Proposals / #621

EnqueueLogMessage data length is a size_t byte count

applied · by Commit-Will · submitted 2026-11-01, applied 2026-11-01

Ghidra v1797 · 3bccb89

Stack[0x10] nDataLen is a numeric byte count, not void*. It is pushed as IsBadReadPtr's UINT_PTR size at 0041006d, added to the payload allocation size at 0041009d, stored as a length at 00410101, and pushed as memcpy's byte count at 0041013a. It is never dereferenced. Both direct callers in DumpThreadContext supply literal byte lengths 4096 and 32 at 0040b59f/0040b5cf. Retype only this parameter to size_t, preserving its name, the seven stack slots, other arguments, void return and cdecl. The complete 375-byte body, complete 179-byte caller and both call setups were checked against the original Windows PE. No struct layout or category-value inference is included. Static verification only.

Changes 1, applied together

1. Retype variable win 0x00410040 Stack[0x10]

   typevoid *→size_t