feat: port WavPlayer and speech/fanfare functions to pure Rust

Replace all 3 WavPlayer asm bridges (Stop, Play, LoadAndPlay) with Rust
implementations using hound for WAV parsing and the windows crate for
DirectSound. Hook them globally to avoid CRT heap mismatch between WA's
msvcr80 and our ucrt.

Port PlayFanfare_CurrentTeam from passthrough to full replacement
(team index lookup + fanfare path building). Eliminates all remaining
WA.exe function calls from the speech/fanfare system.

Move game logic from wormkit speech.rs into openwa-core:
- audio/wav_player.rs: WavPlayer struct, stop/play/load_and_play
- audio/speech_ops.rs: PlayFeSfx, PlayFanfare, speech bank loading,
team config name lookup table

Wormkit speech.rs now contains only hook trampolines, logging shims,
and install().

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/audio/mod.rs

@@ -5,7 +5,9 @@ pub mod music;
 pub mod sound_id;
 pub mod sound_ops;
 pub mod speech;
+pub mod speech_ops;
 pub mod streaming;
+pub mod wav_player;
 
 pub use active_sound::{ActiveSoundEntry, ActiveSoundTable};
 pub use dssound::{

crates/openwa-core/src/audio/speech_ops.rs

@@ -0,0 +1,429 @@
+//! Speech / fanfare / FE SFX operations.
+//!
+//! Pure Rust reimplementations of WA.exe speech and fanfare functions.
+//! Called from wormkit hook trampolines.
+//!
+//! Original WA functions:
+//! - PlayFeSfx (0x4D7960)
+//! - PlayFanfare_Default (0x4D7500)
+//! - PlayFanfare (0x4D7630)
+//! - PlayFanfare_CurrentTeam (0x4D78E0)
+//! - FindCurrentTeamIndex (0x46A7D0)
+//! - GetTeamConfigName (0x4A62A0)
+//! - DDGameWrapper__LoadSpeechWAV (0x571530)
+//! - DSSound_LoadSpeechBank (0x571660)
+//! - DSSound_LoadAllSpeechBanks (0x571A70)
+
+use std::ffi::{c_char, CStr};
+
+use heapless::CString;
+
+use crate::address::va::{self, game_info_offsets};
+use crate::audio::wav_player::{self, WavPlayer};
+use crate::audio::{SpeechLineTableEntry, SpeechSlotTable};
+use crate::engine::ddgame_wrapper::SPEECH_NAME_ENTRY_SIZE;
+use crate::engine::DDGameWrapper;
+use crate::rebase::rb;
+
+/// Windows MAX_PATH (260 bytes including nul terminator).
+const MAX_PATH: usize = 260;
+
+// ============================================================
+// Team config name lookup (port of GetTeamConfigName 0x4A62A0)
+// ============================================================
+
+/// Team config names indexed 0-48, matching WA.exe's jump table at 0x4A62A0.
+/// Used for fanfare WAV file paths (e.g. "user\Fanfare\Finland.wav").
+/// Note: "Leichtenstein" is WA's original misspelling — must match for file lookup.
+const TEAM_CONFIG_NAMES: [&str; 49] = [
+    "UK",             // 0
+    "Argentina",      // 1
+    "Australia",      // 2
+    "Austria",        // 3
+    "Belgium",        // 4
+    "Brazil",         // 5
+    "Canada",         // 6
+    "Croatia",        // 7
+    "Simple",         // 8
+    "Cyprus",         // 9
+    "Simple",         // 10
+    "Denmark",        // 11
+    "Finland",        // 12
+    "France",         // 13
+    "Simple",         // 14
+    "Germany",        // 15
+    "Greece",         // 16
+    "Simple",         // 17
+    "Hungary",        // 18
+    "Iceland",        // 19
+    "India",          // 20
+    "Simple",         // 21
+    "Psycho Laugh",   // 22
+    "Psycho Laugh",   // 23
+    "Ireland",        // 24
+    "Israel",         // 25
+    "Italy",          // 26
+    "Japan",          // 27
+    "Leichtenstein",  // 28
+    "Luxembourg",     // 29
+    "Simple",         // 30
+    "Malta",          // 31
+    "Mexico",         // 32
+    "Morocco",        // 33
+    "Netherlands",    // 34
+    "New Zealand",    // 35
+    "Norway",         // 36
+    "Poland",         // 37
+    "Portugal",       // 38
+    "Simple",         // 39
+    "Romania",        // 40
+    "Russia",         // 41
+    "Singapore",      // 42
+    "South Africa",   // 43
+    "Spain",          // 44
+    "Sweden",         // 45
+    "Switzerland",    // 46
+    "Turkey",         // 47
+    "USA",            // 48
+];
+
+/// Look up a team config name by team_type (1-49). Returns "Simple" for out-of-range.
+pub fn team_config_name(team_type: u32) -> &'static str {
+    if (1..=49).contains(&team_type) {
+        TEAM_CONFIG_NAMES[(team_type - 1) as usize]
+    } else {
+        "Simple"
+    }
+}
+
+// ============================================================
+// WavPlayer access helper
+// ============================================================
+
+/// Get a pointer to the WavPlayer struct at a global address.
+#[inline]
+unsafe fn wav_player_at(ghidra_addr: u32) -> *mut WavPlayer {
+    rb(ghidra_addr) as *mut WavPlayer
+}
+
+// ============================================================
+// PlayFeSfx — port of 0x4D7960
+// ============================================================
+
+/// Build "fesfx\<name>.wav" path and play on the FESFX WavPlayer.
+pub unsafe fn play_fe_sfx(sfx_name: &str) {
+    let mut path = CString::<MAX_PATH>::new();
+    let _ = path.extend_from_bytes(b"fesfx\\");
+    let _ = path.extend_from_bytes(sfx_name.as_bytes());
+    let _ = path.extend_from_bytes(b".wav");
+
+    let player = wav_player_at(va::FESFX_WAV_PLAYER);
+    wav_player::wav_player_stop(player);
+    wav_player::wav_player_load_and_play(player, path.as_ptr(), 0);
+    wav_player::wav_player_play(player, 0);
+}
+
+// ============================================================
+// PlayFanfare_Default — port of 0x4D7500
+// ============================================================
+
+/// Look up team config name, build fanfare path, play on FANFARE WavPlayer.
+pub unsafe fn play_fanfare_default(team_type: u32) {
+    let name = team_config_name(team_type);
+
+    let wa_path = CStr::from_ptr(rb(va::WA_DATA_PATH) as *const i8)
+        .to_str()
+        .unwrap_or(".");
+
+    let mut path = CString::<MAX_PATH>::new();
+    let _ = path.extend_from_bytes(wa_path.as_bytes());
+    let _ = path.extend_from_bytes(b"\\user\\Fanfare\\");
+    let _ = path.extend_from_bytes(name.as_bytes());
+    let _ = path.extend_from_bytes(b".wav");
+
+    let player = wav_player_at(va::FANFARE_WAV_PLAYER);
+    wav_player::wav_player_stop(player);
+    wav_player::wav_player_load_and_play(player, path.as_ptr(), 0);
+    wav_player::wav_player_play(player, 0);
+}
+
+// ============================================================
+// PlayFanfare — port of 0x4D7630
+// ============================================================
+
+/// Build the fanfare WAV path and play it on the FANFARE player.
+/// Falls back to `play_fanfare_default` if loading fails.
+pub unsafe fn play_fanfare(team_type: u32, has_custom_path: bool) {
+    let name = team_config_name(team_type);
+
+    let mut path = CString::<MAX_PATH>::new();
+    if has_custom_path {
+        let custom_path = CStr::from_ptr(rb(0x0088_E282) as *const i8)
+            .to_str()
+            .unwrap_or(".");
+        let _ = path.extend_from_bytes(custom_path.as_bytes());
+        let _ = path.extend_from_bytes(b"\\user\\Fanfare\\");
+        let _ = path.extend_from_bytes(name.as_bytes());
+        let _ = path.extend_from_bytes(b".wav");
+    } else {
+        let _ = path.extend_from_bytes(b"user\\Fanfare\\");
+        let _ = path.extend_from_bytes(name.as_bytes());
+        let _ = path.extend_from_bytes(b".wav");
+    }
+
+    let player = wav_player_at(va::FANFARE_WAV_PLAYER);
+    wav_player::wav_player_stop(player);
+    let loaded = wav_player::wav_player_load_and_play(player, path.as_ptr(), 0);
+    if loaded {
+        wav_player::wav_player_play(player, 0);
+    } else {
+        play_fanfare_default(team_type);
+    }
+}
+
+// ============================================================
+// PlayFanfare_CurrentTeam — port of 0x4D78E0
+// ============================================================
+
+/// Find current team index by comparing team names.
+///
+/// Port of FindCurrentTeamIndex (0x46A7D0). Iterates up to 6 team entries
+/// at stride 0xD7B, comparing name at offset +0x627 against the search name.
+unsafe fn find_current_team_index(name_ptr: u32) -> u32 {
+    let name = name_ptr as *const u8;
+    let base = rb(0x0087_7FFC) as *const u8;
+
+    for i in 0u32..6 {
+        let entry = base.add(i as usize * 0xD7B);
+        if *entry.add(0x121) == 0 {
+            continue;
+        }
+        let team_name = entry.add(0x627);
+        if c_str_eq(team_name, name) {
+            return i;
+        }
+    }
+    -1i32 as u32
+}
+
+/// Compare two null-terminated C strings for equality.
+unsafe fn c_str_eq(a: *const u8, b: *const u8) -> bool {
+    let mut i = 0;
+    loop {
+        let ca = *a.add(i);
+        let cb = *b.add(i);
+        if ca != cb {
+            return false;
+        }
+        if ca == 0 {
+            return true;
+        }
+        i += 1;
+    }
+}
+
+/// Read the default team type, find current team, play the fanfare.
+///
+/// Returns 1 on success, 0 if team not found.
+pub unsafe fn play_fanfare_current_team(eax_index: u32) -> u32 {
+    let default_team_type = *(rb(0x0088_DFAC) as *const u32);
+
+    let team_index = find_current_team_index(eax_index);
+    if team_index == -1i32 as u32 {
+        return 0;
+    }
+
+    let custom_types_active = *(rb(0x0087_D0DE) as *const u8);
+    let team_type = if custom_types_active != 0 {
+        let team_data = rb(0x0087_7FFC) as *const u8;
+        let team_type_byte = *team_data.add(team_index as usize * 0xD7B) as i8;
+        let team_types_array = rb(0x0087_7A54) as *const u32;
+        *team_types_array.add(team_type_byte as usize * 0x1E)
+    } else {
+        default_team_type
+    };
+
+    let team_data_2 = rb(0x0087_8093) as *const u8;
+    let has_custom_path = *team_data_2.add(team_index as usize * 0xD7B) != 0;
+
+    play_fanfare(team_type, has_custom_path);
+
+    1
+}
+
+// ============================================================
+// DDGameWrapper__LoadSpeechWAV — port of 0x571530
+// ============================================================
+
+/// Search speech name table for existing WAV, reuse slot if found.
+/// Otherwise load new WAV via DSSound vtable. Returns 1 on success, 0 on failure.
+pub unsafe fn load_speech_wav(
+    ddgw: *mut DDGameWrapper,
+    team_index: u32,
+    line_id: u32,
+    wav_path: *const c_char,
+    full_path: *const c_char,
+) -> u32 {
+    let wrapper = &mut *ddgw;
+    let count = wrapper.speech_name_count as usize;
+    let search_name = core::ffi::CStr::from_ptr(wav_path).to_bytes();
+
+    let mut found_idx: Option<usize> = None;
+    for i in 0..count {
+        let entry = &wrapper.speech_name_table[i];
+        let entry_len = entry.iter().position(|&b| b == 0).unwrap_or(entry.len());
+        if entry[..entry_len] == *search_name {
+            found_idx = Some(i);
+            break;
+        }
+    }
+
+    let ddgame = &mut *wrapper.ddgame;
+    let slot_table = &mut ddgame.speech_slot_table;
+
+    if let Some(idx) = found_idx {
+        slot_table.set(
+            team_index as usize,
+            line_id,
+            idx as u32 + SpeechSlotTable::BUFFER_OFFSET,
+        );
+        return 1;
+    }
+
+    let slot_idx = count as u32 + SpeechSlotTable::BUFFER_OFFSET;
+    let vtable = (*wrapper.sound).vtable;
+    let result = ((*vtable).load_wav)(wrapper.sound, slot_idx as i32, full_path as *const u8);
+
+    if result != 0 {
+        slot_table.set(team_index as usize, line_id, slot_idx);
+
+        let dest = &mut wrapper.speech_name_table[count];
+        let copy_len = search_name.len().min(SPEECH_NAME_ENTRY_SIZE - 1);
+        dest[..copy_len].copy_from_slice(&search_name[..copy_len]);
+        dest[copy_len] = 0;
+
+        wrapper.speech_name_count = (count + 1) as u32;
+        return 1;
+    }
+
+    0
+}
+
+// ============================================================
+// Helpers
+// ============================================================
+
+/// Extract bytes from a null-terminated C string pointer.
+unsafe fn cstr_bytes<'a>(ptr: *const u8) -> &'a [u8] {
+    if ptr.is_null() {
+        return &[];
+    }
+    CStr::from_ptr(ptr as *const i8).to_bytes()
+}
+
+// ============================================================
+// DSSound_LoadSpeechBank — port of 0x571660
+// ============================================================
+
+/// Iterate speech line table, build WAV paths, load each into DSSound.
+/// Falls back to default speech dir on failure.
+pub unsafe fn load_speech_bank(
+    ddgw: *const DDGameWrapper,
+    team_index: u32,
+    speech_base_path: *const u8,
+    speech_dir: *const u8,
+) {
+    let table_base = rb(va::SPEECH_LINE_TABLE) as *const SpeechLineTableEntry;
+    let mut i: usize = 0;
+
+    loop {
+        let entry = &*table_base.add(i);
+
+        if entry.name_ptr.is_null() {
+            return;
+        }
+
+        let name_bytes = cstr_bytes(entry.name_ptr);
+
+        let mut wav_path = CString::<MAX_PATH>::new();
+        let _ = wav_path.extend_from_bytes(cstr_bytes(speech_dir));
+        let _ = wav_path.extend_from_bytes(b"\\");
+        let _ = wav_path.extend_from_bytes(name_bytes);
+        let _ = wav_path.extend_from_bytes(b".wav");
+
+        let mut full_path = CString::<MAX_PATH>::new();
+        let _ = full_path.extend_from_bytes(cstr_bytes(speech_base_path));
+        let _ = full_path.extend_from_bytes(b"\\");
+        let _ = full_path.extend_from_bytes(wav_path.as_bytes());
+
+        let result = load_speech_wav(
+            ddgw as *mut DDGameWrapper,
+            team_index,
+            entry.id,
+            wav_path.as_ptr(),
+            full_path.as_ptr(),
+        );
+
+        if result == 0 {
+            let next_entry = &*table_base.add(i + 1);
+            if next_entry.name_ptr.is_null() || next_entry.id != entry.id {
+                let game_info = (*(*ddgw).ddgame).game_info as *const u8;
+                let default_dir = game_info.add(game_info_offsets::DEFAULT_SPEECH_DIR as usize);
+                let default_base =
+                    game_info.add(game_info_offsets::DEFAULT_SPEECH_BASE_PATH as usize);
+
+                let mut wav_path2 = CString::<MAX_PATH>::new();
+                let _ = wav_path2.extend_from_bytes(cstr_bytes(default_dir));
+                let _ = wav_path2.extend_from_bytes(b"\\");
+                let _ = wav_path2.extend_from_bytes(name_bytes);
+                let _ = wav_path2.extend_from_bytes(b".wav");
+
+                let mut full_path2 = CString::<MAX_PATH>::new();
+                let _ = full_path2.extend_from_bytes(cstr_bytes(default_base));
+                let _ = full_path2.extend_from_bytes(b"\\");
+                let _ = full_path2.extend_from_bytes(wav_path2.as_bytes());
+
+                load_speech_wav(
+                    ddgw as *mut DDGameWrapper,
+                    team_index,
+                    entry.id,
+                    wav_path2.as_ptr(),
+                    full_path2.as_ptr(),
+                );
+            }
+        } else {
+            let current_id = entry.id;
+            while {
+                let next = &*table_base.add(i + 1);
+                !next.name_ptr.is_null() && next.id == current_id
+            } {
+                i += 1;
+            }
+        }
+
+        i += 1;
+    }
+}
+
+// ============================================================
+// DSSound_LoadAllSpeechBanks — port of 0x571A70
+// ============================================================
+
+/// Clear speech slot table, then load speech bank for each team.
+pub unsafe fn load_all_speech_banks(ddgw: *const DDGameWrapper) {
+    let ddgame = &mut *(*ddgw).ddgame;
+
+    ddgame.speech_slot_table.clear();
+
+    let game_info = &*ddgame.game_info;
+    let team_count = game_info.speech_team_count as u32;
+
+    let gi = ddgame.game_info as *const u8;
+    for i in 0..team_count {
+        let team_offset = (i * game_info_offsets::SPEECH_TEAM_STRIDE) as usize;
+        let base_path = gi.add(game_info_offsets::SPEECH_BASE_PATH as usize + team_offset);
+        let dir = gi.add(game_info_offsets::SPEECH_DIR as usize + team_offset);
+
+        load_speech_bank(ddgw, i, base_path, dir);
+    }
+}

crates/openwa-core/src/audio/wav_player.rs

@@ -0,0 +1,343 @@
+//! WavPlayer — standalone WAV playback via DirectSound.
+//!
+//! WA.exe uses WavPlayer instances for frontend SFX, fanfares, and music
+//! playback. Each instance is an 8-byte struct at a fixed global address.
+//! This module provides pure Rust replacements for the three core operations:
+//!
+//! - `WavPlayer_Stop` (0x599670): Release the loaded DirectSound buffer
+//! - `WavPlayer_Play` (0x5996E0): Set volume and start playback
+//! - `WavPlayer_LoadAndPlay` (0x599B40): Parse WAV, create DS buffer, store
+//!
+//! The WavPlayer system uses its own IDirectSound instance (global at
+//! 0x79D654), separate from DSSound's instance.
+
+use std::ffi::{c_char, c_void, CStr, CString};
+
+use windows::Win32::Media::Audio::DirectSound::{
+    IDirectSound, IDirectSoundBuffer, DSBLOCK_ENTIREBUFFER, DSBUFFERDESC,
+};
+use windows::Win32::Media::Audio::{WAVEFORMATEX, WAVE_FORMAT_PCM};
+
+use crate::rebase::rb;
+
+// ============================================================
+// Address constants
+// ============================================================
+
+crate::define_addresses! {
+    /// IDirectSound* for the WavPlayer subsystem (separate from DSSound).
+    /// Null before DirectSound init.
+    global G_WAV_DIRECT_SOUND = 0x0079_D654;
+    /// Master volume for WavPlayer playback (0-100).
+    global G_WAV_MASTER_VOLUME = 0x0069_7704;
+    /// Success sentinel: a result pointer equal to this address means "no error".
+    global G_WAV_RESULT_SUCCESS = 0x008A_C8A0;
+}
+
+/// Volume-to-dB attenuation table (65 entries of i16, indices 0-64).
+/// Copied from WA.exe .rdata at 0x697680.
+/// Index 0 = silence (-10000 cB), index 64 = unity (0 cB).
+/// Used by WavPlayer_Play to convert the 0-100 master volume to DirectSound
+/// hundredths-of-decibels via: `table[(vol * 64) / 100]`.
+const WAV_VOLUME_DB_TABLE: [i16; 65] = [
+    -10000, -6000, -5000, -4415, -4000, -3678, -3415, -3000, -2744, -2522, -2326, -2150, -1991,
+    -1845, -1712, -1589, -1475, -1368, -1268, -1176, -1088, -1006, -928, -855, -786, -720, -658,
+    -599, -543, -490, -439, -390, -344, -299, -256, -216, -177, -139, -104, -70, -38, -7, 24, 54,
+    83, 111, 138, 163, 188, 211, 234, 256, 277, 296, 315, 333, 350, 367, 383, 398, 413, 427, 441,
+    454, 0,
+];
+
+// ============================================================
+// WavPlayer struct layout
+// ============================================================
+
+/// WavPlayer instance (8 bytes at a fixed global address).
+///
+/// Layout matches WA.exe:
+/// - `+0x00`: Pointer to static vtable/type data (0x651CC8)
+/// - `+0x04`: Pointer to WavBuffer (null = nothing loaded)
+#[repr(C)]
+pub struct WavPlayer {
+    pub type_ptr: u32,
+    pub buffer: *mut WavBuffer,
+}
+
+/// Loaded WAV buffer (heap-allocated, owned by the WavPlayer system).
+///
+/// The first two fields must match WA's layout because unhooked WA code
+/// (FUN_005999c0) reads `filename` directly from buffer+4.
+#[repr(C)]
+pub struct WavBuffer {
+    /// Raw IDirectSoundBuffer COM pointer (stored as u32 for FFI).
+    pub ds_buffer: u32,
+    /// Null-terminated filename (C string, allocated via CString::into_raw).
+    pub filename: *mut c_char,
+}
+
+// ============================================================
+// Helpers
+// ============================================================
+
+/// Read the WavPlayer IDirectSound* global. Returns 0 if not initialized.
+#[inline]
+unsafe fn wav_direct_sound_ptr() -> u32 {
+    *(rb(G_WAV_DIRECT_SOUND) as *const u32)
+}
+
+/// Read the WavPlayer master volume (0-100).
+#[inline]
+unsafe fn wav_master_volume() -> u32 {
+    *(rb(G_WAV_MASTER_VOLUME) as *const u32)
+}
+
+/// Read the success sentinel value.
+#[inline]
+pub unsafe fn wav_result_success() -> u32 {
+    *(rb(G_WAV_RESULT_SUCCESS) as *const u32)
+}
+
+/// Reinterpret a `*const u32` (pointing to a stored raw COM pointer) as
+/// `&IDirectSoundBuffer`. The pointer must point to stable memory (e.g. a
+/// struct field), NOT a stack local — the returned reference borrows it.
+#[inline]
+unsafe fn ds_buffer_from_field(field_ptr: *const u32) -> &'static IDirectSoundBuffer {
+    &*(field_ptr as *const IDirectSoundBuffer)
+}
+
+// ============================================================
+// WavPlayer_Stop — port of 0x599670
+// ============================================================
+
+/// Stop and release the loaded DirectSound buffer.
+///
+/// If no buffer is loaded (player.buffer == null), this is a no-op.
+/// Otherwise: releases the DirectSound buffer COM object, frees the
+/// filename string, and deallocates the WavBuffer struct.
+pub unsafe fn wav_player_stop(player: *mut WavPlayer) {
+    let buf = (*player).buffer;
+    if buf.is_null() {
+        return;
+    }
+
+    // Free filename string (was allocated via CString::into_raw)
+    let filename = (*buf).filename;
+    if !filename.is_null() {
+        drop(CString::from_raw(filename));
+    }
+
+    // Stop and release DirectSound buffer
+    let ds_ptr = (*buf).ds_buffer;
+    if wav_direct_sound_ptr() != 0 && ds_ptr != 0 {
+        let ds_buf: IDirectSoundBuffer = core::mem::transmute_copy(&ds_ptr);
+        let _ = ds_buf.Stop();
+        // Drop calls Release()
+    }
+
+    // Free the WavBuffer struct (was allocated via Box::into_raw)
+    drop(Box::from_raw(buf));
+    (*player).buffer = core::ptr::null_mut();
+}
+
+// ============================================================
+// WavPlayer_Play — port of 0x5996E0
+// ============================================================
+
+/// Rewind, set volume, and start playback on the loaded buffer.
+///
+/// The `flags` parameter maps to IDirectSoundBuffer::Play dwFlags
+/// (0 = play once, DSBPLAY_LOOPING = loop). The volume is read from
+/// the global master volume at 0x697704 and converted via the dB table.
+pub unsafe fn wav_player_play(player: *mut WavPlayer, flags: u32) {
+    let ds_raw = wav_direct_sound_ptr();
+    if ds_raw == 0 {
+        return;
+    }
+
+    let buf = (*player).buffer;
+    if buf.is_null() {
+        return;
+    }
+
+    if (*buf).ds_buffer == 0 {
+        return;
+    }
+
+    // Reference the COM pointer from the heap-allocated WavBuffer field
+    // (NOT from a stack copy — that would create a dangling reference).
+    let ds_buf = ds_buffer_from_field(&(*buf).ds_buffer);
+
+    // Rewind to start (port of FUN_00599930's SetCurrentPosition call)
+    let _ = ds_buf.SetCurrentPosition(0);
+
+    // Compute volume: (master_vol * 64) / 100, then look up in dB table
+    let master_vol = wav_master_volume();
+    let idx = ((master_vol << 6) / 100).min(64) as usize;
+    let vol_db = WAV_VOLUME_DB_TABLE[idx] as i32;
+    let _ = ds_buf.SetVolume(vol_db);
+
+    // Play
+    let _ = ds_buf.Play(0, 0, flags);
+}
+
+// ============================================================
+// WavPlayer_LoadAndPlay — port of 0x599B40
+// ============================================================
+
+/// Parse a WAV file, create a DirectSound buffer, and store it in the player.
+///
+/// Uses `hound` for WAV parsing and the `windows` crate for DirectSound.
+/// Only PCM format is supported (WA.exe rejects non-PCM too).
+///
+/// `param3` controls DSBCAPS_GLOBALFOCUS: if >= 0, the flag is set.
+/// All known callers pass 0.
+///
+/// Returns true on success, false on failure.
+pub unsafe fn wav_player_load_and_play(
+    player: *mut WavPlayer,
+    path: *const c_char,
+    param3: i32,
+) -> bool {
+    // Need DirectSound
+    let ds_raw = wav_direct_sound_ptr();
+    if ds_raw == 0 {
+        return false;
+    }
+
+    // Stop and free current buffer
+    wav_player_stop(player);
+
+    // Open WAV file
+    let path_str = match CStr::from_ptr(path).to_str() {
+        Ok(s) => s,
+        Err(_) => return false,
+    };
+    let reader = match hound::WavReader::open(path_str) {
+        Ok(r) => r,
+        Err(_) => return false,
+    };
+    let spec = reader.spec();
+
+    // Only support PCM
+    if spec.sample_format != hound::SampleFormat::Int {
+        return false;
+    }
+
+    // Compute format parameters
+    let block_align = spec.channels * (spec.bits_per_sample / 8);
+    let avg_bytes_per_sec = spec.sample_rate * block_align as u32;
+    let data_len = reader.duration() * block_align as u32;
+
+    if data_len == 0 {
+        return false;
+    }
+
+    // Build WAVEFORMATEX
+    let wfx = WAVEFORMATEX {
+        wFormatTag: WAVE_FORMAT_PCM as u16,
+        nChannels: spec.channels,
+        nSamplesPerSec: spec.sample_rate,
+        nAvgBytesPerSec: avg_bytes_per_sec,
+        nBlockAlign: block_align,
+        wBitsPerSample: spec.bits_per_sample,
+        cbSize: 0,
+    };
+
+    // DSBUFFERDESC flags: DSBCAPS_STATIC (0x40) | DSBCAPS_CTRLVOLUME (0x80)
+    // Plus DSBCAPS_GLOBALFOCUS (0x8000) if param3 >= 0
+    let mut flags: u32 = 0xC0; // STATIC | CTRLVOLUME
+    if param3 >= 0 {
+        flags |= 0x8000; // GLOBALFOCUS
+    }
+
+    let desc = DSBUFFERDESC {
+        dwSize: core::mem::size_of::<DSBUFFERDESC>() as u32,
+        dwFlags: flags,
+        dwBufferBytes: data_len,
+        dwReserved: 0,
+        lpwfxFormat: &wfx as *const _ as *mut _,
+        ..Default::default()
+    };
+
+    // Create secondary buffer
+    let ds: &IDirectSound = &*(&ds_raw as *const u32 as *const IDirectSound);
+    let mut buf_opt: Option<IDirectSoundBuffer> = None;
+    if ds.CreateSoundBuffer(&desc, &mut buf_opt, None).is_err() {
+        return false;
+    }
+    let ds_buf = match buf_opt {
+        Some(b) => b,
+        None => return false,
+    };
+
+    // Lock the entire buffer
+    let mut audio_ptr: *mut c_void = core::ptr::null_mut();
+    let mut audio_len: u32 = 0;
+    if ds_buf
+        .Lock(
+            0,
+            data_len,
+            &mut audio_ptr,
+            &mut audio_len,
+            None,
+            None,
+            DSBLOCK_ENTIREBUFFER,
+        )
+        .is_err()
+    {
+        return false;
+    }
+
+    // Fill with PCM data from the WAV file
+    {
+        let dest = core::slice::from_raw_parts_mut(audio_ptr as *mut u8, audio_len as usize);
+        match spec.bits_per_sample {
+            16 => {
+                // Re-open to get fresh sample iterator
+                if let Ok(mut reader) = hound::WavReader::open(path_str) {
+                    let mut offset = 0usize;
+                    for s in reader.samples::<i16>().flatten() {
+                        if offset + 2 <= dest.len() {
+                            dest[offset..offset + 2].copy_from_slice(&s.to_le_bytes());
+                            offset += 2;
+                        }
+                    }
+                }
+            }
+            8 => {
+                if let Ok(mut reader) = hound::WavReader::open(path_str) {
+                    let mut offset = 0usize;
+                    for s in reader.samples::<i16>().flatten() {
+                        if offset < dest.len() {
+                            dest[offset] = (s + 128) as u8;
+                            offset += 1;
+                        }
+                    }
+                }
+            }
+            _ => {
+                dest.fill(0);
+            }
+        }
+    }
+
+    let _ = ds_buf.Unlock(audio_ptr, audio_len, None, 0);
+
+    // Store filename (CString for proper deallocation in wav_player_stop)
+    let filename = match CString::new(path_str) {
+        Ok(cs) => cs.into_raw(),
+        Err(_) => core::ptr::null_mut(),
+    };
+
+    // Store DS buffer as raw COM pointer (we take ownership)
+    let ds_raw_ptr: u32 = core::mem::transmute_copy(&ds_buf);
+    core::mem::forget(ds_buf); // Don't Release — stored in WavBuffer
+
+    // Allocate WavBuffer and store in player
+    let wav_buf = Box::new(WavBuffer {
+        ds_buffer: ds_raw_ptr,
+        filename,
+    });
+    (*player).buffer = Box::into_raw(wav_buf);
+
+    true
+}

crates/openwa-wormkit/src/replacements/speech.rs

@@ -1,190 +1,112 @@
-//! Speech / fanfare / FE SFX hooks.
+//! Speech / fanfare / FE SFX / WavPlayer hooks.
+//!
+//! Thin hook shims — game logic lives in `openwa_core::audio::speech_ops`
+//! and `openwa_core::audio::wav_player`.
 //!
 //! Hooks:
+//! - WavPlayer_Stop (0x599670): usercall(ESI=player, EDI=&result), plain RET — REPLACED
+//! - WavPlayer_Play (0x5996E0): usercall(EDI=&result) + stack(player, flags), RET 0x8 — REPLACED
+//! - WavPlayer_LoadAndPlay (0x599B40): usercall(ESI=&result) + stack(player, path, param3), RET 0xC — REPLACED
 //! - PlayFeSfx (0x4D7960): stdcall(sfx_name), RET 0x4 — REPLACED
 //! - PlayFanfare_Default (0x4D7500): stdcall(team_type), RET 0x4 — REPLACED
-//! - PlayFanfare_CurrentTeam (0x4D78E0): usercall(EAX=index), plain RET — passthrough
+//! - PlayFanfare_CurrentTeam (0x4D78E0): usercall(EAX=index), plain RET — REPLACED
 //! - DSSound_LoadSpeechBank (0x571660): usercall(EAX=DDGameWrapper) + 3 stack, RET 0xC — REPLACED
 //! - DSSound_LoadAllSpeechBanks (0x571A70): usercall(ESI=DDGameWrapper), plain RET — REPLACED
 
 use std::ffi::{c_char, CStr};
-use std::sync::atomic::{AtomicU32, Ordering};
-
-use heapless::CString;
 
-use openwa_core::address::va::{self, game_info_offsets};
-use openwa_core::audio::SpeechLineTableEntry;
+use openwa_core::address::va;
+use openwa_core::audio::{speech_ops, wav_player};
+use openwa_core::audio::wav_player::WavPlayer;
 use openwa_core::engine::DDGameWrapper;
 use openwa_core::rebase::rb;
 
 use crate::hook::{self, usercall_trampoline};
 use crate::log_line;
 
-/// Windows MAX_PATH (260 bytes including nul terminator).
-const MAX_PATH: usize = 260;
-
 // ============================================================
-// WavPlayerHandle — typed wrapper for WA's WavPlayer instances
+// WavPlayer hook trampolines (usercall → cdecl shims)
 // ============================================================
 
-/// Handle to a WA.exe WavPlayer instance (opaque, unknown size).
-///
-/// Known globals:
-/// - `va::FESFX_WAV_PLAYER` (0x6AC888) — frontend sound effects
-/// - `va::FANFARE_WAV_PLAYER` (0x6AC890) — team fanfares
-#[derive(Clone, Copy)]
-struct WavPlayerHandle(u32);
-
-impl WavPlayerHandle {
-    /// Read a WavPlayerHandle from a Ghidra global address.
-    unsafe fn from_global(ghidra_addr: u32) -> Self {
-        Self(rb(ghidra_addr))
-    }
-
-    /// Stop and release the current DirectSound buffer.
-    /// WavPlayer_Stop: usercall(ESI=player, EDI=&result), plain RET.
-    unsafe fn stop(self) {
-        wav_player_stop_raw(self.0, rb(va::WAV_PLAYER_STOP));
-    }
-
-    /// Open a WAV file, parse RIFF, create DirectSound buffer.
-    /// WavPlayer_LoadAndPlay: usercall(ESI=&result) + stack(player, path, 0), RET 0xC.
-    unsafe fn load(self, path: *const c_char) {
-        wav_player_load_raw(self.0, path.cast(), rb(va::WAV_PLAYER_LOAD_AND_PLAY));
-    }
-
-    /// Play the loaded buffer at the given volume.
-    /// WavPlayer_Play: usercall(EDI=&result) + stack(player, volume), RET 0x8.
-    unsafe fn play(self, volume: u32) {
-        wav_player_play_raw(self.0, volume, rb(va::WAV_PLAYER_PLAY));
-    }
-}
-
-// Naked asm wrappers for WavPlayer usercall functions.
-// ESI/EDI are LLVM-reserved, so we must use naked functions.
-
-/// cdecl(player, func_addr) — sets ESI=player, EDI=&result, calls func.
+// WavPlayer_Stop: usercall(ESI=player, EDI=&result), plain RET.
 #[unsafe(naked)]
-unsafe extern "cdecl" fn wav_player_stop_raw(_player: u32, _func: u32) {
+unsafe extern "C" fn hook_wav_player_stop() {
     core::arch::naked_asm!(
         "push esi",
-        "push edi",
-        "sub esp, 4",          // result on stack
-        "mov esi, [esp + 16]", // player (arg1, past saved esi+edi+result)
-        "lea edi, [esp]",      // &result
-        "call [esp + 20]",     // func (arg2)
-        "add esp, 4",          // drop result
-        "pop edi",
-        "pop esi",
+        "call {impl_fn}",
+        "add esp, 4",
+        "mov eax, [{success_val}]",
+        "mov [edi], eax",
+        "mov eax, edi",
         "ret",
+        impl_fn = sym wav_player_stop_impl,
+        success_val = sym WAV_RESULT_SUCCESS_VALUE,
     );
 }
 
-/// cdecl(player, path, func_addr) — pushes stack params, sets ESI=&result, calls func.
-/// Stack layout after push esi + sub esp,4:
-///   ESP+0=result, +4=saved_esi, +8=retaddr, +12=player, +16=path, +20=func
-/// Callee expects stack params: [ESP+4]=player, [ESP+8]=path, [ESP+12]=0
+unsafe extern "cdecl" fn wav_player_stop_impl(player: *mut WavPlayer) {
+    wav_player::wav_player_stop(player);
+}
+
+// WavPlayer_Play: usercall(EDI=&result) + stack(player, flags), RET 0x8.
 #[unsafe(naked)]
-unsafe extern "cdecl" fn wav_player_load_raw(_player: u32, _path: *const u8, _func: u32) {
+unsafe extern "C" fn hook_wav_player_play() {
     core::arch::naked_asm!(
-        "push esi",
-        "sub esp, 4",     // result on stack
-        "lea esi, [esp]", // ESI = &result
-        // Push in reverse order: 0, path, player
-        "push 0",                  // third param=0 (ESP: +16=player, +20=path, +24=func)
-        "push dword ptr [esp+20]", // second param=path (ESP: +20=player, +24=path, +28=func)
-        "push dword ptr [esp+20]", // first param=player (ESP: +28=path, +32=func)
-        "call dword ptr [esp+32]", // call func; RET 0xC cleans 3 params
-        "add esp, 4",              // drop result
-        "pop esi",
-        "ret",
+        "push dword ptr [esp+8]",
+        "push dword ptr [esp+8]",
+        "call {impl_fn}",
+        "add esp, 8",
+        "mov eax, [{success_val}]",
+        "mov [edi], eax",
+        "mov eax, edi",
+        "ret 0x8",
+        impl_fn = sym wav_player_play_impl,
+        success_val = sym WAV_RESULT_SUCCESS_VALUE,
     );
 }
 
-/// cdecl(player, volume, func_addr) — pushes stack params, sets EDI=&result, calls func.
-/// Stack layout after push edi + sub esp,4:
-///   ESP+0=result, +4=saved_edi, +8=retaddr, +12=player, +16=volume, +20=func
-/// Callee expects stack params: [ESP+4]=player, [ESP+8]=volume
+unsafe extern "cdecl" fn wav_player_play_impl(player: *mut WavPlayer, flags: u32) {
+    wav_player::wav_player_play(player, flags);
+}
+
+// WavPlayer_LoadAndPlay: usercall(ESI=&result) + stack(player, path, param3), RET 0xC.
 #[unsafe(naked)]
-unsafe extern "cdecl" fn wav_player_play_raw(_player: u32, _volume: u32, _func: u32) {
+unsafe extern "C" fn hook_wav_player_load_and_play() {
     core::arch::naked_asm!(
-        "push edi",
-        "sub esp, 4",     // result on stack
-        "lea edi, [esp]", // EDI = &result
-        // Push in reverse order: volume, player
-        "push dword ptr [esp+16]", // second param=volume (ESP: +16=player, +24=func)
-        "push dword ptr [esp+16]", // first param=player (ESP: +28=func)
-        "call dword ptr [esp+28]", // call func; RET 0x8 cleans 2 params
-        "add esp, 4",              // drop result
-        "pop edi",
-        "ret",
+        "push dword ptr [esp+12]",
+        "push dword ptr [esp+12]",
+        "push dword ptr [esp+12]",
+        "call {impl_fn}",
+        "add esp, 12",
+        "test eax, eax",
+        "jz 2f",
+        "mov eax, [{success_val}]",
+        "mov [esi], eax",
+        "mov eax, esi",
+        "ret 0xC",
+        "2:",
+        "mov dword ptr [esi], 0xFFFFFFFF",
+        "mov eax, esi",
+        "ret 0xC",
+        impl_fn = sym wav_player_load_and_play_impl,
+        success_val = sym WAV_RESULT_SUCCESS_VALUE,
     );
 }
 
-// ============================================================
-// Team config name lookup (port of GetTeamConfigName 0x4A62A0)
-// ============================================================
+unsafe extern "cdecl" fn wav_player_load_and_play_impl(
+    player: *mut WavPlayer,
+    path: *const c_char,
+    param3: i32,
+) -> u32 {
+    wav_player::wav_player_load_and_play(player, path, param3) as u32
+}
 
-/// Team config names indexed 0-48, matching WA.exe's jump table at 0x4A62A0.
-/// Used for fanfare WAV file paths (e.g. "user\Fanfare\Finland.wav").
-/// Note: "Leichtenstein" is WA's original misspelling — must match for file lookup.
-const TEAM_CONFIG_NAMES: [&str; 49] = [
-    "UK",             // 0
-    "Argentina",      // 1
-    "Australia",      // 2
-    "Austria",        // 3
-    "Belgium",        // 4
-    "Brazil",         // 5
-    "Canada",         // 6
-    "Croatia",        // 7
-    "Simple",         // 8
-    "Cyprus",         // 9
-    "Simple",         // 10
-    "Denmark",        // 11
-    "Finland",        // 12
-    "France",         // 13
-    "Simple",         // 14
-    "Germany",        // 15
-    "Greece",         // 16
-    "Simple",         // 17
-    "Hungary",        // 18
-    "Iceland",        // 19
-    "India",          // 20
-    "Simple",         // 21
-    "Psycho Laugh",   // 22
-    "Psycho Laugh",   // 23
-    "Ireland",        // 24
-    "Israel",         // 25
-    "Italy",          // 26
-    "Japan",          // 27
-    "Leichtenstein",  // 28
-    "Luxembourg",     // 29
-    "Simple",         // 30
-    "Malta",          // 31
-    "Mexico",         // 32
-    "Morocco",        // 33
-    "Netherlands",    // 34
-    "New Zealand",    // 35
-    "Norway",         // 36
-    "Poland",         // 37
-    "Portugal",       // 38
-    "Simple",         // 39
-    "Romania",        // 40
-    "Russia",         // 41
-    "Singapore",      // 42
-    "South Africa",   // 43
-    "Spain",          // 44
-    "Sweden",         // 45
-    "Switzerland",    // 46
-    "Turkey",         // 47
-    "USA",            // 48
-];
+/// The success sentinel VALUE (read from *(0x8AC8A0+delta) at install time).
+static mut WAV_RESULT_SUCCESS_VALUE: u32 = 0;
 
 // ============================================================
-// PlayFeSfx replacement (0x4D7960)
+// PlayFeSfx hook (0x4D7960)
 // ============================================================
-// stdcall(sfx_name: *const u8), RET 0x4
-// Builds "fesfx\<name>.wav", plays on FESFX_WAV_PLAYER.
 
 unsafe extern "stdcall" fn hook_play_fe_sfx(sfx_name: *const u8) {
     let name = if !sfx_name.is_null() {
@@ -195,180 +117,39 @@ unsafe extern "stdcall" fn hook_play_fe_sfx(sfx_name: *const u8) {
         "(null)"
     };
     let _ = log_line(&format!("[Speech] PlayFeSfx: \"{}\"", name));
-
-    // Build null-terminated path: "fesfx\<name>.wav"
-    let mut path = CString::<MAX_PATH>::new();
-    let _ = path.extend_from_bytes(b"fesfx\\");
-    let _ = path.extend_from_bytes(name.as_bytes());
-    let _ = path.extend_from_bytes(b".wav");
-
-    let player = WavPlayerHandle::from_global(va::FESFX_WAV_PLAYER);
-    player.stop();
-    player.load(path.as_ptr());
-    player.play(0);
+    speech_ops::play_fe_sfx(name);
 }
 
 // ============================================================
-// PlayFanfare_Default replacement (0x4D7500)
+// PlayFanfare_Default hook (0x4D7500)
 // ============================================================
-// stdcall(team_type: u32), RET 0x4
-// If team_type in 1..=49, looks up config name; else "Simple".
-// Builds "<wa_path>\user\Fanfare\<name>.wav", plays on FANFARE_WAV_PLAYER.
 
 unsafe extern "stdcall" fn hook_play_fanfare_default(team_type: u32) {
-    // Get the fanfare name from lookup table (port of GetTeamConfigName 0x4A62A0)
-    let name = if (1..=49).contains(&team_type) {
-        TEAM_CONFIG_NAMES[(team_type - 1) as usize]
-    } else {
-        "Simple"
-    };
-
-    // Read WA data path
-    let wa_path = CStr::from_ptr(rb(va::WA_DATA_PATH) as *const i8)
-        .to_str()
-        .unwrap_or(".");
-
     let _ = log_line(&format!(
-        "[Speech] PlayFanfare_Default: team_type={} name=\"{}\"",
-        team_type, name
+        "[Speech] PlayFanfare_Default: team_type={}",
+        team_type
     ));
-
-    // Build null-terminated path: "<wa_path>\user\Fanfare\<name>.wav"
-    let mut path = CString::<MAX_PATH>::new();
-    let _ = path.extend_from_bytes(wa_path.as_bytes());
-    let _ = path.extend_from_bytes(b"\\user\\Fanfare\\");
-    let _ = path.extend_from_bytes(name.as_bytes());
-    let _ = path.extend_from_bytes(b".wav");
-
-    let player = WavPlayerHandle::from_global(va::FANFARE_WAV_PLAYER);
-    player.stop();
-    player.load(path.as_ptr());
-    player.play(0);
+    speech_ops::play_fanfare_default(team_type);
 }
 
 // ============================================================
-// PlayFanfare_CurrentTeam passthrough (0x4D78E0)
+// PlayFanfare_CurrentTeam hook (0x4D78E0)
 // ============================================================
-// usercall(EAX=index), plain RET, returns EAX = u32
-// EAX is used as an implicit input (MOV EDI,EAX at 0x4D78E8).
-
-static ORIG_PLAY_FANFARE_CURRENT_TEAM: AtomicU32 = AtomicU32::new(0);
 
 usercall_trampoline!(fn trampoline_play_fanfare_current_team;
     impl_fn = play_fanfare_current_team_impl; reg = eax);
 
-unsafe extern "cdecl" fn play_fanfare_current_team_impl(index: u32) -> u32 {
-    let _ = log_line(&format!("[Speech] PlayFanfare_CurrentTeam: eax={}", index));
-
-    let orig = ORIG_PLAY_FANFARE_CURRENT_TEAM.load(Ordering::Relaxed);
-    let result: u32;
-    core::arch::asm!(
-        "call {orig}",
-        orig = in(reg) orig,
-        in("eax") index,
-        lateout("eax") result,
-        clobber_abi("C"),
-    );
-
-    let _ = log_line(&format!("[Speech] PlayFanfare_CurrentTeam => {}", result));
-    result
-}
-
-// ============================================================
-// DDGameWrapper__LoadSpeechWAV — pure Rust (replaces 0x571530)
-// ============================================================
-// Searches DDGameWrapper's speech name table for existing WAV, reuses slot if found.
-// Otherwise calls DSSound vtable load_wav to load new WAV into a buffer.
-// Stores the buffer slot index in the SpeechSlotTable.
-
-/// Pure Rust replacement for DDGameWrapper__LoadSpeechWAV (0x571530).
-///
-/// Searches the name table for `wav_path`. If found, reuses the existing
-/// buffer slot. Otherwise calls DSSound::load_wav to create a new buffer.
-/// Returns 1 on success, 0 on failure.
-unsafe fn call_load_speech_wav(
-    ddgw: u32,
-    team_index: u32,
-    line_id: u32,
-    wav_path: *const c_char,
-    full_path: *const c_char,
-) -> u32 {
-    use openwa_core::audio::SpeechSlotTable;
-    use openwa_core::engine::ddgame_wrapper::SPEECH_NAME_ENTRY_SIZE;
-    use openwa_core::engine::DDGameWrapper;
-
-    let wrapper = &mut *(ddgw as *mut DDGameWrapper);
-    let count = wrapper.speech_name_count as usize;
-    let search_name = core::ffi::CStr::from_ptr(wav_path).to_bytes();
-
-    // Search name table for existing entry matching wav_path.
-    let mut found_idx: Option<usize> = None;
-    for i in 0..count {
-        let entry = &wrapper.speech_name_table[i];
-        // Compare up to the null terminator.
-        let entry_len = entry.iter().position(|&b| b == 0).unwrap_or(entry.len());
-        if entry[..entry_len] == *search_name {
-            found_idx = Some(i);
-            break;
-        }
-    }
-
-    let ddgame = &mut *wrapper.ddgame;
-    let slot_table = &mut ddgame.speech_slot_table;
-
-    if let Some(idx) = found_idx {
-        // Found existing — reuse the buffer slot.
-        slot_table.set(
-            team_index as usize,
-            line_id,
-            idx as u32 + SpeechSlotTable::BUFFER_OFFSET,
-        );
-        return 1;
-    }
-
-    // Not found — load new WAV via DSSound vtable slot 12 (load_wav).
-    let slot_idx = count as u32 + SpeechSlotTable::BUFFER_OFFSET;
-    let vtable = (*wrapper.sound).vtable;
-    let result = ((*vtable).load_wav)(wrapper.sound, slot_idx as i32, full_path as *const u8);
-
-    if result != 0 {
-        // Success — store slot, copy name into table, increment count.
-        slot_table.set(team_index as usize, line_id, slot_idx);
-
-        // Copy wav_path into name table entry.
-        let dest = &mut wrapper.speech_name_table[count];
-        let copy_len = search_name.len().min(SPEECH_NAME_ENTRY_SIZE - 1);
-        dest[..copy_len].copy_from_slice(&search_name[..copy_len]);
-        dest[copy_len] = 0;
-
-        wrapper.speech_name_count = (count + 1) as u32;
-        return 1;
-    }
-
-    0 // failure
-}
-
-// ============================================================
-// Helpers
-// ============================================================
-
-/// Extract bytes from a null-terminated C string pointer.
-unsafe fn cstr_bytes<'a>(ptr: *const u8) -> &'a [u8] {
-    if ptr.is_null() {
-        return &[];
-    }
-    CStr::from_ptr(ptr as *const i8).to_bytes()
+unsafe extern "cdecl" fn play_fanfare_current_team_impl(eax_index: u32) -> u32 {
+    let _ = log_line(&format!(
+        "[Speech] PlayFanfare_CurrentTeam: eax={}",
+        eax_index
+    ));
+    speech_ops::play_fanfare_current_team(eax_index)
 }
 
 // ============================================================
-// DSSound_LoadSpeechBank replacement (0x571660)
+// DSSound_LoadSpeechBank hook (0x571660)
 // ============================================================
-// usercall(EAX=DDGameWrapper) + 3 stack params (team_index, speech_base_path, speech_dir)
-// RET 0xC
-//
-// Iterates the speech line table at 0x6AF770. For each entry, builds WAV paths
-// and calls LoadSpeechWAV. Falls back to default speech dir on failure.
-// Skips remaining filename alternates when one succeeds.
 
 usercall_trampoline!(fn trampoline_load_speech_bank; impl_fn = load_speech_bank_impl;
     reg = eax; stack_params = 3; ret_bytes = "0xC");
@@ -386,121 +167,25 @@ unsafe extern "cdecl" fn load_speech_bank_impl(
         .to_str()
         .unwrap_or("?");
     let _ = log_line(&format!(
-        "[Speech] LoadSpeechBank: team={} path=\"{}\" dir=\"{}\" ddgw=0x{:08X}",
-        team_index, path_str, dir_str, ddgw as u32
+        "[Speech] LoadSpeechBank: team={} path=\"{}\" dir=\"{}\"",
+        team_index, path_str, dir_str
     ));
-
-    let table_base = rb(va::SPEECH_LINE_TABLE) as *const SpeechLineTableEntry;
-    let mut i: usize = 0;
-
-    loop {
-        let entry = &*table_base.add(i);
-
-        // Null name_ptr = end of table
-        if entry.name_ptr.is_null() {
-            return;
-        }
-
-        let name_bytes = cstr_bytes(entry.name_ptr);
-
-        // Build wav_path: "<speech_dir>\<name>.wav"
-        let mut wav_path = CString::<MAX_PATH>::new();
-        let _ = wav_path.extend_from_bytes(cstr_bytes(speech_dir));
-        let _ = wav_path.extend_from_bytes(b"\\");
-        let _ = wav_path.extend_from_bytes(name_bytes);
-        let _ = wav_path.extend_from_bytes(b".wav");
-
-        // Build full_path: "<speech_base_path>\<wav_path>"
-        let mut full_path = CString::<MAX_PATH>::new();
-        let _ = full_path.extend_from_bytes(cstr_bytes(speech_base_path));
-        let _ = full_path.extend_from_bytes(b"\\");
-        let _ = full_path.extend_from_bytes(wav_path.as_bytes());
-
-        let result = call_load_speech_wav(
-            ddgw as u32,
-            team_index,
-            entry.id,
-            wav_path.as_ptr(),
-            full_path.as_ptr(),
-        );
-
-        if result == 0 {
-            // Failed — try fallback with default speech dir if no more alternates
-            let next_entry = &*table_base.add(i + 1);
-            if next_entry.name_ptr.is_null() || next_entry.id != entry.id {
-                let game_info = (*(*ddgw).ddgame).game_info as *const u8;
-                let default_dir = game_info.add(game_info_offsets::DEFAULT_SPEECH_DIR as usize);
-                let default_base =
-                    game_info.add(game_info_offsets::DEFAULT_SPEECH_BASE_PATH as usize);
-
-                let mut wav_path2 = CString::<MAX_PATH>::new();
-                let _ = wav_path2.extend_from_bytes(cstr_bytes(default_dir));
-                let _ = wav_path2.extend_from_bytes(b"\\");
-                let _ = wav_path2.extend_from_bytes(name_bytes);
-                let _ = wav_path2.extend_from_bytes(b".wav");
-
-                let mut full_path2 = CString::<MAX_PATH>::new();
-                let _ = full_path2.extend_from_bytes(cstr_bytes(default_base));
-                let _ = full_path2.extend_from_bytes(b"\\");
-                let _ = full_path2.extend_from_bytes(wav_path2.as_bytes());
-
-                call_load_speech_wav(
-                    ddgw as u32,
-                    team_index,
-                    entry.id,
-                    wav_path2.as_ptr(),
-                    full_path2.as_ptr(),
-                );
-            }
-        } else {
-            // Success — skip remaining filename alternates for this ID
-            let current_id = entry.id;
-            while {
-                let next = &*table_base.add(i + 1);
-                !next.name_ptr.is_null() && next.id == current_id
-            } {
-                i += 1;
-            }
-        }
-
-        i += 1;
-    }
+    speech_ops::load_speech_bank(ddgw, team_index, speech_base_path, speech_dir);
 }
 
 // ============================================================
-// DSSound_LoadAllSpeechBanks replacement (0x571A70)
+// DSSound_LoadAllSpeechBanks hook (0x571A70)
 // ============================================================
-// usercall(ESI=DDGameWrapper), plain RET.
-// Clears the speech slot table, then iterates teams and calls LoadSpeechBank.
 
 usercall_trampoline!(fn trampoline_load_all_speech_banks;
     impl_fn = load_all_speech_banks_impl; reg = esi);
 
 unsafe extern "cdecl" fn load_all_speech_banks_impl(ddgw: *const DDGameWrapper) {
-    let ddgame = &mut *(*ddgw).ddgame;
-
-    // Clear speech slot table
-    ddgame.speech_slot_table.clear();
-
-    // Read team count from GameInfo
-    let game_info = &*ddgame.game_info;
-    let team_count = game_info.speech_team_count as u32;
-
     let _ = log_line(&format!(
-        "[Speech] LoadAllSpeechBanks: ddgw=0x{:08X} teams={}",
-        ddgw as u32, team_count
+        "[Speech] LoadAllSpeechBanks: ddgw=0x{:08X}",
+        ddgw as u32
     ));
-
-    // Load speech bank for each team
-    let gi = ddgame.game_info as *const u8;
-    for i in 0..team_count {
-        let team_offset = (i * game_info_offsets::SPEECH_TEAM_STRIDE) as usize;
-        let base_path = gi.add(game_info_offsets::SPEECH_BASE_PATH as usize + team_offset);
-        let dir = gi.add(game_info_offsets::SPEECH_DIR as usize + team_offset);
-
-        // Call our Rust impl directly (bypasses the hook trampoline)
-        load_speech_bank_impl(ddgw, i, base_path, dir);
-    }
+    speech_ops::load_all_speech_banks(ddgw);
 }
 
 // ============================================================
@@ -509,29 +194,43 @@ unsafe extern "cdecl" fn load_all_speech_banks_impl(ddgw: *const DDGameWrapper)
 
 pub fn install() -> Result<(), String> {
     unsafe {
-        hook::install("PlayFeSfx", va::PLAY_FE_SFX, hook_play_fe_sfx as *const ())?;
+        // Read the success sentinel VALUE for hook trampolines.
+        WAV_RESULT_SUCCESS_VALUE = *(rb(wav_player::G_WAV_RESULT_SUCCESS) as *const u32);
 
+        // Global WavPlayer hooks — all callers (our hooks + unhooked WA code)
+        // go through Rust. Avoids CRT heap mismatch.
+        hook::install(
+            "WavPlayer_Stop",
+            va::WAV_PLAYER_STOP,
+            hook_wav_player_stop as *const (),
+        )?;
+        hook::install(
+            "WavPlayer_Play",
+            va::WAV_PLAYER_PLAY,
+            hook_wav_player_play as *const (),
+        )?;
+        hook::install(
+            "WavPlayer_LoadAndPlay",
+            va::WAV_PLAYER_LOAD_AND_PLAY,
+            hook_wav_player_load_and_play as *const (),
+        )?;
+
+        hook::install("PlayFeSfx", va::PLAY_FE_SFX, hook_play_fe_sfx as *const ())?;
         hook::install(
             "PlayFanfare_Default",
             va::PLAY_FANFARE_DEFAULT,
             hook_play_fanfare_default as *const (),
         )?;
-
-        let trampoline = hook::install(
+        hook::install(
             "PlayFanfare_CurrentTeam",
             va::PLAY_FANFARE_CURRENT_TEAM,
             trampoline_play_fanfare_current_team as *const (),
         )?;
-        ORIG_PLAY_FANFARE_CURRENT_TEAM.store(trampoline as u32, Ordering::Relaxed);
-
-        // Full replacement — no trampoline needed
         hook::install(
             "DSSound_LoadSpeechBank",
             va::DSSOUND_LOAD_SPEECH_BANK,
             trampoline_load_speech_bank as *const (),
         )?;
-
-        // Full replacement — no trampoline needed
         hook::install(
             "DSSound_LoadAllSpeechBanks",
             va::DSSOUND_LOAD_ALL_SPEECH_BANKS,