From 97e566f1175d915601f8d55a1699e25f684b387c Mon Sep 17 00:00:00 2001
From: Howard Luck <pheenoh@gmail.com>
Date: Sat, 11 Apr 2026 11:53:03 -0600
Subject: [PATCH] Fix dMsgFlow_c::event027 aParam8 buffer size (#326)

---
 src/d/d_msg_flow.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/d/d_msg_flow.cpp b/src/d/d_msg_flow.cpp
index d487b8f7bd..c461b179e1 100644
--- a/src/d/d_msg_flow.cpp
+++ b/src/d/d_msg_flow.cpp
@@ -2234,7 +2234,13 @@ int dMsgFlow_c::event027(mesg_flow_node_event* i_flowNode_p, fopAc_ac_c* i_speak
     u16 prm0;
     getParam(&prm0, &prm1, i_flowNode_p->params);
 
+    // !@bug aParam8 is undersized; getParam always writes 4 bytes, stomping the
+    // 2 bytes past the buffer. Harmless on GC/Wii (MWCC stack layout absorbs it).
+#if AVOID_UB
+    u8 aParam8[4];
+#else
     u8 aParam8[2];
+#endif
     getParam(aParam8, i_flowNode_p->params);
 
     JUT_ASSERT(4509, (aParam8[0] >= 0 && aParam8[0] <= dSv_player_item_c::BOMB_BAG_MAX) || (aParam8[0] == 4));