{"contextFieldHex":"0x000000a8","immediateAssignmentCount":5,"registerAssignmentCount":6,"immediateAssignments":[{"va":4219909,"vaHex":"0x00406405","base":5890832,"baseHex":"0x0059e310","source":"global selection buffer","instruction":"mov dword [eax+0xa8], imm32"},{"va":4220126,"vaHex":"0x004064de","base":4552408,"baseHex":"0x004576d8","source":"save/runtime block","instruction":"mov dword [eax+0xa8], imm32"},{"va":4261538,"vaHex":"0x004106a2","base":5890832,"baseHex":"0x0059e310","source":"global selection buffer","instruction":"mov dword [eax+0xa8], imm32"},{"va":4315327,"vaHex":"0x0041d8bf","base":5890832,"baseHex":"0x0059e310","source":"global selection buffer","instruction":"mov dword [eax+0xa8], imm32"},{"va":4315345,"vaHex":"0x0041d8d1","base":4552408,"baseHex":"0x004576d8","source":"save/runtime block","instruction":"mov dword [eax+0xa8], imm32"}],"registerAssignments":[{"va":4216666,"vaHex":"0x0040575a","instruction":"mov dword [ecx+0xa8], eax","source":"saved pointer table 0x0059dd70[stream+2]","baseExpression":"dword[0x0059dd70 + stream[2]*4]"},{"va":4219965,"vaHex":"0x0040643d","instruction":"mov dword [ecx+0xa8], eax","source":"save block slot selected by stream+1","baseExpression":"0x00457750 + stream[1] * 0xd8"},{"va":4220032,"vaHex":"0x00406480","instruction":"mov dword [ecx+0xa8], eax","source":"runtime object pointer table selected by context+0xf2","baseExpression":"dword[0x0059db30 + context[0xf2]*4]"},{"va":4220064,"vaHex":"0x004064a0","instruction":"mov dword [ecx+0xa8], eax","source":"runtime object pointer table selected by stream+2","baseExpression":"dword[0x0059db30 + stream[2]*4]"},{"va":4315391,"vaHex":"0x0041d8ff","instruction":"mov dword [ecx+0xa8], eax","source":"save block slot selected by object field +3","baseExpression":"0x00457750 + object[3] * 0xd8"},{"va":4315423,"vaHex":"0x0041d91f","instruction":"mov dword [ecx+0xa8], eax","source":"runtime object pointer table selected by context+0xf2","baseExpression":"dword[0x0059db30 + context[0xf2]*4]"}],"gateAddressRows":[{"baseHex":"0x0059e310","baseSource":"global selection buffer immediate assignment","offsetHex":"0x20","addressHex":"0x0059e330","directDwordRefCount":0,"directDwordRefs":[],"staticAddress":true},{"baseHex":"0x0059e310","baseSource":"global selection buffer immediate assignment","offsetHex":"0xe8","addressHex":"0x0059e3f8","directDwordRefCount":0,"directDwordRefs":[],"staticAddress":true},{"baseHex":"0x0059e310","baseSource":"global selection buffer immediate assignment","offsetHex":"0xea","addressHex":"0x0059e3fa","directDwordRefCount":0,"directDwordRefs":[],"staticAddress":true},{"baseHex":"0x004576d8","baseSource":"save/runtime block immediate assignment","offsetHex":"0x20","addressHex":"0x004576f8","directDwordRefCount":12,"directDwordRefs":["0x0040f97f","0x00411099","0x00411172","0x0041e0ad","0x0041e254","0x0041e7fe","0x00421ccf","0x004220dc","0x004220f0","0x0042210a","0x00422732","0x004227ab"],"staticAddress":true},{"baseHex":"0x004576d8","baseSource":"save/runtime block immediate assignment","offsetHex":"0xe8","addressHex":"0x004577c0","directDwordRefCount":0,"directDwordRefs":[],"staticAddress":true},{"baseHex":"0x004576d8","baseSource":"save/runtime block immediate assignment","offsetHex":"0xea","addressHex":"0x004577c2","directDwordRefCount":0,"directDwordRefs":[],"staticAddress":true},{"baseHex":"0x00457750+n*0xd8","baseSource":"indexed save block slot base","offsetHex":"0x20","addressHex":"0x00457770","directDwordRefCount":0,"directDwordRefs":[],"staticAddress":false},{"baseHex":"0x00457750+n*0xd8","baseSource":"indexed save block slot base","offsetHex":"0xe8","addressHex":"0x00457838","directDwordRefCount":0,"directDwordRefs":[],"staticAddress":false},{"baseHex":"0x00457750+n*0xd8","baseSource":"indexed save block slot base","offsetHex":"0xea","addressHex":"0x0045783a","directDwordRefCount":0,"directDwordRefs":[],"staticAddress":false},{"baseHex":"dword[0x0059db30+i*4]","baseSource":"runtime object pointer table base","offsetHex":"0x20","addressHex":null,"directDwordRefCount":0,"directDwordRefs":[],"staticAddress":false},{"baseHex":"dword[0x0059db30+i*4]","baseSource":"runtime object pointer table base","offsetHex":"0xe8","addressHex":null,"directDwordRefCount":0,"directDwordRefs":[],"staticAddress":false},{"baseHex":"dword[0x0059db30+i*4]","baseSource":"runtime object pointer table base","offsetHex":"0xea","addressHex":null,"directDwordRefCount":0,"directDwordRefs":[],"staticAddress":false},{"baseHex":"dword[0x0059dd70+i*4]","baseSource":"saved pointer table base","offsetHex":"0x20","addressHex":null,"directDwordRefCount":0,"directDwordRefs":[],"staticAddress":false},{"baseHex":"dword[0x0059dd70+i*4]","baseSource":"saved pointer table base","offsetHex":"0xe8","addressHex":null,"directDwordRefCount":0,"directDwordRefs":[],"staticAddress":false},{"baseHex":"dword[0x0059dd70+i*4]","baseSource":"saved pointer table base","offsetHex":"0xea","addressHex":null,"directDwordRefCount":0,"directDwordRefs":[],"staticAddress":false}],"knownStaticGateOffsetDirectRefCount":0,"runtimePointerModeStillRequired":true,"proofFound":false,"selectionBufferBaseProofFound":false,"failedSelectionBufferBaseGateIds":["fixed-selection-buffer-base","static-gate-address-ref","runtime-pointer-mode-proof"],"missingEvidence":["fixed context+0xa8 base for the current route path","direct static reference to the 0xe8/0xea gate addresses","runtime pointer-mode proof selecting the correct global/save/object base before the gate"],"evidenceRefs":[{"path":"Hwanse2.exe","description":"context+0xa8 assignment scan and static gate-address reference checks"}],"evidenceRefCount":1,"promotionStatus":"blocked","conclusion":"The selection-buffer pointer at context+0xa8 is not a single fixed array. Static handler paths can point it at 0x0059e310 or 0x004576d8, while other paths compute a save-slot base or load an object pointer from 0x0059db30/0x0059dd70. The gate offsets 0xe8/0xea therefore need runtime pointer-mode evidence before they can prove fallthrough. Exact dword refs to the static 0x0059e310+0xe8/0xea and 0x004576d8+0xe8/0xea addresses are absent, so the producer is still unresolved."}