fix: correct DDGame constructor — allocation size, arrow collision params

Three constructor bugs found and fixed:

1. Allocation size 0x98B8 → 0x98D8: original malloc(0x98D8) but memset(0x98B8).
Our code allocated only 0x98B8, causing 32-byte heap overrun.

2. Wrong function after InitPaletteGradientSprites: called LoadingProgressTick
(0x5717A0) instead of DisplayGfx__InitTeamPaletteDisplayObjects (0x5703E0).

3. Arrow collision region SpriteRegion params were all wrong:
- ECX should be sprite_w/2 (was 0)
- EDX should be sprite_h - margin_h (was margin_h)
- p2/p3 should be margin values (were 0)
- p4 should be sprite_w - margin_w (was margin_w)
- p5 should be sprite_h/2 (was margin_h)
- p6 should be arrow sprite ptr (was landscape gfx_resource)

This was the root cause of the longbow replay desync — wrong collision
boxes caused different terrain collision detection and RNG divergence.

Found via sub-object hashing: comparing pointer-canonicalized hashes of
objects pointed to by DDGame between Rust and original constructors.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/address.rs

@@ -215,6 +215,11 @@ pub mod va {
 
     // === Gameplay functions ===
 
+    /// Game PRNG: rng = (rng + frame_counter) * 0x19660D + 0x3C6EF35F.
+    /// Fastcall(ECX=DDGame). Updates DDGame+0x45EC in place.
+    pub const ADVANCE_GAME_RNG: u32 = 0x0053_F320;
+    /// Terrain hit → debris particles → RNG. 6 iterations, 2 RNG calls per hit.
+    pub const GENERATE_DEBRIS_PARTICLES: u32 = 0x0054_6F70;
     pub const CREATE_EXPLOSION: u32 = 0x0054_8080;
     pub const SPECIAL_IMPACT: u32 = 0x0051_93D0;
     pub const SPAWN_OBJECT: u32 = 0x0056_1CF0;
@@ -379,6 +384,11 @@ pub mod va {
     /// girder sprites, and creates DDGame+0x37C DisplayGfx object.
     /// thiscall(ECX=gfx_dir_4c0) + 2 stack(ddgame, wrapper_4c4), RET 0x8.
     pub const DDGAME_LOAD_HUD_AND_WEAPON_SPRITES: u32 = 0x0053_D0E0;
+    /// DisplayGfx__InitTeamPaletteDisplayObjects (0x5703E0): creates team palette
+    /// gradient DisplayGfx objects. Reads DDGame+0x7338 (fill_pixel), iterates teams,
+    /// creates BitGrid+DisplayGfx for each team's palette gradient.
+    /// stdcall(wrapper), RET 0x4.
+    pub const DISPLAY_GFX_INIT_TEAM_PALETTE_DISPLAY: u32 = 0x0057_03E0;
     /// DDGame__InitPaletteGradientSprites (0x5706D0): creates DisplayGfx objects
     /// at DDGame+0x41C.. for each team's palette gradient data from GameInfo.
     /// stdcall(wrapper), RET 0x4.

crates/openwa-core/src/engine/ddgame.rs

@@ -25,7 +25,7 @@ use crate::wa_alloc::{wa_malloc, wa_malloc_zeroed};
 
 /// DDGame — the main game engine object.
 ///
-/// This is a massive ~39KB struct (0x98B8 bytes) that owns all major subsystems:
+/// This is a massive ~39KB struct (0x98D8 bytes) that owns all major subsystems:
 /// display, landscape, sound, graphics handlers, and task state machines.
 ///
 /// Allocated in DDGame__Constructor (0x56E220).
@@ -367,11 +367,14 @@ pub struct DDGame {
     /// This is the same flag toggled by spacebar (key 0x35) during replay.
     pub fast_forward_active: u32,
 
-    /// 0x98B4-0x98B7: Unknown
-    pub _unknown_98b4: [u8; 0x98B8 - 0x98B4],
+    /// 0x98B4-0x98D7: Unknown tail region.
+    /// The original constructor allocates 0x98D8 bytes but memsets only 0x98B8.
+    /// The remaining 0x20 bytes are not zeroed by the initial memset but may be
+    /// initialized by subsequent constructor steps or game code.
+    pub _unknown_98b4: [u8; 0x98D8 - 0x98B4],
 }
 
-const _: () = assert!(core::mem::size_of::<DDGame>() == 0x98B8);
+const _: () = assert!(core::mem::size_of::<DDGame>() == 0x98D8);
 
 // ============================================================
 // DDGame constructor — replaces DDGame__Constructor (0x56E220)
@@ -396,7 +399,7 @@ const _: () = assert!(core::mem::size_of::<DDGame>() == 0x98B8);
 /// then zeroes coordination/sound entries at 0x8Cxx and 0x98xx.
 ///
 /// # Safety
-/// `ddgame` must point to a valid, zero-filled DDGame allocation (0x98B8 bytes).
+/// `ddgame` must point to a valid, zero-filled DDGame allocation (0x98D8 bytes).
 pub unsafe fn ddgame_init_fields(ddgame: *mut DDGame) {
     let base = ddgame as *mut u8;
 
@@ -645,7 +648,7 @@ pub static mut ON_DDGAME_ALLOC: Option<unsafe fn(*mut u8)> = None;
 
 /// Create and initialize DDGame, matching DDGame__Constructor (0x56E220).
 ///
-/// Allocates 0x98B8 bytes from WA's heap, initializes all fields, and creates
+/// Allocates 0x98D8 bytes from WA's heap, initializes all fields, and creates
 /// sub-objects. Populates fields on both `wrapper` (DDGameWrapper) and the
 /// returned DDGame.
 ///
@@ -665,8 +668,10 @@ pub unsafe fn create_ddgame(
     game_info: *mut GameInfo,
     network_ecx: u32, // implicit ECX from caller
 ) -> *mut DDGame {
-    // ── 1. Allocate and zero-fill (matches: memset(piVar3, 0, 0x98B8)) ──
-    let ddgame = wa_malloc_zeroed(0x98B8) as *mut DDGame;
+    // ── 1. Allocate and zero-fill ──
+    // Original: malloc(0x98D8), memset(ptr, 0, 0x98B8) — last 0x20 bytes not zeroed.
+    // We zero the full 0x98D8 for safety (strictly more initialization than original).
+    let ddgame = wa_malloc_zeroed(0x98D8) as *mut DDGame;
     if ddgame.is_null() {
         return core::ptr::null_mut();
     }
@@ -1108,29 +1113,30 @@ unsafe fn init_graphics_and_resources(
             // Store arrow sprite at DDGame+0x38+i*4
             (*ddgame).arrow_sprites[i as usize] = sprite;
 
-            // Calculate collision region dimensions from sprite
+            // Calculate collision region dimensions from sprite.
+            // The original creates a CENTERED collision box with 10px margin:
+            //   left/top margin = max(0, dim/2 - 10)
+            //   right/bottom = dim - margin
+            // Result: this[5]=this[6]=10 for sprites >20px (the 10px inset).
             if !sprite.is_null() {
                 let tsm = &*(sprite as *const BitGrid);
                 let sprite_w = tsm.width as i32;
                 let sprite_h = tsm.height as i32;
-                let half_w = (sprite_w / 2 - 10).max(0);
-                let half_h = (sprite_h / 2 - 10).max(0);
+                let margin_w = (sprite_w / 2 - 10).max(0);
+                let margin_h = (sprite_h / 2 - 10).max(0);
 
                 // Create SpriteRegion for collision
                 let alloc = wa_malloc_zeroed(0x9C);
                 let region = if !alloc.is_null() {
-                    // SpriteRegion params: ECX, EDX, this, p2, p3, p4, p5, p6
-                    // this[3] = p4 - p2 (width), this[4] = EDX - p3 (height)
-                    // For arrows: region from (0,0) to (half_w, half_h)
                     call_sprite_region_ctor(
                         alloc,
-                        0,                   // ECX (x_max for this[5])
-                        half_h as u32,       // EDX (y_max → this[4] = EDX - p3)
-                        0,                   // p2 (x_offset)
-                        0,                   // p3 (y_offset)
-                        half_w as u32,       // p4 (x_limit → this[3] = p4 - p2)
-                        half_h as u32,       // p5 (y_limit for this[6])
-                        gfx_resource as u32, // p6 (gfx_resource)
+                        (sprite_w / 2) as u32,                   // ECX → this[5] = ECX - p2
+                        (sprite_h - margin_h) as u32,            // EDX → this[4] = EDX - p3
+                        margin_w as u32,                          // p2 (left margin)
+                        margin_h as u32,                          // p3 (top margin)
+                        (sprite_w - margin_w) as u32,             // p4 → this[3] = p4 - p2
+                        (sprite_h / 2) as u32,                    // p5 → this[6] = p5 - p3
+                        sprite as u32,                            // p6 = arrow sprite (NOT landscape gfx_resource)
                     )
                 } else {
                     core::ptr::null_mut()
@@ -1333,8 +1339,13 @@ unsafe fn init_graphics_and_resources(
         // gradient data from GameInfo. stdcall(wrapper), RET 0x4.
         wa_init_palette_gradient_sprites(wrapper);
 
-        // ── Loading progress tick (1 of 2 — after InitPaletteGradientSprites) ──
-        call_usercall_ecx(wrapper, LOADING_PROGRESS_TICK_ADDR);
+        // ── DisplayGfx__InitTeamPaletteDisplayObjects (0x5703E0) ──
+        // Creates team palette gradient display objects. Reads DDGame+0x7338
+        // (fill_pixel), creates BitGrid+DisplayGfx per team.
+        // stdcall(wrapper), RET 0x4.
+        let init_team_palette_display: unsafe extern "stdcall" fn(*mut DDGameWrapper) =
+            core::mem::transmute(rb(va::DISPLAY_GFX_INIT_TEAM_PALETTE_DISPLAY));
+        init_team_palette_display(wrapper);
     }
     // ── Gradient image stub (DDGame+0x30) ──
     // Minimal stub: [6]=0 (zero-width) so CTaskLand skips the gradient column loop.

crates/openwa-wormkit/src/debug_watchpoint.rs

@@ -33,9 +33,8 @@ use windows_sys::Win32::System::Diagnostics::Debug::{
 /// Offsets to watch. Hardware limit: 4 watchpoints (DR0–DR3).
 /// Change these to investigate different fields.
 /// NOTE: The base pointer is set by `on_ddgame_alloc()` — can be DDGame or DDGameWrapper.
-const WATCH_OFFSETS: [(u32, &str); 2] = [
-    (0x09C0, "display+0x09C0"),
-    (0x353C, "display+0x353C"),
+const WATCH_OFFSETS: [(u32, &str); 1] = [
+    (0x3A40, "display+0x3A40"),
 ];
 
 /// DDGame base address (set when allocation is reported).