service: zero the reply of auto-stubbed commands

Switch 2 clients read the reply words they expect without checking the
reply size, so an auto stub's result-only reply handed them the request's
leftover words as data: Kirby Air Riders took them as an HDR output format,
the GPU's CreateGraphicsDevice caller as a device id, and so on for every
unimplemented or nullptr command. Reply with 32 zeroed words after the
result instead.

1 files changed, 8 insertions, 1 deletions

diff --git a/src/core/hle/service/service.cpp b/src/core/hle/service/service.cpp
index 1490af0328..38ea936d3c 100644
--- a/src/core/hle/service/service.cpp
+++ b/src/core/hle/service/service.cpp
@@ -88,8 +88,15 @@ void ServiceFrameworkBase::ReportUnimplementedFunction(HLERequestContext& ctx,
         std::string_view{service_name}.starts_with(Nx2StubPrefix) ||
         (caller != nullptr && caller->IsSwitch2())) {
         LOG_WARNING(Service, "Using auto stub fallback!");
-        IPC::ResponseBuilder rb{ctx, 2};
+        // Callers read the reply words they expect without checking how many were written, so an
+        // empty reply hands them the request's leftover words as data (an HDR output format, a
+        // refresh rate, a device id). Reply with zeroed words instead.
+        constexpr u32 ZeroedWords = 32;
+        IPC::ResponseBuilder rb{ctx, 2 + ZeroedWords};
         rb.Push(ResultSuccess);
+        for (u32 i = 0; i < ZeroedWords; ++i) {
+            rb.Push<u32>(0);
+        }
     }
 }