forked from Ports/goldeneye-pc-port
James Dansereau
bb14baf3bf
D131: restore truncated module ptr in seg_addr (Jungle -level_37) explosionRenderPropSmoke passes a compiled .bss matrix symbol (&dword_CODE_bss_8007A100) through osVirtualToPhysical() -- a u32-returning shim -- into gSPMatrix, truncating the 0x1_00000000 module high word. w1 lands as 0x40xxxxxx and seg_addr() returns it raw -> wild deref in gfx_sp_matrix when the first explosion draws (~frame 300). Fix: seg_addr() restores the module high word for any fallthrough w1 in [0x40000000, 0x70000000) (module fixed-based at 0x140000000, no ASLR; DRAM/KSEG0/segmented/phys are all handled in earlier branches). Covers the ~30 latent osVirtualToPhysical(<compiled matrix/vtx symbol>) sites in explosion/glass/blood/bondview2. Verified: Jungle renders to frame 1500-2400+ crash-free at 91.7% content; -level_20/-level_24 unregressed. Sweep 18->19/21 (note: -level_09 has a separate pre-existing boot crash regressed since M-18 -- see HANDOFF). @