#!/usr/bin/env python3 """A prologue-less dispatch entry needs CFG proof before it becomes a walk root. Overlay bands are shared address windows, so every observed interpreted PC is demanded for every occupant of the band. `_callable_legacy_seed` then admits a demanded address as a callable walk root on any of three grades of evidence: it is the image entry, it opens a stack frame, or the word two slots back is `jr $ra`. That third grade is the weak one, and it fires precisely where it is least trustworthy -- the first word after a function's return is also the first word of whatever the linker placed next, which in these images is routinely a pointer table, a packed record array or zero fill. The walk then runs from the table head to the image end and the generated-C audit reports a column of UNSUPPORTED_INSTRUCTION. Measured on Breath of Fire III (SLPS-00990), 406 overlay captures, 5,339 dispatch entries already accepted as walk roots: 2,066 have a prologue, 3,273 ride on the preceding `jr $ra` alone, and the bounded CFG probe rejects 41 of those 3,273. All 41 are data by inspection (in-image pointer tables, packed 16-bit record arrays, signed delta pairs, zero fill), and 27 of them are exactly the 27 shards whose all-bands compile failed the audit -- one bad root per failing shard. The other 14 are the same bug in shards whose data happened to decode all the way to the image end. Demotion is not a discard: DISPATCH_INTERIOR keeps the dispatch evidence and the isolated-fragment demand, and only declines to start a linear walk there. """ import struct import sys import unittest from pathlib import Path ROOT = Path(__file__).resolve().parents[2] sys.path.insert(0, str(ROOT / "tools")) import compile_overlays # noqa: E402 LOAD = 0x801EEC00 NOP = 0x00000000 JR_RA = 0x03E00008 ADDIU_SP_NEG = 0x27BDFFE0 # addiu sp, sp, -0x20 ADDIU_SP_POS = 0x27BD0020 # addiu sp, sp, 0x20 ORI_V0_ZERO = 0x34020001 # ori v0, zero, 1 def image(words): return b"".join(struct.pack("