Proposals / #1419

gaDrlgRoomReplacementsB is D2DrlgReplaceRoomStrc[4], not [3]

checked · by Nishimura-Katsuo · submitted 2026-11-08

ReplaceRooms (0x00673000) indexes B with a roll of 1..3, so B needs four records. For level 0x7b (the 0x7c check is false), the roll starts as seed%3 (0..2), and ReplaceRoom (0x006724e0) steps it with ADD ECX,1; AND ECX,0x80000003 (+1 mod 4) at 0x0067252c. Then 0x00673090 SHL EDX,4 / ADD EDX,0x6f0328 reads B[roll]. B is typed [3] (48 bytes), but there are 64 bytes to the next symbol, DRLG_WORLDSTONE_REPLACEMENT (0x006f0368). The 16 bytes at 0x006f0358 are an untyped fourth record, {0x414, 0x41b, -1, 2}. It is the only missing source/dest pair: B[0..2] use sources 0x412/0x413/0x415 with dests 0x419/0x41a/0x41c. The generated source has B[3], so whenever A rolled 2, the source reads past the end of the array. In the rebuilt d2.exe this crashes Halls of Death level generation on about 1/3 of seeds.

Changes 1, applied together

1. Retype global win 0x006f0328

   typeD2DrlgReplaceRoomStrc[3] (48 bytes)→D2DrlgReplaceRoomStrc[4]