refactor: split render.rs, move game logic to core, type command structs

Major restructuring of the render subsystem:

Module split — DLL render.rs (1463 lines) split into:
- render/render_queue.rs: enqueue hook trampolines + install
- render/display_vtable.rs: vtable patch stubs + install
- render/mod.rs: thin re-export

Game logic moved to openwa-core (~1140 lines):
- bitgrid/blit.rs: blit routing (8bpp, 1-bit, generic fallback)
- render/display/blit_sprite.rs: BlitSprite + DrawScaledSprite
- render/bungee_trail.rs: bungee trail rendering
- render/crosshair_line.rs: crosshair line rendering
- render/display/destructor.rs: headless_destructor
- trig.rs: interpolated trig table lookup (sin_lookup, cos_lookup)

Render command struct type improvements:
- Position fields: u32 → Fixed (repr-transparent, layout-compatible)
- Sprite fields: u32 → SpriteOp in DrawSpriteOffsetCmd
- Pointer fields: u32 → *mut DisplayBitGrid / *const TiledBitmapSource
- Named all param_N/_reserved fields from dispatcher semantics
(ref_z, src_x/y/w/h, color, mode, flags, etc.)

Also deduplicates fixed_mul in weapon_fire.rs via Fixed::mul_raw.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/bitgrid/blit.rs

@@ -0,0 +1,385 @@
+//! BitGrid blit operations — sprite blitting on raw BitGrid pointers.
+//!
+//! These functions bridge raw `*mut DisplayBitGrid` pointers to the safe
+//! `PixelGrid`/`BlitSource` abstractions in `render::display::sprite_blit`.
+
+use crate::bitgrid::DisplayBitGrid;
+use crate::render::display::line_draw::PixelGridMut;
+use crate::render::display::sprite_blit::{
+    blit_sprite_rect, blit_stippled, blit_tiled, BlitBlend, BlitOrientation, BlitSource,
+};
+
+/// Rust implementation of the core sprite blit (BitGrid__BlitSpriteRect, 0x4F6910).
+///
+/// Handles all blend modes for both 8bpp and 1-bit surfaces:
+/// - 8bpp modes 0-3: via `blit_sprite_rect` (orientation-aware, PixelGrid wrapper)
+/// - 1-bit byte-aligned fast path: memcpy/OR/nop for modes 0-3 with Normal orientation
+/// - Generic per-pixel fallback: handles all remaining cases (unaligned 1-bit, modes 4-5,
+///   mixed cpp, etc.) via `blit_generic_perpixel`
+pub unsafe fn blit_impl(
+    dst: *mut DisplayBitGrid,
+    dst_x: i32,
+    dst_y: i32,
+    width: i32,
+    height: i32,
+    src: *mut DisplayBitGrid,
+    src_x: i32,
+    src_y: i32,
+    color_table: *const u8,
+    flags: u32,
+) -> u32 {
+    if width == 0 || height == 0 {
+        return 0;
+    }
+
+    let blend_mode = flags & 0xFFFF;
+    let src_cpp = (*src).cells_per_unit;
+    let dst_cpp = (*dst).cells_per_unit;
+
+    // Fast path: 8bpp surfaces with blend modes 0-3
+    if dst_cpp == 8 && src_cpp == 8 && blend_mode <= 3 {
+        return blit_8bpp(
+            dst,
+            dst_x,
+            dst_y,
+            width,
+            height,
+            src,
+            src_x,
+            src_y,
+            color_table,
+            flags,
+        );
+    }
+
+    // --- Clipping (shared by 1-bit fast path and generic fallback) ---
+    // This mirrors the clipping logic at the top of BitGrid__BlitSpriteRect.
+    let dst_right = dst_x + width;
+    let dst_bottom = dst_y + height;
+
+    let clip_left = (*dst).clip_left as i32;
+    let clip_top = (*dst).clip_top as i32;
+    let clip_right = (*dst).clip_right as i32;
+    let clip_bottom = (*dst).clip_bottom as i32;
+
+    // Early-out: completely outside clip rect
+    if dst_x >= clip_right
+        || dst_right <= clip_left
+        || dst_y >= clip_bottom
+        || dst_bottom <= clip_top
+    {
+        return 0;
+    }
+
+    // Clamp visible region to clip rect
+    let vis_left = dst_x.max(clip_left);
+    let vis_right = dst_right.min(clip_right);
+    let vis_top = dst_y.max(clip_top);
+    let vis_bottom = dst_bottom.min(clip_bottom);
+
+    if vis_left >= vis_right || vis_top >= vis_bottom {
+        return 0;
+    }
+
+    // Adjust source coordinates for clipping and orientation.
+    // The orientation switch in the original adjusts src_x/src_y before the cpp check.
+    let orientation_code = (flags >> 16) & 0xFFFF;
+    let (adj_src_x, adj_src_y) = adjust_src_for_orientation(
+        src_x,
+        src_y,
+        dst_x,
+        dst_y,
+        width,
+        height,
+        vis_left,
+        vis_top,
+        vis_right,
+        vis_bottom,
+        orientation_code,
+    );
+
+    // Build slices from raw BitGrid data pointers
+    let dst_data =
+        core::slice::from_raw_parts_mut((*dst).data, ((*dst).row_stride * (*dst).height) as usize);
+    let src_data =
+        core::slice::from_raw_parts((*src).data, ((*src).row_stride * (*src).height) as usize);
+
+    // 1-bit byte-aligned fast path
+    if dst_cpp == 1 && src_cpp == 1 {
+        let left_aligned = (vis_left & 7) == 0;
+        let right_aligned = (vis_right & 7) == 0;
+        let src_aligned = (adj_src_x & 7) == 0;
+
+        if left_aligned && right_aligned && src_aligned && color_table.is_null() && flags < 4 {
+            crate::render::display::sprite_blit::blit_1bit_aligned(
+                dst_data,
+                (*dst).row_stride,
+                src_data,
+                (*src).row_stride,
+                vis_left,
+                vis_top,
+                vis_right,
+                vis_bottom,
+                adj_src_x,
+                adj_src_y,
+                blend_mode,
+            );
+            return 1;
+        }
+    }
+
+    // Convert color_table pointer to typed reference for the generic path
+    let color_table_ref: Option<&[u8; 256]> = if !color_table.is_null() {
+        Some(&*(color_table as *const [u8; 256]))
+    } else {
+        None
+    };
+
+    // Generic per-pixel fallback — handles all remaining cases
+    crate::render::display::sprite_blit::blit_generic_perpixel(
+        dst_data,
+        (*dst).row_stride,
+        dst_cpp,
+        src_data,
+        (*src).row_stride,
+        src_cpp,
+        vis_left,
+        vis_top,
+        vis_right,
+        vis_bottom,
+        adj_src_x,
+        adj_src_y,
+        color_table_ref,
+        blend_mode,
+    )
+}
+
+/// Adjust source coordinates for clipping and orientation.
+///
+/// Port of the orientation switch in BitGrid__BlitSpriteRect (0x4F69D3..0x4F6A9D).
+/// Maps the 16 orientation codes (0-15) to 8 unique source adjustments.
+pub fn adjust_src_for_orientation(
+    src_x: i32,
+    src_y: i32,
+    dst_x: i32,
+    dst_y: i32,
+    width: i32,
+    height: i32,
+    vis_left: i32,
+    vis_top: i32,
+    vis_right: i32,
+    vis_bottom: i32,
+    orientation: u32,
+) -> (i32, i32) {
+    match orientation {
+        1 | 10 => {
+            // MirrorX: src_x from right side, src_y from top
+            let sx = src_x + (dst_x - vis_right) + width;
+            let sy = src_y + (vis_top - dst_y);
+            (sx, sy)
+        }
+        2 | 9 => {
+            // MirrorY: src_x from left, src_y from bottom
+            let sx = src_x + (vis_left - dst_x);
+            let sy = src_y + (dst_y - vis_bottom) + height;
+            (sx, sy)
+        }
+        3 | 8 => {
+            // MirrorXY: src_x from right, src_y from bottom
+            let sx = src_x + (dst_x - vis_right) + width;
+            let sy = src_y + (dst_y - vis_bottom) + height;
+            (sx, sy)
+        }
+        4 | 15 => {
+            // Rotate90: src_x tracks dst_y from bottom, src_y tracks dst_x from left
+            let sx = src_x + (dst_y - vis_bottom) + height;
+            let sy = src_y + (vis_left - dst_x);
+            (sx, sy)
+        }
+        5 | 14 => {
+            // Rotate90+MirrorX
+            let sx = src_x + (dst_y - vis_bottom) + height;
+            let sy = src_y + (dst_x - vis_right) + width;
+            (sx, sy)
+        }
+        6 | 13 => {
+            // Rotate90+MirrorY
+            let sx = src_x + (vis_top - dst_y);
+            let sy = src_y + (vis_left - dst_x);
+            (sx, sy)
+        }
+        7 | 12 => {
+            // Rotate90+MirrorXY
+            let sx = src_x + (vis_top - dst_y);
+            let sy = src_y + (dst_x - vis_right) + width;
+            (sx, sy)
+        }
+        _ => {
+            // Normal (0, 11, or any default)
+            let sx = src_x + (vis_left - dst_x);
+            let sy = src_y + (vis_top - dst_y);
+            (sx, sy)
+        }
+    }
+}
+
+/// 8bpp blit path — extracted from the original blit_impl for clarity.
+///
+/// Handles blend modes 0-3 on 8bpp surfaces via PixelGrid wrapper.
+pub unsafe fn blit_8bpp(
+    dst: *mut DisplayBitGrid,
+    dst_x: i32,
+    dst_y: i32,
+    width: i32,
+    height: i32,
+    src: *mut DisplayBitGrid,
+    src_x: i32,
+    src_y: i32,
+    color_table: *const u8,
+    flags: u32,
+) -> u32 {
+    let color_table_ref: Option<&[u8; 256]> = if !color_table.is_null() {
+        Some(&*(color_table as *const [u8; 256]))
+    } else {
+        None
+    };
+
+    let orientation = BlitOrientation::from_flags(flags);
+    let blend = BlitBlend::from_flags(flags);
+
+    let src_data =
+        core::slice::from_raw_parts((*src).data, ((*src).row_stride * (*src).height) as usize);
+    let blit_src = BlitSource {
+        data: src_data,
+        width: (*src).width,
+        height: (*src).height,
+        row_stride: (*src).row_stride,
+    };
+
+    let dst_data_len = ((*dst).row_stride * (*dst).height) as usize;
+    let dst_grid = PixelGridMut {
+        data: core::slice::from_raw_parts_mut((*dst).data, dst_data_len),
+        width: (*dst).width,
+        height: (*dst).height,
+        row_stride: (*dst).row_stride,
+        clip_left: (*dst).clip_left,
+        clip_top: (*dst).clip_top,
+        clip_right: (*dst).clip_right,
+        clip_bottom: (*dst).clip_bottom,
+    };
+
+    blit_sprite_rect(
+        dst_grid,
+        &blit_src,
+        dst_x,
+        dst_y,
+        width,
+        height,
+        src_x,
+        src_y,
+        color_table_ref,
+        orientation,
+        blend,
+    ) as u32
+}
+
+/// Stippled blit on raw BitGrid pointers.
+///
+/// Wraps the raw pointers into PixelGrid/BlitSource and calls
+/// `sprite_blit::blit_stippled`.
+pub unsafe fn blit_stippled_raw(
+    dst: *mut DisplayBitGrid,
+    src: *mut DisplayBitGrid,
+    dst_x: i32,
+    dst_y: i32,
+    width: i32,
+    height: i32,
+    src_x: i32,
+    src_y: i32,
+    stipple_mode: u32,
+    parity: u32,
+) {
+    let src_data =
+        core::slice::from_raw_parts((*src).data, ((*src).row_stride * (*src).height) as usize);
+    let blit_src = BlitSource {
+        data: src_data,
+        width: (*src).width,
+        height: (*src).height,
+        row_stride: (*src).row_stride,
+    };
+
+    let dst_data_len = ((*dst).row_stride * (*dst).height) as usize;
+    let mut dst_grid = PixelGridMut {
+        data: core::slice::from_raw_parts_mut((*dst).data, dst_data_len),
+        width: (*dst).width,
+        height: (*dst).height,
+        row_stride: (*dst).row_stride,
+        clip_left: (*dst).clip_left,
+        clip_top: (*dst).clip_top,
+        clip_right: (*dst).clip_right,
+        clip_bottom: (*dst).clip_bottom,
+    };
+
+    blit_stippled(
+        &mut dst_grid,
+        &blit_src,
+        dst_x,
+        dst_y,
+        width,
+        height,
+        src_x,
+        src_y,
+        stipple_mode,
+        parity,
+    );
+}
+
+/// Tiled blit on raw BitGrid pointers.
+///
+/// Wraps the raw pointers into PixelGrid/BlitSource and calls
+/// `sprite_blit::blit_tiled`.
+pub unsafe fn blit_tiled_raw(
+    dst: *mut DisplayBitGrid,
+    src: *mut DisplayBitGrid,
+    initial_x: i32,
+    dst_y: i32,
+    tile_width: i32,
+    tile_height: i32,
+    clip_left: i32,
+    clip_right: i32,
+    flags: u32,
+) {
+    let src_data =
+        core::slice::from_raw_parts((*src).data, ((*src).row_stride * (*src).height) as usize);
+    let blit_src = BlitSource {
+        data: src_data,
+        width: (*src).width,
+        height: (*src).height,
+        row_stride: (*src).row_stride,
+    };
+
+    let dst_data_len = ((*dst).row_stride * (*dst).height) as usize;
+    let mut dst_grid = PixelGridMut {
+        data: core::slice::from_raw_parts_mut((*dst).data, dst_data_len),
+        width: (*dst).width,
+        height: (*dst).height,
+        row_stride: (*dst).row_stride,
+        clip_left: (*dst).clip_left,
+        clip_top: (*dst).clip_top,
+        clip_right: (*dst).clip_right,
+        clip_bottom: (*dst).clip_bottom,
+    };
+
+    blit_tiled(
+        &mut dst_grid,
+        &blit_src,
+        initial_x,
+        dst_y,
+        tile_width,
+        tile_height,
+        clip_left,
+        clip_right,
+        None, // color_table — tiled mode doesn't use one
+        flags,
+    );
+}

crates/openwa-core/src/{bitgrid.rs → bitgrid/mod.rs}

@@ -35,6 +35,8 @@
 //! (*display_grid).vtable = rb_ptr(BIT_GRID_DISPLAY_VTABLE);
 //! ```
 
+pub mod blit;
+
 use crate::rebase::rb;
 use crate::task::base::Vtable;
 use crate::wa_alloc::{wa_malloc, wa_malloc_struct_zeroed};

crates/openwa-core/src/game/weapon_fire.rs

@@ -1363,7 +1363,7 @@ pub unsafe fn projectile_fire(
 /// Fixed-point 16.16 multiply: (a * b) >> 16, using full 64-bit intermediate.
 #[inline(always)]
 fn fixed_mul(a: i32, b: i32) -> i32 {
-    ((a as i64 * b as i64) >> 16) as i32
+    crate::fixed::Fixed(a).mul_raw(crate::fixed::Fixed(b)).0
 }
 
 /// Rust implementation of CreateArrow (0x51ED90).

crates/openwa-core/src/lib.rs

@@ -46,6 +46,7 @@ pub mod registry;
 pub mod rng;
 pub mod snapshot;
 pub mod task;
+pub mod trig;
 pub mod vtable;
 pub mod wa;
 pub mod wa_alloc;

crates/openwa-core/src/render/bungee_trail.rs

@@ -0,0 +1,129 @@
+//! Bungee trail rendering — draws the bungee drop trajectory path.
+//!
+//! Ported from WA.exe `DrawBungeeTrail` (0x500720).
+//! Draws:
+//!   1. Sprite at trail start position
+//!   2. Series of vertices computed by accumulating angle + trig interpolation
+//!   3. Final vertex at task position (0x84/0x88)
+//!   4. DrawPolygon (if fill != 0) or DrawLineStrip
+
+use crate::address::va;
+use crate::fixed::Fixed;
+use crate::rebase::rb;
+use crate::render::queue::*;
+use crate::render::SpriteOp;
+use crate::task::BungeeTrailTask;
+use crate::trig::trig_lookup;
+
+/// Draw bungee trail for the given task.
+///
+/// # Safety
+///
+/// `task_ptr` must point to a valid `BungeeTrailTask`. ASLR rebase must be
+/// initialized.
+pub unsafe fn draw_bungee_trail(task_ptr: u32, style: u32, fill: u32) {
+    let task = &*(task_ptr as *const BungeeTrailTask);
+
+    if task.trail_visible == 0 {
+        return;
+    }
+
+    let ddgame = &*task.base.ddgame;
+    let rq = &mut *ddgame.render_queue;
+
+    let seg_data = task.segment_data;
+    if seg_data.is_null() {
+        return;
+    }
+
+    let segment_count = task.segment_count;
+    if segment_count <= 0 {
+        return;
+    }
+
+    let mut x = task.trail_start_x;
+    let mut y = task.trail_start_y;
+
+    let first_angle = *(seg_data.add(4) as *const i32);
+
+    // Enqueue start sprite (command type 5 = local)
+    if let Some(entry) = rq.alloc::<DrawSpriteCmd>() {
+        *entry = DrawSpriteCmd {
+            command_type: command_type::DRAW_SPRITE_LOCAL,
+            layer: 0xDFFFF,
+            x: Fixed(x).floor(),
+            y: Fixed(y).floor(),
+            sprite: SpriteOp(0x45),
+            palette: (first_angle + 0x8100) as u32,
+        };
+    }
+
+    // Build vertex array from trail segments
+    const MAX_VERTICES: usize = 256;
+    let mut verts = [[0i32; 3]; MAX_VERTICES];
+    let mut vert_count: usize = 0;
+    let mut accumulated_angle: u32 = 0;
+
+    let sin_table = rb(va::G_SIN_TABLE) as *const i32;
+    let cos_table = rb(va::G_COS_TABLE) as *const i32;
+
+    for i in 0..segment_count {
+        let seg_angle = *(seg_data.add(4 + i as usize * 8) as *const i32);
+
+        // Include vertex if: first segment, or segment has nonzero angle, or fill mode
+        if (i == 0 || seg_angle != 0 || fill != 0) && vert_count < MAX_VERTICES {
+            verts[vert_count] = [x, y, 0];
+            vert_count += 1;
+        }
+
+        accumulated_angle = accumulated_angle.wrapping_add(seg_angle as u32);
+
+        let sin_interp = trig_lookup(sin_table, accumulated_angle);
+        let cos_interp = trig_lookup(cos_table, accumulated_angle);
+
+        x = x.wrapping_add(sin_interp.0.wrapping_mul(8));
+        y = y.wrapping_sub(cos_interp.0.wrapping_mul(8));
+    }
+
+    // Final vertex = task position (target)
+    if vert_count < MAX_VERTICES {
+        verts[vert_count] = [task.pos_x.0, task.pos_y.0, 0];
+        vert_count += 1;
+    }
+
+    // Enqueue as polygon or line strip
+    if fill != 0 {
+        let total_size = vert_count * 0xC + 0x20;
+        if let Some(ptr) = rq.alloc_raw(total_size) {
+            let header = &mut *(ptr as *mut DrawPolygonHeader);
+            *header = DrawPolygonHeader {
+                command_type: command_type::DRAW_POLYGON,
+                layer: 0xE_0000,
+                count: vert_count as u32,
+                color1: style,
+                color2: fill,
+            };
+            core::ptr::copy_nonoverlapping(
+                verts.as_ptr() as *const u8,
+                ptr.add(core::mem::size_of::<DrawPolygonHeader>()),
+                vert_count * 0xC,
+            );
+        }
+    } else {
+        let total_size = vert_count * 0xC + 0x1C;
+        if let Some(ptr) = rq.alloc_raw(total_size) {
+            let header = &mut *(ptr as *mut DrawLineStripHeader);
+            *header = DrawLineStripHeader {
+                command_type: command_type::DRAW_LINE_STRIP,
+                layer: 0xE_0000,
+                count: vert_count as u32,
+                color: style,
+            };
+            core::ptr::copy_nonoverlapping(
+                verts.as_ptr() as *const u8,
+                ptr.add(core::mem::size_of::<DrawLineStripHeader>()),
+                vert_count * 0xC,
+            );
+        }
+    }
+}

crates/openwa-core/src/render/crosshair_line.rs

@@ -0,0 +1,120 @@
+//! Crosshair line rendering — draws the weapon aiming crosshair line.
+//!
+//! Ported from WA.exe `DrawCrosshairLine` (0x5197D0).
+//! Draws:
+//!   1. Compute direction from angle at task+0x264
+//!   2. Compute line length from DDGame scale + task offset
+//!   3. Endpoint = start + direction * length (with overflow clamping)
+//!   4. DrawPolygon (2 vertices) for the line
+//!   5. Conditionally DrawSpriteLocal at endpoint (crosshair sprite)
+
+use crate::address::va;
+use crate::fixed::Fixed;
+use crate::rebase::rb;
+use crate::render::queue::*;
+use crate::render::SpriteOp;
+use crate::task::WeaponAimTask;
+use crate::trig::trig_lookup;
+
+/// Draw the weapon aiming crosshair line for the given task.
+///
+/// # Safety
+///
+/// `task_ptr` must point to a valid `WeaponAimTask`. ASLR rebase must be
+/// initialized.
+pub unsafe fn draw_crosshair_line(task_ptr: u32) {
+    let task = &*(task_ptr as *const WeaponAimTask);
+    let gt = &task.game_task;
+
+    if task.aim_active == 0 {
+        return;
+    }
+
+    let ddgame = &*gt.base.ddgame;
+    let rq = &mut *ddgame.render_queue;
+
+    let start_x = gt.pos_x.0;
+    let start_y = gt.pos_y.0;
+
+    let angle = task.aim_angle;
+
+    // Trig interpolation
+    let sin_table = rb(va::G_SIN_TABLE) as *const i32;
+    let cos_table = rb(va::G_COS_TABLE) as *const i32;
+    let sin_interp = trig_lookup(sin_table, angle);
+    let cos_interp = trig_lookup(cos_table, angle);
+
+    // Scale = fixed_mul(DDGame.parallax_scale, 0x140000) + task.aim_range_offset
+    let scale = Fixed(ddgame.parallax_scale).mul_raw(Fixed(0x14_0000)).0 + task.aim_range_offset;
+
+    // Endpoint = start + direction * scale
+    let mut endpoint_x = Fixed(sin_interp.0)
+        .mul_raw(Fixed(scale))
+        .0
+        .wrapping_add(start_x);
+    let mut endpoint_y = Fixed(cos_interp.0)
+        .mul_raw(Fixed(scale))
+        .0
+        .wrapping_add(start_y);
+
+    // Overflow clamping — when endpoint overflows i32 due to large scale
+    let mut overflowed = false;
+    let mut clamp_factor = 0i32;
+
+    let threshold = (*ddgame.game_info).game_version;
+
+    if threshold > 0x11E {
+        // Check X overflow: sin > 0 but endpoint wrapped below start
+        if sin_interp.0 > 0 && endpoint_x < start_x {
+            overflowed = true;
+            clamp_factor = (0x7FFFFFFFi32 - start_x) / sin_interp.0;
+        }
+        // Check Y overflow: cos > 0 but endpoint wrapped below start
+        if cos_interp.0 > 0 && endpoint_y < start_y {
+            let y_clamp = (0x7FFFFFFFi32 - start_y) / cos_interp.0;
+            if !overflowed || y_clamp < clamp_factor {
+                clamp_factor = y_clamp;
+            }
+            overflowed = true;
+        }
+        if overflowed {
+            endpoint_x = start_x + clamp_factor * sin_interp.0;
+            endpoint_y = start_y + clamp_factor * cos_interp.0;
+        }
+    }
+
+    // Enqueue polygon line (2 vertices)
+    let poly_param_1 = ddgame.gfx_color_table[8]; // crosshair line style
+    let poly_param_2 = ddgame.gfx_color_table[6]; // crosshair line color
+    let verts: [[i32; 3]; 2] = [[start_x, start_y, 0], [endpoint_x, endpoint_y, 0]];
+    let total_size = 2 * 0xC + 0x20;
+    if let Some(ptr) = rq.alloc_raw(total_size) {
+        let header = &mut *(ptr as *mut DrawPolygonHeader);
+        *header = DrawPolygonHeader {
+            command_type: command_type::DRAW_POLYGON,
+            layer: 0xE_0000,
+            count: 2,
+            color1: poly_param_1,
+            color2: poly_param_2,
+        };
+        core::ptr::copy_nonoverlapping(
+            verts.as_ptr() as *const u8,
+            ptr.add(core::mem::size_of::<DrawPolygonHeader>()),
+            2 * 0xC,
+        );
+    }
+
+    // Draw crosshair sprite at endpoint (only if no overflow clamping)
+    if !overflowed {
+        if let Some(entry) = rq.alloc::<DrawSpriteCmd>() {
+            *entry = DrawSpriteCmd {
+                command_type: command_type::DRAW_SPRITE_LOCAL,
+                layer: 0x4_0000,
+                x: Fixed(endpoint_x).floor(),
+                y: Fixed(endpoint_y).floor(),
+                sprite: SpriteOp(0x44),
+                palette: (0x8000u32).wrapping_sub(angle),
+            };
+        }
+    }
+}

crates/openwa-core/src/render/display/blit_sprite.rs

@@ -0,0 +1,455 @@
+//! Rust port of DisplayGfx::BlitSprite (slot 19) and DrawScaledSprite (slot 20).
+//!
+//! These are the high-level sprite blit entry points that resolve sprite IDs,
+//! apply palette transforms, compute destination coordinates with orientation,
+//! and dispatch to the low-level BitGrid blit routines.
+
+use crate::address::va;
+use crate::bitgrid::blit::{blit_impl, blit_stippled_raw, blit_tiled_raw};
+use crate::bitgrid::DisplayBitGrid;
+use crate::fixed::Fixed;
+use crate::rebase::rb;
+use crate::render::display::gfx::DisplayGfx;
+use crate::render::display::vtable as display_vtable;
+use crate::render::display::vtable::DrawScaledSpriteResult;
+use crate::render::{SpriteFlags, SpriteOp};
+
+/// Rust port of DisplayGfx::BlitSprite (slot 19, 0x56B080).
+///
+/// Resolves sprite ID + animation, applies palette transforms, computes
+/// destination coordinates with orientation, and dispatches to the appropriate
+/// blit routine (normal, stippled, or tiled).
+pub unsafe fn blit_sprite(
+    this: *mut DisplayGfx,
+    x: Fixed,
+    y: Fixed,
+    sprite_flags: u32,
+    palette: u32,
+) {
+    let gfx = this;
+    let base = this as *const u8;
+
+    // ---------------------------------------------------------------
+    // Extract sprite index and flags
+    // ---------------------------------------------------------------
+    let sprite = SpriteOp(sprite_flags);
+    let flags = sprite.flags();
+    let sprite_id = sprite.index() as u32;
+
+    if sprite_id == 0 {
+        return;
+    }
+
+    // ---------------------------------------------------------------
+    // Palette manipulation
+    // ---------------------------------------------------------------
+    let mut pal: u32 = palette;
+    if flags.contains(SpriteFlags::INVERT_PALETTE) {
+        pal = 0x10000u32.wrapping_sub(palette);
+        if sprite_id.wrapping_sub(0x1D5) < 3 {
+            // Special sprite IDs: scale by 8/18
+            pal = (0x10000u32.wrapping_sub(palette).wrapping_mul(8)) / 0x12;
+        }
+    }
+    if flags.contains(SpriteFlags::PALETTE_XFORM) {
+        // Bit 25: palette transform (modular arithmetic for color cycling)
+        let tmp = ((pal.wrapping_mul(0x1F) as i32)
+            .wrapping_add(((pal.wrapping_mul(0x1F) as i32) >> 31) & 0x1F)
+            >> 5) as u32;
+        let tmp = tmp.wrapping_add(0x400) & 0xFFFF;
+        pal = (tmp.wrapping_rem(0xF800)) / 2;
+        if (pal & 0x400) != 0 {
+            pal = (pal & !0x400) | 0x8000;
+        }
+    }
+
+    // ---------------------------------------------------------------
+    // Check sprite arrays — bitmap path if not in primary arrays
+    // ---------------------------------------------------------------
+    let arr1 = *(base.add(sprite_id as usize * 4 + 0x1008) as *const u32);
+    let arr2 = *(base.add(sprite_id as usize * 4 + 0x2008) as *const u32);
+
+    if arr1 == 0 && arr2 == 0 {
+        // Bitmap sprite path — sprite is in the bitmap table at 0x3DD4.
+        let bitmap_obj = (*gfx).sprite_table[sprite_id as usize];
+        if bitmap_obj.is_null() {
+            return;
+        }
+
+        // Get frame data and dimensions from bitmap sprite object.
+        let mut sprite_w: i32 = 0;
+        let mut sprite_h: i32 = 0;
+        let mut rect_left: i32 = 0;
+        let mut rect_top: i32 = 0;
+        let mut rect_right: i32 = 0;
+        let mut rect_bottom: i32 = 0;
+        let frame_data = display_vtable::get_bitmap_sprite_info(
+            bitmap_obj,
+            pal,
+            &mut sprite_w,
+            &mut sprite_h,
+            &mut rect_left,
+            &mut rect_top,
+            &mut rect_right,
+            &mut rect_bottom,
+        );
+        if frame_data.is_null() {
+            return;
+        }
+
+        let camera_x = (*gfx).camera_x;
+        let camera_y = (*gfx).camera_y;
+        let half_w = sprite_w / 2;
+        let half_h = sprite_h / 2;
+        let blit_h = rect_bottom - rect_top;
+        let dst_x = (x.0 >> 16) + (camera_x - half_w) + rect_left;
+        let dst_y = (y.0 >> 16) + (camera_y - half_h) + rect_top;
+
+        if !flags.contains(SpriteFlags::TILED) {
+            // Non-tiled: clipped blit at (dst_x, dst_y).
+            display_vtable::blit_bitmap_clipped_native(
+                gfx, dst_x, dst_y, sprite_w, blit_h, frame_data, 2,
+            );
+        } else {
+            // Tiled: horizontal tile across the clip rect.
+            display_vtable::blit_bitmap_tiled_native(
+                gfx, dst_x, sprite_w, dst_y, blit_h, frame_data,
+            );
+        }
+        return;
+    }
+
+    // ---------------------------------------------------------------
+    // Bit 24: palette ×4 adjust with orientation-dependent high bits
+    // ---------------------------------------------------------------
+    // The original ASM at 0x56B145 scales pal by 4, adds 0x8000, then
+    // uses the overflow quadrant (bits 16-17 of the scaled value) to
+    // select an orientation+blend combo. The low 16 bits become the
+    // new palette value.
+    let mut orient_local: u32 = 0x0000_0001; // blend=1 (ColorTable/transparency), orientation=0 (Normal)
+    if flags.contains(SpriteFlags::PALETTE_X4) {
+        let scaled = pal.wrapping_mul(4).wrapping_add(0x8000);
+        pal = scaled & 0xFFFF;
+        let quad = ((scaled as i32) >> 16) & 3;
+        orient_local = match quad {
+            0 => 0x0008_0001, // MirrorXY + ColorTable
+            1 => 0x000C_0001, // Rotate90MirrorXY + ColorTable
+            2 => 0x0004_0001, // Rotate90 + ColorTable
+            _ => 0x0000_0001, // Normal + ColorTable
+        };
+    }
+
+    // ---------------------------------------------------------------
+    // Sprite frame lookup via DisplayGfx::GetSpriteFrameForBlit (slot 33).
+    // ---------------------------------------------------------------
+    // Resolves the sprite ID + animation value into the actual decompressed
+    // frame surface plus its bounding box and full sprite-cell dimensions
+    // (used below for centering and clipped blits).
+    let mut out_sprite_w: i32 = 0;
+    let mut out_sprite_h: i32 = 0;
+    let mut out_rect_left: i32 = 0;
+    let mut out_rect_top: i32 = 0;
+    let mut out_rect_right: i32 = 0;
+    let mut out_rect_bottom: i32 = 0;
+    let mut out_anim_frac: u32 = 0;
+
+    let mut sprite_surface = DisplayGfx::get_sprite_frame_for_blit_raw(
+        gfx,
+        sprite_id,
+        pal,
+        &mut out_sprite_w,
+        &mut out_sprite_h,
+        &mut out_rect_left,
+        &mut out_rect_top,
+        &mut out_rect_right,
+        &mut out_rect_bottom,
+        &mut out_anim_frac,
+    );
+
+    if sprite_surface.is_null() {
+        return;
+    }
+
+    let sprite_w = out_sprite_w;
+    let sprite_h = out_sprite_h;
+    let rect_left = out_rect_left;
+    let rect_top = out_rect_top;
+    let rect_right = out_rect_right;
+    let rect_bottom = out_rect_bottom;
+
+    // Size checks
+    if rect_left >= rect_right || rect_top >= rect_bottom {
+        return;
+    }
+
+    let mut blit_w = rect_right - rect_left;
+    let mut blit_h = rect_bottom - rect_top;
+
+    // ---------------------------------------------------------------
+    // Shadow clear (high_flags bit 22)
+    // ---------------------------------------------------------------
+    if flags.contains(SpriteFlags::SHADOW_CLEAR) {
+        // Blit sprite to layer_2 as shadow base
+        let layer2 = (*gfx).layer_2;
+        blit_impl(
+            layer2,
+            0,
+            0,
+            blit_w,
+            blit_h,
+            sprite_surface,
+            0,
+            0,
+            core::ptr::null(),
+            0, // mode 0 = copy
+        );
+        // Manipulate color_add_table entry for shadow
+        let color_idx = ((*gfx)._unknown_356c as usize) * 0x100;
+        let table_byte = &mut (*gfx).color_add_table[color_idx];
+        let saved = *table_byte;
+        *table_byte = 0;
+
+        // Call BitGrid__ClearColumn_Maybe (0x4F6590) — clears shadow channel
+        let clear_fn: unsafe extern "cdecl" fn(*mut u8) =
+            core::mem::transmute(rb(0x004F6590) as usize);
+        clear_fn(table_byte as *mut u8);
+
+        *table_byte = saved;
+
+        // Replace sprite surface with layer_2 (shadow-processed)
+        sprite_surface = layer2;
+    }
+
+    // ---------------------------------------------------------------
+    // Extra orientation flags from high_flags
+    // ---------------------------------------------------------------
+    if flags.contains(SpriteFlags::MIRROR_X) {
+        orient_local |= 0x0001_0000;
+    }
+    if flags.contains(SpriteFlags::MIRROR_Y) {
+        orient_local |= 0x0002_0000;
+    }
+
+    // ---------------------------------------------------------------
+    // 16-case orientation switch for camera coordinate mapping
+    // ---------------------------------------------------------------
+    let camera_x = (*gfx).camera_x;
+    let camera_y = (*gfx).camera_y;
+
+    // Signed divide toward zero (matches MSVC CDQ+SUB+SAR pattern)
+    let half_w = if sprite_w < 0 {
+        (sprite_w + 1) / 2
+    } else {
+        sprite_w / 2
+    };
+    let half_h = if sprite_h < 0 {
+        (sprite_h + 1) / 2
+    } else {
+        sprite_h / 2
+    };
+
+    let x_px = x.0 >> 16;
+    let y_px = y.0 >> 16;
+
+    let (dst_x, dst_y);
+    let orientation_key = (orient_local >> 16) as i32;
+
+    match orientation_key {
+        1 | 10 => {
+            // MirrorX
+            dst_x = camera_x + half_w + x_px - rect_right;
+            dst_y = camera_y - half_h + rect_top + y_px;
+        }
+        2 | 9 => {
+            // MirrorY — X same as Normal, Y mirrored
+            dst_x = camera_x - half_w + rect_left + x_px;
+            dst_y = camera_y + half_h + y_px - rect_bottom;
+        }
+        3 | 8 => {
+            // MirrorXY
+            dst_x = camera_x + half_w + x_px - rect_right;
+            dst_y = camera_y + half_h + y_px - rect_bottom;
+        }
+        4 | 15 => {
+            // Rotate90 — swap axes
+            dst_x = camera_x - half_h + rect_top + x_px;
+            dst_y = camera_y + half_w + y_px - rect_right;
+            blit_w = rect_bottom - rect_top;
+            blit_h = rect_right - rect_left;
+        }
+        5 | 14 => {
+            // Rotate90MirrorX
+            dst_x = camera_x + half_h + x_px - rect_bottom;
+            dst_y = camera_y + half_w + y_px - rect_right;
+            blit_w = rect_bottom - rect_top;
+            blit_h = rect_right - rect_left;
+        }
+        6 | 13 => {
+            // Rotate90MirrorY
+            dst_x = camera_x - half_h + rect_top + x_px;
+            dst_y = camera_y - half_w + rect_left + y_px;
+            blit_w = rect_bottom - rect_top;
+            blit_h = rect_right - rect_left;
+        }
+        7 | 12 => {
+            // Rotate90MirrorXY
+            dst_x = camera_x + half_h + x_px - rect_bottom;
+            dst_y = camera_y - half_w + rect_left + y_px;
+            blit_w = rect_bottom - rect_top;
+            blit_h = rect_right - rect_left;
+        }
+        _ => {
+            // Normal (0, 11, and any other value)
+            dst_x = camera_x - half_w + rect_left + x_px;
+            dst_y = camera_y - half_h + rect_top + y_px;
+        }
+    }
+
+    // ---------------------------------------------------------------
+    // Blit dispatch based on high_flags
+    // ---------------------------------------------------------------
+
+    if blit_w <= 0 || blit_h <= 0 {
+        return;
+    }
+
+    // Stippled mode (checkerboard per-pixel blit)
+    if flags.intersects(SpriteFlags::STIPPLED_0 | SpriteFlags::STIPPLED_1) {
+        let stipple_mode: u32 = if flags.contains(SpriteFlags::STIPPLED_1) {
+            1
+        } else {
+            0
+        };
+        let parity = *(rb(va::G_STIPPLE_PARITY) as *const u32);
+
+        display_vtable::acquire_render_lock(gfx);
+
+        blit_stippled_raw(
+            (*gfx).layer_0,
+            sprite_surface,
+            dst_x,
+            dst_y,
+            blit_w,
+            blit_h,
+            0,
+            0,
+            stipple_mode,
+            parity,
+        );
+        return;
+    }
+
+    // Tiled mode (horizontal sprite tiling)
+    if flags.contains(SpriteFlags::TILED) {
+        display_vtable::acquire_render_lock(gfx);
+
+        blit_tiled_raw(
+            (*gfx).layer_0,
+            sprite_surface,
+            dst_x,
+            dst_y,
+            blit_w,
+            blit_h,
+            (*gfx).base.clip_x1,
+            (*gfx).base.clip_x2,
+            orient_local,
+        );
+        return;
+    }
+
+    // Determine color table pointer
+    let color_table: *const u8 = if flags.contains(SpriteFlags::ADDITIVE) {
+        (*gfx).color_add_table.as_ptr()
+    } else if flags.contains(SpriteFlags::COLOR_BLEND) {
+        (*gfx).color_blend_table.as_ptr()
+    } else {
+        core::ptr::null()
+    };
+
+    display_vtable::acquire_render_lock(gfx);
+
+    // src_x=0, src_y=0 always — vtable[33] already set up the sprite surface
+    blit_impl(
+        (*gfx).layer_0,
+        dst_x,
+        dst_y,
+        blit_w,
+        blit_h,
+        sprite_surface,
+        0,
+        0,
+        color_table,
+        orient_local,
+    );
+}
+
+/// Rust port of DisplayGfx::DrawScaledSprite (slot 20, 0x56B5F0).
+///
+/// Computes coordinates in the vtable helper, then dispatches the blit
+/// via blit_impl or blit_stippled_raw depending on the result.
+pub unsafe fn draw_scaled_sprite(
+    this: *mut DisplayGfx,
+    x: Fixed,
+    y: Fixed,
+    sprite: *mut DisplayBitGrid,
+    src_x: i32,
+    src_y: i32,
+    src_w: i32,
+    src_h: i32,
+    flags: u32,
+) {
+    match display_vtable::draw_scaled_sprite(this, x, y, sprite, src_x, src_y, src_w, src_h, flags)
+    {
+        DrawScaledSpriteResult::Blit {
+            layer,
+            dst_x,
+            dst_y,
+            width,
+            height,
+            sprite,
+            src_x,
+            src_y,
+            color_table,
+            blit_flags,
+        } => {
+            blit_impl(
+                layer,
+                dst_x,
+                dst_y,
+                width,
+                height,
+                sprite,
+                src_x,
+                src_y,
+                color_table,
+                blit_flags,
+            );
+        }
+        DrawScaledSpriteResult::Stippled {
+            layer,
+            dst_x,
+            dst_y,
+            width,
+            height,
+            sprite,
+            src_x,
+            src_y,
+            stipple_mode,
+        } => {
+            let parity = *(rb(va::G_STIPPLE_PARITY) as *const u32);
+            blit_stippled_raw(
+                layer,
+                sprite,
+                dst_x,
+                dst_y,
+                width,
+                height,
+                src_x,
+                src_y,
+                stipple_mode,
+                parity,
+            );
+        }
+        DrawScaledSpriteResult::Handled => {}
+    }
+}

crates/openwa-core/src/render/display/destructor.rs

@@ -43,6 +43,7 @@ use core::ptr;
 use crate::address::va;
 use crate::bitgrid::{BitGridBaseVtable, BIT_GRID_BASE_VTABLE};
 use crate::rebase::rb;
+use crate::render::display::base::DisplayBase;
 use crate::render::display::context::{FastcallResult, RenderContext};
 use crate::render::display::frame_hook::FramePostProcessHook;
 use crate::render::display::gfx::{DisplayGfx, TileBitmapSet, DISPLAY_BASE_DESTRUCTOR_IMPL};
@@ -293,3 +294,38 @@ unsafe fn cbitmap_vtable0(bitmap: *mut CBitmap, flags: u32) {
         core::mem::transmute(*vtable);
     dtor(bitmap, flags);
 }
+
+// =============================================================================
+// Headless destructor — used when DisplayBase is a headless stub
+// =============================================================================
+
+/// Destructor for the headless `DisplayBase` — frees the sprite cache chain
+/// (SpriteCache → FrameCache → buffer) that was allocated by `new_headless()`.
+///
+/// Installed as vtable slot 0 on the headless `DisplayBase` vtable (0x66A0F8)
+/// by the DLL's display hook installer.
+///
+/// # Safety
+///
+/// `this` must be a valid `DisplayBase` pointer with a headless-allocated
+/// sprite cache chain.
+pub unsafe fn headless_destructor(this: *mut DisplayBase, flags: u8) -> *mut DisplayBase {
+    use crate::wa_alloc::wa_free;
+
+    let sprite_cache = (*this).sprite_cache;
+    if !sprite_cache.is_null() {
+        let frame_cache = (*sprite_cache).frame_cache;
+        if !frame_cache.is_null() {
+            let buf = (*frame_cache).buffer;
+            if !buf.is_null() {
+                wa_free(buf);
+            }
+            wa_free(frame_cache);
+        }
+        wa_free(sprite_cache);
+    }
+    if flags & 1 != 0 {
+        wa_free(this);
+    }
+    this
+}

crates/openwa-core/src/render/display/mod.rs

@@ -1,4 +1,5 @@
 pub mod base;
+pub mod blit_sprite;
 pub mod context;
 pub mod destructor;
 pub mod font;

crates/openwa-core/src/render/mod.rs

@@ -1,3 +1,5 @@
+pub mod bungee_trail;
+pub mod crosshair_line;
 pub mod ddraw;
 pub mod display;
 pub mod landscape;

crates/openwa-core/src/render/queue.rs

@@ -1,3 +1,7 @@
+use crate::bitgrid::DisplayBitGrid;
+use crate::fixed::Fixed;
+use crate::render::display::vtable::TiledBitmapSource;
+
 use super::message::{RenderMessage, TypedRenderCmd, COMMAND_TYPE_TYPED};
 use super::sprite::sprite_op::SpriteOp;
 
@@ -10,10 +14,10 @@ pub struct DrawSpriteCmd {
     /// Command type: 4 = sprite global (world-space), 5 = sprite local (screen-space)
     pub command_type: u32,
     pub layer: u32,
-    /// X position, upper 16 bits used (Fixed16 format)
-    pub x_pos: u32,
-    /// Y position, upper 16 bits used (Fixed16 format)
-    pub y_pos: u32,
+    /// X position (Fixed16, fractional bits always zero — producers floor before storing).
+    pub x: Fixed,
+    /// Y position (Fixed16, fractional bits always zero — producers floor before storing).
+    pub y: Fixed,
     pub sprite: SpriteOp,
     /// Palette context — passed to `blit_sprite` as the last arg.
     /// Semantics vary by producer (palette pointer, animation index, etc.).
@@ -116,14 +120,14 @@ pub struct DrawTiledBitmapCmd {
     /// 0x08: Source X coordinate (Fixed16). Hardcoded 0xFF00_0000 (= -256.0)
     /// — the tile sheet always renders from off-screen-left, with the
     /// dispatcher's clipping pass producing the on-screen X.
-    pub x_fixed16: u32,
+    pub x: Fixed,
     /// 0x0C: Source Y coordinate (Fixed16). Caller-supplied; goes through
     /// `RQ_ClipCoordinates` and the high 16 bits become the destination Y.
-    pub y_fixed16: u32,
-    /// 0x10: Pointer to a sprite source descriptor — read by the slot 11
-    /// method as `p4` with fields at `+0x08` (bpp, 8 or 0x40), `+0x10`
+    pub y: Fixed,
+    /// 0x10: Pointer to a [`TiledBitmapSource`] descriptor — read by the
+    /// slot 11 method with fields at `+0x08` (bpp, 8 or 0x40), `+0x10`
     /// (source row stride), `+0x14`, and `+0x18` (total source height).
-    pub source_descriptor: u32,
+    pub source: *const TiledBitmapSource,
     /// 0x14: Flag byte. Bit 0 forces the destination X to 0 (ignoring the
     /// clipped result), used for "always start at left edge" rendering.
     pub flags: u8,
@@ -143,9 +147,9 @@ pub struct DrawCrosshairCmd {
     pub layer: u32,
     pub color_fg: u32,
     pub color_bg: u32,
-    pub x_pos: u32,
-    pub y_pos: u32,
-    pub _reserved: u32, // hardcoded 0 (clip ref)
+    pub x: Fixed,
+    pub y: Fixed,
+    pub ref_z: i32, // hardcoded 0 (perspective clip reference Z)
 }
 
 const _: () = assert!(core::mem::size_of::<DrawCrosshairCmd>() == 0x1C);
@@ -156,11 +160,11 @@ pub struct DrawRectCmd {
     pub command_type: u32, // 0
     pub layer: u32,
     pub color: u32,
-    pub x1: u32,     // & 0xFFFF0000
-    pub y1: u32,     // & 0xFFFF0000
-    pub x2: u32,     // & 0xFFFF0000
-    pub y2: u32,     // & 0xFFFF0000
-    pub y_clip: u32, // EDX & 0xFFFF0000
+    pub x1: Fixed,
+    pub y1: Fixed,
+    pub x2: Fixed,
+    pub y2: Fixed,
+    pub ref_z: i32, // perspective clip reference Z (EDX & 0xFFFF0000)
 }
 
 const _: () = assert!(core::mem::size_of::<DrawRectCmd>() == 0x20);
@@ -170,13 +174,13 @@ const _: () = assert!(core::mem::size_of::<DrawRectCmd>() == 0x20);
 pub struct DrawSpriteOffsetCmd {
     pub command_type: u32, // 6
     pub layer: u32,
-    pub sprite_id: u32,
-    pub x_pos: u32,     // & 0xFFFF0000
-    pub y_pos: u32,     // & 0xFFFF0000
-    pub _reserved: u32, // hardcoded 0
-    pub y_clip: u32,    // EDX & 0xFFFF0000
-    pub param_7: u32,
-    pub param_8: u32,
+    pub flags: u32,
+    pub x: Fixed,
+    pub y: Fixed,
+    pub ref_z: i32,   // first Z reference for perspective clip (hardcoded 0)
+    pub ref_z_2: i32, // second Z reference (EDX & 0xFFFF0000)
+    pub sprite: SpriteOp,
+    pub palette: u32,
 }
 
 const _: () = assert!(core::mem::size_of::<DrawSpriteOffsetCmd>() == 0x24);
@@ -186,14 +190,14 @@ const _: () = assert!(core::mem::size_of::<DrawSpriteOffsetCmd>() == 0x24);
 pub struct DrawBitmapGlobalCmd {
     pub command_type: u32, // 1
     pub layer: u32,
-    pub x_pos: u32, // & 0xFFFF0000
-    pub y_pos: u32, // EDX & 0xFFFF0000
-    pub bitmap_ptr: u32,
-    pub _reserved: u32, // hardcoded 0
-    pub param_6: u32,
-    pub param_7: u32,
-    pub param_8: u32,
-    pub param_9: u32,
+    pub x: Fixed,
+    pub y: Fixed,
+    pub bitmap: *mut DisplayBitGrid,
+    pub src_x: i32, // hardcoded 0
+    pub src_y: i32,
+    pub src_w: i32,
+    pub src_h: i32,
+    pub flags: u32,
 }
 
 const _: () = assert!(core::mem::size_of::<DrawBitmapGlobalCmd>() == 0x28);
@@ -203,17 +207,17 @@ const _: () = assert!(core::mem::size_of::<DrawBitmapGlobalCmd>() == 0x28);
 pub struct DrawTextboxLocalCmd {
     pub command_type: u32, // 2
     pub layer: u32,
-    pub _reserved_2: u32, // hardcoded 0
-    pub x_pos: u32,       // & 0xFFFF0000
-    pub y_pos: u32,       // EDX & 0xFFFF0000
-    pub _reserved_5: u32, // hardcoded 0
-    pub _reserved_6: u32, // hardcoded 0
-    pub text_ptr: u32,
-    pub _reserved_8: u32, // hardcoded 0
-    pub _reserved_9: u32, // hardcoded 0
-    pub param_6: u32,
-    pub param_7: u32,
-    pub param_8: u32,
+    pub mode: u32,
+    pub x: Fixed,
+    pub y: Fixed,
+    pub ref_z: i32,   // perspective clip reference Z (hardcoded 0)
+    pub ref_z_2: i32, // second Z reference (hardcoded 0)
+    pub bitmap: *mut DisplayBitGrid,
+    pub src_x: i32, // hardcoded 0
+    pub src_y: i32, // hardcoded 0
+    pub src_w: i32,
+    pub src_h: i32,
+    pub flags: u32,
 }
 
 const _: () = assert!(core::mem::size_of::<DrawTextboxLocalCmd>() == 0x34);
@@ -226,7 +230,7 @@ pub struct DrawLineStripHeader {
     pub command_type: u32, // 8
     pub layer: u32,        // hardcoded 0xE_0000
     pub count: u32,        // vertex count (from EDI)
-    pub param_1: u32,      // stack param
+    pub color: u32,        // line color
 }
 
 const _: () = assert!(core::mem::size_of::<DrawLineStripHeader>() == 0x10);
@@ -239,8 +243,8 @@ pub struct DrawPolygonHeader {
     pub command_type: u32, // 9
     pub layer: u32,        // hardcoded 0xE_0000
     pub count: u32,        // vertex count (from ESI)
-    pub param_1: u32,      // stack param 1
-    pub param_2: u32,      // stack param 2
+    pub color1: u32,       // line color 1
+    pub color2: u32,       // line color 2
 }
 
 const _: () = assert!(core::mem::size_of::<DrawPolygonHeader>() == 0x14);

crates/openwa-core/src/trig.rs

@@ -0,0 +1,51 @@
+//! Interpolated fixed-point trig table lookup.
+//!
+//! WA stores sine and cosine values as 1025-entry fixed-point 16.16 tables
+//! at [`va::G_SIN_TABLE`] and [`va::G_COS_TABLE`]. Each table covers one full
+//! period in 1024 steps (2π / 1024 radians per step); the 1025th entry is a
+//! sentinel that allows interpolation at the wraparound.
+//!
+//! The lookup angle is a 16-bit quantity where the full range 0..0xFFFF
+//! maps to one full period. The upper 10 bits select the table entry and
+//! the lower 6 bits are used for linear interpolation between adjacent
+//! entries.
+
+use crate::fixed::Fixed;
+use crate::rebase::rb;
+
+/// Interpolated lookup from a 1025-entry fixed-point trig table.
+///
+/// `table` must point to at least 1025 `i32` values (the standard WA
+/// sine/cosine layout). `angle` is a 16-bit angle where the full range
+/// 0..0xFFFF maps to one full period.
+///
+/// Returns a Fixed 16.16 value interpolated between the two nearest
+/// table entries.
+#[inline]
+pub unsafe fn trig_lookup(table: *const i32, angle: u32) -> Fixed {
+    let index = ((angle as i32) >> 6) as usize & 0x3FF;
+    let frac = Fixed::from_raw(((angle & 0x3F) << 10) as i32);
+    let base = Fixed::from_raw(*table.add(index));
+    let next = Fixed::from_raw(*table.add(index + 1));
+    (next - base).mul_raw(frac) + base
+}
+
+/// Sine lookup from WA's global sine table.
+///
+/// # Safety
+///
+/// Requires ASLR rebase to have been computed (i.e. the DLL is loaded).
+#[inline]
+pub unsafe fn sin_lookup(angle: u32) -> Fixed {
+    trig_lookup(rb(crate::address::va::G_SIN_TABLE) as *const i32, angle)
+}
+
+/// Cosine lookup from WA's global cosine table.
+///
+/// # Safety
+///
+/// Requires ASLR rebase to have been computed (i.e. the DLL is loaded).
+#[inline]
+pub unsafe fn cos_lookup(angle: u32) -> Fixed {
+    trig_lookup(rb(crate::address::va::G_COS_TABLE) as *const i32, angle)
+}

crates/openwa-dll/src/replacements/bitgrid.rs

@@ -827,7 +827,7 @@ unsafe extern "cdecl" fn wa_blit_sprite_rect(
 /// Trampoline to the original WA blit function (for unsupported modes).
 static ORIG_BLIT: AtomicU32 = AtomicU32::new(0);
 
-/// Naked trampoline: captures ESI (dst BitGrid) and forwards to cdecl impl.
+/// Naked trampoline: captures ESI (dst BitGrid) and forwards to cdecl wrapper.
 ///
 /// Original calling convention: ESI=dst, 9 stdcall params, RET 0x24.
 #[unsafe(naked)]
@@ -850,18 +850,15 @@ unsafe extern "C" fn blit_hook_trampoline() {
         "mov esp, ebp",
         "pop ebp",
         "ret 0x24",
-        impl_fn = sym blit_impl,
+        impl_fn = sym blit_impl_cdecl,
     );
 }
 
-/// Rust implementation of the core sprite blit (BitGrid__BlitSpriteRect, 0x4F6910).
+/// Thin cdecl wrapper around `openwa_core::bitgrid::blit::blit_impl`.
 ///
-/// Handles all blend modes for both 8bpp and 1-bit surfaces:
-/// - 8bpp modes 0-3: via `blit_sprite_rect` (orientation-aware, PixelGrid wrapper)
-/// - 1-bit byte-aligned fast path: memcpy/OR/nop for modes 0-3 with Normal orientation
-/// - Generic per-pixel fallback: handles all remaining cases (unaligned 1-bit, modes 4-5,
-///   mixed cpp, etc.) via `blit_generic_perpixel`
-pub(crate) unsafe extern "cdecl" fn blit_impl(
+/// The naked asm trampoline calls this with cdecl convention; this simply
+/// forwards to the core implementation which is a plain `unsafe fn`.
+unsafe extern "cdecl" fn blit_impl_cdecl(
     dst: *mut openwa_core::bitgrid::DisplayBitGrid,
     dst_x: i32,
     dst_y: i32,
@@ -873,368 +870,18 @@ pub(crate) unsafe extern "cdecl" fn blit_impl(
     color_table: *const u8,
     flags: u32,
 ) -> u32 {
-    if width == 0 || height == 0 {
-        return 0;
-    }
-
-    let blend_mode = flags & 0xFFFF;
-    let src_cpp = (*src).cells_per_unit;
-    let dst_cpp = (*dst).cells_per_unit;
-
-    // Fast path: 8bpp surfaces with blend modes 0-3
-    if dst_cpp == 8 && src_cpp == 8 && blend_mode <= 3 {
-        return blit_8bpp(
-            dst,
-            dst_x,
-            dst_y,
-            width,
-            height,
-            src,
-            src_x,
-            src_y,
-            color_table,
-            flags,
-        );
-    }
-
-    // --- Clipping (shared by 1-bit fast path and generic fallback) ---
-    // This mirrors the clipping logic at the top of BitGrid__BlitSpriteRect.
-    let dst_right = dst_x + width;
-    let dst_bottom = dst_y + height;
-
-    let clip_left = (*dst).clip_left as i32;
-    let clip_top = (*dst).clip_top as i32;
-    let clip_right = (*dst).clip_right as i32;
-    let clip_bottom = (*dst).clip_bottom as i32;
-
-    // Early-out: completely outside clip rect
-    if dst_x >= clip_right
-        || dst_right <= clip_left
-        || dst_y >= clip_bottom
-        || dst_bottom <= clip_top
-    {
-        return 0;
-    }
-
-    // Clamp visible region to clip rect
-    let vis_left = dst_x.max(clip_left);
-    let vis_right = dst_right.min(clip_right);
-    let vis_top = dst_y.max(clip_top);
-    let vis_bottom = dst_bottom.min(clip_bottom);
-
-    if vis_left >= vis_right || vis_top >= vis_bottom {
-        return 0;
-    }
-
-    // Adjust source coordinates for clipping and orientation.
-    // The orientation switch in the original adjusts src_x/src_y before the cpp check.
-    let orientation_code = (flags >> 16) & 0xFFFF;
-    let (adj_src_x, adj_src_y) = adjust_src_for_orientation(
-        src_x,
-        src_y,
-        dst_x,
-        dst_y,
-        width,
-        height,
-        vis_left,
-        vis_top,
-        vis_right,
-        vis_bottom,
-        orientation_code,
-    );
-
-    // Build slices from raw BitGrid data pointers
-    let dst_data =
-        core::slice::from_raw_parts_mut((*dst).data, ((*dst).row_stride * (*dst).height) as usize);
-    let src_data =
-        core::slice::from_raw_parts((*src).data, ((*src).row_stride * (*src).height) as usize);
-
-    // 1-bit byte-aligned fast path
-    if dst_cpp == 1 && src_cpp == 1 {
-        let left_aligned = (vis_left & 7) == 0;
-        let right_aligned = (vis_right & 7) == 0;
-        let src_aligned = (adj_src_x & 7) == 0;
-
-        if left_aligned && right_aligned && src_aligned && color_table.is_null() && flags < 4 {
-            openwa_core::render::display::sprite_blit::blit_1bit_aligned(
-                dst_data,
-                (*dst).row_stride,
-                src_data,
-                (*src).row_stride,
-                vis_left,
-                vis_top,
-                vis_right,
-                vis_bottom,
-                adj_src_x,
-                adj_src_y,
-                blend_mode,
-            );
-            return 1;
-        }
-    }
-
-    // Convert color_table pointer to typed reference for the generic path
-    let color_table_ref: Option<&[u8; 256]> = if !color_table.is_null() {
-        Some(&*(color_table as *const [u8; 256]))
-    } else {
-        None
-    };
-
-    // Generic per-pixel fallback — handles all remaining cases
-    openwa_core::render::display::sprite_blit::blit_generic_perpixel(
-        dst_data,
-        (*dst).row_stride,
-        dst_cpp,
-        src_data,
-        (*src).row_stride,
-        src_cpp,
-        vis_left,
-        vis_top,
-        vis_right,
-        vis_bottom,
-        adj_src_x,
-        adj_src_y,
-        color_table_ref,
-        blend_mode,
-    )
-}
-
-/// Adjust source coordinates for clipping and orientation.
-///
-/// Port of the orientation switch in BitGrid__BlitSpriteRect (0x4F69D3..0x4F6A9D).
-/// Maps the 16 orientation codes (0-15) to 8 unique source adjustments.
-fn adjust_src_for_orientation(
-    src_x: i32,
-    src_y: i32,
-    dst_x: i32,
-    dst_y: i32,
-    width: i32,
-    height: i32,
-    vis_left: i32,
-    vis_top: i32,
-    vis_right: i32,
-    vis_bottom: i32,
-    orientation: u32,
-) -> (i32, i32) {
-    match orientation {
-        1 | 10 => {
-            // MirrorX: src_x from right side, src_y from top
-            let sx = src_x + (dst_x - vis_right) + width;
-            let sy = src_y + (vis_top - dst_y);
-            (sx, sy)
-        }
-        2 | 9 => {
-            // MirrorY: src_x from left, src_y from bottom
-            let sx = src_x + (vis_left - dst_x);
-            let sy = src_y + (dst_y - vis_bottom) + height;
-            (sx, sy)
-        }
-        3 | 8 => {
-            // MirrorXY: src_x from right, src_y from bottom
-            let sx = src_x + (dst_x - vis_right) + width;
-            let sy = src_y + (dst_y - vis_bottom) + height;
-            (sx, sy)
-        }
-        4 | 15 => {
-            // Rotate90: src_x tracks dst_y from bottom, src_y tracks dst_x from left
-            let sx = src_x + (dst_y - vis_bottom) + height;
-            let sy = src_y + (vis_left - dst_x);
-            (sx, sy)
-        }
-        5 | 14 => {
-            // Rotate90+MirrorX
-            let sx = src_x + (dst_y - vis_bottom) + height;
-            let sy = src_y + (dst_x - vis_right) + width;
-            (sx, sy)
-        }
-        6 | 13 => {
-            // Rotate90+MirrorY
-            let sx = src_x + (vis_top - dst_y);
-            let sy = src_y + (vis_left - dst_x);
-            (sx, sy)
-        }
-        7 | 12 => {
-            // Rotate90+MirrorXY
-            let sx = src_x + (vis_top - dst_y);
-            let sy = src_y + (dst_x - vis_right) + width;
-            (sx, sy)
-        }
-        _ => {
-            // Normal (0, 11, or any default)
-            let sx = src_x + (vis_left - dst_x);
-            let sy = src_y + (vis_top - dst_y);
-            (sx, sy)
-        }
-    }
-}
-
-/// 8bpp blit path — extracted from the original blit_impl for clarity.
-///
-/// Handles blend modes 0-3 on 8bpp surfaces via PixelGrid wrapper.
-unsafe fn blit_8bpp(
-    dst: *mut openwa_core::bitgrid::DisplayBitGrid,
-    dst_x: i32,
-    dst_y: i32,
-    width: i32,
-    height: i32,
-    src: *mut openwa_core::bitgrid::DisplayBitGrid,
-    src_x: i32,
-    src_y: i32,
-    color_table: *const u8,
-    flags: u32,
-) -> u32 {
-    use openwa_core::render::display::sprite_blit::{
-        blit_sprite_rect, BlitBlend, BlitOrientation, BlitSource,
-    };
-
-    let color_table_ref: Option<&[u8; 256]> = if !color_table.is_null() {
-        Some(&*(color_table as *const [u8; 256]))
-    } else {
-        None
-    };
-
-    let orientation = BlitOrientation::from_flags(flags);
-    let blend = BlitBlend::from_flags(flags);
-
-    let src_data =
-        core::slice::from_raw_parts((*src).data, ((*src).row_stride * (*src).height) as usize);
-    let blit_src = BlitSource {
-        data: src_data,
-        width: (*src).width,
-        height: (*src).height,
-        row_stride: (*src).row_stride,
-    };
-
-    let dst_data_len = ((*dst).row_stride * (*dst).height) as usize;
-    let dst_grid = openwa_core::render::display::line_draw::PixelGridMut {
-        data: core::slice::from_raw_parts_mut((*dst).data, dst_data_len),
-        width: (*dst).width,
-        height: (*dst).height,
-        row_stride: (*dst).row_stride,
-        clip_left: (*dst).clip_left,
-        clip_top: (*dst).clip_top,
-        clip_right: (*dst).clip_right,
-        clip_bottom: (*dst).clip_bottom,
-    };
-
-    blit_sprite_rect(
-        dst_grid,
-        &blit_src,
-        dst_x,
-        dst_y,
-        width,
-        height,
-        src_x,
-        src_y,
-        color_table_ref,
-        orientation,
-        blend,
-    ) as u32
-}
-
-/// Stippled blit on raw BitGrid pointers.
-///
-/// Wraps the raw pointers into PixelGrid/BlitSource and calls
-/// `sprite_blit::blit_stippled`.
-pub(crate) unsafe fn blit_stippled_raw(
-    dst: *mut openwa_core::bitgrid::DisplayBitGrid,
-    src: *mut openwa_core::bitgrid::DisplayBitGrid,
-    dst_x: i32,
-    dst_y: i32,
-    width: i32,
-    height: i32,
-    src_x: i32,
-    src_y: i32,
-    stipple_mode: u32,
-    parity: u32,
-) {
-    use openwa_core::render::display::sprite_blit::{blit_stippled, BlitSource};
-
-    let src_data =
-        core::slice::from_raw_parts((*src).data, ((*src).row_stride * (*src).height) as usize);
-    let blit_src = BlitSource {
-        data: src_data,
-        width: (*src).width,
-        height: (*src).height,
-        row_stride: (*src).row_stride,
-    };
-
-    let dst_data_len = ((*dst).row_stride * (*dst).height) as usize;
-    let mut dst_grid = openwa_core::render::display::line_draw::PixelGridMut {
-        data: core::slice::from_raw_parts_mut((*dst).data, dst_data_len),
-        width: (*dst).width,
-        height: (*dst).height,
-        row_stride: (*dst).row_stride,
-        clip_left: (*dst).clip_left,
-        clip_top: (*dst).clip_top,
-        clip_right: (*dst).clip_right,
-        clip_bottom: (*dst).clip_bottom,
-    };
-
-    blit_stippled(
-        &mut dst_grid,
-        &blit_src,
+    openwa_core::bitgrid::blit::blit_impl(
+        dst,
         dst_x,
         dst_y,
         width,
         height,
+        src,
         src_x,
         src_y,
-        stipple_mode,
-        parity,
-    );
-}
-
-/// Tiled blit on raw BitGrid pointers.
-///
-/// Wraps the raw pointers into PixelGrid/BlitSource and calls
-/// `sprite_blit::blit_tiled`.
-pub(crate) unsafe fn blit_tiled_raw(
-    dst: *mut openwa_core::bitgrid::DisplayBitGrid,
-    src: *mut openwa_core::bitgrid::DisplayBitGrid,
-    initial_x: i32,
-    dst_y: i32,
-    tile_width: i32,
-    tile_height: i32,
-    clip_left: i32,
-    clip_right: i32,
-    flags: u32,
-) {
-    use openwa_core::render::display::sprite_blit::{blit_tiled, BlitSource};
-
-    let src_data =
-        core::slice::from_raw_parts((*src).data, ((*src).row_stride * (*src).height) as usize);
-    let blit_src = BlitSource {
-        data: src_data,
-        width: (*src).width,
-        height: (*src).height,
-        row_stride: (*src).row_stride,
-    };
-
-    let dst_data_len = ((*dst).row_stride * (*dst).height) as usize;
-    let mut dst_grid = openwa_core::render::display::line_draw::PixelGridMut {
-        data: core::slice::from_raw_parts_mut((*dst).data, dst_data_len),
-        width: (*dst).width,
-        height: (*dst).height,
-        row_stride: (*dst).row_stride,
-        clip_left: (*dst).clip_left,
-        clip_top: (*dst).clip_top,
-        clip_right: (*dst).clip_right,
-        clip_bottom: (*dst).clip_bottom,
-    };
-
-    blit_tiled(
-        &mut dst_grid,
-        &blit_src,
-        initial_x,
-        dst_y,
-        tile_width,
-        tile_height,
-        clip_left,
-        clip_right,
-        None, // color_table — tiled mode doesn't use one
+        color_table,
         flags,
-    );
+    )
 }
 
 /// Call the original WA blit function via trampoline.

crates/openwa-dll/src/replacements/render.rs

@@ -1,1463 +0,0 @@
-//! Render subsystem hooks — RenderQueue enqueue + DisplayGfx vtable patches.
-//!
-//! Combines two subsystems:
-//! - RenderQueue enqueue hooks (full Rust replacements for command enqueueing)
-//! - DisplayGfx vtable patches (DisplayBase pure-call stubs, headless destructor,
-//!   and ported DisplayGfx methods)
-
-use core::ffi::c_char;
-
-use openwa_core::address::va;
-use openwa_core::rebase::rb;
-use openwa_core::render::queue::*;
-use openwa_core::render::sprite::gfx_dir::GfxDir;
-use openwa_core::render::SpriteOp;
-use openwa_core::task::{BungeeTrailTask, WeaponAimTask};
-
-use crate::hook::{self, usercall_trampoline};
-use crate::log_line;
-
-// ==========================================================================
-// RenderQueue enqueue hooks
-// ==========================================================================
-//
-// All functions enqueue commands to the RenderQueue's downward-growing buffer.
-// Calling conventions are __usercall variants with register + stack params.
-
-// ---------------------------------------------------------------------------
-// EnqueueTiledBitmap (0x541D60) — type 0xD, EAX=this, 3 stack, RET 0xC
-//
-// Mis-labelled `RQ_DrawPixel` in earlier reverse-engineering passes. It does
-// NOT enqueue a single-pixel draw — it enqueues a tile-cached bitmap draw
-// dispatched by `RenderDrawingQueue` case 0xD into vtable slot 11.
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_enqueue_tiled_bitmap; impl_fn = enqueue_tiled_bitmap_impl;
-    reg = eax; stack_params = 3; ret_bytes = "0xC");
-
-unsafe extern "cdecl" fn enqueue_tiled_bitmap_impl(
-    this: u32,
-    y_fixed16: u32,
-    source_descriptor: u32,
-    flags: u32,
-) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawTiledBitmapCmd>() {
-        *entry = DrawTiledBitmapCmd {
-            command_type: command_type::DRAW_TILED_BITMAP,
-            layer: 0x1B_0000,
-            x_fixed16: 0xFF00_0000,
-            y_fixed16,
-            source_descriptor,
-            flags: flags as u8,
-            _pad: [0; 3],
-        };
-    }
-}
-
-// ---------------------------------------------------------------------------
-// DrawLineStrip (0x541DD0) — type 8, EAX=this, EDI=count, 2 stack, RET 0x8
-// Allocation: count * 0xC + 0x1C (variable size)
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_draw_line_strip; impl_fn = draw_line_strip_impl;
-    regs = [eax, edi]; stack_params = 2; ret_bytes = "0x8");
-
-unsafe extern "cdecl" fn draw_line_strip_impl(
-    this: u32,
-    count: u32,
-    vertex_ptr: u32,
-    param_1: u32,
-) {
-    let q = &mut *(this as *mut RenderQueue);
-    let total_size = count as usize * 0xC + 0x1C;
-
-    if let Some(ptr) = q.alloc_raw(total_size) {
-        let header = &mut *(ptr as *mut DrawLineStripHeader);
-        *header = DrawLineStripHeader {
-            command_type: command_type::DRAW_LINE_STRIP,
-            layer: 0xE_0000,
-            count,
-            param_1,
-        };
-        core::ptr::copy_nonoverlapping(
-            vertex_ptr as *const u8,
-            ptr.add(core::mem::size_of::<DrawLineStripHeader>()),
-            count as usize * 0xC,
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// DrawPolygon (0x541E50) — type 9, ECX=this, ESI=count, 3 stack, RET 0xC
-// Allocation: count * 0xC + 0x20 (variable size)
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_draw_polygon; impl_fn = draw_polygon_impl;
-    regs = [ecx, esi]; stack_params = 3; ret_bytes = "0xC");
-
-unsafe extern "cdecl" fn draw_polygon_impl(
-    this: u32,
-    count: u32,
-    vertex_ptr: u32,
-    param_1: u32,
-    param_2: u32,
-) {
-    let q = &mut *(this as *mut RenderQueue);
-    let total_size = count as usize * 0xC + 0x20;
-
-    if let Some(ptr) = q.alloc_raw(total_size) {
-        let header = &mut *(ptr as *mut DrawPolygonHeader);
-        *header = DrawPolygonHeader {
-            command_type: command_type::DRAW_POLYGON,
-            layer: 0xE_0000,
-            count,
-            param_1,
-            param_2,
-        };
-        core::ptr::copy_nonoverlapping(
-            vertex_ptr as *const u8,
-            ptr.add(core::mem::size_of::<DrawPolygonHeader>()),
-            count as usize * 0xC,
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// DrawCrosshair (0x541ED0) — type 0xB, ECX=this, 5 stack, RET 0x14
-// Enqueues a crosshair draw command. Dispatched by RenderDrawingQueue
-// case 0xB → DisplayGfx::draw_crosshair (vtable slot 16).
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_draw_crosshair; impl_fn = draw_crosshair_impl;
-    reg = ecx; stack_params = 5; ret_bytes = "0x14");
-
-unsafe extern "cdecl" fn draw_crosshair_impl(
-    this: u32,
-    layer: u32,
-    x_pos: u32,
-    y_pos: u32,
-    color_fg: u32,
-    color_bg: u32,
-) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawCrosshairCmd>() {
-        *entry = DrawCrosshairCmd {
-            command_type: command_type::DRAW_CROSSHAIR,
-            layer,
-            color_fg,
-            color_bg,
-            x_pos,
-            y_pos,
-            _reserved: 0,
-        };
-    }
-}
-
-// ---------------------------------------------------------------------------
-// DrawRect (0x541F40) — type 0, ECX=this, EDX=y_clip, 6 stack, RET 0x18
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_draw_rect; impl_fn = draw_rect_impl;
-    regs = [ecx, edx]; stack_params = 6; ret_bytes = "0x18");
-
-unsafe extern "cdecl" fn draw_rect_impl(
-    this: u32,
-    y_clip: u32,
-    layer: u32,
-    x1: u32,
-    y1: u32,
-    x2: u32,
-    y2: u32,
-    color: u32,
-) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawRectCmd>() {
-        *entry = DrawRectCmd {
-            command_type: command_type::DRAW_RECT,
-            layer,
-            color,
-            x1: x1 & 0xFFFF0000,
-            y1: y1 & 0xFFFF0000,
-            x2: x2 & 0xFFFF0000,
-            y2: y2 & 0xFFFF0000,
-            y_clip: y_clip & 0xFFFF0000,
-        };
-    }
-}
-
-// ---------------------------------------------------------------------------
-// DrawSpriteGlobal (0x541FE0) — type 4, EAX=y, ECX=this, 4 stack, RET 0x10
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_draw_sprite_global; impl_fn = draw_sprite_global_impl;
-    regs = [eax, ecx]; stack_params = 4; ret_bytes = "0x10");
-
-unsafe extern "cdecl" fn draw_sprite_global_impl(
-    y_pos: u32,
-    this: u32,
-    layer: u32,
-    x_pos: u32,
-    sprite_id: u32,
-    frame: u32,
-) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawSpriteCmd>() {
-        *entry = DrawSpriteCmd {
-            command_type: command_type::DRAW_SPRITE_GLOBAL,
-            layer,
-            x_pos: x_pos & 0xFFFF0000,
-            y_pos: y_pos & 0xFFFF0000,
-            sprite: SpriteOp(sprite_id),
-            palette: frame,
-        };
-    }
-}
-
-// ---------------------------------------------------------------------------
-// DrawSpriteLocal (0x542060) — type 5, EAX=y, ECX=this, 4 stack, RET 0x10
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_draw_sprite_local; impl_fn = draw_sprite_local_impl;
-    regs = [eax, ecx]; stack_params = 4; ret_bytes = "0x10");
-
-unsafe extern "cdecl" fn draw_sprite_local_impl(
-    y_pos: u32,
-    this: u32,
-    layer: u32,
-    x_pos: u32,
-    sprite_id: u32,
-    frame: u32,
-) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawSpriteCmd>() {
-        *entry = DrawSpriteCmd {
-            command_type: command_type::DRAW_SPRITE_LOCAL,
-            layer,
-            x_pos: x_pos & 0xFFFF0000,
-            y_pos: y_pos & 0xFFFF0000,
-            sprite: SpriteOp(sprite_id),
-            palette: frame,
-        };
-    }
-}
-
-// ---------------------------------------------------------------------------
-// DrawSpriteOffset (0x5420E0) — type 6, ECX=this, EDX=y_clip, 6 stack, RET 0x18
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_draw_sprite_offset; impl_fn = draw_sprite_offset_impl;
-    regs = [ecx, edx]; stack_params = 6; ret_bytes = "0x18");
-
-unsafe extern "cdecl" fn draw_sprite_offset_impl(
-    this: u32,
-    y_clip: u32,
-    layer: u32,
-    x_pos: u32,
-    y_pos: u32,
-    sprite_id: u32,
-    param_7: u32,
-    param_8: u32,
-) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawSpriteOffsetCmd>() {
-        *entry = DrawSpriteOffsetCmd {
-            command_type: command_type::DRAW_SPRITE_OFFSET,
-            layer,
-            sprite_id,
-            x_pos: x_pos & 0xFFFF0000,
-            y_pos: y_pos & 0xFFFF0000,
-            _reserved: 0,
-            y_clip: y_clip & 0xFFFF0000,
-            param_7,
-            param_8,
-        };
-    }
-}
-
-// ---------------------------------------------------------------------------
-// DrawBitmapGlobal (0x542170) — type 1, ECX=this, EDX=y, 7 stack, RET 0x1C
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_draw_bitmap_global; impl_fn = draw_bitmap_global_impl;
-    regs = [ecx, edx]; stack_params = 7; ret_bytes = "0x1C");
-
-unsafe extern "cdecl" fn draw_bitmap_global_impl(
-    this: u32,
-    y_pos: u32,
-    layer: u32,
-    x_pos: u32,
-    bitmap_ptr: u32,
-    param_6: u32,
-    param_7: u32,
-    param_8: u32,
-    param_9: u32,
-) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawBitmapGlobalCmd>() {
-        *entry = DrawBitmapGlobalCmd {
-            command_type: command_type::DRAW_BITMAP_GLOBAL,
-            layer,
-            x_pos: x_pos & 0xFFFF0000,
-            y_pos: y_pos & 0xFFFF0000,
-            bitmap_ptr,
-            _reserved: 0,
-            param_6,
-            param_7,
-            param_8,
-            param_9,
-        };
-    }
-}
-
-// ---------------------------------------------------------------------------
-// DrawTextboxLocal (0x542200) — type 2, ECX=this, EDX=y, 6 stack, RET 0x18
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_draw_textbox_local; impl_fn = draw_textbox_local_impl;
-    regs = [ecx, edx]; stack_params = 6; ret_bytes = "0x18");
-
-unsafe extern "cdecl" fn draw_textbox_local_impl(
-    this: u32,
-    y_pos: u32,
-    layer: u32,
-    x_pos: u32,
-    text_ptr: u32,
-    param_6: u32,
-    param_7: u32,
-    param_8: u32,
-) {
-    let q = &mut *(this as *mut RenderQueue);
-
-    if let Some(entry) = q.alloc::<DrawTextboxLocalCmd>() {
-        *entry = DrawTextboxLocalCmd {
-            command_type: command_type::DRAW_TEXTBOX_LOCAL,
-            layer,
-            _reserved_2: 0,
-            x_pos: x_pos & 0xFFFF0000,
-            y_pos: y_pos & 0xFFFF0000,
-            _reserved_5: 0,
-            _reserved_6: 0,
-            text_ptr,
-            _reserved_8: 0,
-            _reserved_9: 0,
-            param_6,
-            param_7,
-            param_8,
-        };
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Fixed-point trig helpers
-// ---------------------------------------------------------------------------
-
-/// Fixed-point 16.16 multiply: ((a * b) >> 16)
-#[inline]
-fn fixed_mul(a: i32, b: i32) -> i32 {
-    ((a as i64 * b as i64) >> 16) as i32
-}
-
-/// Interpolated lookup from a 1024-entry fixed-point trig table.
-/// Index = (angle >> 6) & 0x3FF, fraction = (angle & 0x3F) << 10.
-#[inline]
-unsafe fn trig_lookup(table: *const i32, angle: u32) -> i32 {
-    let index = ((angle as i32) >> 6) as usize & 0x3FF;
-    let frac = ((angle & 0x3F) << 10) as i32;
-    let base = *table.add(index);
-    let next = *table.add(index + 1);
-    fixed_mul(next - base, frac) + base
-}
-
-// ---------------------------------------------------------------------------
-// DrawBungeeTrail (0x500720) — stdcall(task, style, fill), RET 0xC
-//
-// Draws bungee drop trajectory path:
-//   1. Sprite at trail start position
-//   2. Series of vertices computed by accumulating angle + trig interpolation
-//   3. Final vertex at task position (0x84/0x88)
-//   4. DrawPolygon (if fill != 0) or DrawLineStrip
-// Triggered by Bungee weapon (field_0x30==4, field_0x34==7) check in FUN_00519F60.
-// Gated by task+0xBC flag set by InitWormTrail (0x5008D0).
-// ---------------------------------------------------------------------------
-
-unsafe extern "stdcall" fn draw_bungee_trail_impl(task_ptr: u32, style: u32, fill: u32) {
-    let task = &*(task_ptr as *const BungeeTrailTask);
-
-    if task.trail_visible == 0 {
-        return;
-    }
-
-    let ddgame = &*task.base.ddgame;
-    let rq = &mut *ddgame.render_queue;
-
-    let seg_data = task.segment_data;
-    if seg_data.is_null() {
-        return;
-    }
-
-    let segment_count = task.segment_count;
-    if segment_count <= 0 {
-        return;
-    }
-
-    let mut x = task.trail_start_x;
-    let mut y = task.trail_start_y;
-
-    let first_angle = *(seg_data.add(4) as *const i32);
-
-    // Enqueue start sprite (command type 5 = local)
-    if let Some(entry) = rq.alloc::<DrawSpriteCmd>() {
-        *entry = DrawSpriteCmd {
-            command_type: command_type::DRAW_SPRITE_LOCAL,
-            layer: 0xDFFFF,
-            x_pos: x as u32 & 0xFFFF0000,
-            y_pos: y as u32 & 0xFFFF0000,
-            sprite: SpriteOp(0x45),
-            palette: (first_angle + 0x8100) as u32,
-        };
-    }
-
-    // Build vertex array from trail segments
-    const MAX_VERTICES: usize = 256;
-    let mut verts = [[0i32; 3]; MAX_VERTICES];
-    let mut vert_count: usize = 0;
-    let mut accumulated_angle: u32 = 0;
-
-    let sin_table = rb(va::G_SIN_TABLE) as *const i32;
-    let cos_table = rb(va::G_COS_TABLE) as *const i32;
-
-    for i in 0..segment_count {
-        let seg_angle = *(seg_data.add(4 + i as usize * 8) as *const i32);
-
-        // Include vertex if: first segment, or segment has nonzero angle, or fill mode
-        if (i == 0 || seg_angle != 0 || fill != 0) && vert_count < MAX_VERTICES {
-            verts[vert_count] = [x, y, 0];
-            vert_count += 1;
-        }
-
-        accumulated_angle = accumulated_angle.wrapping_add(seg_angle as u32);
-
-        let sin_interp = trig_lookup(sin_table, accumulated_angle);
-        let cos_interp = trig_lookup(cos_table, accumulated_angle);
-
-        x = x.wrapping_add(sin_interp.wrapping_mul(8));
-        y = y.wrapping_sub(cos_interp.wrapping_mul(8));
-    }
-
-    // Final vertex = task position (target)
-    if vert_count < MAX_VERTICES {
-        verts[vert_count] = [task.pos_x.0, task.pos_y.0, 0];
-        vert_count += 1;
-    }
-
-    // Enqueue as polygon or line strip
-    if fill != 0 {
-        let total_size = vert_count * 0xC + 0x20;
-        if let Some(ptr) = rq.alloc_raw(total_size) {
-            let header = &mut *(ptr as *mut DrawPolygonHeader);
-            *header = DrawPolygonHeader {
-                command_type: command_type::DRAW_POLYGON,
-                layer: 0xE_0000,
-                count: vert_count as u32,
-                param_1: style,
-                param_2: fill,
-            };
-            core::ptr::copy_nonoverlapping(
-                verts.as_ptr() as *const u8,
-                ptr.add(core::mem::size_of::<DrawPolygonHeader>()),
-                vert_count * 0xC,
-            );
-        }
-    } else {
-        let total_size = vert_count * 0xC + 0x1C;
-        if let Some(ptr) = rq.alloc_raw(total_size) {
-            let header = &mut *(ptr as *mut DrawLineStripHeader);
-            *header = DrawLineStripHeader {
-                command_type: command_type::DRAW_LINE_STRIP,
-                layer: 0xE_0000,
-                count: vert_count as u32,
-                param_1: style,
-            };
-            core::ptr::copy_nonoverlapping(
-                verts.as_ptr() as *const u8,
-                ptr.add(core::mem::size_of::<DrawLineStripHeader>()),
-                vert_count * 0xC,
-            );
-        }
-    }
-}
-
-// ---------------------------------------------------------------------------
-// DrawCrosshairLine (0x5197D0) — usercall(EDI=task_ptr), plain RET
-//
-// Draws the weapon aiming crosshair line:
-//   1. Compute direction from angle at task+0x264
-//   2. Compute line length from DDGame scale + task offset
-//   3. Endpoint = start + direction * length (with overflow clamping)
-//   4. DrawPolygon (2 vertices) for the line
-//   5. Conditionally DrawSpriteLocal at endpoint (crosshair sprite)
-// ---------------------------------------------------------------------------
-
-usercall_trampoline!(fn trampoline_draw_crosshair_line; impl_fn = draw_crosshair_line_impl;
-    reg = edi);
-
-unsafe extern "cdecl" fn draw_crosshair_line_impl(task_ptr: u32) {
-    let task = &*(task_ptr as *const WeaponAimTask);
-    let gt = &task.game_task;
-
-    if task.aim_active == 0 {
-        return;
-    }
-
-    let ddgame = &*gt.base.ddgame;
-    let rq = &mut *ddgame.render_queue;
-
-    let start_x = gt.pos_x.0;
-    let start_y = gt.pos_y.0;
-
-    let angle = task.aim_angle;
-
-    // Trig interpolation
-    let sin_table = rb(va::G_SIN_TABLE) as *const i32;
-    let cos_table = rb(va::G_COS_TABLE) as *const i32;
-    let sin_interp = trig_lookup(sin_table, angle);
-    let cos_interp = trig_lookup(cos_table, angle);
-
-    // Scale = fixed_mul(DDGame.parallax_scale, 0x140000) + task.aim_range_offset
-    let scale = fixed_mul(ddgame.parallax_scale, 0x14_0000) + task.aim_range_offset;
-
-    // Endpoint = start + direction * scale
-    let mut endpoint_x = fixed_mul(sin_interp, scale).wrapping_add(start_x);
-    let mut endpoint_y = fixed_mul(cos_interp, scale).wrapping_add(start_y);
-
-    // Overflow clamping — when endpoint overflows i32 due to large scale
-    let mut overflowed = false;
-    let mut clamp_factor = 0i32;
-
-    let threshold = (*ddgame.game_info).game_version;
-
-    if threshold > 0x11E {
-        // Check X overflow: sin > 0 but endpoint wrapped below start
-        if sin_interp > 0 && endpoint_x < start_x {
-            overflowed = true;
-            clamp_factor = (0x7FFFFFFFi32 - start_x) / sin_interp;
-        }
-        // Check Y overflow: cos > 0 but endpoint wrapped below start
-        if cos_interp > 0 && endpoint_y < start_y {
-            let y_clamp = (0x7FFFFFFFi32 - start_y) / cos_interp;
-            if !overflowed || y_clamp < clamp_factor {
-                clamp_factor = y_clamp;
-            }
-            overflowed = true;
-        }
-        if overflowed {
-            endpoint_x = start_x + clamp_factor * sin_interp;
-            endpoint_y = start_y + clamp_factor * cos_interp;
-        }
-    }
-
-    // Enqueue polygon line (2 vertices)
-    let poly_param_1 = ddgame.gfx_color_table[8]; // crosshair line style
-    let poly_param_2 = ddgame.gfx_color_table[6]; // crosshair line color
-    let verts: [[i32; 3]; 2] = [[start_x, start_y, 0], [endpoint_x, endpoint_y, 0]];
-    let total_size = 2 * 0xC + 0x20;
-    if let Some(ptr) = rq.alloc_raw(total_size) {
-        let header = &mut *(ptr as *mut DrawPolygonHeader);
-        *header = DrawPolygonHeader {
-            command_type: command_type::DRAW_POLYGON,
-            layer: 0xE_0000,
-            count: 2,
-            param_1: poly_param_1,
-            param_2: poly_param_2,
-        };
-        core::ptr::copy_nonoverlapping(
-            verts.as_ptr() as *const u8,
-            ptr.add(core::mem::size_of::<DrawPolygonHeader>()),
-            2 * 0xC,
-        );
-    }
-
-    // Draw crosshair sprite at endpoint (only if no overflow clamping)
-    if !overflowed {
-        if let Some(entry) = rq.alloc::<DrawSpriteCmd>() {
-            *entry = DrawSpriteCmd {
-                command_type: command_type::DRAW_SPRITE_LOCAL,
-                layer: 0x4_0000,
-                x_pos: endpoint_x as u32 & 0xFFFF0000,
-                y_pos: endpoint_y as u32 & 0xFFFF0000,
-                sprite: SpriteOp(0x44),
-                palette: (0x8000u32).wrapping_sub(angle),
-            };
-        }
-    }
-}
-
-// ---------------------------------------------------------------------------
-// RenderQueue installation
-// ---------------------------------------------------------------------------
-
-fn install_render_queue() -> Result<(), String> {
-    unsafe {
-        let _ = hook::install(
-            "EnqueueTiledBitmap",
-            va::RQ_ENQUEUE_TILED_BITMAP,
-            trampoline_enqueue_tiled_bitmap as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawLineStrip",
-            va::RQ_DRAW_LINE_STRIP,
-            trampoline_draw_line_strip as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawPolygon",
-            va::RQ_DRAW_POLYGON,
-            trampoline_draw_polygon as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawCrosshair",
-            va::RQ_DRAW_CROSSHAIR,
-            trampoline_draw_crosshair as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawRect",
-            va::RQ_DRAW_RECT,
-            trampoline_draw_rect as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawSpriteGlobal",
-            va::RQ_DRAW_SPRITE_GLOBAL,
-            trampoline_draw_sprite_global as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawSpriteLocal",
-            va::RQ_DRAW_SPRITE_LOCAL,
-            trampoline_draw_sprite_local as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawSpriteOffset",
-            va::RQ_DRAW_SPRITE_OFFSET,
-            trampoline_draw_sprite_offset as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawBitmapGlobal",
-            va::RQ_DRAW_BITMAP_GLOBAL,
-            trampoline_draw_bitmap_global as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawTextboxLocal",
-            va::RQ_DRAW_TEXTBOX_LOCAL,
-            trampoline_draw_textbox_local as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawBungeeTrail",
-            va::DRAW_BUNGEE_TRAIL,
-            draw_bungee_trail_impl as *const (),
-        )?;
-
-        let _ = hook::install(
-            "DrawCrosshairLine",
-            va::DRAW_CROSSHAIR_LINE,
-            trampoline_draw_crosshair_line as *const (),
-        )?;
-
-        let _ = hook::install(
-            "RenderDrawingQueue",
-            va::RQ_RENDER_DRAWING_QUEUE,
-            trampoline_render_drawing_queue as *const (),
-        )?;
-    }
-    Ok(())
-}
-
-// ---------------------------------------------------------------------------
-// RenderDrawingQueue (0x542350) — usercall(EAX=RenderQueue*) + 2 stack
-// (DisplayGfx*, ClipContext*), RET 0x8.
-//
-// The per-frame render-queue dispatcher. Pure Rust port lives in
-// `openwa_core::render::queue_dispatch::render_drawing_queue`. The
-// trampoline captures EAX and forwards the two stack args.
-// ---------------------------------------------------------------------------
-
-use openwa_core::render::queue_dispatch::{render_drawing_queue, ClipContext};
-
-usercall_trampoline!(fn trampoline_render_drawing_queue;
-    impl_fn = render_drawing_queue_impl;
-    reg = eax; stack_params = 2; ret_bytes = "0x8");
-
-unsafe extern "cdecl" fn render_drawing_queue_impl(
-    rq: *mut RenderQueue,
-    display: *mut DisplayGfx,
-    clip: *mut ClipContext,
-) {
-    render_drawing_queue(rq, display, clip);
-}
-
-// ==========================================================================
-// DisplayGfx vtable hooks
-// ==========================================================================
-//
-// Patches DisplayBase vtables in WA.exe's .rdata:
-// - Primary vtable (0x6645F8): replaces _purecall slots with safe no-op stubs
-// - Headless vtable (0x66A0F8): replaces destructor with Rust version that
-//   correctly frees our Rust-allocated sprite cache sub-objects
-
-use openwa_core::bitgrid::DisplayBitGrid;
-use openwa_core::fixed::Fixed;
-use openwa_core::render::display::destructor as display_destructor;
-use openwa_core::render::display::vtable::{self as display_vtable, DisplayGfxVtable};
-use openwa_core::render::display::DisplayBase;
-use openwa_core::render::display::DisplayGfx;
-use openwa_core::vtable::patch_vtable;
-use openwa_core::vtable_replace;
-use openwa_core::wa_alloc::wa_free;
-
-/// The _purecall function address (calls abort).
-const PURECALL: u32 = 0x005D_4E16;
-
-/// Number of slots in the DisplayBase vtable.
-const VTABLE_SLOTS: usize = 32;
-
-unsafe extern "thiscall" fn noop_thiscall(_this: *mut u8) {}
-
-/// Rust destructor for headless DisplayBase. Frees the sprite cache chain
-/// (SpriteCache -> FrameCache -> buffer) that was allocated by new_headless().
-unsafe extern "thiscall" fn headless_destructor(
-    this: *mut DisplayBase,
-    flags: u8,
-) -> *mut DisplayBase {
-    let sprite_cache = (*this).sprite_cache;
-    if !sprite_cache.is_null() {
-        let frame_cache = (*sprite_cache).frame_cache;
-        if !frame_cache.is_null() {
-            let buf = (*frame_cache).buffer;
-            if !buf.is_null() {
-                wa_free(buf);
-            }
-            wa_free(frame_cache);
-        }
-        wa_free(sprite_cache);
-    }
-    if flags & 1 != 0 {
-        wa_free(this);
-    }
-    this
-}
-
-// No saved originals needed — all paths are fully ported or use direct bridges.
-
-/// Rust port of DisplayGfx::BlitSprite (slot 19, 0x56B080).
-///
-/// Standard thiscall: ECX=this, stack params: x, y, sprite_flags, palette (RET 0x10).
-///
-unsafe extern "thiscall" fn blit_sprite(
-    this: *mut DisplayGfx,
-    x: Fixed,
-    y: Fixed,
-    sprite_flags: u32,
-    palette: u32,
-) {
-    use openwa_core::render::display::gfx::DisplayGfx;
-    use openwa_core::render::display::vtable as display_vtable;
-    use openwa_core::render::SpriteFlags;
-
-    let gfx = this as *mut DisplayGfx;
-    let base = this as *const u8;
-
-    // ---------------------------------------------------------------
-    // Extract sprite index and flags
-    // ---------------------------------------------------------------
-    let sprite = SpriteOp(sprite_flags);
-    let flags = sprite.flags();
-    let sprite_id = sprite.index() as u32;
-
-    if sprite_id == 0 {
-        return;
-    }
-
-    // ---------------------------------------------------------------
-    // Palette manipulation
-    // ---------------------------------------------------------------
-    let mut pal: u32 = palette;
-    if flags.contains(SpriteFlags::INVERT_PALETTE) {
-        pal = 0x10000u32.wrapping_sub(palette);
-        if sprite_id.wrapping_sub(0x1D5) < 3 {
-            // Special sprite IDs: scale by 8/18
-            pal = (0x10000u32.wrapping_sub(palette).wrapping_mul(8)) / 0x12;
-        }
-    }
-    if flags.contains(SpriteFlags::PALETTE_XFORM) {
-        // Bit 25: palette transform (modular arithmetic for color cycling)
-        let tmp = ((pal.wrapping_mul(0x1F) as i32)
-            .wrapping_add(((pal.wrapping_mul(0x1F) as i32) >> 31) & 0x1F)
-            >> 5) as u32;
-        let tmp = tmp.wrapping_add(0x400) & 0xFFFF;
-        pal = (tmp.wrapping_rem(0xF800)) / 2;
-        if (pal & 0x400) != 0 {
-            pal = (pal & !0x400) | 0x8000;
-        }
-    }
-
-    // ---------------------------------------------------------------
-    // Check sprite arrays — bitmap path if not in primary arrays
-    // ---------------------------------------------------------------
-    let arr1 = *(base.add(sprite_id as usize * 4 + 0x1008) as *const u32);
-    let arr2 = *(base.add(sprite_id as usize * 4 + 0x2008) as *const u32);
-
-    if arr1 == 0 && arr2 == 0 {
-        // Bitmap sprite path — sprite is in the bitmap table at 0x3DD4.
-        let bitmap_obj = (*gfx).sprite_table[sprite_id as usize];
-        if bitmap_obj.is_null() {
-            return;
-        }
-
-        // Get frame data and dimensions from bitmap sprite object.
-        let mut sprite_w: i32 = 0;
-        let mut sprite_h: i32 = 0;
-        let mut rect_left: i32 = 0;
-        let mut rect_top: i32 = 0;
-        let mut rect_right: i32 = 0;
-        let mut rect_bottom: i32 = 0;
-        let frame_data = display_vtable::get_bitmap_sprite_info(
-            bitmap_obj,
-            pal,
-            &mut sprite_w,
-            &mut sprite_h,
-            &mut rect_left,
-            &mut rect_top,
-            &mut rect_right,
-            &mut rect_bottom,
-        );
-        if frame_data.is_null() {
-            return;
-        }
-
-        let camera_x = (*gfx).camera_x;
-        let camera_y = (*gfx).camera_y;
-        let half_w = sprite_w / 2;
-        let half_h = sprite_h / 2;
-        let blit_h = rect_bottom - rect_top;
-        let dst_x = (x.0 >> 16) + (camera_x - half_w) + rect_left;
-        let dst_y = (y.0 >> 16) + (camera_y - half_h) + rect_top;
-
-        if !flags.contains(SpriteFlags::TILED) {
-            // Non-tiled: clipped blit at (dst_x, dst_y).
-            display_vtable::blit_bitmap_clipped_native(
-                gfx, dst_x, dst_y, sprite_w, blit_h, frame_data, 2,
-            );
-        } else {
-            // Tiled: horizontal tile across the clip rect.
-            display_vtable::blit_bitmap_tiled_native(
-                gfx, dst_x, sprite_w, dst_y, blit_h, frame_data,
-            );
-        }
-        return;
-    }
-
-    // ---------------------------------------------------------------
-    // Bit 24: palette ×4 adjust with orientation-dependent high bits
-    // ---------------------------------------------------------------
-    // The original ASM at 0x56B145 scales pal by 4, adds 0x8000, then
-    // uses the overflow quadrant (bits 16-17 of the scaled value) to
-    // select an orientation+blend combo. The low 16 bits become the
-    // new palette value.
-    let mut orient_local: u32 = 0x0000_0001; // blend=1 (ColorTable/transparency), orientation=0 (Normal)
-    if flags.contains(SpriteFlags::PALETTE_X4) {
-        let scaled = pal.wrapping_mul(4).wrapping_add(0x8000);
-        pal = scaled & 0xFFFF;
-        let quad = ((scaled as i32) >> 16) & 3;
-        orient_local = match quad {
-            0 => 0x0008_0001, // MirrorXY + ColorTable
-            1 => 0x000C_0001, // Rotate90MirrorXY + ColorTable
-            2 => 0x0004_0001, // Rotate90 + ColorTable
-            _ => 0x0000_0001, // Normal + ColorTable
-        };
-    }
-
-    // ---------------------------------------------------------------
-    // Sprite frame lookup via DisplayGfx::GetSpriteFrameForBlit (slot 33).
-    // ---------------------------------------------------------------
-    // Resolves the sprite ID + animation value into the actual decompressed
-    // frame surface plus its bounding box and full sprite-cell dimensions
-    // (used below for centering and clipped blits).
-    let mut out_sprite_w: i32 = 0;
-    let mut out_sprite_h: i32 = 0;
-    let mut out_rect_left: i32 = 0;
-    let mut out_rect_top: i32 = 0;
-    let mut out_rect_right: i32 = 0;
-    let mut out_rect_bottom: i32 = 0;
-    let mut out_anim_frac: u32 = 0;
-
-    let mut sprite_surface = DisplayGfx::get_sprite_frame_for_blit_raw(
-        gfx,
-        sprite_id,
-        pal,
-        &mut out_sprite_w,
-        &mut out_sprite_h,
-        &mut out_rect_left,
-        &mut out_rect_top,
-        &mut out_rect_right,
-        &mut out_rect_bottom,
-        &mut out_anim_frac,
-    );
-
-    if sprite_surface.is_null() {
-        return;
-    }
-
-    let sprite_w = out_sprite_w;
-    let sprite_h = out_sprite_h;
-    let rect_left = out_rect_left;
-    let rect_top = out_rect_top;
-    let rect_right = out_rect_right;
-    let rect_bottom = out_rect_bottom;
-
-    // Size checks
-    if rect_left >= rect_right || rect_top >= rect_bottom {
-        return;
-    }
-
-    let mut blit_w = rect_right - rect_left;
-    let mut blit_h = rect_bottom - rect_top;
-
-    // ---------------------------------------------------------------
-    // Shadow clear (high_flags bit 22)
-    // ---------------------------------------------------------------
-    if flags.contains(SpriteFlags::SHADOW_CLEAR) {
-        // Blit sprite to layer_2 as shadow base
-        let layer2 = (*gfx).layer_2;
-        super::bitgrid::blit_impl(
-            layer2,
-            0,
-            0,
-            blit_w,
-            blit_h,
-            sprite_surface,
-            0,
-            0,
-            core::ptr::null(),
-            0, // mode 0 = copy
-        );
-        // Manipulate color_add_table entry for shadow
-        let color_idx = ((*gfx)._unknown_356c as usize) * 0x100;
-        let table_byte = &mut (*gfx).color_add_table[color_idx];
-        let saved = *table_byte;
-        *table_byte = 0;
-
-        // Call BitGrid__ClearColumn_Maybe (0x4F6590) — clears shadow channel
-        let clear_fn: unsafe extern "cdecl" fn(*mut u8) =
-            core::mem::transmute(rb(0x004F6590) as usize);
-        clear_fn(table_byte as *mut u8);
-
-        *table_byte = saved;
-
-        // Replace sprite surface with layer_2 (shadow-processed)
-        sprite_surface = layer2;
-    }
-
-    // ---------------------------------------------------------------
-    // Extra orientation flags from high_flags
-    // ---------------------------------------------------------------
-    if flags.contains(SpriteFlags::MIRROR_X) {
-        orient_local |= 0x0001_0000;
-    }
-    if flags.contains(SpriteFlags::MIRROR_Y) {
-        orient_local |= 0x0002_0000;
-    }
-
-    // ---------------------------------------------------------------
-    // 16-case orientation switch for camera coordinate mapping
-    // ---------------------------------------------------------------
-    let camera_x = (*gfx).camera_x;
-    let camera_y = (*gfx).camera_y;
-
-    // Signed divide toward zero (matches MSVC CDQ+SUB+SAR pattern)
-    let half_w = if sprite_w < 0 {
-        (sprite_w + 1) / 2
-    } else {
-        sprite_w / 2
-    };
-    let half_h = if sprite_h < 0 {
-        (sprite_h + 1) / 2
-    } else {
-        sprite_h / 2
-    };
-
-    let x_px = x.0 >> 16;
-    let y_px = y.0 >> 16;
-
-    let (dst_x, dst_y);
-    let orientation_key = (orient_local >> 16) as i32;
-
-    match orientation_key {
-        1 | 10 => {
-            // MirrorX
-            dst_x = camera_x + half_w + x_px - rect_right;
-            dst_y = camera_y - half_h + rect_top + y_px;
-        }
-        2 | 9 => {
-            // MirrorY — X same as Normal, Y mirrored
-            dst_x = camera_x - half_w + rect_left + x_px;
-            dst_y = camera_y + half_h + y_px - rect_bottom;
-        }
-        3 | 8 => {
-            // MirrorXY
-            dst_x = camera_x + half_w + x_px - rect_right;
-            dst_y = camera_y + half_h + y_px - rect_bottom;
-        }
-        4 | 15 => {
-            // Rotate90 — swap axes
-            dst_x = camera_x - half_h + rect_top + x_px;
-            dst_y = camera_y + half_w + y_px - rect_right;
-            blit_w = rect_bottom - rect_top;
-            blit_h = rect_right - rect_left;
-        }
-        5 | 14 => {
-            // Rotate90MirrorX
-            dst_x = camera_x + half_h + x_px - rect_bottom;
-            dst_y = camera_y + half_w + y_px - rect_right;
-            blit_w = rect_bottom - rect_top;
-            blit_h = rect_right - rect_left;
-        }
-        6 | 13 => {
-            // Rotate90MirrorY
-            dst_x = camera_x - half_h + rect_top + x_px;
-            dst_y = camera_y - half_w + rect_left + y_px;
-            blit_w = rect_bottom - rect_top;
-            blit_h = rect_right - rect_left;
-        }
-        7 | 12 => {
-            // Rotate90MirrorXY
-            dst_x = camera_x + half_h + x_px - rect_bottom;
-            dst_y = camera_y - half_w + rect_left + y_px;
-            blit_w = rect_bottom - rect_top;
-            blit_h = rect_right - rect_left;
-        }
-        _ => {
-            // Normal (0, 11, and any other value)
-            dst_x = camera_x - half_w + rect_left + x_px;
-            dst_y = camera_y - half_h + rect_top + y_px;
-        }
-    }
-
-    // ---------------------------------------------------------------
-    // Blit dispatch based on high_flags
-    // ---------------------------------------------------------------
-
-    if blit_w <= 0 || blit_h <= 0 {
-        return;
-    }
-
-    // Stippled mode (checkerboard per-pixel blit)
-    if flags.intersects(SpriteFlags::STIPPLED_0 | SpriteFlags::STIPPLED_1) {
-        let stipple_mode: u32 = if flags.contains(SpriteFlags::STIPPLED_1) {
-            1
-        } else {
-            0
-        };
-        let parity = *(rb(openwa_core::address::va::G_STIPPLE_PARITY) as *const u32);
-
-        display_vtable::acquire_render_lock(gfx);
-
-        super::bitgrid::blit_stippled_raw(
-            (*gfx).layer_0,
-            sprite_surface,
-            dst_x,
-            dst_y,
-            blit_w,
-            blit_h,
-            0,
-            0,
-            stipple_mode,
-            parity,
-        );
-        return;
-    }
-
-    // Tiled mode (horizontal sprite tiling)
-    if flags.contains(SpriteFlags::TILED) {
-        display_vtable::acquire_render_lock(gfx);
-
-        super::bitgrid::blit_tiled_raw(
-            (*gfx).layer_0,
-            sprite_surface,
-            dst_x,
-            dst_y,
-            blit_w,
-            blit_h,
-            (*gfx).base.clip_x1,
-            (*gfx).base.clip_x2,
-            orient_local,
-        );
-        return;
-    }
-
-    // Determine color table pointer
-    let color_table: *const u8 = if flags.contains(SpriteFlags::ADDITIVE) {
-        (*gfx).color_add_table.as_ptr()
-    } else if flags.contains(SpriteFlags::COLOR_BLEND) {
-        (*gfx).color_blend_table.as_ptr()
-    } else {
-        core::ptr::null()
-    };
-
-    display_vtable::acquire_render_lock(gfx);
-
-    // src_x=0, src_y=0 always — vtable[33] already set up the sprite surface
-    super::bitgrid::blit_impl(
-        (*gfx).layer_0,
-        dst_x,
-        dst_y,
-        blit_w,
-        blit_h,
-        sprite_surface,
-        0,
-        0,
-        color_table,
-        orient_local,
-    );
-}
-
-/// Thiscall wrapper for DisplayGfx::DrawScaledSprite (slot 20).
-///
-/// Computes coordinates in core, then dispatches the blit via blit_impl.
-unsafe extern "thiscall" fn draw_scaled_sprite(
-    this: *mut DisplayGfx,
-    x: Fixed,
-    y: Fixed,
-    sprite: *mut DisplayBitGrid,
-    src_x: i32,
-    src_y: i32,
-    src_w: i32,
-    src_h: i32,
-    flags: u32,
-) {
-    use openwa_core::render::display::vtable::{self as display_vtable, DrawScaledSpriteResult};
-
-    match display_vtable::draw_scaled_sprite(this, x, y, sprite, src_x, src_y, src_w, src_h, flags)
-    {
-        DrawScaledSpriteResult::Blit {
-            layer,
-            dst_x,
-            dst_y,
-            width,
-            height,
-            sprite,
-            src_x,
-            src_y,
-            color_table,
-            blit_flags,
-        } => {
-            super::bitgrid::blit_impl(
-                layer,
-                dst_x,
-                dst_y,
-                width,
-                height,
-                sprite,
-                src_x,
-                src_y,
-                color_table,
-                blit_flags,
-            );
-        }
-        DrawScaledSpriteResult::Stippled {
-            layer,
-            dst_x,
-            dst_y,
-            width,
-            height,
-            sprite,
-            src_x,
-            src_y,
-            stipple_mode,
-        } => {
-            let parity = *(rb(openwa_core::address::va::G_STIPPLE_PARITY) as *const u32);
-            super::bitgrid::blit_stippled_raw(
-                layer,
-                sprite,
-                dst_x,
-                dst_y,
-                width,
-                height,
-                src_x,
-                src_y,
-                stipple_mode,
-                parity,
-            );
-        }
-        DrawScaledSpriteResult::Handled => {}
-    }
-}
-
-// =========================================================================
-// Font vtable method wrappers
-// =========================================================================
-//
-// Font slot wrappers (slots 7/8/9/10/34/35/36) all live in openwa-core's
-// `display::vtable` module. The wrappers in this file (slots 31/34/35/37
-// for sprite/font loading) are thin forwarders only because they need to
-// capture a bridge function pointer (`wa_load_sprite_from_vfs` etc.) at
-// install time.
-
-// =========================================================================
-// Sprite loading vtable method wrappers
-// =========================================================================
-
-/// Thiscall wrapper for DisplayGfx::LoadSprite (vtable slot 31, 0x523400).
-unsafe extern "thiscall" fn load_sprite(
-    this: *mut DisplayGfx,
-    layer: u32,
-    id: u32,
-    flag: u32,
-    gfx_dir: *mut GfxDir,
-    name: *const c_char,
-) -> i32 {
-    display_vtable::load_sprite(
-        this,
-        layer,
-        id,
-        flag,
-        gfx_dir,
-        name,
-        wa_load_sprite_from_vfs,
-    )
-}
-
-/// Bridge to LoadSpriteFromVfs (0x4FAAF0).
-/// Usercall: ECX=gfx, EAX=name, stack(sprite, layer_ctx), RET 0x8.
-///
-/// Verified from caller at 0x523489:
-///   ECX ← layer_contexts[layer] (gfx/VFS context)... wait, re-checked:
-///   ECX ← gfx param, EAX ← name param.
-///   Stack: sprite (EDI from ConstructSprite), layer_ctx.
-#[unsafe(naked)]
-unsafe extern "cdecl" fn wa_load_sprite_from_vfs(
-    _sprite: *mut openwa_core::render::sprite::Sprite,
-    _gfx_dir: *mut GfxDir,
-    _name: *const c_char,
-    _layer_ctx: *mut openwa_core::render::palette::PaletteContext,
-) -> i32 {
-    core::arch::naked_asm!(
-        // cdecl: +4=sprite, +8=gfx, +12=name, +16=layer_ctx
-        "mov ecx, [esp+8]",         // gfx → ECX
-        "mov eax, [esp+12]",        // name → EAX
-        "push dword ptr [esp+16]",  // layer_ctx
-        "push dword ptr [esp+8]",   // sprite (shifted +4 by push)
-        "call [{ADDR}]",            // RET 0x8 cleans 2 stack params
-        "ret",
-        ADDR = sym LOAD_SPRITE_FROM_VFS_ADDR,
-    );
-}
-
-static mut LOAD_SPRITE_FROM_VFS_ADDR: u32 = 0;
-
-// GetSpriteFrameForBlit (slot 33) is NOT ported — see the docstring on
-// `DisplayVtable::get_sprite_frame_for_blit` in openwa-core for the full
-// rationale. Our `blit_sprite` (slot 19) above calls it via the bound
-// vtable wrapper on every sprite render.
-
-unsafe extern "thiscall" fn load_sprite_by_layer(
-    this: *mut DisplayGfx,
-    layer: u32,
-    id: u32,
-    gfx_dir: *mut GfxDir,
-    name: *const c_char,
-) -> i32 {
-    display_vtable::load_sprite_by_layer(this, layer, id, gfx_dir, name)
-}
-
-unsafe extern "thiscall" fn load_font(
-    this: *mut DisplayGfx,
-    mode: u32,
-    font_id: i32,
-    gfx_dir: *mut GfxDir,
-    filename: *const c_char,
-) -> u32 {
-    display_vtable::load_font(this, mode, font_id, gfx_dir, filename)
-}
-
-unsafe extern "thiscall" fn load_font_extension(
-    this: *mut DisplayGfx,
-    font_id: i32,
-    path: *const c_char,
-    char_map: *const c_char,
-    palette_value: u32,
-    flag: i32,
-) -> u32 {
-    display_vtable::load_font_extension(this, font_id, path, char_map, palette_value, flag)
-}
-
-// ---------------------------------------------------------------------------
-// Display installation
-// ---------------------------------------------------------------------------
-
-fn install_display() -> Result<(), String> {
-    let _ = log_line("[Display] Patching DisplayBase vtables");
-
-    unsafe {
-        let purecall_addr = rb(PURECALL);
-        let noop_addr = noop_thiscall as *const () as u32;
-
-        // Patch primary vtable (0x6645F8): replace _purecall with no-ops.
-        let primary = rb(va::DISPLAY_BASE_VTABLE) as *mut u32;
-        patch_vtable(primary, VTABLE_SLOTS, |vt| {
-            let mut patched = 0u32;
-            for i in 0..VTABLE_SLOTS {
-                let slot = vt.add(i);
-                if *slot == purecall_addr {
-                    *slot = noop_addr;
-                    patched += 1;
-                }
-            }
-            let _ = log_line(&format!(
-                "[Display]   Primary: patched {patched}/{VTABLE_SLOTS} _purecall -> no-op"
-            ));
-        })?;
-
-        // Patch headless vtable (0x66A0F8): replace destructor (slot 0)
-        // with our Rust version that frees the Rust-allocated sprite cache.
-        let headless = rb(va::DISPLAY_BASE_HEADLESS_VTABLE) as *mut u32;
-        patch_vtable(headless, VTABLE_SLOTS, |vt| {
-            *vt = headless_destructor as *const () as u32;
-            let _ = log_line("[Display]   Headless: patched slot 0 (destructor) -> Rust");
-        })?;
-
-        // Initialize bridge address statics for sprite loading
-        LOAD_SPRITE_FROM_VFS_ADDR = rb(va::LOAD_SPRITE_FROM_VFS);
-
-        // Patch DisplayGfx vtable (0x66A218): replace ported methods with Rust.
-        vtable_replace!(DisplayGfxVtable, va::DISPLAY_GFX_VTABLE, {
-            destructor          => display_destructor::display_gfx_destructor,
-            get_dimensions      => display_vtable::get_dimensions,
-            set_layer_color     => display_vtable::set_layer_color,
-            set_active_layer    => display_vtable::set_active_layer,
-            get_sprite_info     => display_vtable::get_sprite_info,
-            draw_text_on_bitmap => display_vtable::draw_text_on_bitmap,
-            draw_tiled_bitmap   => display_vtable::draw_tiled_bitmap,
-            get_font_info       => display_vtable::get_font_info,
-            get_font_metric     => display_vtable::get_font_metric,
-            set_font_param      => display_vtable::set_font_param,
-            draw_polyline       => display_vtable::draw_polyline,
-            draw_line           => display_vtable::draw_line,
-            draw_line_clipped   => display_vtable::draw_line_clipped,
-            draw_pixel_strip    => display_vtable::draw_pixel_strip,
-            draw_crosshair      => display_vtable::draw_crosshair,
-            draw_outlined_pixel => display_vtable::draw_outlined_pixel,
-            fill_rect           => display_vtable::fill_rect,
-            draw_via_callback   => display_vtable::draw_via_callback,
-            draw_tiled_terrain  => display_vtable::draw_tiled_terrain,
-            flush_render        => display_vtable::flush_render,
-            set_camera_offset   => display_vtable::set_camera_offset,
-            set_clip_rect       => display_vtable::set_clip_rect,
-            is_sprite_loaded    => display_vtable::is_sprite_loaded,
-            load_sprite          => load_sprite,
-            draw_scaled_sprite  => draw_scaled_sprite,
-            set_layer_visibility => display_vtable::set_layer_visibility,
-            update_palette      => display_vtable::update_palette,
-            set_font_palette    => display_vtable::set_font_palette,
-            slot 19 => blit_sprite,
-            get_sprite_frame_for_blit => display_vtable::get_sprite_frame_for_blit,
-            load_sprite_by_layer => load_sprite_by_layer,
-            load_font            => load_font,
-            load_font_extension  => load_font_extension,
-        })?;
-        let _ = log_line("[Display]   DisplayGfx: patched 32 methods -> Rust");
-
-        // DisplayGfx::LoadSpriteEx (vtable slot 30) has zero callers in both
-        // WA.exe (no instructions reach vtable[+0x78] on a DisplayGfx) and our
-        // own Rust code (no `bind_DisplayVtable!` invocation, no direct call).
-        // Trap it so we'll be alerted the moment any future caller appears.
-        hook::install_trap!("DisplayGfx__LoadSpriteEx", va::DISPLAY_GFX_LOAD_SPRITE_EX);
-
-        // ── Slot 33 leaf functions: trap the WA-side originals ────────
-        //
-        // After `vtable_replace!` swapped slot 33 to our Rust impl, the
-        // original `DisplayGfx::GetSpriteFrameForBlit` (0x5237C0) is no
-        // longer reached, which means its leaves have no remaining
-        // callers in shipping WA either:
-        //
-        // - `Sprite__GetFrameForBlit` (0x4FAD30): only caller was the
-        //   original slot 33 dispatcher.
-        // - `SpriteBank__GetFrameForBlit` (0x4F9710): same. Also bank
-        //   objects are themselves unreachable (LoadSpriteEx is trapped).
-        // - `FrameCache__Allocate` (0x4FA950): only callers were the
-        //   two GetFrameForBlit helpers above.
-        // - `DisplayBitGrid::SetExternalBuffer` (0x4F6470): only caller
-        //   was `SpriteBank__GetFrameForBlit`.
-        //
-        // `Sprite_LZSS_Decode` (0x5B29E0) is NOT trapped — it has
-        // independent callers (`IMG_Decode`, `FUN_0048EE32`) reachable
-        // from `DDGame__Constructor`/`SoundEmitter`/`LoadHudAndWeaponSprites`,
-        // all still bridged. Trapping it would break those.
-        hook::install_trap!("Sprite__GetFrameForBlit", va::SPRITE_GET_FRAME_FOR_BLIT);
-        hook::install_trap!(
-            "SpriteBank__GetFrameForBlit",
-            va::SPRITE_BANK_GET_FRAME_FOR_BLIT
-        );
-        hook::install_trap!("FrameCache__Allocate", va::FRAME_CACHE_ALLOCATE);
-        hook::install_trap!(
-            "DisplayBitGrid__SetExternalBuffer",
-            va::DISPLAY_BIT_GRID_SET_EXTERNAL_BUFFER
-        );
-
-        // ── Slot 0 destructor leaves: trap the WA-side originals ──────
-        //
-        // After `vtable_replace!` swapped slot 0 to our Rust impl, the
-        // original `DisplayGfx::DestructorImpl` (0x56A010) is no longer
-        // reached, so its only-callee helpers lose their last live
-        // caller too.
-        //
-        // `TileBitmapSet::Destructor` (0x569BC0) has a *second* xref to
-        // `FUN_0056C2E0` (a tile-bitmap-set realloc helper called only
-        // from `CBitmap__Constructor_Maybe` at 0x56C060). That second
-        // chain is **structurally dead** in shipping WA: 0x56C060 sits
-        // in the DisplayGfx vtable .rdata block at slot index 38 (offset
-        // 0x98 past the vtable base 0x66A218), but no instruction in
-        // WA.exe loads from offset 0x98 of any pointer — verified by
-        // byte-pattern search for `FF 90 98 00 00 00` (CALL [reg+0x98])
-        // and `8B 4? 98` (MOV reg,[reg+0x98]) returning no DisplayGfx
-        // hits. The compiler emitted slots 38/39 of DisplayGfx into
-        // .rdata but the C++ source has no live caller for them — they
-        // are vestigial vtable entries from a removed feature. So
-        // trapping `TileBitmapSet::Destructor` is safe.
-        hook::install_trap!(
-            "DisplayGfx__DestructorImpl",
-            va::DISPLAY_GFX_DESTRUCTOR_IMPL
-        );
-        hook::install_trap!(
-            "DisplayGfx__FreeLayerSpriteTable",
-            va::DISPLAY_GFX_FREE_LAYER_SPRITE_TABLE
-        );
-        hook::install_trap!("TileBitmapSet__Destructor", va::TILE_BITMAP_SET_DESTRUCTOR);
-    }
-
-    Ok(())
-}
-
-// ==========================================================================
-// Combined installation
-// ==========================================================================
-
-pub fn install() -> Result<(), String> {
-    install_render_queue()?;
-    install_display()?;
-    Ok(())
-}

crates/openwa-dll/src/replacements/render/display_vtable.rs

@@ -0,0 +1,335 @@
+//! DisplayGfx vtable patches — DisplayBase pure-call stubs, headless destructor,
+//! and ported DisplayGfx methods.
+//!
+//! Patches DisplayBase vtables in WA.exe's .rdata:
+//! - Primary vtable (0x6645F8): replaces _purecall slots with safe no-op stubs
+//! - Headless vtable (0x66A0F8): replaces destructor with Rust version that
+//!   correctly frees our Rust-allocated sprite cache sub-objects
+//! - DisplayGfx vtable (0x66A218): replaces ported methods with Rust
+
+use core::ffi::c_char;
+
+use openwa_core::address::va;
+use openwa_core::bitgrid::DisplayBitGrid;
+use openwa_core::fixed::Fixed;
+use openwa_core::rebase::rb;
+use openwa_core::render::display::destructor as display_destructor;
+use openwa_core::render::display::vtable::{self as display_vtable_impl, DisplayGfxVtable};
+use openwa_core::render::display::DisplayBase;
+use openwa_core::render::display::DisplayGfx;
+use openwa_core::render::sprite::gfx_dir::GfxDir;
+use openwa_core::vtable::patch_vtable;
+use openwa_core::vtable_replace;
+use openwa_core::wa_alloc::wa_free;
+
+use crate::hook;
+use crate::log_line;
+
+/// The _purecall function address (calls abort).
+const PURECALL: u32 = 0x005D_4E16;
+
+/// Number of slots in the DisplayBase vtable.
+const VTABLE_SLOTS: usize = 32;
+
+unsafe extern "thiscall" fn noop_thiscall(_this: *mut u8) {}
+
+/// Rust destructor for headless DisplayBase. Frees the sprite cache chain
+/// (SpriteCache -> FrameCache -> buffer) that was allocated by new_headless().
+unsafe extern "thiscall" fn headless_destructor(
+    this: *mut DisplayBase,
+    flags: u8,
+) -> *mut DisplayBase {
+    let sprite_cache = (*this).sprite_cache;
+    if !sprite_cache.is_null() {
+        let frame_cache = (*sprite_cache).frame_cache;
+        if !frame_cache.is_null() {
+            let buf = (*frame_cache).buffer;
+            if !buf.is_null() {
+                wa_free(buf);
+            }
+            wa_free(frame_cache);
+        }
+        wa_free(sprite_cache);
+    }
+    if flags & 1 != 0 {
+        wa_free(this);
+    }
+    this
+}
+
+// No saved originals needed — all paths are fully ported or use direct bridges.
+
+/// Thiscall stub for DisplayGfx::BlitSprite (slot 19, 0x56B080).
+/// Implementation in `openwa_core::render::display::blit_sprite`.
+unsafe extern "thiscall" fn blit_sprite(
+    this: *mut DisplayGfx,
+    x: Fixed,
+    y: Fixed,
+    sprite_flags: u32,
+    palette: u32,
+) {
+    openwa_core::render::display::blit_sprite::blit_sprite(this, x, y, sprite_flags, palette);
+}
+
+/// Thiscall stub for DisplayGfx::DrawScaledSprite (slot 20).
+/// Implementation in `openwa_core::render::display::blit_sprite`.
+unsafe extern "thiscall" fn draw_scaled_sprite(
+    this: *mut DisplayGfx,
+    x: Fixed,
+    y: Fixed,
+    sprite: *mut DisplayBitGrid,
+    src_x: i32,
+    src_y: i32,
+    src_w: i32,
+    src_h: i32,
+    flags: u32,
+) {
+    openwa_core::render::display::blit_sprite::draw_scaled_sprite(
+        this, x, y, sprite, src_x, src_y, src_w, src_h, flags,
+    );
+}
+
+// =========================================================================
+// Font vtable method wrappers
+// =========================================================================
+//
+// Font slot wrappers (slots 7/8/9/10/34/35/36) all live in openwa-core's
+// `display::vtable` module. The wrappers in this file (slots 31/34/35/37
+// for sprite/font loading) are thin forwarders only because they need to
+// capture a bridge function pointer (`wa_load_sprite_from_vfs` etc.) at
+// install time.
+
+// =========================================================================
+// Sprite loading vtable method wrappers
+// =========================================================================
+
+/// Thiscall wrapper for DisplayGfx::LoadSprite (vtable slot 31, 0x523400).
+unsafe extern "thiscall" fn load_sprite(
+    this: *mut DisplayGfx,
+    layer: u32,
+    id: u32,
+    flag: u32,
+    gfx_dir: *mut GfxDir,
+    name: *const c_char,
+) -> i32 {
+    display_vtable_impl::load_sprite(
+        this,
+        layer,
+        id,
+        flag,
+        gfx_dir,
+        name,
+        wa_load_sprite_from_vfs,
+    )
+}
+
+/// Bridge to LoadSpriteFromVfs (0x4FAAF0).
+/// Usercall: ECX=gfx, EAX=name, stack(sprite, layer_ctx), RET 0x8.
+///
+/// Verified from caller at 0x523489:
+///   ECX ← layer_contexts[layer] (gfx/VFS context)... wait, re-checked:
+///   ECX ← gfx param, EAX ← name param.
+///   Stack: sprite (EDI from ConstructSprite), layer_ctx.
+#[unsafe(naked)]
+unsafe extern "cdecl" fn wa_load_sprite_from_vfs(
+    _sprite: *mut openwa_core::render::sprite::Sprite,
+    _gfx_dir: *mut GfxDir,
+    _name: *const c_char,
+    _layer_ctx: *mut openwa_core::render::palette::PaletteContext,
+) -> i32 {
+    core::arch::naked_asm!(
+        // cdecl: +4=sprite, +8=gfx, +12=name, +16=layer_ctx
+        "mov ecx, [esp+8]",         // gfx → ECX
+        "mov eax, [esp+12]",        // name → EAX
+        "push dword ptr [esp+16]",  // layer_ctx
+        "push dword ptr [esp+8]",   // sprite (shifted +4 by push)
+        "call [{ADDR}]",            // RET 0x8 cleans 2 stack params
+        "ret",
+        ADDR = sym LOAD_SPRITE_FROM_VFS_ADDR,
+    );
+}
+
+static mut LOAD_SPRITE_FROM_VFS_ADDR: u32 = 0;
+
+// GetSpriteFrameForBlit (slot 33) is NOT ported — see the docstring on
+// `DisplayVtable::get_sprite_frame_for_blit` in openwa-core for the full
+// rationale. Our `blit_sprite` (slot 19) above calls it via the bound
+// vtable wrapper on every sprite render.
+
+unsafe extern "thiscall" fn load_sprite_by_layer(
+    this: *mut DisplayGfx,
+    layer: u32,
+    id: u32,
+    gfx_dir: *mut GfxDir,
+    name: *const c_char,
+) -> i32 {
+    display_vtable_impl::load_sprite_by_layer(this, layer, id, gfx_dir, name)
+}
+
+unsafe extern "thiscall" fn load_font(
+    this: *mut DisplayGfx,
+    mode: u32,
+    font_id: i32,
+    gfx_dir: *mut GfxDir,
+    filename: *const c_char,
+) -> u32 {
+    display_vtable_impl::load_font(this, mode, font_id, gfx_dir, filename)
+}
+
+unsafe extern "thiscall" fn load_font_extension(
+    this: *mut DisplayGfx,
+    font_id: i32,
+    path: *const c_char,
+    char_map: *const c_char,
+    palette_value: u32,
+    flag: i32,
+) -> u32 {
+    display_vtable_impl::load_font_extension(this, font_id, path, char_map, palette_value, flag)
+}
+
+// ---------------------------------------------------------------------------
+// Installation
+// ---------------------------------------------------------------------------
+
+pub fn install() -> Result<(), String> {
+    let _ = log_line("[Display] Patching DisplayBase vtables");
+
+    unsafe {
+        let purecall_addr = rb(PURECALL);
+        let noop_addr = noop_thiscall as *const () as u32;
+
+        // Patch primary vtable (0x6645F8): replace _purecall with no-ops.
+        let primary = rb(va::DISPLAY_BASE_VTABLE) as *mut u32;
+        patch_vtable(primary, VTABLE_SLOTS, |vt| {
+            let mut patched = 0u32;
+            for i in 0..VTABLE_SLOTS {
+                let slot = vt.add(i);
+                if *slot == purecall_addr {
+                    *slot = noop_addr;
+                    patched += 1;
+                }
+            }
+            let _ = log_line(&format!(
+                "[Display]   Primary: patched {patched}/{VTABLE_SLOTS} _purecall -> no-op"
+            ));
+        })?;
+
+        // Patch headless vtable (0x66A0F8): replace destructor (slot 0)
+        // with our Rust version that frees the Rust-allocated sprite cache.
+        let headless = rb(va::DISPLAY_BASE_HEADLESS_VTABLE) as *mut u32;
+        patch_vtable(headless, VTABLE_SLOTS, |vt| {
+            *vt = headless_destructor as *const () as u32;
+            let _ = log_line("[Display]   Headless: patched slot 0 (destructor) -> Rust");
+        })?;
+
+        // Initialize bridge address statics for sprite loading
+        LOAD_SPRITE_FROM_VFS_ADDR = rb(va::LOAD_SPRITE_FROM_VFS);
+
+        // Patch DisplayGfx vtable (0x66A218): replace ported methods with Rust.
+        vtable_replace!(DisplayGfxVtable, va::DISPLAY_GFX_VTABLE, {
+            destructor          => display_destructor::display_gfx_destructor,
+            get_dimensions      => display_vtable_impl::get_dimensions,
+            set_layer_color     => display_vtable_impl::set_layer_color,
+            set_active_layer    => display_vtable_impl::set_active_layer,
+            get_sprite_info     => display_vtable_impl::get_sprite_info,
+            draw_text_on_bitmap => display_vtable_impl::draw_text_on_bitmap,
+            draw_tiled_bitmap   => display_vtable_impl::draw_tiled_bitmap,
+            get_font_info       => display_vtable_impl::get_font_info,
+            get_font_metric     => display_vtable_impl::get_font_metric,
+            set_font_param      => display_vtable_impl::set_font_param,
+            draw_polyline       => display_vtable_impl::draw_polyline,
+            draw_line           => display_vtable_impl::draw_line,
+            draw_line_clipped   => display_vtable_impl::draw_line_clipped,
+            draw_pixel_strip    => display_vtable_impl::draw_pixel_strip,
+            draw_crosshair      => display_vtable_impl::draw_crosshair,
+            draw_outlined_pixel => display_vtable_impl::draw_outlined_pixel,
+            fill_rect           => display_vtable_impl::fill_rect,
+            draw_via_callback   => display_vtable_impl::draw_via_callback,
+            draw_tiled_terrain  => display_vtable_impl::draw_tiled_terrain,
+            flush_render        => display_vtable_impl::flush_render,
+            set_camera_offset   => display_vtable_impl::set_camera_offset,
+            set_clip_rect       => display_vtable_impl::set_clip_rect,
+            is_sprite_loaded    => display_vtable_impl::is_sprite_loaded,
+            load_sprite          => load_sprite,
+            draw_scaled_sprite  => draw_scaled_sprite,
+            set_layer_visibility => display_vtable_impl::set_layer_visibility,
+            update_palette      => display_vtable_impl::update_palette,
+            set_font_palette    => display_vtable_impl::set_font_palette,
+            slot 19 => blit_sprite,
+            get_sprite_frame_for_blit => display_vtable_impl::get_sprite_frame_for_blit,
+            load_sprite_by_layer => load_sprite_by_layer,
+            load_font            => load_font,
+            load_font_extension  => load_font_extension,
+        })?;
+        let _ = log_line("[Display]   DisplayGfx: patched 32 methods -> Rust");
+
+        // DisplayGfx::LoadSpriteEx (vtable slot 30) has zero callers in both
+        // WA.exe (no instructions reach vtable[+0x78] on a DisplayGfx) and our
+        // own Rust code (no `bind_DisplayVtable!` invocation, no direct call).
+        // Trap it so we'll be alerted the moment any future caller appears.
+        hook::install_trap!("DisplayGfx__LoadSpriteEx", va::DISPLAY_GFX_LOAD_SPRITE_EX);
+
+        // ── Slot 33 leaf functions: trap the WA-side originals ────────
+        //
+        // After `vtable_replace!` swapped slot 33 to our Rust impl, the
+        // original `DisplayGfx::GetSpriteFrameForBlit` (0x5237C0) is no
+        // longer reached, which means its leaves have no remaining
+        // callers in shipping WA either:
+        //
+        // - `Sprite__GetFrameForBlit` (0x4FAD30): only caller was the
+        //   original slot 33 dispatcher.
+        // - `SpriteBank__GetFrameForBlit` (0x4F9710): same. Also bank
+        //   objects are themselves unreachable (LoadSpriteEx is trapped).
+        // - `FrameCache__Allocate` (0x4FA950): only callers were the
+        //   two GetFrameForBlit helpers above.
+        // - `DisplayBitGrid::SetExternalBuffer` (0x4F6470): only caller
+        //   was `SpriteBank__GetFrameForBlit`.
+        //
+        // `Sprite_LZSS_Decode` (0x5B29E0) is NOT trapped — it has
+        // independent callers (`IMG_Decode`, `FUN_0048EE32`) reachable
+        // from `DDGame__Constructor`/`SoundEmitter`/`LoadHudAndWeaponSprites`,
+        // all still bridged. Trapping it would break those.
+        hook::install_trap!("Sprite__GetFrameForBlit", va::SPRITE_GET_FRAME_FOR_BLIT);
+        hook::install_trap!(
+            "SpriteBank__GetFrameForBlit",
+            va::SPRITE_BANK_GET_FRAME_FOR_BLIT
+        );
+        hook::install_trap!("FrameCache__Allocate", va::FRAME_CACHE_ALLOCATE);
+        hook::install_trap!(
+            "DisplayBitGrid__SetExternalBuffer",
+            va::DISPLAY_BIT_GRID_SET_EXTERNAL_BUFFER
+        );
+
+        // ── Slot 0 destructor leaves: trap the WA-side originals ──────
+        //
+        // After `vtable_replace!` swapped slot 0 to our Rust impl, the
+        // original `DisplayGfx::DestructorImpl` (0x56A010) is no longer
+        // reached, so its only-callee helpers lose their last live
+        // caller too.
+        //
+        // `TileBitmapSet::Destructor` (0x569BC0) has a *second* xref to
+        // `FUN_0056C2E0` (a tile-bitmap-set realloc helper called only
+        // from `CBitmap__Constructor_Maybe` at 0x56C060). That second
+        // chain is **structurally dead** in shipping WA: 0x56C060 sits
+        // in the DisplayGfx vtable .rdata block at slot index 38 (offset
+        // 0x98 past the vtable base 0x66A218), but no instruction in
+        // WA.exe loads from offset 0x98 of any pointer — verified by
+        // byte-pattern search for `FF 90 98 00 00 00` (CALL [reg+0x98])
+        // and `8B 4? 98` (MOV reg,[reg+0x98]) returning no DisplayGfx
+        // hits. The compiler emitted slots 38/39 of DisplayGfx into
+        // .rdata but the C++ source has no live caller for them — they
+        // are vestigial vtable entries from a removed feature. So
+        // trapping `TileBitmapSet::Destructor` is safe.
+        hook::install_trap!(
+            "DisplayGfx__DestructorImpl",
+            va::DISPLAY_GFX_DESTRUCTOR_IMPL
+        );
+        hook::install_trap!(
+            "DisplayGfx__FreeLayerSpriteTable",
+            va::DISPLAY_GFX_FREE_LAYER_SPRITE_TABLE
+        );
+        hook::install_trap!("TileBitmapSet__Destructor", va::TILE_BITMAP_SET_DESTRUCTOR);
+    }
+
+    Ok(())
+}

crates/openwa-dll/src/replacements/render/mod.rs

@@ -0,0 +1,14 @@
+//! Render subsystem hooks — RenderQueue enqueue + DisplayGfx vtable patches.
+//!
+//! Split into two submodules:
+//! - `render_queue`: RenderQueue enqueue hooks and dispatcher
+//! - `display_vtable`: DisplayGfx vtable patches and stubs
+
+mod display_vtable;
+mod render_queue;
+
+pub fn install() -> Result<(), String> {
+    render_queue::install()?;
+    display_vtable::install()?;
+    Ok(())
+}

crates/openwa-dll/src/replacements/render/render_queue.rs

@@ -0,0 +1,478 @@
+//! RenderQueue enqueue hooks — full Rust replacements for command enqueueing,
+//! plus the per-frame RenderDrawingQueue dispatcher bridge.
+
+use openwa_core::address::va;
+use openwa_core::fixed::Fixed;
+use openwa_core::render::display::DisplayGfx;
+use openwa_core::render::queue::*;
+use openwa_core::render::queue_dispatch::{render_drawing_queue, ClipContext};
+use openwa_core::render::SpriteOp;
+
+use crate::hook::{self, usercall_trampoline};
+
+// ---------------------------------------------------------------------------
+// EnqueueTiledBitmap (0x541D60) — type 0xD, EAX=this, 3 stack, RET 0xC
+//
+// Mis-labelled `RQ_DrawPixel` in earlier reverse-engineering passes. It does
+// NOT enqueue a single-pixel draw — it enqueues a tile-cached bitmap draw
+// dispatched by `RenderDrawingQueue` case 0xD into vtable slot 11.
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_enqueue_tiled_bitmap; impl_fn = enqueue_tiled_bitmap_impl;
+    reg = eax; stack_params = 3; ret_bytes = "0xC");
+
+unsafe extern "cdecl" fn enqueue_tiled_bitmap_impl(
+    this: u32,
+    y_fixed16: u32,
+    source_descriptor: u32,
+    flags: u32,
+) {
+    let q = &mut *(this as *mut RenderQueue);
+
+    if let Some(entry) = q.alloc::<DrawTiledBitmapCmd>() {
+        *entry = DrawTiledBitmapCmd {
+            command_type: command_type::DRAW_TILED_BITMAP,
+            layer: 0x1B_0000,
+            x: Fixed(0xFF00_0000u32 as i32),
+            y: Fixed(y_fixed16 as i32),
+            source: source_descriptor as *const _,
+            flags: flags as u8,
+            _pad: [0; 3],
+        };
+    }
+}
+
+// ---------------------------------------------------------------------------
+// DrawLineStrip (0x541DD0) — type 8, EAX=this, EDI=count, 2 stack, RET 0x8
+// Allocation: count * 0xC + 0x1C (variable size)
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_draw_line_strip; impl_fn = draw_line_strip_impl;
+    regs = [eax, edi]; stack_params = 2; ret_bytes = "0x8");
+
+unsafe extern "cdecl" fn draw_line_strip_impl(
+    this: u32,
+    count: u32,
+    vertex_ptr: u32,
+    param_1: u32,
+) {
+    let q = &mut *(this as *mut RenderQueue);
+    let total_size = count as usize * 0xC + 0x1C;
+
+    if let Some(ptr) = q.alloc_raw(total_size) {
+        let header = &mut *(ptr as *mut DrawLineStripHeader);
+        *header = DrawLineStripHeader {
+            command_type: command_type::DRAW_LINE_STRIP,
+            layer: 0xE_0000,
+            count,
+            color: param_1,
+        };
+        core::ptr::copy_nonoverlapping(
+            vertex_ptr as *const u8,
+            ptr.add(core::mem::size_of::<DrawLineStripHeader>()),
+            count as usize * 0xC,
+        );
+    }
+}
+
+// ---------------------------------------------------------------------------
+// DrawPolygon (0x541E50) — type 9, ECX=this, ESI=count, 3 stack, RET 0xC
+// Allocation: count * 0xC + 0x20 (variable size)
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_draw_polygon; impl_fn = draw_polygon_impl;
+    regs = [ecx, esi]; stack_params = 3; ret_bytes = "0xC");
+
+unsafe extern "cdecl" fn draw_polygon_impl(
+    this: u32,
+    count: u32,
+    vertex_ptr: u32,
+    param_1: u32,
+    param_2: u32,
+) {
+    let q = &mut *(this as *mut RenderQueue);
+    let total_size = count as usize * 0xC + 0x20;
+
+    if let Some(ptr) = q.alloc_raw(total_size) {
+        let header = &mut *(ptr as *mut DrawPolygonHeader);
+        *header = DrawPolygonHeader {
+            command_type: command_type::DRAW_POLYGON,
+            layer: 0xE_0000,
+            count,
+            color1: param_1,
+            color2: param_2,
+        };
+        core::ptr::copy_nonoverlapping(
+            vertex_ptr as *const u8,
+            ptr.add(core::mem::size_of::<DrawPolygonHeader>()),
+            count as usize * 0xC,
+        );
+    }
+}
+
+// ---------------------------------------------------------------------------
+// DrawCrosshair (0x541ED0) — type 0xB, ECX=this, 5 stack, RET 0x14
+// Enqueues a crosshair draw command. Dispatched by RenderDrawingQueue
+// case 0xB → DisplayGfx::draw_crosshair (vtable slot 16).
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_draw_crosshair; impl_fn = draw_crosshair_impl;
+    reg = ecx; stack_params = 5; ret_bytes = "0x14");
+
+unsafe extern "cdecl" fn draw_crosshair_impl(
+    this: u32,
+    layer: u32,
+    x_pos: u32,
+    y_pos: u32,
+    color_fg: u32,
+    color_bg: u32,
+) {
+    let q = &mut *(this as *mut RenderQueue);
+
+    if let Some(entry) = q.alloc::<DrawCrosshairCmd>() {
+        *entry = DrawCrosshairCmd {
+            command_type: command_type::DRAW_CROSSHAIR,
+            layer,
+            color_fg,
+            color_bg,
+            x: Fixed(x_pos as i32),
+            y: Fixed(y_pos as i32),
+            ref_z: 0,
+        };
+    }
+}
+
+// ---------------------------------------------------------------------------
+// DrawRect (0x541F40) — type 0, ECX=this, EDX=y_clip, 6 stack, RET 0x18
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_draw_rect; impl_fn = draw_rect_impl;
+    regs = [ecx, edx]; stack_params = 6; ret_bytes = "0x18");
+
+unsafe extern "cdecl" fn draw_rect_impl(
+    this: u32,
+    y_clip: u32,
+    layer: u32,
+    x1: u32,
+    y1: u32,
+    x2: u32,
+    y2: u32,
+    color: u32,
+) {
+    let q = &mut *(this as *mut RenderQueue);
+
+    if let Some(entry) = q.alloc::<DrawRectCmd>() {
+        *entry = DrawRectCmd {
+            command_type: command_type::DRAW_RECT,
+            layer,
+            color,
+            x1: Fixed(x1 as i32).floor(),
+            y1: Fixed(y1 as i32).floor(),
+            x2: Fixed(x2 as i32).floor(),
+            y2: Fixed(y2 as i32).floor(),
+            ref_z: Fixed(y_clip as i32).floor().0,
+        };
+    }
+}
+
+// ---------------------------------------------------------------------------
+// DrawSpriteGlobal (0x541FE0) — type 4, EAX=y, ECX=this, 4 stack, RET 0x10
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_draw_sprite_global; impl_fn = draw_sprite_global_impl;
+    regs = [eax, ecx]; stack_params = 4; ret_bytes = "0x10");
+
+unsafe extern "cdecl" fn draw_sprite_global_impl(
+    y_pos: u32,
+    this: u32,
+    layer: u32,
+    x_pos: u32,
+    sprite_id: u32,
+    frame: u32,
+) {
+    let q = &mut *(this as *mut RenderQueue);
+
+    if let Some(entry) = q.alloc::<DrawSpriteCmd>() {
+        *entry = DrawSpriteCmd {
+            command_type: command_type::DRAW_SPRITE_GLOBAL,
+            layer,
+            x: Fixed(x_pos as i32).floor(),
+            y: Fixed(y_pos as i32).floor(),
+            sprite: SpriteOp(sprite_id),
+            palette: frame,
+        };
+    }
+}
+
+// ---------------------------------------------------------------------------
+// DrawSpriteLocal (0x542060) — type 5, EAX=y, ECX=this, 4 stack, RET 0x10
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_draw_sprite_local; impl_fn = draw_sprite_local_impl;
+    regs = [eax, ecx]; stack_params = 4; ret_bytes = "0x10");
+
+unsafe extern "cdecl" fn draw_sprite_local_impl(
+    y_pos: u32,
+    this: u32,
+    layer: u32,
+    x_pos: u32,
+    sprite_id: u32,
+    frame: u32,
+) {
+    let q = &mut *(this as *mut RenderQueue);
+
+    if let Some(entry) = q.alloc::<DrawSpriteCmd>() {
+        *entry = DrawSpriteCmd {
+            command_type: command_type::DRAW_SPRITE_LOCAL,
+            layer,
+            x: Fixed(x_pos as i32).floor(),
+            y: Fixed(y_pos as i32).floor(),
+            sprite: SpriteOp(sprite_id),
+            palette: frame,
+        };
+    }
+}
+
+// ---------------------------------------------------------------------------
+// DrawSpriteOffset (0x5420E0) — type 6, ECX=this, EDX=y_clip, 6 stack, RET 0x18
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_draw_sprite_offset; impl_fn = draw_sprite_offset_impl;
+    regs = [ecx, edx]; stack_params = 6; ret_bytes = "0x18");
+
+unsafe extern "cdecl" fn draw_sprite_offset_impl(
+    this: u32,
+    y_clip: u32,
+    layer: u32,
+    x_pos: u32,
+    y_pos: u32,
+    sprite_id: u32,
+    param_7: u32,
+    param_8: u32,
+) {
+    let q = &mut *(this as *mut RenderQueue);
+
+    if let Some(entry) = q.alloc::<DrawSpriteOffsetCmd>() {
+        *entry = DrawSpriteOffsetCmd {
+            command_type: command_type::DRAW_SPRITE_OFFSET,
+            layer,
+            flags: sprite_id,
+            x: Fixed(x_pos as i32).floor(),
+            y: Fixed(y_pos as i32).floor(),
+            ref_z: 0,
+            ref_z_2: Fixed(y_clip as i32).floor().0,
+            sprite: SpriteOp(param_7),
+            palette: param_8,
+        };
+    }
+}
+
+// ---------------------------------------------------------------------------
+// DrawBitmapGlobal (0x542170) — type 1, ECX=this, EDX=y, 7 stack, RET 0x1C
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_draw_bitmap_global; impl_fn = draw_bitmap_global_impl;
+    regs = [ecx, edx]; stack_params = 7; ret_bytes = "0x1C");
+
+unsafe extern "cdecl" fn draw_bitmap_global_impl(
+    this: u32,
+    y_pos: u32,
+    layer: u32,
+    x_pos: u32,
+    bitmap_ptr: u32,
+    param_6: u32,
+    param_7: u32,
+    param_8: u32,
+    param_9: u32,
+) {
+    let q = &mut *(this as *mut RenderQueue);
+
+    if let Some(entry) = q.alloc::<DrawBitmapGlobalCmd>() {
+        *entry = DrawBitmapGlobalCmd {
+            command_type: command_type::DRAW_BITMAP_GLOBAL,
+            layer,
+            x: Fixed(x_pos as i32).floor(),
+            y: Fixed(y_pos as i32).floor(),
+            bitmap: bitmap_ptr as *mut _,
+            src_x: 0,
+            src_y: param_6 as i32,
+            src_w: param_7 as i32,
+            src_h: param_8 as i32,
+            flags: param_9,
+        };
+    }
+}
+
+// ---------------------------------------------------------------------------
+// DrawTextboxLocal (0x542200) — type 2, ECX=this, EDX=y, 6 stack, RET 0x18
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_draw_textbox_local; impl_fn = draw_textbox_local_impl;
+    regs = [ecx, edx]; stack_params = 6; ret_bytes = "0x18");
+
+unsafe extern "cdecl" fn draw_textbox_local_impl(
+    this: u32,
+    y_pos: u32,
+    layer: u32,
+    x_pos: u32,
+    text_ptr: u32,
+    param_6: u32,
+    param_7: u32,
+    param_8: u32,
+) {
+    let q = &mut *(this as *mut RenderQueue);
+
+    if let Some(entry) = q.alloc::<DrawTextboxLocalCmd>() {
+        *entry = DrawTextboxLocalCmd {
+            command_type: command_type::DRAW_TEXTBOX_LOCAL,
+            layer,
+            mode: 0,
+            x: Fixed(x_pos as i32).floor(),
+            y: Fixed(y_pos as i32).floor(),
+            ref_z: 0,
+            ref_z_2: 0,
+            bitmap: text_ptr as *mut _,
+            src_x: 0,
+            src_y: 0,
+            src_w: param_6 as i32,
+            src_h: param_7 as i32,
+            flags: param_8,
+        };
+    }
+}
+
+// ---------------------------------------------------------------------------
+// DrawBungeeTrail (0x500720) — stdcall(task, style, fill), RET 0xC
+//
+// Draws bungee drop trajectory path. Logic lives in openwa_core::render::bungee_trail.
+// ---------------------------------------------------------------------------
+
+unsafe extern "stdcall" fn draw_bungee_trail_impl(task_ptr: u32, style: u32, fill: u32) {
+    openwa_core::render::bungee_trail::draw_bungee_trail(task_ptr, style, fill);
+}
+
+// ---------------------------------------------------------------------------
+// DrawCrosshairLine (0x5197D0) — usercall(EDI=task_ptr), plain RET
+//
+// Draws the weapon aiming crosshair line:
+//   1. Compute direction from angle at task+0x264
+//   2. Compute line length from DDGame scale + task offset
+//   3. Endpoint = start + direction * length (with overflow clamping)
+//   4. DrawPolygon (2 vertices) for the line
+//   5. Conditionally DrawSpriteLocal at endpoint (crosshair sprite)
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_draw_crosshair_line; impl_fn = draw_crosshair_line_impl;
+    reg = edi);
+
+unsafe extern "cdecl" fn draw_crosshair_line_impl(task_ptr: u32) {
+    openwa_core::render::crosshair_line::draw_crosshair_line(task_ptr);
+}
+
+// ---------------------------------------------------------------------------
+// RenderDrawingQueue (0x542350) — usercall(EAX=RenderQueue*) + 2 stack
+// (DisplayGfx*, ClipContext*), RET 0x8.
+//
+// The per-frame render-queue dispatcher. Pure Rust port lives in
+// `openwa_core::render::queue_dispatch::render_drawing_queue`. The
+// trampoline captures EAX and forwards the two stack args.
+// ---------------------------------------------------------------------------
+
+usercall_trampoline!(fn trampoline_render_drawing_queue;
+    impl_fn = render_drawing_queue_impl;
+    reg = eax; stack_params = 2; ret_bytes = "0x8");
+
+unsafe extern "cdecl" fn render_drawing_queue_impl(
+    rq: *mut RenderQueue,
+    display: *mut DisplayGfx,
+    clip: *mut ClipContext,
+) {
+    render_drawing_queue(rq, display, clip);
+}
+
+// ---------------------------------------------------------------------------
+// Installation
+// ---------------------------------------------------------------------------
+
+pub fn install() -> Result<(), String> {
+    unsafe {
+        let _ = hook::install(
+            "EnqueueTiledBitmap",
+            va::RQ_ENQUEUE_TILED_BITMAP,
+            trampoline_enqueue_tiled_bitmap as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawLineStrip",
+            va::RQ_DRAW_LINE_STRIP,
+            trampoline_draw_line_strip as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawPolygon",
+            va::RQ_DRAW_POLYGON,
+            trampoline_draw_polygon as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawCrosshair",
+            va::RQ_DRAW_CROSSHAIR,
+            trampoline_draw_crosshair as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawRect",
+            va::RQ_DRAW_RECT,
+            trampoline_draw_rect as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawSpriteGlobal",
+            va::RQ_DRAW_SPRITE_GLOBAL,
+            trampoline_draw_sprite_global as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawSpriteLocal",
+            va::RQ_DRAW_SPRITE_LOCAL,
+            trampoline_draw_sprite_local as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawSpriteOffset",
+            va::RQ_DRAW_SPRITE_OFFSET,
+            trampoline_draw_sprite_offset as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawBitmapGlobal",
+            va::RQ_DRAW_BITMAP_GLOBAL,
+            trampoline_draw_bitmap_global as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawTextboxLocal",
+            va::RQ_DRAW_TEXTBOX_LOCAL,
+            trampoline_draw_textbox_local as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawBungeeTrail",
+            va::DRAW_BUNGEE_TRAIL,
+            draw_bungee_trail_impl as *const (),
+        )?;
+
+        let _ = hook::install(
+            "DrawCrosshairLine",
+            va::DRAW_CROSSHAIR_LINE,
+            trampoline_draw_crosshair_line as *const (),
+        )?;
+
+        let _ = hook::install(
+            "RenderDrawingQueue",
+            va::RQ_RENDER_DRAWING_QUEUE,
+            trampoline_render_drawing_queue as *const (),
+        )?;
+    }
+    Ok(())
+}