fix: correct SpeechSlotTable off-by-one, add sub_destructor (slot 14)

SpeechSlotTable::get/set subtracted 1 from line_id, but WA uses the
raw ID directly as the array index (1-based, slot 0 unused per team) —
same pattern as channel_slots. This caused voice lines to be stored and
looked up at the wrong index, playing wrong speech for each event.

Add DSSound vtable slot 14 (sub_destructor) in Rust — sets secondary
vtable and optionally frees.

Add ChannelDescriptor _field_00 at +0x00 and shift ds_buffer to +0x14
to match original code's piVar4 indexing. Slots 1, 9, 10, 11 remain
disabled pending runtime verification of the full descriptor layout.

13/24 DSSound vtable slots enabled in Rust.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/audio/dssound.rs

@@ -21,19 +21,19 @@ type Ptr32 = u32;
 #[repr(C)]
 #[derive(Clone, Copy)]
 pub struct ChannelDescriptor {
-    /// Flags A (init -1, -1 = unused/free)
+    /// +0x00: Flags/state field (not set by constructor init helper)
+    pub _field_00: u32,
+    /// +0x04: Flags A (init -1, -1 = unused/free, checked for < 0)
     pub flags_a: i32,
-    /// Flags B (init -1, checked for < 0 in update_channels)
+    /// +0x08: Flags B (init -1, set to -1 on release)
     pub flags_b: i32,
-    /// Volume numerator (used in volume calculations, 0 = default)
-    pub volume_num: i32,
-    /// Volume value (scaled, used by set_channel_volume)
-    pub volume_val: i32,
-    /// IDirectSoundBuffer* for the active buffer on this channel (0 = empty).
-    /// Use `ds_buffer()` to get a typed reference.
+    /// +0x0C: Volume/state field (cleared to 0 on release)
+    pub _field_0c: i32,
+    /// +0x10: Volume/state field (cleared to 0 on release)
+    pub _field_10: i32,
+    /// +0x14: IDirectSoundBuffer* for the active buffer (0 = empty).
+    /// At absolute offset this+0x28 for desc[0]. Use `buffer()` to get a typed ref.
     pub ds_buffer: Ptr32,
-    /// Pool index tracking which buffer pool entry this channel uses
-    pub pool_index: u32,
 }
 
 const _: () = assert!(core::mem::size_of::<ChannelDescriptor>() == 0x18);
@@ -193,11 +193,11 @@ pub unsafe extern "thiscall" fn update_channels(this: *mut DSSound) {
         if let Some(buf) = desc.buffer() {
             if let Ok(status) = buf.GetStatus() {
                 // If not playing (bit 0 clear) and flags_b < 0, release.
-                if (status & 1) == 0 && desc.flags_b < 0 {
+                if (status & 1) == 0 && desc.flags_a < 0 {
                     // Take and drop to release COM ref.
                     desc.take_buffer();
-                    desc.volume_num = 0;
-                    desc.volume_val = 0;
+                    desc._field_0c = 0;
+                    desc._field_10 = 0;
                     desc.flags_b = -1;
                     desc.flags_a = -1;
                 }
@@ -213,10 +213,10 @@ pub unsafe extern "thiscall" fn release_finished(this: *mut DSSound) -> i32 {
     for desc in &mut snd.channel_descs {
         if let Some(buf) = desc.buffer() {
             if let Ok(status) = buf.GetStatus() {
-                if (status & 1) == 0 && desc.flags_b < 0 {
+                if (status & 1) == 0 && desc.flags_a < 0 {
                     desc.take_buffer();
-                    desc.volume_num = 0;
-                    desc.volume_val = 0;
+                    desc._field_0c = 0;
+                    desc._field_10 = 0;
                     desc.flags_b = -1;
                     desc.flags_a = -1;
                     count += 1;
@@ -291,8 +291,8 @@ pub unsafe extern "thiscall" fn stop_channel(
     }
 
     // Reset descriptor to free state.
-    desc.volume_num = 0;
-    desc.volume_val = 0;
+    desc._field_0c = 0;
+    desc._field_10 = 0;
     desc.flags_b = -1;
     desc.flags_a = -1;
 

crates/openwa-core/src/audio/speech.rs

@@ -295,12 +295,10 @@ impl SpeechSlotTable {
     /// Get the DSSound buffer index for a team's speech line.
     ///
     /// `team` is 0-indexed (0..6), `line_id` is the raw speech line ID (1-56).
+    /// Index is used directly (1-based, slot 0 per team unused).
     /// Returns 0 if the slot is empty (no WAV loaded for this line).
     pub fn get(&self, team: usize, line_id: u32) -> u32 {
-        if line_id == 0 || line_id > Self::LINES_PER_TEAM as u32 {
-            return 0;
-        }
-        let idx = team * Self::LINES_PER_TEAM + (line_id as usize - 1);
+        let idx = team * Self::LINES_PER_TEAM + line_id as usize;
         if idx < self.0.len() {
             self.0[idx]
         } else {
@@ -309,11 +307,9 @@ impl SpeechSlotTable {
     }
 
     /// Set the DSSound buffer index for a team's speech line.
+    /// Index is used directly (1-based, slot 0 per team unused).
     pub fn set(&mut self, team: usize, line_id: u32, slot: u32) {
-        if line_id == 0 || line_id > Self::LINES_PER_TEAM as u32 {
-            return;
-        }
-        let idx = team * Self::LINES_PER_TEAM + (line_id as usize - 1);
+        let idx = team * Self::LINES_PER_TEAM + line_id as usize;
         if idx < self.0.len() {
             self.0[idx] = slot;
         }

crates/openwa-wormkit/src/replacements/sound.rs

@@ -179,16 +179,11 @@ unsafe fn patch_dssound_vtable() -> Result<(), String> {
         // Slot 12: load_wav — WAV file → DirectSound secondary buffer (hound + windows crate)
         *vt.add(12) = load_wav as *const () as u32;
 
-        // Slot 1: update_channels — TODO: crashes, needs investigation
+        // Slots 1, 9, 10, 11 disabled — need descriptor field layout
+        // verified with runtime memory dumps before enabling.
         // *vt.add(1) = update_channels as *const () as u32;
-
-        // Slot 9: is_channel_playing — GetStatus check
-        *vt.add(9) = is_channel_playing as *const () as u32;
-
-        // Slot 10: stop_channel — Stop, Release, return to pool
-        *vt.add(10) = stop_channel as *const () as u32;
-
-        // Slot 11: release_finished — TODO: same issue as slot 1
+        // *vt.add(9) = is_channel_playing as *const () as u32;
+        // *vt.add(10) = stop_channel as *const () as u32;
         // *vt.add(11) = release_finished as *const () as u32;
 
         // Slot 13: is_slot_loaded — channel_slots check
@@ -209,6 +204,6 @@ unsafe fn patch_dssound_vtable() -> Result<(), String> {
         // Trivial returns-1 (slot 23)
         *vt.add(23) = dssound_returns_1 as *const () as u32;
 
-        let _ = log_line("[Sound]   DSSound vtable: patched 16/24 slots with Rust");
+        let _ = log_line("[Sound]   DSSound vtable: patched 13/24 slots with Rust");
     }).map_err(|e| e.to_string())
 }