route: map1_01a -> map2_02d; active flag 0x00457744; static byte 0x01; save offset 0x006c.
startup init 0x00411300; calls 1; exact refs 4 (reads 3, writes 1); resolved static default: True; promotion status blocked.
The opcode 0x12 active-selection flag is not an unknown static producer: the executable image initializes 0x00457744 to 1, and startup routine 0x00411300 writes it to 1 via a direct byte store called from 0x00401928. The same byte is also inside the first save-read block at save offset 0x006c, so a loaded save can override the startup/default value. For the current blocker this removes the static-writer mystery around byte(0x00457744), but route promotion is still blocked because the actual runtime/save value, prior selectionBuffer[0x20], secondaryBranchState contents, control path, and strict map1_01a hotspot remain unproven.
| address | instruction | access | width | immediate | context | instruction |
|---|---|---|---|---|---|---|
0x00457744 | 0x0040b590 | read | 1 | - | opcode 0x12 active-state slot selector | mov al, ds:[addr] |
0x00457744 | 0x0040b770 | read | 1 | - | opcode 0x13/runtime-slot related handler | mov al, ds:[addr] |
0x00457744 | 0x0040b876 | read | 1 | - | opcode 0x13/runtime-slot related handler | mov al, ds:[addr] |
0x00457744 | 0x00411306 | write | 1 | 0x01 | startup/runtime init routine | mov byte ptr ds:[addr], imm8 |
| address | save offset | static byte | refs | reads | writes |
|---|---|---|---|---|---|
0x00457744 | 0x006c | 0x01 | 4 | 3 | 1 |
0x00457745 | 0x006d | 0x01 | 3 | 1 | 1 |
0x00457746 | 0x006e | 0x01 | 3 | 2 | 1 |
0x00457747 | 0x006f | 0x00 | 4 | 3 | 1 |
0x00457748 | 0x0070 | 0x00 | 2 | 1 | 1 |
0x00457749 | 0x0071 | 0x01 | 4 | 3 | 1 |
| call | target | instruction |
|---|---|---|
0x00401928 | 0x00411300 | call rel32 |