A value that comes from a register nobody set there: read the disassembly

What to know

2026-10-24, vh_yaw_rate (0x47a00c), airlocks_update (0x41648c).

Two traps met while porting the attitude step and the airlock doors, both invisible in the decompiler's output and both caught by the emulator on the first comparison.

• A register kept across a call. vh_yaw_rate loads EDX = −0x600 as if it were an argument to slot_user (0x4fa844), which takes only EAX and does not touch EDX. After the call the code multiplies by EDX: the constant is the yaw's speed factor (0x2000 − 0x600 × speed). Ghidra drops the "argument" and shows a product with an undefined value. Under Watcom's register convention, check the callee's body for which registers it writes before deciding what a register holds after a call.
• A global, not the argument. airlocks_update reads dt_fix from its global (0x59a708). A harness that passes the step only to the routines that take it as an argument leaves the global at 0, and the doors never move: 4,161 of 10,000 cases differed until the harness wrote the global too. Grep the routine for the frame timer's addresses (0x59a704, 0x59a708) before building its harness.
• Stubbing a callee. To test vh_steer's collision response without a world, a code hook on 0x4f8c68 pops the return address, sets EAX to 1 and writes EIP: the routine returns at once with a hit. The same trick logs 0x4f0b44 and 0x4ed7c4 in the airlock case; see isolate-callees.md for callees that pop stack arguments.