The function declares realId and then indexes with it thirteen times -
the load-status tables, AudioLoad_SearchCaches, the table entry it reads
size and address from, every cache allocation, and the status write at the
end - but nothing assigns it. It has read an uninitialised local since
"Custom Sequences" (#2066) dropped the assignment in 2022.
Restoring the line puts back the value the rest of the function expects.
For SEQUENCE_TABLE and FONT_TABLE, AudioLoad_GetRealTableIndex returns the
id unchanged, so this is only a correctness fix in practice: the paths that
reach this function today go through the sequence script's async load
command, which is rare enough that the garbage index has not been tied to
any report.
#6917 guarded the three seqLoadStatus accessors against sequenceMapSize
because the array was allocated at exactly that size, so a custom sequence
id past it read and wrote off the end.
#6932 sized the array to sequenceMapSize + 0xF to match sequenceMap, which
covers the whole id space rather than rejecting the ids outside it, and also
protects the writers those guards never saw: AudioHeap_AllocCached and
AudioHeap_PopCache index seqLoadStatus directly.
The guards are now not just redundant but bounded wrong - they treat the ids
in [sequenceMapSize, sequenceMapSize + 0xF) as absent from a table that now
has room for them. Nothing breaks today because every entry starts at 5, so
AudioLoad_IsSeqLoadComplete answers true regardless and
AudioLoad_SetSeqLoadStatus already declines to overwrite a 5 - but once the
heap cache path moves such an entry off 5, the guard blocks an update that
should happen.
Reverting them restores the three functions to their decompiled form. The
sizing from #6932 and the id check in AudioLoad_SyncInitSeqPlayerInternal
remain the actual protection.
Warp song cutscenes were skipped for randomizer players whether they
wanted it or not: Demo_Kankyo cut the departure animation short from a
hardcoded IS_RANDO branch, and entrance rando cleared respawnFlag so the
arrival never played. There was no way to get the vanilla warp back, and
no way for a vanilla playthrough to skip it.
Drop both and put the behavior behind a Skip Warp Cutscenes toggle,
defaulting on in randomizer so existing rando warps are unchanged. It
kills the departure actor as it spawns and puts the arrival spawn mode
back to IDLE, which covers both halves of the warp.
Entrance rando's destination override moves off Demo_Kankyo's update onto
a new OnWarpSongLeave hook fired from Environment_WarpSongLeave. That is
where every warp path -- the cutscene, the skip toggle, and the spawn
failure fallback -- commits its destination, so the override no longer
depends on the departure actor being alive to see it, and a warp song
shuffled onto a grotto return keeps its grotto respawn.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Root cause of three identical field crashes (audio thread, opcode fetch
through a pointer with its low 32 bits overwritten, seconds after scene
transitions): AudioHeap_AllocPermanent writes permanentCache[index] with
index = permanentPool.count and no bound against the 32-entry array. In
SoH every soundfont sync-load is forced permanent, and custom sequences
whose SEQ.xml says CachePolicy="Temporary" ALSO allocate permanently
(the factory stores the LUS enum where CACHE_TEMPORARY == 0, while
AudioLoad_SyncLoad's switch reads 0 with the ROM convention
'permanent'). A pack with ~60 streamed customs plus vanilla fonts pushes
count past 32 within a session, after which each allocation sprays a
{ptr, size, tableType/id} triplet at 24-byte stride through
gAudioContext - entry[135]'s ptr field lands exactly on
seqPlayers[0].scriptState.pc and entry[156] on seqPlayers[1]'s (both
verified against the crash-dump registers).
- permanentCache raised 32 -> 512 (12 KB) and AllocPermanent refuses
allocations past the array instead of corrupting memory.
- Same unbounded-index disease fixed in the three sibling writers:
AllocCached's persistent path (16-entry array; CACHE_EITHER degrades
to temporary, hard persistent requests fail cleanly),
AllocPersistentSampleCacheEntry, AllocTemporarySampleCacheEntry.
- seqLoadStatus malloc sized for the full id space (sequenceMapSize +
0xF) matching sequenceMap; custom ids above sequenceMapSize previously
overflowed the allocation by up to 15 bytes.
Upstream SoH bugs, not branch-introduced - this branch's many-track
packs merely made the overflow reachable in normal play. Standalone
upstreamable fix.
gItemSlots and sExtraItemBases only cover the item IDs that live in the
inventory, but Item_Give and Item_CheckObtainability index them with any
item ID. Reading past gItemSlots lands on gUpgradeShifts, so
INV_CONTENT(ITEM_SKULL_TOKEN) resolved to the Bow slot and stored the
token there, permanently corrupting the save.
Route both through a bounds-checked Item_GetSlot that reports SLOT_NONE
for items that have no slot, and skip the inventory store in that case.
That read is also undefined behaviour, which link-time optimization is
free to exploit: with it present clang dropped the ITEM_SKULL_TOKEN
branch and the ITEM_MEDALLION_WATER horse fixup from Item_Give
entirely, so tokens were never counted either.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Custom SAF sequence IDs can exceed sequenceMapSize, causing out-of-bounds
reads/writes on the seqLoadStatus byte array (sized exactly sequenceMapSize).
This is the direct cause of intermittent battle music failure with BGM packs
(issue #5706): on the second encounter, AudioLoad_SyncLoadSeq reads a garbage
value from heap memory past seqLoadStatus[] and may find 1 (loading in
progress), causing it to return NULL early — the sequence player is never
initialized and no battle music plays.
Symmetric fix to the fontLoadStatus guards in PR #6916:
- AudioLoad_IsSeqLoadComplete: return true for OOB seqIds (custom SAF
sequences are resource-manager-backed, not in the async-load status table)
- AudioLoad_SetSeqLoadStatus: skip update for seqId >= sequenceMapSize
- AudioLoad_SyncLoadSeq: skip the in-progress check for OOB seqIds
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Rewrite Gfx_TexScrollEx / Gfx_TwoTexScrollEx / Gfx_TwoTexScrollEnvColorEx to
emit one command per tile instead of one baked tile size per interpolated frame,
so texture DL memory no longer scales with InterpolationFPS
Allow player to try opening doors while climbing. Player can't open anything if a door doesn't offer it, so it's ok to try. Handle doors don't change player y position (player walks in the air), so manually lower it.
Increase y height limit for doors to offer open from 15.0f/20.0f to 50.0f (normal door height). (For shutter doors height could be individualized depending on shutter door type in the future.)
Make climbing up animation play even for sloped ledges. The animation/action breaks because game thinks player is not on ground. So, at the end of Player_ProcessSceneCollision, if player is in climbing up action, manually set BGCHECKFLAG_GROUND.
Adds an option for a Better Save Menu that, after saving, allows you to effectively soft-reset the current save (either return to spawn or reset to the dungeon entrance), and additionally lets you reset to spawn specifcally, even if you are in a dungeon. This allows for escaping from the rare entrance-rando related softlock that can happen.
David Racine