feat: port DisplayGfx font vtable methods (slots 7-10, 36) to Rust

Port 5 font-related DisplayGfx vtable methods as thin wrappers that
validate font_id bounds, look up the font object, then delegate to
the internal WA font functions via naked asm bridges.

- Slot 7: draw_text_on_bitmap (usercall EAX=bitmap, EDX=a8, ESI=font)
- Slot 8: get_font_info (usercall EAX=font, EDX=out2, EDI=out1)
- Slot 9: get_font_metric (usercall AL=char, EDX=out1, EDI=out2)
- Slot 10: set_font_param (usercall ECX=p4, EDX=font)
- Slot 36: set_font_palette (usercall ESI=font)

Also fixes vtable param counts for slots 8 and 9, adds 0x3C (CMP AL)
to valid startup check prologues, and adds FONT_OBJ_* address constants.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/address.rs

@@ -241,6 +241,19 @@ pub mod va {
             fn/Thiscall DISPLAY_GFX_LOAD_SPRITE_EX = 0x0052_3310;
         }
 
+        class "Font" {
+            /// Font object: draw text — usercall(EAX=h_align, EDX=bitmap, ESI=font_obj) + 5 stack, RET 0x14
+            fn/Usercall FONT_OBJ_DRAW_TEXT = 0x004F_A4E0;
+            /// Font object: set param — usercall(ECX=p4, EDX=font_obj) + 2 stack(p3, p5), RET 0x8
+            fn/Usercall FONT_OBJ_SET_PARAM = 0x004F_A720;
+            /// Font object: get metric — usercall(AL=char, EDX=out1, EDI=out2) + 1 stack(font_obj), RET 0x4
+            fn/Usercall FONT_OBJ_GET_METRIC = 0x004F_A780;
+            /// Font object: get info — usercall(EAX=font_obj, EDX=out2, EDI=out1), plain RET
+            fn/Usercall FONT_OBJ_GET_INFO = 0x004F_A7D0;
+            /// Font object: set palette — usercall(ESI=font_obj) + 1 stack(palette_value), RET 0x4
+            fn/Usercall FONT_OBJ_SET_PALETTE = 0x004F_9F20;
+        }
+
         /// "sprite" type-tag string in .rdata — returned by Sprite/SpriteBank GetInfo
         global STR_SPRITE = 0x0066_4170;
 

crates/openwa-core/src/render/display/vtable.rs

@@ -75,11 +75,25 @@ pub struct DisplayVtable {
         a8: i32,
     ) -> i32,
     /// get font info for a font slot (0x523790, RET 0xC)
+    ///
+    /// Reads two signed shorts from the font object and writes them to output pointers.
+    /// Returns 1 on success, 0 if font_id is out of range or font slot is empty.
     #[slot(8)]
-    pub get_font_info: fn(this: *mut DisplayGfx, font_id: i32, p3: u32) -> u32,
-    /// get font metric (0x523750, RET 0x10)
+    pub get_font_info:
+        fn(this: *mut DisplayGfx, font_id: i32, out_1: *mut u32, out_2: *mut u32) -> u32,
+    /// get font metric for a character (0x523750, RET 0x10)
+    ///
+    /// Queries character metrics from the font object. `char_code` is passed
+    /// as a byte (low 8 bits). Returns result via two output pointers.
+    /// Returns 1 on success, 0 if font_id is out of range or font slot is empty.
     #[slot(9)]
-    pub get_font_metric: fn(this: *mut DisplayGfx, font_id: i32, p3: u32, p4: u32) -> u32,
+    pub get_font_metric: fn(
+        this: *mut DisplayGfx,
+        font_id: i32,
+        char_code: u32,
+        out_1: *mut u32,
+        out_2: *mut u32,
+    ) -> u32,
     /// set font rendering parameter (0x523710, RET 0x10)
     #[slot(10)]
     pub set_font_param: fn(this: *mut DisplayGfx, font_id: i32, p3: u32, p4: u32, p5: u32) -> u32,

crates/openwa-dll/src/replacements/render.rs

@@ -1306,6 +1306,259 @@ unsafe extern "thiscall" fn draw_scaled_sprite(
     }
 }
 
+// =========================================================================
+// Font vtable method bridges and implementations
+// =========================================================================
+//
+// Font methods are thin wrappers: validate font_id (1..31), check font slot
+// is populated, then delegate to an internal usercall function on the font
+// object. The font object pointer is stored at DisplayBase+0x309C[font_id].
+
+/// Port of DisplayGfx::SetFontPalette (vtable slot 36, 0x523690).
+///
+/// Loads font object from font_table[font_count], then calls
+/// Font__SetPalette (0x4f9f20): usercall(ESI=font_obj) + stack(palette_value), RET 0x4.
+///
+/// The original has NO bounds check on font_count — it trusts the caller.
+unsafe extern "thiscall" fn set_font_palette(
+    this: *mut DisplayGfx,
+    font_count: u32,
+    palette_value: u32,
+) {
+    let font_obj = (*this).base.font_table[font_count as usize];
+    wa_font_set_palette(font_obj, palette_value, rb(va::FONT_OBJ_SET_PALETTE));
+}
+
+/// Bridge to Font__SetPalette (0x4f9f20).
+/// Usercall: ESI=font_obj, stack(palette_value), RET 0x4.
+#[unsafe(naked)]
+unsafe extern "cdecl" fn wa_font_set_palette(_font_obj: u32, _palette_value: u32, _target: u32) {
+    core::arch::naked_asm!(
+        "push esi",
+        "mov esi, [esp+8]",        // font_obj
+        "mov ecx, [esp+16]",       // target
+        "push dword ptr [esp+12]", // palette_value
+        "call ecx",                // RET 0x4 cleans 1 param
+        "pop esi",
+        "ret",
+    );
+}
+
+/// Port of DisplayGfx::SetFontParam (vtable slot 10, 0x523710).
+///
+/// Validates font_id, then calls Font__SetParam (0x4fa720):
+/// usercall(ECX=p4, EDX=font_obj) + stack(p3, p5), RET 0x8.
+unsafe extern "thiscall" fn set_font_param(
+    this: *mut DisplayGfx,
+    font_id: i32,
+    p3: u32,
+    p4: u32,
+    p5: u32,
+) -> u32 {
+    if !(1..=31).contains(&font_id) {
+        return 0;
+    }
+    let font_obj = (*this).base.font_table[font_id as usize];
+    if font_obj == 0 {
+        return 0;
+    }
+    wa_font_set_param(font_obj, p3, p4, p5, rb(va::FONT_OBJ_SET_PARAM));
+    1
+}
+
+/// Bridge to Font__SetParam (0x4fa720).
+/// Usercall: ECX=p4, EDX=font_obj, stack(p3, p5), RET 0x8.
+#[unsafe(naked)]
+unsafe extern "cdecl" fn wa_font_set_param(
+    _font_obj: u32,
+    _p3: u32,
+    _p4: u32,
+    _p5: u32,
+    _target: u32,
+) {
+    core::arch::naked_asm!(
+        "mov edx, [esp+4]",        // font_obj → EDX
+        "mov ecx, [esp+12]",       // p4 → ECX
+        "mov eax, [esp+20]",       // target
+        "push dword ptr [esp+16]", // p5
+        "push dword ptr [esp+12]", // p3 (shifted +4 by push)
+        "call eax",                // RET 0x8 cleans 2 params
+        "ret",
+    );
+}
+
+/// Port of DisplayGfx::GetFontInfo (vtable slot 8, 0x523790).
+///
+/// Validates font_id, then calls Font__GetInfo (0x4fa7d0):
+/// usercall(EAX=font_obj, EDX=out_1, EDI=out_2), plain RET.
+unsafe extern "thiscall" fn get_font_info(
+    this: *mut DisplayGfx,
+    font_id: i32,
+    out_1: *mut u32,
+    out_2: *mut u32,
+) -> u32 {
+    if !(1..=31).contains(&font_id) {
+        return 0;
+    }
+    let font_obj = (*this).base.font_table[font_id as usize];
+    if font_obj == 0 {
+        return 0;
+    }
+    wa_font_get_info(font_obj, out_1, out_2, rb(va::FONT_OBJ_GET_INFO))
+}
+
+/// Bridge to Font__GetInfo (0x4fa7d0).
+/// Usercall: EAX=font_obj, EDX=out_2, EDI=out_1, no stack params, plain RET.
+///
+/// Register mapping verified from caller at 0x523790:
+///   EDX ← [ESP+0xC] = out_2 (3rd vtable param)
+///   EDI ← [ESP+0x8] after PUSH EDI = out_1 (2nd vtable param)
+#[unsafe(naked)]
+unsafe extern "cdecl" fn wa_font_get_info(
+    _font_obj: u32,
+    _out_1: *mut u32,
+    _out_2: *mut u32,
+    _target: u32,
+) -> u32 {
+    core::arch::naked_asm!(
+        "push edi",
+        "mov eax, [esp+8]",  // font_obj → EAX
+        "mov edx, [esp+16]", // out_2 → EDX
+        "mov edi, [esp+12]", // out_1 → EDI
+        "mov ecx, [esp+20]", // target
+        "call ecx",          // plain RET
+        "pop edi",
+        "ret",
+    );
+}
+
+/// Port of DisplayGfx::GetFontMetric (vtable slot 9, 0x523750).
+///
+/// Validates font_id, then calls Font__GetMetric (0x4fa780):
+/// usercall(AL=char_code, EDX=out_1, EDI=out_2) + stack(font_obj), RET 0x4.
+unsafe extern "thiscall" fn get_font_metric(
+    this: *mut DisplayGfx,
+    font_id: i32,
+    char_code: u32,
+    out_1: *mut u32,
+    out_2: *mut u32,
+) -> u32 {
+    if !(1..=31).contains(&font_id) {
+        return 0;
+    }
+    let font_obj = (*this).base.font_table[font_id as usize];
+    if font_obj == 0 {
+        return 0;
+    }
+    wa_font_get_metric(
+        font_obj,
+        char_code,
+        out_1,
+        out_2,
+        rb(va::FONT_OBJ_GET_METRIC),
+    )
+}
+
+/// Bridge to Font__GetMetric (0x4fa780).
+/// Usercall: AL=char_code, EDX=out_1, EDI=out_2, stack(font_obj), RET 0x4.
+#[unsafe(naked)]
+unsafe extern "cdecl" fn wa_font_get_metric(
+    _font_obj: u32,
+    _char_code: u32,
+    _out_1: *mut u32,
+    _out_2: *mut u32,
+    _target: u32,
+) -> u32 {
+    core::arch::naked_asm!(
+        "push edi",
+        "mov al, [esp+12]",       // char_code (byte) → AL
+        "mov edx, [esp+16]",      // out_1 → EDX
+        "mov edi, [esp+20]",      // out_2 → EDI
+        "mov ecx, [esp+24]",      // target
+        "push dword ptr [esp+8]", // font_obj → stack (shifted +4 by push edi)
+        "call ecx",               // RET 0x4 cleans 1 param
+        "pop edi",
+        "ret",
+    );
+}
+
+/// Port of DisplayGfx::DrawTextOnBitmap (vtable slot 7, 0x5236B0).
+///
+/// Extracts font_id from low 16 bits, extra flags from high 16 bits.
+/// Validates font_id, then calls Font__DrawText (0x4fa4e0):
+/// usercall(EAX=bitmap, EDX=a8, ESI=font_obj) + stack(h_align, v_align, msg, a7, high_bits), RET 0x14.
+///
+/// Calling convention verified by tracing the wrapper at 0x5236B0:
+///   EAX receives bitmap (loaded last via [ESP+0x20] after 5 pushes)
+///   EDX receives a8 (loaded via [ESP+0x30] after 4 pushes)
+///   Stack params pushed: h_align, v_align, msg, a7, high_bits
+unsafe extern "thiscall" fn draw_text_on_bitmap(
+    this: *mut DisplayGfx,
+    font_id: i32,
+    bitmap: i32,
+    h_align: i32,
+    v_align: i32,
+    msg: *const core::ffi::c_char,
+    a7: i32,
+    a8: i32,
+) -> i32 {
+    let font_id_low = (font_id as u32) & 0xFFFF;
+    if !(1..=31).contains(&font_id_low) {
+        return 0;
+    }
+    let font_obj = (*this).base.font_table[font_id_low as usize];
+    if font_obj == 0 {
+        return 0;
+    }
+    let font_id_high = ((font_id as u32) >> 16) as i32;
+    wa_font_draw_text(
+        font_obj,
+        bitmap,
+        a8,
+        h_align,
+        v_align,
+        msg,
+        a7,
+        font_id_high,
+        rb(va::FONT_OBJ_DRAW_TEXT),
+    )
+}
+
+/// Bridge to Font__DrawText (0x4fa4e0).
+/// Usercall: EAX=bitmap, EDX=a8, ESI=font_obj, stack(h_align, v_align, msg, a7, high_bits), RET 0x14.
+#[unsafe(naked)]
+unsafe extern "cdecl" fn wa_font_draw_text(
+    _font_obj: u32,
+    _bitmap: i32,
+    _a8: i32,
+    _h_align: i32,
+    _v_align: i32,
+    _msg: *const core::ffi::c_char,
+    _a7: i32,
+    _high_bits: i32,
+    _target: u32,
+) -> i32 {
+    core::arch::naked_asm!(
+        "push esi",
+        // After push esi: +8=font_obj, +12=bitmap, +16=a8, +20=h_align,
+        //   +24=v_align, +28=msg, +32=a7, +36=high_bits, +40=target
+        "mov esi, [esp+8]",  // font_obj → ESI
+        "mov eax, [esp+12]", // bitmap → EAX
+        "mov edx, [esp+16]", // a8 → EDX
+        "mov ecx, [esp+40]", // target
+        // Push 5 stack params in reverse order. Each push shifts ESP by -4,
+        // and the next param is 4 bytes lower, so the offset stays constant.
+        "push dword ptr [esp+36]", // high_bits
+        "push dword ptr [esp+36]", // a7
+        "push dword ptr [esp+36]", // msg
+        "push dword ptr [esp+36]", // v_align
+        "push dword ptr [esp+36]", // h_align
+        "call ecx",                // RET 0x14 cleans 5 params
+        "pop esi",
+        "ret",
+    );
+}
+
 // ---------------------------------------------------------------------------
 // Display installation
 // ---------------------------------------------------------------------------
@@ -1347,6 +1600,10 @@ fn install_display() -> Result<(), String> {
             set_layer_color     => display_vtable::set_layer_color,
             set_active_layer    => display_vtable::set_active_layer,
             get_sprite_info     => display_vtable::get_sprite_info,
+            draw_text_on_bitmap => draw_text_on_bitmap,
+            get_font_info       => get_font_info,
+            get_font_metric     => get_font_metric,
+            set_font_param      => set_font_param,
             draw_polyline       => display_vtable::draw_polyline,
             draw_line           => display_vtable::draw_line,
             draw_line_clipped   => display_vtable::draw_line_clipped,
@@ -1363,9 +1620,10 @@ fn install_display() -> Result<(), String> {
             draw_scaled_sprite  => draw_scaled_sprite,
             set_layer_visibility => display_vtable::set_layer_visibility,
             update_palette      => display_vtable::update_palette,
+            set_font_palette    => set_font_palette,
             slot 19 => blit_sprite,
         })?;
-        let _ = log_line("[Display]   DisplayGfx: patched 21 methods -> Rust");
+        let _ = log_line("[Display]   DisplayGfx: patched 26 methods -> Rust");
     }
 
     Ok(())

crates/openwa-dll/src/startup_checks.rs

@@ -15,6 +15,7 @@ use openwa_core::registry::{self, AddrKind};
 const VALID_PROLOGUES: &[u8] = &[
     0x2B, // sub reg, r/m32 (e.g. SpriteBank__GetInfo starts with SUB EAX, [ECX+8])
     0x33, // xor reg, reg
+    0x3C, // cmp al, imm8 (usercall with AL input, e.g. Font__GetMetric)
     0x51, // push ecx
     0x52, // push edx
     0x53, // push ebx