| # Native client command admission and bounded chat paths |
|
|
| Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_chat_paths.py`; check with `python3 scripts/test_chat_paths.py`. [Generated evidence](chat-paths.json) includes source/disassembly hashes, both Linux ELF64 native command tables/graphs, QVM chat helper partitions and bounded join/recipient traces. CALLs are recorded, not entered; token lengths and team-mode helper results are supplied fixture inputs. No original game or complete QVM runs. |
|
|
| ## CHAT-001: native admission, sanitation and weighted limits |
|
|
| Both Linux ELF64 `ucmds` tables contain eight name/handler pairs followed by a null pair: `userinfo`, `disconnect`, `cp`, `vdr`, `download`, `nextdl`, `stopdl`, `donedl`. Their handlers are respectively SV_UpdateUserinfo_f, SV_Disconnect_f, SV_VerifyPaks_f, SV_ResetPureClient_f, SV_BeginDownload_f, SV_NextDownload_f, SV_StopDownload_f and SV_DoneDownload_f. The collector reads bounded, file-backed 16-byte rows and verifies string termination; it does not execute those handlers. |
|
|
| SV_ExecuteClientCommand tokenizes input and compares argv 0 with built-in names through **strcmp**. A match invokes its handler with the native client pointer before the subsequent forwarding decision. Its third native argument controls that decision: zero permits a handled return or unhandled debug diagnostic; nonzero reaches game forwarding only when no built-in matched. The unmatched forwarding path additionally requires native server state **2** and native client state **4**. Those values belong to native structures and must not be confused with QVM recipient state 2 below. The caller's third-argument production, flood throttling and complete native state lifecycle remain open. |
| |
| Cmd_Args_Sanitize replaces **LF (10)** and **CR (13)** with space (32) in argument strings after argv 0. The file-backed sanitizer bytes are `0a 0d 00`; the symbol-address and graph evidence identify traversal beginning at `cmd_argv + 8`, i.e. argv 1 in these eight-byte-pointer images. The graph is retained; native mutation/tokenizer behavior is not executed in fixtures. |
|
|
| After sanitation, Q_stricmp selects `say`, `say_team` and `tell` for weighted budget **256**, and `ut_radio` for budget **122**. Other unmatched game commands bypass this particular limit scan. The scanner visits argv argc-1 down to 1, counts bytes and inter-argument separators, and adds **16 extra units per `$` byte**. Thus each dollar costs 17 units including its ordinary byte. More than **six** dollar bytes or a signed weighted total above the chosen budget takes the warning/log/server-command path instead of VM forwarding. Equality with a budget passes the visible comparison. This is instruction-graph recovery, not native execution or proof of downstream expansion/escaping semantics. The native command-6 tail still requires its preceding admission/filter path. |
| |
| ## CHAT-002: token concatenation capacity |
| |
| Helper **180858** uses a global buffer at VM address **35737412**. It obtains argc, starts at its incoming token index, retrieves each token into a 1024-byte local buffer and gets its byte length. Before copying it checks signed `used + token_length < 1023`; otherwise it stops before that token. Accepted tokens are copied through trap 101 (encoded CALL -102), and a space is appended unless the token is the final argument. A terminating NUL is written at the resulting used offset. |
|
|
| Bounded slices supply token lengths rather than entering argv/length/memcpy callees. They show that used 1021 plus length 1 can copy and append a separator, reaching used **1023** with NUL at offset 1023. Used 1022 plus an empty nonfinal token does likewise. Used 1022 plus length 1 rejects the token, as does an initial length 1023. Empty nonfinal tokens can therefore still contribute a separator. The visible routine truncates by stopping at a whole-token boundary; it does not partially copy the rejected token. |
|
|
| This is a shared global buffer, not an owned return string. Reentrancy, caller lifetime, signed overflow with impossible/corrupt length inputs and native copy semantics remain unverified. Helper 187381 subsequently copies chat content with capacity **150** and calls 186435; the exact transformation and final effective text limits are still open. |
|
|
| ## CHAT-003: recipient front gates and remaining send behavior |
|
|
| The delivery helper **186721** applies these recovered early gates: |
|
|
| - Sender-record offset **3128** greater than global time **34992532** rejects delivery; equality passes. This is a mute-deadline interpretation supported by the later `(MUTED)` log format, not a complete mute lifecycle or time-wrap contract. |
| - Registered **g_allowChat**, mirror integer **34077172**, supplied default `2`, must be nonzero. Channel mode zero additionally requires its value at least 2; modes 1/2/4 pass the observed gate when it is 1. Other numeric domains have not been constrained by runtime configuration. |
| - Recipient object must be nonzero, object offset **532** nonzero, and its record pointer at offset **520** nonzero. Offset 532's complete field identity is not assigned here. |
| - Recipient-record word **3780 + 4 * sender_slot** must be zero. The sender slot is derived from its record pointer, shared record base and stride 6336. Any nonzero ignore word rejects; complete ignore-table creation, bounds and lifetime remain open. |
| - Recipient-record state at **468** must equal **2**. |
| - For channel mode 1, the visible team path accepts matching record fields **3096** when helper 33715 reports nonzero. If that helper reports zero or the comparison fails, the same-object exception allows sender-to-self; otherwise delivery is rejected. Fixtures supply the helper result explicitly. |
|
|
| These are individually bounded gates, not a composed end-to-end recipient decision. The intervening g_allowChat==3/global-bit/state branch, later dead-chat policy, fields 3740/4324/4, round/pause state, and exact formatting remain open and are retained in the complete helper partition. |
| |
| Send helper **187381** uses a mode jump table, builds a 64-byte name prefix, copies/transforms text, then either sends toward an explicit target with a possible sender echo or iterates slot objects `34091368 + slot * 880`, invoking 186721 per slot. The final delivery helper formats `me`, ordinary chat variants or `cchat` for private messages, then sends trap 17 to the recipient slot derived from the object address. Full table/format selection, mutations, escaping, reliable-command admission and rendering are not closed by this pass. |
| |
| ## Correction to the preceding batch |
| |
| The previous BND-003 fixture incorrectly treated local **3356** as the chat channel mode. With ENTER frame 3340, locals 3348/3352/3356 hold the first/second/third incoming arguments; channel mode is **3352**. The early branch at 187929 reads the **third argument**. All observed say/say_team/me callers pass zero there and can proceed toward slash/auth checks. A nonzero third argument bypasses those checks through concatenation/common-send handling. The analyzer, generated evidence, tests, prior findings and BND-003 documentation are corrected together. This correction does not establish that every later permission or command check succeeds on every channel. |
|
|
| ## Completion and remaining work |
|
|
| RE-261–263 cover native table/admission/filter evidence, bounded concatenation boundaries and recipient front gates. RE-264 tracks native caller/flood/tokenizer execution, complete chat/dead-chat/ignore/mute lifecycle and formatting/queue/rendered-output fixtures. RE-260 remains open for the broader native filtering and chat runtime contract. Original assets remain in ignored cache; only code/documentation and generated analysis evidence are added. |
|
|
| The [DEL-001–003 follow-up](CHAT_DELIVERY.md) recovers bounded dead-chat policy, formatter arguments and echo/fanout calls. It narrows the later-path questions above; complete lifecycle and runtime output remain open under RE-264/268. |
|
|
