Proposals / #1023

Recover the Mac state-list helper's complete base-pointer and input contract

applied · by Commit-Will · submitted 2026-11-02, applied 2026-11-02

Ghidra vmac 111 · 3cfe190

Mac18666b returns an existing child base header or the result of a constructor requesting 0x3c bytes, and explicitly returns NULL on the clear path. Constructor requests 0x3c/0x64, explicit fields and the exact existing Base-at-offset0 relationship establish D2StatListStrc* without assuming an Ex suffix or allocator success/physical extent. Two calls prove ECX Unit, EDX state and one caller-owned DWORD zero/nonzero control, sometimes the full skill level. Recover all inputs and return together with current 3arg __fastcc. BOOL is 4-byte int, preserving the unnormalized word. Preserve chosen names; no shared fields, helper/caller, failure handling, termination or behavior recovery.

Changes 1, applied together

1. Set prototype mac 0x0018666b

   signatureundefined SKILLS_GetOrAllocStateStatList(void)→D2StatListStrc * SKILLS_GetOrAllocStateStatList(D2UnitStrc * pUnit, eD2States eState, BOOL bAlloc)
   conventionunknown→__fastcc