feat: pure Rust DSSound::new() and typed COM init via windows crate

Replace DSSound constructor FFI bridge (call_dssound_ctor) with pure
Rust DSSound::new() that initializes all fields: 8 channel descriptors,
500 channel slots, 64-entry buffer pool, volume, and status flags.

Replace DSSOUND_INIT_BUFFERS FFI bridge (call_dssound_init_buffers) with
typed windows crate COM calls: IDirectSound::SetCooperativeLevel,
CreateSoundBuffer(DSBCAPS_PRIMARYBUFFER), IDirectSoundBuffer::GetCaps.

Expand DSSound struct from opaque blob to named fields matching the
constructor analysis (channel_descs, channel_slots, buffer_pool, etc.).

Remove dead naked asm bridges and statics (DSSOUND_CTOR_ADDR,
DSSOUND_INIT_BUF_ADDR, DSSOUND_INIT_EAX, DSSOUND_INIT_SAVED_RET).

Trap DSSound__Constructor and DSSOUND_INIT_BUFFERS -- both had
GameEngine__InitHardware as their only caller (now Rust).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/audio/dssound.rs

@@ -1,4 +1,5 @@
 use crate::fixed::Fixed;
+
 /// DSSound — DirectSound audio subsystem.
 ///
 /// Created by DSSound__Constructor (0x573D50).
@@ -6,36 +7,114 @@ use crate::fixed::Fixed;
 /// Size: 0xBE0 bytes (allocated by GameEngine__InitHardware).
 ///
 /// Manages sound playback through DirectSound.
-/// Has 500 sound channel slots and a master volume control.
-///
-/// PARTIAL: Only constructor-confirmed and InitHardware-confirmed fields.
+/// Has 8 channel descriptors, 500 sound channel slots, a 64-entry
+/// buffer pool, and a master volume control.
+
+type Ptr32 = u32;
+
+/// Channel descriptor (0x18 bytes). 8 entries at DSSound+0x14.
+/// FUN_005742A0 initializes: field_00=-1, field_04=-1, field_10=0.
+#[repr(C)]
+#[derive(Clone, Copy)]
+pub struct ChannelDescriptor {
+    pub field_00: u32,   // init -1
+    pub field_04: u32,   // init -1
+    pub _pad_08: [u32; 2],
+    pub field_10: u32,   // init 0
+    pub _pad_14: u32,
+}
+
+const _: () = assert!(core::mem::size_of::<ChannelDescriptor>() == 0x18);
+
 #[repr(C)]
 pub struct DSSound {
     /// 0x000: Vtable pointer (0x66AF20)
-    pub vtable: *mut u8,
-    /// 0x004: HWND (set to hwnd after construction)
-    pub hwnd: u32,
+    pub vtable: Ptr32,
+    /// 0x004: HWND (set after construction)
+    pub hwnd: Ptr32,
     /// 0x008: IDirectSound* (from DirectSoundCreate)
-    pub direct_sound: *mut u8,
-    /// 0x00C: Output param from DSSOUND_INIT_BUFFERS (primary buffer caps/format)
+    pub direct_sound: Ptr32,
+    /// 0x00C: Primary buffer caps/format output from init_buffers
     pub primary_buffer_caps: u32,
-    /// 0x010: IDirectSoundBuffer* (primary buffer, from DSSOUND_INIT_BUFFERS)
-    pub primary_buffer: *mut u8,
-    /// 0x014-0x8A3: Unknown fields (includes 500-entry channel slot table)
-    pub _unknown_014: [u8; 0x890],
+    /// 0x010: IDirectSoundBuffer* (primary buffer)
+    pub primary_buffer: Ptr32,
+    /// 0x014-0xD3: 8 channel descriptors (0x18 bytes each = 0xC0 total)
+    pub channel_descs: [ChannelDescriptor; 8],
+    /// 0x0D4-0x8A3: 500 channel slot indices (zeroed by constructor)
+    pub channel_slots: [u32; 500],
     /// 0x8A4: Master volume (Fixed, init 0x10000 = 1.0)
     pub volume: Fixed,
-    /// 0x8A8-0xBB3: Unknown
-    pub _unknown_8a8: [u8; 0x30C],
+    /// 0x8A8-0x9A7: 64 buffer pool shadow entries (init all -1 by FUN_00574260)
+    pub buffer_pool_shadow: [u32; 64],
+    /// 0x9A8-0xAA7: 64 buffer pool indices (init 0..63 by FUN_00574260)
+    pub buffer_pool: [u32; 64],
+    /// 0xAA8: Buffer pool count (init 0x40 = 64)
+    pub buffer_pool_count: u32,
+    /// 0xAAC-0xBAB: Unknown (0x100 bytes)
+    pub _unknown_aac: [u8; 0x100],
+    /// 0xBAC: Buffer pool state (init 0 by FUN_00574260)
+    pub buffer_pool_state: u32,
+    /// 0xBB0: Unknown field (zeroed by constructor)
+    pub _field_bb0: u32,
     /// 0xBB4: Status flag 1 (init 1)
     pub status_1: u32,
     /// 0xBB8: Status flag 2 (init 1)
     pub status_2: u32,
     /// 0xBBC: Init success flag — set to 1 when DirectSoundCreate +
-    /// DSSOUND_INIT_BUFFERS + IDirectSoundBuffer::Play all succeed.
+    /// init_buffers + IDirectSoundBuffer::Play all succeed.
     pub init_success: u32,
     /// 0xBC0-0xBDF: Unknown trailing fields
     pub _unknown_bc0: [u8; 0x20],
 }
 
 const _: () = assert!(core::mem::size_of::<DSSound>() == 0xBE0);
+
+impl DSSound {
+    /// Construct a DSSound with all fields initialized, matching the
+    /// original constructor (0x573D50) + helpers FUN_005742A0/FUN_00574260.
+    ///
+    /// Uses WA's vtable pointer for identity (same pattern as DisplayBase).
+    ///
+    /// # Safety
+    /// Must be called from within the WA.exe process (needs rebased vtable).
+    pub unsafe fn new(hwnd: u32) -> Self {
+        use crate::address::va;
+        use crate::rebase::rb;
+
+        let mut snd: Self = core::mem::zeroed();
+
+        // Vtable (WA's .rdata, identity-checked)
+        snd.vtable = rb(va::DS_SOUND_VTABLE);
+
+        // HWND
+        snd.hwnd = hwnd;
+
+        // Volume = 1.0 (16.16 fixed-point)
+        snd.volume = Fixed(0x10000);
+
+        // 8 channel descriptors: field_00=-1, field_04=-1, field_10=0
+        // (rest is zero from mem::zeroed)
+        for desc in &mut snd.channel_descs {
+            desc.field_00 = 0xFFFF_FFFF;
+            desc.field_04 = 0xFFFF_FFFF;
+        }
+
+        // 500 channel slots: already zeroed
+
+        // Buffer pool: shadow entries all -1, indices 0..63
+        for (i, slot) in snd.buffer_pool.iter_mut().enumerate() {
+            *slot = i as u32;
+        }
+        for entry in &mut snd.buffer_pool_shadow {
+            *entry = 0xFFFF_FFFF;
+        }
+        snd.buffer_pool_count = 64;
+
+        // Status flags
+        snd.status_1 = 1;
+        snd.status_2 = 1;
+        // init_success stays 0 until COM init succeeds
+
+        snd
+    }
+}

crates/openwa-wormkit/src/replacements/hardware_init.rs

@@ -61,8 +61,6 @@ static mut SAVED_RET: u32 = 0;
 
 /// Function addresses, set in `install()`.
 static mut TIMER_CTOR_ADDR: u32 = 0;
-static mut DSSOUND_CTOR_ADDR: u32 = 0;
-static mut DSSOUND_INIT_BUF_ADDR: u32 = 0;
 static mut INPUT_CTRL_INIT_ADDR: u32 = 0;
 static mut STREAM_CTOR_ADDR: u32 = 0;
 static mut DDISPLAY_INIT_ADDR: u32 = 0;
@@ -75,8 +73,6 @@ static mut INPUT_CTRL_ESI: u32 = 0;
 /// Saved ESI across the `call_input_ctrl_init` call.
 static mut INPUT_CTRL_SAVED_ESI: u32 = 0;
 
-/// Implicit EAX for `call_dssound_init_buffers` (set by `impl_init_hardware`).
-static mut DSSOUND_INIT_EAX: u32 = 0;
 
 // ─── Bridges ─────────────────────────────────────────────────────────────────
 //
@@ -102,58 +98,6 @@ unsafe extern "cdecl" fn call_timer_ctor(_timer_ptr: *mut GameTimer, _crosshair_
     );
 }
 
-/// DSSound constructor: `usercall(EAX=this)`, plain RET. Void.
-///
-/// IMPORTANT: FUN_00573D50 clobbers ECX (MOV ECX, 0x1F4 for REP STOSD).
-/// Do NOT use ECX to save bridge_ret — read it from the stack instead.
-#[unsafe(naked)]
-unsafe extern "cdecl" fn call_dssound_ctor(_dssound: *mut DSSound) {
-    core::arch::naked_asm!(
-        // [esp+0]=bridge_ret, [esp+4]=dssound
-        "movl 4(%esp), %eax",    // EAX = dssound (bridge_ret stays on stack untouched)
-        "calll *({fn})",          // FUN_00573D50: plain RET; calll pushes continuation here
-        // After FUN_00573D50 RET: stack = [bridge_ret, dssound]
-        "retl",                  // pop bridge_ret, return; caller cleans dssound
-        fn = sym DSSOUND_CTOR_ADDR,
-        options(att_syntax),
-    );
-}
-
-/// Saved bridge_ret for `call_dssound_init_buffers` (can't use ECX — callee clobbers it).
-static mut DSSOUND_INIT_SAVED_RET: u32 = 0;
-
-/// FUN_00573E50: `usercall(EAX=dssound)` + `__stdcall(out_0x10, out_0x0C)`, `RET 0x8`.
-/// Declared as `extern "stdcall"` so Rust caller does NOT emit `add esp, 8` after the call
-/// (callee already cleans via RET 0x8).
-/// Caller sets `DSSOUND_INIT_EAX = dssound` before calling.
-#[unsafe(naked)]
-unsafe extern "stdcall" fn call_dssound_init_buffers(
-    _out_primary_buffer: *mut *mut u8,
-    _out_primary_caps: *mut u32,
-) -> u32 {
-    core::arch::naked_asm!(
-        // Entry: ESP=E, [E+0]=bridge_ret, [E+4]=out_primary_buffer, [E+8]=out_primary_caps
-        "movl {eax_val}, %eax",      // EAX = dssound
-        "movl (%esp), %ecx",         // ECX = bridge_ret (temp)
-        "movl %ecx, {saved_ret}",    // save to static (ECX clobbered by FUN_00573E50)
-        "movl 4(%esp), %ecx",        // ECX = out_primary_buffer
-        "movl 8(%esp), %edx",        // EDX = out_primary_caps
-        "addl $0xC, %esp",           // ESP = E+12 (discard bridge_ret + 2 args)
-        "pushl %edx",                // ESP = E+8,  [E+8]  = out_primary_caps
-        "pushl %ecx",                // ESP = E+4,  [E+4]  = out_primary_buffer
-        "calll *({fn})",             // ESP = E,    [E]    = cont
-                                     // FUN_00573E50 RET 0x8: pops cont → E+4, +8 → E+12
-        // At cont: ESP = E+12; EAX = return value
-        "pushl {saved_ret}",         // ESP = E+8, [E+8] = bridge_ret
-        "retl",                      // pops bridge_ret → ESP = E+12
-                                     // stdcall: caller skips cleanup. ESP = E+12 = E+4+8 ✓
-        eax_val = sym DSSOUND_INIT_EAX,
-        fn = sym DSSOUND_INIT_BUF_ADDR,
-        saved_ret = sym DSSOUND_INIT_SAVED_RET,
-        options(att_syntax),
-    );
-}
-
 /// FUN_0058C0D0: `usercall(ESI=input_ctrl)` + stdcall(4 params), RET 0x10.
 /// Caller sets `INPUT_CTRL_ESI = input_ctrl` before calling.
 /// FUN_0058C0D0's `RET 0x10` cleans all 4 args, so `retl` here needs no cleanup.
@@ -248,34 +192,50 @@ unsafe extern "stdcall" fn call_ddisplay_init(
 /// if COM steps fail, matching original WA behavior).
 unsafe fn create_dssound(hwnd: u32) -> *mut DSSound {
     use windows::Win32::Media::Audio::DirectSound::{
-        DirectSoundCreate, IDirectSound, IDirectSoundBuffer, DSBPLAY_LOOPING,
+        DirectSoundCreate, IDirectSound, IDirectSoundBuffer,
+        DSBUFFERDESC, DSBCAPS_PRIMARYBUFFER, DSBPLAY_LOOPING, DSSCL_PRIORITY,
     };
+    use windows::Win32::Foundation::HWND;
 
-    let snd = WABox::<DSSound>::alloc(0xBE0, 0xBC0).leak();
-    call_dssound_ctor(snd);
-    (*snd).hwnd = hwnd;
+    // Pure Rust construction — replaces call_dssound_ctor bridge.
+    let snd = WABox::<DSSound>::from_value(DSSound::new(hwnd)).leak();
 
-    // Create DirectSound COM object.
+    // DirectSound COM initialization — replaces call_dssound_init_buffers bridge.
     let mut ds: Option<IDirectSound> = None;
     if DirectSoundCreate(None, &mut ds, None).is_ok() {
         let ds = ds.unwrap();
-        (*snd).direct_sound = core::mem::transmute_copy(&ds);
-        core::mem::forget(ds); // WA owns the COM reference
-
-        // Initialize primary buffer (WA's usercall function).
-        DSSOUND_INIT_EAX = snd as u32;
-        let hr2 = call_dssound_init_buffers(
-            &mut (*snd).primary_buffer,
-            &mut (*snd).primary_buffer_caps,
-        );
-        if hr2 == 0 {
-            // Start the primary buffer looping.
-            let primary: &IDirectSoundBuffer =
-                &*(&(*snd).primary_buffer as *const *mut u8 as *const IDirectSoundBuffer);
+
+        // SetCooperativeLevel(hwnd, DSSCL_PRIORITY)
+        let _ = ds.SetCooperativeLevel(HWND(hwnd as _), DSSCL_PRIORITY);
+
+        // CreateSoundBuffer with DSBCAPS_PRIMARYBUFFER (no format — primary buffer)
+        let desc = DSBUFFERDESC {
+            dwSize: core::mem::size_of::<DSBUFFERDESC>() as u32,
+            dwFlags: DSBCAPS_PRIMARYBUFFER,
+            ..core::mem::zeroed()
+        };
+        let mut primary: Option<IDirectSoundBuffer> = None;
+        if ds.CreateSoundBuffer(&desc, &mut primary, None).is_ok() {
+            let primary = primary.unwrap();
+
+            // GetCaps to populate primary_buffer_caps
+            let mut caps = core::mem::zeroed::<windows::Win32::Media::Audio::DirectSound::DSBCAPS>();
+            caps.dwSize = core::mem::size_of_val(&caps) as u32;
+            let _ = primary.GetCaps(&mut caps);
+            (*snd).primary_buffer_caps = caps.dwBufferBytes;
+
+            // Start primary buffer looping
             if primary.Play(0, 0, DSBPLAY_LOOPING).is_ok() {
                 (*snd).init_success = 1;
             }
+
+            // Store COM pointers as raw u32 (WA owns the references)
+            (*snd).primary_buffer = core::mem::transmute_copy(&primary);
+            core::mem::forget(primary);
         }
+
+        (*snd).direct_sound = core::mem::transmute_copy(&ds);
+        core::mem::forget(ds);
     }
 
     snd
@@ -409,7 +369,7 @@ unsafe extern "cdecl" fn impl_init_hardware(
         (*session).streaming_audio = core::ptr::null_mut();
         if !(*session).sound.is_null() && gi.speech_enabled != 0 {
             let stream = WABox::<StreamingAudio>::alloc(0x354, 0x334).leak();
-            let ids = (*(*session).sound).direct_sound;
+            let ids = (*(*session).sound).direct_sound as *mut u8;
             call_streaming_audio_ctor(
                 stream as *mut u8,
                 ids,
@@ -500,8 +460,6 @@ unsafe extern "C" fn hook_init_hardware() {
 pub fn install() -> Result<(), String> {
     unsafe {
         TIMER_CTOR_ADDR       = rb(va::GAME_ENGINE_TIMER_CTOR);
-        DSSOUND_CTOR_ADDR     = rb(va::CONSTRUCT_DS_SOUND);
-        DSSOUND_INIT_BUF_ADDR = rb(va::DSSOUND_INIT_BUFFERS);
         INPUT_CTRL_INIT_ADDR  = rb(va::INPUT_CTRL_INIT);
         STREAM_CTOR_ADDR      = rb(va::STREAMING_AUDIO_CTOR);
         DDISPLAY_INIT_ADDR    = rb(va::DDISPLAY_INIT);
@@ -512,6 +470,10 @@ pub fn install() -> Result<(), String> {
             va::GAME_ENGINE_INIT_HARDWARE,
             hook_init_hardware as *const (),
         )?;
+
+        // Trap functions whose only caller was GameEngine__InitHardware (now Rust).
+        hook::install_trap!("DSSound__Constructor", va::CONSTRUCT_DS_SOUND);
+        hook::install_trap!("DSSOUND_INIT_BUFFERS", va::DSSOUND_INIT_BUFFERS);
     }
     Ok(())
 }