Save Selector Selection Buffer Bases

context field 0x000000a8; immediate assignments 5; register/computed assignments 6; static gate-offset direct refs 0; runtime pointer mode still required: True; proofFound False; promotion status: blocked.

The selection-buffer pointer at context+0xa8 is not a single fixed array. Static handler paths can point it at 0x0059e310 or 0x004576d8, while other paths compute a save-slot base or load an object pointer from 0x0059db30/0x0059dd70. The gate offsets 0xe8/0xea therefore need runtime pointer-mode evidence before they can prove fallthrough. Exact dword refs to the static 0x0059e310+0xe8/0xea and 0x004576d8+0xe8/0xea addresses are absent, so the producer is still unresolved.

Failed Gates

fixed-selection-buffer-base
static-gate-address-ref
runtime-pointer-mode-proof

Missing Evidence

fixed context+0xa8 base for the current route path
direct static reference to the 0xe8/0xea gate addresses
runtime pointer-mode proof selecting the correct global/save/object base before the gate

Evidence Refs

Hwanse2.exe: context+0xa8 assignment scan and static gate-address reference checks

Immediate Assignments

va	base	source	instruction
`0x00406405`	`0x0059e310`	global selection buffer	`mov dword [eax+0xa8], imm32`
`0x004064de`	`0x004576d8`	save/runtime block	`mov dword [eax+0xa8], imm32`
`0x004106a2`	`0x0059e310`	global selection buffer	`mov dword [eax+0xa8], imm32`
`0x0041d8bf`	`0x0059e310`	global selection buffer	`mov dword [eax+0xa8], imm32`
`0x0041d8d1`	`0x004576d8`	save/runtime block	`mov dword [eax+0xa8], imm32`

Register Assignments

va	source	base expression	instruction
`0x0040575a`	saved pointer table 0x0059dd70[stream+2]	`dword[0x0059dd70 + stream[2]*4]`	`mov dword [ecx+0xa8], eax`
`0x0040643d`	save block slot selected by stream+1	`0x00457750 + stream[1] * 0xd8`	`mov dword [ecx+0xa8], eax`
`0x00406480`	runtime object pointer table selected by context+0xf2	`dword[0x0059db30 + context[0xf2]*4]`	`mov dword [ecx+0xa8], eax`
`0x004064a0`	runtime object pointer table selected by stream+2	`dword[0x0059db30 + stream[2]*4]`	`mov dword [ecx+0xa8], eax`
`0x0041d8ff`	save block slot selected by object field +3	`0x00457750 + object[3] * 0xd8`	`mov dword [ecx+0xa8], eax`
`0x0041d91f`	runtime object pointer table selected by context+0xf2	`dword[0x0059db30 + context[0xf2]*4]`	`mov dword [ecx+0xa8], eax`

Gate Offset Address Checks

base	source	offset	address	direct dword refs	sample refs
`0x0059e310`	global selection buffer immediate assignment	`0x20`	`0x0059e330`	0	-
`0x0059e310`	global selection buffer immediate assignment	`0xe8`	`0x0059e3f8`	0	-
`0x0059e310`	global selection buffer immediate assignment	`0xea`	`0x0059e3fa`	0	-
`0x004576d8`	save/runtime block immediate assignment	`0x20`	`0x004576f8`	12	0x0040f97f, 0x00411099, 0x00411172, 0x0041e0ad, 0x0041e254, 0x0041e7fe, 0x00421ccf, 0x004220dc, 0x004220f0, 0x0042210a, 0x00422732, 0x004227ab
`0x004576d8`	save/runtime block immediate assignment	`0xe8`	`0x004577c0`	0	-
`0x004576d8`	save/runtime block immediate assignment	`0xea`	`0x004577c2`	0	-
`0x00457750+n*0xd8`	indexed save block slot base	`0x20`	`0x00457770`	0	-
`0x00457750+n*0xd8`	indexed save block slot base	`0xe8`	`0x00457838`	0	-
`0x00457750+n*0xd8`	indexed save block slot base	`0xea`	`0x0045783a`	0	-
`dword[0x0059db30+i*4]`	runtime object pointer table base	`0x20`	`-`	0	-
`dword[0x0059db30+i*4]`	runtime object pointer table base	`0xe8`	`-`	0	-
`dword[0x0059db30+i*4]`	runtime object pointer table base	`0xea`	`-`	0	-
`dword[0x0059dd70+i*4]`	saved pointer table base	`0x20`	`-`	0	-
`dword[0x0059dd70+i*4]`	saved pointer table base	`0xe8`	`-`	0	-
`dword[0x0059dd70+i*4]`	saved pointer table base	`0xea`	`-`	0	-