This is the Switch equivalent of 3DS exheader. This is the file with extension ".npdm" in {Switch ExeFS}. The size of this file varies.

ACID

Offset	Size	Description
0	0x100	RSA-2048 signature, seems to verify the data starting at 0x100 with the size field from 0x204.
0x100	0x100	RSA-2048 public key, seems to be used for the second NCA signature.
0x200	0x4	Magic "ACID".
0x204	0x4	s32 Size field used with the above signature(?).
0x208	0x4	Zeroes
0x20C	0x4	Retail flag. Must be 1 on retail, on devunit 0 is also allowed.
0x210	0x8	Title id
0x218	0x8	Title id again
0x220	0x4	#FS Access Control offset
0x224	0x4	#FS Access Control size
0x228	0x4	#Service Access Control offset
0x22C	0x4	#Service Access Control size
0x230	4	#Kernel Access Control offset
0x234	4	#Kernel Access Control size
0x238	0x8	Padding

ACI0

Looks like an old crappy version of ACID. It has the guessed version field 0 instead of 1.

Word	Bit	Description
0		Version? Always 1.
1	0	MountContent* is accessible when set.
1	2	Enables access to Bis partitionID 27 and 28?

Web-applets access control:

"LibAppletWeb" and "LibAppletOff" have same access control: word0 bit0 set, word1 bit0 and bit3 set, and word2 bit30 set.
Rest of the web-applets: Same as above except word1 bit0 isn't set.

This is a list of service-name strings which the title has access to, with the following structure:

 +0: control_byte
 +1: {service-name without nul-terminator}

Bitmask 0x0F in control_byte is the {length of the service-name without nul-terminator} - 1.

Bitmask 0x80 in control_byte means service is allowed to be registered.

The service string can contain a wildcard * character.

On Switch, descriptors are identified by pattern 01..11 in low bits.

Pattern of lower bits	Type	Fields
`0bxxxxxxxxxxxx0111`	Kernel flags	Bit31-24: Highest allowed cpu id, bit23-16: Lowest allowed cpu id, bit15-10: Highest allowed thread prio, bit9-4: Lowest allowed thread prio
`0bxxxxxxxxxxx01111`	Syscall mask	Bits 29-31: Syscall mask table index; Bits 5-28: Mask
`0bxxxxxxxxxx011111`	?	Unknown. Requires two consecutive pairs of this descriptor type.
`0bxxxxxxxxx0111111`	Map IO page (RW)	Bits 7-31: Page
`0bxxxxxxxx01111111`	Map IO range	Bits 7-30: Alternating start page and number of pages, bit31: Alternating read-only flag then MemoryAttribute 0x2001/0x42002 selector flag
`0bxxxx011111111111`	Interrupt pair	Bits 12-21: Irq0, bits 20-31: Irq1, 0x3FF means empty.
`0xxxx0111111111111`
`0xxx01111111111111`
`0xx011111111111111`
`0x0111111111111111`
All ones	Ignored