[thehobbit85]

What and why

Refs #960 (partial fix; the issue remains open).

Ultra Street Fighter II's main+0x590ee8 uses a bit-test guard followed by a masked table index, so the rewriter aborts despite the table having a provable extent. On the fall-through path of tbnz wS,#B,exit, bit B is clear; the following low-bit mask leaves exactly 2^B entries. Treating the mask plus one as the count would read unreachable words.

Add a final fallback for this exact adjacent dispatch, with a full-width ADRP/ADD base and verified incoming paths. It rejects clobbers, gaps, calls and branches that bypass the proof; module-wide checks also reject incoming branches and tables resolved later. Existing recognizers retain priority. Credit to PikaMan80 for the report and original pattern.

The separate dispatch at main+0x7d3000, SDK 1 audio support and full game compatibility remain outside this change. PR #1937 handles CMP-based masked dispatches across control flow, not this TBNZ form; #966/#967 cover other parts of #960. Current main and all-state PRs were rechecked before publishing.

Durable finding: bit-test bounded masked jump-table index.

Checked

Tested base: bbea4c90f136f478e25228bc3d4ab33c77420f2e; tested head: de0dfe2e2704b69d66d19ab98ad3d70c72fafa4e. Latest main 6d9edb079b2edfa5e8a85753b1740ef4275b383a adds unrelated texture-streaming changes; the tested head merges cleanly with it and its rewriter is unchanged. Environment: Apple M2 Max, macOS 26.6, native arm64 Python 3.14.6, Capstone 5.0.7.

• Synthetic red/green: the actual rewriter fails with jump table 11c on the pinned baseline fixture, then writes exactly four expected targets with this fix. All 12 new tests pass, including poisoned extra entries, invalid guards/masks, base clobbers and incoming edges from another function or a later table.
• python3 -m unittest dm.tools.tests.test_jump_tbnz dm.tools.tests.test_jump_copies dm.tools.tests.test_docs -v: 93 pass.
• make -C dm/gfx/tests -j2 GAME=010015100B514000 run: pass, including native Metal tests.
• python3 -m unittest discover -s dm/ios/tests: 52 pass.
• python3 -m unittest discover -s dm/tools/tests: 1,435 run, 23 skipped, one existing ABI-literal ratchet failure (nvn_mtl.m, "?" 2 → 3; already tracked by main CI: t_gfx_suspend does not link (dm_vi_frame_queued outside the tests glob), Tool tests errors in the NSP tool unittests, and the fleet-wide red boxes #1656 and PRs test_dmsh_abi's ratchet no longer counts "?": the unknown binding kind is also what log lines write for a name they do not have, and the third such placeholder in nvn_mtl.m fails the Tool tests on main (issue #1656) #1981/The clang-tidy ratchet passes on main again #2029).
• python3 -m unittest discover -s dm/gfx/tests: 467 run, 140 skipped, six existing IntegerPassThrough errors: its extracted-function fixture omits dmsh_fetch.
• python3 dm/tools/lint_python.py: three existing dmsh_build.py findings at lines 166–167, where a local integer and nested function share depth. No finding in the changed rewriter/tests. All three failing check groups reproduce unchanged on an isolated export of the tested baseline; no baseline or test was weakened.
• git diff --check: pass. scripts/regress.py impact HEAD: broad rewriter rule, four profiles with broad coverage and 149 unknown manifests.

The required scripts/regress.py check --games 010032E00E6E2000,0100698009C6E000,01006A800016E000,01006C300E9F0000,010067300059A000 was attempted but exits 2: REGRESS_ROOT/REGRESS_GAMES are not configured and no local game files are available. No gameplay, extracted-game rewrite comparison or iOS runtime validation is claimed. Selected regression targets:

Game	Reason
Return of the Obra Dinn	Complemented masked-index fallback
Blasphemous	Forward table-base initializer
Super Smash Bros. Ultimate	Far/copied table base
Dragon Quest XI S	Index copied before guard
Mario + Rabbids Kingdom Battle	Far index-copy chain

Ultra Street Fighter II has no repository profile or local assets here. Other games remain unchecked.

Docs

• General finding added to docs/reference/rewriter.md; symptom index regenerated and developer documentation updated. No existing game note is available for this title.
• No game files, keys, extracted game data or agent planning/journal files are included.
• Shader chain unchanged; this is a rewriter change.