BFM-decomp/docs/backlog.md

# Backlog — automation near-misses for hand-finishing

> Generated by `tools/backlog.py render` from `.run/backlog.jsonl`. These are functions the Phase-21 automation got **close** on but did NOT byte-match. The whole-binary byte-gate is the sole arbiter (G3/P9): **byte-matches bank and are NOT listed here** — only genuine near-misses/blockers are. Ranked by hand-session priority: **reach** (×N propagation leverage) → **closeness** (match_one mismatch count, lower = closer) → **size**. Each row's `best_draft` is the closest C the machine reached — resume from there.

**Open near-misses:** 242  ·  by status {'near': 177, 'failed': 65}  ·  by class {'WAVE': 20, 'plumbing': 42, 'other': 15, 'schedule': 47, 'loose-typing': 2, 'struct': 51, 'loop-guard': 2, 'regalloc-order': 49, 'remat': 3, 'iv-combine': 3, 'GIANT': 8}

| # | addr | reach | class | nins | status | closeness | where it stuck | best draft |
|--:|------|------:|-------|-----:|--------|----------:|----------------|------------|
| 1 | func_80174684 | 134 | WAVE | 8 | near | 0 | match_one MATCH but gate rejected (declaration/TU plumbing) | `.run/backlog_drafts/func_80174684.c` |
| 2 | func_8015BE94 | 134 | plumbing | 12 | near | 0 | none — MATCH | `.run/backlog_drafts/func_8015BE94.c` |
| 3 | func_801732C4 | 134 | other | 12 | near | 0 | none — MATCH (param survives first call → $s0; ghidra-C order is correct) | `.run/backlog_drafts/func_801732C4.c` |
| 4 | func_8017331C | 134 | plumbing | 12 | near | 0 | none — MATCH (param_1 saved to $s0 across first call, passed to second) | `.run/backlog_drafts/func_8017331C.c` |
| 5 | func_80173374 | 134 | plumbing | 12 | near | 0 | none — MATCH expected (param_1 lives across first call → naturally lands in $s0) | `.run/backlog_drafts/func_80173374.c` |
| 6 | func_80174554 | 134 | plumbing | 12 | near | 0 | none — MATCH (clean stub; param_1 reused in $a0 across first call, saved to $s0 for second) | `.run/backlog_drafts/func_80174554.c` |
| 7 | func_8014C568 | 134 | plumbing | 13 | near | 0 | none — MATCH expected; straightforward ratan2 wrapper with two s16 deltas & 0xFFF | `.run/backlog_drafts/func_8014C568.c` |
| 8 | func_80161208 | 134 | plumbing | 14 | near | 0 | none — MATCH expected (param saved across call → natural $s0, no pin needed) | `.run/backlog_drafts/func_80161208.c` |
| 9 | func_801542A4 | 134 | plumbing | 14 | near | 0 | none — MATCH expected (simple stub: field stores + tail call) | `.run/backlog_drafts/func_801542A4.c` |
| 10 | func_8016F0AC | 134 | plumbing | 14 | near | 0 | none — MATCH (expected; address CSE'd into $s0 across both calls) | `.run/backlog_drafts/func_8016F0AC.c` |
| 11 | func_801653B8 | 134 | plumbing | 15 | near | 0 | none — MATCH expected (simple call-crossing wrapper, param saved in $s0) | `.run/backlog_drafts/func_801653B8.c` |
| 12 | func_8016E778 | 134 | plumbing | 20 | near | 0 | none — MATCH (build-word spread + 3-halfword buffer, two stack addrs passed) | `.run/backlog_drafts/func_8016E778.c` |
| 13 | func_80172C50 | 134 | plumbing | 20 | near | 0 | none — MATCH (unaligned 8-byte memcpy + tail call) | `.run/backlog_drafts/func_80172C50.c` |
| 14 | func_8016BF50 | 134 | schedule | 22 | near | 0 | none — MATCH; short buf[3] keeps all 3 stores live + hoisting *(int*)(p+0x34) into a local | `.run/backlog_drafts/func_8016BF50.c` |
| 15 | func_80166244 | 134 | plumbing | 22 | near | 0 | none — MATCH expected (single tail-call STUB) | `.run/backlog_drafts/func_80166244.c` |
| 16 | func_80146C3C | 134 | loose-typing | 23 | near | 0 | none — MATCH | `.run/backlog_drafts/func_80146C3C.c` |
| 17 | func_80162CCC | 134 | plumbing | 23 | near | 0 | none — MATCH expected; direct translation, psVar1 as u16* gives lhu, $s0=param_1 survives both calls | `.run/backlog_drafts/func_80162CCC.c` |
| 18 | func_801733FC | 134 | struct | 25 | near | 0 | none — modeled on sibling func_80173460 (packed 8-byte struct copy + two s16=1 stores) | `.run/backlog_drafts/func_801733FC.c` |
| 19 | func_80160F00 | 134 | plumbing | 28 | near | 0 | none — MATCH (straight-line STUB; $s0 holds param_1 across calls naturally) | `.run/backlog_drafts/func_80160F00.c` |
| 20 | func_801661CC | 134 | loop-guard | 30 | near | 0 | none — MATCH (branch-polarity §3-T4: beqz fall-through = func_80146C3C arm; if(!=0){func_80146C3C}else{func_800D22E4;shifts}) | `.run/backlog_drafts/func_801661CC.c` |
| 21 | func_8015ADB0 | 134 | plumbing | 31 | near | 0 | none — MATCH (simple straight-line: clamp byte field, 4 calls in order, global OR) | `.run/backlog_drafts/func_8015ADB0.c` |
| 22 | func_8014A51C | 134 | schedule | 32 | near | 0 | none — MATCH (32 ins, relocation-masked) | `.run/backlog_drafts/func_8014A51C.c` |
| 23 | func_801495C4 | 134 | regalloc-order | 34 | near | 0 | none — MATCH expected (cloned byte-matched sibling func_8014964C recipe: $16 pin + asm barriers force param_2→$s0 and rematerialize &in/&mid/mtx) | `.run/backlog_drafts/func_801495C4.c` |
| 24 | func_80151664 | 134 | plumbing | 35 | near | 0 | none — MATCH (35 ins, relocation-masked); canonical externs kept, call-site casts only | `.run/backlog_drafts/func_80151664.c` |
| 25 | func_801522CC | 134 | plumbing | 41 | near | 0 | TBD — first compile; func_80153C18 canonical is (void) but target sets $a0=$s0 in its delay slot (call-site cast) | `.run/backlog_drafts/func_801522CC.c` |
| 26 | func_801497A8 | 134 | regalloc-order | 47 | near | 0 | none — MATCH. $s1 pinned to D_80078E78 base; result accumulator + masked | `.run/backlog_drafts/func_801497A8.c` |
| 27 | func_801483E8 | 134 | struct | 50 | near | 0 | none — MATCH | `.run/backlog_drafts/func_801483E8.c` |
| 28 | func_8015F380 | 134 | plumbing | 50 | near | 0 | none — expect MATCH (single call-crossing local pinned to $s0) | `.run/backlog_drafts/func_8015F380.c` |
| 29 | func_8016EFC8 | 134 | schedule | 51 | near | 0 | none — MATCH (51 ins). Temp `u32 v = *a0 / 0x4000000;` hoists the load to ins 0 and | `.run/backlog_drafts/func_8016EFC8.c` |
| 30 | func_80156ECC | 134 | plumbing | 55 | near | 0 | none — MATCH (clean reconstruction; 3 call-crossing structs in s1/s2/s4, lh/lhu pair) | `.run/backlog_drafts/func_80156ECC.c` |
| 31 | func_801758FC | 134 | schedule | 55 | near | 0 | none — MATCH (55 ins) | `.run/backlog_drafts/func_801758FC.c` |
| 32 | func_801759D8 | 134 | schedule | 56 | near | 0 | none — MATCH (56 ins) | `.run/backlog_drafts/func_801759D8.c` |
| 33 | func_80133298 | 134 | struct | 65 | near | 0 | none — MATCH (65 ins, relocation-masked) | `.run/backlog_drafts/func_80133298.c` |
| 34 | func_80147E44 | 134 | regalloc-order | 67 | near | 0 | none -- MATCH (67 ins). $s1/$s0/$s3/$s2 pins ($17/$16/$19/$18) + 3-pointer reload | `.run/backlog_drafts/func_80147E44.c` |
| 35 | func_80164418 | 134 | struct | 70 | near | 0 | none — MATCH (s16 stack array forces the spill; 2nd ratan2 reuses /dy/ in $a1) | `.run/backlog_drafts/func_80164418.c` |
| 36 | func_8012E014 | 134 | other | 73 | near | 0 | none — MATCH (expected; straightforward struct-field + global-copy body) | `.run/backlog_drafts/func_8012E014.c` |
| 37 | func_8012E138 | 134 | regalloc-order | 81 | near | 0 | none — MATCH (81/81 ins, match_one proxy); reloaded ptr pinned to $a0 | `.run/backlog_drafts/func_8012E138.c` |
| 38 | func_8012B4B8 | 134 | regalloc-order | 84 | near | 0 | none — MATCH | `.run/backlog_drafts/func_8012B4B8.c` |
| 39 | func_80166054 | 134 | regalloc-order | 94 | near | 0 | none — MATCH (94 ins). Pins: param_1->$s2, angle->$s0, shift->$s1, r0->$s3, | `.run/backlog_drafts/func_80166054.c` |
| 40 | func_801379FC | 134 | regalloc-order | 97 | near | 0 | none — MATCH (match_one 97/97) | `.run/backlog_drafts/func_801379FC.c` |
| 41 | func_801463A0 | 134 | struct | 101 | near | 0 | none — MATCH (101 ins, match_one); real symbol names; misaligned 8B copy + s16 stores + masked B9C last | `.run/backlog_drafts/func_801463A0.c` |
| 42 | func_80167714 | 134 | regalloc-order | 104 | near | 0 | none — MATCH (104 ins) | `.run/backlog_drafts/func_80167714.c` |
| 43 | func_80169228 | 134 | regalloc-order | 105 | near | 0 | none — MATCH (105 ins, relocation-masked). Key levers: arg0/p pinned $s1/$s0, | `.run/backlog_drafts/func_80169228.c` |
| 44 | func_8012CC88 | 134 | struct | 105 | near | 0 | none — MATCH (105 ins, relocation-masked) | `.run/backlog_drafts/func_8012CC88.c` |
| 45 | func_80174CB0 | 134 | regalloc-order | 123 | near | 0 | none — MATCH (match_one 123/123). Levers: (1) §21 one combined stack struct {s32 a[5]; ...} | `.run/backlog_drafts/func_80174CB0.c` |
| 46 | func_80178004 | 134 | regalloc-order | 165 | near | 0 | none — MATCH (full register pins per sibling func_80177EA4; running-ptr $s2 to stop unroll-rebase; | `.run/backlog_drafts/func_80178004.c` |
| 47 | func_80163C2C | 134 | regalloc-order | 167 | near | 0 | none — MATCH (167 ins) | `.run/backlog_drafts/func_80163C2C.c` |
| 48 | func_8015126C | 134 | regalloc-order | 254 | near | 0 | none — MATCH (254 ins, relocation-masked) | `.run/backlog_drafts/func_8015126C.c` |
| 49 | func_8016F0E4 | 134 | plumbing | 26 | near | 1 | none — MATCH (26 ins); natural C form, param_1 auto-allocated to $s0 | `.run/backlog_drafts/func_8016F0E4.c` |
| 50 | func_8014F3E8 | 134 | WAVE | 32 | near | 1 | WAVE: 1 mismatch | `.run/backlog_drafts/func_8014F3E8.c` |
| 51 | func_80177AD4 | 134 | regalloc-order | 34 | near | 1 | 1 ins — loop-bound shift reads loop-carried $a3 (sll v0,a3,16) vs target's dying copy $v0 (sll v0,v0,16); gcc CSE canonicalizes the two equal-valued regs to the loop-carried one. IV-combine (§20) CRACKED via $a2/$a3 pins (was 31-mismatch "stub"). | `.run/backlog_drafts/func_80177AD4.c` |
| 52 | func_801775E0 | 134 | regalloc-order | 67 | near | 1 | 1 ins — target `sb $v0,0x6($s0)` vs mine `sb $v0,26($s1)` (same store P1+0x1a; gcc address-CSE picks $s1 base not the recomputed $s0); all else byte-identical | `.run/backlog_drafts/func_801775E0.c` |
| 53 | func_8014FFDC | 134 | struct | 93 | near | 1 | none — MATCH | `.run/backlog_drafts/func_8014FFDC.c` |
| 54 | func_80158638 | 134 | plumbing | 87 | near | 2 | none — MATCH (proxy); callee externs are plain func_<addr>, gate's canon/cast passes own them | `.run/backlog_drafts/func_80158638.c` |
| 55 | func_80171FFC | 134 | regalloc-order | 40 | near | 3 | none — MATCH (40 ins). Key: func_8017248C takes (a0,a1); calling it with | `.run/backlog_drafts/func_80171FFC.c` |
| 56 | func_801466F0 | 134 | plumbing | 24 | near | 4 | none — MATCH (struct param-spill + branch-polarity) | `.run/backlog_drafts/func_801466F0.c` |
| 57 | func_80147364 | 134 | remat | 30 | near | 4 | none — MATCH (30 ins). Lever: hoist &D_80126B58 into a local ptr `u8 *p=&D_80126B58;` so gcc | `.run/backlog_drafts/func_80147364.c` |
| 58 | func_801325B8 | 134 | schedule | 113 | near | 4 | 4/113 — prologue save-order of the $s0(cur/p3) vs $s5(p1) pair; gcc emits | `.run/backlog_drafts/func_801325B8.c` |
| 59 | func_80146A6C | 134 | struct | 18 | near | 5 | none — MATCH | `.run/backlog_drafts/func_80146A6C.c` |
| 60 | func_80140D68 | 134 | schedule | 65 | near | 5 | 5-ins near-miss — gcc hoists `lui 0xff00` (the 0xFF000000 mask) one slot too early in the first AddPrim block, so the D_800B9A02 index value lands in $v1 instead of $a1 and *param_1 is read late (idx 35-43). Structure + regs otherwise byte-exact (frame eliminated via struct-array D_800AE7BC, &D_800B9A02 held in $a2 via the pB $6 pin, param_1+8 grouping fixes the rest). Pure sched1 list-order residual -> permuter candidate (try reg-hint + reorder around the lui 0xff00 / lw 0($a0) pair). | `.run/backlog_drafts/func_80140D68.c` |
| 61 | func_80130C08 | 134 | schedule | 65 | near | 5 | tail shares one jal func_80131CA8 between the a1=5 and a1=0x38 arms via `j .L80130CEC` with a DUPLICATED `move a0,s0` (one in the beqz delay slot, one at jump-in label .L80130CDC); goto-merge form collapses to 64 ins (one move dropped), if-else form keeps 65 ins but emits two separate jals (idx 54-56 differ + the recheck branch inverts bnez/beqz at idx 51). 5 mismatched, count correct. | `.run/backlog_drafts/func_80130C08.c` |
| 62 | func_80175820 | 134 | schedule | 55 | near | 6 | body byte-IDENTICAL; only residual is the phantom 0x10 leaf frame — target schedules `addiu $sp,-0x10` into the load-delay slot at insn 26 (after the D_8011F7C0 load) and `addiu $sp,0x10` before `jr ra`. With the frame forced (reserved local + anchor) gcc emits the prologue adjust at insn 0 instead of the delay slot (§5 frame-scheduling class); pins block the permuter, no C lever found to move it. Frameless form left here = body byte-exact, 2 frame insns short. | `.run/backlog_drafts/func_80175820.c` |
| 63 | func_8016130C | 134 | WAVE | 26 | near | 9 | WAVE: 9 mismatch | `.run/backlog_drafts/func_8016130C.c` |
| 64 | func_80161374 | 134 | schedule | 41 | near | 10 | none — MATCH (41/41 relocation-masked) | `.run/backlog_drafts/func_80161374.c` |
| 65 | func_80163764 | 134 | regalloc-order | 42 | near | 10 | none — MATCH (42 ins). pins $s2/$s1/$s0/$s3 + u32 counter (sltiu) + init order s2,s3,i,p | `.run/backlog_drafts/func_80163764.c` |
| 66 | func_80149374 | 134 | remat | 23 | near | 11 | gcc -O2 CSEs &sp18 into freed callee-saved $s0 (1 addu + 2 move); target rematerializes addiu $sp,0x18 twice. Single-buffer straight-line address reused across 2 calls -> CSE wins; no clean C (cast/type/union/ptr-var/$8-pin) flips it; two-distinct-locals remats but grows frame +8 (gcc-2.7.2 won't coalesce slots back to 0x18). Frame/regs/params all match; only this 1 insn differs. | `.run/backlog_drafts/func_80149374.c` |
| 67 | func_80150528 | 134 | schedule | 53 | near | 12 | none — MATCH (53 ins). Modeled on banked sibling DEFINE_func_80163950 (same D_801202A0 stride-0x10C loop + func_80135A4C call); single-pointer for-loop reproduces gcc's two-IV (p, p+0x20) schedule exactly. NB: §20 had flagged this "unsteerable" pre-sibling-exemplar. | `.run/backlog_drafts/func_80150528.c` |
| 68 | func_80146AFC | 134 | schedule | 40 | near | 13 | none — MATCH | `.run/backlog_drafts/func_80146AFC.c` |
| 69 | func_80137178 | 134 | schedule | 78 | near | 15 | reg values all correct; prologue independent-addiu order + lazy sw placement differ | `.run/backlog_drafts/func_80137178.c` |
| 70 | func_8015C030 | 134 | WAVE | 23 | near | 17 | WAVE: 17 mismatch | `.run/backlog_drafts/func_8015C030.c` |
| 71 | func_8014ADE0 | 134 | schedule | 139 | near | 19 | 16 ins off — all compiler-internal ties: (1) 0xAAA8 const lands $v0 vs target $v1; | `.run/backlog_drafts/func_8014ADE0.c` |
| 72 | func_8016191C | 134 | plumbing | 24 | near | 20 | none — MATCH (24 ins). early-return-per-arm: each arm sets $v0 directly + j-tail merges | `.run/backlog_drafts/func_8016191C.c` |
| 73 | func_8014FE60 | 134 | regalloc-order | 95 | near | 20 | none — MATCH (permuter closed the final bothzero-block regalloc/schedule residual: moving `a = in[2]` before the +0x7E read-modify-write flips the 0x7FFF constant into $v1 and computes return-0 in $v0) | `.run/backlog_drafts/func_8014FE60.c` |
| 74 | func_8017248C | 134 | WAVE | 24 | near | 23 | WAVE: 23 mismatch | `.run/backlog_drafts/func_8017248C.c` |
| 75 | func_8014E5B4 | 134 | regalloc-order | 59 | near | 23 | none — MATCH | `.run/backlog_drafts/func_8014E5B4.c` |
| 76 | func_80141B90 | 134 | struct | 29 | near | 24 | none — MATCH (29 ins); array-of-int %lo-fold + call + u16 if-block; volatile-double reserves the target's 8-byte frame slot | `.run/backlog_drafts/func_80141B90.c` |
| 77 | func_80136F3C | 134 | regalloc-order | 61 | near | 24 | 24 pure regalloc-order swaps — identical ins count + every opcode/immediate matches; only $sN indices differ. gcc coalesces param a0 with a0+3 (s0) / a1 with a1+3 (s1); target coalesces a0 with a0-3 (s1) / a1 with a1+3 (s2), base in s3 not s2. Coalescing choice not forceable from clean C (s16 register-pins suppress the sign-ext but reschedule the prologue). Permuter-tractable (register-swap passes). | `.run/backlog_drafts/func_80136F3C.c` |
| 78 | func_801719A4 | 134 | struct | 24 | near | 25 | none — MATCH (24 ins, relocation-masked) | `.run/backlog_drafts/func_801719A4.c` |
| 79 | func_8016706C | 134 | WAVE | 30 | near | 27 | WAVE: 27 mismatch | `.run/backlog_drafts/func_8016706C.c` |
| 80 | func_8014D2A0 | 134 | other | 80 | near | 27 | none — MATCH (80 ins, relocation-masked); loop-guard idiom per engine_core DEFINE_func_80164ACC | `.run/backlog_drafts/func_8014D2A0.c` |
| 81 | func_801777BC | 134 | schedule | 59 | near | 29 | body byte-matches; residual ~3 ins = prologue instruction-scheduling (final `sll t8,16` / `lw param_7` / `addu t0,a0,0xC` ordering around the blez guard) + the loop-counter copy `addu t3,v0` — pure gcc sched/regalloc tie-break, permuter-blocked by the register __asm__ pins | `.run/backlog_drafts/func_801777BC.c` |
| 82 | func_80161888 | 134 | schedule | 37 | near | 30 | none — MATCH (proxy verified) | `.run/backlog_drafts/func_80161888.c` |
| 83 | func_80144B14 | 134 | schedule | 34 | near | 31 | none — MATCH (34 ins). Two stack structs (s16[3] each) passed by addr to | `.run/backlog_drafts/func_80144B14.c` |
| 84 | func_801778A8 | 134 | iv-combine | 38 | near | 38 | gcc spawns 2 IVs (byte giv @+0xc, halfword RMW giv @+0xa); target combines both into ONE IV at +0xc reaching the halfword at -2($a3). A struct collapses to 1 IV but anchors at the struct base (+0xa) not +0xc; raw byte+halfword RMW never combines. Same combine_givs-refuses-halfword-RMW wall as sibling func_80177AD4 (§20, stubbed). Floor 33-off; not source-steerable (combine runs pre-regalloc, pins/order don't move it). | `.run/backlog_drafts/func_801778A8.c` |
| 85 | func_8012A1BC | 134 | schedule | 78 | near | 42 | 42/78 — block-copy bytes correct (char[8] => lwl/lwr/swl/swr); residual is gcc's load-hoist split. Target hoists all 9 non-block scalar loads to the top then stores 4, blk, blk, then late-stores the rest; a "memory" barrier is needed to stop the block copy hoisting+spilling but it also pins the 5 late scalars' stores too early. No single source/barrier shape reproduces "loads cross the block copy but the copy itself does not" — permuter/schedule residual. | `.run/backlog_drafts/func_8012A1BC.c` |
| 86 | func_80176144 | 134 | regalloc-order | 53 | near | 50 | none — MATCH | `.run/backlog_drafts/func_80176144.c` |
| 87 | func_8016163C | 134 | plumbing | 78 | near | 50 | none — MATCH (78 ins). First arm calls func_801599A4 with NO arg (asm nop delay slot) via fn-ptr cast ((void(*)(void))func_801599A4)(). | `.run/backlog_drafts/func_8016163C.c` |
| 88 | func_801387B8 | 134 | regalloc-order | 100 | near | 50 | the two scanned bytes land in $a0/$a1 not $a1/$a2 (gcc-2.7.2 grabs the freed incoming-arg $a0 for the first load; a $5 register-asm pin is NOT honored on a load-defined arg-class reg, a $6 pin IS — kept pin-free so the permuter can grind it, costing +1) + gcc basic-block layout of the case-7/case-10/default handlers differs; control-flow semantics correct, 50 mismatch | `.run/backlog_drafts/func_801387B8.c` |
| 89 | func_8014F2E0 | 134 | schedule | 66 | near | 51 | §10 IV-init placement (piVar3 setup not sunk past loop guard) + store-vs-load (D_801150D8=0 schedules between the two arg-loads) — both CONFIRMED-unsteerable per cookbook §20; 11-off | `.run/backlog_drafts/func_8014F2E0.c` |
| 90 | func_80161774 | 134 | plumbing | 69 | near | 53 | none — MATCH (69 ins, match_one verified; clean nested-if; param_1 -> $s0 call-crossing) | `.run/backlog_drafts/func_80161774.c` |
| 91 | func_80176D94 | 134 | schedule | 152 | near | 63 | 63/152 — frame+prologue+4 calls+2x(801783D0/801777BC) MATCH (pins $s0=uVar2/$s2=param_2 + CSE-break barrier); residual is GIANT store-block caller-saved temp COLORING ($a2/$a3/$a0/$v1 vs target $t0/$t1/$t2/$a2) + micro-schedule (~70-ins straight line) + 4 delay-slot fills (li a1,4 vs s0-capture). structurally complete, count-exact → permuter/grinder territory. | `.run/backlog_drafts/func_80176D94.c` |
| 92 | func_80177940 | 134 | iv-combine | 101 | near | 65 | prologue+setup (35 ins) byte-match exactly; loop body diverges on gcc loop-invariant hoist ORDERING (scheduler tie-break), the conditional 0x74808080 recompute-vs-hoist, and the tail IV final-value double-move (addu s3,a0,zero; addu v0,s3,zero) + pd+=5 increment placement -- same loop-IV-combine class S20 flags as stub for sibling func_80177AD4. | `.run/backlog_drafts/func_80177940.c` |
| 93 | func_801770E0 | 134 | schedule | 152 | near | 66 | instr-count exact (152); residual = straight-line back-half scheduling + const temp-reg allocation ($t0/$t1/$t2 vs $v1/$a2/$a3) + a 2-ins prologue save-vs-sll swap. register pins ($s2/$s1/$s0) + CSE-break barrier are load-bearing (without pins 133+); permuter blocked by the register __asm__ pins (§10/§17 hard tail). | `.run/backlog_drafts/func_801770E0.c` |
| 94 | func_8014DD8C | 134 | WAVE | 108 | near | 83 | WAVE: 83 mismatch | `.run/backlog_drafts/func_8014DD8C.c` |
| 95 | func_80148094 | 134 | regalloc-order | 213 | near | 107 | ~39/213 residual (LCS), all in the sVar1>=0x201 clamp blocks: $v0/$v1 mflo regalloc swap + coupled branch-polarity/join-placement (bnez<->beqz) + 2 delay-slot fills (addiu s1,v0,0x400 into 80013F3C slot; sll s1,16 in-place into 2nd ratan2 slot) + early_ret a2-vs-s5 -> permuter/grinder territory | `.run/backlog_drafts/func_80148094.c` |
| 96 | func_80137DD4 | 134 | regalloc-order | 129 | near | 112 | opcodes/structure line-for-line correct, but gcc permutes the 6 saved regs vs target | `.run/backlog_drafts/func_80137DD4.c` |
| 97 | func_8014EA4C | 134 | loop-guard | 183 | near | 142 | body byte-identical; residual is the §20 IV-final-value loop guard — target emits an | `.run/backlog_drafts/func_8014EA4C.c` |
| 98 | func_801412A8 | 134 | regalloc-order | 198 | near | 154 | 154-mismatch near-miss (198/198 ins, structure+branches exact). Two irreducible gcc residuals: (1) HEAD: held &D_800B9A02 ptr must be init-at-decl to stay in a reg across all 4 prims (correct 198-ins), but that forces gcc to materialize the address at fn entry (2 ins before the branches) vs target's in-body materialization -> shifts the head regalloc cascade; in-body assign re-materializes per-use (172 ins, wrong count) even with the $9 pin. (2) BODY: gcc OFFSET-FOLDS the 4x-unrolled prim stores (p[0..3], p+=4 -> sw at 16/20/24/28 from a fixed base) instead of ADVANCING $t6 (addiu $t6,0x10; sw at 0/4/8/12) like the target; no C form (post-inc, char* advance, =r/0 barrier, r-only barrier) triggers the register-advance. Pins landed p1->$t6/uVar4->$t0/iVar1->$a0/pidx->$t1 (head 0-1,8,14,16-19 exact). | `.run/backlog_drafts/func_801412A8.c` |
| 99 | func_801571C4 | 134 | schedule | 198 | near | 183 | prologue instruction SCHEDULE + frame-layout residual. Body + loop are byte-exact and | `.run/backlog_drafts/func_801571C4.c` |
| 100 | func_8014EE14 | 134 | schedule | 248 | near | 205 | body structurally matched (97 reloc-masked, mostly +1-offset branch artifacts). 3 real residuals, | `.run/backlog_drafts/func_8014EE14.c` |
| 101 | func_801745AC | 134 | plumbing | 12 | failed |  | none — MATCH (stub: param saved in $s0 across first call, passed to second) | `.run/backlog_drafts/func_801745AC.c` |
| 102 | func_801705C0 | 134 | WAVE | 14 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_801705C0.c` |
| 103 | func_8016B91C | 134 | WAVE | 18 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_8016B91C.c` |
| 104 | func_80156600 | 134 | other | 18 | failed |  | none — MATCH (simple counted scan, do-while form per Ghidra-C) | `.run/backlog_drafts/func_80156600.c` |
| 105 | func_801718AC | 134 | WAVE | 22 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_801718AC.c` |
| 106 | func_80168B70 | 134 | WAVE | 27 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_80168B70.c` |
| 107 | func_8016BA68 | 134 | plumbing | 29 | failed |  | none — MATCH (29 ins, straight-line; lh narrow loads at call site) | `.run/backlog_drafts/func_8016BA68.c` |
| 108 | func_801494CC | 134 | WAVE | 30 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_801494CC.c` |
| 109 | func_801708B0 | 134 | WAVE | 30 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_801708B0.c` |
| 110 | func_80170CF0 | 134 | schedule | 30 | failed |  | 4-ins PROLOGUE-ORDER residual (body insns 4-29 byte-identical). My cc1 hoists the funcptr lui/lw ABOVE the frame setup (lui,lw,addiu sp,sw s0); target keeps frame setup first (addiu sp,sw s0,lui,lw). Same prologue-order class as func_80177F84 (cookbook L1332) — no C lever found (intermediate var/cast/void*-vs-funcptr/pin/early-ptr all reproduce the hoist; barriers/empty-asm/volatile-local regress). KEY WIN: `case 0: break;` forces emit_case_nodes' slti<2;bnez→default lower-bound prune, exactly matching the target dispatch tree (a bare 2-case switch omits it). | `.run/backlog_drafts/func_80170CF0.c` |
| 111 | func_80149450 | 134 | WAVE | 31 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_80149450.c` |
| 112 | func_80149F2C | 134 | WAVE | 31 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_80149F2C.c` |
| 113 | func_80161A90 | 134 | other | 34 | failed |  | none — MATCH (34 ins) at the overlay's STANDARD -O2 (match_one reports MATCH). NO -O1 split needed. | `.run/backlog_drafts/func_80161A90.c` |
| 114 | func_80152C80 | 134 | plumbing | 41 | failed |  | none — MATCH expected (linear call/store sequence, no regalloc tension) | `.run/backlog_drafts/func_80152C80.c` |
| 115 | func_80173BC0 | 134 | plumbing | 41 | failed |  | none — MATCH. Keys: invert mask branch (else-block = 80174650 path so func_8013E588 | `.run/backlog_drafts/func_80173BC0.c` |
| 116 | func_8014C1C8 | 134 | regalloc-order | 44 | failed |  | none — MATCH (match_one 44/44 ins, relocation-masked) | `.run/backlog_drafts/func_8014C1C8.c` |
| 117 | func_80146750 | 134 | regalloc-order | 47 | failed |  | none — MATCH (match_one 47/47; psVar4->$a3 / psVar3->$v1 pins forced the init order) | `.run/backlog_drafts/func_80146750.c` |
| 118 | func_8014680C | 134 | struct | 47 | failed |  | none — MATCH (47 ins, relocation-masked) | `.run/backlog_drafts/func_8014680C.c` |
| 119 | func_8014C4AC | 134 | other | 47 | failed |  | none — MATCH (shared-ret0 goto §16 flips final branch polarity + schedules ret=0 into delay slot; memcpy(t0+0x7C,a3,8) inlines the lwl/lwr/swl/swr 8-byte block §21; param_1 = unsigned short* for the lhu reads) | `.run/backlog_drafts/func_8014C4AC.c` |
| 120 | func_80151B98 | 134 | regalloc-order | 47 | failed |  | none — MATCH | `.run/backlog_drafts/func_80151B98.c` |
| 121 | func_80147F78 | 134 | schedule | 48 | failed |  | TWO residuals remain. (1) FRAME: target frame is 0x60 = exactly 64 bytes (16 words) of LIVE local vars on top of the 4 saved regs (s0,s1,s2,ra) + 0x10 arg area; my body has no locals so frame is 0x20. Reproducing 64B of live local needs an address-escaped local buffer, but the target has only the 3 visible jals (no 4th call to receive &buf), so I cannot make a 16-word local survive -O2 dead-store-elim without emitting an extra instruction. (2) RELOAD SCHEDULE: target reloads D_80127090/94/98 from memory (folded lui%hi;lw%lo) with the FIRST reload HOISTED up between store90 and store94 (free non-volatile scheduling); a "memory" clobber barrier (below) forces the folded reloads but pins them strictly AFTER all three stores. The natural source is almost certainly a 16-word local buffer that ALIASES the globals (non-volatile reloads, freely scheduled) — same construct that also explains the 0x60 frame. Closest faithful body kept below; folded reload bytes are correct, frame + hoist are the gap. | `.run/backlog_drafts/func_80147F78.c` |
| 122 | func_80151C54 | 134 | plumbing | 52 | failed |  | none — MATCH (52 ins). Branch-polarity §3-T4: BD60 arm is fall-through (if !=1 && ==0x11), BC44 is else. | `.run/backlog_drafts/func_80151C54.c` |
| 123 | func_8017129C | 134 | struct | 58 | failed |  | none — MATCH (58 ins); three aligned 16-byte block-copies via struct assignment (cookbook §21) | `.run/backlog_drafts/func_8017129C.c` |
| 124 | func_80173A60 | 134 | regalloc-order | 59 | failed |  | none — MATCH (59 ins) | `.run/backlog_drafts/func_80173A60.c` |
| 125 | func_8014A738 | 134 | regalloc-order | 62 | failed |  | none — MATCH | `.run/backlog_drafts/func_8014A738.c` |
| 126 | func_80175308 | 134 | struct | 67 | failed |  | none — MATCH (67 ins, relocation-masked) | `.run/backlog_drafts/func_80175308.c` |
| 127 | func_80132F40 | 134 | regalloc-order | 72 | failed |  | gcc gives src (sp+0x10) a 5th saved reg ($s3, frame 0x38 not 0x40); target rematerializes | `.run/backlog_drafts/func_80132F40.c` |
| 128 | func_8014D610 | 134 | plumbing | 74 | failed |  | none — MATCH (74 ins). for-loop + continue, single IV pointer p; gcc derives the $s0 = p+0x75 second induction var. Template: DEFINE_func_80163950 (sibling, same D_801202A0 loop + func_80135A4C). | `.run/backlog_drafts/func_8014D610.c` |
| 129 | func_80163534 | 134 | schedule | 76 | failed |  | mismatch=13, a single 1-position scheduling tie. Instrs 1-30 byte-perfect; all registers correct | `.run/backlog_drafts/func_80163534.c` |
| 130 | func_8014CF04 | 134 | struct | 82 | failed |  | none — MATCH (82 ins; array-of-struct scan, for-loop over Ent D_801202A0[96], stride 0x10C) | `.run/backlog_drafts/func_8014CF04.c` |
| 131 | func_80156670 | 134 | schedule | 83 | failed |  | none — MATCH (83 ins). Key: hoist `iVar1 = uVar3*4;` as its OWN statement before the if so gcc schedules `sll v1,s1,2` into the bnez delay slot (computed unconditionally) and reuses v1 index-first (`iVar1 + (s32)&D_801150E0` → `addu v0,v1,v0`). 13-arg call to func_80157158 (a0-a3 + 9 stack args at 0x10..0x30); param_2/param_3 cast (u16) → andi; param_6 incoming as lhu(u16). Address args = integer math `iVar2 + (s32)&D_x` (index-first → lui;addiu;addu, index added first). | `.run/backlog_drafts/func_80156670.c` |
| 132 | func_8014D4C0 | 134 | schedule | 84 | failed |  | none — MATCH (goto forces if-body out-of-line/last; `>=` fixes slt operand order) | `.run/backlog_drafts/func_8014D4C0.c` |
| 133 | func_8016A73C | 134 | struct | 85 | failed |  | none — MATCH (85 ins, relocation-masked) | `.run/backlog_drafts/func_8016A73C.c` |
| 134 | func_80173CB4 | 134 | schedule | 90 | failed |  | none — MATCH (switch form keeps cases unmerged; final block: reuse one temp for the D_8012750C test + the func_8013767C result -> $a0 alloc; invert if to !=0 for branch polarity + store order) | `.run/backlog_drafts/func_80173CB4.c` |
| 135 | func_8014C6F4 | 134 | regalloc-order | 91 | failed |  | 19-off loop tie-break — target compiles the search as a while/for (pre-guard sltu;beqz present) with the found pointer snapshotted to $v0 split from the IV in $a0 and the +4 sunk into both call-arg delay slots; do-while is instruction-count-exact (91=91) but lacks the pre-guard, while every for/while form costs +4 ins (merge stays in $a0). §10 schedule/regalloc residual. | `.run/backlog_drafts/func_8014C6F4.c` |
| 136 | func_8014D12C | 134 | schedule | 93 | failed |  | none — MATCH (93 ins). Block-order lever: success-continuation (return 1) | `.run/backlog_drafts/func_8014D12C.c` |
| 137 | func_801502EC | 134 | schedule | 93 | failed |  | none — MATCH (93 ins). 8-byte block copy via alignment-1 struct (Blk8{u8 b[8]}) assignment reproduces the lwl/lwr/swl/swr; ret=0 hoisted before the block copy to fix the s3-vs-ra prologue save order. | `.run/backlog_drafts/func_801502EC.c` |
| 138 | func_80150170 | 134 | struct | 95 | failed |  | none — MATCH (95/95). Keys: (1) two parallel 3-halfword groups via chained assign `sp10.x = sp18.x = v` (sp18 inner so 0x18 stores first); (2) align-1 blk8 struct copy for the lwl/lwr/swl/swr 8-byte copy into actor+0x80 (src = sp buf from func_801502EC, or u8[] D_801152A8); (3) f0/f2 = u16 (lhu), f1 = s16 (lh for the slt); (4) `(iVar5/iVar6)!=0` single-OR test + branch-polarity invert (not-both-zero is fall-through); (5) both-zero tail register pins: 0x7fff -> $v1 (`register s32 __asm__("$3")`), sp10.f0/f2 -> reused $a0 (`register u32 __asm__("$4")` written twice) to force gcc's hoist-load + reg reuse schedule. | `.run/backlog_drafts/func_80150170.c` |
| 139 | func_8014CD80 | 134 | regalloc-order | 97 | failed |  | none — MATCH (97 ins). iVar3 pinned to $v1 (register __asm__("$3")) so | `.run/backlog_drafts/func_8014CD80.c` |
| 140 | func_8014E284 | 134 | WAVE | 108 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_8014E284.c` |
| 141 | func_80167540 | 134 | WAVE | 117 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_80167540.c` |
| 142 | func_8014F4C0 | 134 | WAVE | 141 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_8014F4C0.c` |
| 143 | func_8014E048 | 134 | WAVE | 143 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_8014E048.c` |
| 144 | func_80155800 | 134 | WAVE | 145 | failed |  | won't compile standalone (loose-typing / missing decl) | `.run/backlog_drafts/func_80155800.c` |
| 145 | func_80144090 | 134 | schedule | 154 | failed |  | corner-block store/CSE schedule — gcc groups P+2/P-2 (share s>>6) vs target alternates P+2,P+4,P-2,P+0; plus otz*4 (sll $a0,$s5,2) scheduled late not into the D_800B9A02-load delay slot. Structure/regalloc all match (pins+array-of-struct %lo-fold+branch-polarity+mult-grouping landed; 144->52). Residual is §10 schedule tie-break, not source-steerable. | `.run/backlog_drafts/func_80144090.c` |
| 146 | func_80138ED0 | 134 | GIANT | 159 | failed |  | won't compile standalone (loose-typing / missing decl) |  |
| 147 | func_8014F74C | 134 | other | 174 | failed |  | none — MATCH (174 ins). Keys: sibling func_8014FA70 template; in/out/sp20 u8[8] short-trio bufs (lwl/lwr/swl/swr unaligned copies); load each a0 field once into b0/b1/b2 (stored to both sp20+out, reused in the 0x146-add block); 3-way memcpy branch on s1 (0x2000->D_801152A8, 0x4000->D_801152B0, else->D_800D3918); goto-form cmp-chain; final `""::: "memory"` barrier blocks gcc store-flag fold of (in4==out4)<<15 back to a branch | `.run/backlog_drafts/func_8014F74C.c` |
| 148 | func_8012EC04 | 134 | GIANT | 178 | failed |  | won't compile standalone (loose-typing / missing decl) |  |
| 149 | func_801392FC | 134 | GIANT | 182 | failed |  | won't compile standalone (loose-typing / missing decl) |  |
| 150 | func_8013AF20 | 134 | GIANT | 185 | failed |  | won't compile standalone (loose-typing / missing decl) |  |
| 151 | func_8012D098 | 134 | GIANT | 189 | failed |  | won't compile standalone (loose-typing / missing decl) |  |
| 152 | func_80129CF8 | 134 | GIANT | 191 | failed |  | won't compile standalone (loose-typing / missing decl) |  |
| 153 | func_8013A530 | 134 | GIANT | 204 | failed |  | won't compile standalone (loose-typing / missing decl) |  |
| 154 | func_801372B0 | 134 | GIANT | 207 | failed |  | won't compile standalone (loose-typing / missing decl) |  |
| 155 | func_80156B74 | 134 | struct | 214 | failed |  | none — MATCH | `.run/backlog_drafts/func_80156B74.c` |
| 156 | func_80144B9C | 134 | other | 770 | failed |  | -O0 cluster fn (prologue 21F0A003, fp-frame, all locals spilled+reloaded, load-delay nops). match_one compiles -O2 so it CANNOT match this; needs its own per-file -O0 split (Makefile CC1FLAGS:=-O0), like ov_SC01_077_o0.c. Body below is the faithful -O0 source; gate via whole-binary -O0 build only. | `.run/backlog_drafts/func_80144B9C.c` |
| 157 | func_80151944 | 4 | struct | 15 | near | 0 | none — MATCH (fn-pointer table dispatch; array-of-ptr indexing folds %lo) | `.run/backlog_drafts/func_80151944.c` |
| 158 | func_8016039C | 2 | struct | 15 | near | 1 | none — MATCH (function-pointer table dispatch indexed by unsigned-halfword field) | `.run/backlog_drafts/func_8016039C.c` |
| 159 | func_8015CC74 | 2 | struct | 15 | failed |  | none — MATCH (analog func_8015BE38 idiom: D_80189354[a0->idx]() with Obj.idx at off 2) | `.run/backlog_drafts/func_8015CC74.c` |
| 160 | func_8015DAF8 | 1 | struct | 15 | near | 0 | none — MATCH (proxy); identical idiom to matched func_8016901C in same overlay | `.run/backlog_drafts/func_8015DAF8.c` |
| 161 | func_801577C8 | 1 | plumbing | 16 | near | 0 | none — MATCH expected (scalar global store + two sequential calls, param preserved across first call) | `.run/backlog_drafts/func_801577C8.c` |
| 162 | func_80178B70 | 1 | struct | 18 | near | 0 | none — MATCH; local ptr p=&D_8018A458 used for store AND (int)p-0xC arg forces $s0-base reuse across call1, param_1 into $s1 | `.run/backlog_drafts/func_80178B70.c` |
| 163 | func_8017F240 | 1 | regalloc-order | 20 | near | 0 | none — MATCH (base &D_801270D0 pinned to $s0 holds across call; one lui/addiu reused for load+store) | `.run/backlog_drafts/func_8017F240.c` |
| 164 | func_80157D20 | 1 | plumbing | 21 | near | 0 | none — MATCH expected (call, indexed u16-global load as 2nd arg, then call; param_1 saved across all three calls) | `.run/backlog_drafts/func_80157D20.c` |
| 165 | func_80163408 | 1 | struct | 21 | near | 0 | local 8-byte struct copied from D_801D8BB0, &copy passed as 5th arg (s32) | `.run/backlog_drafts/func_80163408.c` |
| 166 | func_80175184 | 1 | struct | 21 | near | 0 | none — MATCH (fnptr-array %lo-fold dispatch; idx = *(u16*)(a0+2) < 2 ? D_8018A1A4[idx]() : func_80175268()) | `.run/backlog_drafts/func_80175184.c` |
| 167 | func_8014FBC0 | 1 | schedule | 22 | near | 0 | none — MATCH (22 ins). Stack-switch primitive: register $sp var, manual save/switch/restore around the call. | `.run/backlog_drafts/func_8014FBC0.c` |
| 168 | func_80178B18 | 1 | other | 22 | near | 0 | none — MATCH | `.run/backlog_drafts/func_80178B18.c` |
| 169 | func_8017B8E8 | 1 | plumbing | 22 | near | 0 | none — MATCH (two inlined unaligned 8-byte memcpy blocks: src[0..7]->D_801DA794, src[8..15]->D_801DA78C) | `.run/backlog_drafts/func_8017B8E8.c` |
| 170 | func_80182988 | 1 | plumbing | 22 | near | 0 | none — MATCH (u16 store of 0xAA10 forces ori, not sign-extended addiu) | `.run/backlog_drafts/func_80182988.c` |
| 171 | func_801609B8 | 1 | struct | 28 | near | 0 | none — MATCH (pending byte-gate); function-pointer table %lo-fold via extern array | `.run/backlog_drafts/func_801609B8.c` |
| 172 | func_8017E224 | 1 | struct | 29 | near | 0 | none — MATCH (unaligned 8-byte memcpy of global onto stack + cond byte incr) | `.run/backlog_drafts/func_8017E224.c` |
| 173 | func_80165140 | 1 | regalloc-order | 30 | near | 0 | none — MATCH (pin i=$v1/eight=$a0/p=$a2; DON'T pin param — let it self-copy to $a3 first; memcpy 8/4 unaligned) | `.run/backlog_drafts/func_80165140.c` |
| 174 | func_801549F8 | 1 | iv-combine | 31 | near | 0 | none — MATCH (31 ins). Re-tie barrier on the index defeats gcc's pointer-giv | `.run/backlog_drafts/func_801549F8.c` |
| 175 | func_8015E698 | 1 | struct | 31 | near | 0 | none — MATCH (clean -O2 reconstruction; table-of-fnptr indexed by param_1[0]) | `.run/backlog_drafts/func_8015E698.c` |
| 176 | func_8017D98C | 1 | plumbing | 31 | near | 0 | none — MATCH (expected): straight global stores + tail call; const 0x140 reused for two halves | `.run/backlog_drafts/func_8017D98C.c` |
| 177 | func_80182268 | 1 | struct | 31 | near | 0 | none — MATCH (jump-table switch over sign-extended high byte of *(u16*)(a0+0x70); case4 decrements D_801270CC then falls into case3/7's func_8012C218; no default) | `.run/backlog_drafts/func_80182268.c` |
| 178 | func_801602A4 | 1 | struct | 34 | near | 0 | none — MATCH (template = matched twin func_801601E4; lhu+0x8000 == compare, fnptr-table dispatch D_801891B8[*(u16*)a0]() no-arg, then 3-call setup in target order; func_80161208 in else) | `.run/backlog_drafts/func_801602A4.c` |
| 179 | func_801734BC | 1 | struct | 34 | near | 0 | none — MATCH (pending byte-gate); switch-jtbl with no default, 3 short stores + fnptr call | `.run/backlog_drafts/func_801734BC.c` |
| 180 | func_8017D900 | 1 | plumbing | 35 | near | 0 | none — expect MATCH (STUB: ordered global stores + single tail call, sibling of func_8017D840) | `.run/backlog_drafts/func_8017D900.c` |
| 181 | func_8016BEA0 | 1 | other | 37 | near | 0 | none — MATCH (expected) | `.run/backlog_drafts/func_8016BEA0.c` |
| 182 | func_801754A8 | 1 | regalloc-order | 37 | near | 0 | none — MATCH (37 ins, relocation-masked proxy) | `.run/backlog_drafts/func_801754A8.c` |
| 183 | func_80160920 | 1 | struct | 38 | near | 0 | none — MATCH (function-pointer table folds %lo via extern array indexed by halfword) | `.run/backlog_drafts/func_80160920.c` |
| 184 | func_80183BAC | 1 | struct | 41 | near | 0 | switch jump-table dispatch (jtbl_801D9420); verifying case grouping 0,1,2,5,6/3,7/4 emits the target table + tail | `.run/backlog_drafts/func_80183BAC.c` |
| 185 | func_80183C50 | 1 | struct | 41 | near | 0 | none — MATCH (cross-jump exploit §cookbook L1543: dup func_8012C218 into case3/7 + case4 → merged jal;nop) | `.run/backlog_drafts/func_80183C50.c` |
| 186 | func_8015DF34 | 1 | struct | 44 | near | 0 | none — MATCH (clean structural; fn-ptr table via array index folds %lo) | `.run/backlog_drafts/func_8015DF34.c` |
| 187 | func_8015FE70 | 1 | struct | 44 | near | 0 | none — MATCH expected (fn-ptr-table dispatch + ushort struct fields) | `.run/backlog_drafts/func_8015FE70.c` |
| 188 | func_8014358C | 1 | regalloc-order | 45 | near | 0 | none — MATCH (relocation-masked match_one) | `.run/backlog_drafts/func_8014358C.c` |
| 189 | func_80183AF0 | 1 | regalloc-order | 47 | near | 0 | none — MATCH (mask pinned $a1/$5 + p pinned $v0/$2; switch w/ distributed func_8012C218 tail via dup calls + cross-jump merge) | `.run/backlog_drafts/func_80183AF0.c` |
| 190 | func_80178BF8 | 1 | plumbing | 49 | near | 0 | none — MATCH (pure scalar-store + two pointer-decrement do-while loops) | `.run/backlog_drafts/func_80178BF8.c` |
| 191 | func_8015E344 | 1 | struct | 50 | near | 0 | none — MATCH (pending whole-binary gate); fn-ptr table folds %lo via extern array, 0x234 single word store | `.run/backlog_drafts/func_8015E344.c` |
| 192 | func_8017EC7C | 1 | struct | 52 | near | 0 | none — MATCH (52 ins, relocation-masked) | `.run/backlog_drafts/func_8017EC7C.c` |
| 193 | func_80183CF4 | 1 | struct | 57 | near | 0 | none — MATCH (clean switch + jtbl; orchestrator owns jtbl/rodata migration) | `.run/backlog_drafts/func_80183CF4.c` |
| 194 | func_8015D01C | 1 | regalloc-order | 58 | near | 0 | none — MATCH | `.run/backlog_drafts/func_8015D01C.c` |
| 195 | func_8016D688 | 1 | struct | 60 | near | 0 | none — MATCH (byte array D_801D9C20[] folds the &D_801D9C21 base/-1 offsets; emit p+0xE store BEFORE the param+2 increment so the lhu fills the load-delay slot in $v1) | `.run/backlog_drafts/func_8016D688.c` |
| 196 | func_801842C8 | 1 | plumbing | 62 | near | 0 | none — MATCH | `.run/backlog_drafts/func_801842C8.c` |
| 197 | func_80165240 | 1 | regalloc-order | 63 | near | 0 | none — MATCH (63 ins). buf pinned to $s2 (register __asm__("$18")) so it stays in a callee-saved reg; param_3 then naturally lands in $s3. memcpy(buf+0x30,param_3,4) -> lwl/lwr+swl/swr unaligned 4B copy (cookbook §1 mem->mem). array-of-u8 buf with explicit *(T*)(buf+off) stores; mtx[0x20] declared 2nd so it lands at sp+0x50, buf_ at sp+0x10. | `.run/backlog_drafts/func_80165240.c` |
| 198 | func_8017BB34 | 1 | struct | 65 | near | 0 | none — MATCH (65 ins). Keys: (1) align-1 {s8 b[8]} struct so the two 8-byte copies emit lwl/lwr; (2) stack-local declaration order = target frame order (svin@0x10, buf@0x18, out@0x38, local8@0x40, rt_in@0x48, rt_out@0x50) — reordering the locals to ascending offset fixed all 23 offset-only diffs. | `.run/backlog_drafts/func_8017BB34.c` |
| 199 | func_8016BD78 | 1 | regalloc-order | 74 | near | 0 | none — MATCH (lazy pointer locals pa=&BC4, pb=&BC8 assigned at first use → $a1/$a2 held thru middle code as final call args; middle bytes BC5/BC6/BC9/BCA direct global) | `.run/backlog_drafts/func_8016BD78.c` |
| 200 | func_8016E7C8 | 1 | regalloc-order | 74 | near | 0 | none — MATCH (match_one 74/74; pins $18=&prim, $19=param_3 fixed s2/s3 alloc order; Work struct sized to 0x20) | `.run/backlog_drafts/func_8016E7C8.c` |
| 201 | func_80161D20 | 1 | struct | 14 | near | 1 | none — MATCH (array-of-u16 %lo-fold, §18) | `.run/backlog_drafts/func_80161D20.c` |
| 202 | func_8015FAAC | 1 | struct | 15 | near | 1 | none — MATCH expected; fn-ptr table indexed by u16 field at +2, *4 scaled load then jalr | `.run/backlog_drafts/func_8015FAAC.c` |
| 203 | func_8016084C | 1 | struct | 15 | near | 1 | none — MATCH (jump-table dispatch via array-of-fn-ptr %lo-fold) | `.run/backlog_drafts/func_8016084C.c` |
| 204 | func_8017F714 | 1 | plumbing | 27 | near | 1 | none — MATCH (27/27 ins, match_one verified) | `.run/backlog_drafts/func_8017F714.c` |
| 205 | func_80142A10 | 1 | struct | 28 | near | 1 | none — MATCH (pending byte-gate) | `.run/backlog_drafts/func_80142A10.c` |
| 206 | func_80161C24 | 1 | struct | 29 | near | 1 | none — MATCH (array-of-struct %lo-fold; even/odd u16 fields at off 0/2, stride 4) | `.run/backlog_drafts/func_80161C24.c` |
| 207 | func_80184C0C | 1 | struct | 48 | near | 1 | none — MATCH (array-of-struct %lo-fold for &D_8018AEB8[idx], stride 0x34) | `.run/backlog_drafts/func_80184C0C.c` |
| 208 | func_8016B4F8 | 1 | regalloc-order | 50 | near | 1 | none — MATCH | `.run/backlog_drafts/func_8016B4F8.c` |
| 209 | func_801803B0 | 1 | other | 51 | near | 1 | none — MATCH expected; simple if/else, no call-crossing locals beyond param in $s0 | `.run/backlog_drafts/func_801803B0.c` |
| 210 | func_8015FBE0 | 1 | schedule | 58 | near | 1 | none — MATCH | `.run/backlog_drafts/func_8015FBE0.c` |
| 211 | func_801809BC | 1 | schedule | 70 | near | 2 | 2-ins prologue swap: `sw $ra,0x30` vs `addiu $a0,$s0,4` (first call-arg setup) adjacent, no data dep — pure ra-save scheduling; everything else byte-identical (70/70 ins). pins+a1-anchor fixed regalloc+s1-order+branch-polarity. | `.run/backlog_drafts/func_801809BC.c` |
| 212 | func_80171B4C | 1 | schedule | 70 | near | 3 | 3-off in the tail only (body+prologue MATCH via $s1 pin on arg1). gcc fills the | `.run/backlog_drafts/func_80171B4C.c` |
| 213 | func_80140E6C | 1 | schedule | 37 | near | 4 | 4 ins — each save-across-call copy (move s1,v0 / move s0,v0) should fill the NEXT jal's delay slot (target) but gcc-2.7.2 sched ties the copy with the next call's arg-setup at priority 2 and the LUID tie-break (rank_for_schedule) keeps the copy first, so reorg fills the slot with the arg-setup instead; no C reshape found that flips the LUID/priority order without breaking the OR-chain regalloc. | `.run/backlog_drafts/func_80140E6C.c` |
| 214 | func_8017EF50 | 1 | schedule | 53 | near | 5 | 5 ins — gcc-2.7.2 instr-scheduler load-order tie-breaks. Branch region + cross-jump-break (t14 pin to $3) + 0x34/0x30 hoist (c34 pin $5, c2c pin $3) all MATCH. Residual: (a) header 0x10-load vs 0x2c-load order swap; (b) compare loads 0x36-before-0xA and puts 0xA in $a1 not $a2 (slt operand reg differs). Both clusters resist source steering — every fix to one perturbs the pinned header schedule. | `.run/backlog_drafts/func_8017EF50.c` |
| 215 | func_8017F114 | 1 | schedule | 75 | near | 5 | block-order swap of 0x7F(.L1C8) vs elem3(.L1C0) cold blocks; gcc-2.7.2 BB placement (permuter-class) | `.run/backlog_drafts/func_8017F114.c` |
| 216 | func_8014D3E0 | 1 | other | 22 | near | 6 | none — MATCH | `.run/backlog_drafts/func_8014D3E0.c` |
| 217 | func_8013CF68 | 1 | schedule | 63 | near | 6 | blocks 2&3 delay-slot fill — gcc picks dead-reg $v1(b0,0x10/0x20) store for the jal delay slot; target picks arg-reg $a3(0x12/0x22). 6 ins (2 rotations); not flippable by source store-order/interleave/barrier (all tested); permuter/scheduler-internal lever needed. Prologue, $s0 fold, regalloc, block-1 all exact. | `.run/backlog_drafts/func_8013CF68.c` |
| 218 | func_8017B940 | 1 | struct | 63 | near | 6 | none — MATCH | `.run/backlog_drafts/func_8017B940.c` |
| 219 | func_80164E40 | 1 | struct | 25 | near | 8 | none — MATCH expected; byte 0 keeps base $v1 (reused by final lw word), bytes 1/2 standalone | `.run/backlog_drafts/func_80164E40.c` |
| 220 | func_8016E9EC | 1 | schedule | 53 | near | 11 | 11 left — all GNU scheduler/canon tie-breaks (regs all match via pins): (a) prologue hoists `addiu a1,0x1C` into the save block; (b) first lbu reads $a0 not $s1 (incoming-arg still live); (c) iCopy copy `addu s4,s0` lands early (scheduler) vs target's func_800D2CA8 delay-slot; (d) `addu a2,s2,s3` vs target `s3,s2` commutative-canon (unflippable w/o breaking load order). Permuter can't run (register __asm__ pins rejected, cookbook §5a). | `.run/backlog_drafts/func_8016E9EC.c` |
| 221 | func_8017EB2C | 1 | regalloc-order | 69 | near | 11 | cond?2:1 call-arg: gcc computes into $v0 then move->$a0 (or pin->$a0 forces move v0,a0 to evac param_1); target reuses $a0 sequentially (andi a0 -> addiu a0) with a sw-s0-in-delay j-island. Body (idx14+) byte-perfect. | `.run/backlog_drafts/func_8017EB2C.c` |
| 222 | func_80156044 | 1 | struct | 74 | near | 12 | none — MATCH (74 ins, relocation-masked); $s2-pin for u16-return + def-mask + 3-arg cast on func_80156848 | `.run/backlog_drafts/func_80156044.c` |
| 223 | func_80161CD0 | 1 | regalloc-order | 20 | near | 14 | param_2 must survive the call in $s0; try plain C first then pin to $16 | `.run/backlog_drafts/func_80161CD0.c` |
| 224 | func_80158FA4 | 1 | schedule | 51 | near | 17 | target keeps a DEAD `sra $a1,$v0,16` before `beqz $a1` (sign-extend of func_80159464's | `.run/backlog_drafts/func_80158FA4.c` |
| 225 | func_8018301C | 1 | plumbing | 28 | near | 24 | none — MATCH (straight-line, statement-order; verify with match_one) | `.run/backlog_drafts/func_8018301C.c` |
| 226 | func_8016BBE0 | 1 | other | 56 | near | 24 | none — straightforward; expect MATCH (mirror Ghidra-C order, synth_mult ×0x555) | `.run/backlog_drafts/func_8016BBE0.c` |
| 227 | func_8016E95C | 1 | regalloc-order | 36 | near | 25 | none — MATCH (pending byte-gate) | `.run/backlog_drafts/func_8016E95C.c` |
| 228 | func_8015094C | 1 | schedule | 73 | near | 33 | gcc jump-opt collapses the target's explicit `j`-to-shared-merge layout (cross-jump | `.run/backlog_drafts/func_8015094C.c` |
| 229 | func_80148E54 | 1 | regalloc-order | 67 | near | 40 | 67/67 ins, structure+branches+block-order+body-reload all match; residual is pure register-allocation order (permuter-eligible, no register-pins). (1) masked first-angle folds andi->$s1; target keeps it in $a0 then copies addu $s1,$a0 lazily into the beq delay-slot (the s1-copy schedules 1 slot later). (2) the 0x80 const is CSE-held in $a2 across both test+body; target re-materializes 0x80 in $v0 per block (it gets clobbered by `srl v0,v1,8`), which both renames the compare regs ($v0 not $a2) AND fills the body's reload load-delay slot (mine emits a nop there). (3) single-exit ret funnels $v1->$v0 (move v0,v1) where target writes $v0 directly. All three are gcc regalloc/value-prop tie-breaks no C reshape steered (tried: $v0 pin, temp-split, low-mask-reuse compare, memory-clobber-vs-volatile reload) — leave for the permuter. | `.run/backlog_drafts/func_80148E54.c` |
| 230 | func_80148AFC | 1 | regalloc-order | 71 | near | 48 | 1 real ins off — target keeps masked angle in caller-saved $a1 (andi $a1) then copies addu $s1,$a1 into the first beq delay slot; gcc coalesces it direct to $s1 (andi $s1) + fills delay with slti. Copy-coalescing tie-break (cookbook §20 hoist-vs-remat): resists barriers/pins($s1,$a1)/u16/reorder/split-mask. Everything else byte-exact (prologue identical thru 0x40; both bodies out-of-line via trailing-goto layout; slti via s32 type from lbu; BB4/BD0 double-load+reload via early-return main block). | `.run/backlog_drafts/func_80148AFC.c` |
| 231 | func_8017B0E4 | 1 | other | 61 | near | 51 | none — MATCH (expected; clean six-call sign-extend-store pattern) | `.run/backlog_drafts/func_8017B0E4.c` |
| 232 | func_80166F58 | 1 | schedule | 69 | near | 55 | regs/loop/logic/%lo-fold all match (pinned $s0-$s6); residual is reorg.c delay-slot fill — target replicates `addiu $v0,$s2,1` into the 3 skip-branch delay slots + commits `addu $s2,$v0,0` at merge (my codegen emits in-place `addiu $s2,$s2,1` w/ nop slots, -1 ins); plus prologue short-arg promote-then-move not fusing (`sra $a1;addu $s4,$a1,0` vs my fused `sra $s4,$a1`). Not source-steerable (pins block permuter). | `.run/backlog_drafts/func_80166F58.c` |
| 233 | func_80177DA8 | 1 | remat | 63 | near | 58 | gcc narrows `&0xfffffeff` on a 16-bit (lhu) value to `andi 0xfeff` (inline), but target hoisted -0x101 into $t4 (and-reg) in the loop preheader — a gcc-2.7.2 LICM-before-combine pass-ordering quirk unsteerable from C; that 1-ins gap cascades the constant-reg numbering + tail reassoc. Secondary: single-IV loop ptr anchors at +0xA (short, 2 accesses) not +0xC (byte) like target. | `.run/backlog_drafts/func_80177DA8.c` |
| 234 | func_801800F8 | 1 | schedule | 73 | near | 62 | body+frame(0x28)+addu-order all MATCH; sole residual = `move $a0,$v0` (func_8001C214 | `.run/backlog_drafts/func_801800F8.c` |
| 235 | func_80160B34 | 1 | struct | 15 | failed |  | none — MATCH | `.run/backlog_drafts/func_80160B34.c` |
| 236 | func_80182338 | 1 | other | 26 | failed |  | none — straight-line init; rely on gcc scheduler to hoist $a1/$v0=6 into prologue/delay-slot | `.run/backlog_drafts/func_80182338.c` |
| 237 | func_80184A68 | 1 | regalloc-order | 33 | failed |  | none — MATCH | `.run/backlog_drafts/func_80184A68.c` |
| 238 | func_8015E018 | 1 | loose-typing | 47 | failed |  | none — MATCH (signed char forces lbu+sll24/sra24 sign-extend; default char is unsigned in this toolchain) | `.run/backlog_drafts/func_8015E018.c` |
| 239 | func_80159A20 | 1 | struct | 58 | failed |  | none — MATCH. Key lever: block tail-MERGE (gcc shared `bne ...,$L1` cross-jump) by making the two return-tests STRUCTURALLY DIFFERENT — positive `if(==){goto mask;} return;` per branch (not `if(!=) return;`), so neither tail can merge. Then fix block ORDER by inverting the outer test (`if(d!=1)` makes the ==4/return path the inline fall-through, the d==1/p[2] path the forward `beq`-target block — matching the target layout). | `.run/backlog_drafts/func_80159A20.c` |
| 240 | func_8013E958 | 1 | schedule | 63 | failed |  | 2 ins swapped — cc1 emits `andi 0x7f; andi 0xff; beqz`(tests doubly-masked) but target wants `andi 0x7f; beqz; andi 0xff`(andi 0xff in the first beqz delay slot). Loop fully byte-matches; struct/ptr fold idioms nailed (D_80115110.q[0x16] hoists base+0x58 disp, Cell D_80115188[i].v folds %lo). func_800D0488 takes (m&0xFF) arg. s16 m -> 2 mism (right ins count); s32 m fixes order but merges andi+arg-move (62 ins, 1 short). | `.run/backlog_drafts/func_8013E958.c` |
| 241 | func_8013E83C | 1 | plumbing | 71 | failed |  | none — MATCH (scalar global stores + 2 conditional calls; §3-T4 branch-polarity invert on the &0xFF test) | `.run/backlog_drafts/func_8013E83C.c` |
| 242 | func_8017B368 | 1 | schedule | 74 | failed |  | dead table-path off by 1 ins — target keeps src*16 live in $s0 & computes 2nd arg src16+(base+8) in call1 delay slot; every C form either folds to e+8 (73 ins) or CSEs base into an extra saved reg $s2 (75 ins). All live code (prologue, sltiu dispatch, copy path, 4 struct-copy stores, tail) matches; only the unreachable func_8012F214 path scheduling diverges. | `.run/backlog_drafts/func_8017B368.c` |