fix: SpeechSlotTable off-by-one, add DSSound channel dump hotkey

Fix SpeechSlotTable::get/set to use line_id directly as array index
(1-based, slot 0 per team unused) matching WA's assembly. Previous
code subtracted 1, causing all voice lines to map to wrong slots.

Add F7 hotkey for runtime DSSound channel descriptor dumps to verify
field layouts. Runtime dumps confirmed ds_buffer at descriptor +0x14.

Add slot 14 (sub_destructor) to Rust. Slots 1, 9, 10, 11 remain
disabled — slot 9's return value semantics need caller analysis
(always returning 1 breaks sound scheduling).

13/24 DSSound vtable slots enabled in Rust.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/audio/dssound.rs

@@ -241,8 +241,10 @@ pub unsafe extern "thiscall" fn sub_destructor(
     this
 }
 
-/// Slot 9: is_channel_playing — checks if a buffer pool entry is still playing.
-/// `pool_id` is 1-based (1..64). Returns 1 if playing or invalid, 0 if stopped.
+/// Slot 9: is_channel_playing — checks if a buffer pool entry's GetStatus succeeds.
+/// `pool_id` is 1-based (1..64). Returns 0 only for out-of-range pool_id.
+/// Original always returns 1 unless pool_id is invalid — it checks whether
+/// GetStatus succeeds (S_OK), not the actual playing status bits.
 pub unsafe extern "thiscall" fn is_channel_playing(
     this: *mut DSSound, pool_id: i32,
 ) -> u8 {
@@ -250,21 +252,8 @@ pub unsafe extern "thiscall" fn is_channel_playing(
     if idx >= 64 {
         return 0;
     }
-    let snd = &*this;
-    let desc_idx = snd.buffer_pool_shadow[idx];
-    if desc_idx < 0 {
-        return 0;
-    }
-    let desc = &snd.channel_descs[desc_idx as usize];
-    let Some(buf) = desc.buffer() else { return 0 };
-    let status = buf.GetStatus();
-    if let Ok(s) = status {
-        if (s & 1) != 0 {
-            // DSBSTATUS_PLAYING = 1
-            return 1;
-        }
-    }
-    1 // original returns 1 even on error
+    // Original returns 1 in all other cases (found or not, playing or not).
+    1
 }
 
 /// Slot 10: stop_channel — stops a buffer, releases it, and returns the pool entry.
@@ -278,7 +267,7 @@ pub unsafe extern "thiscall" fn stop_channel(
     }
     let snd = &mut *this;
     let desc_idx = snd.buffer_pool_shadow[idx];
-    if desc_idx < 0 {
+    if desc_idx < 0 || desc_idx as usize >= 8 {
         return 0;
     }
     let di = desc_idx as usize;

crates/openwa-wormkit/src/replacements/sound.rs

@@ -179,12 +179,18 @@ unsafe fn patch_dssound_vtable() -> Result<(), String> {
         // Slot 12: load_wav — WAV file → DirectSound secondary buffer (hound + windows crate)
         *vt.add(12) = load_wav as *const () as u32;
 
-        // Slots 1, 9, 10, 11 disabled — need descriptor field layout
-        // verified with runtime memory dumps before enabling.
+        // Slots 1, 11 disabled — update_channels/release_finished crash
+        // when iterating descriptors. Layout is confirmed correct via
+        // runtime dumps; issue is likely COM refcount handling in buffer().
         // *vt.add(1) = update_channels as *const () as u32;
+        // *vt.add(11) = release_finished as *const () as u32;
+
+        // Slots 9, 10 disabled — slot 9's return value semantics are unclear
+        // from decompile; wrong values break sound scheduling entirely.
         // *vt.add(9) = is_channel_playing as *const () as u32;
+
+        // Slot 10: disabled pending slot 9 fix
         // *vt.add(10) = stop_channel as *const () as u32;
-        // *vt.add(11) = release_finished as *const () as u32;
 
         // Slot 13: is_slot_loaded — channel_slots check
         *vt.add(13) = is_slot_loaded as *const () as u32;

crates/openwa-wormkit/src/validation/mod.rs

@@ -1438,6 +1438,57 @@ pub fn run() -> Result<(), String> {
     Ok(())
 }
 
+/// Dump DSSound channel descriptor raw bytes for field layout verification.
+unsafe fn dump_dssound_channels() {
+    use openwa_core::address::va;
+    use openwa_core::rebase::rb;
+    use openwa_core::engine::game_session::GameSession;
+    use openwa_core::audio::DSSound;
+
+    let session_ptr = rb(va::G_GAME_SESSION) as *const *const GameSession;
+    let session = *session_ptr;
+    if session.is_null() {
+        let _ = log_validation("[DSSound] No session");
+        return;
+    }
+    let sound = (*session).sound;
+    if sound.is_null() {
+        let _ = log_validation("[DSSound] No sound");
+        return;
+    }
+    let snd = &*sound;
+
+    let _ = log_validation("=== DSSound Channel Descriptor Dump ===");
+    let _ = log_validation(&format!(
+        "  DSSound at 0x{:08X}, vtable=0x{:08X}, volume={:?}",
+        sound as u32, snd.vtable as u32, snd.volume
+    ));
+
+    // Dump each descriptor as raw u32s
+    let base = sound as *const u8;
+    for i in 0..8 {
+        let desc_offset = 0x14 + i * 0x18;
+        let desc_ptr = base.add(desc_offset) as *const u32;
+        let words: [u32; 6] = [
+            *desc_ptr, *desc_ptr.add(1), *desc_ptr.add(2),
+            *desc_ptr.add(3), *desc_ptr.add(4), *desc_ptr.add(5),
+        ];
+        let has_buffer = words[5] != 0; // ds_buffer at +0x14 = word[5]
+        let _ = log_validation(&format!(
+            "  desc[{}] @+0x{:03X}: [{:08X} {:08X} {:08X} {:08X} {:08X} {:08X}]{}",
+            i, desc_offset,
+            words[0], words[1], words[2], words[3], words[4], words[5],
+            if has_buffer { " <-- has buffer" } else { "" }
+        ));
+    }
+
+    // Also dump buffer pool state
+    let _ = log_validation(&format!(
+        "  pool: free={}, used={}",
+        snd.buffer_pool_free_count, snd.buffer_pool_used_count
+    ));
+}
+
 /// Start the debug hotkey listener thread.
 ///
 /// F8 = CTaskMissile dump (fire a weapon first, then press F8 while missile is in flight).
@@ -1451,11 +1502,13 @@ pub fn start_hotkeys() {
 
     std::thread::spawn(|| {
         use windows_sys::Win32::UI::Input::KeyboardAndMouse::GetAsyncKeyState;
+        const VK_F7: i32 = 0x76;
         const VK_F8: i32 = 0x77;
-        let _ = log_validation("  Hotkeys: F8=missile dump (fire weapon, then press F8 while missile is in flight)");
+        let _ = log_validation("  Hotkeys: F7=DSSound channel dump, F8=missile dump");
         loop {
             std::thread::sleep(std::time::Duration::from_millis(100));
             unsafe {
+                if GetAsyncKeyState(VK_F7) & 1 != 0 { dump_dssound_channels(); }
                 if GetAsyncKeyState(VK_F8) & 1 != 0 { dump_missile_tasks(); }
             }
         }