refactor: port GfxDir resource loading system to Rust

Port the entire .dir archive I/O layer — GfxDir vtable (read, seek,
load_cached, release), GfxDirStream vtable (all 6 slots), LoadImage,
cache slot management, and cleanup — eliminating all WA.exe asm bridges.

- Move gfx_dir module from render/sprite/ to new asset/ module
- Type cache slots as GfxCacheSlot struct, rename _unknown fields
- Convert GfxDirStreamVtable to #[vtable] macro with bind_! wrappers
- Replace call_gfx_load_dir/call_gfx_load_image bridges with direct calls
- Add WA_FSEEK address, GFX_DIR_STREAM_VTABLE address
- Fix GfxDirStream.gfx_dir field type from *mut u8 to *mut GfxDir
- Rename GfxDirEntry._unknown_08 to data_size

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/address.rs

@@ -236,6 +236,11 @@ pub mod va {
             fn GFX_DIR_LOAD_IMAGE = 0x0056_66D0;
         }
 
+        class "GfxDirStream" {
+            /// GfxDirStream vtable (6 slots)
+            vtable GFX_DIR_STREAM_VTABLE = 0x0066_A1C0;
+        }
+
         class "DisplayBase" {
             /// DisplayBase__AllocPaletteSlots — usercall EAX=count, 1 stack(this)
             fn/Usercall DISPLAY_BASE_ALLOC_PALETTE_SLOTS = 0x0052_3190;
@@ -801,6 +806,8 @@ pub mod va {
         fn/Cdecl WA_FOPEN = 0x005D_3271;
         /// WA's CRT fread
         fn/Cdecl WA_FREAD = 0x005D_4531;
+        /// WA's CRT fseek
+        fn/Cdecl WA_FSEEK = 0x005D_38A4;
         /// WA's CRT fclose
         fn/Cdecl WA_FCLOSE = 0x005D_399B;
         /// WA's CRT _fileno

crates/openwa-core/src/{render/sprite → asset}/gfx_dir.rs

@@ -10,6 +10,24 @@ use crate::address::va;
 use crate::rebase::rb;
 use crate::wa_alloc::{wa_malloc, wa_malloc_struct_zeroed};
 
+/// Cache slot within a GfxDir (0x10 bytes).
+///
+/// Tracks a currently-open stream's read region within the `.dir` archive file.
+/// `stream_ptr` is null when the slot is free.
+#[repr(C)]
+pub struct GfxCacheSlot {
+    /// Pointer to the GfxDirStream using this slot, or null if free.
+    pub stream_ptr: *mut GfxDirStream,
+    /// Absolute file offset of the data region start.
+    pub start_offset: u32,
+    /// Absolute file offset of the data region end (start + size).
+    pub end_offset: u32,
+    /// Current read position (between start_offset and end_offset).
+    pub current_pos: u32,
+}
+
+const _: () = assert!(core::mem::size_of::<GfxCacheSlot>() == 0x10);
+
 /// .dir archive reader (0x19C bytes, vtable 0x66B280).
 ///
 /// Loaded from `.dir` files via `gfx_dir_load`. Contains a 1024-bucket
@@ -22,16 +40,16 @@ pub struct GfxDir {
     pub bucket_array: *mut u8,
     /// 0x008: 1 if bucket_array was allocated via malloc fallback (needs free).
     pub fallback_alloc: u32,
-    /// 0x00C-0x10B: 16 cache slots (0x10 bytes each, first u32 zeroed on reset).
-    pub cache_slots: [u8; 0x100],
-    /// 0x10C-0x14B: Index table (16 u32 entries, identity permutation on reset).
+    /// 0x00C-0x10B: 16 cache slots tracking open stream read regions.
+    pub cache_slots: [GfxCacheSlot; 16],
+    /// 0x10C-0x14B: Free slot index stack (top at `[slot_count - 1]`).
     pub index_table: [u32; 16],
-    /// 0x14C-0x18B: Unknown padding.
-    pub _unknown_14c: [u8; 0x40],
-    /// 0x18C: Number of cache slots (always 0x10).
+    /// 0x14C-0x18B: In-use slot index array (count in `inuse_count`).
+    pub inuse_slots: [u32; 16],
+    /// 0x18C: Number of free cache slots (starts at 16, decremented on alloc).
     pub slot_count: u32,
-    /// 0x190: Unknown (zeroed on reset).
-    pub _unknown_190: u32,
+    /// 0x190: Number of in-use cache slots (starts at 0, incremented on alloc).
+    pub inuse_count: u32,
     /// 0x194: Loaded flag (1 after successful gfx_dir_load).
     pub loaded: u32,
     /// 0x198: FILE* handle to the open .dir file.
@@ -59,8 +77,8 @@ impl GfxDir {
 pub struct GfxDirVtable {
     /// Slot 0 (0x58BBD0): Read `size` bytes into `buf`. Returns bytes read.
     pub read: fn(this: *mut GfxDir, buf: *mut u8, size: u32) -> u32,
-    /// Slot 1 (0x58BBB0): Seek forward `skip` bytes in the file.
-    pub seek: fn(this: *mut GfxDir, skip: u32),
+    /// Slot 1 (0x58BBB0): Absolute seek — `fseek(file, offset, SEEK_SET)`. Returns 1 on success.
+    pub seek: fn(this: *mut GfxDir, offset: u32) -> u32,
     /// Slot 2 (0x571AF0): Return cached data pointer for `entry_val`, or null if not mapped.
     pub load_cached: fn(this: *mut GfxDir, entry_val: u32) -> *mut u8,
     /// Slot 3 (0x58BB70): Release resources; if `flags & 1`, free the object.
@@ -70,13 +88,15 @@ pub struct GfxDirVtable {
 bind_GfxDirVtable!(GfxDir, vtable);
 
 /// Entry in a GfxDir hash bucket linked list.
-/// Each entry maps a name string to a cached resource value.
+/// Each entry maps a name string to a resource in the `.dir` archive.
 #[repr(C)]
 pub struct GfxDirEntry {
     pub next: *mut GfxDirEntry,
-    /// Passed to GfxDir vtable[2] for cached resource lookup.
+    /// File offset of the resource data within the `.dir` archive.
+    /// Also used as the key for cached resource lookup (vtable[2]).
     pub value: u32,
-    pub _unknown_08: u32,
+    /// Size of the resource data in bytes.
+    pub data_size: u32,
     // +0x0C: null-terminated name (variable-length, not in struct)
 }
 
@@ -219,12 +239,11 @@ unsafe fn gfx_dir_reset(handler: *mut u8) {
     gfx.loaded = 0;
 
     for i in 0..16u32 {
-        // Zero first u32 of each cache slot (stride 0x10)
-        *(gfx.cache_slots.as_mut_ptr().add(i as usize * 0x10) as *mut u32) = 0;
+        gfx.cache_slots[i as usize].stream_ptr = core::ptr::null_mut();
         gfx.index_table[i as usize] = i;
     }
 
-    gfx._unknown_190 = 0;
+    gfx.inuse_count = 0;
     gfx.slot_count = 0x10;
 }
 
@@ -337,6 +356,98 @@ pub unsafe fn gfx_dir_load_dir(handler: *mut u8) -> i32 {
     1 // success
 }
 
+// ─── GfxDir vtable method implementations ───────────────────────────────────
+
+/// Pure Rust implementation of GfxHandler__Read (vtable slot 0, 0x58BBD0).
+///
+/// `fread(buf, 1, size, self->file_handle)`. Returns `size` on success, 0 on error.
+#[cfg(target_arch = "x86")]
+pub unsafe extern "thiscall" fn gfx_dir_read(this: *mut GfxDir, buf: *mut u8, size: u32) -> u32 {
+    let fread: unsafe extern "cdecl" fn(*mut u8, u32, u32, *mut u8) -> u32 =
+        core::mem::transmute(rb(va::WA_FREAD) as usize);
+    let bytes_read = fread(buf, 1, size, (*this).file_handle);
+    if bytes_read != size {
+        0
+    } else {
+        size
+    }
+}
+
+/// Pure Rust implementation of GfxHandler__Seek (vtable slot 1, 0x58BBB0).
+///
+/// `fseek(self->file_handle, offset, SEEK_SET)`. Returns 1 on success, 0 on failure.
+#[cfg(target_arch = "x86")]
+pub unsafe extern "thiscall" fn gfx_dir_seek(this: *mut GfxDir, offset: u32) -> u32 {
+    let fseek: unsafe extern "cdecl" fn(*mut u8, i32, i32) -> i32 =
+        core::mem::transmute(rb(va::WA_FSEEK) as usize);
+    let result = fseek((*this).file_handle, offset as i32, 0); // SEEK_SET = 0
+    if result == 0 {
+        1
+    } else {
+        0
+    }
+}
+
+/// Pure Rust implementation of GfxHandler__LoadCached (vtable slot 2, 0x571AF0).
+///
+/// Base implementation is a no-op — always returns null.
+pub unsafe extern "thiscall" fn gfx_dir_load_cached(
+    _this: *mut GfxDir,
+    _entry_val: u32,
+) -> *mut u8 {
+    core::ptr::null_mut()
+}
+
+/// Pure Rust implementation of FUN_566330 (GfxDir cleanup).
+///
+/// Resets vtable to the "cleaned up" vtable (0x66A1B0), invalidates all
+/// active cache slots, and frees the bucket array if it was malloc'd.
+#[cfg(target_arch = "x86")]
+unsafe fn gfx_dir_cleanup(gfx: *mut GfxDir) {
+    // Set vtable to the "cleaned up" vtable (0x66A1B0)
+    (*gfx).vtable = rb(0x0066_A1B0) as *const GfxDirVtable;
+
+    if (*gfx).loaded != 0 {
+        // Walk in-use slots, invalidate cache entries
+        let inuse_count = (*gfx).inuse_count as usize;
+        for i in 0..inuse_count {
+            let slot_idx = (*gfx).inuse_slots[i] as usize;
+            let slot = &mut (*gfx).cache_slots[slot_idx];
+            // Clear the stream's backpointer (offset +0x08 in GfxDirStream)
+            if !slot.stream_ptr.is_null() {
+                (*slot.stream_ptr).gfx_dir = core::ptr::null_mut();
+            }
+            // Mark slot index as invalid (-1)
+            (*slot.stream_ptr).slot_index = 0xFFFF_FFFF;
+        }
+
+        if (*gfx).fallback_alloc != 0 {
+            crate::wa_alloc::wa_free((*gfx).bucket_array);
+        }
+    }
+}
+
+/// Pure Rust implementation of GfxHandler__Release (vtable slot 3, 0x58BB70).
+///
+/// Resets vtable, closes the file handle, runs cleanup, and optionally frees self.
+#[cfg(target_arch = "x86")]
+pub unsafe extern "thiscall" fn gfx_dir_release(this: *mut GfxDir, flags: u32) {
+    // Reset vtable to base GfxHandler vtable
+    (*this).vtable = rb(va::GFX_DIR_VTABLE) as *const GfxDirVtable;
+
+    if !(*this).file_handle.is_null() {
+        let fclose: unsafe extern "cdecl" fn(*mut u8) -> i32 =
+            core::mem::transmute(rb(va::WA_FCLOSE) as usize);
+        fclose((*this).file_handle);
+    }
+
+    gfx_dir_cleanup(this);
+
+    if (flags & 1) != 0 {
+        crate::wa_alloc::wa_free(this as *mut u8);
+    }
+}
+
 /// Pure Rust implementation of GfxResource__Create_Maybe (0x4F6300).
 ///
 /// Convention: usercall(ECX=gfx_dir, EAX=name) + 1 stack(output), RET 0x4.
@@ -367,7 +478,7 @@ pub unsafe fn gfx_resource_create(
     }
 
     // 2. Fallback: LoadImage → IMG_Decode
-    let raw_image = call_gfx_load_image(gfx_dir, name);
+    let raw_image = gfx_dir_load_image(gfx_dir, name);
     if raw_image.is_null() {
         return core::ptr::null_mut();
     }
@@ -417,7 +528,7 @@ pub(crate) unsafe fn call_gfx_load_and_wrap(
     name: *const core::ffi::c_char,
     display_ctx: *mut crate::render::palette::PaletteContext,
 ) -> *mut u8 {
-    let image = call_gfx_load_image(gfx_dir, name);
+    let image = gfx_dir_load_image(gfx_dir, name);
     if image.is_null() {
         return core::ptr::null_mut();
     }
@@ -442,106 +553,301 @@ pub struct GfxDirStream {
     /// 0x04: Cache slot index within the parent GfxDir.
     pub slot_index: u32,
     /// 0x08: Parent GfxDir pointer.
-    pub gfx_dir: *mut u8,
+    pub gfx_dir: *mut GfxDir,
 }
 
 /// Vtable for GfxDirStream (6 slots at 0x66A1C0).
-#[repr(C)]
+///
+/// Provides a sequential read interface over cached resource data within
+/// a `.dir` archive. The stream reads from a cache slot in the parent GfxDir.
+#[vtable(size = 6, va = 0x0066_A1C0, class = "GfxDirStream")]
 pub struct GfxDirStreamVtable {
     /// Slot 0 (0x5661E0): Destructor — releases cache slot, optionally frees.
-    pub destructor: unsafe extern "thiscall" fn(this: *mut GfxDirStream, flags: u32),
-    /// Slot 1 (0x566210): Returns 1 if read position < end position.
-    pub has_data: unsafe extern "thiscall" fn(this: *mut GfxDirStream) -> u32,
-    /// Slot 2 (0x566240): Returns remaining bytes (end - current position).
-    pub remaining: unsafe extern "thiscall" fn(this: *mut GfxDirStream) -> u32,
-    /// Slot 3 (0x566270): Unknown.
-    pub _slot_3: usize,
-    /// Slot 4 (0x5662C0): Return total byte size of this stream's data region.
-    pub get_total_size: unsafe extern "thiscall" fn(this: *mut GfxDirStream) -> u32,
+    pub destructor: fn(this: *mut GfxDirStream, flags: u32),
+    /// Slot 1 (0x566210): Returns 1 if current read position < end position.
+    pub has_data: fn(this: *mut GfxDirStream) -> u32,
+    /// Slot 2 (0x566240): Returns bytes consumed (current_pos - start_offset).
+    pub bytes_consumed: fn(this: *mut GfxDirStream) -> u32,
+    /// Slot 3 (0x566270): Seek — repositions read cursor within [start, end].
+    pub seek: fn(this: *mut GfxDirStream, offset: u32) -> u32,
+    /// Slot 4 (0x5662C0): Returns total byte size (end_offset - start_offset).
+    pub get_total_size: fn(this: *mut GfxDirStream) -> u32,
     /// Slot 5 (0x5662F0): Read `size` bytes into `dest`.
-    pub read: unsafe extern "thiscall" fn(this: *mut GfxDirStream, dest: *mut u8, size: u32),
+    pub read: fn(this: *mut GfxDirStream, dest: *mut u8, size: u32),
 }
 
+bind_GfxDirStreamVtable!(GfxDirStream, vtable);
+
 impl GfxDirStream {
-    /// Read `size` bytes from the stream into `dest`.
-    ///
-    /// # Safety
-    /// `this` must be a valid stream pointer. `dest` must have room for `size` bytes.
+    /// Destroy the stream reader, releasing its cache slot.
     #[inline]
-    pub unsafe fn read_raw(this: *mut Self, dest: *mut u8, size: u32) {
-        ((*(*this).vtable).read)(this, dest, size);
+    pub unsafe fn destroy_raw(this: *mut Self) {
+        Self::destructor_raw(this, 1);
     }
 
-    /// Returns the number of bytes remaining in the stream.
+    /// Returns a pointer to this stream's cache slot in the parent GfxDir.
+    /// Returns null if the stream is invalid (null gfx_dir or slot_index >= 16).
     #[inline]
-    pub unsafe fn remaining_raw(this: *mut Self) -> u32 {
-        ((*(*this).vtable).remaining)(this)
+    unsafe fn cache_slot(this: *mut Self) -> *mut GfxCacheSlot {
+        let gfx = (*this).gfx_dir;
+        if gfx.is_null() {
+            return core::ptr::null_mut();
+        }
+        let idx = (*this).slot_index;
+        if idx >= 16 {
+            return core::ptr::null_mut();
+        }
+        &raw mut (*gfx).cache_slots[idx as usize]
     }
+}
 
-    /// Returns the total byte size of this stream's data region.
-    #[inline]
-    pub unsafe fn total_size_raw(this: *mut Self) -> u32 {
-        ((*(*this).vtable).get_total_size)(this)
+// ─── GfxDirStream vtable method implementations ─────────────────────────────
+
+/// Pure Rust implementation of GfxDirStream has_data (vtable slot 1, 0x566210).
+///
+/// Returns 1 if `current_pos < end_offset`, 0 otherwise.
+pub unsafe extern "thiscall" fn gfx_dir_stream_has_data(this: *mut GfxDirStream) -> u32 {
+    let slot = GfxDirStream::cache_slot(this);
+    if slot.is_null() || (*slot).stream_ptr.is_null() {
+        return 0;
+    }
+    if (*slot).current_pos < (*slot).end_offset {
+        1
+    } else {
+        0
     }
+}
 
-    /// Destroy the stream reader, releasing its cache slot.
-    #[inline]
-    pub unsafe fn destroy_raw(this: *mut Self) {
-        ((*(*this).vtable).destructor)(this, 1);
+/// Pure Rust implementation of GfxDirStream bytes_consumed (vtable slot 2, 0x566240).
+///
+/// Returns `current_pos - start_offset` (bytes consumed from data start).
+pub unsafe extern "thiscall" fn gfx_dir_stream_bytes_consumed(this: *mut GfxDirStream) -> u32 {
+    let slot = GfxDirStream::cache_slot(this);
+    if slot.is_null() || (*slot).stream_ptr.is_null() {
+        return 0;
     }
+    (*slot).current_pos.wrapping_sub((*slot).start_offset)
 }
 
-static mut GFX_LOAD_DIR_ADDR: u32 = 0;
+/// Pure Rust implementation of GfxDirStream seek (vtable slot 3, 0x566270).
+///
+/// Repositions the read cursor to `start_offset + offset`, clamped to [start, end].
+/// Returns 1 on success, 0 on failure.
+pub unsafe extern "thiscall" fn gfx_dir_stream_seek(this: *mut GfxDirStream, offset: u32) -> u32 {
+    let slot = GfxDirStream::cache_slot(this);
+    if slot.is_null() || (*slot).stream_ptr.is_null() {
+        return 0;
+    }
+    let start = (*slot).start_offset;
+    let end = (*slot).end_offset;
+    let mut new_pos = start.wrapping_add(offset);
+    // Clamp: if wrapping underflow (new_pos < start), use start
+    if new_pos < start {
+        new_pos = start;
+    }
+    if new_pos > end {
+        new_pos = end;
+    }
+    (*slot).current_pos = new_pos;
+    1
+}
 
-// GfxDir__LoadImage is usercall(ESI=gfx_dir) + 1 stack(name), RET 0x4.
-// Returns raw image pointer or null.
-static mut GFX_LOAD_IMAGE_ADDR: u32 = 0;
+/// Pure Rust implementation of GfxDirStream get_total_size (vtable slot 4, 0x5662C0).
+///
+/// Returns `end_offset - start_offset` (total data size), or -1 if gfx_dir is null.
+pub unsafe extern "thiscall" fn gfx_dir_stream_get_total_size(this: *mut GfxDirStream) -> u32 {
+    if (*this).gfx_dir.is_null() {
+        return 0xFFFF_FFFF; // -1 as u32, matching original
+    }
+    let slot = GfxDirStream::cache_slot(this);
+    if slot.is_null() || (*slot).stream_ptr.is_null() {
+        return 0;
+    }
+    (*slot).end_offset.wrapping_sub((*slot).start_offset)
+}
+
+/// Pure Rust implementation of cache slot release (FUN_566640).
+///
+/// Finds the stream's slot in the parent GfxDir's in-use list, removes it,
+/// and returns the slot index to the free list. Clears the slot's stream_ptr.
+///
+/// Returns 1 on success, 0 if the slot was not found.
+pub unsafe fn gfx_dir_release_slot(gfx: *mut GfxDir, stream: *mut GfxDirStream) -> u32 {
+    if stream.is_null() {
+        return 0;
+    }
+    let slot_idx = (*stream).slot_index;
+    if slot_idx >= 16 || (*gfx).cache_slots[slot_idx as usize].stream_ptr.is_null() {
+        return 0;
+    }
+
+    // Find slot_idx in the in-use list
+    let inuse_count = (*gfx).inuse_count as usize;
+    let mut found = false;
+    let mut found_pos = 0usize;
+    for i in 0..inuse_count {
+        if (*gfx).inuse_slots[i] == slot_idx {
+            found = true;
+            found_pos = i;
+            break;
+        }
+    }
+    if !found {
+        return 0;
+    }
+
+    // Remove from in-use list: swap with last, decrement count
+    let new_inuse_count = inuse_count - 1;
+    (*gfx).inuse_count = new_inuse_count as u32;
+    (*gfx).inuse_slots[found_pos] = (*gfx).inuse_slots[new_inuse_count];
+
+    // Push slot index back to free list
+    let free_idx = (*gfx).slot_count as usize;
+    (*gfx).index_table[free_idx] = slot_idx;
+    (*gfx).slot_count += 1;
 
-/// Bridge to GfxHandler__LoadDir (0x5663E0).
-/// Convention: usercall(EAX=handler), plain RET. Returns nonzero on success.
+    // Clear the cache slot
+    (*gfx).cache_slots[slot_idx as usize].stream_ptr = core::ptr::null_mut();
+
+    1
+}
+
+/// Pure Rust implementation of GfxDirStream read helper (FUN_566760).
+///
+/// Reads data from the parent GfxDir's file through its vtable, advancing
+/// the cache slot's current read position.
 #[cfg(target_arch = "x86")]
-pub(crate) unsafe fn call_gfx_load_dir(handler: *mut u8, addr: u32) -> i32 {
-    let result: i32;
-    core::arch::asm!(
-        "call {addr}",
-        addr = in(reg) addr,
-        inlateout("eax") handler => result,
-        out("ecx") _,
-        out("edx") _,
-        clobber_abi("C"),
-    );
-    result
+unsafe fn gfx_dir_stream_read_inner(
+    gfx: *mut GfxDir,
+    slot_idx: u32,
+    dest: *mut u8,
+    size: u32,
+) -> u32 {
+    if slot_idx >= 16 || (*gfx).cache_slots[slot_idx as usize].stream_ptr.is_null() {
+        return 0;
+    }
+
+    let slot = &mut (*gfx).cache_slots[slot_idx as usize];
+    let current = slot.current_pos;
+    let end = slot.end_offset;
+
+    // Clamp read size to remaining bytes
+    let mut actual_end = current.wrapping_add(size);
+    if actual_end > end {
+        actual_end = end;
+    }
+    let actual_size = actual_end.wrapping_sub(current);
+    if actual_size == 0 {
+        return 0;
+    }
+
+    // Seek parent GfxDir to current position (vtable slot 1 = absolute seek)
+    let seek_ok = GfxDir::seek_raw(gfx, current);
+    if seek_ok == 0 {
+        return 0;
+    }
+
+    // Read through parent GfxDir (vtable slot 0)
+    let bytes_read = GfxDir::read_raw(gfx, dest, actual_size);
+    if bytes_read != actual_size {
+        return 0;
+    }
+
+    // Advance read position
+    slot.current_pos = current.wrapping_add(actual_size);
+
+    actual_size
 }
 
+/// Pure Rust implementation of GfxDirStream destructor (vtable slot 0, 0x5661E0).
+///
+/// Releases the cache slot and optionally frees the stream object.
 #[cfg(target_arch = "x86")]
-#[unsafe(naked)]
-pub unsafe extern "C" fn call_gfx_load_image(
-    _gfx_dir: *mut GfxDir,
-    _name: *const core::ffi::c_char,
-) -> *mut GfxDirStream {
-    core::arch::naked_asm!(
-        "pushl %esi",
-        "movl 8(%esp), %esi",     // ESI = gfx_dir
-        "pushl 12(%esp)",         // push name (callee cleans via RET 0x4)
-        "calll *({addr})",
-        "popl %esi",
-        "retl",
-        addr = sym GFX_LOAD_IMAGE_ADDR,
-        options(att_syntax),
-    );
+pub unsafe extern "thiscall" fn gfx_dir_stream_destructor(this: *mut GfxDirStream, flags: u32) {
+    // Set vtable to GfxDirStream vtable (matches original behavior)
+    (*this).vtable = rb(va::GFX_DIR_STREAM_VTABLE) as *const GfxDirStreamVtable;
+
+    // Release the cache slot in the parent GfxDir
+    let gfx = (*this).gfx_dir;
+    if !gfx.is_null() {
+        gfx_dir_release_slot(gfx, this);
+    }
+
+    // Reset vtable to the "released" vtable (0x66A198)
+    (*this).vtable = rb(0x0066_A198) as *const GfxDirStreamVtable;
+
+    if (flags & 1) != 0 {
+        crate::wa_alloc::wa_free(this as *mut u8);
+    }
 }
 
-/// Initialize runtime addresses for GfxHandler bridges.
-/// Must be called once at DLL startup.
-pub fn init_addrs() {
-    unsafe {
-        GFX_LOAD_IMAGE_ADDR = rb(va::GFX_DIR_LOAD_IMAGE);
-        GFX_LOAD_DIR_ADDR = rb(va::GFX_DIR_LOAD_DIR);
+/// Pure Rust implementation of GfxDirStream read (vtable slot 5, 0x5662F0).
+///
+/// Reads `size` bytes from the stream into `dest` by delegating to the
+/// parent GfxDir's file I/O vtable methods.
+#[cfg(target_arch = "x86")]
+pub unsafe extern "thiscall" fn gfx_dir_stream_read(
+    this: *mut GfxDirStream,
+    dest: *mut u8,
+    size: u32,
+) {
+    let gfx = (*this).gfx_dir;
+    if gfx.is_null() {
+        return;
     }
+    gfx_dir_stream_read_inner(gfx, (*this).slot_index, dest, size);
 }
 
-/// Returns the rebased runtime address for GfxHandler__LoadDir.
-/// Used by callers that pass the address to `call_gfx_load_dir`.
-pub fn gfx_load_dir_addr() -> u32 {
-    unsafe { GFX_LOAD_DIR_ADDR }
+/// Pure Rust implementation of GfxDir__LoadImage (0x5666D0).
+///
+/// Convention: usercall(ESI=gfx_dir) + 1 stack(name), RET 0x4.
+///
+/// Looks up `name` in the GfxDir's hash table, allocates a cache slot,
+/// creates a GfxDirStream for sequential reading, and returns it.
+/// Returns null if no free slots or name not found.
+#[cfg(target_arch = "x86")]
+pub unsafe fn gfx_dir_load_image(
+    gfx_dir: *mut GfxDir,
+    name: *const core::ffi::c_char,
+) -> *mut GfxDirStream {
+    // Check if there are free cache slots
+    if (*gfx_dir).slot_count == 0 {
+        return core::ptr::null_mut();
+    }
+
+    // Look up the entry
+    let entry = gfx_dir_find_entry(name, gfx_dir);
+    if entry.is_null() {
+        return core::ptr::null_mut();
+    }
+    let entry = entry as *const GfxDirEntry;
+
+    // Pop a free slot from index_table
+    (*gfx_dir).slot_count -= 1;
+    let slot_idx = (*gfx_dir).index_table[(*gfx_dir).slot_count as usize];
+
+    // Push to in-use list
+    let inuse_pos = (*gfx_dir).inuse_count as usize;
+    (*gfx_dir).inuse_slots[inuse_pos] = slot_idx;
+    (*gfx_dir).inuse_count += 1;
+
+    // Allocate the 0xC-byte GfxDirStream object
+    let stream = wa_malloc(0xC) as *mut GfxDirStream;
+    if stream.is_null() {
+        return core::ptr::null_mut();
+    }
+
+    // Initialize stream
+    (*stream).vtable = rb(va::GFX_DIR_STREAM_VTABLE) as *const GfxDirStreamVtable;
+    (*stream).gfx_dir = gfx_dir;
+    (*stream).slot_index = slot_idx;
+
+    // Set up cache slot
+    let slot = &mut (*gfx_dir).cache_slots[slot_idx as usize];
+    slot.stream_ptr = stream;
+    slot.start_offset = (*entry).value;
+    slot.end_offset = (*entry).value.wrapping_add((*entry).data_size);
+    slot.current_pos = (*entry).value;
+
+    stream
 }

crates/openwa-core/src/asset/mod.rs

@@ -0,0 +1 @@
+pub mod gfx_dir;

crates/openwa-core/src/engine/ddgame_constructor.rs

@@ -9,6 +9,10 @@
 
 use super::ddgame::DDGame;
 use crate::address::va;
+use crate::asset::gfx_dir::{
+    call_gfx_find_and_load, call_gfx_load_and_wrap, gfx_dir_load_dir, GfxDir, GfxDirVtable,
+};
+pub use crate::asset::gfx_dir::{gfx_dir_find_entry, gfx_resource_create};
 use crate::audio::active_sound::ActiveSoundTable;
 use crate::audio::dssound::DSSound;
 use crate::audio::music::Music;
@@ -24,10 +28,6 @@ use crate::render::display::gfx::DisplayGfx;
 use crate::render::display::gradient::compute_complex_gradient;
 use crate::render::display::palette::Palette;
 use crate::render::landscape::PCLandscape;
-use crate::render::sprite::gfx_dir::{
-    call_gfx_find_and_load, call_gfx_load_and_wrap, call_gfx_load_dir, GfxDir, GfxDirVtable,
-};
-pub use crate::render::sprite::gfx_dir::{gfx_dir_find_entry, gfx_resource_create};
 use crate::wa_alloc::{wa_malloc, wa_malloc_zeroed};
 
 // ============================================================
@@ -156,7 +156,6 @@ pub fn init_constructor_addrs() {
         LOADING_PROGRESS_TICK_ADDR = rb(va::DDGAME_WRAPPER_LOADING_PROGRESS_TICK);
         GFX_LOAD_SPRITES_ADDR = rb(va::GFX_DIR_LOAD_SPRITES);
     }
-    crate::render::sprite::gfx_dir::init_addrs();
 }
 
 // ── Typed wrappers for WA stdcall functions ────────────────────────────────
@@ -475,12 +474,7 @@ unsafe fn init_graphics_and_resources(
     for (i, path) in paths.iter().enumerate() {
         let fp = fopen(path.as_ptr(), c"rb".as_ptr());
         (*gfx1).file_handle = fp;
-        if !fp.is_null()
-            && call_gfx_load_dir(
-                gfx1 as *mut u8,
-                crate::render::sprite::gfx_dir::gfx_load_dir_addr(),
-            ) != 0
-        {
+        if !fp.is_null() && gfx_dir_load_dir(gfx1 as *mut u8) != 0 {
             gfx_loaded_idx = i as u32;
             break;
         }
@@ -500,8 +494,6 @@ unsafe fn init_graphics_and_resources(
     let game_version = (*game_info).game_version;
     let threshold = if (*wrapper).gfx_mode != 0 { 33 } else { -2i32 };
     if game_version < threshold {
-        use crate::render::sprite::gfx_dir::gfx_load_dir_addr;
-
         let c_digit = if game_version > -3 { b'2' } else { b'1' };
         let mut gfx_c_path = *b"data\\Gfx\\GfxC_3_0.dir\0";
         gfx_c_path[14] = c_digit;
@@ -511,11 +503,10 @@ unsafe fn init_graphics_and_resources(
 
         let fp = fopen(gfx_c_path.as_ptr().cast(), c"rb".as_ptr());
         (*gfx2).file_handle = fp;
-        let load_addr = gfx_load_dir_addr();
-        if fp.is_null() || call_gfx_load_dir(gfx2 as *mut u8, load_addr) == 0 {
+        if fp.is_null() || gfx_dir_load_dir(gfx2 as *mut u8) == 0 {
             let fp2 = fopen(c"data\\Gfx\\Gfx.dir".as_ptr(), c"rb".as_ptr());
             (*gfx2).file_handle = fp2;
-            if fp2.is_null() || call_gfx_load_dir(gfx2 as *mut u8, load_addr) == 0 {
+            if fp2.is_null() || gfx_dir_load_dir(gfx2 as *mut u8) == 0 {
                 panic!("DDGame: couldn't open secondary Gfx.dir");
             }
         }

crates/openwa-core/src/engine/ddgame_wrapper.rs

@@ -1,10 +1,10 @@
+use crate::asset::gfx_dir::GfxDir;
 use crate::audio::dssound::DSSound;
 use crate::engine::ddgame::DDGame;
 use crate::engine::net_bridge::NetBridge;
 use crate::render::display::gfx::DisplayGfx;
 use crate::render::landscape::PCLandscape;
 use crate::render::palette::PaletteContext;
-use crate::render::sprite::gfx_dir::GfxDir;
 use crate::FieldRegistry;
 
 /// Speech name table entry size (0x40 = 64 bytes, null-terminated C string).

crates/openwa-core/src/lib.rs

@@ -28,6 +28,7 @@ pub use openwa_derive::FieldRegistry;
 #[macro_use]
 pub mod macros;
 
+pub mod asset;
 pub mod audio;
 pub mod bitgrid;
 pub mod engine;

crates/openwa-core/src/render/display/font.rs

@@ -4,7 +4,8 @@
 
 use std::ffi::c_char;
 
-use crate::render::{palette::PaletteContext, sprite::gfx_dir::GfxDir};
+use crate::asset::gfx_dir::GfxDir;
+use crate::render::palette::PaletteContext;
 
 /// Font object — 0x1C bytes.
 ///
@@ -222,8 +223,8 @@ pub unsafe fn font_load_from_gfx(
     palette_ctx: *mut PaletteContext,
     name: *const c_char,
 ) -> u32 {
-    use crate::render::sprite::gfx_dir::{
-        call_gfx_load_image, gfx_dir_find_entry, GfxDirEntry, GfxDirStream,
+    use crate::asset::gfx_dir::{
+        gfx_dir_find_entry, gfx_dir_load_image, GfxDirEntry, GfxDirStream,
     };
     use crate::wa_alloc::wa_malloc;
 
@@ -238,12 +239,12 @@ pub unsafe fn font_load_from_gfx(
     }
 
     // 2. Fallback: LoadImage → get_total_size → wa_malloc → read → destroy
-    let image = call_gfx_load_image(gfx_dir, name);
+    let image = gfx_dir_load_image(gfx_dir, name);
     if image.is_null() {
         return 0;
     }
 
-    let size = GfxDirStream::total_size_raw(image);
+    let size = GfxDirStream::get_total_size_raw(image);
 
     // Match the original's allocation: round size up to 4-byte multiple, add 0x20 guard.
     let alloc_size = ((size + 3) & !3u32).wrapping_add(0x20);

crates/openwa-core/src/render/display/gradient.rs

@@ -6,12 +6,12 @@
 //! may have subtle color differences due to the tangled decompiler output.
 
 use crate::address::va;
+use crate::asset::gfx_dir::call_gfx_find_and_load;
+#[cfg(target_arch = "x86")]
+use crate::asset::gfx_dir::GfxDir;
 use crate::bitgrid::{BitGrid, BitGridBaseVtable};
 use crate::engine::ddgame::DDGame;
 use crate::rebase::rb;
-use crate::render::sprite::gfx_dir::call_gfx_find_and_load;
-#[cfg(target_arch = "x86")]
-use crate::render::sprite::gfx_dir::GfxDir;
 #[cfg(target_arch = "x86")]
 use crate::wa_alloc::wa_malloc_struct_zeroed;
 use crate::wa_alloc::{wa_free, wa_malloc};

crates/openwa-core/src/render/display/vtable.rs

@@ -2,6 +2,7 @@ use core::ffi::c_char;
 
 use openwa_core::vtable;
 
+use crate::asset::gfx_dir::GfxDir;
 use crate::fixed::Fixed;
 use crate::render::display::font::{
     font_extend, font_get_info_impl, font_get_metric_impl, font_load_from_gfx,
@@ -9,7 +10,6 @@ use crate::render::display::font::{
 };
 use crate::render::display::layer::Layer;
 use crate::render::display::line_draw::Vertex;
-use crate::render::sprite::gfx_dir::GfxDir;
 use crate::render::sprite::sprite::{LayerSprite, LayerSpriteFrame};
 use crate::render::sprite::sprite_op::SpriteOp;
 use crate::render::SpriteCache;
@@ -1679,10 +1679,10 @@ pub unsafe fn load_sprite_by_name(
     name: *const c_char,
 ) -> i32 {
     use crate::address::va;
+    use crate::asset::gfx_dir::{gfx_dir_load_image, GfxDirStream};
     use crate::rebase::rb;
     use crate::render::display::context::{FastcallResult, RenderContext, Surface};
     use crate::render::palette::{palette_map_color, remap_pixels_through_lut};
-    use crate::render::sprite::gfx_dir::{call_gfx_load_image, GfxDirStream};
 
     use crate::wa_alloc::wa_malloc;
 
@@ -1702,7 +1702,7 @@ pub unsafe fn load_sprite_by_name(
     (*sprite).gfx_dir = gfx_dir;
     (*sprite).palette_ctx = palette_ctx;
 
-    let stream = call_gfx_load_image(gfx_dir, name);
+    let stream = gfx_dir_load_image(gfx_dir, name);
     if stream.is_null() {
         return 0;
     }
@@ -1710,7 +1710,7 @@ pub unsafe fn load_sprite_by_name(
     let display_mode_flag = *(rb(va::G_DISPLAY_MODE_FLAG) as *const u8);
     if display_mode_flag == 0 {
         // The original calls remaining() and discards the result.
-        GfxDirStream::remaining_raw(stream);
+        GfxDirStream::bytes_consumed_raw(stream);
 
         // Read the .spr header as 4+4+2+2 separate calls — matching the
         // original's read granularity may matter for internal stream state.
@@ -1785,7 +1785,7 @@ pub unsafe fn load_sprite_by_name(
 
         // Skip alignment padding: while (remaining() & 3) != 0, read 1 byte.
         loop {
-            let remaining = GfxDirStream::remaining_raw(stream);
+            let remaining = GfxDirStream::bytes_consumed_raw(stream);
             if remaining & 3 == 0 {
                 break;
             }

crates/openwa-core/src/render/landscape.rs

@@ -1,4 +1,4 @@
-use crate::{engine::ddgame::DDGame, render::sprite::gfx_dir::GfxDir};
+use crate::{asset::gfx_dir::GfxDir, engine::ddgame::DDGame};
 
 /// PCLandscape — terrain/landscape subsystem (0xB40 bytes).
 ///

crates/openwa-core/src/render/sprite/mod.rs

@@ -1,5 +1,4 @@
 pub mod frame_cache;
-pub mod gfx_dir;
 pub mod lzss;
 pub mod spr;
 pub mod sprite;

crates/openwa-core/src/render/sprite/sprite.rs

@@ -1,6 +1,5 @@
-use crate::render::{
-    display::gfx::DisplayGfx, palette::PaletteContext, sprite::gfx_dir::GfxDir, SpriteCache,
-};
+use crate::asset::gfx_dir::GfxDir;
+use crate::render::{display::gfx::DisplayGfx, palette::PaletteContext, SpriteCache};
 
 // Re-export sprite types from their own modules to keep this file focused on struct layouts.
 pub use super::sprite_id::KnownSpriteId;

crates/openwa-dll/src/replacements/ddgame_init.rs

@@ -14,6 +14,9 @@
 use crate::hook;
 use core::ffi::c_char;
 use openwa_core::address::va;
+use openwa_core::asset::gfx_dir::{
+    gfx_dir_find_entry, gfx_dir_load_dir, gfx_resource_create, GfxDir,
+};
 use openwa_core::bitgrid::BitGrid;
 use openwa_core::engine::game_state_init::{
     check_weapon_avail, init_alliance_data, init_landscape_flags, init_team_scoring,
@@ -22,9 +25,6 @@ use openwa_core::engine::game_state_init::{
 use openwa_core::engine::{
     ddgame_init_fields, ddgame_init_render_indices, display_layer_color_init, DDGame, DDGameWrapper,
 };
-use openwa_core::render::sprite::gfx_dir::{
-    gfx_dir_find_entry, gfx_dir_load_dir, gfx_resource_create, GfxDir,
-};
 
 // ─── DDGame__InitFields (0x526120) ──────────────────────────────────────────
 

crates/openwa-dll/src/replacements/gfx_dir.rs

@@ -0,0 +1,65 @@
+//! GfxDir and GfxDirStream vtable replacements + LoadImage hook.
+//!
+//! Replaces the file I/O and stream vtable methods with Rust implementations,
+//! and hooks GfxDir__LoadImage for any remaining WA callers.
+
+use core::ffi::c_char;
+use openwa_core::address::va;
+use openwa_core::asset::gfx_dir::{
+    gfx_dir_load_cached, gfx_dir_load_image, gfx_dir_read, gfx_dir_release, gfx_dir_seek,
+    gfx_dir_stream_bytes_consumed, gfx_dir_stream_destructor, gfx_dir_stream_get_total_size,
+    gfx_dir_stream_has_data, gfx_dir_stream_read, gfx_dir_stream_seek, GfxDir, GfxDirStream,
+};
+use openwa_core::log::log_line;
+
+// ─── GfxDir__LoadImage (0x5666D0) ───────────────────────────────────────────
+// Convention: usercall(ESI=gfx_dir) + 1 stack(name), RET 0x4.
+
+extern "cdecl" fn impl_load_image(gfx_dir: *mut GfxDir, name: *const c_char) -> *mut GfxDirStream {
+    unsafe { gfx_dir_load_image(gfx_dir, name) }
+}
+
+#[unsafe(naked)]
+unsafe extern "C" fn load_image_trampoline() {
+    core::arch::naked_asm!(
+        "push edx",
+        "push [esp+8]",     // name (stack param, shifted by push edx)
+        "push esi",          // gfx_dir (ESI)
+        "call {impl_fn}",
+        "add esp, 8",
+        "pop edx",
+        "ret 0x4",           // callee cleans 1 stack param
+        impl_fn = sym impl_load_image,
+    );
+}
+
+pub fn install() -> Result<(), String> {
+    use openwa_core::vtable_replace;
+
+    vtable_replace!(openwa_core::asset::gfx_dir::GfxDirVtable, va::GFX_DIR_VTABLE, {
+        read => gfx_dir_read,
+        seek => gfx_dir_seek,
+        load_cached => gfx_dir_load_cached,
+        release => gfx_dir_release,
+    })?;
+
+    vtable_replace!(openwa_core::asset::gfx_dir::GfxDirStreamVtable, va::GFX_DIR_STREAM_VTABLE, {
+        destructor => gfx_dir_stream_destructor,
+        has_data => gfx_dir_stream_has_data,
+        bytes_consumed => gfx_dir_stream_bytes_consumed,
+        seek => gfx_dir_stream_seek,
+        get_total_size => gfx_dir_stream_get_total_size,
+        read => gfx_dir_stream_read,
+    })?;
+
+    unsafe {
+        crate::hook::install(
+            "GfxDir__LoadImage",
+            va::GFX_DIR_LOAD_IMAGE,
+            load_image_trampoline as *const (),
+        )?;
+    }
+
+    let _ = log_line("[GfxDir] All vtable methods + LoadImage replaced");
+    Ok(())
+}

crates/openwa-dll/src/replacements/mod.rs

@@ -7,6 +7,7 @@ mod frame_hook;
 mod frontend;
 mod game_session;
 mod game_state_hooks;
+mod gfx_dir;
 mod hardware_init;
 mod headless;
 mod music;
@@ -59,6 +60,7 @@ pub fn install_all() -> Result<(), String> {
     speech::install()?;
     music::install()?;
     ddgame_init::install()?;
+    gfx_dir::install()?;
     game_state_hooks::install()?;
     replay::install()?;
     task::install()?;

crates/openwa-dll/src/replacements/render/display_vtable.rs

@@ -4,6 +4,7 @@
 use core::ffi::c_char;
 
 use openwa_core::address::va;
+use openwa_core::asset::gfx_dir::GfxDir;
 use openwa_core::bitgrid::DisplayBitGrid;
 use openwa_core::fixed::Fixed;
 use openwa_core::rebase::rb;
@@ -11,7 +12,6 @@ use openwa_core::render::display::destructor as display_destructor;
 use openwa_core::render::display::vtable::{self as display_vtable_impl, DisplayGfxVtable};
 use openwa_core::render::display::DisplayBase;
 use openwa_core::render::display::DisplayGfx;
-use openwa_core::render::sprite::gfx_dir::GfxDir;
 use openwa_core::render::SpriteOp;
 use openwa_core::vtable::patch_vtable;
 use openwa_core::vtable_replace;