HUD Menu VM Graph Frontier

top-menu wrapper/sequence 주변 VM graph와 0x14/table false promotion 방지 리포트.

statustop-menu-vm-graph-grounded-opener-still-pending

op14 handler0x00403890

post table rejectedTrue

gate refs1

top refs1

openerFalse

Decision

The VM graph still does not prove the normal-field ESC/X opener. 0x0047e624 creates supporting child objects, stores selectedRoot from the inline 0x004a2cb0 intro/title resource list, and calls selectedRoot. The only top-menu sequence reference remains the wrapper's opcode 0x04 operand at 0x0047e6ac. The apparent 0x14 byte at 0x0047e670 is rejected as a linear command because its overlapped first dword is not a valid VA; the later 0x0047e688 pointer is a table entry/reference to the wrapper gate, not opener proof.

Post SelectedRoot Table

#	entry	value	is VA	section
0	0x0047e670	0x0002c614	False
1	0x0047e674	0x00000200	False
2	0x0047e678	0x0047e688	True	.data
3	0x0047e67c	0x00000001	False
4	0x0047e680	0x00000003	False
5	0x0047e684	0x0047e66c	True	.data

parentContext

VA	opcode	len	summary
`0x0047e624`	`0x40` bind/input-base	4
`0x0047e628`	`0x60` runtime-index-queue-reset	4	reset runtime descriptor index queue at 0x004576e8; handler advances +0x04
`0x0047e62c`	`0x07` create-child-object	8	create child object kind=0x00 script=0x0047e720; handler advances +0x08
`0x0047e634`	`0x28` runtime-object-slot	4	store current child object slot=1 through 0x0059dd70[1]; handler advances +0x04
`0x0047e638`	`0x07` create-child-object	8	create child object kind=0x00 script=0x004ded88; handler advances +0x08
`0x0047e640`	`0x28` runtime-object-slot	4	store current child object slot=6 through 0x0059dd70[6]; handler advances +0x04
`0x0047e644`	`0x07` create-child-object	8	create child object kind=0x00 script=0x004dedd4; handler advances +0x08
`0x0047e64c`	`0x28` runtime-object-slot	4	store current child object slot=10 through 0x0059dd70[10]; handler advances +0x04
`0x0047e650`	`0x07` create-child-object	8	create child object kind=0x00 script=0x0047e75c; handler advances +0x08
`0x0047e658`	`0x28` runtime-object-slot	4	store current child object slot=2 through 0x0059dd70[2]; handler advances +0x04
`0x0047e65c`	`0x07` create-child-object	8	create child object kind=0x00 script=0x0047e704; handler advances +0x08
`0x0047e664`	`0x81` selected-root-store	8	store selected root from inline pointer table into 0x0059de30; slot=0x00 table=0x004a2cb0; handler advances +0x08
`0x0047e66c`	`0x82` selected-root-call	4	call selected root if 0x0059de30 is set; handler first advances +0x04, pushes that continuation, then jumps to 0x0059de30
`0x0047e670`	`0x14` unknown	4
`0x0047e674`	`0x00` destroy/stop	4

gate

VA	opcode	len	summary
`0x0047e688`	`0x6e` active-group-key-branch	8	branch if active script group key equals (0x01,0x00) -> 0x0047e67c; else advances +0x08
`0x0047e690`	`0x6e` active-group-key-branch	8	branch if active script group key equals (0x01,0x01) -> 0x0047e67c; else advances +0x08
`0x0047e698`	`0xe6` active-descriptor-count-branch	8	branch on active descriptor count 0x004576e8; if count is zero -> 0x0047e67c, otherwise advances +0x08
`0x0047e6a0`	`0x4a` active-object-flag-mask	8	active-object flag set; filter object+0x14 mask=0x0001; flags=0x80000000
`0x0047e6a8`	`0x10` byte-store/expression	4
`0x0047e6ac`	`0x04` call/push-continuation	8	call/push-continuation -> 0x004ddc6c; pushes return address 0x0047e6b4 to object return stack object+0x44[object+0x5c], increments object+0x5c, then jumps to target
`0x0047e6b4`	`0x11` resource/sprite-command	12	field arithmetic/write command; group=0xc0 field=+0x0002 literal=0 args=0x2f46,0x0001
`0x0047e6c0`	`0x18` dword-store/expression	8
`0x0047e6c8`	`0x10` byte-store/expression	4
`0x0047e6cc`	`0x4a` active-object-flag-mask	8	active-object flag clear; filter object+0x14 mask=0x0001; flags=0x80000000
`0x0047e6d4`	`0x03` jump	8	jump -> 0x0047e67c

wrapper

VA	opcode	len	summary
`0x0047e6a0`	`0x4a` active-object-flag-mask	8	active-object flag set; filter object+0x14 mask=0x0001; flags=0x80000000
`0x0047e6a8`	`0x10` byte-store/expression	4
`0x0047e6ac`	`0x04` call/push-continuation	8	call/push-continuation -> 0x004ddc6c; pushes return address 0x0047e6b4 to object return stack object+0x44[object+0x5c], increments object+0x5c, then jumps to target
`0x0047e6b4`	`0x11` resource/sprite-command	12	field arithmetic/write command; group=0xc0 field=+0x0002 literal=0 args=0x2f46,0x0001
`0x0047e6c0`	`0x18` dword-store/expression	8
`0x0047e6c8`	`0x10` byte-store/expression	4
`0x0047e6cc`	`0x4a` active-object-flag-mask	8	active-object flag clear; filter object+0x14 mask=0x0001; flags=0x80000000
`0x0047e6d4`	`0x03` jump	8	jump -> 0x0047e67c

topSequence

VA	opcode	len	summary
`0x004ddc6c`	`0x40` bind/input-base	4
`0x004ddc70`	`0x10` byte-store/expression	4
`0x004ddc74`	`0x2f` prompt/text-command	8	prompt/text command mode=0x02 payload=0x004e842e; handler advances +0x08; text payload: ^껷 뒆N 텇N
`0x004ddc7c`	`0x2f` prompt/text-command	8	prompt/text command mode=0x02 payload=0x004e8120; handler advances +0x08; text payload: 갢 쟼N 픹N 긏 $긏 F긏
`0x004ddc84`	`0x07` create-child-object	8	create child object kind=0x00 script=0x004dee18; handler advances +0x08
`0x004ddc8c`	`0x28` runtime-object-slot	4	store current child object slot=7 through 0x0059dd70[7]; handler advances +0x04
`0x004ddc90`	`0x07` create-child-object	8	create child object kind=0x00 script=0x004dee58; handler advances +0x08
`0x004ddc98`	`0x28` runtime-object-slot	4	store current child object slot=8 through 0x0059dd70[8]; handler advances +0x04
`0x004ddc9c`	`0x07` create-child-object	8	create child object kind=0x00 script=0x004dee98; handler advances +0x08
`0x004ddca4`	`0x28` runtime-object-slot	4	store current child object slot=9 through 0x0059dd70[9]; handler advances +0x04
`0x004ddca8`	`0x07` create-child-object	8	create child object kind=0x00 script=0x004deed8; handler advances +0x08
`0x004ddcb0`	`0x28` runtime-object-slot	4	store current child object slot=11 through 0x0059dd70[11]; handler advances +0x04
`0x004ddcb4`	`0x07` create-child-object	8	create child object kind=0x00 script=0x004def0c; handler advances +0x08
`0x004ddcbc`	`0x28` runtime-object-slot	4	store current child object slot=12 through 0x0059dd70[12]; handler advances +0x04
`0x004ddcc0`	`0x2f` prompt/text-command	8	prompt/text command mode=0x02 payload=0x004e8190; handler advances +0x08; text payload: 갢 쟼N 픹N 긏 $긏 F긏
`0x004ddcc8`	`0x12` state-compare-or-store	8	dword field arithmetic/write command; group=0x80 field=+0x0000 literal=0
`0x004ddcd0`	`0x8a` unknown	4
`0x004ddcd4`	`0x8a` unknown	4

Child 0x0047e720

from 0x0047e62c

VA	opcode	len	summary
`0x0047e720`	`0x08` object-field-initializer	48	object field initializer
`0x0047e750`	`0x01` stop-tick	4
`0x0047e754`	`0x03` jump	8	jump -> 0x0047e750

Child 0x004ded88

from 0x0047e638

VA	opcode	len	summary
`0x004ded88`	`0x12` state-compare-or-store	8	dword field arithmetic/write command; group=0x87 field=+0x002c literal=128
`0x004ded90`	`0x08` object-field-initializer	48	object field initializer
`0x004dedc0`	`0x2f` prompt/text-command	8	prompt/text command mode=0x02 payload=0x004e7fec; handler advances +0x08; text payload: 퍷
`0x004dedc8`	`0x01` stop-tick	4
`0x004dedcc`	`0x03` jump	8	jump -> 0x004dedc8

Child 0x004dedd4

from 0x0047e644

VA	opcode	len	summary
`0x004dedd4`	`0x08` object-field-initializer	40	object field initializer
`0x004dedfc`	`0x2f` prompt/text-command	8	prompt/text command mode=0x02 payload=0x004e8068; handler advances +0x08; text payload: 퍷
`0x004dee04`	`0x12` state-compare-or-store	8	dword field arithmetic/write command; group=0x80 field=+0x0000 literal=134217728
`0x004dee0c`	`0x01` stop-tick	4
`0x004dee10`	`0x03` jump	8	jump -> 0x004dee0c

Child 0x0047e75c

from 0x0047e650

VA	opcode	len	summary
`0x0047e75c`	`0x4d` unknown	4
`0x0047e760`	`0x01` stop-tick	4
`0x0047e764`	`0x03` jump	8	jump -> 0x0047e75c

Child 0x0047e704

from 0x0047e65c

VA	opcode	len	summary
`0x0047e704`	`0x11` resource/sprite-command	12	field arithmetic/write command; group=0x80 field=+0x0014 literal=1 args=0x0040,0x0000
`0x0047e710`	`0x61` runtime-index-queue-process	4	process/rebuild runtime descriptor index queue at 0x004576e8; handler advances +0x04
`0x0047e714`	`0x01` stop-tick	4
`0x0047e718`	`0x03` jump	8	jump -> 0x0047e710

Negative Evidence

0x0047e670 is not accepted as a linear opcode 0x14 command because dword[0x0047e670] is not a file-backed VA.
0x0047e688 is referenced only as a table entry from 0x0047e678 in this graph.
0x004ddc6c is only referenced by the wrapper call operand at 0x0047e6b0.
0x004a2cb0 is the compile/aaa/logo/title/btl_k intro-title resource list, so the parent remains intro/title-context.

Next Frontier

Find a non-intro field state/root stream that reaches a menu-equivalent wrapper or descriptor attachment.
If opcode 0x14 is used elsewhere as a branch command, accept it only when dword[stream] is a file-backed target VA.
Trace producers of object+0x40 stream pointers for the normal field mode rather than promoting nearby pointer tables.

Raw JSON