Reconcile native byte regions and trace authentication drop behavior

docs/FINDINGS.md

@@ -185,3 +185,8 @@ Exact native fork/source revision, runtime resource lookup, legacy launch enviro
 **F-030 — Observed: SDL/client Mach-O debug-map ranges.** Raw STABS yield 1,012 nonoverlapping SDL function ranges associated with 78 source/object entries, plus six client SDLMain launcher ranges. No local/parameter/type-description classes were observed. Source paths suggest SDL 1.2.15 build provenance, not a verified upstream implementation match. SDL text still contains 524 bytes outside these ranges. [META-001](research/native/METADATA.md).
 
 **F-031 — Observed: Windows resource contents and icon discrepancy.** The client PE has nine leaves: seven icon images, one string block and one icon group, all language 1033; the dedicated PE has no resource directory. A reconstructed ICO preserves every image byte. Four 32-bit image payloads exceed their standard DIB pixel/mask extent; their surplus remains preserved and unclassified. [META-002/003](research/native/METADATA.md).
+
+
+**F-032 — Observed: bounded native byte regions reconciled.** The SDL text bytes outside debug-map function ranges are 70 NOP runs totaling 524 bytes. Windows client resource bytes partition into 353,268 payload bytes and 520 tree-structure bytes, with no unreferenced gaps. This resolves the previously unclassified bytes in these two regions, not whole-binary semantics. [COV-001/002](research/native/COVERAGE.md).
+
+**F-033 — Observed/inferred: authentication drop boundary and deferred QVM branch.** Linux ELF64 trap 603 receives index/broadcast text/disconnect reason; valid completion and invalid-index guards both return zero. The QVM caller validates slot and states 1/2; state 1 calls a helper with record buffers and limits 128/256, then sets a flag, while state 2 invokes the native service. Deferred-consumer behavior, state names, pointer errors and other platforms remain open. [AUTH-001/002](research/AUTH_DROP.md).

docs/RESEARCH_LEDGER.md

@@ -78,3 +78,8 @@ Completed RE-211–213: extra entry command evidence, six QVM network/auth call-
 ## 2026-10-11 — Native metadata follow-up
 
 Completed static milestones RE-214–216 with `analyze_native_metadata.py`: all 4,753 Mach-O STABS records retained, 1,018 paired function ranges hashed, nine Windows resource leaves preserved by variant, string slots decoded, icon group reconstructed and unexpected image extents recorded. Findings F-030/031 and META-001–003 distinguish structural recovery from source matching or rendering semantics. Seven tests cover malformed structures and real function/resource reconstruction. New derived binary evidence stays under Xet-filtered assets; originals remain in ignored cache. RE-217/218 track icon surplus rendering and uncovered byte regions.
+
+
+## 2026-10-11 — Byte reconciliation and authentication drop boundary
+
+Completed RE-218–220 with `analyze_native_coverage.py` and `analyze_auth_drop.py`: bounded byte partitions explain all SDL text gaps and resource-tree bytes; focused native/QVM evidence recovers broadcast/disconnect parameters, invalid-index zero returns and deferred versus immediate caller branches. F-032/033, COV-001/002 and AUTH-001/002 retain source hashes and limitations. Seven new tests verify interval accounting, malformed bounds, guard convergence, result-preserving epilogues, bounded literals and supplied fixtures. Static literal scanning excludes nonallocated ELF sections to avoid interpreting small numeric constants as offsets into compiler-comment sections. No original game code was executed.

docs/REVERSE_ENGINEERING_TODO.md

@@ -257,4 +257,7 @@ Purpose: turn the supplied installation into an evidence-backed specification of
 - [x] RE-215 Enumerate every supplied Windows PE resource leaf by type/name/language, preserve all variants, decode the string block and reconstruct the linked icon group. **Evidence:** nine client leaves, zero dedicated leaves, seven-image ICO with identical payloads, META-002.
 - [x] RE-216 Calculate supplied icon DIB header/palette/pixel/mask extents; hash and preserve unexpected surplus bytes. **Evidence:** META-003 and per-leaf structural reports. This completes extent analysis, not visual/pixel semantics.
 - [ ] RE-217 Explain/render the four 32-bit Windows icon payloads with surplus bytes; compare alpha/mask behavior across reference decoders before normalizing them.
-- [ ] RE-218 Reconcile the 524 SDL text bytes outside paired debug-map functions and all Windows resource-region metadata/padding gaps; preserve evidence for every byte classification.
+- [x] RE-218 Reconcile the 524 SDL text bytes outside paired debug-map functions and all Windows resource-region metadata/padding gaps; preserve evidence for every byte classification. **Evidence:** `analyze_native_coverage.py`, source-hashed segment partitions and COV-001/002; 70 SDL NOP runs account for all 524 bytes, Windows region accounts for 353,268 payload + 520 structure bytes with no gaps. Byte patterns do not establish runtime reachability.
+- [x] RE-219 Trace Linux ELF64 trap 603 argument meanings, both invalid-index continuations and common return epilogues. **Evidence:** `analyze_auth_drop.py`, `auth-drop.json`, AUTH-001; broadcast/disconnect formats and zero returns verified. Complete helper behavior/all-platform parity remain RE-206.
+- [x] RE-220 Recover the QVM trap-603 caller's slot/state guards, record stride and state-1 storage versus state-2 immediate service call. **Evidence:** AUTH-002 and full caller instructions; state names, copy-helper behavior and deferred consumer remain open.
+- [ ] RE-221 Trace the QVM record flag at offset 3588, helper 69338 and state transitions; specify deferred authentication drops, buffer limits, terminator behavior and reentrancy with runtime fixtures.

docs/research/AUTH_DROP.md

@@ -0,0 +1,30 @@
+# Authentication drop service: Linux boundary and QVM state branches
+
+Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_auth_drop.py`; validate with `python3 scripts/test_native_followup.py`. [Generated evidence](auth-drop.json) preserves original hashes, native dispatch cases, invalid-index continuations, common return epilogues, complete selected helper bodies and the QVM caller. No original game code or network operation was executed.
+
+## AUTH-001: argument meanings and invalid-index result
+
+For Linux ELF64 game trap **603**, slots 1–3 are a signed client index, a VM pointer to a broadcast message, and a VM pointer to a disconnect reason. Both pointers are converted through `VM_ArgPtr` before the native index guard. An index below zero or at least `sv_maxclients` branches to `xor %eax,%eax` and the common result-preserving return epilogue. **Both valid dispatch completion and invalid-index dispatch completion return zero.** The recognizer checks both guards converge and rejects an epilogue that modifies the result or transfers control unexpectedly.
+
+The helper retains its second parameter in `%r13` and third in `%r14`. If the second string's first byte is nonzero, it supplies that string to `SV_SendServerCommand` with client pointer zero and format `print "%s\n"`. The third parameter is supplied with the selected client pointer and format `disconnect "%s"`. This supports the descriptive parameter meanings, rather than merely observing two pointers. Strings and their native instruction locations are preserved in the report.
+
+Dedicated invalid-index continuation: `0x40b41a`, common return `0x40b190`. Client-engine equivalents: `0x47338a`, `0x473100`. The helper entries are `0x407a14` and `0x472364`. These are preferred virtual addresses, not file offsets.
+
+The helper also calls game entry command 5, clears userinfo and transitions the client state to numeric value 1; its diagnostic format is `Going to CS_ZOMBIE for %s\n`. File cleanup, allocation release, bot handling, demo-stop command construction and heartbeat behavior occur in conditional paths retained in the full body. This pass establishes the boundary and selected string effects, not all cleanup ordering and state semantics.
+
+## AUTH-002: QVM caller validates and can defer
+
+The sole observed trap-603 call is instruction **165943**, inside the function beginning at **165818**. Its 32-byte frame reads incoming arguments from local offsets 40, 44 and 48. It validates the signed index against zero and the VM global at address 34992524. Invalid slots print `auth: drop error - bad client slot: %i\n` and skip the trap. It derives a record pointer from the base stored at VM address 34992496 plus `index * 6336` and reads its state at offset 468.
+
+Only numeric states **1 and 2** pass the active-state check. Other states print `auth: drop error - client %i is not active\n` and skip the trap. For state 1, it calls helper instruction 69338 with the two message pointers and record destinations at offsets 3204 and 3332, passing limits 128 and 256. It sets the record field at offset 3588 to one and exits without invoking trap 603. These are observed storage/flag operations consistent with deferred handling; helper semantics and the flag consumer remain untraced.
+
+For state 2, it passes `AccountKick: %i - %s\n`, the index and broadcast-message pointer to helper 7259, clears offset 3588 to zero and then invokes trap 603 with index/message/reason. The native helper independently checks the engine-side index. VM record stride 6336 and native client stride `0x2df40` describe distinct data layouts; a Rust port must not conflate them.
+
+## Remaining contract work
+
+- Trace the state-1 flag consumer and helper 69338 to establish deferred processing, truncation and terminator rules. Recover authoritative names for the two VM states and every affected field.
+- Specify null/invalid VM pointers and conversion behavior, especially because conversion precedes the native index check. Zero return is not proof that all invalid pointer inputs are harmless.
+- Trace all helper early exits and cleanup side effects, the game command-5 callback and state transition ordering, then compare other native platforms.
+- Add deterministic reference fixtures for invalid/inactive slots, deferred state, immediate state, empty broadcast text, disconnect reasons and repeated drops. No runtime conformance is claimed by static recognizer tests.
+
+RE-219/220 record completed static milestones. RE-206 remains open for full error/helper behavior and all-platform parity.

docs/research/README.md

@@ -10,6 +10,8 @@ The [extension follow-up](VM_EXTENSIONS.md) traces all four extra game/UI entry
 
 The [native metadata follow-up](native/METADATA.md) recovers SDL/client debug-map ranges and all supplied Windows resource leaves, reconstructs the icon group and records unclassified icon surplus.
 
+[Byte reconciliation](native/COVERAGE.md) now explains the SDL text gaps and entire Windows resource region; [authentication drop analysis](AUTH_DROP.md) traces parameter meanings, invalid-index returns and QVM state branches.
+
 ## Reproduce
 
 From the repository root, with the verified source installation and extracted assets present:
@@ -19,10 +21,11 @@ python3 scripts/analyze_binaries.py
 python3 scripts/test_binary_analysis.py
 python3 scripts/test_vm_extensions.py
 python3 scripts/test_native_metadata.py
+python3 scripts/test_native_followup.py
 python3 scripts/storage_policy.py check --require-setup
 ```
 
-The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, and `analyze_native_metadata.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
+The pipeline runs `fetch_analysis_references.py`, `analyze_qvm.py`, `analyze_native.py`, `analyze_vm_abi.py`, `analyze_native_dispatch.py`, `analyze_vm_extensions.py`, `analyze_native_metadata.py`, `analyze_native_coverage.py`, and `analyze_auth_drop.py` in that order. Python 3.9+ and **LLVM objdump** with x86 ELF/COFF/Mach-O support are required. This pass used Apple LLVM 17.0.0 on macOS arm64; it disassembled x86 images without running them. Upstream references are downloaded only if absent, checked against the committed SHA-256 manifest, and cached under `.cache/research/upstream/`. A clone also needs `git lfs pull` to obtain the derived artifacts/extracted members.
 
 Generated JSON/JSONL and compressed evidence are regenerated in place; keep prose notes in Markdown. Rerunning the four analysis stages reproduced every generated report and gzip artifact byte-for-byte on the same toolchain. gzip timestamps and stored filenames are fixed. Different objdump versions can produce different disassembly text, so tool version and uncompressed evidence hashes are recorded. Reports are UTF-8 normal Git text, with individual files below the storage policy's 2 MiB limit.
 

docs/research/VM_EXTENSIONS.md

@@ -48,3 +48,5 @@ This gives a concrete replacement boundary for address parsing and packet sendin
 - Implement Rust address/message types only after semantic serialization contracts exist. Preserve compatibility policy for unavailable historical authentication services as a separate design decision.
 
 The broad RE-205 and RE-206 tasks remain open because runtime fixtures and all-platform behavior are still missing. Focused evidence-collection milestones are complete in the main checklist. Native caller scanning reports local candidates and intentionally discards a candidate after a branch, call, return or write to the command register; alternative incoming branches and unusual instruction aliases are outside this recognizer's scope.
+
+Follow-up: [AUTH-001/002](AUTH_DROP.md) recovers the two drop parameter meanings, proves zero results on both Linux ELF64 invalid-index continuations, and traces the QVM caller's state-dependent storage/service branches. Earlier unknowns above are superseded only for these specific static boundaries.

docs/research/auth-drop.json

@@ -0,0 +1,1775 @@
+{
+  "limitations": "Linux ELF64 static boundary evidence. Literal operands are candidates, not whole-program dataflow. No runtime reference fixtures or all-platform contract.",
+  "native": {
+    "linux--Quake3-UrT-Ded.x86_64": {
+      "case": {
+        "direct_call_or_jump_labels": [
+          "SV_Auth_DropClient",
+          "SV_GameSystemCalls",
+          "VM_ArgPtr"
+        ],
+        "first_instructions": [
+          "40d4fa: 48 8b 7f 18                  \tmovq\t0x18(%rdi), %rdi",
+          "40d4fe: e8 4d 4b 04 00               \tcallq\t0x452050 <VM_ArgPtr>",
+          "40d503: 48 8b 7d 10                  \tmovq\t0x10(%rbp), %rdi",
+          "40d507: 48 89 c3                     \tmovq\t%rax, %rbx",
+          "40d50a: e8 41 4b 04 00               \tcallq\t0x452050 <VM_ArgPtr>",
+          "40d50f: 8b 55 08                     \tmovl\t0x8(%rbp), %edx",
+          "40d512: 85 d2                        \ttestl\t%edx, %edx",
+          "40d514: 0f 88 00 df ff ff            \tjs\t0x40b41a <SV_GameSystemCalls+0x2de>",
+          "40d51a: 48 8b 35 37 59 40 00         \tmovq\t0x405937(%rip), %rsi    # 0x812e58 <sv_maxclients>",
+          "40d521: 3b 56 30                     \tcmpl\t0x30(%rsi), %edx",
+          "40d524: 0f 8d f0 de ff ff            \tjge\t0x40b41a <SV_GameSystemCalls+0x2de>",
+          "40d52a: 48 63 ea                     \tmovslq\t%edx, %rbp",
+          "40d52d: 48 89 c6                     \tmovq\t%rax, %rsi",
+          "40d530: 48 89 da                     \tmovq\t%rbx, %rdx",
+          "40d533: 48 69 fd 40 df 02 00         \timulq\t$0x2df40, %rbp, %rdi    # imm = 0x2DF40",
+          "40d53a: 48 03 3d 6f 59 40 00         \taddq\t0x40596f(%rip), %rdi    # 0x812eb0 <svs+0x10>",
+          "40d541: e8 ce a4 ff ff               \tcallq\t0x407a14 <SV_Auth_DropClient>",
+          "40d546: 31 c0                        \txorl\t%eax, %eax",
+          "40d548: e9 43 dc ff ff               \tjmp\t0x40b190 <SV_GameSystemCalls+0x54>"
+        ],
+        "numbers_sharing_target": [
+          603
+        ],
+        "target_address": 4248826
+      },
+      "disassembly_sha256": "052ab3f6a3839fb43519fc71dea4dddc8d2d32ddaec7af312b80c2b17ce7c416",
+      "function": {
+        "address": 4225556,
+        "lines": [
+          "  407a14: 41 56                        \tpushq\t%r14",
+          "  407a16: 49 89 d6                     \tmovq\t%rdx, %r14",
+          "  407a19: 41 55                        \tpushq\t%r13",
+          "  407a1b: 49 89 f5                     \tmovq\t%rsi, %r13",
+          "  407a1e: 41 54                        \tpushq\t%r12",
+          "  407a20: 55                           \tpushq\t%rbp",
+          "  407a21: 53                           \tpushq\t%rbx",
+          "  407a22: 83 3f 01                     \tcmpl\t$0x1, (%rdi)",
+          "  407a25: 48 89 fb                     \tmovq\t%rdi, %rbx",
+          "  407a28: 0f 84 6d 03 00 00            \tje\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407a2e: 8b 87 e4 4e 02 00            \tmovl\t0x24ee4(%rdi), %eax",
+          "  407a34: 85 c0                        \ttestl\t%eax, %eax",
+          "  407a36: 0f 85 68 03 00 00            \tjne\t0x407da4 <SV_Auth_DropClient+0x390>",
+          "  407a3c: 8b bb a8 0c 02 00            \tmovl\t0x20ca8(%rbx), %edi",
+          "  407a42: 85 ff                        \ttestl\t%edi, %edi",
+          "  407a44: 0f 85 e1 04 00 00            \tjne\t0x407f2b <SV_Auth_DropClient+0x517>",
+          "  407a4a: 48 8b bb c0 0c 02 00         \tmovq\t0x20cc0(%rbx), %rdi",
+          "  407a51: c7 83 a8 0c 02 00 00 00 00 00\tmovl\t$0x0, 0x20ca8(%rbx)",
+          "  407a5b: c6 83 68 0c 02 00 00         \tmovb\t$0x0, 0x20c68(%rbx)",
+          "  407a62: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  407a65: 74 10                        \tje\t0x407a77 <SV_Auth_DropClient+0x63>",
+          "  407a67: e8 56 6c 02 00               \tcallq\t0x42e6c2 <Z_Free>",
+          "  407a6c: 48 c7 83 c0 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cc0(%rbx)",
+          "  407a77: 48 8b bb c8 0c 02 00         \tmovq\t0x20cc8(%rbx), %rdi",
+          "  407a7e: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  407a81: 74 10                        \tje\t0x407a93 <SV_Auth_DropClient+0x7f>",
+          "  407a83: e8 3a 6c 02 00               \tcallq\t0x42e6c2 <Z_Free>",
+          "  407a88: 48 c7 83 c8 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cc8(%rbx)",
+          "  407a93: 48 8b bb d0 0c 02 00         \tmovq\t0x20cd0(%rbx), %rdi",
+          "  407a9a: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  407a9d: 74 10                        \tje\t0x407aaf <SV_Auth_DropClient+0x9b>",
+          "  407a9f: e8 1e 6c 02 00               \tcallq\t0x42e6c2 <Z_Free>",
+          "  407aa4: 48 c7 83 d0 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cd0(%rbx)",
+          "  407aaf: 48 8b bb d8 0c 02 00         \tmovq\t0x20cd8(%rbx), %rdi",
+          "  407ab6: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  407ab9: 74 10                        \tje\t0x407acb <SV_Auth_DropClient+0xb7>",
+          "  407abb: e8 02 6c 02 00               \tcallq\t0x42e6c2 <Z_Free>",
+          "  407ac0: 48 c7 83 d8 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cd8(%rbx)",
+          "  407acb: 48 8b bb e0 0c 02 00         \tmovq\t0x20ce0(%rbx), %rdi",
+          "  407ad2: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  407ad5: 74 10                        \tje\t0x407ae7 <SV_Auth_DropClient+0xd3>",
+          "  407ad7: e8 e6 6b 02 00               \tcallq\t0x42e6c2 <Z_Free>",
+          "  407adc: 48 c7 83 e0 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20ce0(%rbx)",
+          "  407ae7: 48 8b bb e8 0c 02 00         \tmovq\t0x20ce8(%rbx), %rdi",
+          "  407aee: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  407af1: 74 10                        \tje\t0x407b03 <SV_Auth_DropClient+0xef>",
+          "  407af3: e8 ca 6b 02 00               \tcallq\t0x42e6c2 <Z_Free>",
+          "  407af8: 48 c7 83 e8 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20ce8(%rbx)",
+          "  407b03: 48 8b bb f0 0c 02 00         \tmovq\t0x20cf0(%rbx), %rdi",
+          "  407b0a: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  407b0d: 74 10                        \tje\t0x407b1f <SV_Auth_DropClient+0x10b>",
+          "  407b0f: e8 ae 6b 02 00               \tcallq\t0x42e6c2 <Z_Free>",
+          "  407b14: 48 c7 83 f0 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cf0(%rbx)",
+          "  407b1f: 48 8b bb f8 0c 02 00         \tmovq\t0x20cf8(%rbx), %rdi",
+          "  407b26: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  407b29: 74 10                        \tje\t0x407b3b <SV_Auth_DropClient+0x127>",
+          "  407b2b: e8 92 6b 02 00               \tcallq\t0x42e6c2 <Z_Free>",
+          "  407b30: 48 c7 83 f8 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cf8(%rbx)",
+          "  407b3b: 41 80 7d 00 00               \tcmpb\t$0x0, (%r13)",
+          "  407b40: 0f 85 56 04 00 00            \tjne\t0x407f9c <SV_Auth_DropClient+0x588>",
+          "  407b46: 8b bb a8 0c 02 00            \tmovl\t0x20ca8(%rbx), %edi",
+          "  407b4c: 85 ff                        \ttestl\t%edi, %edi",
+          "  407b4e: 0f 85 34 04 00 00            \tjne\t0x407f88 <SV_Auth_DropClient+0x574>",
+          "  407b54: 8b 93 20 cf 02 00            \tmovl\t0x2cf20(%rbx), %edx",
+          "  407b5a: 85 d2                        \ttestl\t%edx, %edx",
+          "  407b5c: 0f 85 ef 03 00 00            \tjne\t0x407f51 <SV_Auth_DropClient+0x53d>",
+          "  407b62: 48 89 da                     \tmovq\t%rbx, %rdx",
+          "  407b65: 48 2b 15 44 b3 40 00         \tsubq\t0x40b344(%rip), %rdx    # 0x812eb0 <svs+0x10>",
+          "  407b6c: 48 bd d5 05 41 79 fb 43 2f 35\tmovabsq\t$0x352f43fb794105d5, %rbp # imm = 0x352F43FB794105D5",
+          "  407b76: 48 8b 3d 43 58 2d 00         \tmovq\t0x2d5843(%rip), %rdi    # 0x6dd3c0 <gvm>",
+          "  407b7d: be 05 00 00 00               \tmovl\t$0x5, %esi",
+          "  407b82: 31 c0                        \txorl\t%eax, %eax",
+          "  407b84: 48 c1 fa 06                  \tsarq\t$0x6, %rdx",
+          "  407b88: 48 0f af d5                  \timulq\t%rbp, %rdx",
+          "  407b8c: e8 dd ac 04 00               \tcallq\t0x45286e <VM_Call>",
+          "  407b91: be b2 e9 4a 00               \tmovl\t$0x4ae9b2, %esi         # imm = 0x4AE9B2",
+          "  407b96: 31 c0                        \txorl\t%eax, %eax",
+          "  407b98: 4c 89 f2                     \tmovq\t%r14, %rdx",
+          "  407b9b: 48 89 df                     \tmovq\t%rbx, %rdi",
+          "  407b9e: e8 0b a7 00 00               \tcallq\t0x4122ae <SV_SendServerCommand>",
+          "  407ba3: 8b b3 e4 4e 02 00            \tmovl\t0x24ee4(%rbx), %esi",
+          "  407ba9: 85 f6                        \ttestl\t%esi, %esi",
+          "  407bab: 0f 84 84 03 00 00            \tje\t0x407f35 <SV_Auth_DropClient+0x521>",
+          "  407bb1: 48 89 df                     \tmovq\t%rbx, %rdi",
+          "  407bb4: 48 2b 3d f5 b2 40 00         \tsubq\t0x40b2f5(%rip), %rdi    # 0x812eb0 <svs+0x10>",
+          "  407bbb: be c4 de 4b 00               \tmovl\t$0x4bdec4, %esi         # imm = 0x4BDEC4",
+          "  407bc0: 48 c1 ff 06                  \tsarq\t$0x6, %rdi",
+          "  407bc4: 48 0f af fd                  \timulq\t%rbp, %rdi",
+          "  407bc8: e8 1f 66 00 00               \tcallq\t0x40e1ec <SV_SetUserinfo>",
+          "  407bcd: 48 8d b3 48 0c 02 00         \tleaq\t0x20c48(%rbx), %rsi",
+          "  407bd4: bf c2 e9 4a 00               \tmovl\t$0x4ae9c2, %edi         # imm = 0x4AE9C2",
+          "  407bd9: 31 c0                        \txorl\t%eax, %eax",
+          "  407bdb: e8 cc 60 02 00               \tcallq\t0x42dcac <Com_DPrintf>",
+          "  407be0: c7 03 01 00 00 00            \tmovl\t$0x1, (%rbx)",
+          "  407be6: 48 8b 1d 6b b2 40 00         \tmovq\t0x40b26b(%rip), %rbx    # 0x812e58 <sv_maxclients>",
+          "  407bed: 8b 7b 30                     \tmovl\t0x30(%rbx), %edi",
+          "  407bf0: 85 ff                        \ttestl\t%edi, %edi",
+          "  407bf2: 0f 8e 07 03 00 00            \tjle\t0x407eff <SV_Auth_DropClient+0x4eb>",
+          "  407bf8: 48 8b 05 b1 b2 40 00         \tmovq\t0x40b2b1(%rip), %rax    # 0x812eb0 <svs+0x10>",
+          "  407bff: 83 38 01                     \tcmpl\t$0x1, (%rax)",
+          "  407c02: 0f 87 f7 02 00 00            \tja\t0x407eff <SV_Auth_DropClient+0x4eb>",
+          "  407c08: 8d 6f ff                     \tleal\t-0x1(%rdi), %ebp",
+          "  407c0b: 31 f6                        \txorl\t%esi, %esi",
+          "  407c0d: 48 89 c2                     \tmovq\t%rax, %rdx",
+          "  407c10: 89 e9                        \tmovl\t%ebp, %ecx",
+          "  407c12: 83 e1 07                     \tandl\t$0x7, %ecx",
+          "  407c15: 0f 84 ee 00 00 00            \tje\t0x407d09 <SV_Auth_DropClient+0x2f5>",
+          "  407c1b: 44 8b 80 40 df 02 00         \tmovl\t0x2df40(%rax), %r8d",
+          "  407c22: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  407c25: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  407c2c: 41 83 f8 01                  \tcmpl\t$0x1, %r8d",
+          "  407c30: 0f 87 65 01 00 00            \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407c36: 83 f9 01                     \tcmpl\t$0x1, %ecx",
+          "  407c39: 0f 84 ca 00 00 00            \tje\t0x407d09 <SV_Auth_DropClient+0x2f5>",
+          "  407c3f: 83 f9 02                     \tcmpl\t$0x2, %ecx",
+          "  407c42: 0f 84 a6 00 00 00            \tje\t0x407cee <SV_Auth_DropClient+0x2da>",
+          "  407c48: 83 f9 03                     \tcmpl\t$0x3, %ecx",
+          "  407c4b: 0f 1f 44 00 00               \tnopl\t(%rax,%rax)",
+          "  407c50: 0f 84 7d 00 00 00            \tje\t0x407cd3 <SV_Auth_DropClient+0x2bf>",
+          "  407c56: 83 f9 04                     \tcmpl\t$0x4, %ecx",
+          "  407c59: 74 5d                        \tje\t0x407cb8 <SV_Auth_DropClient+0x2a4>",
+          "  407c5b: 83 f9 05                     \tcmpl\t$0x5, %ecx",
+          "  407c5e: 66 90                        \tnop",
+          "  407c60: 74 3b                        \tje\t0x407c9d <SV_Auth_DropClient+0x289>",
+          "  407c62: 83 f9 06                     \tcmpl\t$0x6, %ecx",
+          "  407c65: 74 1b                        \tje\t0x407c82 <SV_Auth_DropClient+0x26e>",
+          "  407c67: 44 8b 8a 40 df 02 00         \tmovl\t0x2df40(%rdx), %r9d",
+          "  407c6e: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  407c71: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  407c78: 41 83 f9 01                  \tcmpl\t$0x1, %r9d",
+          "  407c7c: 0f 87 19 01 00 00            \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407c82: 44 8b 92 40 df 02 00         \tmovl\t0x2df40(%rdx), %r10d",
+          "  407c89: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  407c8c: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  407c93: 41 83 fa 01                  \tcmpl\t$0x1, %r10d",
+          "  407c97: 0f 87 fe 00 00 00            \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407c9d: 44 8b 9a 40 df 02 00         \tmovl\t0x2df40(%rdx), %r11d",
+          "  407ca4: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  407ca7: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  407cae: 41 83 fb 01                  \tcmpl\t$0x1, %r11d",
+          "  407cb2: 0f 87 e3 00 00 00            \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407cb8: 44 8b a2 40 df 02 00         \tmovl\t0x2df40(%rdx), %r12d",
+          "  407cbf: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  407cc2: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  407cc9: 41 83 fc 01                  \tcmpl\t$0x1, %r12d",
+          "  407ccd: 0f 87 c8 00 00 00            \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407cd3: 44 8b aa 40 df 02 00         \tmovl\t0x2df40(%rdx), %r13d",
+          "  407cda: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  407cdd: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  407ce4: 41 83 fd 01                  \tcmpl\t$0x1, %r13d",
+          "  407ce8: 0f 87 ad 00 00 00            \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407cee: 44 8b b2 40 df 02 00         \tmovl\t0x2df40(%rdx), %r14d",
+          "  407cf5: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  407cf8: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  407cff: 41 83 fe 01                  \tcmpl\t$0x1, %r14d",
+          "  407d03: 0f 87 92 00 00 00            \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407d09: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  407d0c: 39 fe                        \tcmpl\t%edi, %esi",
+          "  407d0e: 0f 84 f3 01 00 00            \tje\t0x407f07 <SV_Auth_DropClient+0x4f3>",
+          "  407d14: 83 ba 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rdx)",
+          "  407d1b: 48 8d 82 40 df 02 00         \tleaq\t0x2df40(%rdx), %rax",
+          "  407d22: 77 77                        \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407d24: 83 b8 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rax)",
+          "  407d2b: 48 8d 90 40 df 02 00         \tleaq\t0x2df40(%rax), %rdx",
+          "  407d32: 77 67                        \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407d34: 83 ba 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rdx)",
+          "  407d3b: 48 8d 88 80 be 05 00         \tleaq\t0x5be80(%rax), %rcx",
+          "  407d42: 77 57                        \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407d44: 83 b9 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rcx)",
+          "  407d4b: 48 8d 90 c0 9d 08 00         \tleaq\t0x89dc0(%rax), %rdx",
+          "  407d52: 77 47                        \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407d54: 83 ba 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rdx)",
+          "  407d5b: 48 8d 88 00 7d 0b 00         \tleaq\t0xb7d00(%rax), %rcx",
+          "  407d62: 77 37                        \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407d64: 83 b9 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rcx)",
+          "  407d6b: 48 8d 90 40 5c 0e 00         \tleaq\t0xe5c40(%rax), %rdx",
+          "  407d72: 77 27                        \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407d74: 83 ba 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rdx)",
+          "  407d7b: 48 8d 88 80 3b 11 00         \tleaq\t0x113b80(%rax), %rcx",
+          "  407d82: 77 17                        \tja\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407d84: 83 c6 07                     \taddl\t$0x7, %esi",
+          "  407d87: 83 b9 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rcx)",
+          "  407d8e: 48 8d 90 c0 1a 14 00         \tleaq\t0x141ac0(%rax), %rdx",
+          "  407d95: 0f 86 6e ff ff ff            \tjbe\t0x407d09 <SV_Auth_DropClient+0x2f5>",
+          "  407d9b: 5b                           \tpopq\t%rbx",
+          "  407d9c: 5d                           \tpopq\t%rbp",
+          "  407d9d: 41 5c                        \tpopq\t%r12",
+          "  407d9f: 41 5d                        \tpopq\t%r13",
+          "  407da1: 41 5e                        \tpopq\t%r14",
+          "  407da3: c3                           \tretq",
+          "  407da4: 48 8b 15 21 b1 40 00         \tmovq\t0x40b121(%rip), %rdx    # 0x812ecc <svs+0x2c>",
+          "  407dab: 8b 0d 23 b1 40 00            \tmovl\t0x40b123(%rip), %ecx    # 0x812ed4 <svs+0x34>",
+          "  407db1: 41 bc cc 2e 81 00            \tmovl\t$0x812ecc, %r12d        # imm = 0x812ECC",
+          "  407db7: 48 8b bf e4 4e 02 00         \tmovq\t0x24ee4(%rdi), %rdi",
+          "  407dbe: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  407dc4: e8 47 ad 03 00               \tcallq\t0x442b10 <NET_CompareAdr>",
+          "  407dc9: 85 c0                        \ttestl\t%eax, %eax",
+          "  407dcb: 0f 85 43 01 00 00            \tjne\t0x407f14 <SV_Auth_DropClient+0x500>",
+          "  407dd1: 41 bc f4 2e 81 00            \tmovl\t$0x812ef4, %r12d        # imm = 0x812EF4",
+          "  407dd7: 49 8b 14 24                  \tmovq\t(%r12), %rdx",
+          "  407ddb: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  407de0: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  407de7: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  407ded: e8 1e ad 03 00               \tcallq\t0x442b10 <NET_CompareAdr>",
+          "  407df2: 85 c0                        \ttestl\t%eax, %eax",
+          "  407df4: 0f 85 1a 01 00 00            \tjne\t0x407f14 <SV_Auth_DropClient+0x500>",
+          "  407dfa: 49 81 fc a4 ce 81 00         \tcmpq\t$0x81cea4, %r12         # imm = 0x81CEA4",
+          "  407e01: 0f 84 35 fc ff ff            \tje\t0x407a3c <SV_Auth_DropClient+0x28>",
+          "  407e07: 49 8d 6c 24 28               \tleaq\t0x28(%r12), %rbp",
+          "  407e0c: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  407e13: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  407e19: 48 8b 55 00                  \tmovq\t(%rbp), %rdx",
+          "  407e1d: 8b 4d 08                     \tmovl\t0x8(%rbp), %ecx",
+          "  407e20: 49 89 ec                     \tmovq\t%rbp, %r12",
+          "  407e23: e8 e8 ac 03 00               \tcallq\t0x442b10 <NET_CompareAdr>",
+          "  407e28: 85 c0                        \ttestl\t%eax, %eax",
+          "  407e2a: 0f 85 e4 00 00 00            \tjne\t0x407f14 <SV_Auth_DropClient+0x500>",
+          "  407e30: 4c 8d 65 28                  \tleaq\t0x28(%rbp), %r12",
+          "  407e34: 48 8b 55 28                  \tmovq\t0x28(%rbp), %rdx",
+          "  407e38: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  407e3f: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  407e45: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  407e4a: e8 c1 ac 03 00               \tcallq\t0x442b10 <NET_CompareAdr>",
+          "  407e4f: 85 c0                        \ttestl\t%eax, %eax",
+          "  407e51: 0f 85 bd 00 00 00            \tjne\t0x407f14 <SV_Auth_DropClient+0x500>",
+          "  407e57: 4c 8d 65 50                  \tleaq\t0x50(%rbp), %r12",
+          "  407e5b: 48 8b 55 50                  \tmovq\t0x50(%rbp), %rdx",
+          "  407e5f: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  407e66: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  407e6c: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  407e71: e8 9a ac 03 00               \tcallq\t0x442b10 <NET_CompareAdr>",
+          "  407e76: 85 c0                        \ttestl\t%eax, %eax",
+          "  407e78: 0f 85 96 00 00 00            \tjne\t0x407f14 <SV_Auth_DropClient+0x500>",
+          "  407e7e: 4c 8d 65 78                  \tleaq\t0x78(%rbp), %r12",
+          "  407e82: 48 8b 55 78                  \tmovq\t0x78(%rbp), %rdx",
+          "  407e86: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  407e8d: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  407e93: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  407e98: e8 73 ac 03 00               \tcallq\t0x442b10 <NET_CompareAdr>",
+          "  407e9d: 85 c0                        \ttestl\t%eax, %eax",
+          "  407e9f: 75 73                        \tjne\t0x407f14 <SV_Auth_DropClient+0x500>",
+          "  407ea1: 4c 8d a5 a0 00 00 00         \tleaq\t0xa0(%rbp), %r12",
+          "  407ea8: 48 8b 95 a0 00 00 00         \tmovq\t0xa0(%rbp), %rdx",
+          "  407eaf: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  407eb6: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  407ebc: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  407ec1: e8 4a ac 03 00               \tcallq\t0x442b10 <NET_CompareAdr>",
+          "  407ec6: 85 c0                        \ttestl\t%eax, %eax",
+          "  407ec8: 75 4a                        \tjne\t0x407f14 <SV_Auth_DropClient+0x500>",
+          "  407eca: 4c 8d a5 c8 00 00 00         \tleaq\t0xc8(%rbp), %r12",
+          "  407ed1: 48 8b 95 c8 00 00 00         \tmovq\t0xc8(%rbp), %rdx",
+          "  407ed8: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  407edf: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  407ee5: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  407eea: e8 21 ac 03 00               \tcallq\t0x442b10 <NET_CompareAdr>",
+          "  407eef: 85 c0                        \ttestl\t%eax, %eax",
+          "  407ef1: 75 21                        \tjne\t0x407f14 <SV_Auth_DropClient+0x500>",
+          "  407ef3: 4c 8d a5 f0 00 00 00         \tleaq\t0xf0(%rbp), %r12",
+          "  407efa: e9 d8 fe ff ff               \tjmp\t0x407dd7 <SV_Auth_DropClient+0x3c3>",
+          "  407eff: 85 ff                        \ttestl\t%edi, %edi",
+          "  407f01: 0f 85 94 fe ff ff            \tjne\t0x407d9b <SV_Auth_DropClient+0x387>",
+          "  407f07: 5b                           \tpopq\t%rbx",
+          "  407f08: 5d                           \tpopq\t%rbp",
+          "  407f09: 41 5c                        \tpopq\t%r12",
+          "  407f0b: 41 5d                        \tpopq\t%r13",
+          "  407f0d: 41 5e                        \tpopq\t%r14",
+          "  407f0f: e9 ac 00 00 00               \tjmp\t0x407fc0 <SV_Heartbeat_f>",
+          "  407f14: 41 c7 44 24 24 00 00 00 00   \tmovl\t$0x0, 0x24(%r12)",
+          "  407f1d: 8b bb a8 0c 02 00            \tmovl\t0x20ca8(%rbx), %edi",
+          "  407f23: 85 ff                        \ttestl\t%edi, %edi",
+          "  407f25: 0f 84 1f fb ff ff            \tje\t0x407a4a <SV_Auth_DropClient+0x36>",
+          "  407f2b: e8 d6 b4 02 00               \tcallq\t0x433406 <FS_FCloseFile>",
+          "  407f30: e9 15 fb ff ff               \tjmp\t0x407a4a <SV_Auth_DropClient+0x36>",
+          "  407f35: 48 89 df                     \tmovq\t%rbx, %rdi",
+          "  407f38: 48 2b 3d 71 af 40 00         \tsubq\t0x40af71(%rip), %rdi    # 0x812eb0 <svs+0x10>",
+          "  407f3f: 48 c1 ff 06                  \tsarq\t$0x6, %rdi",
+          "  407f43: 48 0f af fd                  \timulq\t%rbp, %rdi",
+          "  407f47: e8 b6 af ff ff               \tcallq\t0x402f02 <SV_BotFreeClient>",
+          "  407f4c: e9 60 fc ff ff               \tjmp\t0x407bb1 <SV_Auth_DropClient+0x19d>",
+          "  407f51: 48 89 de                     \tmovq\t%rbx, %rsi",
+          "  407f54: 48 2b 35 55 af 40 00         \tsubq\t0x40af55(%rip), %rsi    # 0x812eb0 <svs+0x10>",
+          "  407f5b: 48 b9 d5 05 41 79 fb 43 2f 35\tmovabsq\t$0x352f43fb794105d5, %rcx # imm = 0x352F43FB794105D5",
+          "  407f65: bf a0 e9 4a 00               \tmovl\t$0x4ae9a0, %edi         # imm = 0x4AE9A0",
+          "  407f6a: 31 c0                        \txorl\t%eax, %eax",
+          "  407f6c: 48 c1 fe 06                  \tsarq\t$0x6, %rsi",
+          "  407f70: 48 0f af f1                  \timulq\t%rcx, %rsi",
+          "  407f74: e8 b7 19 04 00               \tcallq\t0x449930 <va>",
+          "  407f79: 31 ff                        \txorl\t%edi, %edi",
+          "  407f7b: 48 89 c6                     \tmovq\t%rax, %rsi",
+          "  407f7e: e8 a5 25 02 00               \tcallq\t0x42a528 <Cbuf_ExecuteText>",
+          "  407f83: e9 da fb ff ff               \tjmp\t0x407b62 <SV_Auth_DropClient+0x14e>",
+          "  407f88: e8 79 b4 02 00               \tcallq\t0x433406 <FS_FCloseFile>",
+          "  407f8d: c7 83 a8 0c 02 00 00 00 00 00\tmovl\t$0x0, 0x20ca8(%rbx)",
+          "  407f97: e9 b8 fb ff ff               \tjmp\t0x407b54 <SV_Auth_DropClient+0x140>",
+          "  407f9c: 4c 89 ea                     \tmovq\t%r13, %rdx",
+          "  407f9f: be 5f eb 4a 00               \tmovl\t$0x4aeb5f, %esi         # imm = 0x4AEB5F",
+          "  407fa4: 31 ff                        \txorl\t%edi, %edi",
+          "  407fa6: 31 c0                        \txorl\t%eax, %eax",
+          "  407fa8: e8 01 a3 00 00               \tcallq\t0x4122ae <SV_SendServerCommand>",
+          "  407fad: e9 94 fb ff ff               \tjmp\t0x407b46 <SV_Auth_DropClient+0x132>",
+          "  407fb2: 90                           \tnop",
+          "  407fb3: 90                           \tnop",
+          "  407fb4: 90                           \tnop",
+          "  407fb5: 90                           \tnop",
+          "  407fb6: 90                           \tnop",
+          "  407fb7: 90                           \tnop",
+          "  407fb8: 90                           \tnop",
+          "  407fb9: 90                           \tnop",
+          "  407fba: 90                           \tnop",
+          "  407fbb: 90                           \tnop",
+          "  407fbc: 90                           \tnop",
+          "  407fbd: 90                           \tnop",
+          "  407fbe: 90                           \tnop",
+          "  407fbf: 90                           \tnop"
+        ]
+      },
+      "invalid_index": {
+        "address": 4240410,
+        "common_return_address": 4239760,
+        "common_return_instructions": [
+          "40b190: 48 8b 9c 24 08 02 00 00      \tmovq\t0x208(%rsp), %rbx",
+          "40b198: 48 8b ac 24 10 02 00 00      \tmovq\t0x210(%rsp), %rbp",
+          "40b1a0: 4c 8b a4 24 18 02 00 00      \tmovq\t0x218(%rsp), %r12",
+          "40b1a8: 4c 8b ac 24 20 02 00 00      \tmovq\t0x220(%rsp), %r13",
+          "40b1b0: 4c 8b b4 24 28 02 00 00      \tmovq\t0x228(%rsp), %r14",
+          "40b1b8: 4c 8b bc 24 30 02 00 00      \tmovq\t0x230(%rsp), %r15",
+          "40b1c0: 48 81 c4 38 02 00 00         \taddq\t$0x238, %rsp            # imm = 0x238",
+          "40b1c7: c3                           \tretq"
+        ],
+        "instructions": [
+          "40b41a: 31 c0                        \txorl\t%eax, %eax",
+          "40b41c: e9 6f fd ff ff               \tjmp\t0x40b190 <SV_GameSystemCalls+0x54>"
+        ],
+        "result": 0
+      },
+      "literal_operand_candidates": [
+        {
+          "address": 4909490,
+          "file_offset": 715186,
+          "instruction": "407b91: be b2 e9 4a 00               \tmovl\t$0x4ae9b2, %esi         # imm = 0x4AE9B2",
+          "text": "disconnect \"%s\""
+        },
+        {
+          "address": 4909506,
+          "file_offset": 715202,
+          "instruction": "407bd4: bf c2 e9 4a 00               \tmovl\t$0x4ae9c2, %edi         # imm = 0x4AE9C2",
+          "text": "Going to CS_ZOMBIE for %s\n"
+        },
+        {
+          "address": 4909472,
+          "file_offset": 715168,
+          "instruction": "407f65: bf a0 e9 4a 00               \tmovl\t$0x4ae9a0, %edi         # imm = 0x4AE9A0",
+          "text": "stopserverdemo %d"
+        },
+        {
+          "address": 4909919,
+          "file_offset": 715615,
+          "instruction": "407f9f: be 5f eb 4a 00               \tmovl\t$0x4aeb5f, %esi         # imm = 0x4AEB5F",
+          "text": "print \"%s\n\""
+        }
+      ],
+      "source": {
+        "bytes": 961958,
+        "path": "Quake3-UrT-Ded.x86_64",
+        "sha256": "5dc5f5fbf0f106af6df82cd6ce65987bc6ddff18400f1cd0cb8ac1126ee357cb"
+      }
+    },
+    "linux--Quake3-UrT.x86_64": {
+      "case": {
+        "direct_call_or_jump_labels": [
+          "SV_Auth_DropClient",
+          "SV_GameSystemCalls",
+          "VM_ArgPtr"
+        ],
+        "first_instructions": [
+          "47546a: 48 8b 7f 18                  \tmovq\t0x18(%rdi), %rdi",
+          "47546e: e8 5d 6c 01 00               \tcallq\t0x48c0d0 <VM_ArgPtr>",
+          "475473: 48 8b 7d 10                  \tmovq\t0x10(%rbp), %rdi",
+          "475477: 48 89 c3                     \tmovq\t%rax, %rbx",
+          "47547a: e8 51 6c 01 00               \tcallq\t0x48c0d0 <VM_ArgPtr>",
+          "47547f: 8b 55 08                     \tmovl\t0x8(%rbp), %edx",
+          "475482: 85 d2                        \ttestl\t%edx, %edx",
+          "475484: 0f 88 00 df ff ff            \tjs\t0x47338a <SV_GameSystemCalls+0x2de>",
+          "47548a: 48 8b 35 a7 67 e3 00         \tmovq\t0xe367a7(%rip), %rsi    # 0x12abc38 <sv_maxclients>",
+          "475491: 3b 56 30                     \tcmpl\t0x30(%rsi), %edx",
+          "475494: 0f 8d f0 de ff ff            \tjge\t0x47338a <SV_GameSystemCalls+0x2de>",
+          "47549a: 48 63 ea                     \tmovslq\t%edx, %rbp",
+          "47549d: 48 89 c6                     \tmovq\t%rax, %rsi",
+          "4754a0: 48 89 da                     \tmovq\t%rbx, %rdx",
+          "4754a3: 48 69 fd 40 df 02 00         \timulq\t$0x2df40, %rbp, %rdi    # imm = 0x2DF40",
+          "4754aa: 48 03 3d df 67 e3 00         \taddq\t0xe367df(%rip), %rdi    # 0x12abc90 <svs+0x10>",
+          "4754b1: e8 ae ce ff ff               \tcallq\t0x472364 <SV_Auth_DropClient>",
+          "4754b6: 31 c0                        \txorl\t%eax, %eax",
+          "4754b8: e9 43 dc ff ff               \tjmp\t0x473100 <SV_GameSystemCalls+0x54>"
+        ],
+        "numbers_sharing_target": [
+          603
+        ],
+        "target_address": 4674666
+      },
+      "disassembly_sha256": "895d6c0bf954834261883cf62215bf67aa1ce7fe33642f34e1beeaee6f53032d",
+      "function": {
+        "address": 4662116,
+        "lines": [
+          "  472364: 41 56                        \tpushq\t%r14",
+          "  472366: 49 89 d6                     \tmovq\t%rdx, %r14",
+          "  472369: 41 55                        \tpushq\t%r13",
+          "  47236b: 49 89 f5                     \tmovq\t%rsi, %r13",
+          "  47236e: 41 54                        \tpushq\t%r12",
+          "  472370: 55                           \tpushq\t%rbp",
+          "  472371: 53                           \tpushq\t%rbx",
+          "  472372: 83 3f 01                     \tcmpl\t$0x1, (%rdi)",
+          "  472375: 48 89 fb                     \tmovq\t%rdi, %rbx",
+          "  472378: 0f 84 6d 03 00 00            \tje\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  47237e: 8b 87 e4 4e 02 00            \tmovl\t0x24ee4(%rdi), %eax",
+          "  472384: 85 c0                        \ttestl\t%eax, %eax",
+          "  472386: 0f 85 68 03 00 00            \tjne\t0x4726f4 <SV_Auth_DropClient+0x390>",
+          "  47238c: 8b bb a8 0c 02 00            \tmovl\t0x20ca8(%rbx), %edi",
+          "  472392: 85 ff                        \ttestl\t%edi, %edi",
+          "  472394: 0f 85 e1 04 00 00            \tjne\t0x47287b <SV_Auth_DropClient+0x517>",
+          "  47239a: 48 8b bb c0 0c 02 00         \tmovq\t0x20cc0(%rbx), %rdi",
+          "  4723a1: c7 83 a8 0c 02 00 00 00 00 00\tmovl\t$0x0, 0x20ca8(%rbx)",
+          "  4723ab: c6 83 68 0c 02 00 00         \tmovb\t$0x0, 0x20c68(%rbx)",
+          "  4723b2: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  4723b5: 74 10                        \tje\t0x4723c7 <SV_Auth_DropClient+0x63>",
+          "  4723b7: e8 ee ce fc ff               \tcallq\t0x43f2aa <Z_Free>",
+          "  4723bc: 48 c7 83 c0 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cc0(%rbx)",
+          "  4723c7: 48 8b bb c8 0c 02 00         \tmovq\t0x20cc8(%rbx), %rdi",
+          "  4723ce: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  4723d1: 74 10                        \tje\t0x4723e3 <SV_Auth_DropClient+0x7f>",
+          "  4723d3: e8 d2 ce fc ff               \tcallq\t0x43f2aa <Z_Free>",
+          "  4723d8: 48 c7 83 c8 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cc8(%rbx)",
+          "  4723e3: 48 8b bb d0 0c 02 00         \tmovq\t0x20cd0(%rbx), %rdi",
+          "  4723ea: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  4723ed: 74 10                        \tje\t0x4723ff <SV_Auth_DropClient+0x9b>",
+          "  4723ef: e8 b6 ce fc ff               \tcallq\t0x43f2aa <Z_Free>",
+          "  4723f4: 48 c7 83 d0 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cd0(%rbx)",
+          "  4723ff: 48 8b bb d8 0c 02 00         \tmovq\t0x20cd8(%rbx), %rdi",
+          "  472406: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  472409: 74 10                        \tje\t0x47241b <SV_Auth_DropClient+0xb7>",
+          "  47240b: e8 9a ce fc ff               \tcallq\t0x43f2aa <Z_Free>",
+          "  472410: 48 c7 83 d8 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cd8(%rbx)",
+          "  47241b: 48 8b bb e0 0c 02 00         \tmovq\t0x20ce0(%rbx), %rdi",
+          "  472422: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  472425: 74 10                        \tje\t0x472437 <SV_Auth_DropClient+0xd3>",
+          "  472427: e8 7e ce fc ff               \tcallq\t0x43f2aa <Z_Free>",
+          "  47242c: 48 c7 83 e0 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20ce0(%rbx)",
+          "  472437: 48 8b bb e8 0c 02 00         \tmovq\t0x20ce8(%rbx), %rdi",
+          "  47243e: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  472441: 74 10                        \tje\t0x472453 <SV_Auth_DropClient+0xef>",
+          "  472443: e8 62 ce fc ff               \tcallq\t0x43f2aa <Z_Free>",
+          "  472448: 48 c7 83 e8 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20ce8(%rbx)",
+          "  472453: 48 8b bb f0 0c 02 00         \tmovq\t0x20cf0(%rbx), %rdi",
+          "  47245a: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  47245d: 74 10                        \tje\t0x47246f <SV_Auth_DropClient+0x10b>",
+          "  47245f: e8 46 ce fc ff               \tcallq\t0x43f2aa <Z_Free>",
+          "  472464: 48 c7 83 f0 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cf0(%rbx)",
+          "  47246f: 48 8b bb f8 0c 02 00         \tmovq\t0x20cf8(%rbx), %rdi",
+          "  472476: 48 85 ff                     \ttestq\t%rdi, %rdi",
+          "  472479: 74 10                        \tje\t0x47248b <SV_Auth_DropClient+0x127>",
+          "  47247b: e8 2a ce fc ff               \tcallq\t0x43f2aa <Z_Free>",
+          "  472480: 48 c7 83 f8 0c 02 00 00 00 00 00     \tmovq\t$0x0, 0x20cf8(%rbx)",
+          "  47248b: 41 80 7d 00 00               \tcmpb\t$0x0, (%r13)",
+          "  472490: 0f 85 56 04 00 00            \tjne\t0x4728ec <SV_Auth_DropClient+0x588>",
+          "  472496: 8b bb a8 0c 02 00            \tmovl\t0x20ca8(%rbx), %edi",
+          "  47249c: 85 ff                        \ttestl\t%edi, %edi",
+          "  47249e: 0f 85 34 04 00 00            \tjne\t0x4728d8 <SV_Auth_DropClient+0x574>",
+          "  4724a4: 8b 93 20 cf 02 00            \tmovl\t0x2cf20(%rbx), %edx",
+          "  4724aa: 85 d2                        \ttestl\t%edx, %edx",
+          "  4724ac: 0f 85 ef 03 00 00            \tjne\t0x4728a1 <SV_Auth_DropClient+0x53d>",
+          "  4724b2: 48 89 da                     \tmovq\t%rbx, %rdx",
+          "  4724b5: 48 2b 15 d4 97 e3 00         \tsubq\t0xe397d4(%rip), %rdx    # 0x12abc90 <svs+0x10>",
+          "  4724bc: 48 bd d5 05 41 79 fb 43 2f 35\tmovabsq\t$0x352f43fb794105d5, %rbp # imm = 0x352F43FB794105D5",
+          "  4724c6: 48 8b 3d b3 0b 84 00         \tmovq\t0x840bb3(%rip), %rdi    # 0xcb3080 <gvm>",
+          "  4724cd: be 05 00 00 00               \tmovl\t$0x5, %esi",
+          "  4724d2: 31 c0                        \txorl\t%eax, %eax",
+          "  4724d4: 48 c1 fa 06                  \tsarq\t$0x6, %rdx",
+          "  4724d8: 48 0f af d5                  \timulq\t%rbp, %rdx",
+          "  4724dc: e8 0d a4 01 00               \tcallq\t0x48c8ee <VM_Call>",
+          "  4724e1: be 04 24 57 00               \tmovl\t$0x572404, %esi         # imm = 0x572404",
+          "  4724e6: 31 c0                        \txorl\t%eax, %eax",
+          "  4724e8: 4c 89 f2                     \tmovq\t%r14, %rdx",
+          "  4724eb: 48 89 df                     \tmovq\t%rbx, %rdi",
+          "  4724ee: e8 3b 7d 00 00               \tcallq\t0x47a22e <SV_SendServerCommand>",
+          "  4724f3: 8b b3 e4 4e 02 00            \tmovl\t0x24ee4(%rbx), %esi",
+          "  4724f9: 85 f6                        \ttestl\t%esi, %esi",
+          "  4724fb: 0f 84 84 03 00 00            \tje\t0x472885 <SV_Auth_DropClient+0x521>",
+          "  472501: 48 89 df                     \tmovq\t%rbx, %rdi",
+          "  472504: 48 2b 3d 85 97 e3 00         \tsubq\t0xe39785(%rip), %rdi    # 0x12abc90 <svs+0x10>",
+          "  47250b: be e5 22 58 00               \tmovl\t$0x5822e5, %esi         # imm = 0x5822E5",
+          "  472510: 48 c1 ff 06                  \tsarq\t$0x6, %rdi",
+          "  472514: 48 0f af fd                  \timulq\t%rbp, %rdi",
+          "  472518: e8 3f 3c 00 00               \tcallq\t0x47615c <SV_SetUserinfo>",
+          "  47251d: 48 8d b3 48 0c 02 00         \tleaq\t0x20c48(%rbx), %rsi",
+          "  472524: bf 14 24 57 00               \tmovl\t$0x572414, %edi         # imm = 0x572414",
+          "  472529: 31 c0                        \txorl\t%eax, %eax",
+          "  47252b: e8 76 c3 fc ff               \tcallq\t0x43e8a6 <Com_DPrintf>",
+          "  472530: c7 03 01 00 00 00            \tmovl\t$0x1, (%rbx)",
+          "  472536: 48 8b 1d fb 96 e3 00         \tmovq\t0xe396fb(%rip), %rbx    # 0x12abc38 <sv_maxclients>",
+          "  47253d: 8b 7b 30                     \tmovl\t0x30(%rbx), %edi",
+          "  472540: 85 ff                        \ttestl\t%edi, %edi",
+          "  472542: 0f 8e 07 03 00 00            \tjle\t0x47284f <SV_Auth_DropClient+0x4eb>",
+          "  472548: 48 8b 05 41 97 e3 00         \tmovq\t0xe39741(%rip), %rax    # 0x12abc90 <svs+0x10>",
+          "  47254f: 83 38 01                     \tcmpl\t$0x1, (%rax)",
+          "  472552: 0f 87 f7 02 00 00            \tja\t0x47284f <SV_Auth_DropClient+0x4eb>",
+          "  472558: 8d 6f ff                     \tleal\t-0x1(%rdi), %ebp",
+          "  47255b: 31 f6                        \txorl\t%esi, %esi",
+          "  47255d: 48 89 c2                     \tmovq\t%rax, %rdx",
+          "  472560: 89 e9                        \tmovl\t%ebp, %ecx",
+          "  472562: 83 e1 07                     \tandl\t$0x7, %ecx",
+          "  472565: 0f 84 ee 00 00 00            \tje\t0x472659 <SV_Auth_DropClient+0x2f5>",
+          "  47256b: 44 8b 80 40 df 02 00         \tmovl\t0x2df40(%rax), %r8d",
+          "  472572: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  472575: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  47257c: 41 83 f8 01                  \tcmpl\t$0x1, %r8d",
+          "  472580: 0f 87 65 01 00 00            \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  472586: 83 f9 01                     \tcmpl\t$0x1, %ecx",
+          "  472589: 0f 84 ca 00 00 00            \tje\t0x472659 <SV_Auth_DropClient+0x2f5>",
+          "  47258f: 83 f9 02                     \tcmpl\t$0x2, %ecx",
+          "  472592: 0f 84 a6 00 00 00            \tje\t0x47263e <SV_Auth_DropClient+0x2da>",
+          "  472598: 83 f9 03                     \tcmpl\t$0x3, %ecx",
+          "  47259b: 0f 1f 44 00 00               \tnopl\t(%rax,%rax)",
+          "  4725a0: 0f 84 7d 00 00 00            \tje\t0x472623 <SV_Auth_DropClient+0x2bf>",
+          "  4725a6: 83 f9 04                     \tcmpl\t$0x4, %ecx",
+          "  4725a9: 74 5d                        \tje\t0x472608 <SV_Auth_DropClient+0x2a4>",
+          "  4725ab: 83 f9 05                     \tcmpl\t$0x5, %ecx",
+          "  4725ae: 66 90                        \tnop",
+          "  4725b0: 74 3b                        \tje\t0x4725ed <SV_Auth_DropClient+0x289>",
+          "  4725b2: 83 f9 06                     \tcmpl\t$0x6, %ecx",
+          "  4725b5: 74 1b                        \tje\t0x4725d2 <SV_Auth_DropClient+0x26e>",
+          "  4725b7: 44 8b 8a 40 df 02 00         \tmovl\t0x2df40(%rdx), %r9d",
+          "  4725be: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  4725c1: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  4725c8: 41 83 f9 01                  \tcmpl\t$0x1, %r9d",
+          "  4725cc: 0f 87 19 01 00 00            \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  4725d2: 44 8b 92 40 df 02 00         \tmovl\t0x2df40(%rdx), %r10d",
+          "  4725d9: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  4725dc: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  4725e3: 41 83 fa 01                  \tcmpl\t$0x1, %r10d",
+          "  4725e7: 0f 87 fe 00 00 00            \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  4725ed: 44 8b 9a 40 df 02 00         \tmovl\t0x2df40(%rdx), %r11d",
+          "  4725f4: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  4725f7: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  4725fe: 41 83 fb 01                  \tcmpl\t$0x1, %r11d",
+          "  472602: 0f 87 e3 00 00 00            \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  472608: 44 8b a2 40 df 02 00         \tmovl\t0x2df40(%rdx), %r12d",
+          "  47260f: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  472612: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  472619: 41 83 fc 01                  \tcmpl\t$0x1, %r12d",
+          "  47261d: 0f 87 c8 00 00 00            \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  472623: 44 8b aa 40 df 02 00         \tmovl\t0x2df40(%rdx), %r13d",
+          "  47262a: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  47262d: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  472634: 41 83 fd 01                  \tcmpl\t$0x1, %r13d",
+          "  472638: 0f 87 ad 00 00 00            \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  47263e: 44 8b b2 40 df 02 00         \tmovl\t0x2df40(%rdx), %r14d",
+          "  472645: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  472648: 48 81 c2 40 df 02 00         \taddq\t$0x2df40, %rdx          # imm = 0x2DF40",
+          "  47264f: 41 83 fe 01                  \tcmpl\t$0x1, %r14d",
+          "  472653: 0f 87 92 00 00 00            \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  472659: 83 c6 01                     \taddl\t$0x1, %esi",
+          "  47265c: 39 fe                        \tcmpl\t%edi, %esi",
+          "  47265e: 0f 84 f3 01 00 00            \tje\t0x472857 <SV_Auth_DropClient+0x4f3>",
+          "  472664: 83 ba 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rdx)",
+          "  47266b: 48 8d 82 40 df 02 00         \tleaq\t0x2df40(%rdx), %rax",
+          "  472672: 77 77                        \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  472674: 83 b8 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rax)",
+          "  47267b: 48 8d 90 40 df 02 00         \tleaq\t0x2df40(%rax), %rdx",
+          "  472682: 77 67                        \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  472684: 83 ba 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rdx)",
+          "  47268b: 48 8d 88 80 be 05 00         \tleaq\t0x5be80(%rax), %rcx",
+          "  472692: 77 57                        \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  472694: 83 b9 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rcx)",
+          "  47269b: 48 8d 90 c0 9d 08 00         \tleaq\t0x89dc0(%rax), %rdx",
+          "  4726a2: 77 47                        \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  4726a4: 83 ba 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rdx)",
+          "  4726ab: 48 8d 88 00 7d 0b 00         \tleaq\t0xb7d00(%rax), %rcx",
+          "  4726b2: 77 37                        \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  4726b4: 83 b9 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rcx)",
+          "  4726bb: 48 8d 90 40 5c 0e 00         \tleaq\t0xe5c40(%rax), %rdx",
+          "  4726c2: 77 27                        \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  4726c4: 83 ba 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rdx)",
+          "  4726cb: 48 8d 88 80 3b 11 00         \tleaq\t0x113b80(%rax), %rcx",
+          "  4726d2: 77 17                        \tja\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  4726d4: 83 c6 07                     \taddl\t$0x7, %esi",
+          "  4726d7: 83 b9 40 df 02 00 01         \tcmpl\t$0x1, 0x2df40(%rcx)",
+          "  4726de: 48 8d 90 c0 1a 14 00         \tleaq\t0x141ac0(%rax), %rdx",
+          "  4726e5: 0f 86 6e ff ff ff            \tjbe\t0x472659 <SV_Auth_DropClient+0x2f5>",
+          "  4726eb: 5b                           \tpopq\t%rbx",
+          "  4726ec: 5d                           \tpopq\t%rbp",
+          "  4726ed: 41 5c                        \tpopq\t%r12",
+          "  4726ef: 41 5d                        \tpopq\t%r13",
+          "  4726f1: 41 5e                        \tpopq\t%r14",
+          "  4726f3: c3                           \tretq",
+          "  4726f4: 48 8b 15 b1 95 e3 00         \tmovq\t0xe395b1(%rip), %rdx    # 0x12abcac <svs+0x2c>",
+          "  4726fb: 8b 0d b3 95 e3 00            \tmovl\t0xe395b3(%rip), %ecx    # 0x12abcb4 <svs+0x34>",
+          "  472701: 41 bc ac bc 2a 01            \tmovl\t$0x12abcac, %r12d       # imm = 0x12ABCAC",
+          "  472707: 48 8b bf e4 4e 02 00         \tmovq\t0x24ee4(%rdi), %rdi",
+          "  47270e: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  472714: e8 b7 1d fe ff               \tcallq\t0x4544d0 <NET_CompareAdr>",
+          "  472719: 85 c0                        \ttestl\t%eax, %eax",
+          "  47271b: 0f 85 43 01 00 00            \tjne\t0x472864 <SV_Auth_DropClient+0x500>",
+          "  472721: 41 bc d4 bc 2a 01            \tmovl\t$0x12abcd4, %r12d       # imm = 0x12ABCD4",
+          "  472727: 49 8b 14 24                  \tmovq\t(%r12), %rdx",
+          "  47272b: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  472730: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  472737: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  47273d: e8 8e 1d fe ff               \tcallq\t0x4544d0 <NET_CompareAdr>",
+          "  472742: 85 c0                        \ttestl\t%eax, %eax",
+          "  472744: 0f 85 1a 01 00 00            \tjne\t0x472864 <SV_Auth_DropClient+0x500>",
+          "  47274a: 49 81 fc 84 5c 2b 01         \tcmpq\t$0x12b5c84, %r12        # imm = 0x12B5C84",
+          "  472751: 0f 84 35 fc ff ff            \tje\t0x47238c <SV_Auth_DropClient+0x28>",
+          "  472757: 49 8d 6c 24 28               \tleaq\t0x28(%r12), %rbp",
+          "  47275c: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  472763: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  472769: 48 8b 55 00                  \tmovq\t(%rbp), %rdx",
+          "  47276d: 8b 4d 08                     \tmovl\t0x8(%rbp), %ecx",
+          "  472770: 49 89 ec                     \tmovq\t%rbp, %r12",
+          "  472773: e8 58 1d fe ff               \tcallq\t0x4544d0 <NET_CompareAdr>",
+          "  472778: 85 c0                        \ttestl\t%eax, %eax",
+          "  47277a: 0f 85 e4 00 00 00            \tjne\t0x472864 <SV_Auth_DropClient+0x500>",
+          "  472780: 4c 8d 65 28                  \tleaq\t0x28(%rbp), %r12",
+          "  472784: 48 8b 55 28                  \tmovq\t0x28(%rbp), %rdx",
+          "  472788: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  47278f: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  472795: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  47279a: e8 31 1d fe ff               \tcallq\t0x4544d0 <NET_CompareAdr>",
+          "  47279f: 85 c0                        \ttestl\t%eax, %eax",
+          "  4727a1: 0f 85 bd 00 00 00            \tjne\t0x472864 <SV_Auth_DropClient+0x500>",
+          "  4727a7: 4c 8d 65 50                  \tleaq\t0x50(%rbp), %r12",
+          "  4727ab: 48 8b 55 50                  \tmovq\t0x50(%rbp), %rdx",
+          "  4727af: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  4727b6: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  4727bc: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  4727c1: e8 0a 1d fe ff               \tcallq\t0x4544d0 <NET_CompareAdr>",
+          "  4727c6: 85 c0                        \ttestl\t%eax, %eax",
+          "  4727c8: 0f 85 96 00 00 00            \tjne\t0x472864 <SV_Auth_DropClient+0x500>",
+          "  4727ce: 4c 8d 65 78                  \tleaq\t0x78(%rbp), %r12",
+          "  4727d2: 48 8b 55 78                  \tmovq\t0x78(%rbp), %rdx",
+          "  4727d6: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  4727dd: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  4727e3: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  4727e8: e8 e3 1c fe ff               \tcallq\t0x4544d0 <NET_CompareAdr>",
+          "  4727ed: 85 c0                        \ttestl\t%eax, %eax",
+          "  4727ef: 75 73                        \tjne\t0x472864 <SV_Auth_DropClient+0x500>",
+          "  4727f1: 4c 8d a5 a0 00 00 00         \tleaq\t0xa0(%rbp), %r12",
+          "  4727f8: 48 8b 95 a0 00 00 00         \tmovq\t0xa0(%rbp), %rdx",
+          "  4727ff: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  472806: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  47280c: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  472811: e8 ba 1c fe ff               \tcallq\t0x4544d0 <NET_CompareAdr>",
+          "  472816: 85 c0                        \ttestl\t%eax, %eax",
+          "  472818: 75 4a                        \tjne\t0x472864 <SV_Auth_DropClient+0x500>",
+          "  47281a: 4c 8d a5 c8 00 00 00         \tleaq\t0xc8(%rbp), %r12",
+          "  472821: 48 8b 95 c8 00 00 00         \tmovq\t0xc8(%rbp), %rdx",
+          "  472828: 48 8b bb e4 4e 02 00         \tmovq\t0x24ee4(%rbx), %rdi",
+          "  47282f: 8b b3 ec 4e 02 00            \tmovl\t0x24eec(%rbx), %esi",
+          "  472835: 41 8b 4c 24 08               \tmovl\t0x8(%r12), %ecx",
+          "  47283a: e8 91 1c fe ff               \tcallq\t0x4544d0 <NET_CompareAdr>",
+          "  47283f: 85 c0                        \ttestl\t%eax, %eax",
+          "  472841: 75 21                        \tjne\t0x472864 <SV_Auth_DropClient+0x500>",
+          "  472843: 4c 8d a5 f0 00 00 00         \tleaq\t0xf0(%rbp), %r12",
+          "  47284a: e9 d8 fe ff ff               \tjmp\t0x472727 <SV_Auth_DropClient+0x3c3>",
+          "  47284f: 85 ff                        \ttestl\t%edi, %edi",
+          "  472851: 0f 85 94 fe ff ff            \tjne\t0x4726eb <SV_Auth_DropClient+0x387>",
+          "  472857: 5b                           \tpopq\t%rbx",
+          "  472858: 5d                           \tpopq\t%rbp",
+          "  472859: 41 5c                        \tpopq\t%r12",
+          "  47285b: 41 5d                        \tpopq\t%r13",
+          "  47285d: 41 5e                        \tpopq\t%r14",
+          "  47285f: e9 0c 91 ff ff               \tjmp\t0x46b970 <SV_Heartbeat_f>",
+          "  472864: 41 c7 44 24 24 00 00 00 00   \tmovl\t$0x0, 0x24(%r12)",
+          "  47286d: 8b bb a8 0c 02 00            \tmovl\t0x20ca8(%rbx), %edi",
+          "  472873: 85 ff                        \ttestl\t%edi, %edi",
+          "  472875: 0f 84 1f fb ff ff            \tje\t0x47239a <SV_Auth_DropClient+0x36>",
+          "  47287b: e8 a6 16 fd ff               \tcallq\t0x443f26 <FS_FCloseFile>",
+          "  472880: e9 15 fb ff ff               \tjmp\t0x47239a <SV_Auth_DropClient+0x36>",
+          "  472885: 48 89 df                     \tmovq\t%rbx, %rdi",
+          "  472888: 48 2b 3d 01 94 e3 00         \tsubq\t0xe39401(%rip), %rdi    # 0x12abc90 <svs+0x10>",
+          "  47288f: 48 c1 ff 06                  \tsarq\t$0x6, %rdi",
+          "  472893: 48 0f af fd                  \timulq\t%rbp, %rdi",
+          "  472897: e8 d6 85 ff ff               \tcallq\t0x46ae72 <SV_BotFreeClient>",
+          "  47289c: e9 60 fc ff ff               \tjmp\t0x472501 <SV_Auth_DropClient+0x19d>",
+          "  4728a1: 48 89 de                     \tmovq\t%rbx, %rsi",
+          "  4728a4: 48 2b 35 e5 93 e3 00         \tsubq\t0xe393e5(%rip), %rsi    # 0x12abc90 <svs+0x10>",
+          "  4728ab: 48 b9 d5 05 41 79 fb 43 2f 35\tmovabsq\t$0x352f43fb794105d5, %rcx # imm = 0x352F43FB794105D5",
+          "  4728b5: bf f2 23 57 00               \tmovl\t$0x5723f2, %edi         # imm = 0x5723F2",
+          "  4728ba: 31 c0                        \txorl\t%eax, %eax",
+          "  4728bc: 48 c1 fe 06                  \tsarq\t$0x6, %rsi",
+          "  4728c0: 48 0f af f1                  \timulq\t%rcx, %rsi",
+          "  4728c4: e8 47 e4 00 00               \tcallq\t0x480d10 <va>",
+          "  4728c9: 31 ff                        \txorl\t%edi, %edi",
+          "  4728cb: 48 89 c6                     \tmovq\t%rax, %rsi",
+          "  4728ce: e8 f5 84 fc ff               \tcallq\t0x43adc8 <Cbuf_ExecuteText>",
+          "  4728d3: e9 da fb ff ff               \tjmp\t0x4724b2 <SV_Auth_DropClient+0x14e>",
+          "  4728d8: e8 49 16 fd ff               \tcallq\t0x443f26 <FS_FCloseFile>",
+          "  4728dd: c7 83 a8 0c 02 00 00 00 00 00\tmovl\t$0x0, 0x20ca8(%rbx)",
+          "  4728e7: e9 b8 fb ff ff               \tjmp\t0x4724a4 <SV_Auth_DropClient+0x140>",
+          "  4728ec: 4c 89 ea                     \tmovq\t%r13, %rdx",
+          "  4728ef: be 6e 25 57 00               \tmovl\t$0x57256e, %esi         # imm = 0x57256E",
+          "  4728f4: 31 ff                        \txorl\t%edi, %edi",
+          "  4728f6: 31 c0                        \txorl\t%eax, %eax",
+          "  4728f8: e8 31 79 00 00               \tcallq\t0x47a22e <SV_SendServerCommand>",
+          "  4728fd: e9 94 fb ff ff               \tjmp\t0x472496 <SV_Auth_DropClient+0x132>",
+          "  472902: 90                           \tnop",
+          "  472903: 90                           \tnop",
+          "  472904: 90                           \tnop",
+          "  472905: 90                           \tnop",
+          "  472906: 90                           \tnop",
+          "  472907: 90                           \tnop",
+          "  472908: 90                           \tnop",
+          "  472909: 90                           \tnop",
+          "  47290a: 90                           \tnop",
+          "  47290b: 90                           \tnop",
+          "  47290c: 90                           \tnop",
+          "  47290d: 90                           \tnop",
+          "  47290e: 90                           \tnop",
+          "  47290f: 90                           \tnop"
+        ]
+      },
+      "invalid_index": {
+        "address": 4666250,
+        "common_return_address": 4665600,
+        "common_return_instructions": [
+          "473100: 48 8b 9c 24 08 02 00 00      \tmovq\t0x208(%rsp), %rbx",
+          "473108: 48 8b ac 24 10 02 00 00      \tmovq\t0x210(%rsp), %rbp",
+          "473110: 4c 8b a4 24 18 02 00 00      \tmovq\t0x218(%rsp), %r12",
+          "473118: 4c 8b ac 24 20 02 00 00      \tmovq\t0x220(%rsp), %r13",
+          "473120: 4c 8b b4 24 28 02 00 00      \tmovq\t0x228(%rsp), %r14",
+          "473128: 4c 8b bc 24 30 02 00 00      \tmovq\t0x230(%rsp), %r15",
+          "473130: 48 81 c4 38 02 00 00         \taddq\t$0x238, %rsp            # imm = 0x238",
+          "473137: c3                           \tretq"
+        ],
+        "instructions": [
+          "47338a: 31 c0                        \txorl\t%eax, %eax",
+          "47338c: e9 6f fd ff ff               \tjmp\t0x473100 <SV_GameSystemCalls+0x54>"
+        ],
+        "result": 0
+      },
+      "literal_operand_candidates": [
+        {
+          "address": 5710852,
+          "file_offset": 1516548,
+          "instruction": "4724e1: be 04 24 57 00               \tmovl\t$0x572404, %esi         # imm = 0x572404",
+          "text": "disconnect \"%s\""
+        },
+        {
+          "address": 5710868,
+          "file_offset": 1516564,
+          "instruction": "472524: bf 14 24 57 00               \tmovl\t$0x572414, %edi         # imm = 0x572414",
+          "text": "Going to CS_ZOMBIE for %s\n"
+        },
+        {
+          "address": 5710834,
+          "file_offset": 1516530,
+          "instruction": "4728b5: bf f2 23 57 00               \tmovl\t$0x5723f2, %edi         # imm = 0x5723F2",
+          "text": "stopserverdemo %d"
+        },
+        {
+          "address": 5711214,
+          "file_offset": 1516910,
+          "instruction": "4728ef: be 6e 25 57 00               \tmovl\t$0x57256e, %esi         # imm = 0x57256E",
+          "text": "print \"%s\n\""
+        }
+      ],
+      "source": {
+        "bytes": 1940280,
+        "path": "Quake3-UrT.x86_64",
+        "sha256": "31a21e05251f4126b234dd5c4ce2612cd5332d502f35bab1dbde4cb288babd3a"
+      }
+    }
+  },
+  "qvm": {
+    "call_instruction": 165943,
+    "containing_entry": 165818,
+    "instructions": [
+      {
+        "code_offset": 490188,
+        "file_offset": 490220,
+        "index": 165818,
+        "opcode": "ENTER",
+        "operand": 32
+      },
+      {
+        "code_offset": 490193,
+        "file_offset": 490225,
+        "index": 165819,
+        "opcode": "LOCAL",
+        "operand": 24
+      },
+      {
+        "code_offset": 490198,
+        "file_offset": 490230,
+        "index": 165820,
+        "opcode": "LOCAL",
+        "operand": 40
+      },
+      {
+        "code_offset": 490203,
+        "file_offset": 490235,
+        "index": 165821,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490204,
+        "file_offset": 490236,
+        "index": 165822,
+        "opcode": "STORE4",
+        "operand": null
+      },
+      {
+        "code_offset": 490205,
+        "file_offset": 490237,
+        "index": 165823,
+        "opcode": "LOCAL",
+        "operand": 24
+      },
+      {
+        "code_offset": 490210,
+        "file_offset": 490242,
+        "index": 165824,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490211,
+        "file_offset": 490243,
+        "index": 165825,
+        "opcode": "CONST",
+        "operand": 0
+      },
+      {
+        "code_offset": 490216,
+        "file_offset": 490248,
+        "index": 165826,
+        "opcode": "LTI",
+        "operand": 165832
+      },
+      {
+        "code_offset": 490221,
+        "file_offset": 490253,
+        "index": 165827,
+        "opcode": "LOCAL",
+        "operand": 24
+      },
+      {
+        "code_offset": 490226,
+        "file_offset": 490258,
+        "index": 165828,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490227,
+        "file_offset": 490259,
+        "index": 165829,
+        "opcode": "CONST",
+        "operand": 34992524
+      },
+      {
+        "code_offset": 490232,
+        "file_offset": 490264,
+        "index": 165830,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490233,
+        "file_offset": 490265,
+        "index": 165831,
+        "opcode": "LTI",
+        "operand": 165842
+      },
+      {
+        "code_offset": 490238,
+        "file_offset": 490270,
+        "index": 165832,
+        "opcode": "CONST",
+        "operand": 68473
+      },
+      {
+        "code_offset": 490243,
+        "file_offset": 490275,
+        "index": 165833,
+        "opcode": "ARG",
+        "operand": 8
+      },
+      {
+        "code_offset": 490245,
+        "file_offset": 490277,
+        "index": 165834,
+        "opcode": "LOCAL",
+        "operand": 40
+      },
+      {
+        "code_offset": 490250,
+        "file_offset": 490282,
+        "index": 165835,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490251,
+        "file_offset": 490283,
+        "index": 165836,
+        "opcode": "ARG",
+        "operand": 12
+      },
+      {
+        "code_offset": 490253,
+        "file_offset": 490285,
+        "index": 165837,
+        "opcode": "CONST",
+        "operand": 5123
+      },
+      {
+        "code_offset": 490258,
+        "file_offset": 490290,
+        "index": 165838,
+        "opcode": "CALL",
+        "operand": null
+      },
+      {
+        "code_offset": 490259,
+        "file_offset": 490291,
+        "index": 165839,
+        "opcode": "POP",
+        "operand": null
+      },
+      {
+        "code_offset": 490260,
+        "file_offset": 490292,
+        "index": 165840,
+        "opcode": "CONST",
+        "operand": 165945
+      },
+      {
+        "code_offset": 490265,
+        "file_offset": 490297,
+        "index": 165841,
+        "opcode": "JUMP",
+        "operand": null
+      },
+      {
+        "code_offset": 490266,
+        "file_offset": 490298,
+        "index": 165842,
+        "opcode": "LOCAL",
+        "operand": 20
+      },
+      {
+        "code_offset": 490271,
+        "file_offset": 490303,
+        "index": 165843,
+        "opcode": "LOCAL",
+        "operand": 40
+      },
+      {
+        "code_offset": 490276,
+        "file_offset": 490308,
+        "index": 165844,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490277,
+        "file_offset": 490309,
+        "index": 165845,
+        "opcode": "CONST",
+        "operand": 6336
+      },
+      {
+        "code_offset": 490282,
+        "file_offset": 490314,
+        "index": 165846,
+        "opcode": "MULI",
+        "operand": null
+      },
+      {
+        "code_offset": 490283,
+        "file_offset": 490315,
+        "index": 165847,
+        "opcode": "CONST",
+        "operand": 34992496
+      },
+      {
+        "code_offset": 490288,
+        "file_offset": 490320,
+        "index": 165848,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490289,
+        "file_offset": 490321,
+        "index": 165849,
+        "opcode": "ADD",
+        "operand": null
+      },
+      {
+        "code_offset": 490290,
+        "file_offset": 490322,
+        "index": 165850,
+        "opcode": "STORE4",
+        "operand": null
+      },
+      {
+        "code_offset": 490291,
+        "file_offset": 490323,
+        "index": 165851,
+        "opcode": "LOCAL",
+        "operand": 20
+      },
+      {
+        "code_offset": 490296,
+        "file_offset": 490328,
+        "index": 165852,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490297,
+        "file_offset": 490329,
+        "index": 165853,
+        "opcode": "CONST",
+        "operand": 468
+      },
+      {
+        "code_offset": 490302,
+        "file_offset": 490334,
+        "index": 165854,
+        "opcode": "ADD",
+        "operand": null
+      },
+      {
+        "code_offset": 490303,
+        "file_offset": 490335,
+        "index": 165855,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490304,
+        "file_offset": 490336,
+        "index": 165856,
+        "opcode": "CONST",
+        "operand": 1
+      },
+      {
+        "code_offset": 490309,
+        "file_offset": 490341,
+        "index": 165857,
+        "opcode": "EQ",
+        "operand": 165875
+      },
+      {
+        "code_offset": 490314,
+        "file_offset": 490346,
+        "index": 165858,
+        "opcode": "LOCAL",
+        "operand": 20
+      },
+      {
+        "code_offset": 490319,
+        "file_offset": 490351,
+        "index": 165859,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490320,
+        "file_offset": 490352,
+        "index": 165860,
+        "opcode": "CONST",
+        "operand": 468
+      },
+      {
+        "code_offset": 490325,
+        "file_offset": 490357,
+        "index": 165861,
+        "opcode": "ADD",
+        "operand": null
+      },
+      {
+        "code_offset": 490326,
+        "file_offset": 490358,
+        "index": 165862,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490327,
+        "file_offset": 490359,
+        "index": 165863,
+        "opcode": "CONST",
+        "operand": 2
+      },
+      {
+        "code_offset": 490332,
+        "file_offset": 490364,
+        "index": 165864,
+        "opcode": "EQ",
+        "operand": 165875
+      },
+      {
+        "code_offset": 490337,
+        "file_offset": 490369,
+        "index": 165865,
+        "opcode": "CONST",
+        "operand": 68429
+      },
+      {
+        "code_offset": 490342,
+        "file_offset": 490374,
+        "index": 165866,
+        "opcode": "ARG",
+        "operand": 8
+      },
+      {
+        "code_offset": 490344,
+        "file_offset": 490376,
+        "index": 165867,
+        "opcode": "LOCAL",
+        "operand": 40
+      },
+      {
+        "code_offset": 490349,
+        "file_offset": 490381,
+        "index": 165868,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490350,
+        "file_offset": 490382,
+        "index": 165869,
+        "opcode": "ARG",
+        "operand": 12
+      },
+      {
+        "code_offset": 490352,
+        "file_offset": 490384,
+        "index": 165870,
+        "opcode": "CONST",
+        "operand": 5123
+      },
+      {
+        "code_offset": 490357,
+        "file_offset": 490389,
+        "index": 165871,
+        "opcode": "CALL",
+        "operand": null
+      },
+      {
+        "code_offset": 490358,
+        "file_offset": 490390,
+        "index": 165872,
+        "opcode": "POP",
+        "operand": null
+      },
+      {
+        "code_offset": 490359,
+        "file_offset": 490391,
+        "index": 165873,
+        "opcode": "CONST",
+        "operand": 165945
+      },
+      {
+        "code_offset": 490364,
+        "file_offset": 490396,
+        "index": 165874,
+        "opcode": "JUMP",
+        "operand": null
+      },
+      {
+        "code_offset": 490365,
+        "file_offset": 490397,
+        "index": 165875,
+        "opcode": "LOCAL",
+        "operand": 20
+      },
+      {
+        "code_offset": 490370,
+        "file_offset": 490402,
+        "index": 165876,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490371,
+        "file_offset": 490403,
+        "index": 165877,
+        "opcode": "CONST",
+        "operand": 468
+      },
+      {
+        "code_offset": 490376,
+        "file_offset": 490408,
+        "index": 165878,
+        "opcode": "ADD",
+        "operand": null
+      },
+      {
+        "code_offset": 490377,
+        "file_offset": 490409,
+        "index": 165879,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490378,
+        "file_offset": 490410,
+        "index": 165880,
+        "opcode": "CONST",
+        "operand": 1
+      },
+      {
+        "code_offset": 490383,
+        "file_offset": 490415,
+        "index": 165881,
+        "opcode": "NE",
+        "operand": 165916
+      },
+      {
+        "code_offset": 490388,
+        "file_offset": 490420,
+        "index": 165882,
+        "opcode": "LOCAL",
+        "operand": 20
+      },
+      {
+        "code_offset": 490393,
+        "file_offset": 490425,
+        "index": 165883,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490394,
+        "file_offset": 490426,
+        "index": 165884,
+        "opcode": "CONST",
+        "operand": 3204
+      },
+      {
+        "code_offset": 490399,
+        "file_offset": 490431,
+        "index": 165885,
+        "opcode": "ADD",
+        "operand": null
+      },
+      {
+        "code_offset": 490400,
+        "file_offset": 490432,
+        "index": 165886,
+        "opcode": "ARG",
+        "operand": 8
+      },
+      {
+        "code_offset": 490402,
+        "file_offset": 490434,
+        "index": 165887,
+        "opcode": "LOCAL",
+        "operand": 44
+      },
+      {
+        "code_offset": 490407,
+        "file_offset": 490439,
+        "index": 165888,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490408,
+        "file_offset": 490440,
+        "index": 165889,
+        "opcode": "ARG",
+        "operand": 12
+      },
+      {
+        "code_offset": 490410,
+        "file_offset": 490442,
+        "index": 165890,
+        "opcode": "CONST",
+        "operand": 128
+      },
+      {
+        "code_offset": 490415,
+        "file_offset": 490447,
+        "index": 165891,
+        "opcode": "ARG",
+        "operand": 16
+      },
+      {
+        "code_offset": 490417,
+        "file_offset": 490449,
+        "index": 165892,
+        "opcode": "CONST",
+        "operand": 69338
+      },
+      {
+        "code_offset": 490422,
+        "file_offset": 490454,
+        "index": 165893,
+        "opcode": "CALL",
+        "operand": null
+      },
+      {
+        "code_offset": 490423,
+        "file_offset": 490455,
+        "index": 165894,
+        "opcode": "POP",
+        "operand": null
+      },
+      {
+        "code_offset": 490424,
+        "file_offset": 490456,
+        "index": 165895,
+        "opcode": "LOCAL",
+        "operand": 20
+      },
+      {
+        "code_offset": 490429,
+        "file_offset": 490461,
+        "index": 165896,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490430,
+        "file_offset": 490462,
+        "index": 165897,
+        "opcode": "CONST",
+        "operand": 3332
+      },
+      {
+        "code_offset": 490435,
+        "file_offset": 490467,
+        "index": 165898,
+        "opcode": "ADD",
+        "operand": null
+      },
+      {
+        "code_offset": 490436,
+        "file_offset": 490468,
+        "index": 165899,
+        "opcode": "ARG",
+        "operand": 8
+      },
+      {
+        "code_offset": 490438,
+        "file_offset": 490470,
+        "index": 165900,
+        "opcode": "LOCAL",
+        "operand": 48
+      },
+      {
+        "code_offset": 490443,
+        "file_offset": 490475,
+        "index": 165901,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490444,
+        "file_offset": 490476,
+        "index": 165902,
+        "opcode": "ARG",
+        "operand": 12
+      },
+      {
+        "code_offset": 490446,
+        "file_offset": 490478,
+        "index": 165903,
+        "opcode": "CONST",
+        "operand": 256
+      },
+      {
+        "code_offset": 490451,
+        "file_offset": 490483,
+        "index": 165904,
+        "opcode": "ARG",
+        "operand": 16
+      },
+      {
+        "code_offset": 490453,
+        "file_offset": 490485,
+        "index": 165905,
+        "opcode": "CONST",
+        "operand": 69338
+      },
+      {
+        "code_offset": 490458,
+        "file_offset": 490490,
+        "index": 165906,
+        "opcode": "CALL",
+        "operand": null
+      },
+      {
+        "code_offset": 490459,
+        "file_offset": 490491,
+        "index": 165907,
+        "opcode": "POP",
+        "operand": null
+      },
+      {
+        "code_offset": 490460,
+        "file_offset": 490492,
+        "index": 165908,
+        "opcode": "LOCAL",
+        "operand": 20
+      },
+      {
+        "code_offset": 490465,
+        "file_offset": 490497,
+        "index": 165909,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490466,
+        "file_offset": 490498,
+        "index": 165910,
+        "opcode": "CONST",
+        "operand": 3588
+      },
+      {
+        "code_offset": 490471,
+        "file_offset": 490503,
+        "index": 165911,
+        "opcode": "ADD",
+        "operand": null
+      },
+      {
+        "code_offset": 490472,
+        "file_offset": 490504,
+        "index": 165912,
+        "opcode": "CONST",
+        "operand": 1
+      },
+      {
+        "code_offset": 490477,
+        "file_offset": 490509,
+        "index": 165913,
+        "opcode": "STORE4",
+        "operand": null
+      },
+      {
+        "code_offset": 490478,
+        "file_offset": 490510,
+        "index": 165914,
+        "opcode": "CONST",
+        "operand": 165945
+      },
+      {
+        "code_offset": 490483,
+        "file_offset": 490515,
+        "index": 165915,
+        "opcode": "JUMP",
+        "operand": null
+      },
+      {
+        "code_offset": 490484,
+        "file_offset": 490516,
+        "index": 165916,
+        "opcode": "CONST",
+        "operand": 68407
+      },
+      {
+        "code_offset": 490489,
+        "file_offset": 490521,
+        "index": 165917,
+        "opcode": "ARG",
+        "operand": 8
+      },
+      {
+        "code_offset": 490491,
+        "file_offset": 490523,
+        "index": 165918,
+        "opcode": "LOCAL",
+        "operand": 40
+      },
+      {
+        "code_offset": 490496,
+        "file_offset": 490528,
+        "index": 165919,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490497,
+        "file_offset": 490529,
+        "index": 165920,
+        "opcode": "ARG",
+        "operand": 12
+      },
+      {
+        "code_offset": 490499,
+        "file_offset": 490531,
+        "index": 165921,
+        "opcode": "LOCAL",
+        "operand": 44
+      },
+      {
+        "code_offset": 490504,
+        "file_offset": 490536,
+        "index": 165922,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490505,
+        "file_offset": 490537,
+        "index": 165923,
+        "opcode": "ARG",
+        "operand": 16
+      },
+      {
+        "code_offset": 490507,
+        "file_offset": 490539,
+        "index": 165924,
+        "opcode": "CONST",
+        "operand": 7259
+      },
+      {
+        "code_offset": 490512,
+        "file_offset": 490544,
+        "index": 165925,
+        "opcode": "CALL",
+        "operand": null
+      },
+      {
+        "code_offset": 490513,
+        "file_offset": 490545,
+        "index": 165926,
+        "opcode": "POP",
+        "operand": null
+      },
+      {
+        "code_offset": 490514,
+        "file_offset": 490546,
+        "index": 165927,
+        "opcode": "LOCAL",
+        "operand": 20
+      },
+      {
+        "code_offset": 490519,
+        "file_offset": 490551,
+        "index": 165928,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490520,
+        "file_offset": 490552,
+        "index": 165929,
+        "opcode": "CONST",
+        "operand": 3588
+      },
+      {
+        "code_offset": 490525,
+        "file_offset": 490557,
+        "index": 165930,
+        "opcode": "ADD",
+        "operand": null
+      },
+      {
+        "code_offset": 490526,
+        "file_offset": 490558,
+        "index": 165931,
+        "opcode": "CONST",
+        "operand": 0
+      },
+      {
+        "code_offset": 490531,
+        "file_offset": 490563,
+        "index": 165932,
+        "opcode": "STORE4",
+        "operand": null
+      },
+      {
+        "code_offset": 490532,
+        "file_offset": 490564,
+        "index": 165933,
+        "opcode": "LOCAL",
+        "operand": 40
+      },
+      {
+        "code_offset": 490537,
+        "file_offset": 490569,
+        "index": 165934,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490538,
+        "file_offset": 490570,
+        "index": 165935,
+        "opcode": "ARG",
+        "operand": 8
+      },
+      {
+        "code_offset": 490540,
+        "file_offset": 490572,
+        "index": 165936,
+        "opcode": "LOCAL",
+        "operand": 44
+      },
+      {
+        "code_offset": 490545,
+        "file_offset": 490577,
+        "index": 165937,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490546,
+        "file_offset": 490578,
+        "index": 165938,
+        "opcode": "ARG",
+        "operand": 12
+      },
+      {
+        "code_offset": 490548,
+        "file_offset": 490580,
+        "index": 165939,
+        "opcode": "LOCAL",
+        "operand": 48
+      },
+      {
+        "code_offset": 490553,
+        "file_offset": 490585,
+        "index": 165940,
+        "opcode": "LOAD4",
+        "operand": null
+      },
+      {
+        "code_offset": 490554,
+        "file_offset": 490586,
+        "index": 165941,
+        "opcode": "ARG",
+        "operand": 16
+      },
+      {
+        "code_offset": 490556,
+        "file_offset": 490588,
+        "index": 165942,
+        "opcode": "CONST",
+        "operand": -604
+      },
+      {
+        "code_offset": 490561,
+        "file_offset": 490593,
+        "index": 165943,
+        "opcode": "CALL",
+        "operand": null
+      },
+      {
+        "code_offset": 490562,
+        "file_offset": 490594,
+        "index": 165944,
+        "opcode": "POP",
+        "operand": null
+      },
+      {
+        "code_offset": 490563,
+        "file_offset": 490595,
+        "index": 165945,
+        "opcode": "PUSH",
+        "operand": null
+      },
+      {
+        "code_offset": 490564,
+        "file_offset": 490596,
+        "index": 165946,
+        "opcode": "LEAVE",
+        "operand": 32
+      }
+    ],
+    "literal_operand_candidates": [
+      {
+        "instruction": 165832,
+        "text": "auth: drop error - bad client slot: %i\n",
+        "vm_address": 68473
+      },
+      {
+        "instruction": 165865,
+        "text": "auth: drop error - client %i is not active\n",
+        "vm_address": 68429
+      },
+      {
+        "instruction": 165916,
+        "text": "AccountKick: %i - %s\n",
+        "vm_address": 68407
+      }
+    ],
+    "sha256": "a589351dfe517470a1b121dd2164714987d9e4577bf00c6486e1540035d7a79d",
+    "source": {
+      "archive": "zUrT43_qvm.pk3",
+      "archive_sha256": "b59bf0c5bedf11d50e0edd220da7eade96de40601e98ae14c54c819047df0796",
+      "member": {
+        "bytes": 983300,
+        "comment_hex": "",
+        "compressed_bytes": 246560,
+        "compression": 8,
+        "crc32": "98ea1768",
+        "create_system": 0,
+        "create_version": 63,
+        "date_time": [
+          2018,
+          6,
+          18,
+          22,
+          11,
+          50
+        ],
+        "directory": false,
+        "entry_index": 2,
+        "external_attr": 32,
+        "extra_hex": "0a0020000000000001001800d1e24e974007d40116dcbf962f1fd20116dcbf962f1fd201",
+        "extract_version": 20,
+        "flags": 0,
+        "header_offset": 221309,
+        "internal_attr": 0,
+        "occurrence": 0,
+        "output": "assets/extracted/zUrT43_qvm.pk3/members/000002/vm/qagame.qvm",
+        "path": "vm/qagame.qvm",
+        "sha256": "a589351dfe517470a1b121dd2164714987d9e4577bf00c6486e1540035d7a79d",
+        "type": "member",
+        "volume": 0
+      }
+    }
+  }
+}

docs/research/native/COVERAGE.md

@@ -0,0 +1,21 @@
+# SDL text and Windows resource byte reconciliation
+
+Static pass, 2026-10-11. Reproduce with `python3 scripts/analyze_native_coverage.py`; validate with `python3 scripts/test_native_followup.py`. [Summary](coverage-summary.json), [SDL byte partition](macos--libSDL-1.2.0.dylib.coverage.json) and [Windows byte partition](windows--Quake3-UrT.exe.coverage.json) include source hashes and a hash for each segment. These reports cover two bounded regions, not entire binary files or behavior.
+
+## COV-001: SDL text outside debug-map functions
+
+The 327,635-byte SDL `__text` section partitions into 327,111 bytes of paired STABS function ranges and **70 gaps totaling 524 bytes**. Every gap consists entirely of the x86 single-byte NOP opcode `0x90`; each gap's original bytes and SHA-256 are recorded. There are no unclassified bytes in this section's structural partition.
+
+These runs are consistent with alignment padding. The classifier records the byte pattern without claiming intent or proving that no control-flow path executes them. This resolves the earlier unknown content of the 524 bytes; it does not finish per-function behavior analysis, source equivalence or the rest of the Mach-O image.
+
+## COV-002: Windows resource-region accounting
+
+The client PE resource directory occupies **353,788 bytes**. Exact accounting is **353,268 payload bytes plus 520 directory/entry/data-descriptor bytes**. There are no unreferenced gaps in this region. The structural parser now optionally records byte ranges for directory headers/entries, UTF-16 names, data descriptors and leaf payloads; overlapping references count once in the partition.
+
+The observed tree needs no named-string ranges. Each type/name/language variant remains a distinct resource leaf, even if future inputs share storage. This corrects the earlier possibility that the 520-byte difference included padding or unclassified data: all 520 bytes are now explained by resource-tree structures. It does not interpret the surplus bytes *inside* four icon payloads; those remain RE-217.
+
+## Method and limits
+
+The interval partition rejects evidence outside the target region, splits at every range boundary, retains all covering labels, hashes each source segment and accounts for every byte exactly once. Gaps retain their bytes and are classified only by explicit byte patterns. Tests include overlapping ranges, uncovered zero bytes, invalid boundaries and exact reconstruction of both supplied regions. Changes to the underlying snapshot require new source hashes and regenerated evidence.
+
+RE-218 is complete for its two named regions. Whole-file coverage reconciliation, SDL source matching, Windows icon alpha/mask interpretation and native loader metadata remain separate open tasks.

docs/research/native/METADATA.md

@@ -45,3 +45,5 @@ The payload lengths fit a larger mask/data extent, but its interpretation is not
 Seven tests cover relative offsets versus RVAs, named resources, cycles, unbacked payloads, malformed string tables, language/size mismatch, function closure interpretation, every recovered real function hash, nonoverlapping ranges and all reconstructed icon payloads. Reports and derived assets regenerate byte-for-byte.
 
 RE-214–216 complete this static metadata pass. RE-208 remains open for pinned SDL source comparison, implementation differences, absent-type reconstruction and helper behavior. RE-210 remains open for load/bind/relocation details and uncovered regions. Follow up icon surplus/mask rendering, the 524 SDL text bytes outside debug-map functions, and exact resource-region byte coverage before treating these formats as fully understood.
+
+Follow-up: [COV-001/002](COVERAGE.md) resolves the 524 SDL text bytes as NOP sequences and accounts for all 520 non-payload resource bytes as directory structures. Earlier gap questions above are now resolved for these bounded regions; icon surplus remains open.

docs/research/native/coverage-summary.json

@@ -0,0 +1,19 @@
+[
+  {
+    "classification_bytes": {
+      "referenced_structure": 327111,
+      "x86_single_byte_NOP_sequence": 524
+    },
+    "gap_count": 70,
+    "image": "macos--libSDL-1.2.0.dylib",
+    "region_bytes": 327635
+  },
+  {
+    "classification_bytes": {
+      "referenced_structure": 353788
+    },
+    "gap_count": 0,
+    "image": "windows--Quake3-UrT.exe",
+    "region_bytes": 353788
+  }
+]

docs/research/native/windows--Quake3-UrT.exe.coverage.json

@@ -0,0 +1,295 @@
+{
+  "classification_bytes": {
+    "referenced_structure": 353788
+  },
+  "leaf_count": 9,
+  "limitations": "Coverage is limited to the named SDL text section or PE resource-directory region. Byte-pattern gap classification does not prove runtime unreachability, alignment intent or payload semantics.",
+  "region_bytes": 353788,
+  "region_file_offset": 1971712,
+  "segments": [
+    {
+      "bytes": 40,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1971712,
+      "sha256": "7210c11a3bb63adaa5b229d6e64ec64b3678ce6508e84795c9596d9c3692f60a"
+    },
+    {
+      "bytes": 72,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1971752,
+      "sha256": "fb97e86de73d6d2a9316e25b755b3ee90ba4d79e346a31fd262287b832ea3744"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1971824,
+      "sha256": "952116c0b857d15a459c92accc41831b873536fa7d577b663e4330c87b84151b"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1971848,
+      "sha256": "3bdbe9008ecfab3ca3dec6b1ba1d5ea7a68ffde1a036cc140889c85823f27cb0"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1971872,
+      "sha256": "abbc8b90ae6003ba1e829b5e123b1595b8febfc00b4f751bc0e9eb908cab1b25"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1971896,
+      "sha256": "9a6bceccb0c8c0424c464c93c729f97a2b6e58c788796160a41782fb0a7b6f29"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1971920,
+      "sha256": "310c67121a66b7febcf34beda613247893e935ed6f289314ba4ff9256b2a3e51"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1971944,
+      "sha256": "939783d96aec0a334c97cfd0a3d099f8227fe42a55f14945fd182a0a1ccba68e"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1971968,
+      "sha256": "a9b16befc58931acfeef0e5313e8dafa6f3574104ce6126ee389b884f379e4c5"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1971992,
+      "sha256": "0c5af0f5926891d7fd787b6c1dacdb56c49bef028147f85d664725e27cca667a"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1972016,
+      "sha256": "bae666d29add6ce4253f161d4db3022cbba11a7758b61220b95b69add8de88f0"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1972040,
+      "sha256": "895cccfb0bd6c84a171c2d402fb53153f823f7df895cbe5b3ade34cc7afd9881"
+    },
+    {
+      "bytes": 24,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_directory_and_entries"
+      ],
+      "file_offset": 1972064,
+      "sha256": "ce23d45599882a41f5f43861ef1607af7fa1413469feeeed6ce69ed272eff4f2"
+    },
+    {
+      "bytes": 16,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_data_descriptor"
+      ],
+      "file_offset": 1972088,
+      "sha256": "4fb3c2d965adbb3a952f5eb7c2c65457f2cb38460a0d037a7c39b16f2e97e872"
+    },
+    {
+      "bytes": 16,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_data_descriptor"
+      ],
+      "file_offset": 1972104,
+      "sha256": "eb0ac973f24c2920723a6ec415673e69a0812cceb7add1caf2083eb05014feb7"
+    },
+    {
+      "bytes": 16,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_data_descriptor"
+      ],
+      "file_offset": 1972120,
+      "sha256": "5e03f638c5cd728827ae3f20f3b03111c1872022563dd42a599972d57f258ad5"
+    },
+    {
+      "bytes": 16,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_data_descriptor"
+      ],
+      "file_offset": 1972136,
+      "sha256": "b0c8826bda806dfd3f116fbf0511a8f931d09b4b7fc0e72c269fce129b3f7b20"
+    },
+    {
+      "bytes": 16,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_data_descriptor"
+      ],
+      "file_offset": 1972152,
+      "sha256": "3bcf6b99eed90db20bed49558d7dd88bc73f72fac01e9933908e5f935f5bc379"
+    },
+    {
+      "bytes": 16,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_data_descriptor"
+      ],
+      "file_offset": 1972168,
+      "sha256": "9323b25ddee9a7a3cafe26d757f26ff0fba01aa90cc996f683efe62e0e6b513c"
+    },
+    {
+      "bytes": 16,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_data_descriptor"
+      ],
+      "file_offset": 1972184,
+      "sha256": "6b48b75159f618796ad9c8e8f6c24b445b7fd35a9836b4e19c44db25f53a5063"
+    },
+    {
+      "bytes": 16,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_data_descriptor"
+      ],
+      "file_offset": 1972200,
+      "sha256": "8fe179601c1c018abbab9c4a61d3345ee21df58f1b206035bc8a70cebaaead22"
+    },
+    {
+      "bytes": 16,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_data_descriptor"
+      ],
+      "file_offset": 1972216,
+      "sha256": "de1e6a87e3bbfb6564a2ec0680e9c03e72faf0e16972bc517c9a043a20b5e2a5"
+    },
+    {
+      "bytes": 1384,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_payload"
+      ],
+      "file_offset": 1972232,
+      "sha256": "7e91bc2f2c1cae398aed49c77e076f72fb7df4d37acf6e10535b5c87579c472c"
+    },
+    {
+      "bytes": 1320,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_payload"
+      ],
+      "file_offset": 1973616,
+      "sha256": "d5697c5c2d3c4f6f9c3ecfd99c0137eea1098ff9941435974b2f9a62b4fa21e9"
+    },
+    {
+      "bytes": 2216,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_payload"
+      ],
+      "file_offset": 1974936,
+      "sha256": "5f182e38fd1044fb6cb701d0ffe4929546155f5a10c135a31e14f3b431227581"
+    },
+    {
+      "bytes": 5160,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_payload"
+      ],
+      "file_offset": 1977152,
+      "sha256": "7a766ebde718a8d82cade2d990b1025c6ee6e8b0e83361e7282c0dcb6e46899c"
+    },
+    {
+      "bytes": 3752,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_payload"
+      ],
+      "file_offset": 1982312,
+      "sha256": "561be52eacd9c73b5fb5141c636a8c3fc6090977476396fd7597c54472b195c9"
+    },
+    {
+      "bytes": 11560,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_payload"
+      ],
+      "file_offset": 1986064,
+      "sha256": "79e8a802daf7aa78838fc3e5d7837cffd4e09a7922264da9690bb28d0e286bb5"
+    },
+    {
+      "bytes": 327720,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_payload"
+      ],
+      "file_offset": 1997624,
+      "sha256": "8c3a46e5fdc315824a8100c11a5bbf479df8d56266a4efc078a7d2a111e7e92f"
+    },
+    {
+      "bytes": 52,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_payload"
+      ],
+      "file_offset": 2325344,
+      "sha256": "963f626117e91ab3f1f97e30ce012bb855bd564bbb3e8b745ee2a7424753c44c"
+    },
+    {
+      "bytes": 104,
+      "classification": "referenced_structure",
+      "evidence_kinds": [
+        "resource_payload"
+      ],
+      "file_offset": 2325396,
+      "sha256": "35f2a898666580776a08e4e56ff6db778dc8abcfa74b6729a03407e0938884ef"
+    }
+  ],
+  "source": {
+    "bytes": 2634689,
+    "path": "Quake3-UrT.exe",
+    "sha256": "94111a3091c7e70e534720585df58820f0481c0894ba7b29f4f7de09accbaf90"
+  }
+}

scripts/analyze_auth_drop.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Preserve the auth-drop call boundary and its native invalid-index continuation."""
+import gzip
+import json
+from pathlib import Path
+import re
+from analyze_native import parse, take
+from analyze_native_dispatch import recover
+from analyze_qvm import decode, write_json
+from analyze_vm_extensions import verified, native_functions
+
+
+def ascii_literal(data, offset, end):
+    if not 0 <= offset < end <= len(data):
+        return None
+    stop = data.find(b'\0', offset, end)
+    if stop < 0:
+        return None
+    payload = data[offset:stop]
+    if len(payload) < 4 or not all(32 <= c <= 126 or c in (9, 10, 13) for c in payload):
+        return None
+    return payload.decode('ascii')
+
+
+def invalid_continuation(case, lines):
+    # Restrict this recognizer to the actual signed-index guard pattern.
+    guards = [re.search(r'\t(js|jge)\s+0x([0-9a-f]+)', line) for line in case['first_instructions']]
+    guards = [g for g in guards if g]
+    if len(guards) != 2 or [g[1] for g in guards] != ['js', 'jge'] or guards[0][2] != guards[1][2]:
+        raise ValueError('unrecognized auth-drop index guards')
+    address = int(guards[0][2], 16)
+    indexes = {}
+    for i, line in enumerate(lines):
+        m = re.match(r'\s*([0-9a-f]+):', line)
+        if m:
+            indexes[int(m[1], 16)] = i
+    if address not in indexes:
+        raise ValueError('guard continuation is not disassembled')
+    index = indexes[address]
+    continuation = lines[index:index+2]
+    if len(continuation) != 2 or not re.search(r'\txorl\s+%eax, %eax', continuation[0]) or not re.search(r'\tjmp\s+0x', continuation[1]):
+        raise ValueError('invalid index does not match known zero-result continuation')
+    target = int(re.search(r'\tjmp\s+0x([0-9a-f]+)', continuation[1])[1], 16)
+    if target not in indexes:
+        raise ValueError('missing common return continuation')
+    start = indexes[target]
+    epilogue = []
+    for line in lines[start:start+20]:
+        epilogue.append(line.strip())
+        if re.search(r'\tretq?\s*$', line):
+            break
+        m = re.search(r'\t(\w+)\s*(.*)', line)
+        if not m or m[1] not in ('movq', 'addq', 'popq', 'nop', 'nopl', 'nopw') or '%eax' in m[2] or '%rax' in m[2]:
+            raise ValueError('common return could alter result or control flow')
+    else:
+        raise ValueError('common return not found within bound')
+    return {'address': address, 'instructions': [l.strip() for l in continuation],
+            'common_return_address': target, 'common_return_instructions': epilogue,
+            'result': 0}
+
+
+def main():
+    output = {'native': {}, 'limitations': 'Linux ELF64 static boundary evidence. Literal operands are candidates, '
+              'not whole-program dataflow. No runtime reference fixtures or all-platform contract.'}
+    for label in ('linux--Quake3-UrT-Ded.x86_64', 'linux--Quake3-UrT.x86_64'):
+        report = json.loads(Path(f'docs/research/native/{label}.json').read_text())
+        data = verified((Path('.cache/UrbanTerror43')/report['source']['path']).read_bytes(), report['source']['sha256'])
+        layout, _ = parse(data)
+        artifact = report['artifacts']['disassembly.txt']
+        text = verified(gzip.open(artifact['path'], 'rb').read(), artifact['uncompressed_sha256']).decode()
+        functions = native_functions(text)
+        dispatch = recover(data, text, 'SV_GameSystemCalls')
+        case = next(c for c in dispatch['cases'] if c['numbers_sharing_target'] == [603])
+        literals = []
+        function = functions['SV_Auth_DropClient']
+        for line in function['lines']:
+            for match in re.finditer(r'\$0x([0-9a-f]+)', line):
+                address = int(match[1], 16)
+                section = next((s for s in layout['sections'] if s['flags'] & 2 and not s['zero_fill'] and not s['executable'] and
+                                s['address'] <= address < s['address']+s['bytes']), None)
+                if section:
+                    offset = section['file_offset']+address-section['address']
+                    value = ascii_literal(data, offset, section['file_offset']+section['bytes'])
+                    if value:
+                        literals.append({'address': address, 'file_offset': offset, 'text': value,
+                                         'instruction': line.strip()})
+        output['native'][label] = {'source': report['source'], 'disassembly_sha256': artifact['uncompressed_sha256'],
+                                   'case': case, 'invalid_index': invalid_continuation(case, text.splitlines()),
+                                   'function': function, 'literal_operand_candidates': literals}
+    report = json.loads(Path('docs/research/qvm/qagame.json').read_text())
+    data = verified(Path(report['source']['member']['output']).read_bytes(), report['sha256'])
+    header, instructions = decode(data)
+    site = next(i for i in range(1, len(instructions)) if instructions[i]['opcode'] == 'CALL' and
+                instructions[i-1]['opcode'] == 'CONST' and instructions[i-1]['operand'] == -604)
+    start = next(i for i in range(site, -1, -1) if instructions[i]['opcode'] == 'ENTER')
+    end = next(i for i in range(site+1, len(instructions)) if instructions[i]['opcode'] == 'ENTER')
+    strings = []
+    for ins in instructions[start:end]:
+        if ins['opcode'] == 'CONST' and instructions[ins['index']+1]['opcode'] == 'ARG' and 0 <= ins['operand'] < header['data_length']+header['literal_length']:
+            offset = header['data_offset']+ins['operand']
+            value = ascii_literal(data, offset, header['data_offset']+header['data_length']+header['literal_length'])
+            if value:
+                strings.append({'instruction': ins['index'], 'vm_address': ins['operand'], 'text': value})
+    output['qvm'] = {'source': report['source'], 'sha256': report['sha256'], 'call_instruction': site,
+                     'containing_entry': start, 'instructions': instructions[start:end],
+                     'literal_operand_candidates': strings}
+    write_json(Path('docs/research/auth-drop.json'), output)
+    print('Recovered both auth-drop invalid-index zero-return paths and literal operands')
+
+
+if __name__ == '__main__':
+    main()

scripts/analyze_binaries.py

@@ -10,7 +10,7 @@ def main():
         raise SystemExit('Run from the repository root')
     for script in ('fetch_analysis_references.py', 'analyze_qvm.py', 'analyze_native.py',
                    'analyze_vm_abi.py', 'analyze_native_dispatch.py', 'analyze_vm_extensions.py',
-                   'analyze_native_metadata.py'):
+                   'analyze_native_metadata.py', 'analyze_native_coverage.py', 'analyze_auth_drop.py'):
         subprocess.run([sys.executable, str(Path('scripts')/script)], check=True)
 
 

scripts/analyze_native_coverage.py

@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+"""Reconcile bounded source byte ranges against structural analysis evidence."""
+import hashlib
+import json
+from pathlib import Path
+from analyze_native import parse, take
+from analyze_native_metadata import resource_leaves, rva_range
+from analyze_qvm import write_json
+from analyze_vm_extensions import verified
+
+
+def partition(data, offset, size, ranges, gap_classifier):
+    take(data, offset, size)
+    end = offset+size
+    points = {offset, end}
+    for r in ranges:
+        if r['bytes'] < 0 or not offset <= r['file_offset'] <= r['file_offset']+r['bytes'] <= end:
+            raise ValueError('evidence range outside coverage region')
+        points.update([r['file_offset'], r['file_offset']+r['bytes']])
+    points = sorted(points)
+    segments = []
+    for start, stop in zip(points, points[1:]):
+        if start == stop:
+            continue
+        labels = sorted({r['kind'] for r in ranges if r['file_offset'] <= start and stop <= r['file_offset']+r['bytes']})
+        payload = take(data, start, stop-start)
+        segments.append({'file_offset': start, 'bytes': stop-start, 'evidence_kinds': labels,
+                         'classification': 'referenced_structure' if labels else gap_classifier(payload),
+                         'sha256': hashlib.sha256(payload).hexdigest(),
+                         **({'hex': payload.hex()} if not labels else {})})
+    counts = {}
+    for s in segments:
+        counts[s['classification']] = counts.get(s['classification'], 0)+s['bytes']
+    return {'region_file_offset': offset, 'region_bytes': size, 'segments': segments, 'classification_bytes': counts}
+
+
+def main():
+    results = []
+    for label in ('macos--libSDL-1.2.0.dylib', 'windows--Quake3-UrT.exe'):
+        report = json.loads(Path(f'docs/research/native/{label}.json').read_text())
+        data = verified((Path('.cache/UrbanTerror43')/report['source']['path']).read_bytes(), report['source']['sha256'])
+        layout, _ = parse(data)
+        if layout['format'] == 'Mach-O':
+            from analyze_native_metadata import stab_records, decode_stabs
+            metadata = decode_stabs(data, layout, stab_records(data, layout))
+            section = next(s for s in layout['sections'] if s['name'] == '__text')
+            ranges = [{**f, 'kind': 'paired_STABS_function'} for f in metadata['functions']]
+            coverage = partition(data, section['file_offset'], section['bytes'], ranges,
+                                 lambda b: 'x86_single_byte_NOP_sequence' if b == b'\x90'*len(b) else 'unclassified')
+        else:
+            ranges = []
+            leaves = resource_leaves(data, layout, ranges)
+            directory = next(d for d in layout['data_directories'] if d['index'] == 2)
+            offset, _ = rva_range(data, layout, directory['rva_or_security_file_offset'], directory['bytes'])
+            coverage = partition(data, offset, directory['bytes'], ranges,
+                                 lambda b: 'zero_filled_gap' if not any(b) else 'unclassified')
+            coverage['leaf_count'] = len(leaves)
+        output = {'source': report['source'], **coverage, 'limitations':
+                  'Coverage is limited to the named SDL text section or PE resource-directory region. '
+                  'Byte-pattern gap classification does not prove runtime unreachability, alignment intent or payload semantics.'}
+        write_json(Path(f'docs/research/native/{label}.coverage.json'), output)
+        results.append({'image': label, 'region_bytes': coverage['region_bytes'],
+                        'classification_bytes': coverage['classification_bytes'],
+                        'gap_count': sum(not s['evidence_kinds'] for s in coverage['segments'])})
+    write_json(Path('docs/research/native/coverage-summary.json'), results)
+    print(json.dumps(results, indent=2))
+
+
+if __name__ == '__main__':
+    main()

scripts/analyze_native_metadata.py

@@ -94,14 +94,17 @@ def rva_range(data, layout, rva, size):
     return offset, take(data, offset, size)
 
 
-def resource_leaves(data, layout):
+def resource_leaves(data, layout, regions=None):
     if layout['format'] != 'PE':
         raise ValueError('resource reader expects PE')
     directory = next((d for d in layout['data_directories'] if d['index'] == 2), None)
     if not directory or not directory['bytes']:
         return []
     base = directory['rva_or_security_file_offset']
-    _, tree = rva_range(data, layout, base, directory['bytes'])
+    tree_file_offset, tree = rva_range(data, layout, base, directory['bytes'])
+    def record(offset, size, kind):
+        if regions is not None:
+            regions.append({'file_offset': tree_file_offset+offset, 'bytes': size, 'kind': kind})
     leaves = []
     nodes = 0
     def walk(offset, path, ancestors):
@@ -112,6 +115,7 @@ def resource_leaves(data, layout):
         header = unpack('<IIHHHH', tree, offset)
         named, ids = header[-2:]
         entries = take(tree, offset+16, (named+ids)*8)
+        record(offset, 16+(named+ids)*8, 'resource_directory_and_entries')
         for i in range(named+ids):
             name, target = unpack('<II', entries, i*8)
             if bool(name & 0x80000000) != (i < named):
@@ -120,6 +124,7 @@ def resource_leaves(data, layout):
                 at = name & 0x7fffffff
                 length = unpack('<H', tree, at)[0]
                 component = take(tree, at+2, length*2).decode('utf-16le')
+                record(at, 2+length*2, 'resource_name_utf16')
             else:
                 component = name
             current = path+[component]
@@ -127,9 +132,12 @@ def resource_leaves(data, layout):
                 walk(target & 0x7fffffff, current, ancestors | {offset})
             else:
                 rva, size, codepage, reserved = unpack('<4I', tree, target)
+                record(target, 16, 'resource_data_descriptor')
                 if reserved:
                     raise ValueError('nonzero resource data reserved field')
                 file_offset, payload = rva_range(data, layout, rva, size)
+                if regions is not None:
+                    regions.append({'file_offset': file_offset, 'bytes': size, 'kind': 'resource_payload'})
                 leaves.append({'path': current, 'data_entry_relative_offset': target,
                                'rva': rva, 'file_offset': file_offset, 'bytes': size, 'codepage': codepage,
                                'sha256': hashlib.sha256(payload).hexdigest()})

scripts/test_native_followup.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""Coverage accounting and auth-drop boundary recognition tests."""
+import hashlib
+import json
+from pathlib import Path
+import unittest
+from analyze_native_coverage import partition
+from analyze_auth_drop import invalid_continuation, ascii_literal
+
+
+class FollowupTests(unittest.TestCase):
+    def test_partition_overlap_is_counted_once(self):
+        r = partition(b'abcdef', 0, 6, [{'file_offset': 0, 'bytes': 4, 'kind': 'a'},
+                                      {'file_offset': 2, 'bytes': 4, 'kind': 'b'}], lambda b: 'unknown')
+        self.assertEqual(r['classification_bytes'], {'referenced_structure': 6})
+        self.assertEqual(r['segments'][1]['evidence_kinds'], ['a', 'b'])
+
+    def test_partition_gaps_and_invalid_ranges(self):
+        r = partition(b'a\0\0b', 0, 4, [{'file_offset': 0, 'bytes': 1, 'kind': 'a'},
+                                       {'file_offset': 3, 'bytes': 1, 'kind': 'b'}], lambda b: 'zero' if not any(b) else 'unknown')
+        self.assertEqual(r['classification_bytes'], {'referenced_structure': 2, 'zero': 2})
+        for offset, size in [(-1, 1), (3, 2), (2, -1)]:
+            with self.assertRaises(ValueError):
+                partition(b'abcd', 0, 4, [{'file_offset': offset, 'bytes': size, 'kind': 'bad'}], lambda b: 'unknown')
+
+    def continuation_fixture(self):
+        case = {'first_instructions': ['  10: aa\tjs\t0x20', '  11: aa\tjge\t0x20']}
+        lines = ['  20: 31 c0\txorl\t%eax, %eax', '  22: e9\tjmp\t0x30',
+                 '  30: aa\tmovq\t0x8(%rsp), %rbx', '  34: c3\tretq']
+        return case, lines
+
+    def test_zero_result_guard_and_epilogue(self):
+        case, lines = self.continuation_fixture()
+        self.assertEqual(invalid_continuation(case, lines)['result'], 0)
+
+    def test_guard_divergence_and_result_clobber_rejected(self):
+        case, lines = self.continuation_fixture()
+        case['first_instructions'][1] = '  11: aa\tjge\t0x21'
+        with self.assertRaises(ValueError):
+            invalid_continuation(case, lines)
+        case, lines = self.continuation_fixture()
+        lines[2] = '  30: aa\tmovq\t0x8(%rsp), %rax'
+        with self.assertRaises(ValueError):
+            invalid_continuation(case, lines)
+
+    def test_literal_is_bounded_and_allows_newlines(self):
+        self.assertEqual(ascii_literal(b'hello\n\0tail', 0, 7), 'hello\n')
+        self.assertIsNone(ascii_literal(b'hello\0', 0, 5))
+        self.assertIsNone(ascii_literal(b'hello\xff\0', 0, 7))
+
+    def test_shipped_regions_exactly_partition_source(self):
+        for label in ('macos--libSDL-1.2.0.dylib', 'windows--Quake3-UrT.exe'):
+            r = json.loads(Path(f'docs/research/native/{label}.coverage.json').read_text())
+            data = (Path('.cache/UrbanTerror43')/r['source']['path']).read_bytes()
+            self.assertEqual(hashlib.sha256(data).hexdigest(), r['source']['sha256'])
+            cursor = r['region_file_offset']
+            for s in r['segments']:
+                self.assertEqual(s['file_offset'], cursor)
+                payload = data[cursor:cursor+s['bytes']]
+                self.assertEqual(hashlib.sha256(payload).hexdigest(), s['sha256'])
+                if not s['evidence_kinds']:
+                    self.assertEqual(payload, b'\x90'*s['bytes'])
+                cursor += s['bytes']
+            self.assertEqual(cursor, r['region_file_offset']+r['region_bytes'])
+            self.assertEqual(sum(r['classification_bytes'].values()), r['region_bytes'])
+            self.assertNotIn('unclassified', r['classification_bytes'])
+
+    def test_shipped_auth_formats_and_zero_results(self):
+        r = json.loads(Path('docs/research/auth-drop.json').read_text())
+        for n in r['native'].values():
+            self.assertEqual(n['invalid_index']['result'], 0)
+            self.assertEqual({s['text'] for s in n['literal_operand_candidates']},
+                             {'disconnect "%s"', 'print "%s\n"', 'Going to CS_ZOMBIE for %s\n', 'stopserverdemo %d'})
+        self.assertEqual(r['qvm']['containing_entry'], 165818)
+        self.assertEqual(r['qvm']['call_instruction'], 165943)
+        self.assertEqual(len(r['qvm']['literal_operand_candidates']), 3)
+
+
+if __name__ == '__main__':
+    unittest.main()