[failaip12]

Mario Kart World crashed about every 45 minutes. 11 of the 14 recorded crash stacks were in code fed by garbage GPU commands, and a 1x comparison turned up a race in the GPU memory manager. This PR fixes the race and two swapchain crashes, and stops garbage commands from taking the emulator down. Upstream's latest release most likely removes the garbage at its source, so on this base the guards are a safety net.

Changes

• Guards: invalid syncpoint ids, GPU addresses that translate past the device space, memory walks past the GPU page tables and impossible render targets are now ignored. IsFullyMappedRange reports a rejected range as unmapped, not as fully mapped.
• Swapchain: recreation retries transient errors (one Qt run aborted on VK_INCOMPLETE). If every retry fails, the next frame tries again, and a frame with no swapchain is dropped instead of crashing.
• Race: MemoryManager::PageTableOp now takes the kind_map lock that every other use of the map already takes.
• Diagnostics (separate commit): frame time percentiles, EDEN_NX2_FRAME_LOG, EDEN_NX2_TC_DUMP and slow zone logging.

Where the garbage commands came from

• It's Eden's command parser getting out of step, not corrupted guest memory. The crashing render target size, 2147487260x2147485323, is exactly the command headers 0x80000E1C and 0x8000068B read as data. The syncpoint ids over 192 and the out-of-range device addresses fit the same pattern, but weren't traced to their source words.
• The freezes follow the garbage, not the other way round. In the one session a probe caught, the parser desynced first. A channel then waited on a semaphore value it had read from misparsed words, and the 4 s present timeouts started 4 s later.
• It needs a GPU-starved game. 1 of 17 probe sessions desynced, and only that one spent 2 minutes at 4-5 fps with the host GPU at 100% before it did.
• Most likely cause: with the GPU behind, the game gets more than a frame ahead and rewrites command lists Eden hasn't read yet. Upstream found the same thing in Splatoon Raiders. That fits Mario Kart World's single catch but isn't proven for it, since the probe didn't record the first wrong step.

Upstream's fixes for it (in this base):

• 0f14696044: when the GPU is behind at present, also wait for the presented frame.
• cce6d44af2: execute each command list as it was submitted (EDEN_NX2_PB_SNAPSHOT=0 turns this off).
• 6612817cb4: flush command lists the GPU writes (culling) before reading them.
• 8f1435f8db: read GPU-written command lists from copies instead of draining

Known gaps:

• A GPU-written command list is still read stale the first time its page is used, before the GPU thread has marked it.
• Upstream's lazy backing of render-target memory (6bc1ef08c2) uses the guest-locked mapping call from the old 4 s freeze stack again. It looks rare.

Testing

RTX 3070, eden-cli, scripted 9-minute Grand Prix sessions.

Rebased on ce1b1de6f1 builds clean. Two sessions at 1x and one at 4K, all with EDEN_NX2_PB_CHECK=1: no crash, freeze, garbage, semaphore wait over 2 s or driver error, and no guard fired. p99 frame time was 23.7 and 21.8 ms at 1x and 29.2 ms at 4K, and the worst frame was one 1.8 s hitch as a race loaded. About 0.8% of command entries change between submit and execution. Almost all of them are the 3- and 5-word GPU-written culling lists.. So the copy doesn't seem to drop commands the CPU writes late.

Another rebase on 6221409 gave these results:

p99 23.2 ms, worst frame 288 ms.
0.68% of entries changed after submit, the same culling lists.
Clean, and it quit normally.

On the earlier base 926e7ac6af, where upstream means the same base with only the diagnostics commit:

Fault injected (each real crash's values)	Upstream	This PR
Invalid syncpoint id	SEGV, same stack as the real crashes	Survives
Huge render target	GPU Xid 69, permanent freeze	60 fps
0x0 render target, 36232 layers	Abort	60 fps
Garbage render target address	SEGV	60 fps
Device address past the device space	SEGV within 32 hits	300 hits, 60 fps
Swapchain VK_INCOMPLETE	Abort	Survives
Swapchain recreation failing every retry	SEGV the first time	Recovered 3 of 3

9-minute sessions	Upstream	This PR
1x, 3 each	2 crashed (the race)	0 crashed during play
4K, 3 each (~7.1 GB VRAM budget)	All clean	All clean
Race forced by a second writer, 3 each	1 crashed	0 crashed

Qt is tested and ran.

Still open

• Whether garbage still happens on this base. If it never shows up in normal play, the guards never fire. The syncpoint and render target guards log when they do.
• The crash at quit: an assert in k_page_table_base.h. It's older than these changes and not fixed here.
• The late-course 4K stutter (VRAM thrash). It needs re-measuring on this base, because upstream now collects textures from 5 GiB.

Details are in NX2_NOTES.md rows 153-155.

Assisted-by: Claude Opus 5.5 (debugging, implementation, commit message, PR description)
Signed-off-by: @failaip12