feat: port DDDisplay::FlushRender to Rust

Port FlushRender (vtable slot 26) with two simplifications:
- unlock_surface_write call eliminated (it's a no-op that writes a
success code to a discarded result buffer)
- get_renderer_surface called via DDDisplayWrapper::call_method()

Add call_method/call_method_1 helpers on DDDisplayWrapper for calling
its vtable methods which use an MFC-style result-return convention
(ECX=this, EDX=result_buf_ptr). These are temporary bridges — the
proper fix is to investigate whether this is MSVC's hidden return
pointer for struct-returning thiscall methods and type accordingly.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/display/dd_display.rs

@@ -294,9 +294,33 @@ pub unsafe extern "thiscall" fn get_dimensions(
     *out_h = (*gfx).base.display_height;
 }
 
-// FlushRender (vtable slot 26, 0x56A580) — NOT YET PORTED.
-//
-// Calls DDDisplayWrapper::unlock_surface_write and ::get_renderer_surface,
-// which use a non-standard fastcall convention (EDX = result pointer, not
-// standard thiscall). Needs a naked asm bridge or corrected vtable typing
-// for the DDDisplayWrapper methods before this can be ported.
+use super::display_wrapper::DDDisplayWrapper;
+use crate::address::va;
+use crate::rebase::rb;
+
+/// Port of DDDisplay::FlushRender (vtable slot 26, 0x56A580).
+///
+/// If the render lock is held, clears it (the original also calls
+/// DDDisplayWrapper::unlock_surface_write, but that's a no-op that
+/// writes a success code to a discarded result buffer).
+///
+/// Then calls DDDisplayWrapper::get_renderer_surface (slot 13),
+/// which dispatches to the renderer backend's Flip.
+///
+/// # Safety
+/// `this` must be a valid `*mut DDDisplay` (actually a `*mut DisplayGfx`).
+/// `g_DDDisplayWrapper` (0x79D6D4) must be initialized.
+pub unsafe extern "thiscall" fn flush_render(this: *mut DDDisplay) {
+    let gfx = this as *mut DisplayGfx;
+    let wrapper = *(rb(va::G_DD_DISPLAY_WRAPPER) as *const *mut DDDisplayWrapper);
+
+    if (*gfx).render_lock != 0 {
+        // Original calls wrapper->vtable[18] (unlock_surface_write) here,
+        // but that function ignores its data parameter and just writes a
+        // success code to a result buffer that FlushRender never reads.
+        (*gfx).render_lock = 0;
+    }
+
+    // get_renderer_surface → renderer Flip
+    DDDisplayWrapper::call_method(wrapper, 13);
+}

crates/openwa-core/src/display/display_wrapper.rs

@@ -140,4 +140,56 @@ pub struct DDDisplayWrapper {
 const _: () = assert!(core::mem::size_of::<DDDisplayWrapper>() == 0x1C);
 
 // Generate calling wrappers: DDDisplayWrapper::flip_surface(), etc.
+// NOTE: The generated bind wrappers assume standard thiscall, but
+// DDDisplayWrapper methods actually use MFC result-return convention
+// (ECX=this, EDX=result_buf_ptr). Use call_wrapper_method() instead.
 bind_DDDisplayWrapperVtable!(DDDisplayWrapper, vtable);
+
+impl DDDisplayWrapper {
+    /// Call a DDDisplayWrapper vtable method by slot index.
+    ///
+    /// DDDisplayWrapper methods use an MFC result-return convention:
+    /// ECX = this, EDX = pointer to caller-allocated result buffer.
+    /// The result is discarded by most callers.
+    ///
+    /// # Safety
+    /// `this` must be a valid DDDisplayWrapper pointer with an initialized vtable.
+    #[inline]
+    pub unsafe fn call_method(this: *mut DDDisplayWrapper, slot: usize) {
+        let vtable = (*this).vtable as *const u32;
+        let func: u32 = *vtable.add(slot);
+        let mut result_buf: [u32; 2] = [0; 2];
+        core::arch::asm!(
+            "call {func}",
+            func = in(reg) func,
+            in("ecx") this,
+            inout("edx") result_buf.as_mut_ptr() => _,
+            out("eax") _,
+            clobber_abi("C"),
+        );
+    }
+
+    /// Call a DDDisplayWrapper vtable method with one stack parameter.
+    ///
+    /// Same MFC convention as `call_method`, with an additional stack argument
+    /// pushed before the call (callee cleans via RET N).
+    ///
+    /// # Safety
+    /// `this` must be a valid DDDisplayWrapper pointer with an initialized vtable.
+    #[inline]
+    pub unsafe fn call_method_1(this: *mut DDDisplayWrapper, slot: usize, param: u32) {
+        let vtable = (*this).vtable as *const u32;
+        let func: u32 = *vtable.add(slot);
+        let mut result_buf: [u32; 2] = [0; 2];
+        core::arch::asm!(
+            "push {param}",
+            "call {func}",
+            param = in(reg) param,
+            func = in(reg) func,
+            in("ecx") this,
+            inout("edx") result_buf.as_mut_ptr() => _,
+            out("eax") _,
+            clobber_abi("C"),
+        );
+    }
+}

crates/openwa-dll/src/replacements/display.rs

@@ -82,8 +82,9 @@ pub fn install() -> Result<(), String> {
         // Patch DDDisplay vtable (0x66A218): replace ported methods with Rust.
         vtable_replace!(DDDisplayVtable, va::DD_DISPLAY_VTABLE, {
             get_dimensions => dd_display::get_dimensions,
+            flush_render   => dd_display::flush_render,
         })?;
-        let _ = log_line("[Display]   DDDisplay: patched get_dimensions → Rust");
+        let _ = log_line("[Display]   DDDisplay: patched get_dimensions + flush_render → Rust");
     }
 
     Ok(())