fix: correct HUD/sprite init addresses, fix display byte-read bug

Critical fixes:
- HUD_LoadWeaponSprites: was 0x524070 (wrong), now 0x53D0E0 (correct)
with stdcall(ddgame, wrapper_4c4), RET 0x8
- Two DisplayGfx init calls: were using DISPLAYGFX_CTOR (0x569C10),
now use 0x5706D0 and 0x5703E0 (stdcall(wrapper), RET 0x4)
- Fix display byte-read bug in sprite resource section (same pattern
as earlier: *(wrapper as u8).add(0x4D0) reads byte not pointer)
- Re-enable loading tick calls

Headful mode: game starts, 119 validations pass.
Headless mode: still crashes — under investigation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/openwa-core/src/engine/ddgame.rs

@@ -962,9 +962,8 @@ unsafe fn init_graphics_and_resources(
     }
 
     // ── Loading tick (FUN_005717A0 ×2): usercall(ECX=wrapper) ──
-    // This pumps the message loop — commented out to test if it causes crashes.
-    // call_usercall_ecx(wrapper, LOAD_WEAPON_SPRITES_ADDR);
-    // call_usercall_ecx(wrapper, LOAD_WEAPON_SPRITES_ADDR);
+    call_usercall_ecx(wrapper, LOAD_WEAPON_SPRITES_ADDR);
+    call_usercall_ecx(wrapper, LOAD_WEAPON_SPRITES_ADDR);
 
     // ── Sprite resource loading via DDGameWrapper vtable[0] ──
     // DDNetGameWrapper__LoadResourceList: thiscall(ECX=wrapper) +
@@ -1015,7 +1014,7 @@ unsafe fn init_graphics_and_resources(
         let _layer3_ctx = set_layer((*ddgame).display, 3);
 
         // Load back.spr and debris.spr (conditional)
-        let disp_obj = *(wrapper as *const u8).add(0x4D0) as *mut u8;
+        let disp_obj = (*wrapper).display as *mut u8;
         let disp_obj_vt = *(disp_obj as *const *const u32);
         // Check if gfx_mode high byte is set (original: uStack_123c._3_1_ != '\0')
         if (*wrapper).gfx_mode != 0 {
@@ -1077,19 +1076,24 @@ unsafe fn init_graphics_and_resources(
             }
         }
 
-        // ── HUD weapon sprites ──
+        // ── HUD_LoadWeaponSprites (0x53D0E0) ──
+        // stdcall(ddgame, wrapper_4c4), verified from asm: PUSH ECX([EBP+0x4C4]), PUSH EDX(ddgame)
         {
-            let hud_load: unsafe extern "stdcall" fn(u32, u32) =
-                core::mem::transmute(rb(0x524070) as usize); // HUD_LoadWeaponSprites_Maybe address — verify
-            hud_load(ddgame as u32, (*wrapper)._field_4c4 as u32);
+            let hud_load: unsafe extern "stdcall" fn(*mut DDGame, *mut u8) =
+                core::mem::transmute(rb(0x53D0E0) as usize);
+            hud_load(ddgame, (*wrapper)._field_4c4);
         }
 
-        // ── Two DisplayGfx__Constructor_Maybe calls ──
+        // ── Two sprite init calls ──
+        // PUSH EBP(wrapper); CALL 0x5706D0 — stdcall(wrapper)
+        // PUSH EBP(wrapper); CALL 0x5703E0 — stdcall(wrapper)
         {
-            let display_gfx_ctor: unsafe extern "thiscall" fn(*mut DDGameWrapper) =
-                core::mem::transmute(rb(va::DISPLAYGFX_CTOR) as usize);
-            display_gfx_ctor(wrapper);
-            display_gfx_ctor(wrapper);
+            let f1: unsafe extern "stdcall" fn(*mut DDGameWrapper) =
+                core::mem::transmute(rb(0x5706D0) as usize);
+            f1(wrapper);
+            let f2: unsafe extern "stdcall" fn(*mut DDGameWrapper) =
+                core::mem::transmute(rb(0x5703E0) as usize);
+            f2(wrapper);
         }
 
         // ── Close primary GfxHandler ──

crates/openwa-wormkit/src/replacements/game_session.rs

@@ -159,9 +159,11 @@ pub(crate) unsafe fn construct_ddgame_wrapper(
     }
 
     // Initialize DDGame's game-state fields.
+    let _ = log_line("[GameSession] calling InitGameState");
     let init_state: unsafe extern "stdcall" fn(*mut DDGameWrapper) =
         core::mem::transmute(rb(va::DDGAME_INIT_GAME_STATE) as usize);
     init_state(this);
+    let _ = log_line("[GameSession] InitGameState done");
 
     let ddgame = (*this).ddgame;
     let _ = log_line(&format!(