Operator-driven Firefox 150 video session under iter2 driver:
- With MOZ_DISABLE_RDD_SANDBOX=1: our libva backend engages, decodes 10
frames cleanly through hantro (luma gradient 0x10..0x1c matching BBB
intro fade), surface ID recycle + cap_pool slot cycling work as
designed. EINVAL on frame 11 is iter1-carryover (Sonnet 7.x family),
not an iter2 code regression.
- Without sandbox bypass: Firefox 150 RDD sandbox blocks open of
/dev/media0 with ENETDOWN, libva init fails, Firefox SW-falls-back.
iter1 evidence shows libva ran in the utility process
(sandboxingKind=0) at that time; Firefox routing has since changed
to RDD. NOT iter2-side; flag for iter3 substrate.
Cap_pool architecture confirmed working with Firefox: 8 surfaces, slots
recycled IN_DECODE -> DECODED -> reacquired across multiple BeginPicture
cycles for the same surface ID. Decoded NV12 content is real (matches
mpv vaapi-copy luma signature on the same clip).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
mpv --hwdec=vaapi --vo=gpu plays bbb_1080p30 smoothly per operator
inspection. Three independent fixes landed in the fork: format-cache
invalidation on multi-resolution sessions (Fix 1), conditional
DRM_FORMAT_MOD_INVALID for non-64-aligned pitches (Fix 2), decoupled
CAPTURE buffer pool with LRU recycling (Fix 3, the load-bearing one).
Documented limitations carried into iter3 substrate: Option-A
statistical mitigation not provably race-free under pathological
workloads; multi-context safety not addressed; LAST_OUTPUT_*
process-global cache; iter1 carry-over Sonnet 7.x questions still open.
Open recommendation for iter3 substrate: re-run iter1's 4-consumer
regression matrix under Fix 3, especially Firefox 150 multi-video.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
marfrit