fix: eliminate noalias UB in vtable dispatch, add typed TeamMessage

The bind_! macro generated &mut self methods for vtable calls, giving
LLVM noalias guarantees that WA bridge calls violated. This caused
codegen-sensitive desyncs where unrelated code changes would shift
optimization decisions and expose the UB.

Fix: auto-generate _raw associated functions (taking raw pointers) for
every bind_! vtable method. Migrate all call sites in weapon dispatch,
weapon release, sound, cloud, and filter handlers to use _raw variants
and CTask::ddgame_raw() instead of the Task trait methods.

Also adds TeamMessage enum with NapalmStrike variant as the first typed
message, and CTaskTeam::on_napalm_strike handler (not yet wired up due
to a separate binary layout sensitivity issue under investigation).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/task/base.rs

@@ -273,6 +273,60 @@ pub unsafe trait Task {
 // Blanket impl for any CTask<V>
 unsafe impl<V: Vtable> Task for CTask<V> {}
 
+// ---------------------------------------------------------------------------
+// Raw-pointer associated functions — no &self/&mut self, no noalias UB.
+//
+// Use these instead of Task trait methods when operating on WA-owned objects
+// through raw pointers. Any type whose first field is CTask (at offset 0)
+// can be cast to *mut CTask and used with these functions.
+// ---------------------------------------------------------------------------
+
+impl CTask {
+    /// Get the DDGame pointer from a raw CTask pointer.
+    ///
+    /// Reads the `ddgame` field (offset 0x2C) without creating a Rust reference.
+    #[inline(always)]
+    pub unsafe fn ddgame_raw(this: *const CTask) -> *mut DDGame {
+        (*this).ddgame
+    }
+
+    /// Broadcast a message to all children — raw-pointer version.
+    ///
+    /// Pure Rust port of CTask::HandleMessage (0x562F30).
+    /// Identical to `Task::broadcast_message` but takes `*mut CTask` instead
+    /// of `&mut self`, avoiding noalias UB.
+    pub unsafe fn broadcast_message_raw(
+        task_ptr: *mut CTask,
+        sender: *mut CTask,
+        msg_type: u32,
+        size: u32,
+        data: *const u8,
+    ) {
+        let mut i: usize = 0;
+        loop {
+            let child = loop {
+                let watermark = core::ptr::read_volatile(
+                    core::ptr::addr_of!((*task_ptr).children_watermark),
+                ) as usize;
+                if i >= watermark {
+                    return;
+                }
+                let children = core::ptr::read_volatile(
+                    core::ptr::addr_of!((*task_ptr).children_data),
+                );
+                let c = *children.add(i);
+                i += 1;
+                if !c.is_null() {
+                    break c;
+                }
+            };
+
+            let vt = &*((*child).vtable as *const CTaskVtable);
+            (vt.handle_message)(child, sender, msg_type, size, data);
+        }
+    }
+}
+
 // ---------------------------------------------------------------------------
 // Shared-data entity registry
 // ---------------------------------------------------------------------------

crates/openwa-core/src/task/mod.rs

@@ -10,6 +10,7 @@ pub mod missile;
 mod overlays;
 pub mod supply_crate;
 pub mod team;
+pub mod team_message;
 pub mod turn_game;
 pub mod worm;
 
@@ -24,6 +25,7 @@ pub use missile::{CTaskMissile, CTaskMissileVTable, MissileType};
 pub use overlays::{BungeeTrailTask, WeaponAimTask};
 pub use supply_crate::{CTaskCrate, CTaskCrateVTable};
 pub use team::{CTaskTeam, CTaskTeamVTable};
+pub use team_message::TeamMessage;
 pub use turn_game::{CTaskTurnGame, CTaskTurnGameVTable, TurnGameCtx};
 pub use worm::{CTaskWorm, CTaskWormVTable, WormState};
 

crates/openwa-core/src/task/team.rs

@@ -114,3 +114,66 @@ const _: () = assert!(core::mem::size_of::<CTaskTeam>() == 0x460);
 
 // Generate typed vtable method wrappers: handle_message(), write_replay_state(), etc.
 bind_CTaskTeamVTable!(CTaskTeam, base.vtable);
+
+// ── Typed message handlers ──────────────────────────────────
+
+impl CTaskTeam {
+    /// Handle NapalmStrike message (0x2B) — ported from CTaskTeam::HandleMessage.
+    ///
+    /// Uses raw pointer (not `&mut self`) to avoid noalias issues with broadcast calls.
+    ///
+    /// Logic:
+    /// 1. Team ownership check (msg team_index must match this.team_index)
+    /// 2. If game_version > 0xF4: broadcast DetonateWeapon (0x2A) to children
+    /// 3. Set per-team napalm flag at ddgame + team_index * 0x51C + 0x4618
+    /// 4. Broadcast original message (0x2B) to children
+    ///
+    /// # Safety
+    /// `this` must be a valid CTaskTeam pointer with valid ddgame.
+    /// Handle NapalmStrike message (0x2B) — ported from CTaskTeam::HandleMessage.
+    ///
+    /// Uses `CTask::broadcast_message_raw` for child dispatch (no `&mut self`,
+    /// no noalias UB). This is a pure Rust handler — no bridge to WA code.
+    ///
+    /// # Safety
+    /// `this` must be a valid CTaskTeam pointer with valid ddgame.
+    pub unsafe fn on_napalm_strike(
+        this: *mut Self,
+        sender: *mut CTask,
+        msg_team_index: u32,
+    ) {
+        use crate::game::TaskMessage;
+
+        let team_index = (*this).team_index;
+
+        // 1. Team ownership check — only process messages for our team
+        if msg_team_index != team_index {
+            return;
+        }
+
+        // Serialize the message to raw bytes for broadcast to WA children
+        let mut buf = [0u8; 8];
+        buf[0..4].copy_from_slice(&msg_team_index.to_ne_bytes());
+        let task_ptr = this as *mut CTask;
+
+        // 2. If game_version > 0xF4: broadcast DetonateWeapon (0x2A) to children first
+        let ddgame = CTask::ddgame_raw(this as *const CTask);
+        let game_version = (*(*ddgame).game_info).game_version;
+        if game_version > 0xF4 {
+            CTask::broadcast_message_raw(
+                task_ptr, sender, TaskMessage::DetonateWeapon as u32, 4, buf.as_ptr(),
+            );
+        }
+
+        // 3. Set per-team napalm flag
+        // Original: *(ddgame + team_index * 0x51C + 0x4618) = 1
+        let flag_ptr = (ddgame as *mut u8)
+            .add(team_index as usize * 0x51C + 0x4618) as *mut u32;
+        *flag_ptr = 1;
+
+        // 4. Broadcast original message (0x2B) to children
+        CTask::broadcast_message_raw(
+            task_ptr, sender, TaskMessage::Surrender as u32, 4, buf.as_ptr(),
+        );
+    }
+}

crates/openwa-core/src/task/team_message.rs

@@ -0,0 +1,57 @@
+//! Typed messages for CTaskTeam.
+//!
+//! Replaces the raw `(msg_type: u32, size: u32, data: *const u8)` interface
+//! for messages where both sender and receiver are implemented in Rust.
+//! Messages not yet ported remain as raw vtable dispatches.
+
+use crate::game::TaskMessage;
+
+/// Typed messages handled by CTaskTeam in Rust.
+///
+/// Each variant corresponds to a specific `TaskMessage` value and carries
+/// its payload as typed fields instead of a raw byte buffer.
+#[derive(Debug, Clone, Copy)]
+pub enum TeamMessage {
+    /// 0x2B (Surrender): Napalm strike or similar team-targeted action.
+    /// Sets a per-team flag and optionally broadcasts DetonateWeapon.
+    NapalmStrike {
+        /// Team index (1-based) identifying which team fired.
+        team_index: u32,
+    },
+    // Future variants:
+    // WeaponReleased { team_index: u32, worm_index: u32, ... },
+}
+
+impl TeamMessage {
+    /// Parse a raw message into a typed TeamMessage, if recognized.
+    ///
+    /// Returns `None` for unrecognized message types (handled by original WA code).
+    ///
+    /// # Safety
+    /// `data` must be valid for `size` bytes when `size > 0`.
+    pub unsafe fn from_raw(msg_type: u32, _size: u32, data: *const u8) -> Option<Self> {
+        match TaskMessage::try_from(msg_type) {
+            Ok(TaskMessage::Surrender) => {
+                // data[0..4] = team_index
+                if data.is_null() {
+                    return None;
+                }
+                let team_index = *(data as *const u32);
+                Some(TeamMessage::NapalmStrike { team_index })
+            }
+            _ => None,
+        }
+    }
+
+    /// Serialize this message to a raw buffer for broadcast_message interop.
+    ///
+    /// Writes the payload into `buf` and returns `(msg_type, size)`.
+    pub fn to_raw(&self, buf: &mut [u8]) -> (u32, u32) {
+        match self {
+            TeamMessage::NapalmStrike { team_index } => {
+                buf[0..4].copy_from_slice(&team_index.to_ne_bytes());
+                (TaskMessage::Surrender as u32, 4)
+            }
+        }
+    }
+}

crates/openwa-core/src/task/worm.rs

@@ -115,18 +115,9 @@ impl WormState {}
 
 /// Raw-pointer methods for CTaskWorm.
 ///
-/// These avoid creating `&mut CTaskWorm` references, which give LLVM noalias
-/// guarantees that can cause miscompilation when WA code modifies the same
-/// memory through raw pointers during bridge calls. Use these in weapon
-/// dispatch and other hot paths that mix Rust and WA function calls.
+/// `set_state_raw` and other vtable methods are now auto-generated by the
+/// `bind_CTaskWormVTable!` macro. Only non-vtable raw helpers remain here.
 impl CTaskWorm {
-    /// Call set_state through the vtable without creating `&mut self`.
-    /// Avoids noalias issues when WA code may alias the worm memory.
-    pub unsafe fn set_state_raw(this: *mut CTaskWorm, state: WormState) {
-        let vtable = *(this as *const *const CTaskWormVTable);
-        ((*vtable).set_state)(this, state);
-    }
-
     /// Set the weapon fire completion flag at +0x3C without creating `&mut self`.
     pub unsafe fn set_fire_complete_raw(this: *mut CTaskWorm, value: i32) {
         let base = this as *mut u8;

crates/openwa-derive/src/lib.rs

@@ -385,6 +385,13 @@ fn generate_bind_methods(slots: &[SlotInfo]) -> syn::Result<proc_macro2::TokenSt
             quote! { self as *mut Self }
         };
 
+        // Raw-pointer `this` param type for the _raw variant
+        let raw_this_ty = if this_is_const {
+            quote! { *const Self }
+        } else {
+            quote! { *mut Self }
+        };
+
         // Remaining params
         let mut param_decls = Vec::new();
         let mut param_names = Vec::new();
@@ -406,11 +413,25 @@ fn generate_bind_methods(slots: &[SlotInfo]) -> syn::Result<proc_macro2::TokenSt
             syn::ReturnType::Type(_, ty) => quote! { -> #ty },
         };
 
+        // `_raw` variant name
+        let raw_ident = quote::format_ident!("{}_raw", ident);
+        let raw_doc = format!(
+            "{}\n\n\
+             Raw-pointer variant — avoids creating `&mut self`, preventing LLVM noalias \
+             miscompilation when WA code modifies the same memory through bridge calls.",
+            doc
+        );
+
         methods.push(quote! {
             #[doc = #doc]
             pub unsafe fn #ident(#self_param #(, #param_decls)*) #ret_ty {
                 ((*self.$($vtable_field).+).#ident)(#self_cast #(, #param_names)*)
             }
+
+            #[doc = #raw_doc]
+            pub unsafe fn #raw_ident(this: #raw_this_ty #(, #param_decls)*) #ret_ty {
+                ((*(*this).$($vtable_field).+).#ident)(this #(, #param_names)*)
+            }
         });
     }
 

crates/openwa-wormkit/src/replacements/sound.rs

@@ -14,7 +14,7 @@ use openwa_core::audio::{play_sound, play_sound_pooled, KnownSoundId, SoundId};
 use openwa_core::engine::{DDGame, DDGameWrapper, SoundQueueEntry};
 use openwa_core::fixed::Fixed;
 use openwa_core::task::worm::CTaskWorm;
-use openwa_core::task::{CGameTask, CTask, Task};
+use openwa_core::task::{CGameTask, CTask};
 
 use crate::hook;
 use crate::log_line;
@@ -172,13 +172,13 @@ pub(crate) unsafe fn play_sound_local(
 pub(crate) unsafe fn stop_worm_sound(worm: *mut CTaskWorm) {
     let handle = (*worm).sound_handle;
     if handle != 0 {
-        let ddgame = &*(*worm).ddgame();
-        let sound = ddgame.sound;
+        let ddgame = CTask::ddgame_raw(worm as *const CTask);
+        let sound = (*ddgame).sound;
         if !sound.is_null() && (handle as i32) >= 0 {
             if handle & 0x40000000 != 0 {
                 // Streaming sound — stop via ActiveSoundTable
-                if !ddgame.active_sounds.is_null() {
-                    (*ddgame.active_sounds).stop_sound(handle & !0x40000000);
+                if !(*ddgame).active_sounds.is_null() {
+                    (*(*ddgame).active_sounds).stop_sound(handle & !0x40000000);
                 }
             } else {
                 // Regular DSSound channel
@@ -198,16 +198,16 @@ pub(crate) unsafe fn stop_worm_sound(worm: *mut CTaskWorm) {
 pub(crate) unsafe fn play_worm_sound(worm: *mut CTaskWorm, sound_id: SoundId, volume: Fixed) {
     let handle = (*worm).sound_handle;
     if handle != 0 {
-        let ddgame = &*(*worm).ddgame();
-        let sound = ddgame.sound;
+        let ddgame = CTask::ddgame_raw(worm as *const CTask);
+        let sound = (*ddgame).sound;
         if !sound.is_null() && (handle as i32) >= 0 {
             if handle & 0x40000000 == 0 {
                 // Regular DSSound channel — stop via vtable
                 ((*(*sound).vtable).stop_channel)(sound, handle as i32);
             } else {
                 // Streaming sound — stop via ActiveSoundTable
-                if !ddgame.active_sounds.is_null() {
-                    (*ddgame.active_sounds).stop_sound(handle & !0x40000000);
+                if !(*ddgame).active_sounds.is_null() {
+                    (*(*ddgame).active_sounds).stop_sound(handle & !0x40000000);
                 }
             }
         }

crates/openwa-wormkit/src/replacements/task/cloud.rs

@@ -9,7 +9,7 @@ use openwa_core::game::TaskMessage;
 use openwa_core::log::log_line;
 use openwa_core::render::queue::{command_type, DrawSpriteCmd};
 use openwa_core::task::cloud::CTaskCloud;
-use openwa_core::task::{CTask, Task};
+use openwa_core::task::CTask;
 
 /// CTaskCloud::HandleMessage replacement.
 ///
@@ -26,61 +26,60 @@ unsafe extern "thiscall" fn cloud_handle_message(
     size: u32,
     data: *const u8,
 ) {
-    let cloud = &mut *this;
     let msg = TaskMessage::try_from(msg_type);
 
     match msg {
         Ok(TaskMessage::FrameFinish) => {
             // Advance Y position
-            cloud.pos_y = Fixed(cloud.pos_y.0 + cloud.vel_y.0);
+            (*this).pos_y = Fixed((*this).pos_y.0 + (*this).vel_y.0);
 
             // Advance X position: base velocity + wind * 10
-            let wind = cloud.wind_accel.0;
-            cloud.pos_x = Fixed(cloud.pos_x.0 + cloud.vel_x.0 + wind * 10);
+            let wind = (*this).wind_accel.0;
+            (*this).pos_x = Fixed((*this).pos_x.0 + (*this).vel_x.0 + wind * 10);
 
             // Wrap X at landscape bounds (with 128.0 Fixed padding)
-            let ddgame = &*cloud.ddgame();
+            let ddgame = CTask::ddgame_raw(this as *const CTask);
             let padding = Fixed::from_int(128);
-            let level_left = ddgame.level_bound_min_x - padding;
-            let level_right = ddgame.level_bound_max_x + padding;
+            let level_left = (*ddgame).level_bound_min_x - padding;
+            let level_right = (*ddgame).level_bound_max_x + padding;
 
-            if cloud.pos_x < level_left {
-                cloud.pos_x = level_right;
-            } else if cloud.pos_x > level_right {
-                cloud.pos_x = level_left;
+            if (*this).pos_x < level_left {
+                (*this).pos_x = level_right;
+            } else if (*this).pos_x > level_right {
+                (*this).pos_x = level_left;
             }
 
             // Converge wind_accel toward wind_target (clamp step to ±0x147)
-            let target = cloud.wind_target.0;
-            let current = cloud.wind_accel.0;
+            let target = (*this).wind_target.0;
+            let current = (*this).wind_accel.0;
             let diff = target - current;
             if diff.abs() < 0x147 {
-                cloud.wind_accel = Fixed(target);
+                (*this).wind_accel = Fixed(target);
             } else if current < target {
-                cloud.wind_accel = Fixed(current + 0x147);
+                (*this).wind_accel = Fixed(current + 0x147);
             } else {
-                cloud.wind_accel = Fixed(current - 0x147);
+                (*this).wind_accel = Fixed(current - 0x147);
             }
         }
 
         Ok(TaskMessage::RenderScene) => {
-            let ddgame = &mut *cloud.ddgame();
+            let ddgame = CTask::ddgame_raw(this as *const CTask);
 
             // Only render when rendering phase == 5 (in-game rendering active)
-            if ddgame.render_phase == 5 {
+            if (*ddgame).render_phase == 5 {
                 // Compute parallax X offset: (vel_x + wind * 10) * parallax_scale
-                let scroll_speed = cloud.vel_x.0 + cloud.wind_accel.0 * 10;
-                let parallax_x = ((scroll_speed as i64 * ddgame.parallax_scale as i64) >> 16) as i32;
-                let x = parallax_x + cloud.pos_x.0;
+                let scroll_speed = (*this).vel_x.0 + (*this).wind_accel.0 * 10;
+                let parallax_x = ((scroll_speed as i64 * (*ddgame).parallax_scale as i64) >> 16) as i32;
+                let x = parallax_x + (*this).pos_x.0;
 
-                let rq = &mut *ddgame.render_queue;
+                let rq = &mut *(*ddgame).render_queue;
                 if let Some(entry) = rq.alloc::<DrawSpriteCmd>() {
                     *entry = DrawSpriteCmd {
                         command_type: command_type::DRAW_SPRITE_LOCAL,
-                        layer: cloud.layer_depth.0 as u32,
+                        layer: (*this).layer_depth.0 as u32,
                         x_pos: x as u32 & 0xFFFF0000,
-                        y_pos: cloud.pos_y.0 as u32 & 0xFFFF0000,
-                        sprite_id: cloud.sprite_id,
+                        y_pos: (*this).pos_y.0 as u32 & 0xFFFF0000,
+                        sprite_id: (*this).sprite_id,
                         frame: 0,
                     };
                 }
@@ -89,15 +88,15 @@ unsafe extern "thiscall" fn cloud_handle_message(
 
         Ok(TaskMessage::SetWind) => {
             if !data.is_null() {
-                cloud.wind_target = Fixed(*(data as *const i32));
+                (*this).wind_target = Fixed(*(data as *const i32));
             }
         }
 
         _ => {}
     }
 
-    // Broadcast to children (pure Rust port of CTask::HandleMessage)
-    cloud.broadcast_message(sender, msg_type, size, data);
+    // Broadcast to children — raw-pointer version avoids noalias UB
+    CTask::broadcast_message_raw(this as *mut CTask, sender, msg_type, size, data);
 }
 
 pub fn install() -> Result<(), String> {

crates/openwa-wormkit/src/replacements/task/filter.rs

@@ -6,7 +6,7 @@
 use openwa_core::address::va;
 use openwa_core::log::log_line;
 use openwa_core::task::filter::CTaskFilter;
-use openwa_core::task::{CTask, Task};
+use openwa_core::task::CTask;
 
 /// CTaskFilter::HandleMessage replacement.
 ///
@@ -20,17 +20,14 @@ unsafe extern "thiscall" fn filter_handle_message(
     size: u32,
     data: *const u8,
 ) {
-    let filter = &*this;
-
     // Check subscription table — messages >= 98 always pass through
-    if (msg_type as usize) < filter.subscription_table.len()
-        && filter.subscription_table[msg_type as usize] == 0
-    {
+    let table = &(*this).subscription_table;
+    if (msg_type as usize) < table.len() && table[msg_type as usize] == 0 {
         return; // message not subscribed — drop silently
     }
 
-    // Broadcast to children (pure Rust port of CTask::HandleMessage)
-    (*this).broadcast_message(sender, msg_type, size, data);
+    // Broadcast to children — raw-pointer version avoids noalias UB
+    CTask::broadcast_message_raw(this as *mut CTask, sender, msg_type, size, data);
 }
 
 pub fn install() -> Result<(), String> {

crates/openwa-wormkit/src/replacements/weapon.rs

@@ -22,7 +22,8 @@ use openwa_core::fixed::Fixed;
 use openwa_core::game::weapon::{WeaponEntry, WeaponFireParams, WeaponSpawnData};
 use openwa_core::game::Weapon;
 use openwa_core::log::log_line;
-use openwa_core::task::Task;
+use openwa_core::task::team::CTaskTeam;
+use openwa_core::task::CTask;
 use openwa_core::task::worm::{CTaskWorm, WormState};
 
 use crate::hook::{self, usercall_trampoline};
@@ -322,7 +323,7 @@ unsafe fn fire_weapon_special(
         Ok(S::Prod) => fire_prod(worm, ctx as *const u8),
         Ok(S::AirStrike) => fire_air_strike(worm),
         Ok(S::ScalesOfJustice) => CTaskWorm::set_state_raw(worm, WormState::ScalesOfJustice),
-        Ok(S::NapalmStrike) => fire_send_team_message(worm, 0x2B),
+        Ok(S::NapalmStrike) => fire_napalm_strike_typed(worm),
         Ok(S::MailMineMole) => fire_mail_mine_mole(worm),
         Ok(S::IndianNuclearTest) => {
             if can_fire_subtype16((*worm).state()) {
@@ -356,13 +357,42 @@ fn can_fire_subtype16(state: u32) -> bool {
 ///
 /// Returns null if not found.
 pub(crate) unsafe fn lookup_team_task(worm: *const CTaskWorm) -> *mut openwa_core::task::CTaskTeam {
-    use openwa_core::task::{SharedDataTable, Task};
+    use openwa_core::task::SharedDataTable;
 
-    let table = SharedDataTable::from_task((*worm).as_task_ptr());
+    let table = SharedDataTable::from_task(worm as *const CTask);
     // CTaskTeam is registered with key (0, 0x14) in SharedData
     table.lookup(0, 0x14) as *mut openwa_core::task::CTaskTeam
 }
 
+/// Napalm Strike (subtype 14) — typed Rust handler.
+///
+/// Constructs a typed TeamMessage, serializes to raw bytes, and dispatches
+/// through CTaskTeam's WA vtable via handle_message_raw. The typed message
+/// ensures correct field layout without manual byte manipulation.
+#[inline(never)]
+unsafe fn fire_napalm_strike_typed(worm: *mut CTaskWorm) {
+    use openwa_core::task::TeamMessage;
+
+    let team = lookup_team_task(worm);
+    if team.is_null() {
+        return;
+    }
+
+    let msg = TeamMessage::NapalmStrike {
+        team_index: (*worm).team_index,
+    };
+    let mut buf = [0u8; 0x40C];
+    let (msg_type, size) = msg.to_raw(&mut buf);
+
+    CTaskTeam::handle_message_raw(
+        team,
+        worm as *mut openwa_core::task::CTask,
+        msg_type,
+        size,
+        buf.as_ptr(),
+    );
+}
+
 /// Send a message to the worm's CTaskTeam entity via SharedData lookup.
 ///
 /// Pattern shared by Napalm Strike (msg 0x2B), Surrender (msg 0x29), etc.
@@ -380,8 +410,8 @@ unsafe fn fire_send_team_message(worm: *mut CTaskWorm, msg_type: u32) {
     let team_index = (*worm).team_index;
     buf[0..4].copy_from_slice(&team_index.to_ne_bytes());
 
-    (*team).handle_message(
-        (*worm).as_task_ptr_mut(),
+    CTaskTeam::handle_message_raw(team,
+        worm as *mut openwa_core::task::CTask,
         msg_type,
         4,
         buf.as_ptr(),
@@ -401,8 +431,8 @@ unsafe fn fire_select_worm(worm: *mut CTaskWorm) {
     buf[0..4].copy_from_slice(&8u32.to_ne_bytes());
     buf[4..8].copy_from_slice(&(*worm).team_index.to_ne_bytes());
 
-    (*team).handle_message(
-        (*worm).as_task_ptr_mut(),
+    CTaskTeam::handle_message_raw(team,
+        worm as *mut openwa_core::task::CTask,
         0x5D,
         0x408,
         buf.as_ptr(),
@@ -416,7 +446,7 @@ unsafe fn fire_select_worm(worm: *mut CTaskWorm) {
 /// In game_version > 0x1C: toggles (set/clear). Otherwise: always sets.
 unsafe fn fire_skip_go(worm: *const CTaskWorm, entry: *const WeaponEntry) {
     use openwa_core::engine::ddgame::TeamArenaRef;
-    let ddgame = (*worm).ddgame();
+    let ddgame = CTask::ddgame_raw(worm as *const CTask);
     let game_version = (*(*ddgame).game_info).game_version;
     let team_index = (*worm).team_index as usize;
 
@@ -443,7 +473,7 @@ unsafe fn fire_surrender(worm: *mut CTaskWorm) {
 
     fire_send_team_message(worm, 0x29);
 
-    let ddgame = (*worm).ddgame();
+    let ddgame = CTask::ddgame_raw(worm as *const CTask);
     let arena = TeamArenaRef::from_ptr(&raw mut (*ddgame).team_arena);
     let team_index = (*worm).team_index as usize;
     let worm_index = (*worm).worm_index as usize;
@@ -465,7 +495,7 @@ unsafe fn fire_surrender(worm: *mut CTaskWorm) {
 /// - otherwise: skip
 unsafe fn fire_mail_mine_mole(worm: *mut CTaskWorm) {
     use openwa_core::engine::ddgame::TeamArenaRef;
-    let ddgame = (*worm).ddgame();
+    let ddgame = CTask::ddgame_raw(worm as *const CTask);
     let version = (*ddgame).version_flag_4;
     let worm_state = (*worm).state();
 
@@ -518,7 +548,7 @@ unsafe fn fire_air_strike(worm: *mut CTaskWorm) {
     *(worm_raw.add(0x34) as *mut i32) = saved_34;
 
     // Compute new state: version < 455 → Idle (0x65), else → 0x8B
-    let ddgame = (*worm).ddgame();
+    let ddgame = CTask::ddgame_raw(worm as *const CTask);
     let game_version = (*(*ddgame).game_info).game_version;
     let new_state = if game_version < 0x1C7 {
         WormState::Idle
@@ -549,7 +579,7 @@ unsafe fn fire_air_strike(worm: *mut CTaskWorm) {
 unsafe fn fire_indian_nuclear_test(worm: *mut CTaskWorm) {
     use crate::replacements::sound;
 
-    let ddgame = (*worm).ddgame();
+    let ddgame = CTask::ddgame_raw(worm as *const CTask);
     let entry = &*(*worm).active_weapon_entry;
     let team = lookup_team_task(worm);
 
@@ -558,7 +588,7 @@ unsafe fn fire_indian_nuclear_test(worm: *mut CTaskWorm) {
         let mut buf = [0u8; 0x40C];
         buf[0..4].copy_from_slice(&entry.fire_method.to_ne_bytes());
         buf[4..8].copy_from_slice(&8i32.to_ne_bytes());
-        (*team).handle_message((*worm).as_task_ptr_mut(), 0x59, 0x408, buf.as_ptr());
+        CTaskTeam::handle_message_raw(team,worm as *mut openwa_core::task::CTask, 0x59, 0x408, buf.as_ptr());
     }
 
     // Message 0x5A (NukeBlast): buf[0]=8
@@ -566,7 +596,7 @@ unsafe fn fire_indian_nuclear_test(worm: *mut CTaskWorm) {
     if !team.is_null() {
         let mut buf = [0u8; 0x40C];
         buf[0..4].copy_from_slice(&8i32.to_ne_bytes());
-        (*team).handle_message((*worm).as_task_ptr_mut(), 0x5A, 0x408, buf.as_ptr());
+        CTaskTeam::handle_message_raw(team,worm as *mut openwa_core::task::CTask, 0x5A, 0x408, buf.as_ptr());
     }
 
     // PlaySoundGlobal(IndianAnthem, 8, 0x10000, 0x10000)
@@ -579,7 +609,7 @@ unsafe fn fire_indian_nuclear_test(worm: *mut CTaskWorm) {
         buf[0..4].copy_from_slice(&entry.fire_params.shot_count.to_ne_bytes());
         buf[4..8].copy_from_slice(&2i32.to_ne_bytes());
         buf[8..12].copy_from_slice(&(*worm).team_index.to_ne_bytes());
-        (*team).handle_message((*worm).as_task_ptr_mut(), 0x51, 0x408, buf.as_ptr());
+        CTaskTeam::handle_message_raw(team,worm as *mut openwa_core::task::CTask, 0x51, 0x408, buf.as_ptr());
     }
 
     // PlaySoundGlobal(NukeFlash, 5, 0x10000, 0x10000)
@@ -673,8 +703,8 @@ unsafe fn fire_jet_pack(worm: *mut CTaskWorm) {
     // Send message 0x5E to CTaskTeam
     let team = lookup_team_task(worm);
     if !team.is_null() {
-        (*team).handle_message(
-            (*worm).as_task_ptr_mut(),
+        CTaskTeam::handle_message_raw(team,
+            worm as *mut openwa_core::task::CTask,
             0x5E,
             0,
             core::ptr::null(),
@@ -684,7 +714,7 @@ unsafe fn fire_jet_pack(worm: *mut CTaskWorm) {
     // Play jet pack sound:
     // FUN_0053EC70: usercall(EDI=0x6CB) + stdcall(timer_obj)
     // FUN_005480F0: usercall(EAX=-21) + stdcall(worm, result, 0x17, &worm_name)
-    let ddgame = (*worm).ddgame();
+    let ddgame = CTask::ddgame_raw(worm as *const CTask);
     let sound_val = call_get_sound_val((*ddgame).timer_obj, rb(0x53EC70));
     call_play_sound_usercall(worm, sound_val, 0x17, (*worm).worm_name.as_ptr(), rb(0x5480F0));
 }
@@ -734,7 +764,7 @@ unsafe extern "C" fn call_play_sound_usercall(
 unsafe fn fire_low_gravity(worm: *mut CTaskWorm) {
     use openwa_core::rebase::rb;
 
-    let ddgame = (*worm).ddgame();
+    let ddgame = CTask::ddgame_raw(worm as *const CTask);
     let game_version = (*(*ddgame).game_info).game_version;
 
     // Send message 0x5B to CTaskTeam with weapon info buffer
@@ -747,8 +777,8 @@ unsafe fn fire_low_gravity(worm: *mut CTaskWorm) {
         buf[0x0C..0x10].copy_from_slice(&((*worm).selected_weapon as u32).to_ne_bytes());
         buf[0x10..0x14].copy_from_slice(&(*worm).team_index.to_ne_bytes());
 
-        (*team).handle_message(
-            (*worm).as_task_ptr_mut(),
+        CTaskTeam::handle_message_raw(team,
+            worm as *mut openwa_core::task::CTask,
             0x5B,
             0x408,
             buf.as_ptr(),
@@ -802,11 +832,11 @@ unsafe fn fire_girder(
     worm: *mut CTaskWorm, fire_params: *const WeaponFireParams, local_struct: *const u8,
 ) {
     use openwa_core::rebase::rb;
-    use openwa_core::task::{SharedDataTable, Task};
+    use openwa_core::task::SharedDataTable;
     use openwa_core::wa_alloc::wa_malloc;
 
     // Look up parent task via SharedData (same key as CreateWeaponProjectile)
-    let table = SharedDataTable::from_task((*worm).as_task_ptr());
+    let table = SharedDataTable::from_task(worm as *const CTask);
     let parent = table.lookup(0, 0x19);
 
     // Allocate CTaskGirder (0xA4 bytes), zero first 0x84
@@ -889,7 +919,7 @@ unsafe extern "C" fn call_fire_usercall(_eax: *const (), _worm: *mut CTaskWorm,
 unsafe fn fire_freeze(worm: *mut CTaskWorm) {
     use openwa_core::rebase::rb;
 
-    let ddgame = (*worm).ddgame();
+    let ddgame = CTask::ddgame_raw(worm as *const CTask);
     let game_version = (*(*ddgame).game_info).game_version;
 
     // Read freeze position and target from CTaskWorm fields
@@ -987,7 +1017,7 @@ fn special_impact_version_flags(base: u32, version: u8) -> u32 {
 /// The original is usercall(ECX=local_struct, ESI=worm) — the old bridge
 /// did not set ECX, so this port also fixes a latent bug.
 unsafe fn fire_drill(worm: *mut CTaskWorm, local_struct: *const u8) {
-    let ddgame = (*worm).ddgame();
+    let ddgame = CTask::ddgame_raw(worm as *const CTask);
     let version = (*ddgame).version_flag_4;
     let entry = &*(*worm).active_weapon_entry;
     let shot_count = entry.fire_params.shot_count;
@@ -1019,7 +1049,7 @@ unsafe fn fire_drill(worm: *mut CTaskWorm, local_struct: *const u8) {
 unsafe fn fire_prod(worm: *mut CTaskWorm, local_struct: *const u8) {
     use openwa_core::rebase::rb;
 
-    let ddgame = (*worm).ddgame();
+    let ddgame = CTask::ddgame_raw(worm as *const CTask);
     let version = (*ddgame).version_flag_4;
     let entry = &*(*worm).active_weapon_entry;
     let shot_count = entry.fire_params.shot_count;
@@ -1157,10 +1187,10 @@ unsafe extern "cdecl" fn create_weapon_projectile_impl(
     worm: *mut CTaskWorm, fire_params: *const WeaponFireParams, local_struct: *const u8,
 ) {
     use openwa_core::rebase::rb;
-    use openwa_core::task::{SharedDataTable, Task};
+    use openwa_core::task::SharedDataTable;
     use openwa_core::wa_alloc::wa_malloc;
 
-    let ddgame = &mut *(*worm).ddgame();
+    let ddgame = &mut *CTask::ddgame_raw(worm as *const CTask);
 
     // Pool capacity check: pool_count + 7 must be <= 700
     if ddgame.object_pool_count + 7 > 700 {
@@ -1169,7 +1199,7 @@ unsafe extern "cdecl" fn create_weapon_projectile_impl(
     }
 
     // Look up parent CTaskTurnGame via SharedData (key_esi=0, key_edi=0x19)
-    let table = SharedDataTable::from_task((*worm).as_task_ptr());
+    let table = SharedDataTable::from_task(worm as *const CTask);
     let parent = table.lookup(0, 0x19);
 
     // Allocate CTaskMissile (0x40C bytes)
@@ -1250,7 +1280,7 @@ unsafe extern "cdecl" fn projectile_fire_impl(
     let sin_table = rb(va::SIN_TABLE) as *const i32;
     let cos_table = sin_table.add(256); // cos = sin offset by 256 entries (quarter turn)
 
-    let ddgame = &mut *(*worm).ddgame();
+    let ddgame = &mut *CTask::ddgame_raw(worm as *const CTask);
 
     for _i in 0..shot_count {
         // Advance game RNG (same LCG as ADVANCE_GAME_RNG at 0x53F320)
@@ -1331,10 +1361,10 @@ unsafe extern "cdecl" fn create_arrow_impl(
     worm: *mut CTaskWorm, fire_params: *const WeaponFireParams, local_struct: *const u8,
 ) {
     use openwa_core::rebase::rb;
-    use openwa_core::task::{SharedDataTable, Task};
+    use openwa_core::task::SharedDataTable;
     use openwa_core::wa_alloc::wa_malloc;
 
-    let ddgame = &mut *(*worm).ddgame();
+    let ddgame = &mut *CTask::ddgame_raw(worm as *const CTask);
 
     // Pool capacity check: pool_count + 2 must be <= 700
     if ddgame.object_pool_count + 2 > 700 {
@@ -1343,7 +1373,7 @@ unsafe extern "cdecl" fn create_arrow_impl(
     }
 
     // Look up parent CTaskTurnGame via SharedData (key 0, 0x19)
-    let table = SharedDataTable::from_task((*worm).as_task_ptr());
+    let table = SharedDataTable::from_task(worm as *const CTask);
     let parent = table.lookup(0, 0x19);
 
     // Allocate CTaskArrow (0x168 bytes)

crates/openwa-wormkit/src/replacements/weapon_release.rs

@@ -10,8 +10,9 @@ use openwa_core::audio::{KnownSoundId, SoundId};
 use openwa_core::fixed::Fixed;
 use openwa_core::game::Weapon;
 use openwa_core::log::log_line;
+use openwa_core::task::team::CTaskTeam;
 use openwa_core::task::worm::{CTaskWorm, WormState};
-use openwa_core::task::{CGameTask, SharedDataTable, Task};
+use openwa_core::task::{CGameTask, CTask, SharedDataTable, Task};
 
 use crate::hook::{self, usercall_trampoline};
 use crate::replacements::{sound, weapon};
@@ -251,8 +252,9 @@ unsafe extern "cdecl" fn weapon_release_impl(
 
     let team = weapon::lookup_team_task(worm);
     if !team.is_null() {
-        (*team).handle_message(
-            (*worm).as_task_ptr_mut(),
+        CTaskTeam::handle_message_raw(
+            team,
+            worm as *mut openwa_core::task::CTask,
             0x49,
             0x408,
             msg_buf.as_ptr(),
@@ -260,7 +262,7 @@ unsafe extern "cdecl" fn weapon_release_impl(
     }
 
     // ── 8. Weapon stat counters ─────────────────────────────
-    let g = &mut *(*worm).ddgame();
+    let g = &mut *CTask::ddgame_raw(worm as *const CTask);
     let team_id = (*worm).team_index;
     let worm_id = (*worm).worm_index;
 
@@ -371,7 +373,7 @@ unsafe extern "cdecl" fn weapon_release_impl(
 
     // ── 10. Visual effect (if triggered by sound dispatch) ──
     if do_effect {
-        let ddgame = &mut *(*worm).ddgame();
+        let ddgame = &mut *CTask::ddgame_raw(worm as *const CTask);
         let gfx_handler = ddgame.game_state_stream as *const u8;
         let palette = *(gfx_handler.add(0x22C) as *const u32);
 
@@ -448,7 +450,7 @@ pub(crate) unsafe fn spawn_effect(
     write_u32(&mut buf, 0x2C, scale.0 as u32);
 
     // SharedData lookup for entity type 0x1A (CTaskSpriteAnim)
-    let table = SharedDataTable::from_task((*worm).as_task_ptr());
+    let table = SharedDataTable::from_task(worm as *const CTask);
     let entity = table.lookup(0, 0x1A);
     if !entity.is_null() {
         let vtable = *(entity as *const *const usize);