fix: correct SpriteRegion params from hook data + pass gfx_resource

SpriteRegion params 4-8 were completely wrong (guessed from asm,
not verified). Hooked SpriteRegion__Constructor with naked fastcall
trampoline to capture actual params from original:
- Entries 4-8: ECX/EDX values were wrong (0x21→0x0C, etc.)
- p6 (6th stack param): was 0, should be GfxResource pointer

2/5 runs now pass. Crash moved to GfxDir__FindEntry in arrow loop —
likely a calling convention issue in the arrow sprite loading section.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/engine/ddgame.rs

@@ -818,16 +818,19 @@ unsafe fn init_graphics_and_resources(
     // ── 8× SpriteRegion at DDGame+0x46C..0x488 ──
     // SpriteRegion__Constructor: fastcall(ECX, EDX) + 6 stack(this, p2, p3, p4, p5, p6), RET 0x18
     {
-        // (ddgame_offset, ECX, EDX, stack2, stack3, stack4, stack5, stack6)
+        // Params verified by hooking original (see SpriteRegion param logger).
+        // (ddgame_offset, ECX, EDX, p2, p3, p4, p5, p6=gfx_resource)
+        // p6 is the GfxResource pointer returned by GfxResource__Create_Maybe.
+        let gr = gfx_resource as u32;
         let regions: [(u32, u32, u32, u32, u32, u32, u32, u32); 8] = [
-            (0x474, 0x37, 0x36, 0x2E, 0x24, 0x41, 0x2D, 0),
-            (0x46C, 0x30, 0x0C, 0x2D, 0x07, 0x34, 0x09, 0),
-            (0x470, 0x11, 0x1A, 0x0D, 0x0A, 0x16, 0x13, 0),
-            (0x478, 0x21, 0x01, 0x00, 0x20, 0x22, 0x01, 0),
-            (0x47C, 0x01, 0x01, 0x00, 0x00, 0x02, 0x01, 0),
-            (0x484, 0x0A, 0x01, 0x173, 0x09, 0x17C, 0x02, 0),
-            (0x488, 0x08, 0x01, 0x1E5, 0x07, 0x1EC, 0x02, 0),
-            (0x480, 0x08, 0x01, 0x2D, 0x07, 0x34, 0x02, 0),
+            (0x474, 0x37, 0x36, 0x2E, 0x24, 0x41, 0x2D, gr),
+            (0x46C, 0x30, 0x0C, 0x2D, 0x07, 0x34, 0x09, gr),
+            (0x470, 0x11, 0x1A, 0x0D, 0x0A, 0x16, 0x13, gr),
+            (0x478, 0x0C, 0x3D, 0x00, 0x20, 0x18, 0x33, gr),
+            (0x47C, 0x00, 0x01, 0x00, 0x00, 0x01, 0x00, gr),
+            (0x484, 0x1A2,0x1B, 0x173,0x09, 0x1D8,0x03, gr),
+            (0x488, 0x1EF,0x26, 0x1E5,0x07, 0x1F9,0x16, gr),
+            (0x480, 0x2D, 0x08, 0x2D, 0x07, 0x2E, 0x07, gr),
         ];
 
         for &(offset, ecx, edx, p2, p3, p4, p5, p6) in &regions {

crates/openwa-wormkit/src/replacements/game_session.rs

@@ -322,6 +322,51 @@ unsafe extern "stdcall" fn hook_pc_landscape_ctor(
     orig(p1, p2, p3, p4, p5, p6, p7, p8, p9, p10, p11)
 }
 
+// ── SpriteRegion__Constructor param logger ──────────────────────────
+static mut SPRITE_REGION_TRAMPOLINE: *const () = core::ptr::null();
+
+/// Log fastcall params. Called from naked trampoline with all params on stack.
+unsafe extern "cdecl" fn log_sprite_region(
+    ecx: u32, edx: u32, p1: u32, p2: u32, p3: u32, p4: u32, p5: u32, p6: u32,
+) {
+    let _ = log_line(&format!(
+        "[SpriteRgn] ECX=0x{:X} EDX=0x{:X} p1=0x{:X} p2=0x{:X} p3=0x{:X} p4=0x{:X} p5=0x{:X} p6=0x{:X}",
+        ecx, edx, p1, p2, p3, p4, p5, p6));
+}
+
+/// Naked trampoline: captures ECX/EDX, logs, then calls original fastcall.
+#[unsafe(naked)]
+unsafe extern "C" fn hook_sprite_region_ctor() {
+    core::arch::naked_asm!(
+        // Save all regs
+        "pushl %eax",
+        "pushl %ecx",
+        "pushl %edx",
+        // Push all 8 params for logger: ECX, EDX, then 6 stack params
+        // Stack after 3 pushes: [edx][ecx][eax][ret][p1][p2][p3][p4][p5][p6]
+        // p1 at ESP+16, p2 at ESP+20, ...
+        "pushl 36(%esp)",  // p6
+        "pushl 36(%esp)",  // p5
+        "pushl 36(%esp)",  // p4
+        "pushl 36(%esp)",  // p3
+        "pushl 36(%esp)",  // p2
+        "pushl 36(%esp)",  // p1
+        "pushl %edx",       // EDX
+        "pushl %ecx",       // ECX
+        "calll {logger}",
+        "addl $32, %esp",   // clean 8 cdecl params
+        // Restore regs
+        "popl %edx",
+        "popl %ecx",
+        "popl %eax",
+        // Jump to original (fastcall, same params on stack)
+        "jmpl *({tramp})",
+        logger = sym log_sprite_region,
+        tramp = sym SPRITE_REGION_TRAMPOLINE,
+        options(att_syntax),
+    );
+}
+
 pub fn install() -> Result<(), String> {
     unsafe {
         INIT_REPLAY_ADDR = rb(va::DDGAMEWRAPPER_INIT_REPLAY);
@@ -338,6 +383,14 @@ pub fn install() -> Result<(), String> {
             hook_pc_landscape_ctor as *const (),
         )?;
         PC_LANDSCAPE_TRAMPOLINE = tramp as *const ();
+
+        // Hook SpriteRegion__Constructor to log fastcall params
+        let tramp2 = hook::install(
+            "SpriteRegion__Constructor",
+            va::SPRITE_REGION_CONSTRUCTOR,
+            hook_sprite_region_ctor as *const (),
+        )?;
+        SPRITE_REGION_TRAMPOLINE = tramp2 as *const ();
     }
     Ok(())
 }