-pb died with exit 0xC0000374, heap corruption, nothing in the log. Two
causes found, one fixed hazard behind them, and the crash itself still
open.
The first cause was mine. L4NetworkManager has always dumped whatever egg
it loaded to "last.egg" as a debug aid, and the egg-beside-the-spool work
put a recording's companion egg at exactly that name. Playback's fallback
then picked up an unrelated egg as though it belonged to last.spl. That
matters more than a wrong filename: the spool header holds one
(remote, hostID) pair per host named in the EGG, so an egg with a
different host count makes the reader consume the wrong number of pairs,
leave the read pointer mid-header, and parse the first packet out of
garbage. The debug dump is now last-loaded.egg.
The second is that nothing checked. A wrong egg could only announce itself
by corrupting memory, which is the least useful signal a program can give.
Playback now looks at the first packet after the host table and refuses a
length that cannot be right, naming the cause: play it back with the .egg
saved beside it.
Neither fixed the crash. With the guard in place and an egg it accepts,
playback still corrupts the heap - and the guard did NOT fire, so the
header was consumed consistently and the fault is later, in dispatching
the packets themselves. The stack at the failure is inside ntdll's
allocator, which is where corruption is DETECTED rather than where it is
caused, so the next step is page heap to find the write rather than more
staring.
Where MR stands after today: it loads the world from the egg, lays the
cockpit out as whatever the station was, accepts the spool's header, and
gets as far as playing packets into the simulation. That is a good deal
further than "crashes on the first thing it touches" this morning, and the
remaining fault is a single memory overrun in a code path that has not run
since 2007.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
CydandClaude Opus 5
48a595b244