destination was never written at all" : "");
+
+        BindDefaultFramebuffer();
+        glDeleteFramebuffers(1, &fbo);
+        glDeleteTextures(1, &packedArray);
+        gl.EndFrame();
+    }
+
+    // The control: the plain GL_TEXTURE_2D shape, which always worked. If this one ever fails
+    // alongside the three above, the fault is in depth readback generally rather than in how
+    // the attachment's format and presence are discovered.
+    TEST_F(DepthStencilReadbackAttachmentShapeScenario, DepthOfAPlainTexture2DAttachmentReadsBack) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+
+        GLuint fbo = 0;
+        GLuint depthTex = 0;
+        glGenFramebuffers(1, &fbo);
+        glGenTextures(1, &depthTex);
+        glBindTexture(GL_TEXTURE_2D, depthTex);
+        glTexStorage2D(GL_TEXTURE_2D, 1, GL_DEPTH_COMPONENT24, kSize, kSize);
+        glBindTexture(GL_TEXTURE_2D, 0);
+
+        glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+        glFramebufferTexture2D(GL_FRAMEBUFFER, GL_DEPTH_ATTACHMENT, GL_TEXTURE_2D, depthTex, 0);
+        glDrawBuffer(GL_NONE);
+        glReadBuffer(GL_NONE);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ASSERT_TRUE(FramebufferIsComplete());
+
+        glViewport(0, 0, kSize, kSize);
+        ClearDepthStencil();
+
+        const float depth = ReadDepthAt(kSize / 2, kSize / 2);
+        EXPECT_EQ(FirstGLError(), 0u);
+        EXPECT_NEAR(depth, kDepthValue, 1.0f / 4096.0f)
+            << "the control case failed: even a plain GL_TEXTURE_2D depth attachment read back " << depth;
+
+        BindDefaultFramebuffer();
+        glDeleteFramebuffers(1, &fbo);
+        glDeleteTextures(1, &depthTex);
+        gl.EndFrame();
+    }
+
+    // (3) The default framebuffer must describe its depth/stencil truthfully enough that a
+    // buffer allocated from that description is blit-compatible with it. This is the exact
+    // sequence KHR-GLxx.framebuffer_blit performs, and the exact reason 22 of its cases died
+    // on DirectGLES: the frontend answered 32-bit float depth for a 24-bit fixed-point
+    // surface, so the renderbuffer the caller allocated could never be blitted to.
+    TEST_F(DepthStencilReadbackAttachmentShapeScenario, DefaultFramebufferDepthStencilFormatIsBlitCompatible) {
+        if (!Ready()) return;
+        HeadlessGL& gl = Gl();
+        const int width = gl.Width();
+        const int height = gl.Height();
+
+        BindDefaultFramebuffer();
+        GLint depthBits = 0;
+        GLint stencilBits = 0;
+        GLint componentType = GL_UNSIGNED_NORMALIZED;
+        glGetFramebufferAttachmentParameteriv(GL_DRAW_FRAMEBUFFER, GL_DEPTH,
+                                              GL_FRAMEBUFFER_ATTACHMENT_DEPTH_SIZE, &depthBits);
+        glGetFramebufferAttachmentParameteriv(GL_DRAW_FRAMEBUFFER, GL_STENCIL,
+                                              GL_FRAMEBUFFER_ATTACHMENT_STENCIL_SIZE, &stencilBits);
+        glGetFramebufferAttachmentParameteriv(GL_DRAW_FRAMEBUFFER, GL_DEPTH,
+                                              GL_FRAMEBUFFER_ATTACHMENT_COMPONENT_TYPE, &componentType);
+        EXPECT_EQ(FirstGLError(), 0u);
+        if (depthBits <= 0 || stencilBits <= 0) {
+            GTEST_SKIP() << "this surface has no packed depth/stencil (depth=" << depthBits
+                         << " stencil=" << stencilBits << "); the blit-compatibility contract needs both";
+        }
+
+        // The one sized format the reported description names. Getting here with the wrong
+        // answer is the bug: the two candidates are not interchangeable for a blit.
+        const GLenum reported = (componentType == GL_FLOAT || depthBits > 24) ? GL_DEPTH32F_STENCIL8
+                                                                             : GL_DEPTH24_STENCIL8;
+
+        GLuint fbo = 0;
+        GLuint colorRbo = 0;
+        GLuint depthRbo = 0;
+        glGenFramebuffers(1, &fbo);
+        glGenRenderbuffers(1, &colorRbo);
+        glGenRenderbuffers(1, &depthRbo);
+        glBindRenderbuffer(GL_RENDERBUFFER, colorRbo);
+        glRenderbufferStorage(GL_RENDERBUFFER, GL_RGBA8, width, height);
+        glBindRenderbuffer(GL_RENDERBUFFER, depthRbo);
+        glRenderbufferStorage(GL_RENDERBUFFER, reported, width, height);
+        glBindRenderbuffer(GL_RENDERBUFFER, 0);
+        glBindFramebuffer(GL_FRAMEBUFFER, fbo);
+        glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_RENDERBUFFER, colorRbo);
+        glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_DEPTH_STENCIL_ATTACHMENT, GL_RENDERBUFFER, depthRbo);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ASSERT_TRUE(FramebufferIsComplete());
+
+        // Put a known depth in the default framebuffer, then blit colour+depth+stencil out of
+        // it into the buffer that its own description asked for.
+        BindDefaultFramebuffer();
+        glViewport(0, 0, width, height);
+        glColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+        glClearColor(0.0f, 1.0f, 0.0f, 1.0f);
+        glClear(GL_COLOR_BUFFER_BIT);
+        ClearDepthStencil();
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        glBindFramebuffer(GL_READ_FRAMEBUFFER, 0);
+        glBindFramebuffer(GL_DRAW_FRAMEBUFFER, fbo);
+        glBlitFramebuffer(0, 0, width, height, 0, 0, width, height,
+                          GL_COLOR_BUFFER_BIT | GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT, GL_NEAREST);
+        EXPECT_EQ(FirstGLError(), 0u)
+            << "blitting depth/stencil out of the default framebuffer into a buffer allocated from the format "
+               "the default framebuffer itself reported was rejected - the report and the storage disagree";
+
+        glBindFramebuffer(GL_READ_FRAMEBUFFER, fbo);
+        unsigned char color[4] = {0, 0, 0, 0};
+        glReadPixels(width / 2, height / 2, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, color);
+        const float depth = ReadDepthAt(width / 2, height / 2);
+        const int stencil = ReadStencilAt(width / 2, height / 2);
+        EXPECT_EQ(FirstGLError(), 0u);
+        // The colour bit is the precondition, not the claim: it says this stack can blit out of
+        // its default framebuffer at all, which has nothing to do with depth/stencil formats.
+        // DirectVulkan on a surfaceless pbuffer cannot - the whole call, colour included, is a
+        // no-op there, while the same blit works on a real surface (KHR-GLxx.framebuffer_blit
+        // exercises exactly it and Magma passes 33/33 on device). Skipping keeps the
+        // depth/stencil claim below falsifiable instead of drowning it in an unrelated
+        // harness limitation.
+        if (int(color[1]) <= 192) {
+            // GTEST_SKIP() expands to a return, so the teardown below it would never run and this
+            // scenario would hand the next one a foreign framebuffer plus three leaked objects -
+            // and this is the path DirectVulkan takes on every headless run, not a rare one.
+            BindDefaultFramebuffer();
+            glDeleteFramebuffers(1, &fbo);
+            glDeleteRenderbuffers(1, &colorRbo);
+            glDeleteRenderbuffers(1, &depthRbo);
+            gl.EndFrame();
+            GTEST_SKIP() << "backend " << gl.BackendName() << " on this surface transferred no colour either (green="
+                         << int(color[1])
+                         << "): it cannot blit out of the default framebuffer here, so the depth/stencil half proves "
+                            "nothing. The GL-error assertion above still ran, and it is the format contract";
+        }
+        EXPECT_NEAR(depth, kDepthValue, 1.0f / 4096.0f)
+            << "depth blitted out of the default framebuffer read back " << depth
+            << (std::fabs(depth - kDepthPoison) < 1e-6f ? " - the blit transferred nothing" : "");
+        EXPECT_EQ(stencil, kStencilValue) << "stencil blitted out of the default framebuffer read back " << stencil;
+
+        BindDefaultFramebuffer();
+        glDeleteFramebuffers(1, &fbo);
+        glDeleteRenderbuffers(1, &colorRbo);
+        glDeleteRenderbuffers(1, &depthRbo);
+        gl.EndFrame();
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/DepthStencilReadbackMatrixScenario.cpp

@@ -0,0 +1,784 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/DepthStencilReadbackMatrixScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - THE DEPTH/STENCIL READBACK MATRIX: every verb, every source kind.
+//
+// DepthStencilReadbackScenario pins the default framebuffer. This file pins the rest of
+// the surface a depth/stencil read has to cover, because the three verbs and the four
+// source kinds do NOT share a code path by accident - they share one on purpose, and a
+// change that quietly serves only one of them is exactly what these assertions catch:
+//
+//   verbs         glReadPixels(GL_DEPTH_COMPONENT | GL_STENCIL_INDEX | GL_DEPTH_STENCIL),
+//                 glGetTexImage(GL_DEPTH_STENCIL), glCopyTexImage2D followed by a read
+//   source kinds  depth(-stencil) TEXTURE, RENDERBUFFER (not samplable at all),
+//                 MULTISAMPLE renderbuffer (needs a resolve first), default framebuffer
+//   formats       DEPTH24_STENCIL8, DEPTH32F_STENCIL8, DEPTH_COMPONENT16/24/32F,
+//                 STENCIL_INDEX8
+//   client types  GL_FLOAT / GL_UNSIGNED_INT / GL_UNSIGNED_SHORT depth, GL_INT /
+//                 GL_UNSIGNED_BYTE stencil, both packed GL_DEPTH_STENCIL layouts
+//
+// On DirectGLES none of this exists natively - ES has no depth or stencil readback in
+// core - so every assertion here is really an assertion about the shader-sampling
+// emulation. The catch is that some ES drivers accept the reads anyway (Mesa does,
+// Adreno does not), which would make the emulation dead code on the very stack the
+// headless suite runs on. That is what the second ctest registration is for: the same
+// scenarios run again with MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION=1, which takes the
+// native spellings off the table and leaves only the path the device actually uses.
+//
+// Every destination is poisoned with a value the correct answer cannot be, so "the
+// backend wrote nothing" fails loudly instead of passing on a coincidence - a test that
+// only checked "no GL error" would pass against a readback that never touched the buffer,
+// which is precisely how this whole cluster hid for so long.
+
+#include <cmath>
+#include <cstring>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr float kDepthPoison = 0.2f;
+        constexpr int kStencilPoison = 50;
+        constexpr int kWidth = 64;
+        constexpr int kHeight = 48;
+
+        // A depth-stencil pair no clear in these tests produces, packed both ways.
+        constexpr unsigned int kPacked24_8Poison = 0xAAAAAA33u;
+
+        struct D32fS8 {
+            float depth;
+            unsigned int stencil;
+        };
+
+        // Everything a source needs to be read: the framebuffer to bind, plus the objects
+        // to delete afterwards.
+        struct DepthSource {
+            GLuint fbo = 0;
+            GLuint colorTexture = 0;
+            GLuint depthTexture = 0;
+            GLuint depthRenderbuffer = 0;
+            GLuint colorRenderbuffer = 0;
+        };
+
+        void DestroySource(DepthSource& source) {
+            if (source.fbo != 0) glDeleteFramebuffers(1, &source.fbo);
+            if (source.colorTexture != 0) glDeleteTextures(1, &source.colorTexture);
+            if (source.depthTexture != 0) glDeleteTextures(1, &source.depthTexture);
+            if (source.depthRenderbuffer != 0) glDeleteRenderbuffers(1, &source.depthRenderbuffer);
+            if (source.colorRenderbuffer != 0) glDeleteRenderbuffers(1, &source.colorRenderbuffer);
+            source = DepthSource{};
+        }
+
+        GLenum AttachmentPointFor(GLenum internalFormat) {
+            switch (internalFormat) {
+            case GL_DEPTH24_STENCIL8:
+            case GL_DEPTH32F_STENCIL8: return GL_DEPTH_STENCIL_ATTACHMENT;
+            case GL_STENCIL_INDEX8: return GL_STENCIL_ATTACHMENT;
+            default: return GL_DEPTH_ATTACHMENT;
+            }
+        }
+
+        bool FormatHasDepth(GLenum internalFormat) { return internalFormat != GL_STENCIL_INDEX8; }
+        bool FormatHasStencil(GLenum internalFormat) {
+            return internalFormat == GL_DEPTH24_STENCIL8 || internalFormat == GL_DEPTH32F_STENCIL8 ||
+                   internalFormat == GL_STENCIL_INDEX8;
+        }
+
+        // A framebuffer whose depth/stencil lives in a TEXTURE. The colour attachment is
+        // there so a stencil-only or depth-only framebuffer still has something to size it.
+        DepthSource MakeTextureSource(GLenum internalFormat) {
+            DepthSource source;
+            glGenFramebuffers(1, &source.fbo);
+            glBindFramebuffer(GL_FRAMEBUFFER, source.fbo);
+            glGenTextures(1, &source.colorTexture);
+            glBindTexture(GL_TEXTURE_2D, source.colorTexture);
+            glTexStorage2D(GL_TEXTURE_2D, 1, GL_RGBA8, kWidth, kHeight);
+            glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, source.colorTexture, 0);
+            glGenTextures(1, &source.depthTexture);
+            glBindTexture(GL_TEXTURE_2D, source.depthTexture);
+            glTexStorage2D(GL_TEXTURE_2D, 1, internalFormat, kWidth, kHeight);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+            glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+            glFramebufferTexture2D(GL_FRAMEBUFFER, AttachmentPointFor(internalFormat), GL_TEXTURE_2D,
+                                   source.depthTexture, 0);
+            return source;
+        }
+
+        // The same, with the depth/stencil in a RENDERBUFFER - which cannot be sampled at
+        // all, so the readback has no choice but to copy it somewhere samplable first.
+        // `samples` > 0 makes it multisample, which additionally needs a resolve.
+        DepthSource MakeRenderbufferSource(GLenum internalFormat, int samples) {
+            DepthSource source;
+            glGenFramebuffers(1, &source.fbo);
+            glBindFramebuffer(GL_FRAMEBUFFER, source.fbo);
+            glGenRenderbuffers(1, &source.colorRenderbuffer);
+            glBindRenderbuffer(GL_RENDERBUFFER, source.colorRenderbuffer);
+            if (samples > 0) {
+                glRenderbufferStorageMultisample(GL_RENDERBUFFER, samples, GL_RGBA8, kWidth, kHeight);
+            } else {
+                glRenderbufferStorage(GL_RENDERBUFFER, GL_RGBA8, kWidth, kHeight);
+            }
+            glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_RENDERBUFFER, source.colorRenderbuffer);
+            glGenRenderbuffers(1, &source.depthRenderbuffer);
+            glBindRenderbuffer(GL_RENDERBUFFER, source.depthRenderbuffer);
+            if (samples > 0) {
+                glRenderbufferStorageMultisample(GL_RENDERBUFFER, samples, internalFormat, kWidth, kHeight);
+            } else {
+                glRenderbufferStorage(GL_RENDERBUFFER, internalFormat, kWidth, kHeight);
+            }
+            glFramebufferRenderbuffer(GL_FRAMEBUFFER, AttachmentPointFor(internalFormat), GL_RENDERBUFFER,
+                                      source.depthRenderbuffer);
+            glBindRenderbuffer(GL_RENDERBUFFER, 0);
+            return source;
+        }
+
+        // Clears the bound framebuffer's depth and stencil to known values, with the masks
+        // and the scissor explicitly out of the way (a leaked scissor from an earlier
+        // scenario would clip the clear and every assertion after it).
+        void ClearDepthStencil(GLenum internalFormat, float depth, int stencil) {
+            glDisable(GL_SCISSOR_TEST);
+            glViewport(0, 0, kWidth, kHeight);
+            GLbitfield mask = 0;
+            if (FormatHasDepth(internalFormat)) {
+                glDepthMask(GL_TRUE);
+                glClearDepth(depth);
+                mask |= GL_DEPTH_BUFFER_BIT;
+            }
+            if (FormatHasStencil(internalFormat)) {
+                glStencilMask(0xFFu);
+                glClearStencil(stencil);
+                mask |= GL_STENCIL_BUFFER_BIT;
+            }
+            glClear(mask);
+        }
+
+        class DepthStencilReadbackMatrixScenario : public ScenarioTest {
+        protected:
+            // Not every ES driver can render to every depth format (DEPTH_COMPONENT32F and
+            // the multisample counts in particular), and an incomplete framebuffer would
+            // turn a legitimate "this machine cannot host the source" into a spurious
+            // failure about the readback.
+            static bool SourceIsUsable() {
+                return glCheckFramebufferStatus(GL_FRAMEBUFFER) == GLenum(GL_FRAMEBUFFER_COMPLETE);
+            }
+
+            static std::vector<float> ReadDepthFloat(int x, int y, int width, int height) {
+                std::vector<float> depth(static_cast<size_t>(width) * height, kDepthPoison);
+                glReadPixels(x, y, width, height, GL_DEPTH_COMPONENT, GL_FLOAT, depth.data());
+                return depth;
+            }
+
+            static std::vector<int> ReadStencilInt(int x, int y, int width, int height) {
+                std::vector<int> stencil(static_cast<size_t>(width) * height, kStencilPoison);
+                glReadPixels(x, y, width, height, GL_STENCIL_INDEX, GL_INT, stencil.data());
+                return stencil;
+            }
+
+            // "every value in the region is `expected`" rather than "the middle pixel is":
+            // a staging blit that lands the wrong rectangle, or a conversion pass with a
+            // half-texel offset, still gets the centre right.
+            static void ExpectAllDepth(const std::vector<float>& values, float expected, const char* what) {
+                size_t bad = 0;
+                float worst = expected;
+                for (float value : values) {
+                    if (std::fabs(value - expected) > 1.0f / 4096.0f) {
+                        if (bad == 0) worst = value;
+                        ++bad;
+                    }
+                }
+                EXPECT_EQ(bad, 0u) << what << ": " << bad << " of " << values.size()
+                                   << " depth values differ from " << expected << "; first bad value " << worst
+                                   << (std::fabs(worst - kDepthPoison) < 1e-6f
+                                           ? " - which is the poison value, so nothing was written at all"
+                                           : "");
+            }
+
+            static void ExpectAllStencil(const std::vector<int>& values, int expected, const char* what) {
+                size_t bad = 0;
+                int worst = expected;
+                for (int value : values) {
+                    if (value != expected) {
+                        if (bad == 0) worst = value;
+                        ++bad;
+                    }
+                }
+                EXPECT_EQ(bad, 0u) << what << ": " << bad << " of " << values.size()
+                                   << " stencil values differ from " << expected << "; first bad value " << worst
+                                   << (worst == kStencilPoison
+                                           ? " - which is the poison value, so nothing was written at all"
+                                           : "");
+            }
+        };
+
+        // ---- glReadPixels across the source kinds -----------------------------------
+
+        struct SourceCase {
+            const char* name;
+            GLenum internalFormat;
+            int samples;
+            bool renderbuffer;
+        };
+
+        const SourceCase kSourceCases[] = {
+            {"texture depth24_stencil8", GL_DEPTH24_STENCIL8, 0, false},
+            {"texture depth32f_stencil8", GL_DEPTH32F_STENCIL8, 0, false},
+            {"texture depth_component16", GL_DEPTH_COMPONENT16, 0, false},
+            {"texture depth_component24", GL_DEPTH_COMPONENT24, 0, false},
+            {"texture depth_component32f", GL_DEPTH_COMPONENT32F, 0, false},
+            {"renderbuffer depth24_stencil8", GL_DEPTH24_STENCIL8, 0, true},
+            {"renderbuffer depth_component24", GL_DEPTH_COMPONENT24, 0, true},
+            {"renderbuffer stencil_index8", GL_STENCIL_INDEX8, 0, true},
+        };
+
+    } // namespace
+
+    TEST_F(DepthStencilReadbackMatrixScenario, EverySourceKindReadsItsClearBack) {
+        if (!Ready()) return;
+        int exercised = 0;
+        for (const SourceCase& testCase : kSourceCases) {
+            SCOPED_TRACE(testCase.name);
+            DepthSource source = testCase.renderbuffer
+                                     ? MakeRenderbufferSource(testCase.internalFormat, testCase.samples)
+                                     : MakeTextureSource(testCase.internalFormat);
+            if (!SourceIsUsable()) {
+                DestroySource(source);
+                continue;
+            }
+            FirstGLError(); // the storage calls above may have probed an unsupported combination
+            ClearDepthStencil(testCase.internalFormat, 0.625f, 9);
+            EXPECT_EQ(FirstGLError(), 0u) << "clearing the source";
+
+            if (FormatHasDepth(testCase.internalFormat)) {
+                const std::vector<float> depth = ReadDepthFloat(0, 0, kWidth, kHeight);
+                EXPECT_EQ(FirstGLError(), 0u) << "glReadPixels(GL_DEPTH_COMPONENT, GL_FLOAT)";
+                ExpectAllDepth(depth, 0.625f, testCase.name);
+            }
+            if (FormatHasStencil(testCase.internalFormat)) {
+                const std::vector<int> stencil = ReadStencilInt(0, 0, kWidth, kHeight);
+                EXPECT_EQ(FirstGLError(), 0u) << "glReadPixels(GL_STENCIL_INDEX, GL_INT)";
+                ExpectAllStencil(stencil, 9, testCase.name);
+            }
+            ++exercised;
+            DestroySource(source);
+        }
+        // A machine that hosted none of the sources would report a vacuous pass.
+        EXPECT_GE(exercised, 4) << "too few depth/stencil source kinds were usable to call this a matrix";
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        Gl().EndFrame();
+    }
+
+    // Depth and stencil in two SEPARATE objects, with two different formats, on the same
+    // framebuffer. Legal GL, and the shape KHR-GL3x.framebuffer_blit builds when its depth
+    // config and its stencil config are configured independently - so a readback that
+    // describes "the" depth/stencil source as one thing serves whichever aspect it happened
+    // to find first and silently abandons the other. Each aspect has to be staged from its
+    // own attachment, in its own format.
+    TEST_F(DepthStencilReadbackMatrixScenario, SeparateDepthAndStencilAttachmentsAreBothReadable) {
+        if (!Ready()) return;
+        DepthSource source;
+        glGenFramebuffers(1, &source.fbo);
+        glBindFramebuffer(GL_FRAMEBUFFER, source.fbo);
+        glGenRenderbuffers(1, &source.colorRenderbuffer);
+        glBindRenderbuffer(GL_RENDERBUFFER, source.colorRenderbuffer);
+        glRenderbufferStorage(GL_RENDERBUFFER, GL_RGBA8, kWidth, kHeight);
+        glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_RENDERBUFFER, source.colorRenderbuffer);
+        // Depth in a DEPTH_COMPONENT24 renderbuffer...
+        glGenRenderbuffers(1, &source.depthRenderbuffer);
+        glBindRenderbuffer(GL_RENDERBUFFER, source.depthRenderbuffer);
+        glRenderbufferStorage(GL_RENDERBUFFER, GL_DEPTH_COMPONENT24, kWidth, kHeight);
+        glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_DEPTH_ATTACHMENT, GL_RENDERBUFFER, source.depthRenderbuffer);
+        // ...and stencil in a STENCIL_INDEX8 one of its own.
+        GLuint stencilRenderbuffer = 0;
+        glGenRenderbuffers(1, &stencilRenderbuffer);
+        glBindRenderbuffer(GL_RENDERBUFFER, stencilRenderbuffer);
+        glRenderbufferStorage(GL_RENDERBUFFER, GL_STENCIL_INDEX8, kWidth, kHeight);
+        glFramebufferRenderbuffer(GL_FRAMEBUFFER, GL_STENCIL_ATTACHMENT, GL_RENDERBUFFER, stencilRenderbuffer);
+        glBindRenderbuffer(GL_RENDERBUFFER, 0);
+        if (!SourceIsUsable()) {
+            // Separate depth and stencil images are legal GL but many stacks answer
+            // GL_FRAMEBUFFER_UNSUPPORTED for them; say which, so a skip here is a fact about
+            // the driver rather than an unexplained hole in the matrix.
+            const GLenum status = glCheckFramebufferStatus(GL_FRAMEBUFFER);
+            glDeleteRenderbuffers(1, &stencilRenderbuffer);
+            DestroySource(source);
+            GTEST_SKIP() << "this driver cannot host separate DEPTH_COMPONENT24 and STENCIL_INDEX8 attachments: "
+                         << "glCheckFramebufferStatus = 0x" << std::hex << status;
+        }
+        FirstGLError();
+
+        glDisable(GL_SCISSOR_TEST);
+        glViewport(0, 0, kWidth, kHeight);
+        glDepthMask(GL_TRUE);
+        glStencilMask(0xFFu);
+        glClearDepth(0.3125);
+        glClearStencil(17);
+        glClear(GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        const std::vector<float> depth = ReadDepthFloat(0, 0, kWidth, kHeight);
+        EXPECT_EQ(FirstGLError(), 0u) << "reading depth from a separately-attached DEPTH_COMPONENT24";
+        ExpectAllDepth(depth, 0.3125f, "separate depth attachment");
+
+        const std::vector<int> stencil = ReadStencilInt(0, 0, kWidth, kHeight);
+        EXPECT_EQ(FirstGLError(), 0u) << "reading stencil from a separately-attached STENCIL_INDEX8";
+        ExpectAllStencil(stencil, 17, "separate stencil attachment");
+
+        glDeleteRenderbuffers(1, &stencilRenderbuffer);
+        DestroySource(source);
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        Gl().EndFrame();
+    }
+
+    // A multisample source is never read directly - glReadPixels on a multisampled
+    // framebuffer is INVALID_OPERATION in GL as much as in ES, and the state layer says so.
+    // The way multisample depth reaches a reader is a resolve blit into a single-sampled
+    // framebuffer, which is then read; that pair is
+    // KHR-GL3x.framebuffer_blit.multisampled_to_singlesampled_blit_depth_config_test, and
+    // the assertion here is that the resolved depth arrives intact rather than as the
+    // destination's own clear value.
+    TEST_F(DepthStencilReadbackMatrixScenario, AResolvedMultisampleDepthReadsBackFromTheDestination) {
+        if (!Ready()) return;
+        DepthSource multisampled = MakeRenderbufferSource(GL_DEPTH24_STENCIL8, 4);
+        if (!SourceIsUsable()) {
+            DestroySource(multisampled);
+            GTEST_SKIP() << "this driver cannot host a 4x multisample DEPTH24_STENCIL8 renderbuffer";
+        }
+        FirstGLError();
+        ClearDepthStencil(GL_DEPTH24_STENCIL8, 0.875f, 0);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        // The destination starts at a depth the resolve must overwrite everywhere.
+        DepthSource resolved = MakeTextureSource(GL_DEPTH24_STENCIL8);
+        ASSERT_TRUE(SourceIsUsable());
+        ClearDepthStencil(GL_DEPTH24_STENCIL8, 0.125f, 0);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        glBindFramebuffer(GL_READ_FRAMEBUFFER, multisampled.fbo);
+        glBindFramebuffer(GL_DRAW_FRAMEBUFFER, resolved.fbo);
+        glDisable(GL_SCISSOR_TEST);
+        glBlitFramebuffer(0, 0, kWidth, kHeight, 0, 0, kWidth, kHeight, GL_DEPTH_BUFFER_BIT, GL_NEAREST);
+        EXPECT_EQ(FirstGLError(), 0u) << "resolving a multisample depth buffer into a single-sampled one";
+
+        glBindFramebuffer(GL_FRAMEBUFFER, resolved.fbo);
+        const std::vector<float> depth = ReadDepthFloat(0, 0, kWidth, kHeight);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ExpectAllDepth(depth, 0.875f, "resolved multisample depth");
+
+        DestroySource(resolved);
+        DestroySource(multisampled);
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        Gl().EndFrame();
+    }
+
+    // A read whose rectangle is NOT the whole attachment. The staging copy has to carry
+    // the requested rect (not the origin) and hand back its rows bottom-up, which a
+    // full-extent uniform read is a fixed point of and therefore cannot see.
+    TEST_F(DepthStencilReadbackMatrixScenario, ASubRectangleReadsTheRightBandInTheRightOrder) {
+        if (!Ready()) return;
+        DepthSource source = MakeTextureSource(GL_DEPTH24_STENCIL8);
+        ASSERT_TRUE(SourceIsUsable());
+
+        // Bottom half 0.25, top half 0.75, and the stencil banded the other way round so a
+        // mix-up between the two aspects cannot pass either.
+        glDisable(GL_SCISSOR_TEST);
+        glViewport(0, 0, kWidth, kHeight);
+        glDepthMask(GL_TRUE);
+        glStencilMask(0xFFu);
+        glEnable(GL_SCISSOR_TEST);
+        glScissor(0, 0, kWidth, kHeight / 2);
+        glClearDepth(0.25);
+        glClearStencil(11);
+        glClear(GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT);
+        glScissor(0, kHeight / 2, kWidth, kHeight - kHeight / 2);
+        glClearDepth(0.75);
+        glClearStencil(22);
+        glClear(GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT);
+        glDisable(GL_SCISSOR_TEST);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        // A rect wholly inside the bottom band, offset from the origin in both axes.
+        const int rectWidth = 8;
+        const int rectHeight = 4;
+        const std::vector<float> bottom = ReadDepthFloat(16, 4, rectWidth, rectHeight);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ExpectAllDepth(bottom, 0.25f, "sub-rect inside the bottom depth band");
+        const std::vector<int> bottomStencil = ReadStencilInt(16, 4, rectWidth, rectHeight);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ExpectAllStencil(bottomStencil, 11, "sub-rect inside the bottom stencil band");
+
+        // And one wholly inside the top band. Reading the mirrored row would answer 0.25.
+        const std::vector<float> top = ReadDepthFloat(16, kHeight - 4 - rectHeight, rectWidth, rectHeight);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ExpectAllDepth(top, 0.75f, "sub-rect inside the top depth band");
+
+        // A rect that STRADDLES the boundary pins the row order itself: its first rows must
+        // be the bottom band and its last rows the top one.
+        const int straddleHeight = 8;
+        const std::vector<float> straddle =
+            ReadDepthFloat(16, kHeight / 2 - straddleHeight / 2, rectWidth, straddleHeight);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ASSERT_EQ(straddle.size(), static_cast<size_t>(rectWidth) * straddleHeight);
+        EXPECT_NEAR(straddle[0], 0.25f, 1.0f / 4096.0f)
+            << "the first row of the returned rect must be its BOTTOM row (GL order), which is in the 0.25 band";
+        EXPECT_NEAR(straddle[straddle.size() - 1], 0.75f, 1.0f / 4096.0f)
+            << "the last row of the returned rect must be its TOP row, which is in the 0.75 band";
+
+        DestroySource(source);
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        Gl().EndFrame();
+    }
+
+    // The packed layouts the packed_depth_stencil family reads its gradients with.
+    TEST_F(DepthStencilReadbackMatrixScenario, PackedDepthStencilReadPixelsCarriesBothAspects) {
+        if (!Ready()) return;
+        struct PackedCase {
+            const char* name;
+            GLenum internalFormat;
+            GLenum type;
+        };
+        const PackedCase cases[] = {
+            {"depth24_stencil8 / GL_UNSIGNED_INT_24_8", GL_DEPTH24_STENCIL8, GL_UNSIGNED_INT_24_8},
+            {"depth32f_stencil8 / GL_FLOAT_32_UNSIGNED_INT_24_8_REV", GL_DEPTH32F_STENCIL8,
+             GL_FLOAT_32_UNSIGNED_INT_24_8_REV},
+        };
+        int exercised = 0;
+        for (const PackedCase& testCase : cases) {
+            SCOPED_TRACE(testCase.name);
+            DepthSource source = MakeTextureSource(testCase.internalFormat);
+            if (!SourceIsUsable()) {
+                DestroySource(source);
+                continue;
+            }
+            FirstGLError();
+            ClearDepthStencil(testCase.internalFormat, 0.5f, 3);
+            ASSERT_EQ(FirstGLError(), 0u);
+
+            const size_t pixels = static_cast<size_t>(kWidth) * kHeight;
+            if (testCase.type == GL_UNSIGNED_INT_24_8) {
+                std::vector<unsigned int> packed(pixels, kPacked24_8Poison);
+                glReadPixels(0, 0, kWidth, kHeight, GL_DEPTH_STENCIL, testCase.type, packed.data());
+                EXPECT_EQ(FirstGLError(), 0u);
+                size_t bad = 0;
+                for (unsigned int value : packed) {
+                    const float depth = static_cast<float>(value >> 8) / 16777215.0f;
+                    const int stencil = static_cast<int>(value & 0xFFu);
+                    if (std::fabs(depth - 0.5f) > 0.01f || stencil != 3) ++bad;
+                }
+                EXPECT_EQ(bad, 0u) << testCase.name << ": " << bad << " of " << pixels
+                                   << " packed words carry the wrong depth or stencil (first word 0x" << std::hex
+                                   << packed[0] << std::dec << ")";
+            } else {
+                std::vector<D32fS8> packed(pixels, D32fS8{kDepthPoison, static_cast<unsigned int>(kStencilPoison)});
+                glReadPixels(0, 0, kWidth, kHeight, GL_DEPTH_STENCIL, testCase.type, packed.data());
+                EXPECT_EQ(FirstGLError(), 0u);
+                size_t bad = 0;
+                for (const D32fS8& value : packed) {
+                    if (std::fabs(value.depth - 0.5f) > 0.01f || (value.stencil & 0xFFu) != 3u) ++bad;
+                }
+                EXPECT_EQ(bad, 0u) << testCase.name << ": " << bad << " of " << pixels
+                                   << " packed pairs carry the wrong depth or stencil (first pair depth "
+                                   << packed[0].depth << " stencil " << (packed[0].stencil & 0xFFu) << ")";
+            }
+            ++exercised;
+            DestroySource(source);
+        }
+        EXPECT_GE(exercised, 1) << "neither packed depth/stencil format was renderable";
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        Gl().EndFrame();
+    }
+
+    // glGetTexImage reads a TEXTURE, not the bound framebuffer - a different entry point
+    // that has to reach the same machinery. This is verify_get_tex_image's shape.
+    TEST_F(DepthStencilReadbackMatrixScenario, GetTexImageReadsAPackedDepthStencilTexture) {
+        if (!Ready()) return;
+        DepthSource source = MakeTextureSource(GL_DEPTH24_STENCIL8);
+        ASSERT_TRUE(SourceIsUsable());
+        FirstGLError();
+        ClearDepthStencil(GL_DEPTH24_STENCIL8, 0.375f, 5);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        // Read it back through the texture, with the framebuffer that owns it unbound so a
+        // path that secretly read the framebuffer instead would answer from somewhere else.
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        glBindTexture(GL_TEXTURE_2D, source.depthTexture);
+        const size_t pixels = static_cast<size_t>(kWidth) * kHeight;
+        std::vector<unsigned int> packed(pixels, kPacked24_8Poison);
+        glGetTexImage(GL_TEXTURE_2D, 0, GL_DEPTH_STENCIL, GL_UNSIGNED_INT_24_8, packed.data());
+        EXPECT_EQ(FirstGLError(), 0u);
+        size_t bad = 0;
+        for (unsigned int value : packed) {
+            const float depth = static_cast<float>(value >> 8) / 16777215.0f;
+            if (std::fabs(depth - 0.375f) > 0.01f || (value & 0xFFu) != 5u) ++bad;
+        }
+        EXPECT_EQ(bad, 0u) << bad << " of " << pixels
+                           << " words from glGetTexImage(GL_DEPTH_STENCIL) are wrong (first word 0x" << std::hex
+                           << packed[0] << std::dec << ")";
+
+        glBindTexture(GL_TEXTURE_2D, 0);
+        DestroySource(source);
+        Gl().EndFrame();
+    }
+
+    // glCopyTexImage2D out of a depth attachment, then read the copy - verify_copy_tex_image.
+    TEST_F(DepthStencilReadbackMatrixScenario, CopyTexImageFromADepthAttachmentSurvivesAReadBack) {
+        if (!Ready()) return;
+        DepthSource source = MakeTextureSource(GL_DEPTH24_STENCIL8);
+        ASSERT_TRUE(SourceIsUsable());
+        FirstGLError();
+        ClearDepthStencil(GL_DEPTH24_STENCIL8, 0.75f, 6);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        GLuint copy = 0;
+        glGenTextures(1, &copy);
+        glBindTexture(GL_TEXTURE_2D, copy);
+        glTexImage2D(GL_TEXTURE_2D, 0, GL_DEPTH24_STENCIL8, kWidth, kHeight, 0, GL_DEPTH_STENCIL,
+                     GL_UNSIGNED_INT_24_8, nullptr);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_NEAREST);
+        glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_NEAREST);
+        glCopyTexImage2D(GL_TEXTURE_2D, 0, GL_DEPTH24_STENCIL8, 0, 0, kWidth, kHeight, 0);
+        EXPECT_EQ(FirstGLError(), 0u) << "glCopyTexImage2D from a depth/stencil attachment";
+
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        const size_t pixels = static_cast<size_t>(kWidth) * kHeight;
+        std::vector<unsigned int> packed(pixels, kPacked24_8Poison);
+        glGetTexImage(GL_TEXTURE_2D, 0, GL_DEPTH_STENCIL, GL_UNSIGNED_INT_24_8, packed.data());
+        EXPECT_EQ(FirstGLError(), 0u);
+        size_t bad = 0;
+        for (unsigned int value : packed) {
+            const float depth = static_cast<float>(value >> 8) / 16777215.0f;
+            if (std::fabs(depth - 0.75f) > 0.01f) ++bad;
+        }
+        EXPECT_EQ(bad, 0u) << bad << " of " << pixels << " copied depth values are wrong (first word 0x" << std::hex
+                           << packed[0] << std::dec << ")";
+
+        glBindTexture(GL_TEXTURE_2D, 0);
+        glDeleteTextures(1, &copy);
+        DestroySource(source);
+        Gl().EndFrame();
+    }
+
+    // The integer client widths, which are a separate conversion each.
+    TEST_F(DepthStencilReadbackMatrixScenario, DepthAndStencilConvertIntoEveryClientWidth) {
+        if (!Ready()) return;
+        DepthSource source = MakeTextureSource(GL_DEPTH24_STENCIL8);
+        ASSERT_TRUE(SourceIsUsable());
+        FirstGLError();
+        ClearDepthStencil(GL_DEPTH24_STENCIL8, 0.5f, 200);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        const size_t pixels = static_cast<size_t>(kWidth) * kHeight;
+
+        std::vector<unsigned int> depthUint(pixels, 0xDEADBEEFu);
+        glReadPixels(0, 0, kWidth, kHeight, GL_DEPTH_COMPONENT, GL_UNSIGNED_INT, depthUint.data());
+        EXPECT_EQ(FirstGLError(), 0u) << "glReadPixels(GL_DEPTH_COMPONENT, GL_UNSIGNED_INT)";
+        // 0.5 of the full 32-bit range, with room for the source's 24-bit quantisation.
+        EXPECT_NEAR(static_cast<double>(depthUint[0]) / 4294967295.0, 0.5, 0.01)
+            << "GL_UNSIGNED_INT depth came back as " << depthUint[0];
+
+        std::vector<unsigned short> depthUshort(pixels, 0xBEEFu);
+        glReadPixels(0, 0, kWidth, kHeight, GL_DEPTH_COMPONENT, GL_UNSIGNED_SHORT, depthUshort.data());
+        EXPECT_EQ(FirstGLError(), 0u) << "glReadPixels(GL_DEPTH_COMPONENT, GL_UNSIGNED_SHORT)";
+        EXPECT_NEAR(static_cast<double>(depthUshort[0]) / 65535.0, 0.5, 0.01)
+            << "GL_UNSIGNED_SHORT depth came back as " << depthUshort[0];
+
+        // A stencil index is written unconverted into whichever width was asked for, so 200
+        // must survive intact in all of them - it is also large enough that a signed byte
+        // would wrap, which is the point of choosing it.
+        std::vector<unsigned char> stencilByte(pixels, static_cast<unsigned char>(kStencilPoison));
+        glReadPixels(0, 0, kWidth, kHeight, GL_STENCIL_INDEX, GL_UNSIGNED_BYTE, stencilByte.data());
+        EXPECT_EQ(FirstGLError(), 0u) << "glReadPixels(GL_STENCIL_INDEX, GL_UNSIGNED_BYTE)";
+        EXPECT_EQ(static_cast<int>(stencilByte[0]), 200);
+
+        std::vector<int> stencilInt(pixels, kStencilPoison);
+        glReadPixels(0, 0, kWidth, kHeight, GL_STENCIL_INDEX, GL_INT, stencilInt.data());
+        EXPECT_EQ(FirstGLError(), 0u) << "glReadPixels(GL_STENCIL_INDEX, GL_INT)";
+        EXPECT_EQ(stencilInt[0], 200);
+
+        DestroySource(source);
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        Gl().EndFrame();
+    }
+
+    // The PACK pixel-store parameters apply to a depth read exactly as they do to a colour
+    // one, and the gap regions they create must be left alone.
+    TEST_F(DepthStencilReadbackMatrixScenario, DepthReadbackHonoursThePackPixelStoreParameters) {
+        if (!Ready()) return;
+        DepthSource source = MakeTextureSource(GL_DEPTH_COMPONENT24);
+        ASSERT_TRUE(SourceIsUsable());
+        FirstGLError();
+        ClearDepthStencil(GL_DEPTH_COMPONENT24, 0.5f, 0);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        const int rectWidth = 4;
+        const int rectHeight = 3;
+        const int rowLength = 8;
+        const int skipPixels = 2;
+        const int skipRows = 1;
+        constexpr float kGap = -7.0f;
+        std::vector<float> destination(static_cast<size_t>(rowLength) * (skipRows + rectHeight) + 16, kGap);
+
+        glPixelStorei(GL_PACK_ROW_LENGTH, rowLength);
+        glPixelStorei(GL_PACK_SKIP_PIXELS, skipPixels);
+        glPixelStorei(GL_PACK_SKIP_ROWS, skipRows);
+        glPixelStorei(GL_PACK_ALIGNMENT, 4);
+        glReadPixels(0, 0, rectWidth, rectHeight, GL_DEPTH_COMPONENT, GL_FLOAT, destination.data());
+        const unsigned int readError = FirstGLError();
+        glPixelStorei(GL_PACK_ROW_LENGTH, 0);
+        glPixelStorei(GL_PACK_SKIP_PIXELS, 0);
+        glPixelStorei(GL_PACK_SKIP_ROWS, 0);
+        glPixelStorei(GL_PACK_ALIGNMENT, 4);
+        EXPECT_EQ(readError, 0u);
+
+        size_t written = 0;
+        size_t gapsTouched = 0;
+        for (size_t index = 0; index < destination.size(); ++index) {
+            const long row = static_cast<long>(index) / rowLength - skipRows;
+            const long column = static_cast<long>(index) % rowLength - skipPixels;
+            const bool inRect = row >= 0 && row < rectHeight && column >= 0 && column < rectWidth;
+            if (inRect) {
+                if (std::fabs(destination[index] - 0.5f) <= 1.0f / 4096.0f) ++written;
+            } else if (destination[index] != kGap) {
+                ++gapsTouched;
+            }
+        }
+        EXPECT_EQ(written, static_cast<size_t>(rectWidth) * rectHeight)
+            << "only " << written << " of " << (rectWidth * rectHeight)
+            << " destination pixels landed where GL_PACK_ROW_LENGTH/SKIP_* put them";
+        EXPECT_EQ(gapsTouched, 0u) << gapsTouched << " bytes outside the packed rectangle were overwritten";
+
+        DestroySource(source);
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        Gl().EndFrame();
+    }
+
+    // The readback borrows the application's context for a full-screen pass. Everything it
+    // touches has to come back, or the next draw inherits it - which is how an emulation
+    // that "works" takes the rest of the renderer down with it.
+    TEST_F(DepthStencilReadbackMatrixScenario, ReadbackLeavesNoGLStateBehind) {
+        if (!Ready()) return;
+        DepthSource source = MakeTextureSource(GL_DEPTH24_STENCIL8);
+        ASSERT_TRUE(SourceIsUsable());
+        FirstGLError();
+        ClearDepthStencil(GL_DEPTH24_STENCIL8, 0.5f, 4);
+
+        // A deliberately awkward state: nothing here is what an emulation pass would want,
+        // so anything it forgets to put back shows up below.
+        GLuint scratchTexture = 0;
+        glGenTextures(1, &scratchTexture);
+        glBindTexture(GL_TEXTURE_2D, scratchTexture);
+        glActiveTexture(GL_TEXTURE3);
+        glBindTexture(GL_TEXTURE_2D, scratchTexture);
+        glEnable(GL_SCISSOR_TEST);
+        glScissor(3, 5, 7, 11);
+        glEnable(GL_CULL_FACE);
+        glEnable(GL_BLEND);
+        glEnable(GL_DEPTH_TEST);
+        glDepthFunc(GL_GEQUAL);
+        glDepthMask(GL_FALSE);
+        glEnable(GL_STENCIL_TEST);
+        glStencilFunc(GL_NOTEQUAL, 0x5, 0x0Fu);
+        glStencilOp(GL_INCR, GL_DECR, GL_INVERT);
+        glStencilMask(0x3Cu);
+        glColorMask(GL_FALSE, GL_TRUE, GL_FALSE, GL_TRUE);
+        glViewport(2, 3, 5, 7);
+        ASSERT_EQ(FirstGLError(), 0u);
+
+        const std::vector<float> depth = ReadDepthFloat(0, 0, kWidth, kHeight);
+        const std::vector<int> stencil = ReadStencilInt(0, 0, kWidth, kHeight);
+        EXPECT_EQ(FirstGLError(), 0u);
+        ExpectAllDepth(depth, 0.5f, "state-preservation case depth");
+        ExpectAllStencil(stencil, 4, "state-preservation case stencil");
+
+        GLint viewport[4] = {0, 0, 0, 0};
+        GLint scissorBox[4] = {0, 0, 0, 0};
+        GLboolean colorMask[4] = {GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE};
+        GLint depthFunc = 0;
+        GLboolean depthMask = GL_TRUE;
+        GLint stencilFunc = 0, stencilRef = 0, stencilValueMask = 0, stencilWriteMask = 0;
+        GLint stencilFail = 0, stencilPassDepthFail = 0, stencilPassDepthPass = 0;
+        GLint activeTexture = 0, boundTexture = 0;
+        glGetIntegerv(GL_VIEWPORT, viewport);
+        glGetIntegerv(GL_SCISSOR_BOX, scissorBox);
+        glGetBooleanv(GL_COLOR_WRITEMASK, colorMask);
+        glGetIntegerv(GL_DEPTH_FUNC, &depthFunc);
+        glGetBooleanv(GL_DEPTH_WRITEMASK, &depthMask);
+        glGetIntegerv(GL_STENCIL_FUNC, &stencilFunc);
+        glGetIntegerv(GL_STENCIL_REF, &stencilRef);
+        glGetIntegerv(GL_STENCIL_VALUE_MASK, &stencilValueMask);
+        glGetIntegerv(GL_STENCIL_WRITEMASK, &stencilWriteMask);
+        glGetIntegerv(GL_STENCIL_FAIL, &stencilFail);
+        glGetIntegerv(GL_STENCIL_PASS_DEPTH_FAIL, &stencilPassDepthFail);
+        glGetIntegerv(GL_STENCIL_PASS_DEPTH_PASS, &stencilPassDepthPass);
+        glGetIntegerv(GL_ACTIVE_TEXTURE, &activeTexture);
+        glGetIntegerv(GL_TEXTURE_BINDING_2D, &boundTexture);
+
+        EXPECT_EQ(viewport[0], 2);
+        EXPECT_EQ(viewport[1], 3);
+        EXPECT_EQ(viewport[2], 5);
+        EXPECT_EQ(viewport[3], 7);
+        EXPECT_EQ(scissorBox[0], 3);
+        EXPECT_EQ(scissorBox[1], 5);
+        EXPECT_EQ(scissorBox[2], 7);
+        EXPECT_EQ(scissorBox[3], 11);
+        EXPECT_EQ(glIsEnabled(GL_SCISSOR_TEST), GLboolean(GL_TRUE));
+        EXPECT_EQ(glIsEnabled(GL_CULL_FACE), GLboolean(GL_TRUE));
+        EXPECT_EQ(glIsEnabled(GL_BLEND), GLboolean(GL_TRUE));
+        EXPECT_EQ(glIsEnabled(GL_DEPTH_TEST), GLboolean(GL_TRUE));
+        EXPECT_EQ(glIsEnabled(GL_STENCIL_TEST), GLboolean(GL_TRUE));
+        EXPECT_EQ(colorMask[0], GLboolean(GL_FALSE));
+        EXPECT_EQ(colorMask[1], GLboolean(GL_TRUE));
+        EXPECT_EQ(colorMask[2], GLboolean(GL_FALSE));
+        EXPECT_EQ(colorMask[3], GLboolean(GL_TRUE));
+        EXPECT_EQ(depthFunc, GLint(GL_GEQUAL));
+        EXPECT_EQ(depthMask, GLboolean(GL_FALSE));
+        EXPECT_EQ(stencilFunc, GLint(GL_NOTEQUAL));
+        EXPECT_EQ(stencilRef, 0x5);
+        EXPECT_EQ(stencilValueMask, 0x0F);
+        EXPECT_EQ(stencilWriteMask, 0x3C);
+        EXPECT_EQ(stencilFail, GLint(GL_INCR));
+        EXPECT_EQ(stencilPassDepthFail, GLint(GL_DECR));
+        EXPECT_EQ(stencilPassDepthPass, GLint(GL_INVERT));
+        EXPECT_EQ(activeTexture, GLint(GL_TEXTURE3));
+        EXPECT_EQ(boundTexture, GLint(scratchTexture))
+            << "the readback left a scratch texture on the application's texture unit";
+        EXPECT_EQ(FirstGLError(), 0u);
+
+        // Put the awkward state back so the next scenario in this process starts clean.
+        glDisable(GL_SCISSOR_TEST);
+        glDisable(GL_CULL_FACE);
+        glDisable(GL_BLEND);
+        glDisable(GL_DEPTH_TEST);
+        glDisable(GL_STENCIL_TEST);
+        glDepthFunc(GL_LESS);
+        glDepthMask(GL_TRUE);
+        glStencilFunc(GL_ALWAYS, 0, 0xFFFFFFFFu);
+        glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP);
+        glStencilMask(0xFFFFFFFFu);
+        glColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+        glBindTexture(GL_TEXTURE_2D, 0);
+        glActiveTexture(GL_TEXTURE0);
+        glDeleteTextures(1, &scratchTexture);
+        DestroySource(source);
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        glViewport(0, 0, Gl().Width(), Gl().Height());
+        Gl().EndFrame();
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/DepthStencilReadbackScenario.cpp

@@ -58,12 +58,12 @@ namespace MGITest {
 
         class DepthStencilReadbackScenario : public ScenarioTest {
         protected:
-            // DirectGLES reads depth and stencil back through the ES driver, which has no
+            // Both backends now answer these reads. DirectGLES has no native ES path for
-            // guaranteed path for either (GL_NV_read_depth / GL_NV_read_stencil are optional and
+            // either aspect (GL_NV_read_depth / GL_NV_read_stencil are optional and absent on
-            // absent on both the Adreno device and Mesa's ES). That gap is tracked separately as
+            // both the Adreno device and Mesa's ES), so it stages the attachment into a
-            // the packed_depth_stencil cluster and needs a shader-sampling emulation, not this
+            // scratch depth texture and samples it into a colour target; the assertions below
-            // change; asserting it here would only pin a known-missing feature.
+            // are the same either way, which is the point.
-            bool BackendReadsDepthStencil() const { return Gl().BackendName() == "DirectVulkan"; }
+            bool BackendReadsDepthStencil() const { return true; }
 
             float ReadDepthAt(int x, int y) const {
                 float depth = kDepthPoison;

MobileGL/MG_IntegrationTest/Scenarios/DoublePrecisionScenario.cpp

@@ -99,6 +99,8 @@ void main() {
 
             void TearDown() override {
                 if (!Ready()) return;
+                if (m_shapeOutput != 0) glDeleteBuffers(1, &m_shapeOutput);
+                if (m_shapeProgram != 0) glDeleteProgram(m_shapeProgram);
                 if (m_output != 0) glDeleteBuffers(1, &m_output);
                 if (m_program != 0) glDeleteProgram(m_program);
             }
@@ -146,9 +148,147 @@ void main() {
 
             unsigned int m_program = 0;
             unsigned int m_output = 0;
+            unsigned int m_shapeProgram = 0;
+            unsigned int m_shapeOutput = 0;
             std::string m_buildLog;
         };
 
+        // Every double-typed uniform shape GLSL has, all thirteen of them, in one program - the
+        // shape of KHR-GL43.compute_shader.fp64-case2. The scalar and the square matrices are
+        // covered by the cases above; what only a set like this reaches is the NON-SQUARE
+        // matrices, whose column stride and total size both change when the demotion turns a
+        // 64-bit column into a 32-bit one, and whose members therefore move every uniform
+        // declared after them.
+        //
+        // The shader reports every component separately rather than one pass/fail flag, because
+        // "the readback is wrong" is not a diagnosis: a wrong column stride, a wrong member
+        // offset and a wrong narrowing all fail the same single comparison, and only the
+        // component map says which.
+        // No #version here on purpose: it is handed over as a separate source string, the way
+        // the CTS case hands it over.
+        constexpr const char* kAllDoubleShapesSource = R"(
+layout(local_size_x = 1) in;
+uniform double  g_0;
+uniform dvec2   g_1;
+uniform dvec3   g_2;
+uniform dvec4   g_3;
+uniform dmat2   g_4;
+uniform dmat2x3 g_5;
+uniform dmat2x4 g_6;
+uniform dmat3x2 g_7;
+uniform dmat3   g_8;
+uniform dmat3x4 g_9;
+uniform dmat4x2 g_10;
+uniform dmat4x3 g_11;
+uniform dmat4   g_12;
+layout(std430, binding = 0) buffer Output {
+    float g_out[];
+};
+void main() {
+    g_out[0] = float(g_0);
+    for (int i = 0; i < 2; ++i) g_out[1 + i] = float(g_1[i]);
+    for (int i = 0; i < 3; ++i) g_out[3 + i] = float(g_2[i]);
+    for (int i = 0; i < 4; ++i) g_out[6 + i] = float(g_3[i]);
+    for (int c = 0; c < 2; ++c) for (int r = 0; r < 2; ++r) g_out[10 + c * 2 + r] = float(g_4[c][r]);
+    for (int c = 0; c < 2; ++c) for (int r = 0; r < 3; ++r) g_out[14 + c * 3 + r] = float(g_5[c][r]);
+    for (int c = 0; c < 2; ++c) for (int r = 0; r < 4; ++r) g_out[20 + c * 4 + r] = float(g_6[c][r]);
+    for (int c = 0; c < 3; ++c) for (int r = 0; r < 2; ++r) g_out[28 + c * 2 + r] = float(g_7[c][r]);
+    for (int c = 0; c < 3; ++c) for (int r = 0; r < 3; ++r) g_out[34 + c * 3 + r] = float(g_8[c][r]);
+    for (int c = 0; c < 3; ++c) for (int r = 0; r < 4; ++r) g_out[43 + c * 4 + r] = float(g_9[c][r]);
+    for (int c = 0; c < 4; ++c) for (int r = 0; r < 2; ++r) g_out[55 + c * 2 + r] = float(g_10[c][r]);
+    for (int c = 0; c < 4; ++c) for (int r = 0; r < 3; ++r) g_out[63 + c * 3 + r] = float(g_11[c][r]);
+    for (int c = 0; c < 4; ++c) for (int r = 0; r < 4; ++r) g_out[75 + c * 4 + r] = float(g_12[c][r]);
+}
+)";
+
+        // The values the CTS case sets, spelled the way it spells them - column-major, and small
+        // enough that every one is exact in a float. Nothing here is a precision question; a
+        // component that comes back wrong came back from the wrong bytes.
+        constexpr double kG0 = 1.0;
+        constexpr double kG1[2] = {2.0, 3.0};
+        constexpr double kG2[3] = {4.0, 5.0, 6.0};
+        constexpr double kG3[4] = {7.0, 8.0, 9.0, 10.0};
+        constexpr double kG4[4] = {11.0, 12.0, 13.0, 14.0};
+        constexpr double kG5[6] = {15.0, 16.0, 17.0, 18.0, 19.0, 20.0};
+        constexpr double kG6[8] = {21.0, 22.0, 23.0, 24.0, 25.0, 26.0, 27.0, 28.0};
+        constexpr double kG7[6] = {29.0, 30.0, 31.0, 32.0, 33.0, 34.0};
+        constexpr double kG8[9] = {35.0, 36.0, 37.0, 38.0, 39.0, 40.0, 41.0, 42.0, 43.0};
+        constexpr double kG9[12] = {44.0, 45.0, 46.0, 47.0, 48.0, 49.0, 50.0, 51.0, 52.0, 53.0, 54.0, 55.0};
+        constexpr double kG10[8] = {56.0, 57.0, 58.0, 59.0, 60.0, 61.0, 62.0, 63.0};
+        constexpr double kG11[12] = {63.0, 64.0, 65.0, 66.0, 67.0, 68.0, 69.0, 70.0, 71.0, 27.0, 73.0, 74.0};
+        constexpr double kG12[16] = {75.0, 76.0, 77.0, 78.0, 79.0, 80.0, 81.0, 82.0,
+                                     83.0, 84.0, 85.0, 86.0, 87.0, 88.0, 89.0, 90.0};
+
+        struct DoubleShape {
+            const char* name;
+            int base;
+            int columns; // 1 for the scalar and the vectors
+            int rows;    // component count for the scalar and the vectors
+            const double* values;
+        };
+
+        constexpr DoubleShape kDoubleShapes[] = {
+            {"g_0 double", 0, 1, 1, &kG0},      {"g_1 dvec2", 1, 1, 2, kG1},
+            {"g_2 dvec3", 3, 1, 3, kG2},        {"g_3 dvec4", 6, 1, 4, kG3},
+            {"g_4 dmat2", 10, 2, 2, kG4},       {"g_5 dmat2x3", 14, 2, 3, kG5},
+            {"g_6 dmat2x4", 20, 2, 4, kG6},     {"g_7 dmat3x2", 28, 3, 2, kG7},
+            {"g_8 dmat3", 34, 3, 3, kG8},       {"g_9 dmat3x4", 43, 3, 4, kG9},
+            {"g_10 dmat4x2", 55, 4, 2, kG10},   {"g_11 dmat4x3", 63, 4, 3, kG11},
+            {"g_12 dmat4", 75, 4, 4, kG12},
+        };
+
+        constexpr int kAllShapeSlots = 91;
+
+        // The conformance case's own shader, kept verbatim down to the literal suffixes and the
+        // unnamed, unqualified storage block - except that each comparison sets its OWN bit
+        // instead of collapsing all thirteen into one flag. That single flag is the whole reason
+        // the case was unexplained for a wave: it says "something is wrong" and nothing else.
+        //
+        // Verbatim matters here. Reading the components out one at a time (the case above)
+        // passes; whatever fails does so through the shape the conformance case actually
+        // writes - whole-matrix comparison against a constructor, a storage block with no
+        // layout qualifier and no instance name, values reached with constant indices.
+        constexpr const char* kCtsShapedSource = R"(
+layout(local_size_x = 1) in;
+buffer Result {
+  int g_result;
+};
+uniform double g_0;
+uniform dvec2 g_1;
+uniform dvec3 g_2;
+uniform dvec4 g_3;
+uniform dmat2 g_4;
+uniform dmat2x3 g_5;
+uniform dmat2x4 g_6;
+uniform dmat3x2 g_7;
+uniform dmat3 g_8;
+uniform dmat3x4 g_9;
+uniform dmat4x2 g_10;
+uniform dmat4x3 g_11;
+uniform dmat4 g_12;
+
+void main() {
+  g_result = 0;
+
+  if (g_0 != 1.0LF) g_result |= 1;
+  if (g_1 != dvec2(2.0LF, 3.0LF)) g_result |= 2;
+  if (g_2 != dvec3(4.0LF, 5.0LF, 6.0LF)) g_result |= 4;
+  if (g_3 != dvec4(7.0LF, 8.0LF, 9.0LF, 10.0LF)) g_result |= 8;
+
+  if (g_4 != dmat2(11.0LF, 12.0LF, 13.0LF, 14.0LF)) g_result |= 16;
+  if (g_5 != dmat2x3(15.0LF, 16.0LF, 17.0LF, 18.0LF, 19.0LF, 20.0LF)) g_result |= 32;
+  if (g_6 != dmat2x4(21.0LF, 22.0LF, 23.0LF, 24.0LF, 25.0LF, 26.0LF, 27.0LF, 28.0LF)) g_result |= 64;
+
+  if (g_7 != dmat3x2(29.0LF, 30.0LF, 31.0LF, 32.0LF, 33.0LF, 34.0LF)) g_result |= 128;
+  if (g_8 != dmat3(35.0LF, 36.0LF, 37.0LF, 38.0LF, 39.0LF, 40.0LF, 41.0LF, 42.0LF, 43.0LF)) g_result |= 256;
+  if (g_9 != dmat3x4(44.0LF, 45.0LF, 46.0LF, 47.0LF, 48.0LF, 49.0LF, 50.0LF, 51.0LF, 52.0LF, 53.0LF, 54.0LF, 55.0LF)) g_result |= 512;
+
+  if (g_10 != dmat4x2(56.0, 57.0, 58.0, 59.0, 60.0, 61.0, 62.0, 63.0)) g_result |= 1024;
+  if (g_11 != dmat4x3(63.0, 64.0, 65.0, 66.0, 67.0, 68.0, 69.0, 70.0, 71.0, 27.0, 73, 74.0)) g_result |= 2048;
+  if (g_12 != dmat4(75.0, 76.0, 77.0, 78.0, 79.0, 80.0, 81.0, 82.0, 83.0, 84.0, 85.0, 86.0, 87.0, 88.0, 89.0, 90.0)) g_result |= 4096;
+}
+)";
+
         TEST_F(DoublePrecisionScenario, ADoubleUniformReachesTheShaderAtFloatPrecision) {
             if (!Ready()) return;
             glUseProgram(m_program);
@@ -353,6 +493,190 @@ void main() {
             EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
         }
 
+        TEST_F(DoublePrecisionScenario, EveryDoubleUniformShapeArrivesWhereTheShaderReadsIt) {
+            if (!Ready()) return;
+            // Built the way the CTS case builds it, because every step of that build has been a
+            // bug here at least once: the source arrives as TWO strings (the version directive
+            // and the body), the shader is attached before it has a source and deleted while
+            // still attached, and the program is linked twice.
+            m_shapeProgram = glCreateProgram();
+            ASSERT_NE(m_shapeProgram, 0u);
+            {
+                const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+                glAttachShader(m_shapeProgram, shader);
+                glDeleteShader(shader);
+                const char* const sources[2] = {"#version 430 core\n", kAllDoubleShapesSource};
+                glShaderSource(shader, 2, sources, nullptr);
+                glCompileShader(shader);
+                GLint compiled = 0;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    FAIL() << "compute shader did not compile: " << log;
+                }
+            }
+            glLinkProgram(m_shapeProgram);
+            {
+                GLint linkedOnce = 0;
+                glGetProgramiv(m_shapeProgram, GL_LINK_STATUS, &linkedOnce);
+                if (linkedOnce == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetProgramInfoLog(m_shapeProgram, sizeof(log) - 1, nullptr, log);
+                    FAIL() << "compute program did not link: " << log;
+                }
+            }
+
+            glGenBuffers(1, &m_shapeOutput);
+            glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_shapeOutput);
+            const std::vector<float> zeroes(kAllShapeSlots, 0.0f);
+            glBufferData(GL_SHADER_STORAGE_BUFFER, kAllShapeSlots * sizeof(float), zeroes.data(), GL_DYNAMIC_DRAW);
+            glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, m_shapeOutput);
+            glBindBuffer(GL_SHADER_STORAGE_BUFFER, 0);
+
+            const auto location = [&](const char* name) { return glGetUniformLocation(m_shapeProgram, name); };
+
+            // Pass one sets through glProgramUniform*, pass two through glUniform* after a
+            // re-link - the two entry-point families the CTS case exercises, and two different
+            // routes into the same uniform storage.
+            const auto setWithProgramUniform = [&]() {
+                glProgramUniform1d(m_shapeProgram, location("g_0"), kG0);
+                glProgramUniform2d(m_shapeProgram, location("g_1"), kG1[0], kG1[1]);
+                glProgramUniform3d(m_shapeProgram, location("g_2"), kG2[0], kG2[1], kG2[2]);
+                glProgramUniform4d(m_shapeProgram, location("g_3"), kG3[0], kG3[1], kG3[2], kG3[3]);
+                glProgramUniformMatrix2dv(m_shapeProgram, location("g_4"), 1, GL_FALSE, kG4);
+                glProgramUniformMatrix2x3dv(m_shapeProgram, location("g_5"), 1, GL_FALSE, kG5);
+                glProgramUniformMatrix2x4dv(m_shapeProgram, location("g_6"), 1, GL_FALSE, kG6);
+                glProgramUniformMatrix3x2dv(m_shapeProgram, location("g_7"), 1, GL_FALSE, kG7);
+                glProgramUniformMatrix3dv(m_shapeProgram, location("g_8"), 1, GL_FALSE, kG8);
+                glProgramUniformMatrix3x4dv(m_shapeProgram, location("g_9"), 1, GL_FALSE, kG9);
+                glProgramUniformMatrix4x2dv(m_shapeProgram, location("g_10"), 1, GL_FALSE, kG10);
+                glProgramUniformMatrix4x3dv(m_shapeProgram, location("g_11"), 1, GL_FALSE, kG11);
+                glProgramUniformMatrix4dv(m_shapeProgram, location("g_12"), 1, GL_FALSE, kG12);
+            };
+            // Deliberately does NOT re-issue glUseProgram: the CTS case leaves the program
+            // current across the re-link and writes into it from there, so this is the path
+            // where a re-link has to keep the current program's uniform storage addressable.
+            const auto setWithUniform = [&]() {
+                glUniform1d(location("g_0"), kG0);
+                glUniform2d(location("g_1"), kG1[0], kG1[1]);
+                glUniform3d(location("g_2"), kG2[0], kG2[1], kG2[2]);
+                glUniform4d(location("g_3"), kG3[0], kG3[1], kG3[2], kG3[3]);
+                glUniformMatrix2dv(location("g_4"), 1, GL_FALSE, kG4);
+                glUniformMatrix2x3dv(location("g_5"), 1, GL_FALSE, kG5);
+                glUniformMatrix2x4dv(location("g_6"), 1, GL_FALSE, kG6);
+                glUniformMatrix3x2dv(location("g_7"), 1, GL_FALSE, kG7);
+                glUniformMatrix3dv(location("g_8"), 1, GL_FALSE, kG8);
+                glUniformMatrix3x4dv(location("g_9"), 1, GL_FALSE, kG9);
+                glUniformMatrix4x2dv(location("g_10"), 1, GL_FALSE, kG10);
+                glUniformMatrix4x3dv(location("g_11"), 1, GL_FALSE, kG11);
+                glUniformMatrix4dv(location("g_12"), 1, GL_FALSE, kG12);
+            };
+
+            const auto dispatchAndRead = [&]() {
+                glUseProgram(m_shapeProgram);
+                glDispatchCompute(1, 1, 1);
+                glMemoryBarrier(GL_BUFFER_UPDATE_BARRIER_BIT);
+                std::vector<float> values(kAllShapeSlots, -1.0f);
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_shapeOutput);
+                glGetBufferSubData(GL_SHADER_STORAGE_BUFFER, 0, kAllShapeSlots * sizeof(float), values.data());
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, 0);
+                // The program stays current on purpose - see setWithUniform.
+                return values;
+            };
+
+            const auto expectEverything = [](const std::vector<float>& values, const char* pass) {
+                for (const DoubleShape& shape : kDoubleShapes) {
+                    for (int c = 0; c < shape.columns; ++c) {
+                        for (int r = 0; r < shape.rows; ++r) {
+                            const int component = c * shape.rows + r;
+                            EXPECT_FLOAT_EQ(values[shape.base + component],
+                                            static_cast<float>(shape.values[component]))
+                                << pass << ": " << shape.name << " column " << c << " row " << r;
+                        }
+                    }
+                }
+            };
+
+            setWithProgramUniform();
+            expectEverything(dispatchAndRead(), "glProgramUniform*");
+
+            // A re-link zeroes every uniform, so pass two proves its own writes rather than
+            // reading pass one's bytes back.
+            glLinkProgram(m_shapeProgram);
+            GLint linked = 0;
+            glGetProgramiv(m_shapeProgram, GL_LINK_STATUS, &linked);
+            ASSERT_EQ(linked, GL_TRUE);
+            glBindBuffer(GL_SHADER_STORAGE_BUFFER, m_shapeOutput);
+            glBufferSubData(GL_SHADER_STORAGE_BUFFER, 0, kAllShapeSlots * sizeof(float), zeroes.data());
+            glBindBuffer(GL_SHADER_STORAGE_BUFFER, 0);
+
+            setWithUniform();
+            expectEverything(dispatchAndRead(), "glUniform* after re-link");
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+        }
+
+        TEST_F(DoublePrecisionScenario, TheConformanceUniformShaderAgreesWithEveryValueItWasGiven) {
+            if (!Ready()) return;
+            m_shapeProgram = glCreateProgram();
+            ASSERT_NE(m_shapeProgram, 0u);
+            {
+                const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+                glAttachShader(m_shapeProgram, shader);
+                glDeleteShader(shader);
+                const char* const sources[2] = {"#version 430 core\n", kCtsShapedSource};
+                glShaderSource(shader, 2, sources, nullptr);
+                glCompileShader(shader);
+                GLint compiled = 0;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[2048] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    FAIL() << "compute shader did not compile: " << log;
+                }
+            }
+            glLinkProgram(m_shapeProgram);
+            GLint linked = 0;
+            glGetProgramiv(m_shapeProgram, GL_LINK_STATUS, &linked);
+            if (linked == GL_FALSE) {
+                char log[2048] = {};
+                glGetProgramInfoLog(m_shapeProgram, sizeof(log) - 1, nullptr, log);
+                FAIL() << "compute program did not link: " << log;
+            }
+
+            glGenBuffers(1, &m_shapeOutput);
+            const GLint seed = 123;
+            glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, m_shapeOutput);
+            glBufferData(GL_SHADER_STORAGE_BUFFER, sizeof(seed), &seed, GL_STATIC_DRAW);
+
+            const auto location = [&](const char* name) { return glGetUniformLocation(m_shapeProgram, name); };
+            glProgramUniform1d(m_shapeProgram, location("g_0"), kG0);
+            glProgramUniform2d(m_shapeProgram, location("g_1"), kG1[0], kG1[1]);
+            glProgramUniform3d(m_shapeProgram, location("g_2"), kG2[0], kG2[1], kG2[2]);
+            glProgramUniform4d(m_shapeProgram, location("g_3"), kG3[0], kG3[1], kG3[2], kG3[3]);
+            glProgramUniformMatrix2dv(m_shapeProgram, location("g_4"), 1, GL_FALSE, kG4);
+            glProgramUniformMatrix2x3dv(m_shapeProgram, location("g_5"), 1, GL_FALSE, kG5);
+            glProgramUniformMatrix2x4dv(m_shapeProgram, location("g_6"), 1, GL_FALSE, kG6);
+            glProgramUniformMatrix3x2dv(m_shapeProgram, location("g_7"), 1, GL_FALSE, kG7);
+            glProgramUniformMatrix3dv(m_shapeProgram, location("g_8"), 1, GL_FALSE, kG8);
+            glProgramUniformMatrix3x4dv(m_shapeProgram, location("g_9"), 1, GL_FALSE, kG9);
+            glProgramUniformMatrix4x2dv(m_shapeProgram, location("g_10"), 1, GL_FALSE, kG10);
+            glProgramUniformMatrix4x3dv(m_shapeProgram, location("g_11"), 1, GL_FALSE, kG11);
+            glProgramUniformMatrix4dv(m_shapeProgram, location("g_12"), 1, GL_FALSE, kG12);
+
+            glUseProgram(m_shapeProgram);
+            glDispatchCompute(1, 1, 1);
+            glMemoryBarrier(GL_BUFFER_UPDATE_BARRIER_BIT);
+
+            GLint disagreements = -1;
+            glGetBufferSubData(GL_SHADER_STORAGE_BUFFER, 0, sizeof(disagreements), &disagreements);
+            for (int bit = 0; bit < 13; ++bit) {
+                EXPECT_EQ(disagreements & (1 << bit), 0)
+                    << kDoubleShapes[bit].name << " did not compare equal to the value it was given";
+            }
+            EXPECT_EQ(glGetError(), static_cast<GLenum>(GL_NO_ERROR));
+        }
+
         TEST_F(DoublePrecisionScenario, TheFp64ExtensionIsNotAdvertised) {
             if (!Ready()) return;
             // The shader above compiled, linked and ran without the extension string, which is

MobileGL/MG_IntegrationTest/Scenarios/ImageTargetKindScenario.cpp

@@ -0,0 +1,550 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/ImageTargetKindScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// Scenario - ONE IMAGE TARGET KIND AT A TIME, THROUGH A COMPUTE DISPATCH.
+//
+// KHR-GL44.multi_bind.dispatch_bind_image_textures decomposed. That conformance case declares
+// ELEVEN image uniforms of eleven different target kinds in one compute shader, binds a texture
+// of the matching kind to each unit, sums one texel from every one of them and compares the sum
+// against N*(N-1)/2. It is a single pass/fail bit over eleven independent mechanisms: if any one
+// of them is wrong - or merely fails to compile - the case fails and says nothing about which.
+// That is what it did here, on both backends, for two waves.
+//
+// So the eleven are pulled apart into one case each. Each case declares ONE image uniform, binds
+// ONE texture and checks the value that comes back, so a failure names the target kind and the
+// direction. What the conformance case does with eleven at once, AllKindsInOneProgram at the
+// bottom still does - a defect that only appears when several kinds share a program is invisible
+// to the single-kind cases by construction.
+//
+// The shape is deliberately the conformance case's own, not a cleaner equivalent:
+//
+//   * r32ui / GL_R32UI throughout, 6x6x6 storage, one level, texel (0,0,0) read;
+//   * `layout (location = N, r32ui) readonly uniform` - an explicit uniform LOCATION, not a
+//     binding, with the image unit then assigned by glUniform1i. That combination is the one ES
+//     cannot express directly, because ES forbids glUniform1i on an image uniform and the unit
+//     has to be baked into the generated ESSL (RebindImageUniformsToFrontendUnits);
+//   * `layout (std140, ...) buffer` for the result block - legal, but unusual enough that a
+//     frontend could plausibly mishandle it. Mirroring it means a green scenario cannot be green
+//     for a reason the conformance case excludes;
+//   * glBindImageTexture with layered = GL_TRUE, which is what glBindImageTextures is specified
+//     to pass, and which is where a target kind whose layeredness a backend does not recognise
+//     goes wrong.
+//
+// MULTISAMPLE is the one kind that is not merely an emulation problem, and the conformance case
+// already knows it: it reads GL_MAX_IMAGE_SAMPLES and, when that is zero, substitutes a plain 2D
+// texture and a plain uimage2D for both multisample entries. MobileGL reports zero, so the
+// conformance case never asks it for a multisample image at all. The two cases below are kept
+// and skip on that same query, so the coverage is already written the day a backend advertises
+// them - and so the skip is a standing record of WHY the conformance case passes without them.
+
+#include <algorithm>
+#include <cstddef>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        // The conformance case's own dimensions: one level, 6 on every axis (which is also
+        // exactly one cube's worth for a cube array), and a single texel read at the origin.
+        constexpr int kExtent = 6;
+        constexpr GLuint kFilledValue = 7u;
+        constexpr GLuint kStoredValue = 13u;
+
+        // Everything that differs between the eleven kinds, in one row.
+        struct TargetKind {
+            const char* name;      // this scenario's name for it, which failure messages carry
+            GLenum target;         // the GL texture target
+            const char* imageType; // the GLSL image uniform type
+            const char* coord;     // the coordinate expression imageLoad/imageStore takes
+            bool multisample;      // needs GL_MAX_IMAGE_SAMPLES > 0
+            bool buffer;           // storage comes from a buffer object, not TexStorage
+        };
+
+        constexpr TargetKind kKind1D{"1D", GL_TEXTURE_1D, "uimage1D", "0", false, false};
+        constexpr TargetKind kKind1DArray{"1DArray", GL_TEXTURE_1D_ARRAY, "uimage1DArray", "ivec2(0, 0)", false,
+                                          false};
+        constexpr TargetKind kKind2D{"2D", GL_TEXTURE_2D, "uimage2D", "ivec2(0, 0)", false, false};
+        constexpr TargetKind kKind2DArray{"2DArray", GL_TEXTURE_2D_ARRAY, "uimage2DArray", "ivec3(0, 0, 0)", false,
+                                          false};
+        constexpr TargetKind kKind3D{"3D", GL_TEXTURE_3D, "uimage3D", "ivec3(0, 0, 0)", false, false};
+        constexpr TargetKind kKindBuffer{"Buffer", GL_TEXTURE_BUFFER, "uimageBuffer", "0", false, true};
+        constexpr TargetKind kKindCube{"Cube", GL_TEXTURE_CUBE_MAP, "uimageCube", "ivec3(0, 0, 0)", false, false};
+        constexpr TargetKind kKindCubeArray{"CubeArray", GL_TEXTURE_CUBE_MAP_ARRAY, "uimageCubeArray",
+                                            "ivec3(0, 0, 0)", false, false};
+        constexpr TargetKind kKindRect{"Rect", GL_TEXTURE_RECTANGLE, "uimage2DRect", "ivec2(0, 0)", false, false};
+        constexpr TargetKind kKind2DMS{"2DMS", GL_TEXTURE_2D_MULTISAMPLE, "uimage2DMS", "ivec2(0, 0)", true, false};
+        constexpr TargetKind kKind2DMSArray{"2DMSArray", GL_TEXTURE_2D_MULTISAMPLE_ARRAY, "uimage2DMSArray",
+                                            "ivec3(0, 0, 0)", true, false};
+
+        // A multisample image load/store takes the sample index as an extra argument; no other
+        // kind does. Keeping that in one place stops the two spellings drifting apart.
+        std::string LoadExpression(const TargetKind& kind, const std::string& name) {
+            return "imageLoad(" + name + ", " + kind.coord + (kind.multisample ? ", 0)" : ")");
+        }
+
+        std::string StoreStatement(const TargetKind& kind, const std::string& name, const char* value) {
+            return "imageStore(" + name + ", " + kind.coord + (kind.multisample ? ", 0, uvec4(" : ", uvec4(") +
+                   value + ", 0, 0, 0));";
+        }
+
+        const char* kComputePrologue = "#version 440 core\n"
+                                       "\n"
+                                       "layout (local_size_x = 1, local_size_y = 1, local_size_z = 1) in;\n"
+                                       "\n";
+
+        const char* kResultBlock = "layout (std140, binding = 0) buffer SSB {\n"
+                                   "    uint sum;\n"
+                                   "} ssb;\n"
+                                   "\n";
+
+        // The conformance case's shader, narrowed to a single image.
+        std::string SingleLoadSource(const TargetKind& kind) {
+            return std::string(kComputePrologue) + "layout (location = 0, r32ui) readonly uniform " + kind.imageType +
+                   " i0;\n" + kResultBlock + "void main()\n{\n    uvec4 v = " + LoadExpression(kind, "i0") +
+                   ";\n    ssb.sum = v.r;\n}\n";
+        }
+
+        // The other direction. Written as its own program rather than a read-write one so that a
+        // backend which gets the store right and the load wrong (or the reverse) is not able to
+        // cancel its own defect out.
+        std::string SingleStoreSource(const TargetKind& kind) {
+            return std::string(kComputePrologue) + "layout (location = 0, r32ui) writeonly uniform " +
+                   kind.imageType + " i0;\n\nvoid main()\n{\n    " + StoreStatement(kind, "i0", "13u") + "\n}\n";
+        }
+
+        class ImageTargetKindScenario : public ScenarioTest {
+        protected:
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                for (GLuint p : m_programs) glDeleteProgram(p);
+                for (GLuint t : m_textures) glDeleteTextures(1, &t);
+                for (GLuint b : m_buffers) glDeleteBuffers(1, &b);
+                m_programs.clear();
+                m_textures.clear();
+                m_buffers.clear();
+                // Leave no image unit bound. These scenarios share one context, and a stale image
+                // binding is exactly the kind of state that makes the NEXT scenario's failure
+                // impossible to reproduce on its own.
+                GLint maxImageUnits = 0;
+                glGetIntegerv(GL_MAX_IMAGE_UNITS, &maxImageUnits);
+                for (GLint unit = 0; unit < maxImageUnits; ++unit) {
+                    glBindImageTexture(static_cast<GLuint>(unit), 0, 0, GL_FALSE, 0, GL_READ_ONLY, GL_R32UI);
+                }
+                glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, 0);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+            }
+
+            bool ImagesAreUsable() const {
+                GLint maxImageUnits = 0;
+                glGetIntegerv(GL_MAX_IMAGE_UNITS, &maxImageUnits);
+                GLint maxComputeImageUniforms = 0;
+                glGetIntegerv(GL_MAX_COMPUTE_IMAGE_UNIFORMS, &maxComputeImageUniforms);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return maxImageUnits >= 1 && maxComputeImageUniforms >= 1;
+            }
+
+            // The conformance case's own multisample gate, asked the same way it asks it.
+            bool MultisampleImagesAreUsable() const {
+                GLint maxImageSamples = 0;
+                glGetIntegerv(GL_MAX_IMAGE_SAMPLES, &maxImageSamples);
+                while (glGetError() != GL_NO_ERROR) {
+                }
+                return maxImageSamples > 0;
+            }
+
+            GLuint MakeComputeProgram(const std::string& source) {
+                const GLuint shader = glCreateShader(GL_COMPUTE_SHADER);
+                const char* text = source.c_str();
+                glShaderSource(shader, 1, &text, nullptr);
+                glCompileShader(shader);
+                GLint compiled = GL_FALSE;
+                glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+                if (compiled == GL_FALSE) {
+                    char log[4096] = {};
+                    glGetShaderInfoLog(shader, sizeof(log) - 1, nullptr, log);
+                    ADD_FAILURE() << "the compute shader did not compile: " << log << "\nsource:\n" << source;
+                    glDeleteShader(shader);
+                    return 0;
+                }
+                const GLuint program = glCreateProgram();
+                m_programs.push_back(program);
+                glAttachShader(program, shader);
+                glLinkProgram(program);
+                glDeleteShader(shader);
+                GLint linked = GL_FALSE;
+                glGetProgramiv(program, GL_LINK_STATUS, &linked);
+                if (linked == GL_FALSE) {
+                    char log[4096] = {};
+                    glGetProgramInfoLog(program, sizeof(log) - 1, nullptr, log);
+                    ADD_FAILURE() << "the compute program did not link: " << log << "\nsource:\n" << source;
+                    return 0;
+                }
+                return program;
+            }
+
+            // Storage plus a full fill with `value`, in the spelling each target kind needs.
+            // Returns 0 - having already reported - when the target could not be created.
+            GLuint MakeTexture(const TargetKind& kind, bool fill, GLuint value = kFilledValue) {
+                const std::vector<GLuint> texels(static_cast<std::size_t>(kExtent) * kExtent * kExtent, value);
+
+                if (kind.buffer) {
+                    GLuint buffer = 0;
+                    glGenBuffers(1, &buffer);
+                    m_buffers.push_back(buffer);
+                    glBindBuffer(GL_TEXTURE_BUFFER, buffer);
+                    glBufferData(GL_TEXTURE_BUFFER, static_cast<GLsizeiptr>(texels.size() * sizeof(GLuint)),
+                                 fill ? texels.data() : nullptr, GL_DYNAMIC_COPY);
+                    GLuint texture = 0;
+                    glGenTextures(1, &texture);
+                    m_textures.push_back(texture);
+                    glBindTexture(GL_TEXTURE_BUFFER, texture);
+                    glTexBuffer(GL_TEXTURE_BUFFER, GL_R32UI, buffer);
+                    if (const GLenum error = FirstGLError()) {
+                        ADD_FAILURE() << kind.name << ": creating the texture buffer errored with "
+                                      << GLErrorName(error);
+                        return 0;
+                    }
+                    return texture;
+                }
+
+                GLuint texture = 0;
+                glGenTextures(1, &texture);
+                m_textures.push_back(texture);
+                glBindTexture(kind.target, texture);
+
+                switch (kind.target) {
+                case GL_TEXTURE_1D:
+                    glTexStorage1D(kind.target, 1, GL_R32UI, kExtent);
+                    break;
+                case GL_TEXTURE_2D:
+                case GL_TEXTURE_RECTANGLE:
+                case GL_TEXTURE_1D_ARRAY:
+                case GL_TEXTURE_CUBE_MAP:
+                    glTexStorage2D(kind.target, 1, GL_R32UI, kExtent, kExtent);
+                    break;
+                case GL_TEXTURE_2D_ARRAY:
+                case GL_TEXTURE_3D:
+                case GL_TEXTURE_CUBE_MAP_ARRAY:
+                    glTexStorage3D(kind.target, 1, GL_R32UI, kExtent, kExtent, kExtent);
+                    break;
+                case GL_TEXTURE_2D_MULTISAMPLE:
+                    glTexStorage2DMultisample(kind.target, 1, GL_R32UI, kExtent, kExtent, GL_FALSE);
+                    break;
+                case GL_TEXTURE_2D_MULTISAMPLE_ARRAY:
+                    glTexStorage3DMultisample(kind.target, 1, GL_R32UI, kExtent, kExtent, kExtent, GL_FALSE);
+                    break;
+                default:
+                    ADD_FAILURE() << kind.name << ": no storage spelling for target 0x" << std::hex << kind.target;
+                    return 0;
+                }
+                if (const GLenum error = FirstGLError()) {
+                    ADD_FAILURE() << kind.name << ": allocating storage errored with " << GLErrorName(error);
+                    return 0;
+                }
+
+                // A multisample texture has no TexSubImage - the conformance case fills it with a
+                // compute pass, which is what the store cases below do.
+                if (!fill || kind.multisample) return texture;
+
+                switch (kind.target) {
+                case GL_TEXTURE_1D:
+                    glTexSubImage1D(kind.target, 0, 0, kExtent, GL_RED_INTEGER, GL_UNSIGNED_INT, texels.data());
+                    break;
+                case GL_TEXTURE_2D:
+                case GL_TEXTURE_RECTANGLE:
+                case GL_TEXTURE_1D_ARRAY:
+                    glTexSubImage2D(kind.target, 0, 0, 0, kExtent, kExtent, GL_RED_INTEGER, GL_UNSIGNED_INT,
+                                    texels.data());
+                    break;
+                case GL_TEXTURE_CUBE_MAP:
+                    for (int face = 0; face < 6; ++face) {
+                        glTexSubImage2D(static_cast<GLenum>(GL_TEXTURE_CUBE_MAP_POSITIVE_X + face), 0, 0, 0, kExtent,
+                                        kExtent, GL_RED_INTEGER, GL_UNSIGNED_INT, texels.data());
+                    }
+                    break;
+                case GL_TEXTURE_2D_ARRAY:
+                case GL_TEXTURE_3D:
+                case GL_TEXTURE_CUBE_MAP_ARRAY:
+                    glTexSubImage3D(kind.target, 0, 0, 0, 0, kExtent, kExtent, kExtent, GL_RED_INTEGER,
+                                    GL_UNSIGNED_INT, texels.data());
+                    break;
+                default:
+                    break;
+                }
+                if (const GLenum error = FirstGLError()) {
+                    ADD_FAILURE() << kind.name << ": uploading texels errored with " << GLErrorName(error);
+                    return 0;
+                }
+                return texture;
+            }
+
+            // A 4-byte `buffer` block bound to base 0, which is where every case puts its answer.
+            GLuint MakeResultBuffer() {
+                GLuint ssbo = 0;
+                glGenBuffers(1, &ssbo);
+                m_buffers.push_back(ssbo);
+                const GLuint zero = 0u;
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, ssbo);
+                glBufferData(GL_SHADER_STORAGE_BUFFER, sizeof(GLuint), &zero, GL_DYNAMIC_COPY);
+                glBindBufferBase(GL_SHADER_STORAGE_BUFFER, 0, ssbo);
+                return ssbo;
+            }
+
+            GLuint ReadResult(GLuint ssbo) {
+                glBindBuffer(GL_SHADER_STORAGE_BUFFER, ssbo);
+                GLuint value = 0xFFFFFFFFu;
+                glGetBufferSubData(GL_SHADER_STORAGE_BUFFER, 0, sizeof(GLuint), &value);
+                return value;
+            }
+
+            // Fill a texture of `kind`, read texel (0,0,0) of it through an image uniform in a
+            // compute dispatch, and require the value back.
+            void RunLoadCase(const TargetKind& kind) {
+                const GLuint program = MakeComputeProgram(SingleLoadSource(kind));
+                if (program == 0) return;
+                const GLuint texture = MakeTexture(kind, true);
+                if (texture == 0) return;
+                const GLuint ssbo = MakeResultBuffer();
+
+                glBindImageTexture(0, texture, 0, GL_TRUE, 0, GL_READ_ONLY, GL_R32UI);
+                ASSERT_EQ(FirstGLError(), 0u) << kind.name << ": glBindImageTexture errored";
+
+                glUseProgram(program);
+                // The unit, by LOCATION - the conformance case's own redundant-but-legal
+                // assignment, and the one ES cannot take at the API level.
+                glUniform1i(0, 0);
+                ASSERT_EQ(FirstGLError(), 0u) << kind.name << ": assigning the image unit errored";
+
+                glDispatchCompute(1, 1, 1);
+                glMemoryBarrier(GL_ALL_BARRIER_BITS);
+                EXPECT_EQ(FirstGLError(), 0u) << kind.name << ": the dispatch leaked a GL error";
+
+                EXPECT_EQ(ReadResult(ssbo), kFilledValue)
+                    << kind.name << ": the compute dispatch did not read the value the texture was filled with";
+                glUseProgram(0);
+            }
+
+            // The other direction: store through an image uniform, then read the same texel back
+            // through a SECOND program, so a defect cannot cancel itself out.
+            void RunStoreCase(const TargetKind& kind) {
+                const GLuint storeProgram = MakeComputeProgram(SingleStoreSource(kind));
+                const GLuint loadProgram = MakeComputeProgram(SingleLoadSource(kind));
+                if (storeProgram == 0 || loadProgram == 0) return;
+                const GLuint texture = MakeTexture(kind, false);
+                if (texture == 0) return;
+                const GLuint ssbo = MakeResultBuffer();
+
+                glBindImageTexture(0, texture, 0, GL_TRUE, 0, GL_READ_WRITE, GL_R32UI);
+                ASSERT_EQ(FirstGLError(), 0u) << kind.name << ": glBindImageTexture errored";
+
+                glUseProgram(storeProgram);
+                glUniform1i(0, 0);
+                glDispatchCompute(1, 1, 1);
+                glMemoryBarrier(GL_ALL_BARRIER_BITS);
+                EXPECT_EQ(FirstGLError(), 0u) << kind.name << ": the storing dispatch leaked a GL error";
+
+                glUseProgram(loadProgram);
+                glUniform1i(0, 0);
+                glDispatchCompute(1, 1, 1);
+                glMemoryBarrier(GL_ALL_BARRIER_BITS);
+                EXPECT_EQ(FirstGLError(), 0u) << kind.name << ": the loading dispatch leaked a GL error";
+
+                EXPECT_EQ(ReadResult(ssbo), kStoredValue)
+                    << kind.name << ": the value stored through the image did not come back";
+                glUseProgram(0);
+            }
+
+            std::vector<GLuint> m_programs;
+            std::vector<GLuint> m_textures;
+            std::vector<GLuint> m_buffers;
+        };
+
+    } // namespace
+
+    // ---- the load direction, one target kind per case -----------------------
+    //
+    // Exactly what the conformance case does with each of its eleven uniforms, but alone, so a
+    // failure names the kind.
+
+#define MGL_DEFINE_LOAD_CASE(CaseName, Kind)                                                                    \
+    TEST_F(ImageTargetKindScenario, Loads##CaseName) {                                                          \
+        if (!Ready()) return;                                                                                   \
+        if (!ImagesAreUsable()) GTEST_SKIP() << "no compute image uniforms";                                    \
+        if ((Kind).multisample && !MultisampleImagesAreUsable()) {                                              \
+            GTEST_SKIP() << "GL_MAX_IMAGE_SAMPLES is 0, so the conformance case substitutes a plain 2D image "   \
+                            "here and never asks for a multisample one";                                        \
+        }                                                                                                       \
+        RunLoadCase(Kind);                                                                                      \
+    }
+
+#define MGL_DEFINE_STORE_CASE(CaseName, Kind)                                                                   \
+    TEST_F(ImageTargetKindScenario, Stores##CaseName) {                                                         \
+        if (!Ready()) return;                                                                                   \
+        if (!ImagesAreUsable()) GTEST_SKIP() << "no compute image uniforms";                                    \
+        if ((Kind).multisample && !MultisampleImagesAreUsable()) {                                              \
+            GTEST_SKIP() << "GL_MAX_IMAGE_SAMPLES is 0, so the conformance case substitutes a plain 2D image "   \
+                            "here and never asks for a multisample one";                                        \
+        }                                                                                                       \
+        RunStoreCase(Kind);                                                                                      \
+    }
+
+    MGL_DEFINE_LOAD_CASE(Texture1D, kKind1D)
+    MGL_DEFINE_LOAD_CASE(Texture1DArray, kKind1DArray)
+    MGL_DEFINE_LOAD_CASE(Texture2D, kKind2D)
+    MGL_DEFINE_LOAD_CASE(Texture2DArray, kKind2DArray)
+    MGL_DEFINE_LOAD_CASE(Texture3D, kKind3D)
+    MGL_DEFINE_LOAD_CASE(TextureBuffer, kKindBuffer)
+    MGL_DEFINE_LOAD_CASE(TextureCube, kKindCube)
+    MGL_DEFINE_LOAD_CASE(TextureCubeArray, kKindCubeArray)
+    MGL_DEFINE_LOAD_CASE(TextureRectangle, kKindRect)
+    MGL_DEFINE_LOAD_CASE(Texture2DMultisample, kKind2DMS)
+    MGL_DEFINE_LOAD_CASE(Texture2DMultisampleArray, kKind2DMSArray)
+
+    MGL_DEFINE_STORE_CASE(Texture1D, kKind1D)
+    MGL_DEFINE_STORE_CASE(Texture1DArray, kKind1DArray)
+    MGL_DEFINE_STORE_CASE(Texture2D, kKind2D)
+    MGL_DEFINE_STORE_CASE(Texture2DArray, kKind2DArray)
+    MGL_DEFINE_STORE_CASE(Texture3D, kKind3D)
+    MGL_DEFINE_STORE_CASE(TextureBuffer, kKindBuffer)
+    MGL_DEFINE_STORE_CASE(TextureCube, kKindCube)
+    MGL_DEFINE_STORE_CASE(TextureCubeArray, kKindCubeArray)
+    MGL_DEFINE_STORE_CASE(TextureRectangle, kKindRect)
+    MGL_DEFINE_STORE_CASE(Texture2DMultisample, kKind2DMS)
+    MGL_DEFINE_STORE_CASE(Texture2DMultisampleArray, kKind2DMSArray)
+
+#undef MGL_DEFINE_LOAD_CASE
+#undef MGL_DEFINE_STORE_CASE
+
+    // ---- and all of them at once -------------------------------------------
+    //
+    // The conformance case's actual shape. The single-kind cases above cannot see a defect that
+    // needs several kinds in one program - a binding remap that only collides when two image
+    // types share a descriptor set, a per-kind rewrite that is not idempotent across declarations
+    // - and that class of defect is precisely what "each kind passes alone but the case still
+    // fails" would mean.
+    //
+    // Each unit is filled with its own DISTINCT value rather than a shared one, so a shortfall
+    // names WHICH kind is missing rather than merely how many are: with one shared value, "three
+    // kinds read zero" and "one kind read zero" differ only by a multiple, and any two kinds are
+    // interchangeable in the total. A sum still cannot see two kinds SWAPPING - addition is
+    // commutative, and the conformance case has exactly the same blind spot - but the single-kind
+    // cases above pin each kind to its own texture already, so a swap cannot hide there.
+    TEST_F(ImageTargetKindScenario, AllKindsInOneProgram) {
+        if (!Ready()) return;
+        if (!ImagesAreUsable()) GTEST_SKIP() << "no compute image uniforms";
+
+        // The two kinds this whole scenario file exists for come FIRST, and that ordering is
+        // load-bearing rather than cosmetic. The list has to be truncated to the device's image
+        // unit count, and the guaranteed minimum is small - ES 3.1 promises only four compute
+        // image uniforms - so a list in the conformance case's own order would put imageBuffer
+        // at index five and drop it on exactly the devices most likely to get it wrong. A test
+        // that quietly stops covering its own subject is worse than one that fails.
+        const bool multisample = MultisampleImagesAreUsable();
+        std::vector<TargetKind> kinds{kKind1DArray, kKindBuffer, kKind2D,   kKind1D,      kKind2DArray,
+                                      kKind3D,      kKindCube,   kKindRect, kKindCubeArray};
+        if (multisample) {
+            kinds.push_back(kKind2DMS);
+            kinds.push_back(kKind2DMSArray);
+        }
+
+        GLint maxComputeImageUniforms = 0;
+        glGetIntegerv(GL_MAX_COMPUTE_IMAGE_UNIFORMS, &maxComputeImageUniforms);
+        GLint maxImageUnits = 0;
+        glGetIntegerv(GL_MAX_IMAGE_UNITS, &maxImageUnits);
+        while (glGetError() != GL_NO_ERROR) {
+        }
+        const std::size_t count =
+            std::min<std::size_t>(kinds.size(), static_cast<std::size_t>(std::max(0, std::min(maxComputeImageUniforms,
+                                                                                              maxImageUnits))));
+        if (count == 0) GTEST_SKIP() << "no image units";
+        // Named, not silently dropped: `expected` is computed over whatever survives, so a
+        // truncated run is self-consistently green and would otherwise never say what it stopped
+        // covering.
+        if (count < kinds.size()) {
+            std::string dropped;
+            for (std::size_t i = count; i < kinds.size(); ++i) {
+                if (!dropped.empty()) dropped += ", ";
+                dropped += kinds[i].name;
+            }
+            RecordProperty("dropped_image_target_kinds", dropped);
+            GTEST_LOG_(INFO) << "only " << count << " image units, so these kinds are not covered by the "
+                             << "combined case: " << dropped;
+        }
+        kinds.resize(count);
+
+        std::string declarations;
+        std::string sum;
+        for (std::size_t i = 0; i < kinds.size(); ++i) {
+            const std::string name = "i" + std::to_string(i);
+            declarations += "layout (location = " + std::to_string(i) + ", r32ui) readonly uniform " +
+                            kinds[i].imageType + " " + name + ";\n";
+            if (!sum.empty()) sum += " + ";
+            sum += LoadExpression(kinds[i], name);
+        }
+        const std::string source = std::string(kComputePrologue) + declarations + kResultBlock +
+                                   "void main()\n{\n    uvec4 v = " + sum + ";\n    ssb.sum = v.r;\n}\n";
+
+        const GLuint program = MakeComputeProgram(source);
+        if (program == 0) return;
+
+        // Powers of two, so the shortfall's bit pattern names exactly which kinds read zero -
+        // no other subset of the values can sum to the same total. Eleven kinds at most, so the
+        // largest is 1 << 10 and the sum cannot approach a uint's range.
+        GLuint expected = 0;
+        for (std::size_t i = 0; i < kinds.size(); ++i) {
+            const GLuint value = 1u << i;
+            const GLuint texture = MakeTexture(kinds[i], true, value);
+            if (texture == 0) return;
+            expected += value;
+            glBindImageTexture(static_cast<GLuint>(i), texture, 0, GL_TRUE, 0, GL_READ_ONLY, GL_R32UI);
+            ASSERT_EQ(FirstGLError(), 0u) << kinds[i].name << ": glBindImageTexture errored";
+        }
+        const GLuint ssbo = MakeResultBuffer();
+
+        glUseProgram(program);
+        for (std::size_t i = 0; i < kinds.size(); ++i) {
+            glUniform1i(static_cast<GLint>(i), static_cast<GLint>(i));
+        }
+        ASSERT_EQ(FirstGLError(), 0u) << "assigning the image units errored";
+
+        glDispatchCompute(1, 1, 1);
+        glMemoryBarrier(GL_ALL_BARRIER_BITS);
+        EXPECT_EQ(FirstGLError(), 0u) << "the dispatch leaked a GL error";
+
+        const GLuint actual = ReadResult(ssbo);
+        std::string missing;
+        for (std::size_t i = 0; i < kinds.size(); ++i) {
+            if ((actual & (1u << i)) == 0u) {
+                if (!missing.empty()) missing += ", ";
+                missing += kinds[i].name;
+            }
+        }
+        EXPECT_EQ(actual, expected)
+            << "the sum over " << kinds.size()
+            << " image target kinds is wrong; each kind contributes its own bit, and these read "
+               "zero: "
+            << (missing.empty() ? "(none - so some kind read a value it was never given)" : missing);
+        glUseProgram(0);
+    }
+
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/VertexArrayEnableDisableScenario.cpp

@@ -0,0 +1,264 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/VertexArrayEnableDisableScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// KHR-GL45.direct_state_access.vertex_arrays_enable_disable_attributes, rebuilt.
+//
+// The case is small and does one unusual thing twice: it turns half of
+// GL_MAX_VERTEX_ATTRIBS attribute arrays on and the other half off with
+// glEnableVertexArrayAttrib / glDisableVertexArrayAttrib on a vertex array object
+// that is NOT bound (it binds the default one first, on purpose), draws one point
+// through a program that reads exactly the enabled half, and checks the sum those
+// arrays produced. Then it swaps which half is enabled, draws again through a
+// SECOND program, and checks the other sum.
+//
+// Both draws capture into ONE four-byte transform feedback buffer, allocated once
+// with immutable storage and read back with glMapBuffer - so anything that only
+// works on the first capture span through a buffer fails the second check while
+// leaving the first one green.
+//
+// It is reassembled here rather than shortened because every one of those details
+// is a candidate: the unbound-VAO enables, the two-program swap, the integer
+// attributes fetched with glVertexAttribIPointer at a stride wider than one
+// element, the second capture span, and the fact that the sums differ ONLY in
+// which arrays contributed (a fetch that ignored the enable state, or one that
+// read the wrong element, lands on a different number, not on garbage).
+
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        GLuint CompileShader(GLenum type, const std::string& source, std::string* log) {
+            const GLuint shader = glCreateShader(type);
+            const char* text = source.c_str();
+            glShaderSource(shader, 1, &text, nullptr);
+            glCompileShader(shader);
+            GLint status = GL_FALSE;
+            glGetShaderiv(shader, GL_COMPILE_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetShaderInfoLog(shader, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteShader(shader);
+                return 0;
+            }
+            return shader;
+        }
+
+        // Declares and sums the even (parity 0) or odd (parity 1) attributes only, with the
+        // locations assigned by glBindAttribLocation rather than a layout qualifier - which is
+        // what the CTS case does, and which makes the attribute set the program reads a link
+        // property rather than a source one.
+        GLuint BuildSumProgram(int parity, int attributeCount, std::string* log) {
+            std::string declarations;
+            std::string copies = "  sum = 0;\n";
+            for (int i = parity; i < attributeCount; i += 2) {
+                declarations += "in int a_" + std::to_string(i) + ";\n";
+                copies += "  sum += a_" + std::to_string(i) + ";\n";
+            }
+            // `flat` where the CTS case has none: an integral shader output cannot be
+            // interpolated, so a driver is within its rights to reject the unqualified form
+            // even with no matching fragment input. The capture reads the same value either
+            // way, and the qualifier keeps this scenario portable off llvmpipe.
+            const std::string vertexSource = "#version 450\n\n" + declarations +
+                                             "flat out int sum;\n\nvoid main()\n{\n" + copies + "}\n";
+            const std::string fragmentSource = R"(#version 450
+
+out vec4 color;
+
+void main()
+{
+    color = vec4(1.0);
+}
+)";
+            const GLuint vertexShader = CompileShader(GL_VERTEX_SHADER, vertexSource, log);
+            if (vertexShader == 0) return 0;
+            const GLuint fragmentShader = CompileShader(GL_FRAGMENT_SHADER, fragmentSource, log);
+            if (fragmentShader == 0) {
+                glDeleteShader(vertexShader);
+                return 0;
+            }
+
+            const GLuint program = glCreateProgram();
+            glAttachShader(program, vertexShader);
+            glAttachShader(program, fragmentShader);
+            const char* varying = "sum";
+            glTransformFeedbackVaryings(program, 1, &varying, GL_INTERLEAVED_ATTRIBS);
+            for (int i = parity; i < attributeCount; i += 2) {
+                const std::string name = "a_" + std::to_string(i);
+                glBindAttribLocation(program, static_cast<GLuint>(i), name.c_str());
+            }
+            glLinkProgram(program);
+            glDeleteShader(vertexShader);
+            glDeleteShader(fragmentShader);
+
+            GLint status = GL_FALSE;
+            glGetProgramiv(program, GL_LINK_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetProgramInfoLog(program, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteProgram(program);
+                return 0;
+            }
+            return program;
+        }
+
+        class VertexArrayEnableDisableScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                glGetIntegerv(GL_MAX_VERTEX_ATTRIBS, &m_attributeCount);
+                ASSERT_GE(m_attributeCount, 16);
+
+                std::string log;
+                m_even = BuildSumProgram(0, m_attributeCount, &log);
+                ASSERT_NE(m_even, 0u) << "even program failed to build: " << log;
+                m_odd = BuildSumProgram(1, m_attributeCount, &log);
+                ASSERT_NE(m_odd, 0u) << "odd program failed to build: " << log;
+
+                // One element per attribute, read as one vertex whose stride spans them all.
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                glGenBuffers(1, &m_vbo);
+                glBindBuffer(GL_ARRAY_BUFFER, m_vbo);
+                std::vector<GLint> reference(static_cast<std::size_t>(m_attributeCount));
+                for (int i = 0; i < m_attributeCount; ++i) reference[static_cast<std::size_t>(i)] = i;
+                glBufferData(GL_ARRAY_BUFFER, static_cast<GLsizeiptr>(reference.size() * sizeof(GLint)),
+                             reference.data(), GL_STATIC_DRAW);
+                for (int i = 0; i < m_attributeCount; ++i) {
+                    glVertexAttribIPointer(static_cast<GLuint>(i), 1, GL_INT,
+                                           static_cast<GLsizei>(sizeof(GLint) * m_attributeCount),
+                                           reinterpret_cast<const void*>(static_cast<std::size_t>(i) * sizeof(GLint)));
+                }
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+
+                // Immutable storage, allocated once, read back with glMapBuffer - the capture
+                // buffer is never respecified between the two spans.
+                glGenBuffers(1, &m_xfb);
+                glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, m_xfb);
+                glBufferStorage(GL_TRANSFORM_FEEDBACK_BUFFER, sizeof(GLint), nullptr, GL_MAP_READ_BIT);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, m_xfb);
+                ASSERT_EQ(glGetError(), GL_NO_ERROR) << "capture buffer setup";
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glUseProgram(0);
+                glBindVertexArray(0);
+                if (m_xfb != 0) glDeleteBuffers(1, &m_xfb);
+                if (m_vbo != 0) glDeleteBuffers(1, &m_vbo);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                if (m_even != 0) glDeleteProgram(m_even);
+                if (m_odd != 0) glDeleteProgram(m_odd);
+                ScenarioTest::TearDown();
+            }
+
+            // Enables one parity's arrays and disables the other's, THROUGH THE OBJECT NAME
+            // while a different vertex array object is bound.
+            void TurnOnAttributes(int enabledParity) {
+                glBindVertexArray(0);
+                for (int i = 0; i < m_attributeCount; ++i) {
+                    if (i % 2 == enabledParity % 2) {
+                        glEnableVertexArrayAttrib(m_vao, static_cast<GLuint>(i));
+                    } else {
+                        glDisableVertexArrayAttrib(m_vao, static_cast<GLuint>(i));
+                    }
+                    ASSERT_EQ(glGetError(), GL_NO_ERROR) << "attribute " << i << ", parity " << enabledParity;
+                }
+                glBindVertexArray(m_vao);
+            }
+
+            int ExpectedSum(int parity) const {
+                int sum = 0;
+                for (int i = parity; i < m_attributeCount; i += 2) sum += i;
+                return sum;
+            }
+
+            // One capture span, read back the way the CTS case does.
+            int DrawAndRead(int parity) {
+                glUseProgram(parity == 0 ? m_even : m_odd);
+                glBindVertexArray(m_vao);
+                glBeginTransformFeedback(GL_POINTS);
+                glDrawArrays(GL_POINTS, 0, 1);
+                glEndTransformFeedback();
+
+                const void* mapped = glMapBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, GL_READ_ONLY);
+                if (mapped == nullptr) {
+                    ADD_FAILURE() << "glMapBuffer returned null for parity " << parity;
+                    return -1;
+                }
+                GLint result = -1;
+                std::memcpy(&result, mapped, sizeof(result));
+                glUnmapBuffer(GL_TRANSFORM_FEEDBACK_BUFFER);
+                return result;
+            }
+
+            GLint m_attributeCount = 16;
+            GLuint m_even = 0;
+            GLuint m_odd = 0;
+            GLuint m_vao = 0;
+            GLuint m_vbo = 0;
+            GLuint m_xfb = 0;
+        };
+
+        // The case verbatim: even half on, draw, check; odd half on, draw, check.
+        TEST_F(VertexArrayEnableDisableScenario, EitherHalfOfTheAttributesInTurn) {
+            if (!Ready()) GTEST_SKIP();
+
+            TurnOnAttributes(0);
+            EXPECT_EQ(DrawAndRead(0), ExpectedSum(0)) << "even attributes";
+
+            TurnOnAttributes(1);
+            EXPECT_EQ(DrawAndRead(1), ExpectedSum(1)) << "odd attributes";
+
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // The first span on its own, so a failure of the case above can be read as "the second
+        // span" rather than "the enables".
+        TEST_F(VertexArrayEnableDisableScenario, TheEvenHalfAlone) {
+            if (!Ready()) GTEST_SKIP();
+
+            TurnOnAttributes(0);
+            EXPECT_EQ(DrawAndRead(0), ExpectedSum(0));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // And the odd half as the FIRST span, which separates "the odd program/arrays are
+        // wrong" from "the second span is wrong".
+        TEST_F(VertexArrayEnableDisableScenario, TheOddHalfAlone) {
+            if (!Ready()) GTEST_SKIP();
+
+            TurnOnAttributes(1);
+            EXPECT_EQ(DrawAndRead(1), ExpectedSum(1));
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_IntegrationTest/Scenarios/VertexAttribBindingScenario.cpp

@@ -139,16 +139,18 @@ void main() {
         // As CapturePoints, but through the baseInstance entry point, and on a capture buffer
         // of its own.
         //
-        // Kept separate from CapturePoints rather than defaulting a parameter, for two
+        // Kept separate from CapturePoints rather than defaulting a parameter, so that every
-        // reasons. Every existing caller stays on the draw command that carries no
+        // existing caller stays on the draw command that carries no baseInstance at all: the
-        // baseInstance at all, so the negative control is a DIFFERENT command rather than
+        // negative control is then a DIFFERENT command rather than the same one passed a zero.
-        // the same one passed a zero. And baseInstance is the first thing here that needs
+        //
-        // several captures in ONE test, which the shared helper cannot currently do: a
+        // The buffer per capture is a leftover. baseInstance was the first thing here that
-        // second capture into the same buffer object comes back empty on DirectVulkan
+        // needed several captures in ONE test, and at the time a second capture into the same
-        // (respecifying a buffer that is bound to a transform-feedback binding point does
+        // buffer object came back empty on DirectVulkan - respecifying a buffer whose bytes the
-        // not reach that binding - reproduced with two plain CapturePoints calls, so it is
+        // backend had handed the frontend a pointer into replaced the storage under that
-        // neither about baseInstance nor about this helper). A fresh buffer per capture
+        // pointer, so the capture wrote one store and the readback read another. That is fixed
-        // sidesteps it; without that, this scenario would be pinning that bug instead.
+        // and pinned by XfbCaptureBufferReuseScenario, which owns the shape now; a buffer per
+        // capture is simply the cheapest thing that still isolates these three draws from each
+        // other.
         std::vector<float> CaptureOwnBufferBaseInstance(GLuint program, int vertexCount, int instanceCount,
                                                         GLuint baseInstance, bool useBaseInstanceCommand) {
             const std::size_t floats = static_cast<std::size_t>(vertexCount) * instanceCount * 16;

MobileGL/MG_IntegrationTest/Scenarios/XfbCaptureBufferReuseScenario.cpp

@@ -0,0 +1,317 @@
+// MobileGL - MobileGL/MG_IntegrationTest/Scenarios/XfbCaptureBufferReuseScenario.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+//
+// ONE capture buffer, SEVERAL capture spans - the shape most KHR-GL4x cases that
+// use transform feedback as a readback channel are built on. They allocate the
+// capture buffer once in a setup step and then run span after span through it,
+// so a defect that only shows from the second span onwards fails the whole case
+// while the first span (and every single-span scenario in this suite) stays
+// green. The first thing checked here is therefore not the capture itself but
+// that the bytes the capture wrote are the bytes the readback reads.
+//
+// Two ways of reusing the buffer, because they exercise different machinery:
+//
+//   * respecified between spans (glBufferData while the buffer is still bound to
+//     the transform-feedback binding point), which is what a test helper that
+//     poisons its capture buffer before every span does;
+//   * allocated ONCE with immutable storage and never touched again, which is
+//     what KHR-GL45.direct_state_access.vertex_arrays_enable_disable_attributes
+//     does - glBufferStorage(4 bytes) in its setup, then two draws.
+//
+// The negative control (a fresh buffer object per span) is a separate case
+// rather than a parameter: it is the configuration that already worked, so it
+// has to keep working for the others to mean anything.
+
+#include <cmath>
+#include <cstdio>
+#include <cstring>
+#include <string>
+#include <vector>
+
+#include "../Harness/HeadlessGL.h"
+#include "../Harness/ScenarioFixture.h"
+
+#ifdef GLAPI
+#undef GLAPI
+#endif
+#define GL_GLEXT_PROTOTYPES
+#include <GL/gl.h>
+#include <GL/glcorearb.h>
+#undef GL_GLEXT_PROTOTYPES
+
+namespace MGITest {
+    namespace {
+
+        constexpr float kPoison = -1234.0f;
+        // One vec4 per point, one point per draw.
+        constexpr std::size_t kCaptureFloats = 4;
+        constexpr std::size_t kCaptureBytes = kCaptureFloats * sizeof(float);
+
+        GLuint CompileShader(GLenum type, const std::string& source, std::string* log) {
+            const GLuint shader = glCreateShader(type);
+            const char* text = source.c_str();
+            glShaderSource(shader, 1, &text, nullptr);
+            glCompileShader(shader);
+            GLint status = GL_FALSE;
+            glGetShaderiv(shader, GL_COMPILE_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetShaderiv(shader, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetShaderInfoLog(shader, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteShader(shader);
+                return 0;
+            }
+            return shader;
+        }
+
+        // Vertex-only capture program: whatever the draw fetched at location 0 comes
+        // straight back out through the capture. Runs under GL_RASTERIZER_DISCARD, so
+        // there is no fragment stage.
+        GLuint BuildCaptureProgram(std::string* log) {
+            const std::string vertexSource = R"(#version 430 core
+layout(location = 0) in vec4 vs_in_value;
+out vec4 vs_out_value;
+void main() {
+  vs_out_value = vs_in_value;
+}
+)";
+            const GLuint vertexShader = CompileShader(GL_VERTEX_SHADER, vertexSource, log);
+            if (vertexShader == 0) return 0;
+            const GLuint program = glCreateProgram();
+            glAttachShader(program, vertexShader);
+            const char* varying = "vs_out_value";
+            glTransformFeedbackVaryings(program, 1, &varying, GL_INTERLEAVED_ATTRIBS);
+            glLinkProgram(program);
+            glDeleteShader(vertexShader);
+            GLint status = GL_FALSE;
+            glGetProgramiv(program, GL_LINK_STATUS, &status);
+            if (status == GL_FALSE) {
+                GLint length = 0;
+                glGetProgramiv(program, GL_INFO_LOG_LENGTH, &length);
+                std::vector<char> buffer(static_cast<std::size_t>(length) + 1, '\0');
+                glGetProgramInfoLog(program, length + 1, nullptr, buffer.data());
+                if (log != nullptr) *log = buffer.data();
+                glDeleteProgram(program);
+                return 0;
+            }
+            return program;
+        }
+
+        class XfbCaptureBufferReuseScenario : public ScenarioTest {
+        protected:
+            void SetUp() override {
+                ScenarioTest::SetUp();
+                if (!Ready()) return;
+
+                std::string log;
+                m_program = BuildCaptureProgram(&log);
+                ASSERT_NE(m_program, 0u) << "capture program failed to build: " << log;
+
+                glGenVertexArrays(1, &m_vao);
+                glBindVertexArray(m_vao);
+                glGenBuffers(1, &m_vbo);
+                glBindBuffer(GL_ARRAY_BUFFER, m_vbo);
+                glBufferData(GL_ARRAY_BUFFER, kCaptureBytes, nullptr, GL_DYNAMIC_DRAW);
+                glVertexAttribPointer(0, 4, GL_FLOAT, GL_FALSE, 0, nullptr);
+                glEnableVertexAttribArray(0);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+            }
+
+            void TearDown() override {
+                if (!Ready()) return;
+                glBindVertexArray(0);
+                if (m_vbo != 0) glDeleteBuffers(1, &m_vbo);
+                if (m_vao != 0) glDeleteVertexArrays(1, &m_vao);
+                if (m_program != 0) glDeleteProgram(m_program);
+                glUseProgram(0);
+                ScenarioTest::TearDown();
+            }
+
+            // The vertex the next span will fetch and capture.
+            void SetVertex(float value) {
+                const float data[kCaptureFloats] = {value, value + 1.0f, value + 2.0f, value + 3.0f};
+                glBindBuffer(GL_ARRAY_BUFFER, m_vbo);
+                glBufferSubData(GL_ARRAY_BUFFER, 0, kCaptureBytes, data);
+                glBindBuffer(GL_ARRAY_BUFFER, 0);
+            }
+
+            // One capture span over the buffer currently bound to capture point 0.
+            void RunSpan() {
+                glEnable(GL_RASTERIZER_DISCARD);
+                glUseProgram(m_program);
+                glBindVertexArray(m_vao);
+                glBeginTransformFeedback(GL_POINTS);
+                glDrawArrays(GL_POINTS, 0, 1);
+                glEndTransformFeedback();
+                glDisable(GL_RASTERIZER_DISCARD);
+                glUseProgram(0);
+            }
+
+            static ::testing::AssertionResult CapturedIs(const float* data, float value) {
+                for (std::size_t i = 0; i < kCaptureFloats; ++i) {
+                    const float expected = value + static_cast<float>(i);
+                    const float got = data[i];
+                    // isfinite first: every ordered comparison against a NaN is false, so a
+                    // pair of one-sided range tests REPORTS SUCCESS for uninitialised
+                    // storage that happens to read as NaN - which is exactly the failure
+                    // these scenarios exist to catch.
+                    if (!std::isfinite(got) || std::fabs(got - expected) > 0.01f) {
+                        return ::testing::AssertionFailure()
+                               << "component " << i << " is " << got << ", expected " << expected
+                               << (got == kPoison ? " (the capture never reached these bytes)" : "");
+                    }
+                }
+                return ::testing::AssertionSuccess();
+            }
+
+            GLuint m_program = 0;
+            GLuint m_vao = 0;
+            GLuint m_vbo = 0;
+        };
+
+        // The negative control: one buffer object per span. This is the configuration
+        // every multi-span scenario in this suite works around the others with, so it
+        // has to hold or nothing below is interpretable.
+        TEST_F(XfbCaptureBufferReuseScenario, EverySpanIntoABufferObjectOfItsOwn) {
+            if (!Ready()) GTEST_SKIP();
+
+            for (int span = 0; span < 3; ++span) {
+                const float value = 10.0f * static_cast<float>(span + 1);
+                const std::vector<float> poison(kCaptureFloats, kPoison);
+
+                GLuint xfbBuffer = 0;
+                glGenBuffers(1, &xfbBuffer);
+                glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+                glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, kCaptureBytes, poison.data(), GL_DYNAMIC_DRAW);
+
+                SetVertex(value);
+                RunSpan();
+
+                float readback[kCaptureFloats] = {kPoison, kPoison, kPoison, kPoison};
+                glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0, kCaptureBytes, readback);
+                EXPECT_TRUE(CapturedIs(readback, value)) << "span " << span;
+
+                glDeleteBuffers(1, &xfbBuffer);
+            }
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // The same three spans through ONE buffer object, respecified before each of
+        // them WHILE it is bound to capture point 0 - a helper poisoning its capture
+        // buffer, which is what makes "captured nothing" legible in the first place.
+        //
+        // A respecification is free to replace the storage underneath (that is what
+        // orphaning is), and on a buffer whose bytes the backend has already handed
+        // the frontend a pointer into, the replacement has to reach that pointer too.
+        // It did not: the capture wrote the new storage and the readback kept reading
+        // the old one, so every span after the first came back poison.
+        TEST_F(XfbCaptureBufferReuseScenario, EverySpanIntoOneRespecifiedBufferObject) {
+            if (!Ready()) GTEST_SKIP();
+
+            GLuint xfbBuffer = 0;
+            glGenBuffers(1, &xfbBuffer);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+
+            for (int span = 0; span < 3; ++span) {
+                const float value = 10.0f * static_cast<float>(span + 1);
+                const std::vector<float> poison(kCaptureFloats, kPoison);
+                glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, kCaptureBytes, poison.data(), GL_DYNAMIC_DRAW);
+
+                SetVertex(value);
+                RunSpan();
+
+                float readback[kCaptureFloats] = {kPoison, kPoison, kPoison, kPoison};
+                glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0, kCaptureBytes, readback);
+                EXPECT_TRUE(CapturedIs(readback, value)) << "span " << span;
+            }
+
+            glDeleteBuffers(1, &xfbBuffer);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // A respecification that CHANGES the size, which is the case a re-pointing
+        // that only handled same-size storage would still get wrong - and, before the
+        // fix, the case that wrote the new (larger) contents through a mapping sized
+        // for the old ones.
+        TEST_F(XfbCaptureBufferReuseScenario, ARespecificationMayChangeTheCaptureBufferSize) {
+            if (!Ready()) GTEST_SKIP();
+
+            GLuint xfbBuffer = 0;
+            glGenBuffers(1, &xfbBuffer);
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+
+            // Sized for one point, then for four, then back down to one.
+            const std::size_t pointCapacity[] = {1, 4, 1};
+            for (int span = 0; span < 3; ++span) {
+                const float value = 10.0f * static_cast<float>(span + 1);
+                const std::size_t floats = kCaptureFloats * pointCapacity[span];
+                const std::vector<float> poison(floats, kPoison);
+                glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, static_cast<GLsizeiptr>(floats * sizeof(float)),
+                             poison.data(), GL_DYNAMIC_DRAW);
+
+                SetVertex(value);
+                RunSpan();
+
+                std::vector<float> readback(floats, kPoison);
+                glGetBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0,
+                                   static_cast<GLsizeiptr>(floats * sizeof(float)), readback.data());
+                EXPECT_TRUE(CapturedIs(readback.data(), value)) << "span " << span;
+                // The bytes past the one point the draw produced must still be the
+                // poison the respecification put there, not whatever the previous
+                // (differently sized) storage held.
+                for (std::size_t i = kCaptureFloats; i < floats; ++i) {
+                    EXPECT_FLOAT_EQ(readback[i], kPoison) << "span " << span << " float " << i;
+                }
+            }
+
+            glDeleteBuffers(1, &xfbBuffer);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+        // The KHR-GL45.direct_state_access.vertex_arrays_enable_disable_attributes
+        // shape: the capture buffer gets IMMUTABLE storage once, in a setup step, and
+        // is never respecified - two spans simply run through it, each read back with
+        // glMapBuffer. Nothing here may depend on a respecification to reset the
+        // capture: glBeginTransformFeedback does that on its own.
+        TEST_F(XfbCaptureBufferReuseScenario, EverySpanIntoOneImmutableStorageBuffer) {
+            if (!Ready()) GTEST_SKIP();
+
+            GLuint xfbBuffer = 0;
+            glGenBuffers(1, &xfbBuffer);
+            glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, xfbBuffer);
+            // Poisoned at creation - the storage is immutable, so this is the only chance to
+            // put a recognisable value there, and without it a span that captured nothing
+            // would be indistinguishable from one that captured the right thing whenever the
+            // untouched bytes happened to read back as the expected number.
+            const std::vector<float> poison(kCaptureFloats, kPoison);
+            glBufferStorage(GL_TRANSFORM_FEEDBACK_BUFFER, kCaptureBytes, poison.data(), GL_MAP_READ_BIT);
+            ASSERT_EQ(glGetError(), GL_NO_ERROR) << "glBufferStorage on the capture buffer";
+            glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, xfbBuffer);
+
+            for (int span = 0; span < 3; ++span) {
+                const float value = 10.0f * static_cast<float>(span + 1);
+                SetVertex(value);
+                RunSpan();
+
+                const void* mapped = glMapBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, GL_READ_ONLY);
+                ASSERT_NE(mapped, nullptr) << "span " << span << ": glMapBuffer returned null";
+                float readback[kCaptureFloats] = {kPoison, kPoison, kPoison, kPoison};
+                std::memcpy(readback, mapped, kCaptureBytes);
+                glUnmapBuffer(GL_TRANSFORM_FEEDBACK_BUFFER);
+                EXPECT_TRUE(CapturedIs(readback, value)) << "span " << span;
+            }
+
+            glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, 0);
+            glDeleteBuffers(1, &xfbBuffer);
+            EXPECT_EQ(glGetError(), GL_NO_ERROR);
+        }
+
+    } // namespace
+} // namespace MGITest

MobileGL/MG_State/GLState/BufferState/BufferObject.cpp

@@ -75,10 +75,42 @@ namespace MobileGL::MG_State::GLState {
         NotifySubData(offset, size);
     }
 
-    void BufferObject::Respecify(SizeT size, const void* data) {
+    // A (re)definition of the store is about to write `size` bytes through Bytes().
-        ReleaseMemory();
+    // Sizing the shadow is all that takes for a shadow-backed buffer. A buffer whose
+    // bytes were adopted into backend GPU memory has to give the adoption back first,
+    // because the mapping it holds describes exactly the OLD store: writing the new
+    // contents through it runs past its end the moment the store grows, and a backend
+    // that replaces the storage for the new store - which is what an orphaning
+    // respecification asks for - would leave that mapping, and therefore every later
+    // read of this buffer, addressing storage nothing writes to any more. That was the
+    // transform feedback capture that wrote one buffer while the readback read another.
+    //
+    // Given back rather than renewed here, deliberately. Renewing in place would mean
+    // memcpying the new contents into storage that submitted-but-unretired draws may
+    // still be reading, which is precisely what the orphaning idiom exists to avoid;
+    // avoiding THAT would mean either stalling on a fence in the middle of a frame or
+    // teaching the persistent-map op to orphan, and the op must never orphan for the
+    // other kind of caller (an application-held GL_MAP_PERSISTENT_BIT mapping, whose
+    // pointer has to stay valid for the buffer's whole life). Handing the store back to
+    // the CPU shadow needs none of that: the backend's ordinary respecification path
+    // then does the busy-tracking and the conditional orphan it has always done, and the
+    // next binding that wants GPU residency takes a fresh mapping of the new store.
+    void BufferObject::RedefineStorage(SizeT size) {
+        if (m_resource.IsGpuResident()) {
+            m_resource.ReleasePersistentMap();
+            // Whatever a shader or a capture wrote is in the store being replaced, so
+            // there is nothing left to reconcile - and leaving the flag set would make
+            // the next read of this buffer wait for GPU work on behalf of bytes the
+            // application has just thrown away.
+            m_gpuWritePending = false;
+        }
         m_size = size;
         m_resource.ResizeShadow(size);
+    }
+
+    void BufferObject::Respecify(SizeT size, const void* data) {
+        ReleaseMemory();
+        RedefineStorage(size);
         if (data && size > 0) {
             Memcpy(m_resource.Bytes(), data, size);
         }
@@ -96,8 +128,7 @@ namespace MobileGL::MG_State::GLState {
 
     void BufferObject::AllocateImmutableStorage(SizeT size, const void* data, GLbitfield storageFlags) {
         ReleaseMemory();
-        m_size = size;
+        RedefineStorage(size);
-        m_resource.ResizeShadow(size);
         if (data) {
             Memcpy(m_resource.Bytes(), data, size);
         } else if (size > 0) {

MobileGL/MG_State/GLState/BufferState/BufferObject.h

@@ -205,6 +205,9 @@ namespace MobileGL {
             void SetBackendResource(SharedPtr<BackendBufferResource> resource);
 
         private:
+            // Sizes the store for a (re)definition, renewing an adopted GPU-resident
+            // mapping across it. See the definition for why the renewal is not optional.
+            void RedefineStorage(SizeT size);
             void NotifyRespecify();
             void NotifySubData(SizeT offset, SizeT size);
             void NotifyFlushMappedRange(Range1D range, Flags<BufferMappingAccessBit> appAccess);

MobileGL/MG_State/GLState/BufferState/PipeResource.h

@@ -70,6 +70,15 @@ namespace MobileGL::MG_State::GLState {
             m_shadow->shrink_to_fit();
         }
 
+        // Give the adoption back: the bytes resolve against the shadow again (which
+        // the caller must (re)size, it was released on adoption). Used when the store
+        // itself is redefined - the mapping describes exactly the store that is going
+        // away, so it may neither be written through nor kept. It is NOT a general
+        // "unmap": a persistent map the application holds outlives every unmap by
+        // definition, and the calls that could redefine such a buffer's store are
+        // errors the frontend refuses before reaching here.
+        void ReleasePersistentMap() { m_gpuMapped = nullptr; }
+
         // Backend GPU resource, owned here in both modes.
         const SharedPtr<BackendBufferResource>& Backend() const { return m_backend; }
         void SetBackend(SharedPtr<BackendBufferResource> backend) { m_backend = std::move(backend); }

MobileGL/MG_State/GLState/RenderState/RenderState.cpp

@@ -187,6 +187,14 @@ namespace MobileGL {
             }
 
             // -------------------- Capabilities --------------------
+            namespace {
+                // CapabilityInput lists ClipDistance0..7 contiguously (RenderState.h); the caller
+                // has already rejected anything outside that run, so the subtraction is in range.
+                Uint32 ClipDistanceBit(CapabilityInput cap) {
+                    return 1u << (static_cast<Uint>(cap) - static_cast<Uint>(CapabilityInput::ClipDistance0));
+                }
+            } // namespace
+
             void RenderState::SetCapability(CapabilityInput cap, Bool enabled) {
 #define SET_CAPABILITY(capability, flag)                                                                               \
     case CapabilityInput::capability:                                                                                  \
@@ -228,6 +236,27 @@ namespace MobileGL {
                     if (stateChanged) BumpVersions();
                     break;
                 }
+                case CapabilityInput::ClipDistance0:
+                case CapabilityInput::ClipDistance1:
+                case CapabilityInput::ClipDistance2:
+                case CapabilityInput::ClipDistance3:
+                case CapabilityInput::ClipDistance4:
+                case CapabilityInput::ClipDistance5:
+                case CapabilityInput::ClipDistance6:
+                case CapabilityInput::ClipDistance7: {
+                    const Uint32 bit = ClipDistanceBit(cap);
+                    const Uint32 updated =
+                        enabled ? (m_parameters.ClipDistanceEnabledMask | bit)
+                                : (m_parameters.ClipDistanceEnabledMask & ~bit);
+                    if (updated == m_parameters.ClipDistanceEnabledMask) break;
+                    m_parameters.ClipDistanceEnabledMask = updated;
+                    // Deliberately NOT BumpVersions(): no backend bakes a clip-distance enable
+                    // into a pipeline object (DirectGLES issues glEnable, DirectVulkan takes the
+                    // set from the shader's declared array), so bumping the pipeline version here
+                    // would evict cached pipelines for state they do not contain.
+                    ++m_version;
+                    break;
+                }
                 default: // not supported currently
                     break;
                 }
@@ -263,6 +292,15 @@ namespace MobileGL {
                     RETURN_CAPABILITY(ProgramPointSize);
                 case CapabilityInput::Blend:
                     return m_parameters.BlendStates[0].Enabled;
+                case CapabilityInput::ClipDistance0:
+                case CapabilityInput::ClipDistance1:
+                case CapabilityInput::ClipDistance2:
+                case CapabilityInput::ClipDistance3:
+                case CapabilityInput::ClipDistance4:
+                case CapabilityInput::ClipDistance5:
+                case CapabilityInput::ClipDistance6:
+                case CapabilityInput::ClipDistance7:
+                    return (m_parameters.ClipDistanceEnabledMask & ClipDistanceBit(cap)) != 0;
                 default:
                     return false;
                 }

MobileGL/MG_State/GLState/RenderState/RenderState.h

@@ -303,6 +303,12 @@ namespace MobileGL {
         Bool StencilTestEnabled = false;
         Bool ProgramPointSizeEnabled = false;
         IntVec4 ScissorBox = IntVec4(0, 0, 0, 0); // x, y, width, height
+        // glEnable(GL_CLIP_DISTANCE0 + i) for i in [0, 8), one bit each. A bitmask rather than
+        // eight bools because every consumer wants the set, not an individual flag, and because
+        // the SYNC_CAPABILITY/SET_CAPABILITY macros key off a "<Name>Enabled" field name that
+        // eight numbered capabilities cannot share. Lives in the tail span (after LogicOp), so
+        // DirectGLES' span memcmp picks a change up like any other capability.
+        Uint32 ClipDistanceEnabledMask = 0;
     };
 
     namespace MG_State {

MobileGL/MG_State/GLState/TextureState/TextureObject.h

@@ -117,7 +117,15 @@ namespace MobileGL::MG_State::GLState {
         void SetFixedSampleLocations(Bool fixedSampleLocations) override;
         Uint64 GetLifetimeId() const override;
         GLenum GetDepthStencilTextureMode() const override { return m_depthStencilTextureMode; }
-        void SetDepthStencilTextureMode(GLenum mode) override { m_depthStencilTextureMode = mode; }
+        // Bumps the params version like every other backend-visible texture parameter: the mode
+        // decides which ASPECT of a packed depth/stencil image a sampler reads, which DirectGLES
+        // forwards as a texture parameter and DirectVulkan bakes into the sampled image view. A
+        // silent write here would leave both backends showing the aspect they last built.
+        void SetDepthStencilTextureMode(GLenum mode) override {
+            if (m_depthStencilTextureMode == mode) return;
+            m_depthStencilTextureMode = mode;
+            ++m_textureParamsVersion;
+        }
 
     protected:
         static Uint64 AllocateLifetimeId();

MobileGL/MG_Test/Backend/DirectGLES/EsslShaderPassTest.cpp

@@ -16,6 +16,7 @@
 #include <MG_Backend/DirectGLES/Utils.h>
 
 using namespace MobileGL;
+using MobileGL::MG_Backend::DirectGLES::PrgramImpl::ForceFlatIntegerVaryings;
 using MobileGL::MG_Backend::DirectGLES::PrgramImpl::IMAGE_WRITE_ALIAS_PREFIX;
 using MobileGL::MG_Backend::DirectGLES::PrgramImpl::RemoveLayoutBinding;
 using MobileGL::MG_Backend::DirectGLES::PrgramImpl::SplitReadWriteImageUniforms;
@@ -367,3 +368,70 @@ void main() {}
         << "an unrelated extension must survive untouched:\n" << out;
     EXPECT_EQ(CountOf(out, "GL_OES_texture_buffer"), 1u);
 }
+
+// Interpolation is only ever consumed at a fragment input, but an ES linker still compares the
+// two sides of EVERY stage interface and rejects a program whose producer says `flat` and whose
+// consumer does not. SPIRV-Cross prints `flat` on a vertex output and a geometry input of
+// integer type and on nothing else, so a program with tessellation in the middle came out
+// mismatched at both ends of the tessellator - "output vs_tcs_result interpolation mismatch
+// with other stage" on Adreno, and a program that fails to link is a draw that paints nothing.
+TEST(ForceFlatIntegerVaryingsTest, TessellationStagesGetTheQualifierOnBothSides) {
+    const String tessControl = R"(#version 320 es
+layout(vertices = 1) out;
+layout(location = 0) in uint vs_tcs_result[];
+layout(location = 0) out uint tcs_tes_result[1];
+void main() { tcs_tes_result[gl_InvocationID] = vs_tcs_result[gl_InvocationID]; }
+)";
+    const String control = ForceFlatIntegerVaryings(tessControl, GL_TESS_CONTROL_SHADER);
+    EXPECT_TRUE(Contains(control, "layout(location = 0) flat in uint vs_tcs_result[];")) << control;
+    EXPECT_TRUE(Contains(control, "layout(location = 0) flat out uint tcs_tes_result[1];")) << control;
+
+    const String tessEval = R"(#version 320 es
+layout(isolines, point_mode) in;
+layout(location = 0) in uint tcs_tes_result[];
+layout(location = 0) out uint tes_gs_result;
+void main() { tes_gs_result = tcs_tes_result[0]; }
+)";
+    const String eval = ForceFlatIntegerVaryings(tessEval, GL_TESS_EVALUATION_SHADER);
+    EXPECT_TRUE(Contains(eval, "layout(location = 0) flat in uint tcs_tes_result[];")) << eval;
+    EXPECT_TRUE(Contains(eval, "layout(location = 0) flat out uint tes_gs_result;")) << eval;
+}
+
+// The two ends the tessellation stages have to meet: what a vertex shader and a geometry shader
+// already emitted before this pass learned about tessellation at all. Pinned here so the two
+// sides cannot drift apart again.
+TEST(ForceFlatIntegerVaryingsTest, TheStagesAroundTessellationAreUnchanged) {
+    const String vertex = R"(#version 320 es
+layout(location = 0) out uint vs_tcs_result;
+void main() { vs_tcs_result = 1u; }
+)";
+    EXPECT_TRUE(Contains(ForceFlatIntegerVaryings(vertex, GL_VERTEX_SHADER),
+                         "layout(location = 0) flat out uint vs_tcs_result;"));
+
+    const String geometry = R"(#version 320 es
+layout(points) in;
+layout(triangle_strip, max_vertices = 4) out;
+layout(location = 0) in uint tes_gs_result[1];
+layout(location = 0) out uint gs_fs_result;
+void main() { gs_fs_result = tes_gs_result[0]; EmitVertex(); }
+)";
+    const String gs = ForceFlatIntegerVaryings(geometry, GL_GEOMETRY_SHADER);
+    EXPECT_TRUE(Contains(gs, "layout(location = 0) flat in uint tes_gs_result[1];")) << gs;
+    EXPECT_TRUE(Contains(gs, "layout(location = 0) flat out uint gs_fs_result;")) << gs;
+}
+
+// Non-integer interfaces keep whatever interpolation they were given: adding `flat` to a float
+// varying would turn a smoothly interpolated value into a per-provoking-vertex constant, which
+// is a rendering change, not a linker one.
+TEST(ForceFlatIntegerVaryingsTest, FloatVaryingsAreNotTouched) {
+    const String tessEval = R"(#version 320 es
+layout(isolines, point_mode) in;
+layout(location = 1) in vec2 tcs_tes_coord[];
+layout(location = 1) out vec2 tes_gs_coord;
+void main() { tes_gs_coord = tcs_tes_coord[0]; }
+)";
+    const String out = ForceFlatIntegerVaryings(tessEval, GL_TESS_EVALUATION_SHADER);
+    EXPECT_TRUE(Contains(out, "layout(location = 1) in vec2 tcs_tes_coord[];")) << out;
+    EXPECT_TRUE(Contains(out, "layout(location = 1) out vec2 tes_gs_coord;")) << out;
+    EXPECT_EQ(CountOf(out, "flat"), 0u) << out;
+}

MobileGL/MG_Test/Buffer/BufferTest.cpp

@@ -1610,3 +1610,188 @@ TEST_F(GeneralBufferTest, General_CoherentAsFlush_PersistentMapAdoptsZeroCopyBac
     EXPECT_EQ(GetError(), GL_NO_ERROR);
     g_zeroCopyMock = nullptr;
 }
+
+// A buffer whose bytes the backend adopted into its own GPU memory - which is what
+// EnsureGpuResidentStorage does for a transform-feedback capture target or a shader
+// storage binding, so that MapBuffer/GetBufferSubData read real GPU results - and which
+// the application then REDEFINES.
+//
+// The store the adopted mapping describes is the one being thrown away. Keeping that
+// mapping across the redefinition is what let a transform feedback capture be written to
+// one buffer and read back out of another: the backend replaced the storage (a
+// respecification is the orphaning point) while the frontend went on resolving every read
+// through a mapping of the storage it had just released. Two capture spans into one
+// re-specified buffer came back empty from the second one onwards.
+//
+// So the mapping is handed back and the buffer returns to the CPU-shadow model until
+// something asks for residency again. These pin all three parts of that: the adoption
+// really is dropped, the new contents really do land where later reads resolve, and the
+// backend really is told to respecify - it must not skip the storage, or its copy would
+// keep the old bytes.
+TEST_F(BufferTest, RedefiningAnAdoptedBufferHandsTheMappingBack) {
+    ZeroCopyMockBackend mock;
+    g_zeroCopyMock = &mock;
+    ScopedBackendOps scopedOps(&kZeroCopyMockOps);
+
+    GLuint buffer = 0;
+    GenBuffers(1, &buffer);
+    BindBuffer(GL_ARRAY_BUFFER, buffer);
+    const GLint before[4] = {1, 2, 3, 4};
+    BufferData(GL_ARRAY_BUFFER, sizeof(before), before, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+
+    auto bufferObject = MG_State::pGLContext->GetBufferObject(buffer);
+    ASSERT_NE(bufferObject, nullptr);
+    // The backend adopts the bytes, exactly as a capture target or an SSBO binding does.
+    ASSERT_TRUE(bufferObject->EnsureGpuResidentStorage());
+    ASSERT_TRUE(bufferObject->IsBackendPersistentMapped());
+    ASSERT_EQ(static_cast<const void*>(bufferObject->MappedData()),
+              static_cast<const void*>(mock.gpu.data()));
+    mock.respecifyCalls = 0;
+
+    const GLint after[4] = {10, 20, 30, 40};
+    BufferData(GL_ARRAY_BUFFER, sizeof(after), after, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+
+    EXPECT_FALSE(bufferObject->IsBackendPersistentMapped());
+    EXPECT_NE(static_cast<const void*>(bufferObject->MappedData()),
+              static_cast<const void*>(mock.gpu.data()));
+    EXPECT_EQ(std::memcmp(bufferObject->MappedData(), after, sizeof(after)), 0);
+    // The backend has a separate copy again, so it must have been told to refresh it.
+    EXPECT_EQ(mock.respecifyCalls, 1);
+
+    g_zeroCopyMock = nullptr;
+}
+
+// The same redefinition at a LARGER size, which is the case nothing could paper over: the
+// adopted mapping is exactly as big as the old store, so writing the new contents through
+// it ran past the end of the backend allocation.
+TEST_F(BufferTest, RedefiningAnAdoptedBufferAtANewSizeStaysInBounds) {
+    ZeroCopyMockBackend mock;
+    g_zeroCopyMock = &mock;
+    ScopedBackendOps scopedOps(&kZeroCopyMockOps);
+
+    GLuint buffer = 0;
+    GenBuffers(1, &buffer);
+    BindBuffer(GL_ARRAY_BUFFER, buffer);
+    const GLint small[2] = {1, 2};
+    BufferData(GL_ARRAY_BUFFER, sizeof(small), small, GL_DYNAMIC_DRAW);
+    auto bufferObject = MG_State::pGLContext->GetBufferObject(buffer);
+    ASSERT_NE(bufferObject, nullptr);
+    ASSERT_TRUE(bufferObject->EnsureGpuResidentStorage());
+    ASSERT_EQ(mock.gpu.size(), sizeof(small));
+
+    const GLint large[8] = {1, 2, 3, 4, 5, 6, 7, 8};
+    BufferData(GL_ARRAY_BUFFER, sizeof(large), large, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+
+    EXPECT_EQ(bufferObject->GetSize(), sizeof(large));
+    EXPECT_FALSE(bufferObject->IsBackendPersistentMapped());
+    EXPECT_EQ(std::memcmp(bufferObject->MappedData(), large, sizeof(large)), 0);
+    // The old, smaller GPU block was not written through: still the old size, still the
+    // old bytes.
+    EXPECT_EQ(mock.gpu.size(), sizeof(small));
+    EXPECT_EQ(std::memcmp(mock.gpu.data(), small, sizeof(small)), 0);
+
+    // And residency can be taken again, now over the new store.
+    ASSERT_TRUE(bufferObject->EnsureGpuResidentStorage());
+    EXPECT_TRUE(bufferObject->IsBackendPersistentMapped());
+    EXPECT_EQ(mock.gpu.size(), sizeof(large));
+    EXPECT_EQ(std::memcmp(bufferObject->MappedData(), large, sizeof(large)), 0);
+
+    g_zeroCopyMock = nullptr;
+}
+
+// glBufferStorage is the other way into a redefinition, and an adopted buffer can reach
+// it: the adoption came from a binding rather than from an application map, so the buffer
+// is still mutable and glBufferStorage is still legal on it.
+TEST_F(BufferTest, ImmutableStorageOnAnAdoptedBufferHandsTheMappingBackToo) {
+    ZeroCopyMockBackend mock;
+    g_zeroCopyMock = &mock;
+    ScopedBackendOps scopedOps(&kZeroCopyMockOps);
+
+    GLuint buffer = 0;
+    GenBuffers(1, &buffer);
+    BindBuffer(GL_ARRAY_BUFFER, buffer);
+    const GLint before[4] = {1, 2, 3, 4};
+    BufferData(GL_ARRAY_BUFFER, sizeof(before), before, GL_DYNAMIC_DRAW);
+    auto bufferObject = MG_State::pGLContext->GetBufferObject(buffer);
+    ASSERT_NE(bufferObject, nullptr);
+    ASSERT_TRUE(bufferObject->EnsureGpuResidentStorage());
+    ASSERT_TRUE(bufferObject->IsBackendPersistentMapped());
+
+    const GLint after[6] = {9, 8, 7, 6, 5, 4};
+    BufferStorage(GL_ARRAY_BUFFER, sizeof(after), after, GL_MAP_READ_BIT);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+
+    EXPECT_TRUE(bufferObject->IsImmutableStorage());
+    EXPECT_FALSE(bufferObject->IsBackendPersistentMapped());
+    EXPECT_EQ(bufferObject->GetSize(), sizeof(after));
+    EXPECT_EQ(std::memcmp(bufferObject->MappedData(), after, sizeof(after)), 0);
+
+    g_zeroCopyMock = nullptr;
+}
+
+// A redefinition to nothing. The backend declines residency for an empty store, so this
+// is also the path where the mapping is given back and never retaken.
+TEST_F(BufferTest, RedefiningAnAdoptedBufferToZeroBytesLeavesItOnTheShadow) {
+    ZeroCopyMockBackend mock;
+    g_zeroCopyMock = &mock;
+    ScopedBackendOps scopedOps(&kZeroCopyMockOps);
+
+    GLuint buffer = 0;
+    GenBuffers(1, &buffer);
+    BindBuffer(GL_ARRAY_BUFFER, buffer);
+    const GLint before[4] = {1, 2, 3, 4};
+    BufferData(GL_ARRAY_BUFFER, sizeof(before), before, GL_DYNAMIC_DRAW);
+    auto bufferObject = MG_State::pGLContext->GetBufferObject(buffer);
+    ASSERT_NE(bufferObject, nullptr);
+    ASSERT_TRUE(bufferObject->EnsureGpuResidentStorage());
+    ASSERT_TRUE(bufferObject->IsBackendPersistentMapped());
+
+    BufferData(GL_ARRAY_BUFFER, 0, nullptr, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+
+    EXPECT_EQ(bufferObject->GetSize(), 0u);
+    EXPECT_FALSE(bufferObject->IsBackendPersistentMapped());
+    EXPECT_FALSE(bufferObject->EnsureGpuResidentStorage()); // nothing to make resident
+
+    // ...and it comes back to life on the next non-empty store.
+    const GLint again[3] = {5, 6, 7};
+    BufferData(GL_ARRAY_BUFFER, sizeof(again), again, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+    EXPECT_TRUE(bufferObject->EnsureGpuResidentStorage());
+    EXPECT_EQ(std::memcmp(bufferObject->MappedData(), again, sizeof(again)), 0);
+
+    g_zeroCopyMock = nullptr;
+}
+
+// The negative control for the four above: a backend that DECLINES to hand out a mapping
+// leaves the buffer shadow-backed throughout, so a redefinition is just a redefinition -
+// no adoption to give back, and the backend still gets its Respecify.
+TEST_F(BufferTest, RedefiningANonAdoptedBufferIsUnchanged) {
+    ZeroCopyMockBackend mock;
+    mock.provideMap = false;
+    g_zeroCopyMock = &mock;
+    ScopedBackendOps scopedOps(&kZeroCopyMockOps);
+
+    GLuint buffer = 0;
+    GenBuffers(1, &buffer);
+    BindBuffer(GL_ARRAY_BUFFER, buffer);
+    const GLint before[4] = {1, 2, 3, 4};
+    BufferData(GL_ARRAY_BUFFER, sizeof(before), before, GL_DYNAMIC_DRAW);
+    auto bufferObject = MG_State::pGLContext->GetBufferObject(buffer);
+    ASSERT_NE(bufferObject, nullptr);
+    EXPECT_FALSE(bufferObject->EnsureGpuResidentStorage());
+    EXPECT_FALSE(bufferObject->IsBackendPersistentMapped());
+    mock.respecifyCalls = 0;
+
+    const GLint after[4] = {10, 20, 30, 40};
+    BufferData(GL_ARRAY_BUFFER, sizeof(after), after, GL_DYNAMIC_DRAW);
+    ASSERT_EQ(GetError(), GL_NO_ERROR);
+    EXPECT_FALSE(bufferObject->IsBackendPersistentMapped());
+    EXPECT_EQ(std::memcmp(bufferObject->MappedData(), after, sizeof(after)), 0);
+    EXPECT_EQ(mock.respecifyCalls, 1);
+
+    g_zeroCopyMock = nullptr;
+}

MobileGL/MG_Test/Program/ProgramUtilTest.cpp

@@ -21,6 +21,7 @@
 #include <MG_Util/ShaderTranspiler/ShaderCompiler.h>
 #include <MG_Util/ShaderTranspiler/ShaderSourceProcessor.h>
 #include <MG_Util/ShaderTranspiler/SpirvPasses/LegalizeFragmentOutputIndexPass.h>
+#include <MG_Util/ShaderTranspiler/SpirvPasses/Lower1DArrayImagesPass.h>
 #include <MG_Util/ShaderTranspiler/SpirvPasses/RenameSamplerFunctionParameterPass.h>
 #include <MG_Util/ShaderTranspiler/Types.h>
 #include <MG_Util/ShaderTranspiler/glslang/UniformTraverser.h>
@@ -3481,3 +3482,210 @@ void main() { fragColor = vec4(texelFetch(Data, 3)); }
         << essl320;
 
 }
+
+namespace {
+    // OpTypeImage words: result id (+1), sampled type (+2), Dim (+3), Depth (+4), Arrayed (+5),
+    // MS (+6), Sampled (+7). Dim::Dim1D == 0, and Sampled == 2 is a storage image.
+    SizeT Count1DArrayStorageImageTypes(const Vector<Uint32>& spirv) {
+        constexpr unsigned kOpTypeImage = 25, kDim1D = 0;
+        SizeT count = 0;
+        for (SizeT i = 5; i < spirv.size();) {
+            const unsigned wordCount = spirv[i] >> 16;
+            const unsigned opcode = spirv[i] & 0xFFFFu;
+            if (wordCount == 0 || i + wordCount > spirv.size()) break;
+            if (opcode == kOpTypeImage && wordCount >= 8 && spirv[i + 3] == kDim1D && spirv[i + 5] == 1u &&
+                spirv[i + 7] == 2u) {
+                ++count;
+            }
+            i += wordCount;
+        }
+        return count;
+    }
+
+    const char* k1DArrayImageCompute = R"(#version 440 core
+layout (local_size_x = 1) in;
+layout (location = 0, r32ui) readonly uniform uimage1DArray i0;
+layout (std430, binding = 0) buffer SSB { uint sum; } ssb;
+void main() { ssb.sum = imageLoad(i0, ivec2(2, 3)).r; }
+)";
+} // namespace
+
+// The negative control, and the whole reason the pass exists: SPIRV-Cross's ES emulation of 1D
+// images does not ask whether the type is arrayed, so it wraps an already-two-component
+// coordinate in a two-component constructor. Pinning the upstream behaviour here means that if a
+// future SPIRV-Cross bump fixes it, this test fails and says so, rather than the pass quietly
+// becoming dead weight.
+TEST_F(ProgramUtilTest, SpirvCrossEmitsAMalformedCoordinateFor1DArrayImages) {
+    using namespace MG_Util::ShaderTranspiler;
+
+    const Vector<Uint32> spirv = BuildSpirvForStage(k1DArrayImageCompute, GL_COMPUTE_SHADER);
+    ASSERT_FALSE(spirv.empty());
+    ASSERT_EQ(Count1DArrayStorageImageTypes(spirv), 1u)
+        << "glslang no longer emits a Dim1D/Arrayed/Sampled=2 image for uimage1DArray";
+
+    const String essl = DecompileToEssl(spirv);
+    ASSERT_FALSE(essl.empty());
+    EXPECT_NE(essl.find("ivec2(ivec2("), String::npos)
+        << "SPIRV-Cross is expected to emit ivec2(ivec2(...), 0) here - three components in a "
+           "two-component constructor, which every ES driver rejects. If this no longer happens, "
+           "Lower1DArrayImagesForEssl may no longer be needed:\n"
+        << essl;
+}
+
+// The fix: the type becomes a 2D array and the coordinate becomes three components, so
+// SPIRV-Cross's 1D path never fires and the emitted ESSL is something a driver accepts.
+TEST_F(ProgramUtilTest, Lower1DArrayImagesRewritesTheTypeAndWidensTheCoordinate) {
+    using namespace MG_Util::ShaderTranspiler;
+
+    const Vector<Uint32> raw = BuildSpirvForStage(k1DArrayImageCompute, GL_COMPUTE_SHADER);
+    ASSERT_FALSE(raw.empty());
+
+    // Through the shared chain first, exactly as the DirectGLES transpile path does: the pass
+    // runs on sanitized bytes, and the explicit uniform LOCATION this fixture carries (the
+    // conformance case's own spelling) is illegal on UniformConstant storage until
+    // StripUniformLocationsPass has removed it. Validating raw glslang output would latch that
+    // pre-existing property against this pass.
+    Vector<Uint32> spirv;
+    ASSERT_TRUE(ShaderCompiler::SanitizeAndOptimizeBinary(raw, spirv));
+    ASSERT_EQ(Count1DArrayStorageImageTypes(spirv), 1u)
+        << "the shared chain must leave the 1D-array image for this pass to handle";
+
+    SpirvValidationScope validationOn(true);
+    const Uint64 failuresBefore = ShaderCompiler::SpirvValidationFailureCount();
+
+    Vector<Uint32> lowered;
+    ASSERT_TRUE(ShaderCompiler::Lower1DArrayImagesForEssl(spirv, lowered));
+    ASSERT_FALSE(lowered.empty());
+
+    EXPECT_EQ(Count1DArrayStorageImageTypes(lowered), 0u)
+        << "no 1D-array storage image type may survive the pass:\n"
+        << DisassembleSpirv(lowered);
+    EXPECT_EQ(ShaderCompiler::SpirvValidationFailureCount(), failuresBefore)
+        << "the lowered module must stay validator-clean";
+
+    const String essl = DecompileToEssl(lowered);
+    ASSERT_FALSE(essl.empty());
+    EXPECT_NE(essl.find("uimage2DArray"), String::npos)
+        << "the image must be declared as the 2D array the texture is stored as:\n" << essl;
+    EXPECT_EQ(essl.find("ivec2(ivec2("), String::npos)
+        << "the malformed constructor must be gone:\n" << essl;
+    // The ORDER is the whole point, and it is what a widening that merely appended the 0 would
+    // get wrong while still producing a three-component constructor that compiles. The fixture
+    // reads (u=2, layer=3), and the ES 2D array holds height 1 with the layers in depth
+    // (TextureImpl::GetBackendUploadSize), so the only correct spelling is (2, 0, 3).
+    EXPECT_NE(essl.find("ivec3(2, 0, 3)"), String::npos)
+        << "the layer must land in the third component and Y must be 0; ivec3(2, 3, 0) would read "
+           "row 3 of a one-row texture and layer 0 of every access:\n"
+        << essl;
+}
+
+// The shape that made the first cut of this pass emit INVALID SPIR-V, and the shape the
+// conformance case actually has: a 1D-array image and a real 2D-array image of the same sampled
+// type and format in one module. Rewriting the first one's Dim in place makes the two
+// OpTypeImage declarations structurally identical, and SPIR-V forbids duplicate non-aggregate
+// types - so the module the ESSL path hands on failed validation and quietly bumped the latch.
+// A single-image fixture cannot see any of that.
+TEST_F(ProgramUtilTest, Lower1DArrayImagesDeduplicatesAgainstAnExisting2DArrayImage) {
+    using namespace MG_Util::ShaderTranspiler;
+
+    const Vector<Uint32> raw = BuildSpirvForStage(R"(#version 440 core
+layout (local_size_x = 1) in;
+layout (location = 0, r32ui) readonly uniform uimage1DArray i0;
+layout (location = 1, r32ui) readonly uniform uimage2DArray i1;
+layout (std430, binding = 0) buffer SSB { uint sum; } ssb;
+void main() { ssb.sum = imageLoad(i0, ivec2(2, 3)).r + imageLoad(i1, ivec3(1, 1, 1)).r; }
+)",
+                                                  GL_COMPUTE_SHADER);
+    ASSERT_FALSE(raw.empty());
+
+    Vector<Uint32> spirv;
+    ASSERT_TRUE(ShaderCompiler::SanitizeAndOptimizeBinary(raw, spirv));
+    ASSERT_EQ(Count1DArrayStorageImageTypes(spirv), 1u);
+
+    SpirvValidationScope validationOn(true);
+    const Uint64 failuresBefore = ShaderCompiler::SpirvValidationFailureCount();
+
+    Vector<Uint32> lowered;
+    ASSERT_TRUE(ShaderCompiler::Lower1DArrayImagesForEssl(spirv, lowered));
+    ASSERT_FALSE(lowered.empty());
+
+    EXPECT_EQ(Count1DArrayStorageImageTypes(lowered), 0u) << DisassembleSpirv(lowered);
+    EXPECT_EQ(ShaderCompiler::SpirvValidationFailureCount(), failuresBefore)
+        << "the rewritten 1D-array image collided with the module's own 2D-array image and left a "
+           "duplicate type declaration behind:\n"
+        << DisassembleSpirv(lowered);
+
+    const String essl = DecompileToEssl(lowered);
+    ASSERT_FALSE(essl.empty());
+    EXPECT_NE(essl.find("ivec3(2, 0, 3)"), String::npos) << essl;
+}
+
+// Scope, half one: a NON-arrayed 1D storage image is emitted correctly by the very same
+// SPIRV-Cross code, so the pass must not touch it - replacing working emission with our own buys
+// nothing and risks everything.
+TEST_F(ProgramUtilTest, Lower1DArrayImagesLeavesNonArrayed1DImagesToSpirvCross) {
+    using namespace MG_Util::ShaderTranspiler;
+
+    const Vector<Uint32> spirv = BuildSpirvForStage(R"(#version 440 core
+layout (local_size_x = 1) in;
+layout (location = 0, r32ui) readonly uniform uimage1D i0;
+layout (std430, binding = 0) buffer SSB { uint sum; } ssb;
+void main() { ssb.sum = imageLoad(i0, 2).r; }
+)",
+                                                   GL_COMPUTE_SHADER);
+    ASSERT_FALSE(spirv.empty());
+
+    Vector<Uint32> lowered;
+    ASSERT_TRUE(ShaderCompiler::Lower1DArrayImagesForEssl(spirv, lowered));
+    EXPECT_EQ(lowered, spirv) << "a non-arrayed 1D storage image must pass through byte for byte";
+
+    const String essl = DecompileToEssl(lowered);
+    ASSERT_FALSE(essl.empty());
+    EXPECT_NE(essl.find("uimage2D "), String::npos)
+        << "SPIRV-Cross's own 1D-as-2D emulation must still be what handles this:\n" << essl;
+}
+
+// Scope, half two: a 1D-array SAMPLER reaches SPIRV-Cross's sampler path, which does check
+// `arrayed` and does move the layer into the third component. The pass is storage-image only.
+TEST_F(ProgramUtilTest, Lower1DArrayImagesLeavesSampledImagesAlone) {
+    using namespace MG_Util::ShaderTranspiler;
+
+    const Vector<Uint32> spirv = BuildSpirvForStage(R"(#version 440 core
+uniform sampler1DArray uTex;
+in vec2 vUv;
+out vec4 fragColor;
+void main() { fragColor = texture(uTex, vUv); }
+)",
+                                                   GL_FRAGMENT_SHADER);
+    ASSERT_FALSE(spirv.empty());
+
+    Vector<Uint32> lowered;
+    ASSERT_TRUE(ShaderCompiler::Lower1DArrayImagesForEssl(spirv, lowered));
+    EXPECT_EQ(lowered, spirv) << "a sampled 1D-array image must pass through byte for byte";
+}
+
+// The declined shape. After the rewrite the image is a 2D array, so a size query on it yields
+// three components where the shader consumes two, and there is no correct two-component answer to
+// substitute - the ES texture genuinely has a height the GL one does not. The module is handed
+// back untouched rather than half-translated.
+TEST_F(ProgramUtilTest, Lower1DArrayImagesDeclinesAModuleThatQueriesTheImageSize) {
+    using namespace MG_Util::ShaderTranspiler;
+
+    const Vector<Uint32> spirv = BuildSpirvForStage(R"(#version 440 core
+layout (local_size_x = 1) in;
+layout (location = 0, r32ui) readonly uniform uimage1DArray i0;
+layout (std430, binding = 0) buffer SSB { uint sum; } ssb;
+void main() { ssb.sum = uint(imageSize(i0).x) + imageLoad(i0, ivec2(0, 0)).r; }
+)",
+                                                   GL_COMPUTE_SHADER);
+    ASSERT_FALSE(spirv.empty());
+    const auto traits = Lower1DArrayImagesPass::InspectBinary(spirv);
+    ASSERT_TRUE(traits.declaresImage && traits.queriesImageSize)
+        << "the fixture must contain the shape the pass declines";
+
+    Vector<Uint32> lowered;
+    ASSERT_TRUE(ShaderCompiler::Lower1DArrayImagesForEssl(spirv, lowered));
+    EXPECT_EQ(lowered, spirv) << "a declined module must be handed back untouched, not partly rewritten";
+    EXPECT_EQ(Count1DArrayStorageImageTypes(lowered), 1u)
+        << "declining means the 1D-array type is still there for the driver to reject";
+}

MobileGL/MG_Test/SanityTest.cpp

@@ -198,6 +198,38 @@ TEST(DirectGLESSanity, AdvertisesDepthTextureForGlmarkShadowScenes) {
     EXPECT_NE(std::find(extensions.begin(), extensions.end(), MobileGL::E_GL_ARB_depth_texture), extensions.end());
 }
 
+// Two strings that name capabilities MobileGL has always had, and that were missing from the
+// advertised list for as long as it existed.
+//
+// GL_ARB_uniform_buffer_object is the one with teeth: applications gate the ENTRY POINTS on the
+// string rather than on the context version. KHR-GL4x.transform_feedback.draw_xfb_instanced_test
+// resolves glGetUniformBlockIndex / glUniformBlockBinding only inside `if (is_arb_ubo)`, then
+// calls them unconditionally because the context claims >= 4.2 - so a missing string turned into
+// a call through a null pointer and took the whole process down with SIGSEGV. Withdrawing it
+// again would restore that crash on both backends.
+//
+// GL_ARB_stencil_texturing is what makes DEPTH_STENCIL_TEXTURE_MODE = GL_STENCIL_INDEX reachable
+// at all before GL 4.3, which is the whole of KHR-GL3x.packed_depth_stencil.stencil_texturing.
+TEST(DirectGLESSanity, AdvertisesUniformBufferObjectAndStencilTexturing) {
+    MobileGL::MG_Backend::DirectGLES::BackendObject_DirectGLES backend;
+    const auto& extensions = backend.GetRendererInfo().RendererGLInfo.Extensions;
+
+    EXPECT_NE(std::find(extensions.begin(), extensions.end(), MobileGL::E_GL_ARB_uniform_buffer_object),
+              extensions.end());
+    EXPECT_NE(std::find(extensions.begin(), extensions.end(), MobileGL::E_GL_ARB_stencil_texturing),
+              extensions.end());
+}
+
+TEST(DirectVulkanSanity, AdvertisesUniformBufferObjectAndStencilTexturing) {
+    MobileGL::MG_Backend::DirectVulkan::BackendObject_DirectVulkan backend;
+    const auto& extensions = backend.GetRendererInfo().RendererGLInfo.Extensions;
+
+    EXPECT_NE(std::find(extensions.begin(), extensions.end(), MobileGL::E_GL_ARB_uniform_buffer_object),
+              extensions.end());
+    EXPECT_NE(std::find(extensions.begin(), extensions.end(), MobileGL::E_GL_ARB_stencil_texturing),
+              extensions.end());
+}
+
 // Voxy only ever needed the extensions, which stay advertised whatever the version is; the version
 // assertion just pins what the backend really reports, now that V_OpenGL40 is in the list.
 TEST(DirectGLESSanity, AdvertisesVoxyRequiredRenderingExtensions) {
@@ -435,6 +467,31 @@ TEST(DirectVulkanSanity, AdvertisesTextureStorageForDirectStateAccess) {
     EXPECT_NE(std::find(extensions.begin(), extensions.end(), MobileGL::E_GL_ARB_texture_storage), extensions.end());
 }
 
+// A sampled view of a combined depth/stencil image may name exactly one aspect, and
+// GL_DEPTH_STENCIL_TEXTURE_MODE picks which - the whole of GL_ARB_stencil_texturing on this
+// backend. Depth remains the answer for everything that does not ask for stencil, including
+// depth-only images asked for the stencil aspect they do not have.
+TEST(DirectVulkanSanity, SampledViewAspectFollowsDepthStencilTextureMode) {
+    using MobileGL::MG_Backend::DirectVulkan::VkTextureManager;
+    constexpr VkImageAspectFlags kPacked = VK_IMAGE_ASPECT_DEPTH_BIT | VK_IMAGE_ASPECT_STENCIL_BIT;
+
+    EXPECT_EQ(VkTextureManager::ResolveSampledImageViewAspectMask(kPacked, GL_DEPTH_COMPONENT),
+              static_cast<VkImageAspectFlags>(VK_IMAGE_ASPECT_DEPTH_BIT));
+    EXPECT_EQ(VkTextureManager::ResolveSampledImageViewAspectMask(kPacked, GL_STENCIL_INDEX),
+              static_cast<VkImageAspectFlags>(VK_IMAGE_ASPECT_STENCIL_BIT));
+    // The default argument is the pre-existing behaviour, for the call sites with no texture.
+    EXPECT_EQ(VkTextureManager::ResolveSampledImageViewAspectMask(kPacked),
+              static_cast<VkImageAspectFlags>(VK_IMAGE_ASPECT_DEPTH_BIT));
+
+    // Single-aspect images ignore the mode: there is only one aspect to name.
+    EXPECT_EQ(VkTextureManager::ResolveSampledImageViewAspectMask(VK_IMAGE_ASPECT_DEPTH_BIT, GL_STENCIL_INDEX),
+              static_cast<VkImageAspectFlags>(VK_IMAGE_ASPECT_DEPTH_BIT));
+    EXPECT_EQ(VkTextureManager::ResolveSampledImageViewAspectMask(VK_IMAGE_ASPECT_STENCIL_BIT, GL_DEPTH_COMPONENT),
+              static_cast<VkImageAspectFlags>(VK_IMAGE_ASPECT_STENCIL_BIT));
+    EXPECT_EQ(VkTextureManager::ResolveSampledImageViewAspectMask(VK_IMAGE_ASPECT_COLOR_BIT, GL_STENCIL_INDEX),
+              static_cast<VkImageAspectFlags>(VK_IMAGE_ASPECT_COLOR_BIT));
+}
+
 TEST(DirectVulkanSanity, RenderPassExtentUsesSwapchainSizeOnlyForDefaultFramebuffer) {
     using MobileGL::MG_Backend::DirectVulkan::ResolveRenderPassFramebufferExtent;
 

MobileGL/MG_Test/ShaderTranspiler/DemoteFloat64Test.cpp

@@ -484,3 +484,53 @@ TEST_F(DemoteFloat64Test, RejectsGarbageInput) {
     Vector<Uint32> output;
     EXPECT_FALSE(ShaderCompiler::DemoteFloat64ToFloat32(notSpirv, output));
 }
+
+// EliminateFloatEqualsZeroPass turns a comparison against 0.0 into an epsilon test, a
+// workaround for drivers whose exact float compare misbehaves. Deciding WHICH constants are
+// zero used to read every float constant as though it were 32 bits wide, and on a 64-bit
+// constant that reads the LOW half of the mantissa - which is zero for 1.0lf, 2.0lf, 0.5lf and
+// every other round double a shader is likely to spell. Each of those was mistaken for 0.0, so
+// a comparison against 1.0lf became an epsilon test against ZERO, and came out true for a
+// uniform holding exactly 1.0. That is the whole of KHR-GL43.compute_shader.fp64-case2.
+//
+// Asserted on the optimized module rather than through a driver, because that is where the
+// rewrite happens and its fingerprint there is unambiguous: the epsilon form introduces a
+// GLSL.std.450 FAbs, and nothing else in these shaders would.
+namespace {
+    Bool RewritesToAnEpsilonTest(const String& source) {
+        const Vector<Uint32> input = CompileToSpirv(GL_COMPUTE_SHADER, source);
+        EXPECT_FALSE(input.empty());
+        if (input.empty()) return false;
+        Vector<Uint32> output;
+        EXPECT_TRUE(ShaderCompiler::SanitizeAndOptimizeBinary(input, output));
+        return Disassemble(output).find("FAbs") != String::npos;
+    }
+
+    String CompareAgainst(const String& type, const String& literal) {
+        return "#version 430 core\n"
+               "layout(local_size_x = 1) in;\n"
+               "buffer Result { int g_result; };\n"
+               "uniform " + type + " g_0;\n"
+               "void main() {\n"
+               "  g_result = 0;\n"
+               "  if (g_0 != " + literal + ") g_result = 1;\n"
+               "}\n";
+    }
+} // namespace
+
+TEST_F(DemoteFloat64Test, AComparisonAgainstANonZeroDoubleIsLeftAlone) {
+    EXPECT_FALSE(RewritesToAnEpsilonTest(CompareAgainst("double", "1.0LF")))
+        << "a double compared against 1.0lf was rewritten into an epsilon test against zero";
+}
+
+TEST_F(DemoteFloat64Test, AComparisonAgainstZeroIsStillRewritten) {
+    EXPECT_TRUE(RewritesToAnEpsilonTest(CompareAgainst("double", "0.0LF")))
+        << "the rewrite must still fire for a genuine comparison against zero";
+}
+
+TEST_F(DemoteFloat64Test, TheThirtyTwoBitBehaviourIsUnchanged) {
+    EXPECT_FALSE(RewritesToAnEpsilonTest(CompareAgainst("float", "1.0")))
+        << "a float compared against 1.0 must not be rewritten";
+    EXPECT_TRUE(RewritesToAnEpsilonTest(CompareAgainst("float", "0.0")))
+        << "the 32-bit behaviour this pass shipped with must be preserved exactly";
+}

MobileGL/MG_Test/State/NegativeApiErrorsTest.cpp

@@ -323,6 +323,47 @@ namespace {
         static_cast<void>(parameterBuffer);
     }
 
+    // A transform feedback name has two different truths and glDrawTransformFeedback used to ask
+    // for the wrong one. glGenTransformFeedbacks only RESERVES a name; the first
+    // glBindTransformFeedback is what creates the object (GL 4.6 core 13.2.1), and
+    // glIsTransformFeedback reports exactly that distinction. glDrawTransformFeedback's
+    // "id is not the name of a transform feedback object" INVALID_VALUE has to agree with
+    // glIsTransformFeedback, or a caller that picks an unused name the way
+    // KHR-GL4x.transform_feedback.api_errors_test does - increment until glIsTransformFeedback
+    // says false - gets a name the draw then accepts, and the draw falls through to a different
+    // error entirely (INVALID_OPERATION, "glEndTransformFeedback has never been called").
+    //
+    // The draw path itself needs a backend and a linked program before it reaches the name, which
+    // this GPU-free suite has neither of, so what is pinned here is the predicate pair the fix
+    // turns on: the two must not collapse back into one.
+    TEST_F(NegativeApiErrorsTest, ReservedTransformFeedbackNameIsNotYetAnObject) {
+        GLuint name = 0;
+        GenTransformFeedbacks(1, &name);
+        ASSERT_NE(name, 0u);
+        DrainErrors();
+
+        // Reserved, so it is a legal argument to glBindTransformFeedback...
+        EXPECT_TRUE(MG_State::pGLContext->ValidateTransformFeedbackName(name));
+        // ...but not an object yet, which is what a draw must key off.
+        EXPECT_FALSE(MG_State::pGLContext->IsTransformFeedbackObject(name));
+        EXPECT_EQ(IsTransformFeedback(name), GL_FALSE);
+
+        BindTransformFeedback(GL_TRANSFORM_FEEDBACK, name);
+        EXPECT_EQ(GetError(), GL_NO_ERROR);
+
+        EXPECT_TRUE(MG_State::pGLContext->ValidateTransformFeedbackName(name));
+        EXPECT_TRUE(MG_State::pGLContext->IsTransformFeedbackObject(name));
+        EXPECT_EQ(IsTransformFeedback(name), GL_TRUE);
+
+        // The default object is never "an object" by this predicate and is always drawable, so
+        // the draw path has to special-case it rather than reuse the answer directly.
+        EXPECT_FALSE(MG_State::pGLContext->IsTransformFeedbackObject(0));
+        EXPECT_TRUE(MG_State::pGLContext->ValidateTransformFeedbackName(0));
+
+        BindTransformFeedback(GL_TRANSFORM_FEEDBACK, 0);
+        DrainErrors();
+    }
+
     TEST_F(NegativeApiErrorsTest, TexStorage3DRejectsCompressedFormatsOnTexture3D) {
         GLuint texture = 0;
         GenTextures(1, &texture);

MobileGL/MG_Test/Texture/TextureTest.cpp

@@ -16,6 +16,7 @@
 #include <MG_Backend/BackendObjects.h>
 #include <MG_Backend/DirectGLES/Managers.h>
 #include <MG_Backend/DirectGLES/Utils.h>
+#include <MG_Impl/GLImpl/Buffer/GL_Buffer.h>
 #include <MG_Impl/GLImpl/Framebuffer/GL_Framebuffer.h>
 #include <MG_Impl/GLImpl/Getter/GL_Getter.h>
 #include <MG_Impl/GLImpl/RenderState/GL_RenderState.h>
@@ -1572,6 +1573,415 @@ TEST_F(TextureTest, CompressedInternalFormatsResolveToTheirUncompressedStorage)
     }
 }
 
+// Resolving to uncompressed storage is a storage decision, not a licence to answer the level
+// queries as if the application had asked for an uncompressed format. GL 4.6 core 8.5 lets the
+// implementation choose for the GENERIC formats (GL_COMPRESSED_RED and friends), but a SPECIFIC
+// one commits the level: GL_TEXTURE_COMPRESSED is true, GL_TEXTURE_INTERNAL_FORMAT is the token
+// that was passed, and GL_TEXTURE_COMPRESSED_IMAGE_SIZE answers instead of erroring - which is
+// exactly the three-query sequence KHR-GL44.buffer_storage.map_persistent_texture opens with to
+// size the image it then uploads through glCompressedTexSubImage2D.
+TEST_F(TextureTest, ASpecificCompressedInternalFormatTagsTheLevelCompressed) {
+    GLuint texture = 0;
+    MG_Impl::GLImpl::GenTextures(1, &texture);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, texture);
+    MG_Impl::GLImpl::TexImage2D(GL_TEXTURE_2D, 0, GL_COMPRESSED_RED_RGTC1, 8, 8, 0, GL_RED, GL_UNSIGNED_BYTE, nullptr);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    GLint compressed = GL_FALSE;
+    MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_COMPRESSED, &compressed);
+    EXPECT_EQ(compressed, GL_TRUE);
+
+    GLint internalFormat = 0;
+    MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_INTERNAL_FORMAT, &internalFormat);
+    EXPECT_EQ(internalFormat, static_cast<GLint>(GL_COMPRESSED_RED_RGTC1));
+
+    // 8x8 in 4x4 blocks of 8 bytes each.
+    GLint imageSize = 0;
+    MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_COMPRESSED_IMAGE_SIZE, &imageSize);
+    EXPECT_EQ(imageSize, 32);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // The texel shadow behind the tag still carries the uncompressed storage the format resolves
+    // to - which is what lets the level sample, and what every size computation downstream
+    // divides by.
+    const auto textureObject = MG_State::pGLContext->GetTextureObject(texture);
+    ASSERT_NE(textureObject, nullptr);
+    EXPECT_EQ(textureObject->GetFormat(), TextureInternalFormat::R8);
+}
+
+// The negative control for the case above, and the reason it cannot simply tag every
+// GL_COMPRESSED_* token: for a generic format the implementation's choice IS the answer, and
+// MobileGL chooses uncompressed - so the level is not compressed and the size query is the
+// INVALID_OPERATION GL 4.6 core 8.11 prescribes for an uncompressed image.
+TEST_F(TextureTest, AGenericCompressedInternalFormatLeavesTheLevelUncompressed) {
+    GLuint texture = 0;
+    MG_Impl::GLImpl::GenTextures(1, &texture);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, texture);
+    MG_Impl::GLImpl::TexImage2D(GL_TEXTURE_2D, 0, GL_COMPRESSED_RED, 8, 8, 0, GL_RED, GL_UNSIGNED_BYTE, nullptr);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    GLint compressed = GL_TRUE;
+    MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_COMPRESSED, &compressed);
+    EXPECT_EQ(compressed, GL_FALSE);
+
+    GLint internalFormat = 0;
+    MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_INTERNAL_FORMAT, &internalFormat);
+    EXPECT_EQ(internalFormat, static_cast<GLint>(GL_R8));
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    GLint imageSize = 0;
+    MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_COMPRESSED_IMAGE_SIZE, &imageSize);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+}
+
+// A plain glTexImage2D over a level that was tagged compressed has to un-tag it, the same way it
+// does for a level a glCompressedTexImage2D shadowed - otherwise the size query would keep
+// answering for an image that no longer exists.
+TEST_F(TextureTest, AnUncompressedRespecificationClearsTheCompressedTag) {
+    GLuint texture = 0;
+    MG_Impl::GLImpl::GenTextures(1, &texture);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, texture);
+    MG_Impl::GLImpl::TexImage2D(GL_TEXTURE_2D, 0, GL_COMPRESSED_RED_RGTC1, 8, 8, 0, GL_RED, GL_UNSIGNED_BYTE, nullptr);
+    MG_Impl::GLImpl::TexImage2D(GL_TEXTURE_2D, 0, GL_R8, 8, 8, 0, GL_RED, GL_UNSIGNED_BYTE, nullptr);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    GLint compressed = GL_TRUE;
+    MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_COMPRESSED, &compressed);
+    EXPECT_EQ(compressed, GL_FALSE);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+// GL_DEPTH_STENCIL_TEXTURE_MODE used to be a pure frontend shadow: stored, answered by
+// glGetTexParameter, and never shown to a backend. Sampling therefore always read the depth
+// aspect however the mode was set, which is the whole of
+// KHR-GL3x.packed_depth_stencil.stencil_texturing. Both backends pick the aspect up through the
+// texture-params version - DirectGLES re-emits glTexParameteri when it moves, DirectVulkan
+// rebuilds the sampled image view - so the version bump is the load-bearing part, and a
+// no-op write must not spend one (every bump costs DirectVulkan a view recreation).
+TEST_F(TextureTest, DepthStencilTextureModeIsBackendVisibleThroughTheParamsVersion) {
+    GLuint texture = 0;
+    MG_Impl::GLImpl::GenTextures(1, &texture);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, texture);
+    MG_Impl::GLImpl::TexStorage2D(GL_TEXTURE_2D, 1, GL_DEPTH24_STENCIL8, 8, 8);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    const auto textureObject = MG_State::pGLContext->GetTextureObject(texture);
+    ASSERT_NE(textureObject, nullptr);
+    EXPECT_EQ(textureObject->GetDepthStencilTextureMode(), static_cast<GLenum>(GL_DEPTH_COMPONENT));
+
+    const Uint16 initialVersion = textureObject->GetTextureParamsVersion();
+    MG_Impl::GLImpl::TexParameteri(GL_TEXTURE_2D, GL_DEPTH_STENCIL_TEXTURE_MODE, GL_STENCIL_INDEX);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    EXPECT_EQ(textureObject->GetDepthStencilTextureMode(), static_cast<GLenum>(GL_STENCIL_INDEX));
+    EXPECT_NE(textureObject->GetTextureParamsVersion(), initialVersion);
+
+    // Re-writing the value already in force is not a change and must not invalidate anything.
+    const Uint16 settledVersion = textureObject->GetTextureParamsVersion();
+    MG_Impl::GLImpl::TexParameteri(GL_TEXTURE_2D, GL_DEPTH_STENCIL_TEXTURE_MODE, GL_STENCIL_INDEX);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    EXPECT_EQ(textureObject->GetTextureParamsVersion(), settledVersion);
+
+    // ...and going back to the depth aspect is a change again.
+    MG_Impl::GLImpl::TexParameteri(GL_TEXTURE_2D, GL_DEPTH_STENCIL_TEXTURE_MODE, GL_DEPTH_COMPONENT);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    EXPECT_EQ(textureObject->GetDepthStencilTextureMode(), static_cast<GLenum>(GL_DEPTH_COMPONENT));
+    EXPECT_NE(textureObject->GetTextureParamsVersion(), settledVersion);
+}
+
+namespace {
+    // 8x8 RGTC1: 2x2 blocks of 8 bytes, so the stored image is 32 bytes and one block row is 16.
+    constexpr GLsizei kRgtc1Size8x8 = 32;
+
+    GLuint MakeCompressedRgtc1Texture8x8() {
+        GLuint texture = 0;
+        MG_Impl::GLImpl::GenTextures(1, &texture);
+        MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, texture);
+        MG_Impl::GLImpl::CompressedTexImage2D(GL_TEXTURE_2D, 0, GL_COMPRESSED_RED_RGTC1, 8, 8, 0, kRgtc1Size8x8,
+                                              nullptr);
+        return texture;
+    }
+} // namespace
+
+// glCompressedTexSubImage2D was a stub that answered GL_INVALID_ENUM to every call. It replaces a
+// block-aligned rectangle of the stored image, and the arithmetic that places the incoming blocks
+// is what the partial write below pins: a full-width write would pass with the rows concatenated
+// in either order.
+TEST_F(TextureTest, CompressedTexSubImage2DReplacesTheStoredBlocks) {
+    const GLuint texture = MakeCompressedRgtc1Texture8x8();
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    Uint8 whole[kRgtc1Size8x8];
+    for (Int i = 0; i < kRgtc1Size8x8; ++i) whole[i] = static_cast<Uint8>(i + 1);
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, kRgtc1Size8x8,
+                                             whole);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    Uint8 stored[kRgtc1Size8x8] = {};
+    MG_Impl::GLImpl::GetCompressedTexImage(GL_TEXTURE_2D, 0, stored);
+    EXPECT_EQ(std::memcmp(stored, whole, sizeof(whole)), 0);
+
+    // The right-hand block column only: one block wide, two block rows high. Its two blocks land
+    // at byte 8 and byte 24, not at bytes 0 and 8.
+    const Uint8 column[16] = {0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5, 0xA6, 0xA7,
+                              0xB0, 0xB1, 0xB2, 0xB3, 0xB4, 0xB5, 0xB6, 0xB7};
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 4, 0, 4, 8, GL_COMPRESSED_RED_RGTC1,
+                                             static_cast<GLsizei>(sizeof(column)), column);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    Uint8 expected[kRgtc1Size8x8];
+    std::memcpy(expected, whole, sizeof(expected));
+    std::memcpy(expected + 8, column, 8);
+    std::memcpy(expected + 24, column + 8, 8);
+
+    std::memset(stored, 0, sizeof(stored));
+    MG_Impl::GLImpl::GetCompressedTexImage(GL_TEXTURE_2D, 0, stored);
+    EXPECT_EQ(std::memcmp(stored, expected, sizeof(expected)), 0);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+// The Y axis of the placement, which the whole-image and single-column cases above cannot see: an
+// implementation that dropped the first-block-row term, or that divided yoffset by the block WIDTH,
+// passes every one of them. The region here starts at block row 1, so its two blocks belong at
+// bytes 16 and 24 and nowhere else.
+TEST_F(TextureTest, CompressedTexSubImage2DPlacesTheFirstBlockRow) {
+    const GLuint texture = MakeCompressedRgtc1Texture8x8();
+    Uint8 whole[kRgtc1Size8x8];
+    for (Int i = 0; i < kRgtc1Size8x8; ++i) whole[i] = static_cast<Uint8>(i + 1);
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, kRgtc1Size8x8,
+                                             whole);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // The bottom block row only: 8 texels wide, 4 high, starting at y = 4.
+    const Uint8 bottom[16] = {0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7,
+                              0xD0, 0xD1, 0xD2, 0xD3, 0xD4, 0xD5, 0xD6, 0xD7};
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 4, 8, 4, GL_COMPRESSED_RED_RGTC1,
+                                             static_cast<GLsizei>(sizeof(bottom)), bottom);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    Uint8 expected[kRgtc1Size8x8];
+    std::memcpy(expected, whole, sizeof(expected));
+    std::memcpy(expected + 16, bottom, sizeof(bottom));
+
+    Uint8 stored[kRgtc1Size8x8] = {};
+    MG_Impl::GLImpl::GetCompressedTexImage(GL_TEXTURE_2D, 0, stored);
+    EXPECT_EQ(std::memcmp(stored, expected, sizeof(expected)), 0);
+
+    // And one block in the far corner, which needs both terms at once.
+    const Uint8 corner[8] = {0xE0, 0xE1, 0xE2, 0xE3, 0xE4, 0xE5, 0xE6, 0xE7};
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 4, 4, 4, 4, GL_COMPRESSED_RED_RGTC1,
+                                             static_cast<GLsizei>(sizeof(corner)), corner);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    std::memcpy(expected + 24, corner, sizeof(corner));
+    std::memset(stored, 0, sizeof(stored));
+    MG_Impl::GLImpl::GetCompressedTexImage(GL_TEXTURE_2D, 0, stored);
+    EXPECT_EQ(std::memcmp(stored, expected, sizeof(expected)), 0);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    (void)texture;
+}
+
+// A level whose size is neither square nor a multiple of the block size, at a level above the
+// base, in a format with SIXTEEN bytes per block. Between them these pin the row stride (which a
+// square level cannot distinguish from the column count), the rounding-up of a partial edge block,
+// the run-to-the-edge exemption from the whole-blocks rule, and the block size actually coming from
+// the format rather than from a constant.
+TEST_F(TextureTest, CompressedTexSubImage2DHandlesPartialBlocksAndAMipLevel) {
+    GLuint texture = 0;
+    MG_Impl::GLImpl::GenTextures(1, &texture);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, texture);
+    // 6x10 BPTC: 2 block columns x 3 block rows of 16 bytes = 96, one block row = 32.
+    constexpr GLsizei kBptcSize6x10 = 96;
+    MG_Impl::GLImpl::CompressedTexImage2D(GL_TEXTURE_2D, 1, GL_COMPRESSED_RGBA_BPTC_UNORM, 6, 10, 0, kBptcSize6x10,
+                                          nullptr);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    GLint imageSize = 0;
+    MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, 1, GL_TEXTURE_COMPRESSED_IMAGE_SIZE, &imageSize);
+    EXPECT_EQ(imageSize, kBptcSize6x10);
+
+    Uint8 whole[kBptcSize6x10];
+    for (Int i = 0; i < kBptcSize6x10; ++i) whole[i] = static_cast<Uint8>(i + 1);
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 1, 0, 0, 6, 10, GL_COMPRESSED_RGBA_BPTC_UNORM,
+                                             kBptcSize6x10, whole);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // The right-hand column (2 texels wide - a partial block that runs to the edge) of the middle
+    // block row: one block, at byte 32 + 16.
+    Uint8 patch[16];
+    for (Int i = 0; i < 16; ++i) patch[i] = static_cast<Uint8>(0xF0 + i);
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 1, 4, 4, 2, 4, GL_COMPRESSED_RGBA_BPTC_UNORM,
+                                             static_cast<GLsizei>(sizeof(patch)), patch);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    Uint8 expected[kBptcSize6x10];
+    std::memcpy(expected, whole, sizeof(expected));
+    std::memcpy(expected + 48, patch, sizeof(patch));
+
+    Uint8 stored[kBptcSize6x10] = {};
+    MG_Impl::GLImpl::GetCompressedTexImage(GL_TEXTURE_2D, 1, stored);
+    EXPECT_EQ(std::memcmp(stored, expected, sizeof(expected)), 0);
+
+    // The partial edge block is only exempt from the whole-blocks rule AT the edge: the same
+    // 2-texel width one block to the left is not.
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 1, 0, 4, 2, 4, GL_COMPRESSED_RGBA_BPTC_UNORM,
+                                             static_cast<GLsizei>(sizeof(patch)), patch);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+}
+
+// The same call sourcing its blocks from a buffer bound to GL_PIXEL_UNPACK_BUFFER, where `data` is
+// an offset into that buffer rather than a client pointer - which is the form
+// KHR-GL44.buffer_storage.map_persistent_texture uses for every one of its operations.
+TEST_F(TextureTest, CompressedTexSubImage2DUnpacksFromAPixelUnpackBuffer) {
+    Uint8 source[256];
+    for (Int i = 0; i < 256; ++i) source[i] = static_cast<Uint8>(i);
+    GLuint buffer = 0;
+    MG_Impl::GLImpl::GenBuffers(1, &buffer);
+    MG_Impl::GLImpl::BindBuffer(GL_PIXEL_UNPACK_BUFFER, buffer);
+    MG_Impl::GLImpl::BufferData(GL_PIXEL_UNPACK_BUFFER, sizeof(source), source, GL_STATIC_DRAW);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    const GLuint texture = MakeCompressedRgtc1Texture8x8();
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, kRgtc1Size8x8,
+                                             reinterpret_cast<const void*>(static_cast<SizeT>(64)));
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    Uint8 stored[kRgtc1Size8x8] = {};
+    MG_Impl::GLImpl::GetCompressedTexImage(GL_TEXTURE_2D, 0, stored);
+    EXPECT_EQ(std::memcmp(stored, source + 64, sizeof(stored)), 0);
+
+    // Reading past the end of the buffer is the unpack-buffer error, not a read out of bounds.
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, kRgtc1Size8x8,
+                                             reinterpret_cast<const void*>(static_cast<SizeT>(sizeof(source) - 8)));
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+
+    MG_Impl::GLImpl::BindBuffer(GL_PIXEL_UNPACK_BUFFER, 0);
+    (void)texture;
+}
+
+// ARB_buffer_storage's whole point: a PERSISTENTLY mapped buffer stays usable while the map is
+// live, including as the source of a texture upload - which is what
+// KHR-GL44.buffer_storage.map_persistent_texture checks. An ordinary map still disqualifies it.
+// Both compressed entry points share one validator, so both are checked here.
+TEST_F(TextureTest, CompressedUploadsAcceptAPersistentlyMappedUnpackBuffer) {
+    Uint8 source[256];
+    for (Int i = 0; i < 256; ++i) source[i] = static_cast<Uint8>(255 - i);
+    GLuint buffer = 0;
+    MG_Impl::GLImpl::GenBuffers(1, &buffer);
+    MG_Impl::GLImpl::BindBuffer(GL_PIXEL_UNPACK_BUFFER, buffer);
+    MG_Impl::GLImpl::BufferStorage(GL_PIXEL_UNPACK_BUFFER, sizeof(source), source,
+                                   GL_MAP_PERSISTENT_BIT | GL_MAP_READ_BIT | GL_MAP_WRITE_BIT);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    void* mapped = MG_Impl::GLImpl::MapBufferRange(GL_PIXEL_UNPACK_BUFFER, 0, sizeof(source),
+                                                   GL_MAP_PERSISTENT_BIT | GL_MAP_READ_BIT | GL_MAP_WRITE_BIT);
+    ASSERT_NE(mapped, nullptr);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    GLuint texture = 0;
+    MG_Impl::GLImpl::GenTextures(1, &texture);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, texture);
+    // The image call takes offset 0 and the sub-image call offset 128, so the readback can only
+    // match if the SUB-IMAGE call ran: were it refused (or a no-op), the level would still hold
+    // the image call's bytes.
+    MG_Impl::GLImpl::CompressedTexImage2D(GL_TEXTURE_2D, 0, GL_COMPRESSED_RED_RGTC1, 8, 8, 0, kRgtc1Size8x8,
+                                          reinterpret_cast<const void*>(static_cast<SizeT>(0)));
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR) << "glCompressedTexImage2D over a persistent map";
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, kRgtc1Size8x8,
+                                             reinterpret_cast<const void*>(static_cast<SizeT>(128)));
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR) << "glCompressedTexSubImage2D over a persistent map";
+
+    Uint8 stored[kRgtc1Size8x8] = {};
+    MG_Impl::GLImpl::GetCompressedTexImage(GL_TEXTURE_2D, 0, stored);
+    EXPECT_EQ(std::memcmp(stored, source + 128, sizeof(stored)), 0);
+
+    MG_Impl::GLImpl::UnmapBuffer(GL_PIXEL_UNPACK_BUFFER);
+
+    // The negative control: an ORDINARY map is still an error, so the check above is not just
+    // "the mapped test was dropped".
+    GLuint plainBuffer = 0;
+    MG_Impl::GLImpl::GenBuffers(1, &plainBuffer);
+    MG_Impl::GLImpl::BindBuffer(GL_PIXEL_UNPACK_BUFFER, plainBuffer);
+    MG_Impl::GLImpl::BufferData(GL_PIXEL_UNPACK_BUFFER, sizeof(source), source, GL_STATIC_DRAW);
+    ASSERT_NE(MG_Impl::GLImpl::MapBuffer(GL_PIXEL_UNPACK_BUFFER, GL_READ_ONLY), nullptr);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, kRgtc1Size8x8,
+                                             reinterpret_cast<const void*>(static_cast<SizeT>(0)));
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+    MG_Impl::GLImpl::UnmapBuffer(GL_PIXEL_UNPACK_BUFFER);
+    MG_Impl::GLImpl::BindBuffer(GL_PIXEL_UNPACK_BUFFER, 0);
+}
+
+// glCompressedTextureSubImage2D was an exported no-op that raised no error at all, so an
+// application could not tell the write had not happened. It must reach the NAMED texture and leave
+// the binding it borrowed exactly as it found it.
+TEST_F(TextureTest, CompressedTextureSubImage2DModifiesTheNamedTextureOnly) {
+    const GLuint bound = MakeCompressedRgtc1Texture8x8();
+    Uint8 boundImage[kRgtc1Size8x8];
+    for (Int i = 0; i < kRgtc1Size8x8; ++i) boundImage[i] = 0x11;
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, kRgtc1Size8x8,
+                                             boundImage);
+
+    const GLuint named = MakeCompressedRgtc1Texture8x8();
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, bound); // `named` is NOT the bound texture
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    Uint8 namedImage[kRgtc1Size8x8];
+    for (Int i = 0; i < kRgtc1Size8x8; ++i) namedImage[i] = 0x22;
+    MG_Impl::GLImpl::CompressedTextureSubImage2D(named, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, kRgtc1Size8x8,
+                                                 namedImage);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // The borrowed binding is back, and it kept its own image.
+    Uint8 stored[kRgtc1Size8x8] = {};
+    MG_Impl::GLImpl::GetCompressedTexImage(GL_TEXTURE_2D, 0, stored);
+    EXPECT_EQ(std::memcmp(stored, boundImage, sizeof(stored)), 0);
+
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, named);
+    std::memset(stored, 0, sizeof(stored));
+    MG_Impl::GLImpl::GetCompressedTexImage(GL_TEXTURE_2D, 0, stored);
+    EXPECT_EQ(std::memcmp(stored, namedImage, sizeof(stored)), 0);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+TEST_F(TextureTest, CompressedTexSubImage2DRejectsTheRegionsGLForbids) {
+    const GLuint texture = MakeCompressedRgtc1Texture8x8();
+    Uint8 blocks[kRgtc1Size8x8] = {};
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // A format that is not the one the image is stored in.
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RG_RGTC2, 64, blocks);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+
+    // A start that is not on a block boundary.
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 2, 0, 4, 8, GL_COMPRESSED_RED_RGTC1, 16, blocks);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+
+    // A width that is neither a whole number of blocks nor a run to the image's edge.
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 2, 8, GL_COMPRESSED_RED_RGTC1, 16, blocks);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+
+    // A region that runs off the image.
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 4, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, 32, blocks);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+
+    // An imageSize that does not match the region.
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, 16, blocks);
+    ExpectSingleGlError(GL_INVALID_VALUE);
+
+    // A format with no defined block layout here.
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_RGBA8, 32, blocks);
+    ExpectSingleGlError(GL_INVALID_ENUM);
+
+    // An uncompressed image has nothing for it to replace.
+    GLuint plain = 0;
+    MG_Impl::GLImpl::GenTextures(1, &plain);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, plain);
+    MG_Impl::GLImpl::TexImage2D(GL_TEXTURE_2D, 0, GL_R8, 8, 8, 0, GL_RED, GL_UNSIGNED_BYTE, nullptr);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, kRgtc1Size8x8,
+                                             blocks);
+    ExpectSingleGlError(GL_INVALID_OPERATION);
+    (void)texture;
+}
+
 // RGTC compresses 4x4 blocks of a 2D image and has no 3D form, so glTexImage3D must reject it even
 // though the same enum is accepted on a 2D target. The generic compressed formats carry no such
 // restriction and stay legal in 3D.
@@ -3288,3 +3698,57 @@ TEST_F(TextureTest, GetTexLevelParameterOnBufferStorageReportsErrorInsteadOfTerm
         ExpectSingleGlError(GL_INVALID_OPERATION);
     }
 }
+
+// Immutable storage plus glCompressedTexSubImage2D is the modern way to upload a compressed
+// texture, so glTexStorage2D has to commit its levels to a specific compressed internalformat
+// exactly as glTexImage2D does. When it did not, the sub-image call found an uncompressed level
+// and refused it, and glTexImage2D and glTexStorage2D disagreed about the same token.
+TEST_F(TextureTest, TexStorage2DTagsEveryLevelForASpecificCompressedFormat) {
+    GLuint texture = 0;
+    MG_Impl::GLImpl::GenTextures(1, &texture);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, texture);
+    MG_Impl::GLImpl::TexStorage2D(GL_TEXTURE_2D, 2, GL_COMPRESSED_RED_RGTC1, 8, 8);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    for (GLint level = 0; level < 2; ++level) {
+        GLint compressed = GL_FALSE;
+        MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, level, GL_TEXTURE_COMPRESSED, &compressed);
+        EXPECT_EQ(compressed, GL_TRUE) << "level " << level;
+        GLint internalFormat = 0;
+        MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, level, GL_TEXTURE_INTERNAL_FORMAT, &internalFormat);
+        EXPECT_EQ(internalFormat, static_cast<GLint>(GL_COMPRESSED_RED_RGTC1)) << "level " << level;
+        GLint imageSize = 0;
+        MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, level, GL_TEXTURE_COMPRESSED_IMAGE_SIZE, &imageSize);
+        // 8x8 -> 2x2 blocks -> 32 bytes; 4x4 -> 1 block -> 8 bytes.
+        EXPECT_EQ(imageSize, level == 0 ? 32 : 8) << "level " << level;
+    }
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    // ...and the sub-image call the whole arrangement exists for now reaches both levels.
+    Uint8 blocks[kRgtc1Size8x8];
+    for (Int i = 0; i < kRgtc1Size8x8; ++i) blocks[i] = static_cast<Uint8>(0x40 + i);
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, 8, 8, GL_COMPRESSED_RED_RGTC1, kRgtc1Size8x8,
+                                             blocks);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+    Uint8 stored[kRgtc1Size8x8] = {};
+    MG_Impl::GLImpl::GetCompressedTexImage(GL_TEXTURE_2D, 0, stored);
+    EXPECT_EQ(std::memcmp(stored, blocks, sizeof(stored)), 0);
+
+    MG_Impl::GLImpl::CompressedTexSubImage2D(GL_TEXTURE_2D, 1, 0, 0, 4, 4, GL_COMPRESSED_RED_RGTC1, 8, blocks);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}
+
+// The negative control: a generic compressed token leaves glTexStorage2D's levels uncompressed,
+// because for those the implementation's choice IS the answer and MobileGL chooses uncompressed.
+TEST_F(TextureTest, TexStorage2DLeavesAGenericCompressedFormatUncompressed) {
+    GLuint texture = 0;
+    MG_Impl::GLImpl::GenTextures(1, &texture);
+    MG_Impl::GLImpl::BindTexture(GL_TEXTURE_2D, texture);
+    MG_Impl::GLImpl::TexStorage2D(GL_TEXTURE_2D, 1, GL_COMPRESSED_RED, 8, 8);
+    ASSERT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+
+    GLint compressed = GL_TRUE;
+    MG_Impl::GLImpl::GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_COMPRESSED, &compressed);
+    EXPECT_EQ(compressed, GL_FALSE);
+    EXPECT_EQ(MG_Impl::GLImpl::GetError(), GL_NO_ERROR);
+}

MobileGL/MG_Util/BackendLoaders/OpenGL/Loader.cpp

@@ -925,6 +925,9 @@ namespace MobileGL::MG_Util::BackendLoader {
                 if (std::strcmp(extension, "GL_EXT_multi_draw_arrays") == 0) {
                     hasMultiDrawArraysExtension = true;
                 }
+                if (std::strcmp(extension, "GL_EXT_clip_cull_distance") == 0) {
+                    caps.SupportsClipDistance = true;
+                }
             }
         }
         // The pointer check on top of the extension check makes each flag sufficient on its own
@@ -978,6 +981,7 @@ namespace MobileGL::MG_Util::BackendLoader {
         MGLOG_I("    compute shaders (ES 3.1 core): %s", caps.SupportsComputeShader ? "yes" : "no");
         MGLOG_I("    base instance (EXT_base_instance; emulated by attribute offsets when absent): %s",
                 caps.SupportsBaseInstance ? "yes" : "no");
+        MGLOG_I("    clip distances (EXT_clip_cull_distance): %s", caps.SupportsClipDistance ? "yes" : "no");
 
         MGLOG_I("OpenGL ES capabilities:");
         glesFuncs.glGetIntegerv(GL_UNIFORM_BUFFER_OFFSET_ALIGNMENT, &caps.UniformBufferOffsetAlignment);

MobileGL/MG_Util/BackendLoaders/OpenGL/Loader.h

@@ -1163,6 +1163,13 @@ namespace MobileGL {
             // Compute shaders are usable: ES 3.1 core (there is no pre-3.1 extension in ES), with
             // the dispatch and barrier entry points resolved.
             Bool SupportsComputeShader = false;
+            // GL_EXT_clip_cull_distance is present: the driver accepts gl_ClipDistance in ESSL
+            // (which is what SPIRV-Cross emits, together with a `#extension ... : require`) AND
+            // the GL_CLIP_DISTANCE0_EXT..7_EXT enable tokens, whose values are the desktop ones.
+            // ES core has neither at any version, so without this a gl_ClipDistance shader cannot
+            // compile and the per-distance enables have nowhere to go - clipping silently never
+            // happens, which is exactly what KHR-GLxx.clip_distance.functional catches.
+            Bool SupportsClipDistance = false;
             // GL_RENDERER contains "ANGLE".
             Bool IsAngleRenderer = false;
             // GL_RENDERER contains both "ANGLE" and "llvmpipe".

MobileGL/MG_Util/ShaderTranspiler/ShaderCompiler.cpp

@@ -26,6 +26,7 @@
 #include "SpirvPasses/RebaseInstanceIndexPass.h"
 #include "SpirvPasses/ZeroBaseVertexPass.h"
 #include "SpirvPasses/NormalizeRectCoordinatesPass.h"
+#include "SpirvPasses/Lower1DArrayImagesPass.h"
 #include "SpirvPasses/PrivateToEntryLocalPass.h"
 #include "SpirvPasses/StripUniformLocationsPass.h"
 #include "SpirvPasses/StripUboMemberRelaxedPrecisionPass.h"
@@ -824,6 +825,53 @@ namespace MobileGL {
                 return RunOptimizerChecked("LowerRectImages", optimizer, inputBinary, outputBinary);
             }
 
+            bool ShaderCompiler::Lower1DArrayImagesForEssl(const Vector<Uint32>& inputBinary,
+                                                            Vector<uint32_t>& outputBinary) {
+                using namespace spvtools;
+
+                // Declined rather than half-translated: after the rewrite the image is a 2D
+                // array, so a size query on it yields three components where the shader consumes
+                // two. Handing back a differently-shaped size silently is worse than leaving the
+                // module alone and letting the driver say what it does not like - and unlike the
+                // access path there is no correct answer to substitute, because the ES texture
+                // genuinely has a height the GL one does not.
+                //
+                // MGLOG_I, deliberately: MGLOG_E/W are compiled out at the INFO level every CI,
+                // retrace and release build uses, and this is exactly the diagnostic that has to
+                // survive to explain the shader the driver is about to reject.
+                const auto traits = Lower1DArrayImagesPass::InspectBinary(inputBinary);
+                // The overwhelmingly common answer, and the reason the inspection exists: no
+                // 1D-array storage image, so the module is handed back byte for byte without an
+                // Optimizer ever being built. Every ESSL shader in the process passes through
+                // here, so the cost of the case with nothing to do is the cost of this pass.
+                if (!traits.declaresImage) {
+                    outputBinary = inputBinary;
+                    return true;
+                }
+                if (traits.queriesImageSize) {
+                    MGLOG_I("[spirv] Lower1DArrayImagesForEssl: the module queries the size of a 1D-array "
+                            "storage image, which cannot be answered in the 2D-array shape ES stores it in; "
+                            "leaving the module alone, and a strict ES driver will reject it");
+                    outputBinary = inputBinary;
+                    return true;
+                }
+
+                Optimizer optimizer(SPV_ENV_VULKAN_1_1);
+                optimizer.RegisterPass(Lower1DArrayImagesPass::CreateLower1DArrayImagesPass());
+                // Mandatory, not tidying. Rewriting a 1D-array image type to the 2D-array one
+                // makes it structurally IDENTICAL to any real 2D-array image of the same sampled
+                // type and format that the module already declared - and SPIR-V forbids duplicate
+                // non-aggregate type declarations, so the result fails validation. That collision
+                // is not exotic: it is the shape of this whole change's headline case, where one
+                // compute shader declares uimage1DArray and uimage2DArray side by side, both
+                // r32ui. The same applies one level up, to the OpTypePointer instructions that
+                // named the two types, and to the Image1D capability the rewrite turns into a
+                // second Shader. Deduplicating afterwards collapses all three at once.
+                optimizer.RegisterPass(CreateRemoveDuplicatesPass());
+
+                return RunOptimizerChecked("Lower1DArrayImagesForEssl", optimizer, inputBinary, outputBinary);
+            }
+
             bool ShaderCompiler::RebaseInstanceIndexForVulkan(const Vector<Uint32>& inputBinary,
                                                               Vector<uint32_t>& outputBinary) {
                 using namespace spvtools;

MobileGL/MG_Util/ShaderTranspiler/ShaderCompiler.h

@@ -89,6 +89,14 @@ namespace MobileGL {
                 // size and rewrites the image type to 2D. See NormalizeRectCoordinatesPass for
                 // what it declines and why.
                 static bool LowerRectImages(const Vector<Uint32>& inputBinary, Vector<uint32_t>& outputBinary);
+                // GL_TEXTURE_1D_ARRAY storage images rewritten to the 2D-array shape the texture
+                // is actually stored in on ES, with the layer moved from the coordinate's second
+                // component to its third. DirectGLES transpile path only - Vulkan binds a real
+                // VK_IMAGE_VIEW_TYPE_1D_ARRAY and must see the module unchanged. Copies the input
+                // through untouched when the module declares no such image, which is every shader
+                // but a handful. See Lower1DArrayImagesPass for what it declines and why.
+                static bool Lower1DArrayImagesForEssl(const Vector<Uint32>& inputBinary,
+                                                      Vector<uint32_t>& outputBinary);
                 static bool RebaseInstanceIndexForVulkan(const Vector<Uint32>& inputBinary,
                                                          Vector<uint32_t>& outputBinary);
                 // Builds the non-indexed-draw variant of a vertex shader: every gl_BaseVertex

MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/EliminateFloatEqualsZeroPass.cpp

@@ -16,6 +16,7 @@
 #include "source/opt/ir_context.h"
 #include "source/opt/module.h"
 #include "source/opt/type_manager.h"
+#include <cmath>
 #include <vector>
 
 namespace MobileGL {
@@ -70,12 +71,37 @@ namespace MobileGL {
 
                             uint32_t var_id = 0;
 
+                            // The constant's WIDTH decides which accessor may read it, and asking
+                            // the wrong one does not fail - it answers.
+                            //
+                            // GetFloat() bit-casts words()[0], which only means anything at 32
+                            // bits. On a 64-bit constant words()[0] is the LOW half of the
+                            // mantissa, and that half is zero for every round double a shader
+                            // actually spells: 1.0lf, 2.0lf, 0.5lf, 100.0lf. Each of those
+                            // therefore looked like 0.0 here, and `d != 1.0lf` was rewritten into
+                            // `abs(d) >= epsilon` - which is TRUE for d == 1.0. That is the whole
+                            // of KHR-GL43.compute_shader.fp64-case2: twelve uniforms compared
+                            // against vector and matrix constructors were untouched (a composite
+                            // is not a FloatConstant) and the one scalar comparison in the shader
+                            // came out inverted. GetFloat() asserts the width, but every shipping
+                            // build compiles with NDEBUG, so the assert never ran.
+                            //
+                            // Widths other than 32 and 64 are declined rather than guessed at:
+                            // GetDoubleValue() reads words()[1], which a 16-bit constant does not
+                            // have.
                             auto is_float_zero = [&](uint32_t id) -> bool {
                                 const analysis::Constant* c = const_mgr->FindDeclaredConstant(id);
-                                if (c && c->AsFloatConstant() && fabs(c->AsFloatConstant()->GetFloat()) <= K_EPSILON) {
+                                if (c == nullptr) return false;
-                                    return true;
+                                const analysis::FloatConstant* floatConstant = c->AsFloatConstant();
+                                if (floatConstant == nullptr) return false;
+                                const analysis::Float* floatType =
+                                    floatConstant->type() != nullptr ? floatConstant->type()->AsFloat() : nullptr;
+                                if (floatType == nullptr) return false;
+                                switch (floatType->width()) {
+                                case 32: return std::fabs(floatConstant->GetFloatValue()) <= K_EPSILON;
+                                case 64: return std::fabs(floatConstant->GetDoubleValue()) <= K_EPSILON;
+                                default: return false;
                                 }
-                                return false;
                             };
 
                             if (is_float_zero(op2_id)) {

MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/Lower1DArrayImagesPass.cpp

@@ -0,0 +1,299 @@
+// MobileGL - MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/Lower1DArrayImagesPass.cpp
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#include "Lower1DArrayImagesPass.h"
+
+#include "spirv.hpp"
+#include "source/opt/build_module.h"
+#include "source/opt/constants.h"
+#include "source/opt/def_use_manager.h"
+#include "source/opt/instruction.h"
+#include "source/opt/ir_builder.h"
+#include "source/opt/ir_context.h"
+#include "source/opt/module.h"
+#include "source/opt/type_manager.h"
+#include "source/opt/types.h"
+#include "source/util/make_unique.h"
+
+#include <memory>
+#include <vector>
+
+namespace MobileGL {
+    namespace MG_Util {
+        namespace ShaderTranspiler {
+            namespace {
+                using spvtools::opt::Instruction;
+                using spvtools::opt::InstructionBuilder;
+                using spvtools::opt::IRContext;
+
+                // OpTypeImage in-operands: 0 sampled type, 1 Dim, 2 Depth, 3 Arrayed, 4 MS,
+                // 5 Sampled, 6 Format.
+                constexpr uint32_t kDimOperand = 1;
+                constexpr uint32_t kArrayedOperand = 3;
+                constexpr uint32_t kSampledOperand = 5;
+
+                // A 1D image that is arrayed AND is a storage image. Sampled == 2 is SPIR-V's
+                // "used without a sampler", i.e. exactly the image uniforms this pass exists for;
+                // Sampled == 1 (a sampled image) reaches SPIRV-Cross's sampler path, which
+                // already handles the 1D-array shape correctly and must be left to it.
+                bool Is1DArrayStorageImageType(const Instruction* imageType) {
+                    return imageType != nullptr && imageType->opcode() == spv::Op::OpTypeImage &&
+                           imageType->NumInOperands() > kSampledOperand &&
+                           static_cast<spv::Dim>(imageType->GetSingleWordInOperand(kDimOperand)) == spv::Dim::Dim1D &&
+                           imageType->GetSingleWordInOperand(kArrayedOperand) == 1u &&
+                           imageType->GetSingleWordInOperand(kSampledOperand) == 2u;
+                }
+
+                // Any Dim1D image, sampled or storage. Used only to decide whether the Image1D
+                // capability is still needed - deliberately wider than the rewrite's own
+                // predicate, so a module that also holds a non-arrayed 1D image (which this pass
+                // leaves to SPIRV-Cross) keeps the capability it still requires.
+                bool IsDim1DImageType(const Instruction* imageType) {
+                    return imageType != nullptr && imageType->opcode() == spv::Op::OpTypeImage &&
+                           imageType->NumInOperands() > kSampledOperand &&
+                           static_cast<spv::Dim>(imageType->GetSingleWordInOperand(kDimOperand)) == spv::Dim::Dim1D;
+                }
+
+                // The OpTypeImage behind whatever an image operation was handed - a bare image,
+                // or a pointer to one. Same unwrapping as NormalizeRectCoordinatesPass, minus the
+                // sampled-image case a storage image never has.
+                Instruction* ResolveImageType(IRContext* context, uint32_t objectId) {
+                    auto* defUseMgr = context->get_def_use_mgr();
+                    Instruction* object = defUseMgr->GetDef(objectId);
+                    if (object == nullptr) return nullptr;
+                    Instruction* type = defUseMgr->GetDef(object->type_id());
+                    while (type != nullptr) {
+                        switch (type->opcode()) {
+                        case spv::Op::OpTypeImage:
+                            return type;
+                        case spv::Op::OpTypeSampledImage:
+                        case spv::Op::OpTypePointer:
+                        case spv::Op::OpTypeArray:
+                        case spv::Op::OpTypeRuntimeArray:
+                            // Each names its element type in its last in-operand, except arrays,
+                            // whose element type is the FIRST. Both are reached here because an
+                            // image uniform may be declared as an array of images.
+                            type = defUseMgr->GetDef(type->opcode() == spv::Op::OpTypeArray ||
+                                                             type->opcode() == spv::Op::OpTypeRuntimeArray
+                                                         ? type->GetSingleWordInOperand(0)
+                                                         : type->GetSingleWordInOperand(type->NumInOperands() - 1));
+                            continue;
+                        default:
+                            return nullptr;
+                        }
+                    }
+                    return nullptr;
+                }
+
+                // The coordinate operand index for the operations that address an image's texels.
+                // OpImageRead and OpImageTexelPointer take (image, coordinate, ...); OpImageWrite
+                // takes (image, coordinate, texel).
+                bool TryGetCoordinateOperand(spv::Op opcode, uint32_t* coordinateOperand) {
+                    switch (opcode) {
+                    case spv::Op::OpImageRead:
+                    case spv::Op::OpImageSparseRead:
+                    case spv::Op::OpImageWrite:
+                    case spv::Op::OpImageTexelPointer:
+                        *coordinateOperand = 1;
+                        return true;
+                    default:
+                        return false;
+                    }
+                }
+
+                bool QueriesImageSize(spv::Op opcode) {
+                    return opcode == spv::Op::OpImageQuerySize || opcode == spv::Op::OpImageQuerySizeLod ||
+                           opcode == spv::Op::OpImageQueryLevels || opcode == spv::Op::OpImageQuerySamples;
+                }
+            } // namespace
+
+            Lower1DArrayImagesPass::ModuleTraits Lower1DArrayImagesPass::InspectBinary(const Vector<Uint32>& binary) {
+                ModuleTraits traits{};
+                if (binary.empty()) {
+                    return traits;
+                }
+                std::unique_ptr<IRContext> context = spvtools::BuildModule(
+                    SPV_ENV_VULKAN_1_1, [](spv_message_level_t, const char*, const spv_position_t&, const char*) {},
+                    binary.data(), binary.size());
+                if (!context) {
+                    return traits;
+                }
+
+                // The type table settles it for the cheap half, and it is the half almost every
+                // shader takes: no such type declared, nothing to inspect further.
+                for (const Instruction& type : context->module()->types_values()) {
+                    if (Is1DArrayStorageImageType(&type)) {
+                        traits.declaresImage = true;
+                        break;
+                    }
+                }
+                if (!traits.declaresImage) {
+                    return traits;
+                }
+
+                for (auto& function : *context->module()) {
+                    for (auto& block : function) {
+                        for (auto& instruction : block) {
+                            if (!QueriesImageSize(instruction.opcode()) || instruction.NumInOperands() < 1) {
+                                continue;
+                            }
+                            if (Is1DArrayStorageImageType(
+                                    ResolveImageType(context.get(), instruction.GetSingleWordInOperand(0)))) {
+                                traits.queriesImageSize = true;
+                                return traits;
+                            }
+                        }
+                    }
+                }
+                return traits;
+            }
+
+            spvtools::opt::Pass::Status Lower1DArrayImagesPass::Process() {
+                auto* irContext = context();
+                auto* typeMgr = irContext->get_type_mgr();
+                auto* constantMgr = irContext->get_constant_mgr();
+
+                // Nothing to do unless the module actually declares one. Every other shader pays
+                // one walk of the type table and is handed back unchanged.
+                bool hasType = false;
+                for (const Instruction& type : irContext->types_values()) {
+                    if (Is1DArrayStorageImageType(&type)) {
+                        hasType = true;
+                        break;
+                    }
+                }
+                if (!hasType) {
+                    return Status::SuccessWithoutChange;
+                }
+
+                // The same refusal the caller makes, restated here so the pass is safe wherever
+                // it is registered. Rewriting the type while leaving an OpImageQuerySize on it
+                // produces a query whose result type has one component too few - an invalid
+                // module - and there is no correct two-component size to substitute, because the
+                // ES texture genuinely has a height the GL one does not.
+                for (auto& function : *irContext->module()) {
+                    for (auto& block : function) {
+                        for (auto& instruction : block) {
+                            if (QueriesImageSize(instruction.opcode()) && instruction.NumInOperands() >= 1 &&
+                                Is1DArrayStorageImageType(
+                                    ResolveImageType(irContext, instruction.GetSingleWordInOperand(0)))) {
+                                return Status::SuccessWithoutChange;
+                            }
+                        }
+                    }
+                }
+
+                // (u, layer) -> (u, 0, layer). The height the ES 2D array carries is 1, so Y is
+                // always 0 and the layer has to move from the second component to the third; a
+                // plain widening that appended the 0 would read layer 0 of every access instead.
+                for (auto& function : *irContext->module()) {
+                    for (auto& block : function) {
+                        for (auto& instruction : block) {
+                            uint32_t coordinateOperand = 0;
+                            if (!TryGetCoordinateOperand(instruction.opcode(), &coordinateOperand) ||
+                                instruction.NumInOperands() <= coordinateOperand) {
+                                continue;
+                            }
+                            if (!Is1DArrayStorageImageType(
+                                    ResolveImageType(irContext, instruction.GetSingleWordInOperand(0)))) {
+                                continue;
+                            }
+
+                            const uint32_t coordinateId = instruction.GetSingleWordInOperand(coordinateOperand);
+
+                            // Built from the COORDINATE's own component type rather than a
+                            // hardcoded signed int. GLSL only ever spells these ivec2, but SPIR-V
+                            // permits an unsigned coordinate, and extracting a uint component
+                            // into an int result is an invalid module rather than a wrong answer -
+                            // the kind of defect that reaches a driver as "compiles here, not
+                            // there".
+                            Instruction* coordinateDef = irContext->get_def_use_mgr()->GetDef(coordinateId);
+                            if (coordinateDef == nullptr) return Status::Failure;
+                            const auto* coordinateType = typeMgr->GetType(coordinateDef->type_id());
+                            const auto* coordinateVector = coordinateType != nullptr ? coordinateType->AsVector()
+                                                                                     : nullptr;
+                            if (coordinateVector == nullptr || coordinateVector->element_count() != 2) {
+                                return Status::Failure;
+                            }
+                            const auto* component = coordinateVector->element_type();
+                            const auto* componentInteger = component != nullptr ? component->AsInteger() : nullptr;
+                            if (componentInteger == nullptr) return Status::Failure;
+
+                            spvtools::opt::analysis::Vector widenedVector(component, 3);
+                            const uint32_t int3TypeId = typeMgr->GetTypeInstruction(&widenedVector);
+                            const uint32_t intTypeId = typeMgr->GetTypeInstruction(component);
+                            const uint32_t zeroId = componentInteger->IsSigned()
+                                                        ? constantMgr->GetSIntConstId(0)
+                                                        : constantMgr->GetUIntConstId(0);
+                            if (int3TypeId == 0 || intTypeId == 0 || zeroId == 0) {
+                                return Status::Failure;
+                            }
+
+                            InstructionBuilder builder(
+                                irContext, &instruction,
+                                IRContext::kAnalysisDefUse | IRContext::kAnalysisInstrToBlockMapping);
+
+                            Instruction* u =
+                                builder.AddCompositeExtract(intTypeId, coordinateId, {0});
+                            Instruction* layer =
+                                builder.AddCompositeExtract(intTypeId, coordinateId, {1});
+                            if (u == nullptr || layer == nullptr) {
+                                return Status::Failure;
+                            }
+                            Instruction* widened = builder.AddCompositeConstruct(
+                                int3TypeId, {u->result_id(), zeroId, layer->result_id()});
+                            if (widened == nullptr) {
+                                return Status::Failure;
+                            }
+                            instruction.SetInOperand(coordinateOperand, {widened->result_id()});
+                            irContext->UpdateDefUse(&instruction);
+                        }
+                    }
+                }
+
+                // Only now, with no access still spelling the 1D-array coordinate, does the type
+                // become the 2D array one. Arrayed stays 1: this is a 2D ARRAY image, which is
+                // what the texture was stored as.
+                for (Instruction& type : irContext->types_values()) {
+                    if (Is1DArrayStorageImageType(&type)) {
+                        type.SetInOperand(kDimOperand, {static_cast<uint32_t>(spv::Dim::Dim2D)});
+                    }
+                }
+
+                // Image1D describes the types just rewritten - but only drop it if no 1D image
+                // type is left at all. A module may hold a non-arrayed 1D storage image, which
+                // this pass deliberately leaves to SPIRV-Cross, and that one still needs the
+                // capability. Shader is always declared by any module reaching here, so restating
+                // it keeps the instruction valid without leaving a capability a consumer could
+                // key off.
+                bool anyDim1DLeft = false;
+                for (const Instruction& type : irContext->types_values()) {
+                    if (IsDim1DImageType(&type)) {
+                        anyDim1DLeft = true;
+                        break;
+                    }
+                }
+                if (!anyDim1DLeft) {
+                    for (Instruction& capability : irContext->capabilities()) {
+                        const auto value = static_cast<spv::Capability>(capability.GetSingleWordInOperand(0));
+                        if (value == spv::Capability::Image1D) {
+                            capability.SetInOperand(0, {static_cast<uint32_t>(spv::Capability::Shader)});
+                        }
+                    }
+                }
+
+                irContext->InvalidateAnalysesExceptFor(IRContext::kAnalysisNone);
+                return Status::SuccessWithChange;
+            }
+
+            spvtools::Optimizer::PassToken Lower1DArrayImagesPass::CreateLower1DArrayImagesPass() {
+                return spvtools::Optimizer::PassToken(spvtools::MakeUnique<Lower1DArrayImagesPass>());
+            }
+        } // namespace ShaderTranspiler
+    } // namespace MG_Util
+} // namespace MobileGL

MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/Lower1DArrayImagesPass.h

@@ -0,0 +1,99 @@
+// MobileGL - MobileGL/MG_Util/ShaderTranspiler/SpirvPasses/Lower1DArrayImagesPass.h
+// Copyright (c) 2025-2026 MobileGL-Dev
+// Licensed under the GNU Lesser General Public License v3.0:
+//   https://www.gnu.org/licenses/gpl-3.0.txt
+//   https://www.gnu.org/licenses/lgpl-3.0.txt
+// SPDX-License-Identifier: LGPL-3.0-only
+// End of Source File Header
+
+#pragma once
+
+#include "spirv-tools/optimizer.hpp"
+#include "source/opt/pass.h"
+
+#include <Includes.h>
+
+namespace MobileGL {
+    namespace MG_Util {
+        namespace ShaderTranspiler {
+            // ES has no 1D texture of any kind, so a GL_TEXTURE_1D_ARRAY is stored as an ES 2D
+            // array with height 1 and the layers in depth (TextureImpl::MapToBackendTextureTarget
+            // and GetBackendUploadSize, MG_Backend/DirectGLES/Managers.h). The shader side has to
+            // agree, and for SAMPLERS it does: SPIRV-Cross rewrites a 1D-array lookup into a
+            // 2D-array one and moves the layer into the third component itself
+            // (spirv_glsl.cpp, `if (imgtype.image.arrayed) ... ".x, 0.0, " ... ".y"`).
+            //
+            // For IMAGES it does not. The image path applies the same 1D emulation without ever
+            // asking whether the type is arrayed:
+            //
+            //     if (type.image.dim == Dim1D && options.es)
+            //         coord_expr = join("ivec2(", coord_expr, ", 0)");
+            //
+            // For a non-arrayed 1D image that is right - a scalar coordinate becomes (u, 0). For
+            // a 1D ARRAY image the coordinate is already the two-component (u, layer), so the
+            // result is `ivec2(ivec2(u, layer), 0)`: three components crammed into a two-component
+            // constructor. Every ES driver rejects it outright, and the whole program is lost -
+            // which is how one uimage1DArray uniform took the entire eleven-image compute shader
+            // of KHR-GL44.multi_bind.dispatch_bind_image_textures down with it, with the driver
+            // saying only "'constructor' : too many arguments".
+            //
+            // Widening the constructor would not be enough either. `ivec3(u, layer, 0)` puts the
+            // layer in the 2D array's Y and reads layer 0, whereas the storage this has to match
+            // puts height at 1 and the layers in Z, so the correct coordinate is (u, 0, layer).
+            //
+            // So this pass does the whole conversion in the module, before SPIRV-Cross sees it:
+            // every 1D-array STORAGE image type becomes a 2D-array one, and every read and write
+            // through it has its coordinate widened from (u, layer) to (u, 0, layer). SPIRV-Cross
+            // is then looking at an ordinary 2D array image and its 1D path never fires.
+            //
+            // Deliberately narrow, on three axes:
+            //
+            //   * STORAGE images only (Sampled == 2). Sampled images reach SPIRV-Cross's sampler
+            //     path, which is correct today; rewriting them would replace working emission
+            //     with our own for no reason.
+            //   * ARRAYED only. A non-arrayed 1D storage image is emitted correctly by the same
+            //     SPIRV-Cross code, and is left to it.
+            //   * ESSL only. Vulkan has VK_IMAGE_VIEW_TYPE_1D_ARRAY natively and Magma binds it
+            //     directly, so the module must reach that backend unchanged.
+            //
+            // A size query on one of these images is DECLINED rather than half-translated: after
+            // the rewrite OpImageQuerySize yields three components where the shader consumes two,
+            // and silently handing back a differently-shaped size is worse than refusing. The
+            // caller logs it and leaves the module alone.
+            //
+            // KNOWN LIMITATION - the decline is per MODULE, and a program is several of them. A
+            // program whose vertex and fragment stages share a uimage1DArray uniform, where only
+            // one stage calls imageSize() on it, gets that stage declined and the other rewritten:
+            // the two then declare the same uniform with different types and the ES LINK fails on
+            // a type mismatch, rather than the single compile error a reader of the comment above
+            // would expect. Correlating the decision across a program's stages needs the decision
+            // to be made where the program is known, which is above this pass; it is left undone
+            // deliberately rather than papered over, because both outcomes are a refusal and the
+            // shape has never been observed outside a deliberately constructed shader.
+            class Lower1DArrayImagesPass final : public spvtools::opt::Pass {
+            public:
+                const char* name() const override { return "mobilegl-lower-1d-array-images"; }
+                Status Process() override;
+
+                // What one inspection of a binary tells the caller. Both answers come from a
+                // SINGLE parse on purpose: every ESSL shader in the process reaches this, and
+                // almost none of them declare a 1D-array storage image, so the common path has to
+                // cost one module parse and no optimizer run at all - not one parse to ask about
+                // size queries and a second inside an Optimizer that then early-outs.
+                struct ModuleTraits {
+                    // The module declares a 1D-array storage image, i.e. there is anything to do.
+                    bool declaresImage = false;
+                    // ...and queries its size, which is the shape this pass refuses to translate:
+                    // afterwards the image is a 2D array, so the query yields three components
+                    // where the shader consumes two, and there is no correct two-component answer
+                    // to substitute. The caller leaves such a module alone rather than half
+                    // rewriting it.
+                    bool queriesImageSize = false;
+                };
+                static ModuleTraits InspectBinary(const Vector<Uint32>& binary);
+
+                static spvtools::Optimizer::PassToken CreateLower1DArrayImagesPass();
+            };
+        } // namespace ShaderTranspiler
+    } // namespace MG_Util
+} // namespace MobileGL

README.md

@@ -164,6 +164,7 @@ MobileGL supports runtime configuration via environment variables.
 | `MOBILEGL_MAGMA_FRAMESINFLIGHT` | Set Magma frames in flight. | Integer `1`–`64` | `3` |
 | `MOBILEGL_AVOID_SAMPLER_MIPMAP_MIN_FILTER` | Avoid sampler mipmap minification filters. | `0`, `1` | `0` |
 | `MOBILEGL_COHERENT_AS_FLUSH` | Treat persistent `GL_MAP_FLUSH_EXPLICIT_BIT` maps as coherent (app-compat for engines like Flywheel that never flush them). | `0`, `1` | `0` |
+| `MOBILEGL_ESPRYT_FORCE_DS_READBACK_EMULATION` | Always emulate depth/stencil `glReadPixels`/`glGetTexImage` by shader sampling on Espryt, instead of using the driver's own depth/stencil readback where it has one. | `0`, `1` | `0` |
 | `VK_ICD_FILENAMES`      | Select the Vulkan ICD used by the Vulkan loader. | Path to an ICD JSON file             | Loader default |
 
 ## License

tools/trace_replay/README.md

@@ -18,8 +18,6 @@ The bundled fixtures cover:
 - minecraft-1.21.4-fabric-sodium-in-world: captured from Minecraft 1.21.4 Fabric with Sodium after entering a
   singleplayer world with Fancy graphics.
   ![Minecraft 1.21.4 Fabric Sodium in-world golden](fixtures/minecraft-1.21.4-fabric-sodium-in-world.0000923340.png)
-- minecraft-26.2-main-menu: captured from Minecraft 26.2's main menu.
-  ![Minecraft 26.2 main menu golden](fixtures/minecraft-26.2-main-menu.0000101926.png)
 - improved-transparency-minecraft-26.3: captured from the Minecraft 26.3 improved-transparency scene.
   ![Minecraft 26.3 improved-transparency golden](fixtures/improved-transparency-minecraft-26.3.0002667619.png)
 - minecraft-1.21.4-fabric-common-mods-in-world: captured from Minecraft 1.21.4 Fabric with Sodium, Iris, REI,

tools/trace_replay/trace_cases.json

@@ -60,14 +60,6 @@
       "target_call": 923340,
       "timeout_seconds": 1800
     },
-    {
-      "name": "minecraft-26.2-main-menu",
-      "ci": false,
-      "trace_archive": "minecraft-26.2-main-menu.tgz",
-      "golden": "minecraft-26.2-main-menu.0000101926.png",
-      "target_call": 101926,
-      "timeout_seconds": 180
-    },
     {
       "name": "minecraft-1.21.4-fabric-common-mods-in-world",
       "trace_archive": "minecraft-1.21.4-fabric-common-mods-in-world.tgz",