asm.cpp

/*
MIT License

Copyright (c) 2017 Franck GOTTHOLD, xor2003

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
*/
#include "asm.h"

#include <exception>

#ifndef __BORLANDC__
 #ifndef _WIN32
  #include <sys/select.h>
  #include <sys/time.h>
  #include <unistd.h>
  #include <fcntl.h>
  #include <dirent.h>
  #include <strings.h>
 #endif
 #ifndef __DJGPP__
  #ifndef NOSDL
   #include <SDL2/SDL.h>
  #endif
 #endif
// #include <thread>
#endif

#ifdef __DJGPP__
 #include <pc.h>
 #include <dos.h>
 #include <dpmi.h>
 #include <go32.h>
 #include <sys/farptr.h>
#endif

#ifdef _WIN32
//#include <windows.h>
#endif

//#include <assert.h>
//#include <time.h>
#include <cassert>
#include <cerrno>
#include <string>
#include <ctime>
#include <algorithm>
#include <atomic>
#include <chrono>
#include <cmath>
#include <cstdio>
#include <execinfo.h>
#include <cstdint>
#include <cstdlib>
#include <cstring>
#include <csignal>
#include <thread>
#include <vector>
#include <map>
#include <fstream>

#ifndef M2C_LOAD_SEG
#define M2C_LOAD_SEG 0x192
#endif

// DOS program segment prefix paragraph. For hosted .COM-style runs it equals
// M2C_LOAD_SEG; for EXE-style two-segment programs the code loads at
// M2C_LOAD_SEG while the PSP lives one paragraph below it.
#ifndef M2C_PSP_SEG
#define M2C_PSP_SEG M2C_LOAD_SEG
#endif

#ifndef NOCURSES
#include <curses.h>
#endif

static m2c::m2c_game_hooks g_hooks;
static m2c::m2c_palette_map g_palette_map;
static bool g_palette_mapped = false;
m2c::m2c_overlay_module* m2c::m2c_overlays[8];

void m2c::m2c_set_game_hooks(const m2c_game_hooks* hooks) {
	g_hooks = hooks ? *hooks : m2c_game_hooks{};
}

void m2c::m2c_register_palette_map(const m2c_palette_map* map) {
	if (map) { g_palette_map = *map; g_palette_mapped = true; }
	else { g_palette_map = m2c_palette_map{}; g_palette_mapped = false; }
}

bool m2c::m2c_register_overlay_module(m2c_overlay_module* mod) {
	for (auto& slot : m2c_overlays) {
		if (!slot) { slot = mod; return true; }
	}
	return false;
}

static m2c::m2c_overlay_module* m2c_find_overlay(dw seg) {
	for (auto* mod : m2c::m2c_overlays) {
		if (mod && mod->code_seg && seg == mod->code_seg) return mod;
	}
	return nullptr;
}

static m2c::m2c_overlay_module* m2c_overlay_image_at(dw segment, dw offset) {
	for (auto* mod : m2c::m2c_overlays) {
		if (mod && mod->img_paras && segment >= mod->seg &&
		    segment < mod->seg + mod->img_paras) {
			(void)offset;
			return mod;
		}
	}
	return nullptr;
}

/* https://commons.wikimedia.org/wiki/File:Table_of_x86_Registers_svg.svg */


//struct uc_x86_state {
//    REGDEF_nol(flags);
//};



/*
#undef REGDEF_hl
#undef REGDEF_l
#undef REGDEF_bwd
#undef REGDEF_nol

struct __fl
{
	bool _CF:1;
	bool res1:1;
	bool _PF:1;
	bool res2:1;
	bool _AF:1;
	bool res3:1;
	bool _ZF:1;
	bool _SF:1;
	bool _TF:1;
	bool _IF:1;
	bool _DF:1;
	bool _OF:1;
	int _IOPL:2;
	bool _NT:1;
	bool res4:1;
	bool res5:16;
};
static struct __fl __eflags;

#define CF __eflags._CF
#define ZF __eflags._ZF
#define DF __eflags._DF
#define SF __eflags._SF
*/
// VRAM logical window is VGA-state (not SDL) — needed by headless builds for
// the deterministic frame-flip machinery below.
static const size_t VGA_WINDOW_SIZE = 0x20000;
// SDL2 VGA
#ifndef NOSDL
 #if SDL_MAJOR_VERSION == 2
    SDL_Renderer *renderer;
    SDL_Window *window;
    static bool vga_render_dirty;
    static unsigned vga_render_writes;
    static int vga_logical_width = 320;
    static int vga_logical_height = 200;
    static const unsigned VGA_RENDER_WRITE_FLUSH_THRESHOLD = 8 * 1024;
    static db vgaPlanarPixels[640 * 200];
    static db vgaMode13Pixels[VGA_WINDOW_SIZE * 4];
    static unsigned char vga_wr_hit[VGA_WINDOW_SIZE];  // per-byte write coverage (M2C_WRHIT)
    static db vgaReadLatch[4];
    static db vgaPendingReadLatch[4][4];
    static size_t vgaPendingReadLatchCount;
    static size_t vgaPendingReadLatchNext;
    static uint32_t vgaSdlFrame[640 * 400];
    static SDL_Texture *vgaTexture;

db vgaRamPaddingBefore[VGARAM_SIZE];
db vgaRam[VGARAM_SIZE];
db vgaRamPaddingAfter[VGARAM_SIZE];
 #endif
#endif

  bool from_callf=false;

namespace m2c {
  int last_ret_popped=-1;
  size_t last_ret_mark_id=0;
  int last_ret_mark_mode=0;
  dd last_ret_site=0;

#ifdef M2CDEBUG
  /* Per-instruction tracing is expensive enough to freeze a program, so it
   * is strictly opt-in: M2CDEBUG only compiles the support in, M2C_DEBUG
   * must be set explicitly to turn it on (default off). */
  size_t debug = std::getenv("M2C_DEBUG") ? (size_t)atoi(std::getenv("M2C_DEBUG")) : 0;
#else
  size_t debug = 0;
#endif
bool defered_irqs=false;
  size_t counter = 0;
    int m2c_ret_dbg = [](){ const char* e=getenv("M2C_RETDBG"); return e && *e=='1'; }();
    unsigned m2c_last_callsite_i = 0, m2c_last_callsite_eip = 0, m2c_last_callsite_rip = 0;
    std::vector<NativeReturnMark> native_return_marks;
    std::vector<NativeReturnMark> native_return_values;
    std::unordered_map<MWORDSIZE, SentinelResumeInfo> sentinel_resume_map;
    size_t native_return_next_id = 0;
    size_t native_return_call_depth = 0;
    bool suppress_native_return_push_transfer = false;
    /* Default to strict (exact-match) native-return bookkeeping. The
       non-strict register-carried (`carry`/`take`) and frame-skip/reloc
       fallback heuristics mis-consume marks on Tornado's call patterns:
       a `pop`/`push` juggling the return word steals or drops the mark, the
       later `ret` then misses, dispatches to the proc *entry* instead of the
       post-call continuation, and re-enters the proc -> unbounded recursion.
       Exact-match marks are semantically correct for this code; opt back into
       the heuristics with M2C_STRICT_RET=0 if a different game needs them. */
    int m2c_strict_native_return = [](){ const char* e=getenv("M2C_STRICT_RET"); return e && *e=='0' ? 0 : 1; }();

    /* M2C_DISPASSERT: verbose dump when a far/near target cannot be resolved.
       Default ON so dispatch misses surface their full context (seg, off, cs,
       eip, which resolver failed) instead of a bare "Don't know how to call".
       Set M2C_DISPASSERT=0 to silence. */
    int m2c_dispassert = [](){ const char* e=getenv("M2C_DISPASSERT"); return e && *e=='0' ? 0 : 1; }();

    /* cs invariant: while running translated code the emulated cs must be a
       plausible code segment -- 0 (bare near dispatch), 0xf000 (BIOS), a
       generated-proc host paragraph (m2c_seg_func_for), or a real loaded
       segment.  Anything else means a return-table word or data pointer was
       popped into cs, which is the exact corruption class that produced the
       seg:off "Don't know how to call" aborts.  Checked at dispatch entry so
       the first bad cs is flagged at the point it is *used*, not deep inside
       a wrong-module run. */
    static bool m2c_cs_sane(dw v) {
        if (v == 0 || v == 0xf000) return true;
        if (m2c_seg_func_for(v)) return true;
        if (linked_code_segment_raddr(v, 0) || m2c_alloc_segment_raddr(v, 0)) return true;
        return false;
    }
    static void m2c_check_cs(_STATE* _state, _offsets disp, const char* where) {
        if (!m2c_dispassert) return;
        const dw v = _state->cs;
        if (!m2c_cs_sane(v)) {
            fprintf(stderr,
                "[CSBAD] %s cs=%04x (not 0/f000/func-seg/real-seg) disp=%08x eip=%04x\n",
                where, (unsigned)v, (unsigned)disp, (unsigned)(_state->eip & 0xffff));
        }
    }

    int m2c_dump_marks(_STATE* st, unsigned disp) {
        fprintf(stderr, "MARKDUMP disp=%08x state=%p depth=%d nmarks=%d\n",
            disp, (void*)st, (int)native_return_call_depth, (int)native_return_marks.size());
        const unsigned rip = disp & 0xffff;
        for (auto& mk : native_return_marks) {
            if ((unsigned)mk.return_ip == rip || mk.state == st)
                fprintf(stderr, "   mk st=%p ss=%x sp=%x rip=%x d=%d id=%d %s\n",
                    (void*)mk.state,(unsigned)mk.stack_segment,(unsigned)mk.stack_offset,
                    (unsigned)mk.return_ip,(int)mk.call_depth,(int)mk.id,
                    mk.state==st?"<SAMEST":"");
        }
        return 0;
    }
    db _indent=0;
    const char *_str="";
    bool fix_segs(){return true;}
void interpret_unknown_callf(dw cs, dd eip, db source){assert(0);}
    __attribute__((weak)) db* linked_code_segment_raddr(dw, dw){return nullptr;}
    __attribute__((weak)) db* linked_data_segment_raddr(dw, dw){return nullptr;}
    __attribute__((weak)) void set_segment_register(dw& reg, dw value){reg = value;}
    __attribute__((weak)) void copy_linked_program_segment_prefix(dw, const void*, size_t) {}
    // BIOS ROM shadow for the F000 segment (see asm.h). Zeroed by default; a
    // program that emulates a specific machine plants its signature bytes via
    // the overlay/game glue before the guest first reads the F000 segment.
    db m2c_bios_rom[0x10000] = {};
    bool host_try_overlay_retf(_offsets __disp, _STATE* _state, bool* out_result);
    __attribute__((weak)) bool m2c_guest_thunk(_offsets __disp, _STATE* _state) {
        (void)__disp; (void)_state;
        return false;
    }
    __attribute__((weak)) m2cf* m2c_seg_func_for(dw seg) {
        (void)seg;
        return nullptr;
    }
    __attribute__((weak)) bool dispatch_external_code(_offsets __disp, _STATE* _state, bool* handled) {
        bool res = true;
        if (host_try_overlay_retf(__disp, _state, &res)) {
            if (handled) {
                *handled = true;
            }
            return res;
        }
        if (handled) {
            *handled = false;
        }
        return true;
    }


ShadowStack shadow_stack;

x87_t fpu;

long double fpu_ld80(const void* p) {
    if (sizeof(long double) >= 10) {
        long double v = 0;
        memcpy(&v, p, 10);
        return v;
    }
    // Portable decode for hosts where long double is not 80-bit x87 ext.
    const db* b = (const db*)p;
    uint64_t mant;
    memcpy(&mant, b, 8);
    int se = b[8] | (b[9] << 8);
    int sign = se >> 15;
    int exp = se & 0x7fff;
    if (exp == 0 && mant == 0) return sign ? -0.0L : 0.0L;
    return (long double)std::ldexp((long double)mant, exp - 16383 - 63) * (sign ? -1.0L : 1.0L);
}

void fpu_st80(void* p, long double v) {
    db* b = (db*)p;
    if (sizeof(long double) >= 10) {
        memcpy(b, &v, 10);
        return;
    }
    // Portable encode to 80-bit x87 extended.
    int sign = std::signbit(v);
    long double a = std::fabs(v);
    uint64_t mant = 0;
    int se = 0;
    if (a != 0 && std::isfinite(a)) {
        int exp;
        long double f = std::frexp(a, &exp);          // a = f * 2^exp, f in [0.5,1)
        mant = (uint64_t)std::ldexp(f, 64);           // 1 bit int + 63 fraction
        se = exp - 1 + 16383;
    }
    memcpy(b, &mant, 8);
    b[8] = se & 0xff;
    b[9] = ((se >> 8) & 0x7f) | (sign ? 0x80 : 0);
}

void fpu_init() {
    memset(&fpu, 0, sizeof(fpu));
    fpu.cw = 0x037f;
    std::fesetround(FE_TONEAREST);
}

//db vgaPalette[256*3];
#include "vgapal.h"
// Legacy selector table — superseded by m2c_ldt (emulated LDT).  Kept
// because historical asm_16.h copies reference `selectors[segment]` under
// _PROTECTED_MODE; the shared runtime no longer uses it.
dd selectorsPointer;
dd selectors[NB_SELECTORS];

dd heapPointer;
struct find_t;
static db defaultDiskTransferArea[128] = {};
struct find_t * diskTransferAddr = reinterpret_cast<find_t *>(defaultDiskTransferArea);

/* Win16 / protected-mode descriptor table (emulated LDT).  Under real
   protected mode, segment registers hold *selectors*: 16-bit values encoded
   as (index<<3 | TI<<2 | RPL).  Each selector indexes a descriptor
   {base, limit, rights}.  We emulate that:

   - m2c_ldt[] is the descriptor store, indexed by selector>>3.
   - base is a HOST pointer: either inside `m` (aliases of real-mode
     segments / the loaded image) or a malloc'd block (DPMI/RTM allocations).
   - lin is the guest-visible linear base (m-offset for m-aliases, a
     synthetic address for owned blocks).
   - Real-mode paragraphs in segregs are not descriptors: they resolve
     through the `m` paragraph view in raddr_().

   Allocated selectors are encoded (idx<<3 | 7) starting at m2c_pm_sel_base
   (default 0x4000 -> index 2048), above normal image paragraphs, so plain
   paragraph values never alias a used descriptor.  Because the encoding is
   the real one, guest descriptor arithmetic works: sel+8 (__AHINCR) steps
   to the next descriptor and sel>>3 (__AHSHIFT) yields the table index. */
PmDesc m2c_ldt[NB_LDT];
static unsigned m2c_ldt_next_idx;   // allocation cursor (index)
// First allocated selector *value*. Weak so a program can place its
// descriptor space above its loaded image; default suits images < 256KB.
__attribute__((weak)) dw m2c_pm_sel_base = 0x4000;
static unsigned m2c_pm_next_linear = 0x1000000;  // synthetic linear base for owned blocks

int m2c_ldt_idx(dw sel) { return (sel >> 3) & (NB_LDT - 1); }

// Allocate n consecutive descriptors; returns the base selector value
// (idx<<3 | 7) or 0 on exhaustion.  Entries are marked used with no base —
// the client sets base/limit via INT31 0007/0008 or the m2c_ldt_* helpers.
dw m2c_ldt_alloc(int n) {
	if (!m2c_ldt_next_idx) m2c_ldt_next_idx = m2c_ldt_idx(m2c_pm_sel_base);
	unsigned start = m2c_ldt_next_idx;
	if (start + n >= NB_LDT) {
		log_error("ldt: out of descriptors (need %d at %u)\n", n, start);
		return 0;
	}
	for (int i = 0; i < n; ++i) {
		PmDesc& d = m2c_ldt[start + i];
		if (d.used) { // shouldn't happen past the cursor; be loud
			log_error("ldt: descriptor %u already used\n", start + i);
		}
		d.base = nullptr;
		d.limit = 0xffff;
		d.rights = 0x00f3;  // data, read/write, accessed (DPMI default)
		d.lin = 0;
		d.used = 1;
		d.owned = 0;
	}
	m2c_ldt_next_idx = start + n;
	return (dw)((start << 3) | 7);
}

void m2c_ldt_free(dw sel) {
	int idx = m2c_ldt_idx(sel);
	PmDesc& d = m2c_ldt[idx];
	if (!d.used) return;
	if (d.owned) {
		db* blk = d.base;
		dd ext = d.extent ? d.extent : 0x10000;
		free(blk);
		// Clear every descriptor aliasing the freed block.
		for (int i = 0; i < NB_LDT; ++i) {
			if (m2c_ldt[i].used && m2c_ldt[i].base >= blk &&
			    m2c_ldt[i].base < blk + ext)
				m2c_ldt[i] = PmDesc{};
		}
	} else {
		d = PmDesc{};
	}
}

// `struct Memory` is program-defined and incomplete here; its layout ends
// with the `heap` array (a link-bound reference into m), so the usable
// extent of `m` linear addresses is (&heap - &m) + HEAP_SIZE.
static inline dd m2c_m_extent() {
	return (dd)((db*)&heap - (db*)&m) + HEAP_SIZE;
}

// Guest linear base for INT31 0006: m-offset for m-aliased descriptors,
// the recorded synthetic base for owned regions.
dd m2c_ldt_get_lin(dw sel) {
	const PmDesc& d = m2c_ldt[m2c_ldt_idx(sel)];
	if (!d.base) return d.lin;
	if (d.base >= (db*)&m && d.base < (db*)&m + m2c_m_extent())
		return (dd)(d.base - (db*)&m);
	return d.lin;
}

// Allocate a 64KB-backed region and return its selector.  Real selectors
// cover the full 64KB regardless of the requested size — guest code may
// legally touch any 16-bit offset — so the host block is always 64KB.
dw m2c_pm_alloc_paras(dw paras) {
	dw sel = m2c_ldt_alloc(1);
	if (!sel) {
		log_error("pm alloc: out of descriptors (req=%04x)\n", (unsigned)paras);
		return 0;
	}
	db* p = static_cast<db*>(calloc(1, 0x10000));
	if (!p) { m2c_ldt_free(sel); return 0; }
	PmDesc& d = m2c_ldt[m2c_ldt_idx(sel)];
	d.base = p;
	d.limit = 0xffff;
	d.lin = m2c_pm_next_linear;
	d.extent = 0x10000;
	m2c_pm_next_linear += 0x10000;
	d.owned = 1;
	log_debug2("pm alloc req=%04x -> sel=%04x lin=%x\n", (unsigned)paras, sel, d.lin);
	return sel;
}

void m2c_pm_free(dw sel) { m2c_ldt_free(sel); }

// Under the protected-mode memory model, `seg X` must produce a *selector*:
// value stored into ds/es/ss/cs, passed to DPMI, or written by NE fixups.
// Resolve a paragraph to a descriptor aliasing that m storage.  Aliases are
// shared (same paragraph -> same selector) and cached for the common
// repeated `seg DGROUP` pattern.
dw m2c_seg_selector(dw para) {
	dd lin = (dd)para << 4;
	static dw last_para = 0xffff, last_sel = 0;
	if (para == last_para) return last_sel;
	for (int i = 0; i < NB_LDT; ++i) {
		const PmDesc& d = m2c_ldt[i];
		if (d.used && !d.owned && d.lin == lin) {
			last_para = para;
			last_sel = (dw)((i << 3) | 7);
			return last_sel;
		}
	}
	dw sel = m2c_ldt_alloc(1);
	if (!sel) return para;  // LDT exhausted — paragraph still resolves via m
	PmDesc& d = m2c_ldt[m2c_ldt_idx(sel)];
	d.base = (db*)&m + lin;
	d.lin = lin;
	last_para = para;
	last_sel = sel;
	return sel;
}

// `seg X` where X names a segment the NE loader mapped: the descriptor the
// loader created is the guest-visible selector value (ds/ss hold selectors,
// NE fixups store selectors), so data initializers and `seg` expressions
// must agree with them.  Paragraphs with no descriptor keep their real-mode
// identity, so DOS programs see no behaviour change.  Lookup only — unlike
// m2c_seg_selector this never allocates, and misses are not cached so it is
// safe to call before the loader runs.
dw m2c_seg_selector_or_para(dw para) {
	const dd lin = (dd)para << 4;
	static dw last_para = 0xffff, last_sel = 0;
	if (para == last_para) return last_sel;
	for (int i = 0; i < NB_LDT; ++i) {
		const PmDesc& d = m2c_ldt[i];
		if (d.used && !d.owned && d.lin == lin) {
			last_para = para;
			last_sel = (dw)((i << 3) | 7);
			return last_sel;
		}
	}
	return para;
}

/* Generic NE (Win16) image loader — shared implementation behind the
   m2c_ne_entry_setup hook.  The caller owns where each segment lives
   (M2cNeSegHost::base/para); this routine does the format work: descriptor
   creation, file-data copies, internal-reference fixups, entry state. */
static dw ne_w(const db* p) { return (dw)(p[0] | (p[1] << 8)); }
static void ne_w_set(db* p, dw v) { p[0] = db(v); p[1] = db(v >> 8); }
static dd ne_d(const db* p) {
	return (dd)p[0] | ((dd)p[1] << 8) | ((dd)p[2] << 16) | ((dd)p[3] << 24);
}

static M2cNeImport s_ne_imports[512];
static char s_ne_mod_names[32][16];
M2cNeImport* m2c_ne_imports = s_ne_imports;
dw m2c_ne_import_count = 0;
const char* m2c_ne_import_mod_name(dw mod_idx) {
	if (!mod_idx || mod_idx > 32 || !s_ne_mod_names[mod_idx - 1][0]) return "?";
	return s_ne_mod_names[mod_idx - 1];
}
static dw ne_import_add(dw mod_idx, dw ord) {
	for (dw i = 0; i < m2c_ne_import_count; ++i)
		if (s_ne_imports[i].mod_idx == mod_idx && s_ne_imports[i].ordinal == ord)
			return i;
	dw idx = m2c_ne_import_count;
	if (idx < sizeof(s_ne_imports) / sizeof(*s_ne_imports)) {
		s_ne_imports[idx].mod_idx = mod_idx;
		s_ne_imports[idx].ordinal = ord;
		++m2c_ne_import_count;
	}
	return idx;
}

bool m2c_ne_load(_STATE* _state, const db* image, dd image_size,
                 M2cNeSegHost* segs) {
	X86_REGREF
	if (!image || image_size < 0x40 || ne_w(image) != 0x5a4d /*'MZ'*/) {
		log_error("NE load: not an MZ image\n");
		return false;
	}
	dd ne = ne_d(image + 0x3c);
	if (ne + 0x40 > image_size || ne_w(image + ne) != 0x454e /*'NE'*/) {
		log_error("NE load: no NE signature\n");
		return false;
	}
	const db* hdr = image + ne;
	const dw ds_idx  = ne_w(hdr + 0x0e);   // automatic data segment
	const dw entry_ip = ne_w(hdr + 0x14);
	const dw cs_idx  = ne_w(hdr + 0x16);
	const dw entry_sp = ne_w(hdr + 0x18);
	const dw ss_idx  = ne_w(hdr + 0x1a);
	const dw nseg    = ne_w(hdr + 0x1c);
	const dw segoff  = ne_w(hdr + 0x22);   // segment table, rel to NE
	const dw shift   = ne_w(hdr + 0x32);   // logical sector shift
	if (!nseg || ne + segoff + nseg * 8 > image_size) {
		log_error("NE load: bad segment table (count=%u)\n", nseg);
		return false;
	}
	const db* stab = hdr + segoff;
	for (int i = 0; i < nseg; ++i) {
		const db* e = stab + i * 8;
		dd  foff  = (dd)ne_w(e) << shift;
		dd  len   = ne_w(e + 2); if (!len) len = 0x10000;
		dw  flags = ne_w(e + 4);
		segs[i].flags = flags;
		if (!segs[i].base && segs[i].para)
			segs[i].base = (db*)&m + ((dd)segs[i].para << 4);
		if (!segs[i].base) {
			log_error("NE load: segment %d has no host storage\n", i + 1);
			return false;
		}
		// File bytes (code images, preinitialized data) into host storage.
		if (foff && foff + len <= image_size)
			memcpy(segs[i].base, image + foff, len);
		// Selector aliasing the segment storage; keep lin = paragraph
		// linear so get-base and the PM-vector IVT mirror stay consistent.
		dw sel = m2c_ldt_alloc(1);
		if (!sel) return false;
		PmDesc& d = m2c_ldt[m2c_ldt_idx(sel)];
		d.base = segs[i].base;
		d.lin = (dd)segs[i].para << 4;
		segs[i].selector = sel;
	}
	// Module-reference table -> imported module names (for diagnostics).
	const dw nmods = ne_w(hdr + 0x1e);
	const db* mrt  = hdr + ne_w(hdr + 0x28);   // module-reference table
	const db* itab = hdr + ne_w(hdr + 0x2a);   // imported names table
	for (dw mi = 0; mi < nmods && mi < 32 && mrt + 2 * mi + 2 <= image + image_size; ++mi) {
		const db* np = itab + ne_w(mrt + 2 * mi);
		dw nl = np[0]; if (nl > 15) nl = 15;
		if (np + 1 + nl <= image + image_size) {
			memcpy(s_ne_mod_names[mi], np + 1, nl);
			s_ne_mod_names[mi][nl] = 0;
		}
	}
	// Relocation records.
	// Non-additive records (flag bit2 clear) are CHAIN records: the stored
	// word at each site holds the offset of the next site and 0xffff ends
	// the list; the record supplies the whole fixup value.  Additive records
	// are single sites whose stored word is an addend to the record target.
	//   rtype&3 == 0  internal ref  -> seg selector / target offset
	//   rtype&3 == 1  imported ordinal / 2 imported name -> sentinel 0000:80NN
	//   rtype&3 == 3  osfixup (x87 emulator patching) -> skipped: real FPU
	for (int i = 0; i < nseg; ++i) {
		const db* e = stab + i * 8;
		dd  foff  = (dd)ne_w(e) << shift;
		dd  len   = ne_w(e + 2); if (!len) len = 0x10000;
		if (!(segs[i].flags & 0x0100)) continue;  // no relocations
		dd rp = foff + len;
		if (rp + 2 > image_size) break;
		dw count = ne_w(image + rp);
		rp += 2;
		for (dw r = 0; r < count && rp + 8 <= image_size; ++r, rp += 8) {
			const db* rec = image + rp;
			const db atype = rec[0];
			const db rtype = rec[1];
			const dw rkind = rtype & 3;
			const bool additive = (rtype & 4) != 0;
			if (rkind == 3) continue;
			dw off = ne_w(rec + 2);
			dw guard = 0;
			if (rkind == 1 || rkind == 2) {
				const dw mod = ne_w(rec + 4);
				const dw ord = ne_w(rec + 6);
				const dw sentinel = (dw)(0x8000 | ne_import_add(mod, ord));
				do {
					db* loc = segs[i].base + off;
					dw link = ne_w(loc);
					switch (atype) {
					case 2: *(dw*)loc = 0; break;                            // seg word -> null
					case 3: *(dw*)loc = sentinel; *(dw*)(loc + 2) = 0; break; // far ptr -> 0000:80NN
					case 5: *(dw*)loc = sentinel; break;                     // off16 -> sentinel
					default: log_error("NE load: import addr type %u\n", atype); break;
					}
					off = additive ? 0xffff : link;
				} while (off != 0xffff && ++guard < 0x8000);
				continue;
			}
			const dw tseg = ne_w(rec + 4);
			const dw toff = ne_w(rec + 6);
			if (!tseg || tseg > nseg) continue;
			const dw tsel = segs[tseg - 1].selector;
			do {
				db* loc = segs[i].base + off;
				dw link = ne_w(loc);
				switch (atype) {
				case 2: ne_w_set(loc, tsel); break;                     // selector word
				case 3: ne_w_set(loc, toff); ne_w_set(loc + 2, tsel); break; // far ptr
				case 5: ne_w_set(loc, additive ? (dw)(link + toff) : toff); break;
				default:
					log_error("NE load: addr type %u unsupported\n", atype);
				}
				off = additive ? 0xffff : link;
			} while (off != 0xffff && ++guard < 0x8000);
		}
	}
	cs  = segs[cs_idx - 1].selector;
	eip = entry_ip;
	if (ss_idx) { ss = segs[ss_idx - 1].selector; }
	sp  = entry_sp ? entry_sp : (dw)(STACK_SIZE - 4);
	if (ds_idx) { ds = es = segs[ds_idx - 1].selector; }
	log_debug("NE load: entry %04x:%04x stack %04x:%04x ds %04x (%u segs)\n",
	          cs, entry_ip, ss, sp, ds, nseg);
	return true;
}
db* m2c_alloc_segment_raddr(dw segment, dw offset) {
	const PmDesc& d = m2c_ldt[m2c_ldt_idx(segment)];
	// Only values with the LDT table-indicator bit (sel&4) are selectors;
	// plain paragraphs fall through to the `m` view.  Lenient on the limit:
	// blocks are backed by 64KB so every 16-bit offset resolves; the limit
	// is recorded for get/set fidelity.
	if ((segment & 4) && d.used && d.base)
		return d.base + offset;
	return nullptr;
}

// Protected-mode vectors installed via INT31 0203/0205 (CX:EDX = sel:eip).
// Recorded verbatim for faithful get/set round-trips; additionally mirrored
// into the real-mode IVT when the handler selector aliases `m`.
static dw pm_vec_sel[256];
static dd pm_vec_off[256];
static db pm_vec_set[256];
/* Real-mode IVT entries installed via int21 ah=25h are program vectors: their
   segment is the translated code's (opaque, often >=0xa000), so host_fire_ivt
   must not discard them as BIOS/adapter-ROM vectors. BIOS-resident entries the
   program never overwrote keep the >=0xa000 filter. */
static db rm_vec_set[256];

// Compatibility name used by NE/RTM-style translated programs (asm.h).
// Weak so a program harness can substitute its own allocator.
__attribute__((weak)) dw tlink_rtm_alloc_paras(dw paras) { return m2c_pm_alloc_paras(paras); }

// DOS file-handle table: handles 0..4 are the predefined std devices;
// regular files occupy 5..N (like DOS's SFT).
static dw dta_seg = 0;   // guest-visible seg:off of the DTA (as set by AH=1Ah)
static dw dta_off = 0x80;
static FILE * dos_files[0x40] = {};
static const dw DOS_HANDLE_BASE = 5;
static int dos_last_child_rc = 0;
static FILE * dos_std[5] = {};
static FILE * dos_get_file(dw h) {
	if (h < DOS_HANDLE_BASE) {
		// Predefined DOS devices 0..4 (stdin/stdout/stderr/aux/prn). Map to
		// dup'd host stdio so guest dup()/close() on them is harmless.
		if (!dos_std[h]) {
			FILE * sf = (h == 0) ? stdin : (h == 1) ? stdout : (h == 2) ? stderr
				: (h == 3) ? stdout : stderr;
			int fd = dup(fileno(sf));
			int acc = fd >= 0 ? (fcntl(fd, F_GETFL) & O_ACCMODE) : -1;
			const char * sm = acc == O_RDONLY ? "r" : acc == O_WRONLY ? "a" : "r+";
			dos_std[h] = fd >= 0 ? fdopen(fd, sm) : nullptr;
		}
		return dos_std[h];
	}
	if (h - DOS_HANDLE_BASE >= 0x40) return nullptr;
	return dos_files[h - DOS_HANDLE_BASE];
}
static dw dos_alloc_handle(FILE * f) {
	for (dw h = 0; h < 0x40; ++h)
		if (!dos_files[h]) { dos_files[h] = f; return DOS_HANDLE_BASE + h; }
	fclose(f);
	return 0xffff;
}

// DOS file names are case-insensitive. Resolve a guest path against the
// host filesystem component-by-component, folding case via directory
// listing, so "hello.obj" finds "HELLO.OBJ". Returns true on success.
static bool dos_resolve_case(const char *path, char *out, size_t outsz) {
	if (!path || !*path || !out || outsz < 2) return false;
	char buf[1024];
	std::snprintf(buf, sizeof(buf), "%s", path);
	for (char *p = buf; *p; ++p) if (*p == '\\') *p = '/';
	std::string resolved;
	size_t pos = 0;
	if (buf[0] == '/') { resolved = "/"; pos = 1; }
	while (pos <= strlen(buf)) {
		const char *sep = strchr(buf + pos, '/');
		size_t len = sep ? (size_t)(sep - (buf + pos)) : strlen(buf + pos);
		if (len == 0) {
			if (!sep) break;
			pos += 1;
			continue;
		}
		char comp[256];
		if (len >= sizeof(comp)) return false;
		std::memcpy(comp, buf + pos, len);
		comp[len] = 0;
		const char *dir = resolved.empty() ? "." : resolved.c_str();
		// exact match first
		std::string cand = resolved + comp;
		if (access(cand.c_str(), F_OK) != 0) {
			DIR *d = opendir(dir);
			if (!d) return false;
			struct dirent *e;
			bool found = false;
			while ((e = readdir(d))) {
				if (!strcasecmp(e->d_name, comp)) {
					cand = resolved + e->d_name;
					found = true;
					break;
				}
			}
			closedir(d);
			if (!found) return false;
		}
		resolved = cand;
		if (!sep) break;
		resolved += "/";
		pos += len + 1;
	}
	if (resolved.size() >= outsz) return false;
	std::memcpy(out, resolved.c_str(), resolved.size() + 1);
	return true;
}
//#include "memmgr.c"


bool isLittle;
bool jumpToBackGround;
//char *path;
bool executionFinished;
db exitCode;

FILE * logDebug=NULL;

struct HostMouse {
	bool installed = true;
	bool visible = false;
	int x = 160;
	int y = 100;
	int last_x = 160;
	int last_y = 100;
	int min_x = 0;
	int max_x = 319;
	int min_y = 0;
	int max_y = 199;
	int buttons = 0;
	int motion_x = 0;
	int motion_y = 0;
};

struct HostVga {
	static const int TEXT_PAGES = 8;
	static const int TEXT_ROWS = 25;
	static const int TEXT_COLS = 80;
	struct TextCell {
		db ch = ' ';
		db attr = 0x07;
	};
	db seq_index = 0;
	db gc_index = 0;
	db crtc_index = 0;
	db attr_index = 0;
	bool attr_waiting_for_index = true;
	db seq_regs[0x100] = {};
	db gc_regs[0x100] = {};
	db crtc_regs[0x100] = {};
	db attr_regs[0x100] = {};
	size_t dac_read_index = 0;
	size_t dac_write_index = 0;
	size_t dac_write_start = 0;
	size_t dac_write_count = 0;
	db cursor_start = 0;
	db cursor_end = 0;
	db current_mode = 3;
	db active_page = 0;
	db cursor_row[TEXT_PAGES] = {};
	db cursor_col[TEXT_PAGES] = {};
	TextCell text[TEXT_PAGES][TEXT_ROWS][TEXT_COLS] = {};
	// CGA graphics-mode state (modes 4/5 = 320x200x2bpp, 6 = 640x200x1bpp):
	// pixel data lives in guest VRAM at B800:0000/B800:2000 and is rasterized
	// from `m` directly. These mirror the BIOS color-select/int10-AH=0Bh
	// settings plus a per-cell char shadow so AH=08 read-back works (the real
	// BIOS pattern-matches pixels; keeping the written char is equivalent for
	// software that reads back what it wrote, e.g. GW-BASIC's screen editor).
	db cga_color_select = 0;   // int10 AH=0Bh BH=0: low nibble bg(med res)/fg(hi res), bit4 intensity
	db cga_palette = 0;        // int10 AH=0Bh BH=1: bit0 = palette 0/1
	db cga_cells[TEXT_ROWS][TEXT_COLS] = {};
};

struct HostPit {
	db channel0_latch = 0;
	bool channel0_waiting_high = false;
	db channel0_low = 0;
	uint16_t channel0_divisor = 0;
};

struct HostTimer {
	bool enabled = false;
	bool in_callback = false;
	std::atomic<bool> background_running{false};
	std::atomic<bool> irq_running{false};
	uint64_t last_us = 0;
	uint64_t accum_us = 0;
	int divider_20hz = 0;
};

struct HostHardware {
	HostMouse mouse;
	HostVga vga;
	HostPit pit;
	HostTimer timer;
	dw current_psp = M2C_PSP_SEG;
	db ppi_port_b = 0;
	db keyboard_scan_code = 0;
	dw keyboard_buffer[16] = {};
	db keyboard_head = 0;
	db keyboard_tail = 0;
	// Segments populated by EXEC AL=03h overlay loads (e.g. MSC sound drivers).
	// Their x86 code is not translated; far calls into them are treated as
	// no-ops by dispatch_external_code, which emulates the driver's retf.
	std::vector<std::pair<dw, dw>> overlay_segs;
};

static HostHardware host;

// Accessor for NE-harness glue (zeek16.cpp) which installs a fake PSP after
// segment binding; HostHardware itself is file-local.
void m2c_set_current_psp(dw psp) { host.current_psp = psp; }
dw m2c_current_psp() { return host.current_psp; }

bool is_dos_terminate_vector(dw segment, dw offset) {
	// 0:0 is the sentinel pushed for synthesized interrupt frames (IVT IRQ
	// delivery); reaching it means unwind to C++, not program termination.
	if (segment == 0 && offset == 0) {
		return true;
	}
	if (segment != host.current_psp || offset != 0) {
		return false;
	}
	log_error("terminate vector hit at %x:%x\n", segment, offset);
	jumpToBackGround = true;
	executionFinished = true;
	exitCode = 0;
	return true;
}

static db* host_physical_address(dw segment, dw offset) {
	// A translated overlay's image lives in its private buffer: the EXEC load
	// segment may alias regions the game writes through, so the image must not
	// sit inside struct Memory's heap.
	if (m2c_overlay_module* mod = m2c_overlay_image_at(segment, offset))
		return mod->img + ((segment - mod->seg) << 4) + offset;
	// PM selectors resolve through the emulated LDT (DOS services given a
	// selector must see the same memory the guest sees).
	if (db* sel_mem = m2c_alloc_segment_raddr(segment, offset))
		return sel_mem;
	return reinterpret_cast<db*>(&m2c::m) + (static_cast<size_t>(segment) << 4) + offset;
}

static db host_text_page(db page) {
	return page < HostVga::TEXT_PAGES ? page : 0;
}

static db host_text_row(db row) {
	return row < HostVga::TEXT_ROWS ? row : HostVga::TEXT_ROWS - 1;
}

static db host_text_col(db col) {
	return col < HostVga::TEXT_COLS ? col : HostVga::TEXT_COLS - 1;
}

// Guest-visible text VRAM page inside `m`. BIOS mode-2/3 pages are 0x1000
// bytes each at B800:0000 — int10 text services must keep this region in
// sync with the host.vga.text shadow so direct-VRAM programs (GW-BASIC
// writes through ES=B800) and BIOS-driven programs see identical memory.
static db* host_text_vram_page(db page) {
	return reinterpret_cast<db*>(&m2c::m) + 0xB8000 +
	       static_cast<size_t>(host_text_page(page)) * 0x1000;
}

static void host_text_clear_page(db page, db attr = 0x07) {
	page = host_text_page(page);
	db *vram = host_text_vram_page(page);
	for (int row = 0; row < HostVga::TEXT_ROWS; ++row) {
		for (int col = 0; col < HostVga::TEXT_COLS; ++col) {
			host.vga.text[page][row][col].ch = ' ';
			host.vga.text[page][row][col].attr = attr;
			vram[(row * HostVga::TEXT_COLS + col) * 2] = ' ';
			vram[(row * HostVga::TEXT_COLS + col) * 2 + 1] = attr;
		}
	}
	host.vga.cursor_row[page] = 0;
	host.vga.cursor_col[page] = 0;
}

static void host_text_clear_all(db attr = 0x07) {
	for (int page = 0; page < HostVga::TEXT_PAGES; ++page) {
		host_text_clear_page(static_cast<db>(page), attr);
	}
}

static void host_text_scroll_up_window(db page, db attr, db top, db left, db bottom, db right, db lines) {
	page = host_text_page(page);
	top = host_text_row(top);
	bottom = host_text_row(bottom);
	left = host_text_col(left);
	right = host_text_col(right);
	if (top > bottom || left > right) {
		return;
	}
	if (lines == 0 || lines > bottom - top + 1) {
		lines = static_cast<db>(bottom - top + 1);
	}
	db *vram = host_text_vram_page(page);
	for (int row = top; row <= bottom; ++row) {
		const int src_row = row + lines;
		for (int col = left; col <= right; ++col) {
			const int cell = (row * HostVga::TEXT_COLS + col) * 2;
			if (src_row <= bottom) {
				host.vga.text[page][row][col] = host.vga.text[page][src_row][col];
				const int src_cell = (src_row * HostVga::TEXT_COLS + col) * 2;
				vram[cell] = vram[src_cell];
				vram[cell + 1] = vram[src_cell + 1];
			} else {
				host.vga.text[page][row][col].ch = ' ';
				host.vga.text[page][row][col].attr = attr;
				vram[cell] = ' ';
				vram[cell + 1] = attr;
			}
		}
	}
}

static void host_text_write(db page, db row, db col, db ch, db attr, dw count) {
	page = host_text_page(page);
	size_t pos = static_cast<size_t>(host_text_row(row)) * HostVga::TEXT_COLS + host_text_col(col);
	const size_t cells = HostVga::TEXT_ROWS * HostVga::TEXT_COLS;
	db *vram = host_text_vram_page(page);
	for (dw n = 0; n < count && pos < cells; ++n, ++pos) {
		host.vga.text[page][pos / HostVga::TEXT_COLS][pos % HostVga::TEXT_COLS].ch = ch;
		host.vga.text[page][pos / HostVga::TEXT_COLS][pos % HostVga::TEXT_COLS].attr = attr;
		vram[pos * 2] = ch;
		vram[pos * 2 + 1] = attr;
	}
}

// ---------------------------------------------------------------------------
// CGA graphics-mode support (BIOS modes 4/5 = 320x200 2bpp, 6 = 640x200 1bpp).
// Pixel memory is interleaved at B800:0000 (even rows) and B800:2000 (odd).
// Programs like GW-BASIC write pixels directly through ES=B800 and emit text
// via BIOS int10 AH=09; this rasterizes both paths deterministically from `m`.
// ---------------------------------------------------------------------------

// Standard 8x8 VGA/CGA BIOS font for chars 0x20-0x7f (public domain,
// font8x8_basic). Rows are byte bitmaps, MSB = leftmost pixel.
static const db cga_font8x8[96][8] = {
	{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}, // 0x20 ' '
	{0x18,0x3c,0x3c,0x18,0x18,0x00,0x18,0x00}, // 0x21 '!'
	{0x36,0x36,0x00,0x00,0x00,0x00,0x00,0x00}, // 0x22 '"'
	{0x36,0x36,0x7f,0x36,0x7f,0x36,0x36,0x00}, // 0x23 '#'
	{0x0c,0x3e,0x03,0x1e,0x30,0x1f,0x0c,0x00}, // 0x24 '$'
	{0x00,0x63,0x33,0x18,0x0c,0x66,0x63,0x00}, // 0x25 '%'
	{0x1c,0x36,0x1c,0x6e,0x3b,0x33,0x6e,0x00}, // 0x26 '&'
	{0x06,0x06,0x03,0x00,0x00,0x00,0x00,0x00}, // 0x27 '\''
	{0x18,0x0c,0x06,0x06,0x06,0x0c,0x18,0x00}, // 0x28 '('
	{0x06,0x0c,0x18,0x18,0x18,0x0c,0x06,0x00}, // 0x29 ')'
	{0x00,0x66,0x3c,0xff,0x3c,0x66,0x00,0x00}, // 0x2a '*'
	{0x00,0x0c,0x0c,0x3f,0x0c,0x0c,0x00,0x00}, // 0x2b '+'
	{0x00,0x00,0x00,0x00,0x00,0x0c,0x0c,0x06}, // 0x2c ','
	{0x00,0x00,0x00,0x3f,0x00,0x00,0x00,0x00}, // 0x2d '-'
	{0x00,0x00,0x00,0x00,0x00,0x0c,0x0c,0x00}, // 0x2e '.'
	{0x60,0x30,0x18,0x0c,0x06,0x03,0x01,0x00}, // 0x2f '/'
	{0x3e,0x63,0x73,0x7b,0x6f,0x67,0x3e,0x00}, // 0x30 '0'
	{0x0c,0x0e,0x0c,0x0c,0x0c,0x0c,0x3f,0x00}, // 0x31 '1'
	{0x1e,0x33,0x30,0x1c,0x06,0x33,0x3f,0x00}, // 0x32 '2'
	{0x1e,0x33,0x30,0x1c,0x30,0x33,0x1e,0x00}, // 0x33 '3'
	{0x38,0x3c,0x36,0x33,0x7f,0x30,0x78,0x00}, // 0x34 '4'
	{0x3f,0x03,0x1f,0x30,0x30,0x33,0x1e,0x00}, // 0x35 '5'
	{0x1c,0x06,0x03,0x1f,0x33,0x33,0x1e,0x00}, // 0x36 '6'
	{0x3f,0x33,0x30,0x18,0x0c,0x0c,0x0c,0x00}, // 0x37 '7'
	{0x1e,0x33,0x33,0x1e,0x33,0x33,0x1e,0x00}, // 0x38 '8'
	{0x1e,0x33,0x33,0x3e,0x30,0x18,0x0e,0x00}, // 0x39 '9'
	{0x00,0x0c,0x0c,0x00,0x00,0x0c,0x0c,0x00}, // 0x3a ':'
	{0x00,0x0c,0x0c,0x00,0x00,0x0c,0x0c,0x06}, // 0x3b ';'
	{0x18,0x0c,0x06,0x03,0x06,0x0c,0x18,0x00}, // 0x3c '<'
	{0x00,0x00,0x3f,0x00,0x00,0x3f,0x00,0x00}, // 0x3d '='
	{0x06,0x0c,0x18,0x30,0x18,0x0c,0x06,0x00}, // 0x3e '>'
	{0x1e,0x33,0x30,0x18,0x0c,0x00,0x0c,0x00}, // 0x3f '?'
	{0x3e,0x63,0x7b,0x7b,0x7b,0x03,0x1e,0x00}, // 0x40 '@'
	{0x0c,0x1e,0x33,0x33,0x3f,0x33,0x33,0x00}, // 0x41 'A'
	{0x3f,0x66,0x66,0x3e,0x66,0x66,0x3f,0x00}, // 0x42 'B'
	{0x3c,0x66,0x03,0x03,0x03,0x66,0x3c,0x00}, // 0x43 'C'
	{0x1f,0x36,0x66,0x66,0x66,0x36,0x1f,0x00}, // 0x44 'D'
	{0x7f,0x46,0x16,0x1e,0x16,0x46,0x7f,0x00}, // 0x45 'E'
	{0x7f,0x46,0x16,0x1e,0x16,0x06,0x0f,0x00}, // 0x46 'F'
	{0x3c,0x66,0x03,0x03,0x73,0x66,0x7c,0x00}, // 0x47 'G'
	{0x33,0x33,0x33,0x3f,0x33,0x33,0x33,0x00}, // 0x48 'H'
	{0x1e,0x0c,0x0c,0x0c,0x0c,0x0c,0x1e,0x00}, // 0x49 'I'
	{0x78,0x30,0x30,0x30,0x33,0x33,0x1e,0x00}, // 0x4a 'J'
	{0x67,0x66,0x36,0x1e,0x36,0x66,0x67,0x00}, // 0x4b 'K'
	{0x0f,0x06,0x06,0x06,0x46,0x66,0x7f,0x00}, // 0x4c 'L'
	{0x63,0x77,0x7f,0x7f,0x6b,0x63,0x63,0x00}, // 0x4d 'M'
	{0x63,0x67,0x6f,0x7b,0x73,0x63,0x63,0x00}, // 0x4e 'N'
	{0x1c,0x36,0x63,0x63,0x63,0x36,0x1c,0x00}, // 0x4f 'O'
	{0x3f,0x66,0x66,0x3e,0x06,0x06,0x0f,0x00}, // 0x50 'P'
	{0x1e,0x33,0x33,0x33,0x3b,0x1e,0x38,0x00}, // 0x51 'Q'
	{0x3f,0x66,0x66,0x3e,0x36,0x66,0x67,0x00}, // 0x52 'R'
	{0x1e,0x33,0x07,0x0e,0x38,0x33,0x1e,0x00}, // 0x53 'S'
	{0x3f,0x2d,0x0c,0x0c,0x0c,0x0c,0x1e,0x00}, // 0x54 'T'
	{0x33,0x33,0x33,0x33,0x33,0x33,0x3f,0x00}, // 0x55 'U'
	{0x33,0x33,0x33,0x33,0x33,0x1e,0x0c,0x00}, // 0x56 'V'
	{0x63,0x63,0x63,0x6b,0x7f,0x77,0x63,0x00}, // 0x57 'W'
	{0x63,0x63,0x36,0x1c,0x1c,0x36,0x63,0x00}, // 0x58 'X'
	{0x33,0x33,0x33,0x1e,0x0c,0x0c,0x1e,0x00}, // 0x59 'Y'
	{0x7f,0x63,0x31,0x18,0x4c,0x66,0x7f,0x00}, // 0x5a 'Z'
	{0x1e,0x06,0x06,0x06,0x06,0x06,0x1e,0x00}, // 0x5b '['
	{0x03,0x06,0x0c,0x18,0x30,0x60,0x40,0x00}, // 0x5c '\'
	{0x1e,0x18,0x18,0x18,0x18,0x18,0x1e,0x00}, // 0x5d ']'
	{0x08,0x1c,0x36,0x63,0x00,0x00,0x00,0x00}, // 0x5e '^'
	{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xff}, // 0x5f '_'
	{0x0c,0x0c,0x18,0x00,0x00,0x00,0x00,0x00}, // 0x60 '`'
	{0x00,0x00,0x1e,0x30,0x3e,0x33,0x6e,0x00}, // 0x61 'a'
	{0x07,0x06,0x06,0x3e,0x66,0x66,0x3b,0x00}, // 0x62 'b'
	{0x00,0x00,0x1e,0x33,0x03,0x33,0x1e,0x00}, // 0x63 'c'
	{0x38,0x30,0x30,0x3e,0x33,0x33,0x6e,0x00}, // 0x64 'd'
	{0x00,0x00,0x1e,0x33,0x3f,0x03,0x1e,0x00}, // 0x65 'e'
	{0x1c,0x36,0x06,0x0f,0x06,0x06,0x0f,0x00}, // 0x66 'f'
	{0x00,0x00,0x6e,0x33,0x33,0x3e,0x30,0x1f}, // 0x67 'g'
	{0x07,0x06,0x36,0x6e,0x66,0x66,0x67,0x00}, // 0x68 'h'
	{0x0c,0x00,0x0e,0x0c,0x0c,0x0c,0x1e,0x00}, // 0x69 'i'
	{0x30,0x00,0x30,0x30,0x30,0x33,0x33,0x1e}, // 0x6a 'j'
	{0x07,0x06,0x66,0x36,0x1e,0x36,0x67,0x00}, // 0x6b 'k'
	{0x0e,0x0c,0x0c,0x0c,0x0c,0x0c,0x1e,0x00}, // 0x6c 'l'
	{0x00,0x00,0x33,0x7f,0x7f,0x6b,0x63,0x00}, // 0x6d 'm'
	{0x00,0x00,0x1f,0x33,0x33,0x33,0x33,0x00}, // 0x6e 'n'
	{0x00,0x00,0x1e,0x33,0x33,0x33,0x1e,0x00}, // 0x6f 'o'
	{0x00,0x00,0x3b,0x66,0x66,0x3e,0x06,0x0f}, // 0x70 'p'
	{0x00,0x00,0x6e,0x33,0x33,0x3e,0x30,0x78}, // 0x71 'q'
	{0x00,0x00,0x3b,0x6e,0x66,0x06,0x0f,0x00}, // 0x72 'r'
	{0x00,0x00,0x3e,0x03,0x1e,0x30,0x1f,0x00}, // 0x73 's'
	{0x08,0x0c,0x3e,0x0c,0x0c,0x2c,0x18,0x00}, // 0x74 't'
	{0x00,0x00,0x33,0x33,0x33,0x33,0x6e,0x00}, // 0x75 'u'
	{0x00,0x00,0x33,0x33,0x33,0x1e,0x0c,0x00}, // 0x76 'v'
	{0x00,0x00,0x63,0x6b,0x7f,0x7f,0x36,0x00}, // 0x77 'w'
	{0x00,0x00,0x63,0x36,0x1c,0x36,0x63,0x00}, // 0x78 'x'
	{0x00,0x00,0x33,0x33,0x33,0x3e,0x30,0x1f}, // 0x79 'y'
	{0x00,0x00,0x3f,0x19,0x0c,0x26,0x3f,0x00}, // 0x7a 'z'
	{0x38,0x0c,0x0c,0x07,0x0c,0x0c,0x38,0x00}, // 0x7b '{'
	{0x18,0x18,0x18,0x00,0x18,0x18,0x18,0x00}, // 0x7c '|'
	{0x07,0x0c,0x0c,0x38,0x0c,0x0c,0x07,0x00}, // 0x7d '}'
	{0x6e,0x3b,0x00,0x00,0x00,0x00,0x00,0x00}, // 0x7e '~'
	{0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00}, // 0x7f
};

static bool host_gfx_mode() {
	return host.vga.current_mode == 0x04 || host.vga.current_mode == 0x05 ||
	       host.vga.current_mode == 0x06;
}

// Text-cell columns for the current mode: med-res (4/5) = 40, hi-res (6) = 80.
static int cga_text_cols() {
	return host.vga.current_mode == 0x06 ? 80 : 40;
}

static const db* cga_glyph(db ch) {
	if (ch >= 0x20 && ch < 0x7f) return cga_font8x8[ch - 0x20];
	static const db blank[8] = {0};
	return ch == 0 ? blank : cga_font8x8['?' - 0x20];
}

// CGA byte address of pixel row y, byte-column bx: even scanlines at
// B800:0000 (80 bytes/row), odd at B800:2000.
static db* cga_scanline(int y) {
	return reinterpret_cast<db*>(&m2c::m) + 0xB8000 +
	       (y & 1) * 0x2000 + (y >> 1) * 80;
}

// Write/erase a packed 2bpp pixel pair inside byte `off` — modes 4/5.
// Each byte holds 4 pixels; a "dot" = one pixel of value v (0-3).
static void cga2_set_pixel(int y, int x, int v, bool xormode) {
	db* base = cga_scanline(y);
	int off = x >> 2, shift = (3 - (x & 3)) * 2;
	if (xormode) {
		base[off] ^= (v << shift);
	} else {
		base[off] = (base[off] & ~(0x03 << shift)) | ((v & 3) << shift);
	}
}

// Mode 6: 1 pixel/bit, 8 pixels/byte.
static void cga1_set_pixel(int y, int x, int v, bool xormode) {
	db* base = cga_scanline(y);
	int off = x >> 3, bit = 7 - (x & 7);
	if (xormode) {
		base[off] ^= (v << bit);
	} else if (v) {
		base[off] |= (1 << bit);
	} else {
		base[off] &= ~(1 << bit);
	}
}

// BIOS int10 AH=09 in graphics modes: draw one 8x8 glyph cell at text
// (row,col). BL low bits = pixel value for set bits (2bpp: 0-3, 1bpp: 0-1);
// BL bit7 = XOR onto existing pixels. Also records the char in cga_cells so
// AH=08 read-back works (the BIOS equivalent pattern-matches glyph shapes).
static void cga_draw_cell(db row, db col, db ch, db attr) {
	if (row >= HostVga::TEXT_ROWS || col >= (db)cga_text_cols()) return;
	const db* glyph = cga_glyph(ch);
	const bool xormode = (attr & 0x80) != 0;
	const int px = (host.vga.current_mode == 0x06) ? (attr & 1) : (attr & 3);
	for (int gy = 0; gy < 8; ++gy) {
		const int y = row * 8 + gy;
		db bits = glyph[gy];
		for (int gx = 0; gx < 8; ++gx) {
			const int x = col * 8 + gx;
			const int v = (bits & (0x01 << gx)) ? px : 0; // font is LSB-left
			if (host.vga.current_mode == 0x06) {
				cga1_set_pixel(y, x, v, xormode && v);
			} else {
				cga2_set_pixel(y, x, v, xormode);
			}
		}
	}
	host.vga.cga_cells[row][col] = ch;
}

// BIOS scroll-up (AH=06) for graphics modes: shifts `lines` text rows (8
// pixel rows each) inside the given cell window; CGA banks shift separately.
static void cga_scroll_up_window(db top, db left, db bottom, db right, db lines) {
	if (top > bottom || left > right) return;
	bottom = host_text_row(bottom);
	if (right >= (db)cga_text_cols()) right = cga_text_cols() - 1;
	if (lines == 0 || lines > bottom - top + 1) lines = bottom - top + 1;
	const int w = right - left + 1;
	const int bpc = host.vga.current_mode == 0x06 ? 1 : 2; // bytes per cell
	for (int row = top; row <= bottom; ++row) {
		const int src = row + lines;
		for (int gy = 0; gy < 8; ++gy) {
			const int y = row * 8 + gy;
			db* dst = cga_scanline(y) + left * bpc;
			if (src <= bottom) {
				memcpy(dst, cga_scanline(src * 8 + gy) + left * bpc, w * bpc);
			} else {
				memset(dst, 0, w * bpc);
			}
		}
		for (int col = left; col <= right; ++col) {
			host.vga.cga_cells[row][col] =
			    (src <= bottom) ? host.vga.cga_cells[src][col] : (db)' ';
		}
	}
}

static void cga_clear_screen() {
	memset(reinterpret_cast<db*>(&m2c::m) + 0xB8000, 0, 0x4000);
	memset(host.vga.cga_cells, ' ', sizeof(host.vga.cga_cells));
}

static void vga_set_mode13_defaults() {
	host.vga.seq_regs[2] = 0x0f; // map mask: all planes writable
	host.vga.seq_regs[4] = 0x0e; // extended memory, odd/even disabled, chain-4 enabled
	host.vga.gc_regs[4] = 0x00;  // read map select
	host.vga.gc_regs[5] = 0x40;  // 256-color shift mode, write mode 0
	host.vga.crtc_regs[0x0c] = 0;
	host.vga.crtc_regs[0x0d] = 0;
}

static bool m2c_stats_enabled() {
	const char *enabled = std::getenv("M2C_VGA_STATS");
	return enabled && *enabled;
}

static bool bytes_have_nonzero(const db *data, size_t size) {
	for (size_t i = 0; i < size; ++i) {
		if (data[i] != 0) {
			return true;
		}
	}
	return false;
}

static db *translated_data_symbol_address(db *symbol_storage) {
	if (!symbol_storage) {
		return NULL;
	}
	db *target = NULL;
	std::copy(
		symbol_storage,
		symbol_storage + sizeof(target),
		reinterpret_cast<db *>(&target)
	);
	const uintptr_t target_addr = reinterpret_cast<uintptr_t>(target);
	const uintptr_t memory_addr = reinterpret_cast<uintptr_t>(&m);
	if (target_addr >= memory_addr && target_addr - memory_addr < 64u * 1024u * 1024u) {
		return target;
	}
	return symbol_storage;
}

db *m2c_data_symbol_address(db *symbol_storage) {
	return translated_data_symbol_address(symbol_storage);
}

static void maybe_apply_registered_palette() {
	if (!g_palette_mapped) {
		return;
	}

	db *rgb_data = translated_data_symbol_address(g_palette_map.dst_b);
	db *panel = translated_data_symbol_address(g_palette_map.dst_a);
	db *panel1 = translated_data_symbol_address(g_palette_map.src);
	db *palette_flag = translated_data_symbol_address(g_palette_map.flag);
	if (!rgb_data || !panel || !panel1 || !palette_flag) {
		return;
	}
	if (!bytes_have_nonzero(panel1, g_palette_map.size)) {
		return;
	}
	if (bytes_have_nonzero(rgb_data + g_palette_map.start, g_palette_map.size)
		|| bytes_have_nonzero(panel, g_palette_map.size)) {
		return;
	}

	std::copy(panel1, panel1 + g_palette_map.size, panel);
	std::copy(panel1, panel1 + g_palette_map.size, rgb_data + g_palette_map.start);
	std::copy(panel1, panel1 + g_palette_map.size, vgaPalette + g_palette_map.start);
	*palette_flag = 1;
	if (m2c_stats_enabled()) {
		std::fprintf(stderr, "vga panel palette initialized from registered palette map\n");
	}
}

static void vga_maybe_dump_dac_upload() {
	if (!m2c_stats_enabled() || host.vga.dac_write_start != 0 || host.vga.dac_write_count != 256 * 3) {
		return;
	}
	static unsigned upload_count = 0;
	++upload_count;
	std::fprintf(stderr, "vga dac upload #%u:", upload_count);
	const db colors[] = {0x00, 0x85, 0x96, 0xa0, 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xcf};
	for (size_t i = 0; i < sizeof(colors) / sizeof(colors[0]); ++i) {
		const size_t index = static_cast<size_t>(colors[i]) * 3;
		std::fprintf(
			stderr,
			" #%02x(%u,%u,%u)",
			colors[i],
			static_cast<unsigned>(vgaPalette[index]),
			static_cast<unsigned>(vgaPalette[index + 1]),
			static_cast<unsigned>(vgaPalette[index + 2])
		);
	}
	std::fprintf(stderr, "\n");
}

/* Deterministic frame machinery: VGA-state only (host.vga registers), so it
 * must live outside the SDL block to stay available in headless NOSDL builds. */
static size_t vga_crtc_start_byte_offset() {
	const size_t crtc_start = (static_cast<size_t>(host.vga.crtc_regs[0x0c]) << 8) | host.vga.crtc_regs[0x0d];
	if (host.vga.current_mode == 0x13 && (host.vga.seq_regs[4] & 0x08) == 0) {
		/* Unchained (mode-X style) plane addressing: the start-address units
		 * follow the CRTC addressing mode -- dword mode (CRTC 0x14 bit6)
		 * scales x4, word mode (CRTC 0x17 bit6=0) x2, byte mode (bit6=1) x1.
		 * Tornado programs the start directly in plane bytes ({0, 0x4000}),
		 * so byte mode must not scale or the display reads the wrong page. */
		if (host.vga.crtc_regs[0x14] & 0x40) {
			return (crtc_start * 4) % VGA_WINDOW_SIZE;
		}
		if ((host.vga.crtc_regs[0x17] & 0x40) == 0) {
			return (crtc_start * 2) % VGA_WINDOW_SIZE;
		}
	}
	return crtc_start % VGA_WINDOW_SIZE;
}

// (the real per-frame boundary, unlike the CRTC-start flip which the game only
// touches a few times). host_run_timer fires IRQ0 det_step times per render so
// the game's 100Hz ISR (and the counters it drives) advances a fixed count
// per rendered frame -- identical between stock and lifted builds.
static unsigned g_det_render_tick = 0;
// Deterministic flip-tick counter: bumped once per CRTC page flip = once per
// download = once per simulated game frame. Stock and lifted builds present a
// different number of times per sim frame (3DA retrace polls differ), so the
// keyscript/ST dump index and the IRQ0 drip budget must key off flips, not
// presents, to keep the two binaries sim-frame-aligned.
static unsigned g_det_flip_tick = 0;
extern "C" unsigned g_dbg_flip = 0;
static _STATE* host_irq_main_state = nullptr;

#ifndef NOSDL
 #if SDL_MAJOR_VERSION == 2
static int sdl_vga_scale(int width, int height) {
	const char *forced_scale = getenv("M2C_SDL_SCALE");
	if (forced_scale && *forced_scale) {
		int scale = atoi(forced_scale);
		return scale > 0 ? scale : 1;
	}

	SDL_DisplayMode mode;
	if (SDL_GetCurrentDisplayMode(0, &mode) == 0 && mode.w > 0 && mode.h > 0) {
		int scale_x = mode.w / width;
		int scale_y = mode.h / height;
		int scale = scale_x < scale_y ? scale_x : scale_y;
		return scale > 0 ? scale : 1;
	}

	return 4;
}

static void configure_sdl_vga_window(int width, int height) {
	if ((SDL_WasInit(SDL_INIT_VIDEO) & SDL_INIT_VIDEO) == 0) {
		SDL_Init(SDL_INIT_VIDEO);
	}

	SDL_SetHint(SDL_HINT_RENDER_SCALE_QUALITY, "0");
	const int scale = sdl_vga_scale(width, height);
	if (!window) {
		window = SDL_CreateWindow(
			"masm2c VGA",
			SDL_WINDOWPOS_CENTERED,
			SDL_WINDOWPOS_CENTERED,
			width * scale,
			height * scale,
			SDL_WINDOW_SHOWN | SDL_WINDOW_RESIZABLE | SDL_WINDOW_INPUT_FOCUS
		);
		if (window) {
			// Bring forward and take keyboard focus; a shown-but-unfocused window
			// receives no SDL_KEYDOWNs and the game appears to ignore input. WMs
			// often deny SetWindowInputFocus (focus-stealing prevention), so also
			// grab the keyboard: the window then receives key events regardless of
			// which top-level window the desktop considers focused.
			SDL_RaiseWindow(window);
			SDL_SetWindowInputFocus(window);
			SDL_SetWindowKeyboardGrab(window, SDL_TRUE);
		}
	}
	if (!renderer && window) {
		renderer = SDL_CreateRenderer(window, -1, SDL_RENDERER_ACCELERATED);
		if (!renderer) {
			renderer = SDL_CreateRenderer(window, -1, SDL_RENDERER_SOFTWARE);
		}
		if (!renderer) {
			log_error("SDL_CreateRenderer failed: %s\n", SDL_GetError());
			return;
		}
	}
	const bool logical_size_changed = vga_logical_width != width || vga_logical_height != height;
	if (window && logical_size_changed) {
		SDL_SetWindowSize(window, width * scale, height * scale);
	}
	if (renderer) {
		if (logical_size_changed && vgaTexture) {
			SDL_DestroyTexture(vgaTexture);
			vgaTexture = NULL;
		}
		SDL_RenderSetLogicalSize(renderer, width, height);
	}
	vga_logical_width = width;
	vga_logical_height = height;
}

static bool ensure_sdl_vga_window(int width, int height) {
	if (renderer && vga_logical_width == width && vga_logical_height == height) {
		return true;
	}
	configure_sdl_vga_window(width, height);
	return renderer != NULL;
}

void init_sdl_vga_window() {
	// Size for the starting mode: text modes render 640x400, CGA gfx is
	// pixel-doubled to 640x400, VGA mode 13 stays 320x200.
	if (host.vga.current_mode == 0x13) {
		configure_sdl_vga_window(320, 200);
	} else {
		configure_sdl_vga_window(640, 400);
	}
	std::fill(vgaPlanarPixels, vgaPlanarPixels + 640 * 200, 0);
	std::fill(vgaMode13Pixels, vgaMode13Pixels + VGA_WINDOW_SIZE * 4, 0);
	std::fill(vgaReadLatch, vgaReadLatch + 4, 0);
	std::fill(&vgaPendingReadLatch[0][0], &vgaPendingReadLatch[0][0] + 16, 0);
	std::fill(vgaSdlFrame, vgaSdlFrame + 640 * 400, 0xff000000u);
	vgaPendingReadLatchCount = 0;
	vgaPendingReadLatchNext = 0;
	if (!renderer) {
		return;
	}
	SDL_SetRenderDrawColor(renderer, 0, 0, 0, 255);
	SDL_RenderClear(renderer);
	SDL_RenderPresent(renderer);
	vga_render_dirty = false;
	vga_render_writes = 0;
	{static unsigned _ri=0; if (getenv("M2C_STATEDBG") && ++_ri<20) fprintf(stderr,"[initwin dirty0 #%u]\n",_ri);}
}

// ---------------------------------------------------------------------------
// Tandy 3-voice sound (SN76496 / NCR8496 compatible) on I/O port 0xC0.
// Chip model borrowed from MAME's sn76496 (via dosbox-staging), rendered
// through an SDL2 audio stream. Tandy PSG clock = 14318180/4 = 3579545 Hz.
namespace m2c_snd {

constexpr int SND_CLOCK = 3579545;
constexpr int SND_MAX_OUTPUT = 0x7fff;
// Counter decrement ("tick") rate: MAME runs the stream at clock/2 and
// subdivides by m_clock_divider (8), so tone/noise counters tick at clock/16.
constexpr double SND_TICK_HZ = SND_CLOCK / 16.0;

// NCR8496 (Tandy) parameters: feedback 0x8000, taps D/E via 0x02/0x20,
// XNOR noise feedback, data-writes to odd/noise regs ignored.
constexpr int SND_FEEDBACK_MASK = 0x8000;
constexpr int SND_TAP1 = 0x02;
constexpr int SND_TAP2 = 0x20;
constexpr bool SND_NEGATE = true;

struct Sn76496 {
	int32_t reg[8] = {};
	int last_reg = 0;
	int32_t period[4] = {};
	int32_t count[4] = {};
	int output[4] = {};
	int32_t volume[4] = {};
	int32_t vol_table[16] = {};
	uint32_t rng = 0;
	double tick_accum = 0.0;
	bool started = false;
};

static Sn76496 snd;
static SDL_AudioDeviceID snd_dev = 0;
static double snd_ticks_per_sample = 0.0;

// --- MIDI capture ---------------------------------------------------------
// The game streams raw SN76496 register words, so each tone write is a real
// note frequency (f = SND_CLOCK/(32*period)). We mirror that into a Standard
// MIDI File: tone channels 0..2 -> MIDI channels 0..2, noise channel 3 ->
// percussion on channel 9. Events are timestamped in microseconds and flushed
// at exit. Capture is opt-in: set M2C_MIDI_OUT to the .mid path to enable it.
struct MidiEvt { uint64_t us; uint8_t status, a, b; };
static std::vector<MidiEvt> midi_evts;
static int midi_note_state[4] = {-1, -1, -1, -1};   // sounding note or -1
static bool midi_started = false;

static uint64_t midi_now_us() {
	using namespace std::chrono;
	return (uint64_t)duration_cast<microseconds>(
		steady_clock::now().time_since_epoch()).count();
}

static int snd_freq_to_midi(int period) {
	if (period <= 0) return -1;
	const double f = SND_CLOCK / (32.0 * (double)period);
	if (f < 8.0) return -1;
	int n = (int)lround(69.0 + 12.0 * log2(f / 440.0));
	return n < 0 ? 0 : (n > 127 ? 127 : n);
}

static void midi_push(uint8_t status, uint8_t a, uint8_t b, uint64_t us) {
	midi_evts.push_back({us, status, a, b});
}

// Re-evaluate channel c's sounding note and emit note-on/off on change.
static void midi_commit(int c) {
	if (!midi_started) return; // capture is opt-in via M2C_MIDI_OUT
	int note = -1;
	if (snd.volume[c] > 0) {
		note = (c < 3) ? snd_freq_to_midi(snd.period[c]) : 38; // noise -> snare
	}
	if (note == midi_note_state[c]) return;
	const uint64_t now = midi_now_us();
	const int mch = (c < 3) ? c : 9;
	if (midi_note_state[c] >= 0) midi_push(0x80 | mch, midi_note_state[c], 0, now);
	if (note >= 0)               midi_push(0x90 | mch, note, 100, now);
	midi_note_state[c] = note;
}

static void midi_flush() {
	if (midi_evts.empty()) return;
	const char* path = getenv("M2C_MIDI_OUT");
	if (!path || !*path) return;
	FILE* f = fopen(path, "wb");
	if (!f) return;
	// Sort by timestamp, then write a single-track type-0 file at 96 PPQ,
	// 120 BPM (500000us/qn => 1 MIDI tick = 5208.33us of wall time).
	std::stable_sort(midi_evts.begin(), midi_evts.end(),
		[](const MidiEvt& x, const MidiEvt& y){ return x.us < y.us; });
	const double us_per_tick = 500000.0 / 96.0;
	fwrite("MThd", 1, 4, f);
	uint32_t hdrlen = 6; fwrite(&hdrlen, 4, 1, f); // big-endian below
	fseek(f, -4, SEEK_CUR);
	fputc(0, f); fputc(0, f); fputc(0, f); fputc(6, f);          // hdr len
	fputc(0, f); fputc(0, f); fputc(0, f); fputc(1, f);          // fmt 0, 1 track
	fputc(0, f); fputc(96, f);                                    // division=96 PPQ
	// body into memory to learn its length
	std::vector<uint8_t> trk;
	auto put=[&](uint8_t b){ trk.push_back(b); };
	auto putvlq=[&](uint32_t v){ uint8_t b[5];int n=0;b[n++]=v&0x7f;
		while(v>>=7)b[n++]=0x80|(v&0x7f); while(n--)trk.push_back(b[n]); };
	uint64_t prev = midi_evts.front().us; // first event anchors t=0
	for (auto& e : midi_evts) {
		uint64_t dt = (uint64_t)((e.us - prev) / us_per_tick + 0.5);
		prev = e.us;
		putvlq((uint32_t)dt);
		put(e.status); put(e.a); put(e.b);
	}
	putvlq(0); put(0xff); put(0x2f); put(0x00);                  // end of track
	fwrite("MTrk", 1, 4, f);
	uint32_t len = (uint32_t)trk.size();
	fputc((len>>24)&255, f); fputc((len>>16)&255, f);
	fputc((len>>8)&255, f); fputc(len&255, f);
	fwrite(trk.data(), 1, trk.size(), f);
	fclose(f);
	m2c::log_error("MIDI: wrote %zu note events to %s\n", midi_evts.size(), path);
}

static void midi_init() {
	if (midi_started) return;
	const char* path = getenv("M2C_MIDI_OUT");
	if (!path || !*path) return; // opt-in: no output file configured
	midi_started = true;
	atexit(midi_flush);
	// Route SIGTERM/SIGINT through exit() so atexit dumps the capture even when
	// the game is killed rather than quitting via its own exit path.
	auto die = [](int){ exit(0); };
	signal(SIGTERM, die);
	signal(SIGINT, die);
}
// --- end MIDI capture -----------------------------------------------------

static void snd_reset() {
	double out = SND_MAX_OUTPUT / 4; // per-channel headroom
	int gain = 16;
	while (gain-- > 0) {
		out *= 1.023292992; // +0.2 dB per step
	}
	for (int i = 0; i < 15; ++i) {
		snd.vol_table[i] = static_cast<int32_t>(out) < SND_MAX_OUTPUT / 4
			? static_cast<int32_t>(out)
			: SND_MAX_OUTPUT / 4;
		out /= 1.258925412; // -2 dB per step
	}
	snd.vol_table[15] = 0;
	for (int i = 0; i < 8; ++i) snd.reg[i] = 0;
	for (int i = 0; i < 4; ++i) {
		snd.volume[i] = 0;
		snd.period[i] = 0;
		snd.count[i] = 0;
		snd.output[i] = 0;
	}
	snd.last_reg = 3; // sega_style_psg default
	snd.rng = SND_FEEDBACK_MASK;
	snd.output[3] = snd.rng & 1;
	snd.tick_accum = 0.0;
}

static bool snd_in_noise_mode() { return (snd.reg[6] & 4) != 0; }

static void snd_write(uint8_t data) {
	int r;
	if (data & 0x80) {
		r = (data & 0x70) >> 4;
		snd.last_reg = r;
		if (r == 6 && ((data & 0x04) != (snd.reg[6] & 0x04))) snd.rng = SND_FEEDBACK_MASK;
		snd.reg[r] = (snd.reg[r] & 0x3f0) | (data & 0x0f);
	} else {
		r = snd.last_reg;
		if ((r & 1) || (r == 6)) return; // NCR8496 ignores data writes to vol/noise regs
	}
	const int c = r >> 1;
	switch (r) {
	case 0: case 2: case 4: // tone frequency
		if (!(data & 0x80)) snd.reg[r] = (snd.reg[r] & 0x0f) | ((data & 0x3f) << 4);
		snd.period[c] = snd.reg[r] != 0 ? snd.reg[r] : 0x400;
		if (r == 4 && (snd.reg[6] & 0x03) == 0x03) snd.period[3] = snd.period[2] << 1;
		// Frequency divider is complete only after the data byte; commit then.
		if (!(data & 0x80)) midi_commit(c);
		break;
	case 1: case 3: case 5: case 7: // volume
		snd.volume[c] = snd.vol_table[data & 0x0f];
		if (!(data & 0x80)) snd.reg[r] = (snd.reg[r] & 0x3f0) | (data & 0x0f);
		midi_commit(c);
		break;
	case 6: // noise frequency/mode
		if (!(data & 0x80)) snd.reg[r] = (snd.reg[r] & 0x3f0) | (data & 0x0f);
		{
			const int n = snd.reg[6];
			snd.period[3] = ((n & 3) == 3) ? (snd.period[2] << 1) : (1 << (5 + (n & 3)));
		}
		midi_commit(3);
		break;
	}
}

// One counter-decrement step (the MAME "new divided clock" block).
static void snd_tick() {
	for (int i = 0; i < 3; ++i) {
		if (--snd.count[i] <= 0) {
			snd.output[i] ^= 1;
			snd.count[i] = snd.period[i];
		}
	}
	if (--snd.count[3] <= 0) {
		if (((snd.rng & SND_TAP1) != 0) !=
		    ((static_cast<int32_t>(snd.rng & SND_TAP2) != SND_TAP2) && snd_in_noise_mode())) {
			snd.rng >>= 1;
			snd.rng |= SND_FEEDBACK_MASK;
		} else {
			snd.rng >>= 1;
		}
		snd.output[3] = snd.rng & 1;
		snd.count[3] = snd.period[3];
	}
}

static int snd_sample() {
	int out = (snd.output[0] ? snd.volume[0] : 0)
	        + (snd.output[1] ? snd.volume[1] : 0)
	        + (snd.output[2] ? snd.volume[2] : 0)
	        + (snd.output[3] ? snd.volume[3] : 0);
	return SND_NEGATE ? -out : out;
}

// --- live note-based soft-synth ("MIDI" engine) ------------------------------
// Two audio engines share the same SN76496 register state (period[c] -> note
// frequency, volume[c] -> amplitude):
//   midi (default): each tone channel is rendered as a triangle-wave voice with
//                   a short attack and a gentle release, so the score reads as
//                   soft instruments instead of raw square beeps. The noise
//                   channel keeps the chip's own percussion output.
//   psg           : the original cycle-level square-wave emulation.
// Select with M2C_SND_ENGINE=midi|psg (default: midi). The .mid file recorder
// (M2C_MIDI_OUT) is independent and works with either engine.
static int    snd_engine_sel = -1;  // -1 unresolved; 0 = midi, 1 = psg
static double snd_sample_rate = 0.0;
static double midi_phase[4] = {0.0, 0.0, 0.0, 0.0};
static double midi_amp[4]   = {0.0, 0.0, 0.0, 0.0};

static int snd_engine() {
	if (snd_engine_sel >= 0) return snd_engine_sel;
	const char* e = getenv("M2C_SND_ENGINE");
	snd_engine_sel = (e && (!strcmp(e, "psg") || !strcmp(e, "square") ||
	                        !strcmp(e, "tandy") || !strcmp(e, "chip")))
	                 ? 1 : 0;
	return snd_engine_sel;
}

// One audio sample from the note-based (MIDI) engine. Only called on the audio
// thread, so the per-voice phase/amplitude accumulators need no locking.
static int midi_synth_sample(double dt) {
	int acc = 0;
	for (int c = 0; c < 3; ++c) {
		const double f = snd.period[c] > 0 ? SND_CLOCK / (32.0 * snd.period[c]) : 0.0;
		const double tgt = static_cast<double>(snd.volume[c]) / SND_MAX_OUTPUT;
		const double rate = tgt > midi_amp[c] ? 400.0 : 50.0; // fast attack, slow release
		const double k = rate * dt > 1.0 ? 1.0 : rate * dt;
		midi_amp[c] += (tgt - midi_amp[c]) * k;
		midi_phase[c] += f * dt;
		midi_phase[c] -= floor(midi_phase[c]);
		const double t = midi_phase[c];
		const double tri = t < 0.5 ? 4.0 * t - 1.0 : 3.0 - 4.0 * t; // -1..1
		acc += static_cast<int>(tri * midi_amp[c] * SND_MAX_OUTPUT);
	}
	acc += snd.output[3] ? snd.volume[3] : 0; // noise channel stays percussion
	return SND_NEGATE ? -acc : acc;
}

static void snd_sdl_callback(void*, Uint8* stream, int len) {
	int16_t* out = reinterpret_cast<int16_t*>(stream);
	const int samples = len / static_cast<int>(sizeof(int16_t));
	const bool midi = (snd_engine() == 0);
	const double dt = snd_sample_rate > 0.0 ? 1.0 / snd_sample_rate : 0.0;
	for (int i = 0; i < samples; ++i) {
		snd.tick_accum += snd_ticks_per_sample;
		while (snd.tick_accum >= 1.0) {
			snd.tick_accum -= 1.0;
			snd_tick();
		}
		out[i] = static_cast<int16_t>(midi ? midi_synth_sample(dt) : snd_sample());
	}
}

static void snd_init() {
	if (snd.started) {
		return;
	}
	snd.started = true;
	snd_reset();
	midi_init();
	if ((SDL_WasInit(SDL_INIT_AUDIO) & SDL_INIT_AUDIO) == 0) {
		SDL_InitSubSystem(SDL_INIT_AUDIO);
	}
	SDL_AudioSpec want = {};
	want.freq = 22050;
	want.format = AUDIO_S16SYS;
	want.channels = 1;
	want.samples = 512;
	want.callback = snd_sdl_callback;
	SDL_AudioSpec got = {};
	snd_dev = SDL_OpenAudioDevice(nullptr, 0, &want, &got, 0);
	if (snd_dev == 0) {
		log_error("Tandy SDL_OpenAudioDevice failed: %s\n", SDL_GetError());
		return;
	}
	snd_ticks_per_sample = SND_TICK_HZ / got.freq;
	snd_sample_rate = got.freq;
	SDL_PauseAudioDevice(snd_dev, 0);
	log_debug("Tandy sound: SDL audio %d Hz, engine=%s\n", got.freq,
	          snd_engine() == 0 ? "midi" : "psg");
}

} // namespace m2c_snd

void tandy_snd_write(db data) {
	m2c_snd::snd_init();
	if (m2c_snd::snd_dev) {
		SDL_LockAudioDevice(m2c_snd::snd_dev);
	}
	m2c_snd::snd_write(data);
	if (m2c_snd::snd_dev) {
		SDL_UnlockAudioDevice(m2c_snd::snd_dev);
	}
	static unsigned long snd_writes = 0;
	++snd_writes;
	if (snd_writes <= 32 || (snd_writes % 512) == 0) {
		m2c::log_error("snd c0 wr #%lu data=%02x\n", snd_writes, data);
	}
}

static uint8_t vga_dac_to_sdl(db value) {
	if (value > 63) {
		return value;
	}
	return static_cast<uint8_t>((value << 2) | (value >> 4));
}

static uint32_t vga_color_to_argb(db color) {
	const size_t index = 3 * color;
	const uint8_t r = vga_dac_to_sdl(vgaPalette[index]);
	const uint8_t g = vga_dac_to_sdl(vgaPalette[index + 1]);
	const uint8_t b = vga_dac_to_sdl(vgaPalette[index + 2]);
	return 0xff000000u | (static_cast<uint32_t>(r) << 16) | (static_cast<uint32_t>(g) << 8) | b;
}

static bool vga_mode13_chain4_enabled() {
	return host.vga.current_mode == 0x13 && (host.vga.seq_regs[4] & 0x08) != 0;
}

// Standard 16-color CGA/EGA-index palette (ARGB) for rasterizing B800 memory.
static const uint32_t cga_index_argb[16] = {
	0xff000000, 0xff0000aa, 0xff00aa00, 0xff00aaaa,
	0xffaa0000, 0xffaa00aa, 0xffaa5500, 0xffaaaaaa,
	0xff555555, 0xff5555ff, 0xff55ff55, 0xff55ffff,
	0xffff5555, 0xffff55ff, 0xffffff55, 0xffffffff,
};

// Map a CGA pixel value at (x,y) in m[B8000] to a 0-15 color index.
// Modes 4/5: 2bpp; pixel 0 = background (color-select low nibble), pixels
// 1-3 = fixed palette selected by cga_palette bit0 + intensity bit4.
// Mode 6: 1bpp; set = fg color (color-select low nibble, default 7).
static db cga_pixel_color(int x, int y) {
	const db* base = cga_scanline(y);
	if (host.vga.current_mode == 0x06) {
		const db byte = base[x >> 3];
		const int v = (byte >> (7 - (x & 7))) & 1;
		const db fg = host.vga.cga_color_select & 0x0f;
		return v ? (fg ? fg : 0x07) : 0;
	}
	const db byte = base[x >> 2];
	const int v = (byte >> ((3 - (x & 3)) * 2)) & 3;
	if (v == 0) return host.vga.cga_color_select & 0x0f;
	static const db pals[2][3] = {{2, 4, 6}, {3, 5, 7}};
	db color = pals[host.vga.cga_palette & 1][v - 1];
	if (host.vga.cga_color_select & 0x10) color += 8;
	return color;
}

// Text modes (0-3): guest VRAM at B800:<page*0x1000> holds char/attr pairs.
// Rasterized at 640x400: 80x25 cells of 8x16 (8x8 glyph rows doubled).
// 40-col modes 0/1 use 16px-wide cells.
static uint32_t text_mode_pixel_argb(int x, int y) {
	const bool wide = host.vga.current_mode <= 0x01;
	const db* vram = reinterpret_cast<const db*>(&m2c::m) + 0xB8000 +
	                 static_cast<size_t>(host.vga.active_page) * 0x1000;
	const int col = wide ? (x >> 4) : (x >> 3);
	const int row = y >> 4;
	if (row >= HostVga::TEXT_ROWS || col >= HostVga::TEXT_COLS) return 0xff000000;
	const db ch = vram[(row * HostVga::TEXT_COLS + col) * 2];
	const db attr = vram[(row * HostVga::TEXT_COLS + col) * 2 + 1];
	const db bits = cga_glyph(ch)[(y & 15) >> 1];
	const int bit = wide ? ((x >> 1) & 7) : (x & 7);
	const bool on = (bits >> bit) & 1; // font is LSB-left
	return on ? cga_index_argb[attr & 0x0f] : cga_index_argb[(attr >> 4) & 0x07];
}

static bool host_text_mode() {
	return host.vga.current_mode <= 0x03;
}

static db vga_mode13_visible_color(size_t start, int x, int y) {
	if (vga_mode13_chain4_enabled()) {
		const size_t byte_offset = (start + y * 320 + x) % VGA_WINDOW_SIZE;
		return vgaMode13Pixels[byte_offset];
	}
	const size_t byte_offset = (start + y * 80 + x / 4) % VGA_WINDOW_SIZE;
	return vgaMode13Pixels[byte_offset * 4 + (x & 3)];
}

static size_t vga_count_nonzero_at_start(size_t start, bool require_visible_palette) {
	size_t count = 0;
	for (int y = 0; y < 200; ++y) {
		for (int x = 0; x < 320; ++x) {
			const db color = vga_mode13_visible_color(start, x, y);
			if (color == 0) {
				continue;
			}
			if (require_visible_palette && (vga_color_to_argb(color) & 0x00ffffffu) == 0) {
				continue;
			}
			++count;
		}
	}
	return count;
}

static void vga_dump_top_visible_colors(size_t start) {
	size_t counts[256];
	std::fill(counts, counts + 256, 0);
	for (int y = 0; y < 200; ++y) {
		for (int x = 0; x < 320; ++x) {
			const db color = vga_mode13_visible_color(start, x, y);
			++counts[color];
		}
	}
	std::fprintf(stderr, "vga colors:");
	for (int rank = 0; rank < 8; ++rank) {
		size_t best_count = 0;
		int best_color = -1;
		for (int color = 0; color < 256; ++color) {
			if (counts[color] > best_count) {
				best_count = counts[color];
				best_color = color;
			}
		}
		if (best_color < 0 || best_count == 0) {
			break;
		}
		const size_t index = static_cast<size_t>(best_color) * 3;
		std::fprintf(
			stderr,
			" #%02x=%zu(rgb=%u,%u,%u)",
			best_color,
			best_count,
			static_cast<unsigned>(vgaPalette[index]),
			static_cast<unsigned>(vgaPalette[index + 1]),
			static_cast<unsigned>(vgaPalette[index + 2])
		);
		counts[best_color] = 0;
	}
	std::fprintf(stderr, "\n");
}

static void vga_maybe_dump_frame() {
	static bool dumped = false;
	static unsigned frame_count = 0;
	static unsigned since_last = 0;
	++frame_count;
	if (dumped) {
		return;
	}
	const char *path = std::getenv("M2C_VGA_DUMP_FRAME");
	if (!path || !*path) {
		return;
	}
	const char *frame_at_value = std::getenv("M2C_VGA_DUMP_FRAME_AT");
	const unsigned frame_at = frame_at_value && *frame_at_value
		? static_cast<unsigned>(std::strtoul(frame_at_value, NULL, 10))
		: 0;
	if (frame_at != 0 && frame_count < frame_at) {
		return;
	}
	// Continuous mode: when no specific frame was requested, refresh the dump
	// file periodically so the live screen can be inspected without gdb.
	if (frame_at == 0 && ++since_last < 15) {
		return;
	}
	since_last = 0;

	size_t lit_pixels = 0;
	for (int i = 0; i < vga_logical_width * vga_logical_height; ++i) {
		if ((vgaSdlFrame[i] & 0x00ffffffu) != 0) {
			++lit_pixels;
		}
	}
	if (lit_pixels == 0) {
		return;
	}

	FILE *f = std::fopen(path, "wb");
	if (!f) {
		log_error("could not write M2C_VGA_DUMP_FRAME=%s\n", path);
		dumped = true;
		return;
	}
	{
		const db *base = (const db*)&m;
		std::fprintf(stderr, "DBG mode=%x seq4=%x w=%d h=%d\n",
			(int)host.vga.current_mode, (int)host.vga.seq_regs[4],
			vga_logical_width, vga_logical_height);
		{
			// driver jump-table fields live at &data+0x182.. = &m+0x1f2.. (&data=&m+0x70)
			const dw *w = (const dw*)(base + 0x1f2);
			static const char *names[] = {
				"_setvideomode","?","_download","?","_setpixel","?","_linedraw","?",
				"_vlinedraw","?","_hlinedraw","?","_polyfill","?","_meshfill","?",
				"_smokefill","?","_prch1","?","_prch2","?","_prch3","?",
				"_sspr","_mspr","_bspr","_qspr","_initss","_initms","_initqs",
				"_blockfill","?","_savembg","?","_loadmbg","?","_savescr","?",
				"_loadscr","?","_uncompr","?","_horizonf","?","vgascr0","vgascr1"};
			for (int i = 0; i < 45; ++i)
				std::fprintf(stderr, "DBG drv %-11s @%04x = %04x\n",
					names[i], (unsigned)(0x182 + i*2), (unsigned)w[i]);
		}
		FILE *fr = std::fopen("/tmp/m_a0000.bin", "wb");
		if (fr) { std::fwrite(base + 0xa0000, 1, 0x10000, fr); std::fclose(fr); }
		FILE *fp = std::fopen("/tmp/mode13pix.bin", "wb");
		if (fp) { std::fwrite(vgaMode13Pixels, 1, 64000*4, fp); std::fclose(fp); }
		FILE *fw = std::fopen("/tmp/workscreen.bin", "wb");
		if (fw) { std::fwrite(base + 0xe060, 1, 32000, fw); std::fclose(fw); } // workscreen 320x100 packed
		FILE *fd = std::fopen("/tmp/mdata.bin", "wb");
		if (fd) { std::fwrite(base + 0x70, 1, 0x2C000, fd); std::fclose(fd); } // whole data image + paldata
	}
	std::fprintf(f, "P6\n%d %d\n255\n", vga_logical_width, vga_logical_height);
	for (int i = 0; i < vga_logical_width * vga_logical_height; ++i) {
		const uint32_t pixel = vgaSdlFrame[i];
		const unsigned char rgb[3] = {
			static_cast<unsigned char>((pixel >> 16) & 0xff),
			static_cast<unsigned char>((pixel >> 8) & 0xff),
			static_cast<unsigned char>(pixel & 0xff),
		};
		std::fwrite(rgb, 1, sizeof(rgb), f);
	}
	std::fclose(f);
	// Companion diagnostics: dump the raw per-pixel palette indices and the DAC
	// palette alongside the rendered frame so corruption can be attributed to
	// bad pixel data vs a bad palette entry.
	{
		std::string pal_path = std::string(path) + ".pal";
		FILE *pf = std::fopen(pal_path.c_str(), "wb");
		if (pf) {
			std::fwrite(vgaPalette, 1, 256 * 3, pf);
			std::fclose(pf);
		}
	}
	{
		std::string idx_path = std::string(path) + ".idx";
		FILE *ix = std::fopen(idx_path.c_str(), "wb");
		if (ix) {
			const size_t start = vga_crtc_start_byte_offset();
			for (int y = 0; y < vga_logical_height; ++y) {
				for (int x = 0; x < vga_logical_width; ++x) {
					const db color = (host.vga.current_mode == 0x13 && vga_logical_width == 320)
						? vga_mode13_visible_color(start, x, y)
						: vgaPlanarPixels[y * 640 + x];
					std::fwrite(&color, 1, 1, ix);
				}
			}
			std::fclose(ix);
		}
	}
	if (frame_at != 0) {
		std::fprintf(stderr, "vga dumped frame #%u to %s lit=%zu\n", frame_count, path, lit_pixels);
		dumped = true;
	}
}

static void vga_maybe_dump_stats(size_t crtc_start) {
	static unsigned dump_count = 0;
	const char *enabled = std::getenv("M2C_VGA_STATS");
	if (!enabled || !*enabled) {
		return;
	}
	++dump_count;
	if (dump_count != 1 && dump_count % 30 != 0) {
		return;
	}
	std::fprintf(
		stderr,
		"vga stats #%u mode=%02x crtc=%04zx r0c=%02x r0d=%02x r11=%02x seq2=%02x seq4=%02x gc5=%02x visible=%zu visible-lit=%zu p0=%zu p4000=%zu p8000=%zu pc000=%zu\n",
		dump_count,
		host.vga.current_mode,
		crtc_start,
		host.vga.crtc_regs[0x0c],
		host.vga.crtc_regs[0x0d],
		host.vga.crtc_regs[0x11],
		host.vga.seq_regs[2],
		host.vga.seq_regs[4],
		host.vga.gc_regs[5],
		vga_count_nonzero_at_start(crtc_start, false),
		vga_count_nonzero_at_start(crtc_start, true),
		vga_count_nonzero_at_start(0x0000, false),
		vga_count_nonzero_at_start(0x4000, false),
			vga_count_nonzero_at_start(0x8000, false),
			vga_count_nonzero_at_start(0xc000, false)
		);
		vga_dump_top_visible_colors(crtc_start);
	}

static void host_keyscript_tick();
static bool m2c_deterministic();
// Deterministic render-tick counter: bumped once per vga_render_indexed_frame
static void vga_render_indexed_frame() {
	++g_det_render_tick;
	if (!m2c_deterministic()) host_keyscript_tick();
	if (!renderer) {
		return;
	}
	if (!vgaTexture) {
		vgaTexture = SDL_CreateTexture(
			renderer,
			SDL_PIXELFORMAT_ARGB8888,
			SDL_TEXTUREACCESS_STREAMING,
			vga_logical_width,
			vga_logical_height
		);
		if (!vgaTexture) {
			log_error("SDL_CreateTexture failed: %s\n", SDL_GetError());
			return;
		}
	}

	maybe_apply_registered_palette();
	const size_t crtc_start = vga_crtc_start_byte_offset();
	vga_maybe_dump_stats(crtc_start);
	for (int y = 0; y < vga_logical_height; ++y) {
		for (int x = 0; x < vga_logical_width; ++x) {
			db color = 0;
			if (host.vga.current_mode == 0x13 && vga_logical_width == 320) {
				color = vga_mode13_visible_color(crtc_start, x, y);
				vgaSdlFrame[y * vga_logical_width + x] = vga_color_to_argb(color);
			} else if (host_gfx_mode()) {
				// CGA modes are pixel-doubled onto the 640x400 logical frame:
				// modes 4/5 are 320x200 (2x2 blocks), mode 6 is 640x200 (1x2).
				const int xscale = (vga_logical_width == 640 &&
				                    host.vga.current_mode != 0x06) ? 1 : 0;
				const int yscale = vga_logical_height == 400 ? 1 : 0;
				const int sx = x >> xscale;
				const int sy = y >> yscale;
				vgaSdlFrame[y * vga_logical_width + x] = cga_index_argb[cga_pixel_color(sx, sy)];
			} else if (host_text_mode()) {
				vgaSdlFrame[y * vga_logical_width + x] = text_mode_pixel_argb(x, y);
			} else {
				color = vgaPlanarPixels[y * 640 + x];
				vgaSdlFrame[y * vga_logical_width + x] = vga_color_to_argb(color);
			}
		}
	}

	if (const char* hpath = getenv("M2C_FRAMEHASH")) {
		uint64_t h = 1469598103934665603ull;
		const size_t n = (size_t)vga_logical_width * (size_t)vga_logical_height;
		for (size_t i = 0; i < n; ++i) {
			const uint32_t p = vgaSdlFrame[i];
			for (int b = 0; b < 4; ++b) { h ^= (p >> (b * 8)) & 0xffu; h *= 1099511628211ull; }
		}
		static unsigned fno = 0;
		if (FILE* fp = std::fopen(hpath, "a")) { std::fprintf(fp, "frame %u %016llx\n", fno++, (unsigned long long)h); std::fclose(fp); }
	}

	SDL_UpdateTexture(vgaTexture, NULL, vgaSdlFrame, vga_logical_width * static_cast<int>(sizeof(uint32_t)));
	vga_maybe_dump_frame();
	if (const char* sd = getenv("M2C_SEQDUMP")) {  // dump every present, all modes
		static unsigned seq = 0;
		static unsigned skip = 0;
		if (++skip >= 8) {  // ~every 8th present
			skip = 0;
			char pp[1024]; std::snprintf(pp, sizeof(pp), "%s/seq_%05u.ppm", sd, seq++);
			if (FILE* f = std::fopen(pp, "wb")) {
				std::fprintf(f, "P6\n%d %d\n255\n", vga_logical_width, vga_logical_height);
				for (int i = 0; i < vga_logical_width * vga_logical_height; ++i) {
					const uint32_t p = vgaSdlFrame[i];
					unsigned char rgb[3] = { (unsigned char)(p>>16), (unsigned char)(p>>8), (unsigned char)p };
					std::fwrite(rgb,1,3,f);
				}
				std::fclose(f);
			}
		}
	}
	SDL_RenderClear(renderer);
	SDL_RenderCopy(renderer, vgaTexture, NULL, NULL);
}

// Per-sim-frame hash of the game's VRAM image (mode-X planes), called once per
// controlloop download tick. Deterministic across runs regardless of SDL present
// cadence, unlike M2C_FRAMEHASH which is present-boundary driven.
void m2c_frame_tick_hash() {
	static const char* hpath = getenv("M2C_TICKHASH");
	static unsigned tick = 0;
	if (!hpath) return;
	uint64_t h = 1469598103934665603ull;
	for (size_t i = 0; i < (size_t)VGA_WINDOW_SIZE * 4; ++i) {
		h ^= vgaMode13Pixels[i]; h *= 1099511628211ull;
	}
	if (FILE* fp = std::fopen(hpath, "a")) { std::fprintf(fp, "tick %u %016llx\n", tick++, (unsigned long long)h); std::fclose(fp); }
	// M2C_VRAMDUMP=<dir>: raw dump of all 4 mode-X planes once per flip.
	static const char* vdir = getenv("M2C_VRAMDUMP");
	static unsigned vtick = 0;
	if (vdir && *vdir) {
		char vp[1024]; std::snprintf(vp, sizeof(vp), "%s/vram_%05u.bin", vdir, vtick++);
		if (FILE* vf = std::fopen(vp, "wb")) { std::fwrite(vgaMode13Pixels, 1, (size_t)VGA_WINDOW_SIZE * 4, vf); std::fclose(vf); }
	}
}

// Per-page-flip dump of the assembled logical index plane (the exact 320x200
// indices that would be displayed), for byte-level comparison against the
// original's paletted frame dumps. M2C_IDXDUMP=<dir> enables it.
static void vga_dump_flip_index() {
	static const char* dir = getenv("M2C_IDXDUMP");
	static unsigned flip = 0;
	if (!dir || !*dir) return;
	if (!(host.vga.current_mode == 0x13 && vga_logical_width == 320)) return;
	char path[1024];
	std::snprintf(path, sizeof(path), "%s/idx_%05u.bin", dir, flip++);
	if (FILE* fp = std::fopen(path, "wb")) {
		const size_t start = vga_crtc_start_byte_offset();
		for (int y = 0; y < vga_logical_height; ++y)
			for (int x = 0; x < vga_logical_width; ++x) {
				const db color = vga_mode13_visible_color(start, x, y);
				std::fwrite(&color, 1, 1, fp);          // raw palette index
			}
		std::fclose(fp);
	}
	if (getenv("M2C_IDXWS")) {  // dump the 320x100 outside-view workscreen too
		char wp[1024]; std::snprintf(wp, sizeof(wp), "%s/ws_%05u.bin", dir, flip-1);
		if (FILE* wf = std::fopen(wp, "wb")) {
			std::fwrite(((const db*)&m) + 0xe060, 1, 32000, wf); std::fclose(wf);
		}
	}
	if (getenv("M2C_IDXLOG")) {
		char lp[1024]; std::snprintf(lp, sizeof(lp), "%s/log.txt", dir);
		if (FILE* lf = std::fopen(lp, "a")) {
			const size_t st = vga_crtc_start_byte_offset();
			// count writes that landed in the displayed page's top rows (rows 0-9)
			size_t topw = 0, midw = 0;
			for (size_t o = st; o < st + 800 && o < VGA_WINDOW_SIZE; ++o) topw += vga_wr_hit[o];
			for (size_t o = st+800; o < st + 16000 && o < VGA_WINDOW_SIZE; ++o) midw += vga_wr_hit[o];
			std::fprintf(lf, "flip=%u start=%04zx r0c=%02x topwr=%zu restwr=%zu\n",
				flip-1, st, host.vga.crtc_regs[0x0c], topw, midw);
			std::fclose(lf);
		}
	}
	// clear hitmap for next frame
	if (getenv("M2C_WRHIT")) std::fill(vga_wr_hit, vga_wr_hit + VGA_WINDOW_SIZE, 0);
	if (getenv("M2C_IDXPAL")) {  // palette dump each flip; last write = flight state
		char pp[1024]; std::snprintf(pp, sizeof(pp), "%s/pal.bin", dir);
		if (FILE* pf = std::fopen(pp, "wb")) { std::fwrite(vgaPalette,1,256*3,pf); std::fclose(pf); }
	}
	if (g_hooks.frame_hook) {
		g_hooks.frame_hook();
	}
}

static uint64_t vga_last_present_ms = 0;

static void vga_present_now() {
	{static unsigned _pn=0; if (getenv("M2C_STATEDBG") && (++_pn<40 || _pn%120==0)) fprintf(stderr,"[present_now #%u rdr=%p dirty=%d tid=%llx]\n",_pn,(void*)renderer,(int)vga_render_dirty,(unsigned long long)std::hash<std::thread::id>()(std::this_thread::get_id()));}
	vga_render_indexed_frame();
	SDL_RenderPresent(renderer);
	vga_last_present_ms = SDL_GetTicks64();
	vga_render_dirty = false;
	vga_render_writes = 0;
	{static unsigned _pc=0; if (getenv("M2C_STATEDBG") && (++_pc<20 || _pc%120==0)) fprintf(stderr,"[presentclr dirty0 #%u]\n",_pc);}
}

/* Rate-limited mid-frame present. The write-flush threshold fires several times
   inside one ~64 KB frame and each call used to re-render + present the whole
   framebuffer, which is heavy CPU work and can queue up vsync on a real display.
   Cap those mid-frame flushes to ~30 Hz; the completed frame is still shown once
   per frame by the retrace boundary (vga_present_forced) and by the periodic
   event pump. vga_render_writes/dirty stay set on a skip so the next check still
   sees pending work. */
void vga_present_pending() {
	// In deterministic mode a mid-frame flush present would also bump
	// g_det_render_tick -> extra IRQ0 deliveries at wall-clock cadence, making
	// sim speed depend on wall-time instead of rendered game frames. Presents
	// still happen per frame via the page-flip and retrace boundaries.
	if (m2c_deterministic()) return;
	const uint64_t now = SDL_GetTicks64();
	const int64_t elapsed = (int64_t)(now - vga_last_present_ms);
	{static unsigned _pp=0; if (getenv("M2C_STATEDBG") && (++_pp<20 || _pp%4000==0)) fprintf(stderr,"[ppend #%u rdr=%p dirty=%d elapsed=%lld tid=%llx]\n",_pp,(void*)renderer,(int)vga_render_dirty,(long long)elapsed,(unsigned long long)std::hash<std::thread::id>()(std::this_thread::get_id()));}
	if (renderer && vga_render_dirty &&
	    now - vga_last_present_ms >= 33) {
		vga_present_now();
	}
}

/* Frame-boundary present: always shows the accumulated frame. Called from the
   VGA vertical-retrace poll (IN 0x3DA), i.e. once per logical game frame. */
void vga_present_forced() {
	{static unsigned _pf=0; if (getenv("M2C_STATEDBG") && (++_pf<20 || _pf%600==0)) fprintf(stderr,"[pforced #%u rdr=%p dirty=%d wr=%u]\n",_pf,(void*)renderer,(int)vga_render_dirty,vga_render_writes);}
	/* Retrace boundary = logical frame edge even when nothing is presented —
	   tick the keyscript here so scripted input still advances while an idle
	   interpreter polls 3DA without producing frames. */
	if (!m2c_deterministic()) host_keyscript_tick();
	/* Present on any writes accumulated since the last frame, not only when the
	   dirty flag happens to read high at this instant — the flag is cleared by
	   the previous present and mid-frame flush presents, so gating on it alone
	   stalls the display once the game draws to a hidden page. */
	if (renderer && (vga_render_dirty || vga_render_writes > 0)) {
		vga_present_now();
	}
}

static bool vga_is_planar_mode() {
	if (host.vga.current_mode == 0x13) {
		return !vga_mode13_chain4_enabled();
	}
	return true;
}

static bool vga_mode13_address(size_t offset, size_t *page_offset) {
	if (offset >= VGA_WINDOW_SIZE) {
		return false;
	}
	*page_offset = offset;
	return true;
}

static void vga_latch_mode13_byte(size_t page_offset, db *latch) {
	for (int plane = 0; plane < 4; ++plane) {
		latch[plane] = vgaMode13Pixels[page_offset * 4 + plane];
	}
}

db vga_read_byte_value_from_memory(const db *d) {
	if (host.vga.current_mode != 0x13) {
		return *d;
	}
	const size_t offset = d - ((const db*)&m) - 0xa0000;
	size_t page_offset = 0;
	if (!vga_mode13_address(offset, &page_offset)) {
		return *d;
	}
	if (vga_mode13_chain4_enabled()) {
		return vgaMode13Pixels[page_offset];
	}
	vga_latch_mode13_byte(page_offset, vgaReadLatch);
	const db read_plane = host.vga.gc_regs[4] & 0x03;
	return vgaReadLatch[read_plane];
}

void vga_read_bytes_from_memory(const db *d, size_t size) {
	if (host.vga.current_mode != 0x13) {
		return;
	}
	vgaPendingReadLatchCount = 0;
	vgaPendingReadLatchNext = 0;
	for (size_t i = 0; i < size && i < 4; ++i) {
		const size_t offset = (d + i) - ((const db*)&m) - 0xa0000;
		size_t page_offset = 0;
		if (!vga_mode13_address(offset, &page_offset)) {
			continue;
		}
		vga_latch_mode13_byte(page_offset, vgaReadLatch);
		vga_latch_mode13_byte(page_offset, vgaPendingReadLatch[vgaPendingReadLatchCount]);
		++vgaPendingReadLatchCount;
	}
}

void vga_read_byte_from_memory(const db *d) {
	vga_read_bytes_from_memory(d, 1);
}

static const db *vga_latch_for_mode13_write() {
	if (vgaPendingReadLatchNext < vgaPendingReadLatchCount) {
		const db *latch = vgaPendingReadLatch[vgaPendingReadLatchNext++];
		if (vgaPendingReadLatchNext >= vgaPendingReadLatchCount) {
			vgaPendingReadLatchCount = 0;
			vgaPendingReadLatchNext = 0;
		}
		return latch;
	}
	return vgaReadLatch;
}

static void vga_write_mode13_chain4_byte(size_t offset, db value) {
	if (!ensure_sdl_vga_window(320, 200)) {
		return;
	}

	size_t page_offset = 0;
	if (!vga_mode13_address(offset, &page_offset)) {
		return;
	}
	db map_mask = host.vga.seq_regs[2] & 0x0f;
	if (!map_mask) {
		map_mask = 0x0f;
	}
	const db plane = page_offset & 0x03;
	if ((map_mask & (1 << plane)) == 0) {
		return;
	}
	vgaMode13Pixels[page_offset] = value;
	vga_render_dirty = true;
	if (++vga_render_writes >= VGA_RENDER_WRITE_FLUSH_THRESHOLD) {
		vga_present_pending();
	}
}

static void vga_write_mode13_planar_byte(size_t offset, db value) {
	static unsigned _er=0;
	if (!ensure_sdl_vga_window(320, 200)) {
		if (getenv("M2C_STATEDBG") && ++_er<20) fprintf(stderr,"[m13planar EARLY ensure off=%#x rdr=%p]\n",(unsigned)offset,(void*)renderer);
		return;
	}

	size_t page_offset = 0;
	if (!vga_mode13_address(offset, &page_offset)) {
		if (getenv("M2C_STATEDBG") && ++_er<20) fprintf(stderr,"[m13planar EARLY addr off=%#x]\n",(unsigned)offset);
		return;
	}
	db map_mask = host.vga.seq_regs[2] & 0x0f;
	if (!map_mask) {
		map_mask = 0x0f;
	}
	const bool write_mode_1 = (host.vga.gc_regs[5] & 0x03) == 1;
	const db *write_latch = write_mode_1 ? vga_latch_for_mode13_write() : vgaReadLatch;
	for (int plane = 0; plane < 4; ++plane) {
		if ((map_mask & (1 << plane)) == 0) {
			continue;
		}
		const db pixel = write_mode_1 ? write_latch[plane] : value;
		vgaMode13Pixels[page_offset * 4 + plane] = pixel;
	}
	{static const bool wt = getenv("M2C_WRTRACE") != nullptr;
	static _STATE* const* pms = &host_irq_main_state;
	if (wt && pms && *pms) {
		fprintf(stderr,"WRT f=%u cs=%04x ip=%04x off=%05x mm=%x wm=%d v=%02x L=%02x%02x%02x%02x\n",
			g_det_flip_tick,(unsigned)(*pms)->cs,(unsigned)((*pms)->eip&0xffff),
			(unsigned)page_offset,(unsigned)map_mask,(int)write_mode_1,(unsigned)value,
			(unsigned)write_latch[0],(unsigned)write_latch[1],(unsigned)write_latch[2],(unsigned)write_latch[3]);
	}}
	static const bool wrhit = getenv("M2C_WRHIT") != nullptr;
	if (wrhit && page_offset < 0x20000) vga_wr_hit[page_offset] = 1;
	static const bool bandbt = getenv("M2C_BANDBT") != nullptr;
	if (bandbt && page_offset < 80 * 6) {  // writes to top 6 rows
		const db eff = write_mode_1 ? write_latch[0] : value;
		if (eff == 133 || value == 133 || write_latch[0]==133 || write_latch[1]==133) {
			void* bt[24]; int n = backtrace(bt, 24);
			fprintf(stderr, "BANDWR off=%#x val=%d latch0=%d wm=%d\n", (unsigned)page_offset,(int)value,(int)write_latch[0],(int)write_mode_1);
			backtrace_symbols_fd(bt, n, 2);
		}
	}
	vga_render_dirty = true;
	{static unsigned _sd=0; if (getenv("M2C_STATEDBG") && (++_sd<20 || _sd%4000==0)) fprintf(stderr,"[SETDIRTY #%u off=%#x dirty=%d tid=%llx]\n",_sd,(unsigned)page_offset,(int)vga_render_dirty,(unsigned long long)std::hash<std::thread::id>()(std::this_thread::get_id()));}
	{static unsigned _wi=0; if (getenv("M2C_STATEDBG") && (++_wi<20 || _wi%4000==0)) fprintf(stderr,"[wrinc #%u wr=%u tid=%llx]\n",_wi,vga_render_writes,(unsigned long long)std::hash<std::thread::id>()(std::this_thread::get_id()));}
	if (++vga_render_writes >= VGA_RENDER_WRITE_FLUSH_THRESHOLD) {
		vga_present_pending();
	}
}

static void vga_write_planar_byte(size_t offset, db value) {
	if (host.vga.current_mode == 0x13) {
		vga_write_mode13_planar_byte(offset, value);
		return;
	}

	if (!ensure_sdl_vga_window(640, 200)) {
		return;
	}

	const size_t page_offset = offset % 0x4000;
	const int y = page_offset / 80;
	const int x0 = (page_offset % 80) * 8;
	if (y < 0 || y >= 200) {
		return;
	}

	db map_mask = host.vga.seq_regs[2] & 0x0f;
	if (!map_mask) {
		map_mask = 0x0f;
	}
	for (int bit = 0; bit < 8; ++bit) {
		const int x = x0 + bit;
		if (x >= 640) {
			break;
		}
		const db source_bit = (value >> (7 - bit)) & 1;
		db &pixel = vgaPlanarPixels[y * 640 + x];
		for (int plane = 0; plane < 4; ++plane) {
			const db plane_mask = 1 << plane;
			if ((map_mask & plane_mask) == 0) {
				continue;
			}
			if (source_bit) {
				pixel |= plane_mask;
			} else {
				pixel &= ~plane_mask;
			}
		}
	}
	vga_render_dirty = true;
	if (++vga_render_writes >= VGA_RENDER_WRITE_FLUSH_THRESHOLD) {
		vga_present_pending();
	}
}

void vga_write_pixel_from_memory(db *d, db color) {
	{static unsigned _wp=0; if (getenv("M2C_STATEDBG") && (++_wp<40 || _wp%4000==0)) fprintf(stderr,"[vgawr #%u off=%#x rdr=%p]\n",_wp,(unsigned)(d-((db*)&m)-0xa0000),(void*)renderer);}
	if (!renderer) {
		init_sdl_vga_window();
	}
	if (!renderer) {
		return;
	}
	const size_t di = d - ((db*)&m) - 0xa0000;
	if (vga_is_planar_mode()) {
		{static unsigned _rp=0; if (getenv("M2C_STATEDBG") && (++_rp<20 || _rp%4000==0)) fprintf(stderr,"[vgaroute #%u off=%#x PLANAR mode=%#x chain4=%d]\n",_rp,(unsigned)di,(int)host.vga.current_mode,(int)vga_mode13_chain4_enabled());}
		vga_write_planar_byte(di, color);
		return;
	}
	{static unsigned _rc=0; if (getenv("M2C_STATEDBG") && (++_rc<20 || _rc%4000==0)) fprintf(stderr,"[vgaroute #%u off=%#x CHAIN4 mode=%#x]\n",_rc,(unsigned)di,(int)host.vga.current_mode);}
	vga_write_mode13_chain4_byte(di, color);
}
 #endif
#endif

#ifdef NOSDL
void tandy_snd_write(db) {}
// SDL-only frame hooks: the flip detection itself is config-independent, so
// headless builds get no-op stubs and still run the deterministic tick path.
static void vga_present_now() {}
static void vga_dump_flip_index() {}
void m2c_frame_tick_hash() {}
#endif

static int host_clamp_int(int value, int min_value, int max_value) {
	if (value < min_value) {
		return min_value;
	}
	if (value > max_value) {
		return max_value;
	}
	return value;
}

static void clamp_host_mouse() {
	host.mouse.x = host_clamp_int(host.mouse.x, host.mouse.min_x, host.mouse.max_x);
	host.mouse.y = host_clamp_int(host.mouse.y, host.mouse.min_y, host.mouse.max_y);
}

static db* host_key_state() {
	return g_hooks.key_state;
}

static bool host_keyboard_buffer_empty() {
	return host.keyboard_head == host.keyboard_tail;
}

static bool host_keyboard_buffer_full() {
	return static_cast<db>((host.keyboard_tail + 1) % 16) == host.keyboard_head;
}

static bool host_keyboard_push(dw bios_key) {
	if (bios_key == 0 || host_keyboard_buffer_full()) {
		return false;
	}
	host.keyboard_buffer[host.keyboard_tail] = bios_key;
	host.keyboard_tail = static_cast<db>((host.keyboard_tail + 1) % 16);
	return true;
}

static bool host_keyboard_peek(dw* bios_key) {
	if (host_keyboard_buffer_empty()) {
		return false;
	}
	*bios_key = host.keyboard_buffer[host.keyboard_head];
	return true;
}

static bool host_keyboard_pop(dw* bios_key) {
	if (!host_keyboard_peek(bios_key)) {
		return false;
	}
	host.keyboard_head = static_cast<db>((host.keyboard_head + 1) % 16);
	return true;
}

/* M2C_KEYSCRIPT=<file>: frame-timed BIOS key injection, the standalone analog
   of DOSBOX_KEYSCRIPT's "<frame> bios <0xCODE>" lines. One BIOS keycode per
   line is pushed into the keyboard buffer when the present counter reaches the
   listed frame. Lets the same script drive the original (dosbox keyscript) and
   this standalone so both traverse identical menus for same-state compare. */
static void host_queue_irq9(db port60);
static void host_set_key(int scan_code, bool pressed);
static void host_keyscript_tick() {
	static const char* path = getenv("M2C_KEYSCRIPT");
	static std::map<unsigned, std::vector<dw>> script;
	static bool loaded = false;
	static unsigned present = 0;
	if (!loaded) {
		loaded = true;
		if (path && *path) {
			std::ifstream in(path);
			unsigned fr; std::string kind; unsigned code;
			while (in >> std::dec >> fr >> kind && in >> std::hex >> code)
				script[fr].push_back((dw)code);
		}
	}
	if (g_hooks.frame_hook) {
		g_hooks.frame_hook();
	}
	auto it = script.find(present++);
	if (it != script.end())
		for (dw k : it->second) {
			const int scan = (k >> 8) & 0x7f;
			const bool release = (k & 0x8000) != 0;
			if (scan) {  // hold the key so the int9 Key[] held-state registers
				host_set_key(scan, !release);
			}
			host_keyboard_push(k);
		}
}

static db host_ascii_to_pc_scan(db ch) {
	switch (ch) {
	case 0x1b: return 0x01;
	case '1': case '!': return 0x02;
	case '2': case '@': return 0x03;
	case '3': case '#': return 0x04;
	case '4': case '$': return 0x05;
	case '5': case '%': return 0x06;
	case '6': case '^': return 0x07;
	case '7': case '&': return 0x08;
	case '8': case '*': return 0x09;
	case '9': case '(': return 0x0a;
	case '0': case ')': return 0x0b;
	case '-': case '_': return 0x0c;
	case '=': case '+': return 0x0d;
	case '\b': return 0x0e;
	case '\t': return 0x0f;
	case 'q': case 'Q': return 0x10;
	case 'w': case 'W': return 0x11;
	case 'e': case 'E': return 0x12;
	case 'r': case 'R': return 0x13;
	case 't': case 'T': return 0x14;
	case 'y': case 'Y': return 0x15;
	case 'u': case 'U': return 0x16;
	case 'i': case 'I': return 0x17;
	case 'o': case 'O': return 0x18;
	case 'p': case 'P': return 0x19;
	case '[': case '{': return 0x1a;
	case ']': case '}': return 0x1b;
	case '\r': case '\n': return 0x1c;
	case 'a': case 'A': return 0x1e;
	case 's': case 'S': return 0x1f;
	case 'd': case 'D': return 0x20;
	case 'f': case 'F': return 0x21;
	case 'g': case 'G': return 0x22;
	case 'h': case 'H': return 0x23;
	case 'j': case 'J': return 0x24;
	case 'k': case 'K': return 0x25;
	case 'l': case 'L': return 0x26;
	case ';': case ':': return 0x27;
	case '\'': case '"': return 0x28;
	case '`': case '~': return 0x29;
	case '\\': case '|': return 0x2b;
	case 'z': case 'Z': return 0x2c;
	case 'x': case 'X': return 0x2d;
	case 'c': case 'C': return 0x2e;
	case 'v': case 'V': return 0x2f;
	case 'b': case 'B': return 0x30;
	case 'n': case 'N': return 0x31;
	case 'm': case 'M': return 0x32;
	case ',': case '<': return 0x33;
	case '.': case '>': return 0x34;
	case '/': case '?': return 0x35;
	case ' ': return 0x39;
	default: return 0;
	}
}

static dw host_stdin_char_to_bios_key(db ch) {
	const db ascii = ch == '\n' ? '\r' : ch;
	return static_cast<dw>((static_cast<dw>(host_ascii_to_pc_scan(ascii)) << 8) | ascii);
}

static db host_keyboard_shift_flags() {
	const db* keys = host_key_state();
	if (keys == nullptr) {
		return 0;
	}
	db flags = 0;
	if (keys[54]) {
		flags |= 0x01;
	}
	if (keys[42]) {
		flags |= 0x02;
	}
	if (keys[29]) {
		flags |= 0x04;
	}
	if (keys[56]) {
		flags |= 0x08;
	}
	return flags;
}

static dw* host_ticker_counter() {
	return g_hooks.det_ticker;
}

static dw* host_frames_counter() {
	return g_hooks.det_frames;
}

static dw* host_countdown_counter() {
	return g_hooks.det_countdown;
}

static dd* host_elapsed_time() {
	return g_hooks.det_elapsed;
}

// M2C_DET=1 selects a fixed-step timer: the wall-clock IRQ thread and poll-driven
// counter advances are disabled; counters advance a constant amount once per
// mode-X page flip (once per game frame). This makes the sim deterministic.
static bool m2c_deterministic() {
	static const char* det_env = getenv("M2C_DET");
	static const int det = det_env ? atoi(det_env) : 0;
	return det != 0;
}

// Wall-clock reads (DOS int 1Ah/21h time+date) must return a fixed value in
// deterministic mode or the game's clock/seed diverges run to run.
static time_t m2c_host_time() {
	if (m2c_deterministic()) {
		// Fixed epoch for determinism; M2C_DET_EPOCH overrides it so the
		// standalone can match the original build_det run's DOSBOX_DET_EPOCH
		// ("YYYY-MM-DD HH:MM:SS", local time) when the game seeds scenario /
		// demo state from the DOS clock.
		static const time_t fixed = [] {
			if (const char* e = getenv("M2C_DET_EPOCH")) {
				struct tm t; std::memset(&t, 0, sizeof t);
				if (strptime(e, "%Y-%m-%d %H:%M:%S", &t)) return mktime(&t);
				char* end = nullptr; long v = strtol(e, &end, 10);
				if (end && end != e) return (time_t)v;
			}
			return (time_t)0; // default 1970-01-01 00:00:00
		}();
		return fixed;
	}
	return time(nullptr);
}

static int m2c_force_lf() {
	static const char* lf_env = getenv("M2C_FORCE_LF");
	static const int v = lf_env ? atoi(lf_env) : 0;
	return v;
}
static void host_advance_timer_counters() {
	if (dw* ticker_counter = host_ticker_counter()) {
		++*ticker_counter;
	}
	if (dw* frames_counter = host_frames_counter()) {
		// M2C_FORCE_LF freezes Frames at the pinned value (poll_host_events keeps
		// it there) so FrameWait's LastFrame is a fixed timestep; skip ++ here or
		// the flip advance would overshoot before the poll re-pins.
		if (m2c_force_lf() <= 0) ++*frames_counter;
	}
	dw* countdown_counter = host_countdown_counter();
	if (countdown_counter && *countdown_counter > 0) {
		--*countdown_counter;
	}
	if (dd* elapsed_time = host_elapsed_time()) {
		++*elapsed_time;
	}
}

// One deterministic game frame = one 100Hz-tick batch. FrameWait gates on
// frames>=MaxFrameRate so the original runs at a fixed centisecond step per
// frame; M2C_DET_STEP lets us match that quantum (default = lastframe).
static int m2c_det_step() {
	static const char* step_env = getenv("M2C_DET_STEP");
	static const int s = step_env ? atoi(step_env) : 6;
	return s;
}
static void host_advance_timer_counters_n(int n) {
	for (int i = 0; i < n; ++i) host_advance_timer_counters();
}

static void host_start_timer_thread() {
	if (m2c_deterministic()) return; // fixed-step: counters advance at page flip
	bool expected = false;
	if (!host.timer.background_running.compare_exchange_strong(expected, true)) {
		return;
	}
	std::thread([] {
		while (host.timer.background_running.load()) {
			std::this_thread::sleep_for(std::chrono::milliseconds(10));
			if (host.timer.enabled) {
				host_advance_timer_counters();
			}
		}
	}).detach();
}

// The translated program's main state, captured in init(). The IRQ thread
// consults its IF flag so guest cli sections are honored while polling the
// IVT for handlers installed with direct vector writes (no int 21h AH=25h).

/* Cooperative IRQ delivery. A real ISR shares the caller's machine state and
   runs on the interrupted thread between instructions; the generated code uses
   shared bookkeeping (native_return_*, data_offset stacks, etc.) that is NOT
   thread-safe. Running the IVT handler on a separate thread races the game on
   that shared state (observed as non-deterministic "Don't know how to call"
   faults). Instead the timer thread only bumps the BIOS tick and a pending
   counter; the game thread drains it here, on its own stack, exactly like
   host_run_timer_handler does for registered timer procs. */
static std::atomic<int> host_pending_irq8{0};
static std::atomic<int> host_pending_irq1c{0};

/* PIT channel-0 period in microseconds. The game/sound driver reprograms the
   8253 divisor via ports 0x43/0x40 (e.g. TANDYSND loads 0x4DAE => ~60 Hz for
   its sequencer); the IRQ thread paces int8/int1c at this rate so music tempo,
   animation and input polling run at the speed the game expects. Default is
   the BIOS rate (65536 divisor => 18.2 Hz). */
static std::atomic<int> host_irq_period_us{54945};

/* The ISR runs on a dedicated machine state whose stack lives in stack[]; the
   frame sentinel (0,0) makes IRET/RETF unwind back to C++. It is only ever run
   on the game thread (via host_drain_irq) so the shared generated-code
   bookkeeping is used serially, never concurrently. */
static _STATE host_irq_state;
static bool host_irq_state_init = false;

static void host_fire_ivt(int intno, _STATE* _state) {
	const dw off = *(dw*)host_physical_address(0, intno * 4);
	const dw seg = *(dw*)host_physical_address(0, intno * 4 + 2);
	if (getenv("M2C_IRQDBG") && intno==0x08) { static int c8=0; if(++c8<=4) fprintf(stderr,"FIREIVT8 rptr=%p val=%04x:%04x m=%p\n",(void*)host_physical_address(0,intno*4),(unsigned)seg,(unsigned)off,(void*)&m2c::m); }
	// Skip unset/BIOS-adapter-region vectors, but let a registered translated
	// overlay's ISR (which lives at its own code segment) fire.
	if ((off | seg) == 0 || (seg >= 0xa000 && !m2c_find_overlay(seg) && !rm_vec_set[intno])) {
		return;
	}
	if (host_irq_main_state && !host_irq_main_state->IF) {
		return;
	}
	/* Run the ISR on a SEPARATE _STATE with its own dedicated int8stack. Its
	   native_return marks are keyed by this state's pointer, so they never
	   collide with the interrupted game's in-flight dispatch bookkeeping, and
	   its pushes/pops land on int8stack (never the game's live stack[]). A
	   properly PUSH_-ed 0:0 sentinel makes the handler's IRET/RETF unwind to
	   C++ via is_dos_terminate_vector, exactly like host_run_timer_handler. */
	if (!host_irq_state_init) {
		std::memset(&host_irq_state, 0, sizeof(host_irq_state));
		host_irq_state_init = true;
	}
	{
		_STATE* irq = &host_irq_state;
		/* Executing cs must stay 0 inside translated code: __dispatch_call does
		   `__i |= cs<<16` for bare k* targets, which is only a no-op at cs==0.
		   Setting cs=seg made every ISR in-proc jump/call resolve to seg:off and
		   miss all local cases. The IRET frame's popped cs is written to the
		   ISR stack separately, so the register stays 0. */
		irq->cs = 0;
		irq->eip = off;
		/* Dedicated ISR stack at the low quarter of the stack[] arena. The
		   game's own esp stays near the top (~0xff00) so it never reaches
		   down here; the ISR's pushes/pops are fully separate. (int8stack
		   isn't usable: Memory is forward-declared-only at this point.) */
		irq->ss = seg_offset(stack);
		irq->esp = 0x3000;
		/* Fully isolate native-return bookkeeping for the ISR: move the game's
		   marks/values out, reset the shared depth to a clean 0, run the ISR
		   self-contained, restore. Otherwise the ISR's calls ride on the game's
		   inflated depth and its register-carried returns leak into the shared
		   native_return_values, inflating depth until every consume misses. */
		std::vector<NativeReturnMark> saved_marks_v, saved_values_v;
		saved_marks_v.swap(m2c::native_return_marks);
		saved_values_v.swap(m2c::native_return_values);
		const size_t saved_depth = m2c::native_return_call_depth;
		m2c::native_return_call_depth = 0;
		const bool saved_suppress = m2c::suppress_native_return_push_transfer;
		m2c::suppress_native_return_push_transfer = true;
		PUSH_((dw)0, irq); // flags slot (IRET) / padding (RETF)
		PUSH_((dw)0, irq); // sentinel cs
		PUSH_((dw)0, irq); // sentinel ip=0 -> unwind to C++
		m2c::suppress_native_return_push_transfer = saved_suppress;
#ifdef SHADOW_STACK
		const ShadowStack::SavedState saved_shadow = m2c::shadow_stack.save_state();
#endif
		bool handled = false;
		try {
			m2c::dispatch_external_code(static_cast<_offsets>(off), irq, &handled);
		} catch (const m2c::StackPop&) {
			// An IRET/RETF inside the handler unwound past the frame: normal.
		}
		if (getenv("M2C_IRQDBG")) {
			static unsigned dcnt[256] = {0};
			if (intno < 256 && (++dcnt[intno] & 0x3f) == 1)
				fprintf(stderr, "FIREIVT int=%02x seg=%04x off=%04x handled=%d\n",
					intno, (unsigned)seg, (unsigned)off, (int)handled);
		}
		m2c::native_return_marks.clear();
		m2c::native_return_values.clear();
		m2c::native_return_marks.swap(saved_marks_v);
		m2c::native_return_values.swap(saved_values_v);
		m2c::native_return_call_depth = saved_depth;
		m2c::suppress_native_return_push_transfer = saved_suppress;
#ifdef SHADOW_STACK
		m2c::shadow_stack.restore_state(saved_shadow);
#endif
		return;
	}
	if (!host_irq_state_init) {
		std::memset(&host_irq_state, 0, sizeof(host_irq_state));
		host_irq_state_init = true;
	}
	_STATE* irq = &host_irq_state;
	/* On real hardware the CPU pushes the interrupt frame onto the
	   interrupted task's own ss:sp. Placing it at the top of stack[] instead
	   breaks when the game itself runs on stack[]: the handler's pushes
	   descend into live frames and corrupt both the stack bytes and the
	   shared shadow-stack map (indexed by raw sp). Run the ISR on the game's
	   stack, just below its live sp; fall back to a dedicated arena at the
	   bottom of stack[] only when no game state exists yet. */
	dw irq_ss = seg_offset(stack);
	dw irq_sp = STACK_SIZE / 4;
	if (host_irq_main_state && host_irq_main_state->esp > 0x10) {
		irq_ss = host_irq_main_state->ss;
		irq_sp = (dw)(host_irq_main_state->esp - 8);
	}
	// IRET lowers to RETF(0) here, which pops ip then cs; ip==0 is the
	// sentinel that unwinds back to C++.
	irq->ss = irq_ss;
	irq->esp = irq_sp;
	*(dw*)m2c::stack_raddr_(irq->ss, (dw)irq->esp) = 0;
	*(dw*)m2c::stack_raddr_(irq->ss, (dw)(irq->esp + 2)) = 0;
	/* Keep executing cs=0 for the same reason as the early path: bare k*
	   dispatch offsets require __i |= cs<<16 to be a no-op. */
	irq->cs = 0;
	irq->eip = off;
#ifdef SHADOW_STACK
	const ShadowStack::SavedState saved_shadow = m2c::shadow_stack.save_state();
#endif
	/* Fully isolate native-return bookkeeping for the ISR. The global
	   native_return_call_depth is shared, so a nested ISR's calls ride on top
	   of the game's (already deep) counter; its register-carried returns then
	   miss call_depth==curdepth and leak into native_return_values, inflating
	   the shared depth further and making every later consume miss. Give the
	   ISR a pristine context (depth 0, empty marks/values) and restore the
	   game's on the way out. */
	std::vector<NativeReturnMark> saved_marks_v, saved_values_v;
	saved_marks_v.swap(m2c::native_return_marks);
	saved_values_v.swap(m2c::native_return_values);
	const size_t saved_depth = m2c::native_return_call_depth;
	m2c::native_return_call_depth = 0;
	const bool saved_suppress = m2c::suppress_native_return_push_transfer;
	/* Dispatch through the aggregate global-offset table: IVT offsets were
	   stored by generated `OFFSET` writes (kglobal_* space), so `off` maps
	   directly (e.g. Tornado's 0x13a2 -> timerintr). _ENTRY_POINT_ is the
	   program's main proc and ignores its argument -- running it per IRQ
	   re-enters the whole game loop inside the ISR. Untranslated overlay ISRs
	   (TANDYSND) are still reached via host_try_overlay_retf: irq->cs holds the
	   vector's segment, so the tseg==0 internal-dispatch case applies. */
	bool handled = false;
	try {
		m2c::dispatch_external_code(static_cast<_offsets>(off), irq, &handled);
	} catch (const m2c::StackPop&) {
		// An IRET/RETF inside the handler unwound past the synthesized frame;
		// that is the normal way back to C++, not an error.
	}
	if (getenv("M2C_IRQDBG")) {
		static unsigned dcnt[256] = {0};
		if (intno < 256 && (++dcnt[intno] & 0x3f) == 1)
			fprintf(stderr, "FIREIVT int=%02x seg=%04x off=%04x handled=%d\n",
				intno, (unsigned)seg, (unsigned)off, (int)handled);
	}
	if (!handled) {
		log_debug2("irq vector %x:%x not handled by translated code\n", seg, off);
	}
	/* Discard whatever marks/values the ISR left and restore the game's. */
	m2c::native_return_marks.clear();
	m2c::native_return_values.clear();
	m2c::native_return_marks.swap(saved_marks_v);
	m2c::native_return_values.swap(saved_values_v);
	m2c::native_return_call_depth = saved_depth;
	m2c::suppress_native_return_push_transfer = saved_suppress;
#ifdef SHADOW_STACK
	m2c::shadow_stack.restore_state(saved_shadow);
	// The handler pushed frames below the live stack top; they are stale now
	// and would otherwise be miscounted as uncontrolled pops by later scans.
	m2c::shadow_stack.clear_frames_below(irq_sp);
#endif
}

// Run pending IVT interrupts on the caller's (game) thread. Called from
// poll_host_events and from a periodic hook inside the arithmetic helpers so
// that pure compute delay loops (e.g. waits on an int1c-decremented counter)
// still get their ticks. */
struct HostIrqCallbackGuard {
	HostIrqCallbackGuard() { host.timer.in_callback = true; }
	~HostIrqCallbackGuard() { host.timer.in_callback = false; }
};

/* Pending hardware-keyboard IRQ1 (int 9) requests. host_set_key pushes the
   port-0x60 byte (scancode, bit7 set = release) for every host key event; the
   game thread drains them here, presenting the byte on port 0x60 and firing the
   game's own int9 ISR (KbdIntr) so its Key[] held-state table updates exactly
   as on real IRQ1 hardware. SPSC ring: SDL thread produces, game thread drains. */
static db host_irq9_queue[64];
static std::atomic<unsigned> host_irq9_qhead{0};
static std::atomic<unsigned> host_irq9_qtail{0};
static void host_queue_irq9(db port60) {
	unsigned t = host_irq9_qtail.load(std::memory_order_relaxed);
	unsigned n = (t + 1) % 64;
	if (n == host_irq9_qhead.load(std::memory_order_acquire)) return; // full: drop
	host_irq9_queue[t] = port60;
	host_irq9_qtail.store(n, std::memory_order_release);
}
static bool host_dequeue_irq9(db* out) {
	unsigned h = host_irq9_qhead.load(std::memory_order_relaxed);
	if (h == host_irq9_qtail.load(std::memory_order_acquire)) return false;
	*out = host_irq9_queue[h];
	host_irq9_qhead.store((h + 1) % 64, std::memory_order_release);
	return true;
}

static void host_drain_irq() {
	if (host.timer.in_callback) {
		return;
	}
	HostIrqCallbackGuard callback_guard;
	db kscan;
	while (host_dequeue_irq9(&kscan)) {
		host.keyboard_scan_code = kscan;
		host_fire_ivt(0x09, nullptr);
	}
	/* Real hardware latches at most one pending IRQ per source: ticks that
	   arrive while the game is busy are lost, never queued. Clamp the catch-up
	   batch so a stall (heavy frame, debugger pause) cannot queue thousands of
	   handler invocations and trap the game thread inside this loop. The BIOS
	   tick count at 0x40:0x6c still advances at wall-clock rate. */
	int n8 = host_pending_irq8.exchange(0);
	if (n8 > 4) n8 = 4;
	while (n8-- > 0) host_fire_ivt(0x08, nullptr);
	int n1c = host_pending_irq1c.exchange(0);
	if (n1c > 4) n1c = 4;
	while (n1c-- > 0) host_fire_ivt(0x1c, nullptr);
}

// Cheap periodic drain trigger injected into hot generated-code helpers. The
// counter bounds overhead; the atomic pending check makes the common case a
// single load. Runs on whichever thread executes generated code (the game's).
#ifndef NOSDL
static void host_pump_sdl_events();
#endif

void host_irq_poll() {
#ifndef NOSDL
	/* Pump SDL on a ~1ms cadence: a game polling its int9 Key[] table in a
	   tight loop never reaches the BIOS int16/int8 waits that call
	   poll_host_events, so without this SDL_KEYDOWNs queue up and input is
	   ignored. host_set_key (invoked per event) writes the game's Key[]
	   directly. */
	{
		using namespace std::chrono;
		static steady_clock::time_point last_pump{};
		const steady_clock::time_point now = steady_clock::now();
		if (now - last_pump >= milliseconds(1)) {
			last_pump = now;
			host_pump_sdl_events();
		}
	}
#endif
	/* Per-poll program adjustments (e.g. input-device fallback when no
	   joystick hardware exists) are supplied by the game's glue. */
	if (g_hooks.poll_hook) {
		g_hooks.poll_hook();
	}
	/* Keyboard IRQ1 (int9) is input-driven, not timer-driven: deliver pending
	   scancodes on every poll regardless of deterministic mode or timer state,
	   or the game's Key[] held-state never updates (keys appear ignored). */
	if (host_irq9_qhead.load(std::memory_order_acquire) !=
	    host_irq9_qtail.load(std::memory_order_acquire)) {
		host_drain_irq();
	}
	if (m2c_deterministic()) {
		// Keep frames >= maxframerate so FrameWait never blocks on a frozen
		// counter; the flip hook then re-pins a constant dt each frame.
		if (dw* f = host_frames_counter()) { if (*f < 6) *f = 6; }
		// M2C_FORCE_LF pins the game's Frames tick counter to a constant so
		// FrameWait always exits with LastFrame=Frames=that constant and
		// DeltaTime (DeltaTable[LastFrame]) is a fixed timestep regardless of
		// page-flip/FrameWait tick-count jitter. FrameWait reads `frames` itself,
		// so the source is pinned, not the downstream lastframe copy.
		if (dw* fc = host_frames_counter()) {
			static const char* lf_env = getenv("M2C_FORCE_LF");
			static const int lf = lf_env ? atoi(lf_env) : 0;
			if (lf > 0) *fc = lf;
		}
		return;
	}
	if (host.timer.enabled) {
		host_advance_timer_counters();
	}
	if (host_pending_irq8.load() <= 0 && host_pending_irq1c.load() <= 0) return;
	host_drain_irq();
}

// Far call/jump targets inside EXEC-loaded overlay regions (sound drivers)
// have no translated code. The drivers end with `retf`, which pops the
// caller's cs:ip frame. Emulate that by popping the frame and returning
// true: the C++ call chain then unwinds to the statement after the original
// far call, which is exactly where the driver's retf would resume.
bool host_try_overlay_retf(_offsets __disp, _STATE* _state, bool* out_result) {
	// A null far target means the jump/call chained to an empty vector --
	// e.g. Tornado's timerintr tails into the saved DOS IRQ0 handler, which
	// was 0:0 because no BIOS handler was ever installed. On real hardware
	// that slot ends in EOI+IRET, i.e. the whole activation simply ends:
	// returning false unwinds the dispatch exactly like a completed retf.
	if (__disp == 0) {
		*out_result = false;
		return true;
	}
	const dw tseg = static_cast<dw>(__disp >> 16);
	m2c_check_cs(_state, __disp, "ovlretf");
	// Translated overlay module: an external far call / ISR targets the
	// module's code segment (tseg == mod->code_seg), while an internal indirect
	// dispatch (e.g. `call off_10380[bx]`) arrives with tseg == 0 while cs is
	// still the module's code segment. Route both into the module's entry.
	for (auto* mod : m2c_overlays) {
		if (mod && mod->code_seg && mod->call &&
		    (tseg == mod->code_seg || (tseg == 0 && _state->cs == mod->code_seg))) {
			log_debug2("overlay-module call disp=%x cs=%x\n", __disp, _state->cs);
			*out_result = mod->call((dd)__disp, _state);
			return true;
		}
	}
	for (const auto& r : host.overlay_segs) {
		if (tseg < r.first || tseg >= r.second) {
			continue;
		}
		const dw toff = static_cast<dw>(__disp & 0xffff);
		X86_REGREF
		dw ret_ip = 0, ret_cs = 0;
		POP(ret_ip);
		POP(ret_cs);
		/* The POPs moved the caller's return mark into the value list;
		 * claim it so CALL_'s strict verification sees a real consume. */
		size_t ov_mid = 0;
		if (take_native_return_value(_state, (MWORDSIZE)ret_ip, &ret_ip, &ov_mid)) {
			m2c::last_ret_mark_id = ov_mid;
			m2c::last_ret_mark_mode = 4;
		}
		m2c::last_ret_popped = 4;
		log_debug2("overlay entry %x:%x emulated as retf to %x:%x\n",
			tseg, toff, ret_cs, ret_ip);
		*out_result = true;
		return true;
	}
	/* Packed far target (seg:off from a dd pointer, e.g. Tornado's
	 * `call UserVctr100` = 0x4d1d:0x1659): SEG of a generated proc is an
	 * opaque value, not a real address, so the aggregate dispatch only ever
	 * matches the offset part. BIOS (f000) and overlay segments were already
	 * excluded above; retry the remaining packed pointers by global offset.
	 * Never retry off==0: the inner dispatch's null-target rule would claim
	 * it as an empty vector and "end the activation", silently swallowing a
	 * real far call whose target segment simply starts at offset 0 (e.g. an
	 * NE listing-mode key 0x15c5:0000 that the local switch owns).
	 * The retry is also skipped when `tseg` resolves to a real segment of
	 * this image: a packed value carrying a live code paragraph or LDT
	 * selector is a genuine seg:off key owned by the local switch (or the
	 * selector thunk), and stripping the segment aliases its offset word
	 * against unrelated aggregate-table entries -- e.g. Zeek's packed
	 * 0x11ed:0x1066 (kloc_11516) collapsed to global offset 0x1066 and ran
	 * loc_11918 instead.  Tornado's packed pointers survive the gate
	 * because their bank "seg" matches no resolver. */
	if (tseg != 0 && tseg != 0xf000 && (__disp & 0xffff) != 0) {
		const dw toff = static_cast<dw>(__disp & 0xffff);
		const bool real_seg =
			(tlink_code_segment_raddr != nullptr &&
			 tlink_code_segment_raddr(tseg, toff) != nullptr) ||
			(m2c_code_segment_raddr != nullptr &&
			 m2c_code_segment_raddr(tseg, toff) != nullptr) ||
			linked_code_segment_raddr(tseg, toff) != nullptr ||
			m2c_alloc_segment_raddr(tseg, toff) != nullptr;
		if (getenv("M2C_OVRDBG") && (toff == 0x1682 || toff == 0x167f)) {
			fprintf(stderr, "OVLRETF disp=%08x tseg=%04x toff=%04x real_seg=%d\n",
				(unsigned)__disp, (unsigned)tseg, (unsigned)toff, (int)real_seg);
		}
		if (!real_seg) {
			bool inner = false;
			const bool ok = dispatch_external_code(
				static_cast<_offsets>(toff), _state, &inner);
			if (inner) {
				*out_result = ok;
				return true;
			}
			if (getenv("M2C_OVRDBG") && (toff == 0x1682 || toff == 0x167f)) {
				fprintf(stderr, "OVLRETF inner-miss toff=%04x (case not found)\n", (unsigned)toff);
			}
		}
		/* Module-local far pointer: `tseg` is the host paragraph of a proc
		 * wrapper (seg_offset(label)) and `toff` a module-local `k*` offset
		 * -- not a flat `kglobal_*`, so the aggregate retry above missed.
		 * Route `toff` into the owning module's group dispatcher.  Applies
		 * both to `real_seg` targets (genuine seg:off that must not be
		 * stripped) and to stripped-but-unresolved local offsets. */
		if (m2cf* f = m2c_seg_func_for(tseg)) {
			*out_result = f(static_cast<_offsets>(toff), _state);
			return true;
		}
	}
	if (m2c_dispassert) {
		const dw toff = static_cast<dw>(__disp & 0xffff);
		const bool real_seg =
			(tlink_code_segment_raddr && tlink_code_segment_raddr(tseg, toff)) ||
			(m2c_code_segment_raddr && m2c_code_segment_raddr(tseg, toff)) ||
			linked_code_segment_raddr(tseg, toff) ||
			m2c_alloc_segment_raddr(tseg, toff);
		fprintf(stderr,
			"[DISPMISS] disp=%08x seg=%04x off=%04x cs=%04x eip=%04x "
			"real_seg=%d funcseg=%s sp=%04x ss=%04x depth=%d "
			"i=%x from=%04x rip=%04x\n",
			(unsigned)__disp, (unsigned)tseg, (unsigned)toff,
			(unsigned)_state->cs, (unsigned)(_state->eip & 0xffff),
			(int)real_seg,
			m2c_seg_func_for(tseg) ? "Y" : "N",
			(unsigned)(_state->esp & 0xffff), (unsigned)_state->ss,
			(int)native_return_call_depth,
			m2c_last_callsite_i, m2c_last_callsite_eip, m2c_last_callsite_rip);
		/* dump guest stack words to find caller return chain */
		{
			const db* spb = (const db*)&m;
			for (int i = 0; i < 8; ++i) {
				unsigned w = spb[(_state->ss << 4) + (_state->esp & 0xffff) + i*2]
					| (spb[(_state->ss << 4) + (_state->esp & 0xffff) + i*2 + 1] << 8);
				fprintf(stderr, "   stk[%d]=%04x\n", i, w);
			}
		}
	}
	return false;
}

static void host_start_irq_thread() {
	if (m2c_deterministic()) return; // fixed-step: no wall-clock IRQ pacing
	bool expected = false;
	if (!host.timer.irq_running.compare_exchange_strong(expected, true)) {
		return;
	}
	std::thread([] {
		while (host.timer.irq_running.load()) {
			int us = host_irq_period_us.load();
			if (us < 1000) us = 1000; // clamp: don't spin below 1 kHz
			std::this_thread::sleep_for(std::chrono::microseconds(us));
			++*(dd*)host_physical_address(0x40, 0x6c); // BIOS tick count
			// Mark IRQ0/IRQ1C pending; the game thread drains them in
			// host_drain_irq so handler code never races the game on
			// shared (non-thread-local) generated-code bookkeeping.
			host_pending_irq8.fetch_add(1);
			host_pending_irq1c.fetch_add(1);
		}
	}).detach();
}

static uint64_t host_now_us() {
	using clock = std::chrono::steady_clock;
	return std::chrono::duration_cast<std::chrono::microseconds>(
		clock::now().time_since_epoch()).count();
}

static db host_to_bcd(int value) {
	return static_cast<db>(((value / 10) << 4) | (value % 10));
}

#ifndef NOSDL
static int sdl_scancode_to_pc(SDL_Scancode scancode) {
	switch (scancode) {
	case SDL_SCANCODE_ESCAPE: return 1;
	case SDL_SCANCODE_1: return 2;
	case SDL_SCANCODE_2: return 3;
	case SDL_SCANCODE_3: return 4;
	case SDL_SCANCODE_4: return 5;
	case SDL_SCANCODE_5: return 6;
	case SDL_SCANCODE_6: return 7;
	case SDL_SCANCODE_7: return 8;
	case SDL_SCANCODE_8: return 9;
	case SDL_SCANCODE_9: return 10;
	case SDL_SCANCODE_0: return 11;
	case SDL_SCANCODE_MINUS: return 12;
	case SDL_SCANCODE_EQUALS: return 13;
	case SDL_SCANCODE_BACKSPACE: return 14;
	case SDL_SCANCODE_TAB: return 15;
	case SDL_SCANCODE_Q: return 16;
	case SDL_SCANCODE_W: return 17;
	case SDL_SCANCODE_E: return 18;
	case SDL_SCANCODE_R: return 19;
	case SDL_SCANCODE_T: return 20;
	case SDL_SCANCODE_Y: return 21;
	case SDL_SCANCODE_U: return 22;
	case SDL_SCANCODE_I: return 23;
	case SDL_SCANCODE_O: return 24;
	case SDL_SCANCODE_P: return 25;
	case SDL_SCANCODE_LEFTBRACKET: return 26;
	case SDL_SCANCODE_RIGHTBRACKET: return 27;
	case SDL_SCANCODE_RETURN: return 28;
	case SDL_SCANCODE_LCTRL:
	case SDL_SCANCODE_RCTRL: return 29;
	case SDL_SCANCODE_A: return 30;
	case SDL_SCANCODE_S: return 31;
	case SDL_SCANCODE_D: return 32;
	case SDL_SCANCODE_F: return 33;
	case SDL_SCANCODE_G: return 34;
	case SDL_SCANCODE_H: return 35;
	case SDL_SCANCODE_J: return 36;
	case SDL_SCANCODE_K: return 37;
	case SDL_SCANCODE_L: return 38;
	case SDL_SCANCODE_SEMICOLON: return 39;
	case SDL_SCANCODE_APOSTROPHE: return 40;
	case SDL_SCANCODE_GRAVE: return 41;
	case SDL_SCANCODE_LSHIFT: return 42;
	case SDL_SCANCODE_BACKSLASH: return 43;
	case SDL_SCANCODE_Z: return 44;
	case SDL_SCANCODE_X: return 45;
	case SDL_SCANCODE_C: return 46;
	case SDL_SCANCODE_V: return 47;
	case SDL_SCANCODE_B: return 48;
	case SDL_SCANCODE_N: return 49;
	case SDL_SCANCODE_M: return 50;
	case SDL_SCANCODE_COMMA: return 51;
	case SDL_SCANCODE_PERIOD: return 52;
	case SDL_SCANCODE_SLASH: return 53;
	case SDL_SCANCODE_RSHIFT: return 54;
	case SDL_SCANCODE_KP_MULTIPLY: return 55;
	case SDL_SCANCODE_LALT:
	case SDL_SCANCODE_RALT: return 56;
	case SDL_SCANCODE_SPACE: return 57;
	case SDL_SCANCODE_CAPSLOCK: return 58;
	case SDL_SCANCODE_F1: return 59;
	case SDL_SCANCODE_F2: return 60;
	case SDL_SCANCODE_F3: return 61;
	case SDL_SCANCODE_F4: return 62;
	case SDL_SCANCODE_F5: return 63;
	case SDL_SCANCODE_F6: return 64;
	case SDL_SCANCODE_F7: return 65;
	case SDL_SCANCODE_F8: return 66;
	case SDL_SCANCODE_F9: return 67;
	case SDL_SCANCODE_F10: return 68;
	case SDL_SCANCODE_NUMLOCKCLEAR: return 69;
	case SDL_SCANCODE_SCROLLLOCK: return 70;
	case SDL_SCANCODE_KP_7:
	case SDL_SCANCODE_HOME: return 71;
	case SDL_SCANCODE_KP_8:
	case SDL_SCANCODE_UP: return 72;
	case SDL_SCANCODE_KP_9:
	case SDL_SCANCODE_PAGEUP: return 73;
	case SDL_SCANCODE_KP_MINUS: return 74;
	case SDL_SCANCODE_KP_4:
	case SDL_SCANCODE_LEFT: return 75;
	case SDL_SCANCODE_KP_5: return 76;
	case SDL_SCANCODE_KP_6:
	case SDL_SCANCODE_RIGHT: return 77;
	case SDL_SCANCODE_KP_PLUS: return 78;
	case SDL_SCANCODE_KP_1:
	case SDL_SCANCODE_END: return 79;
	case SDL_SCANCODE_KP_2:
	case SDL_SCANCODE_DOWN: return 80;
	case SDL_SCANCODE_KP_3:
	case SDL_SCANCODE_PAGEDOWN: return 81;
	case SDL_SCANCODE_KP_0:
	case SDL_SCANCODE_INSERT: return 82;
	case SDL_SCANCODE_KP_PERIOD:
	case SDL_SCANCODE_DELETE: return 83;
	case SDL_SCANCODE_F11: return 87;
	case SDL_SCANCODE_F12: return 88;
	default: return -1;
	}
}
#endif

// Weak default: games whose INT 9 hardware-keyboard ISR was not translated
// (kept as data bytes) provide a strong override to maintain their held-key
// bitmask. Called on every host key make (pressed) / break (released).
// host_int9_diverts_key mirrors the real ISR's routing: a key is diverted to the
// held-key bitmask only when it has a table entry; all other keys (and keys
// pressed while the ISR is disabled) still reach the BIOS buffer for INT 16h.
__attribute__((weak)) void host_int9_update(int scan_code, bool pressed) {}
__attribute__((weak)) bool host_int9_diverts_key(int scan_code) { return false; }

// Terminal (stdin) input produces only key-down events -- there is no release.
// Emulate a short key tap: raise the held-key bit immediately, then release it
// ~60ms later so menus that sample the held-key bitmask register one press.
struct HostTap { int scan; uint64_t release_us; };
static HostTap host_taps[8];
static int host_tap_count = 0;

static void host_int9_tap(int scan_code) {
	if (scan_code <= 0 || scan_code >= 0x80) return;
	host_int9_update(scan_code, true);
	if (host_tap_count < 8) {
		host_taps[host_tap_count].scan = scan_code;
		host_taps[host_tap_count].release_us = host_now_us() + 60000;
		++host_tap_count;
	}
}

static void host_int9_release_taps() {
	const uint64_t now = host_now_us();
	for (int i = 0; i < host_tap_count; ++i) {
		if (now >= host_taps[i].release_us) {
			host_int9_update(host_taps[i].scan, false);
			host_taps[i] = host_taps[--host_tap_count];
			--i;
		}
	}
}

static void host_set_key(int scan_code, bool pressed) {
	if (scan_code < 0 || scan_code >= 128) {
		return;
	}
	host.keyboard_scan_code = pressed ? scan_code : (scan_code | 0x80);
	// Real hardware raises IRQ1 -> the game's int9 ISR (KbdIntr) reads port
	// 0x60 and updates its Key[] held-state table. Queue the port-0x60 byte so
	// the game thread fires vector 0x9; without it the table never updates.
	host_queue_irq9((db)(pressed ? scan_code : (scan_code | 0x80)));
	// The game's INT 9 held-key bitmask is independent of the generic key[]
	// table; update it even when that table is absent (key is a null weak sym).
	host_int9_update(scan_code, pressed);
	db* keys = host_key_state();
	if (keys == nullptr) {
		return;
	}
	keys[scan_code] = pressed ? 1 : 0;
	switch (scan_code) {
	case 42:
		keys[54] = keys[42];
		break;
	case 54:
		keys[42] = keys[54];
		break;
	case 12:
		keys[74] = keys[12];
		break;
	case 74:
		keys[12] = keys[74];
		break;
	case 13:
		keys[78] = keys[13];
		break;
	case 78:
		keys[13] = keys[78];
		break;
	default:
		break;
	}
}

#ifndef NOSDL
static db sdl_keycode_to_bios_ascii(SDL_Keycode keycode, SDL_Keymod modifiers) {
	const bool shifted = (modifiers & KMOD_SHIFT) != 0;
	if (keycode >= SDLK_a && keycode <= SDLK_z) {
		const int letter = keycode - SDLK_a;
		return static_cast<db>((shifted ? 'A' : 'a') + letter);
	}
	if (keycode >= SDLK_0 && keycode <= SDLK_9) {
		static const char normal[] = "0123456789";
		static const char shifted_digits[] = ")!@#$%^&*(";
		const int digit = keycode - SDLK_0;
		return static_cast<db>((shifted ? shifted_digits : normal)[digit]);
	}
	switch (keycode) {
	case SDLK_SPACE: return ' ';
	case SDLK_RETURN:
	case SDLK_KP_ENTER: return '\r';
	case SDLK_ESCAPE: return 0x1b;
	case SDLK_BACKSPACE: return '\b';
	case SDLK_TAB: return '\t';
	case SDLK_MINUS: return shifted ? '_' : '-';
	case SDLK_EQUALS: return shifted ? '+' : '=';
	case SDLK_LEFTBRACKET: return shifted ? '{' : '[';
	case SDLK_RIGHTBRACKET: return shifted ? '}' : ']';
	case SDLK_BACKSLASH: return shifted ? '|' : '\\';
	case SDLK_SEMICOLON: return shifted ? ':' : ';';
	case SDLK_QUOTE: return shifted ? '"' : '\'';
	case SDLK_COMMA: return shifted ? '<' : ',';
	case SDLK_PERIOD: return shifted ? '>' : '.';
	case SDLK_SLASH: return shifted ? '?' : '/';
	case SDLK_BACKQUOTE: return shifted ? '~' : '`';
	default: return 0;
	}
}

static dw sdl_key_event_to_bios_key(const SDL_KeyboardEvent& event) {
	const int scan_code = sdl_scancode_to_pc(event.keysym.scancode);
	if (scan_code < 0 || scan_code > 0xff) {
		return 0;
	}
	return static_cast<dw>((scan_code << 8) | sdl_keycode_to_bios_ascii(event.keysym.sym, SDL_GetModState()));
}
#endif

// The game timer handlers are far procedures ending in RETF/IRET. Like a real
// interrupt, push a frame onto the current stack: the handler's final far
// return pops it and unwinds to C++ (is_dos_terminate_vector treats 0:0 as the
// synthesized-frame sentinel). The whole CPU state is restored afterwards: an
// interrupt must not leak the popped sentinel values (cs=0, eip=0) or an
// unbalanced sp into the interrupted code.
static void host_run_timer_handler(m2cf* handler, struct _STATE* _state) {
	const struct _STATE saved = *_state;
	// Snapshot native-return bookkeeping; a StackPop unwind out of the handler
	// can bypass the matching RET and leave stale marks behind.
	const size_t saved_marks = m2c::native_return_marks.size();
	const size_t saved_values = m2c::native_return_values.size();
	const size_t saved_depth = m2c::native_return_call_depth;
	const bool saved_suppress = m2c::suppress_native_return_push_transfer;
	m2c::suppress_native_return_push_transfer = true;
	PUSH_((dw)0, _state); // flags slot (IRET) / padding (RETF)
	PUSH_((dw)0, _state); // sentinel cs
	PUSH_((dw)0, _state); // sentinel ip=0 -> unwind to C++
	m2c::suppress_native_return_push_transfer = saved_suppress;
#ifdef SHADOW_STACK
	// Isolate the handler's bookkeeping: its pushes/rets must not perturb the
	// interrupted code's call-depth accounting (spurious StackPop unwinds).
	const ShadowStack::SavedState saved_shadow = m2c::shadow_stack.save_state();
#endif
	try {
		handler(0, _state);
	} catch (const m2c::StackPop&) {
		// A RETF inside the handler unwound past the interrupt entry frame.
		// The emulated state is restored below either way.
	}
	*_state = saved;
	m2c::native_return_marks.resize(saved_marks);
	m2c::native_return_values.resize(saved_values);
	m2c::native_return_call_depth = saved_depth;
	m2c::suppress_native_return_push_transfer = saved_suppress;
#ifdef SHADOW_STACK
	m2c::shadow_stack.restore_state(saved_shadow);
	// The sentinel words and the handler's own pushes left frames below the
	// live stack top; they are stale now and would otherwise be miscounted as
	// uncontrolled pops by later scans.
	m2c::shadow_stack.clear_frames_below((dw)saved.esp);
#endif
}

static void host_run_timer(struct _STATE* _state) {
	if (!host.timer.enabled || host.timer.in_callback) {
		return;
	}
	if (m2c_deterministic()) {
		// Deterministic: drip-det_step IRQ0 ticks per rendered frame, spread one
		// per poll rather than bunched -- the game's 100Hz ISR then samples key
		// state across the frame like a real PIT, so short key taps still
		// register, and the per-frame tick count stays identical across builds.
		static int budget = 0;
		static unsigned last_det = 0;
		const unsigned now = g_det_flip_tick;
		if (now != last_det) {
			budget += (int)(now - last_det) * m2c_det_step();
			last_det = now;
		}
		if (budget > 0) {
			--budget;
			HostIrqCallbackGuard callback_guard;
			host_fire_ivt(0x08, _state);
		}
		return;
	}
	const uint64_t now_us = host_now_us();
	if (host.timer.last_us == 0) {
		host.timer.last_us = now_us;
		return;
	}
	uint64_t delta_us = now_us - host.timer.last_us;
	host.timer.last_us = now_us;
	delta_us = std::min<uint64_t>(delta_us, 250000);
	host.timer.accum_us += delta_us;

	HostIrqCallbackGuard callback_guard;
	int ticks_this_pump = 0;
	while (host.timer.accum_us >= 10000 && ticks_this_pump < 5) {
		host.timer.accum_us -= 10000;
		++ticks_this_pump;
		/* Fire the installed IRQ0 handler (IVT[8] -> timerintr) through the
		   cooperative-IRQ path. timerintr sets ds=DATA, updates the counters,
		   checks the user-vector flags and CALLFs the registered 100Hz/20Hz
		   user procs with the correct segment -- the
		   same work a real PIT tick performs. Calling the user procs directly
		   here ran them on the shared _state with a stale cs/ds and ignored
		   IF, which corrupted far-return dispatch whenever a tick landed mid
		   `int`/cli window. */
		host_fire_ivt(0x08, _state);
	}
}

static void poll_host_stdin() {
#if !defined(_WIN32) && !defined(__DJGPP__)
	/* Terminal arrow keys arrive as CSI "ESC [ <final>". Parse that sequence so
	   they produce PC extended keys (AL=0, AH=scancode) the menu code expects.
	   A bare ESC (no '[' following) still pushes the Escape key. */
	static int esc_state = 0;   // 0 = normal, 1 = got ESC, 2 = got "ESC ["
	for (int n = 0; n < 8 && !host_keyboard_buffer_full(); ++n) {
		fd_set readfds;
		FD_ZERO(&readfds);
		FD_SET(STDIN_FILENO, &readfds);
		timeval timeout = {0, 0};
		if (select(STDIN_FILENO + 1, &readfds, NULL, NULL, &timeout) <= 0 ||
		    !FD_ISSET(STDIN_FILENO, &readfds)) {
			break;
		}
		unsigned char ch = 0;
		if (read(STDIN_FILENO, &ch, 1) <= 0) {
			break;
		}
		dw key = 0;
		if (esc_state == 0) {
			if (ch == 0x1b) { esc_state = 1; continue; }
			key = host_stdin_char_to_bios_key(ch);
		} else if (esc_state == 1) {
			if (ch == '[') { esc_state = 2; continue; }
			esc_state = 0;
			host_keyboard_push(host_stdin_char_to_bios_key(0x1b));
			if (host_keyboard_buffer_full()) break;
			key = host_stdin_char_to_bios_key(ch);   // ESC then a normal key
		} else { // esc_state == 2, final byte of CSI
			esc_state = 0;
			int scan = 0;
			switch (ch) {
			case 'A': scan = 0x48; break; // up
			case 'B': scan = 0x50; break; // down
			case 'C': scan = 0x4d; break; // right
			case 'D': scan = 0x4b; break; // left
			case 'H': scan = 0x47; break; // home
			case 'F': scan = 0x4f; break; // end
			default: break;
			}
			if (!scan) continue;
			key = (dw)(scan << 8); // extended key: AL=0, AH=scancode
		}
		if (key) {
			// Real hardware raises IRQ1 (int9 ISR updates the game's Key[]
			// held-state) AND lands the key in the BIOS buffer for INT 16h;
			// deliver to both. Terminal input has no release event, so tap:
			// press then release so the key doesn't latch held forever.
			const int scan = (key >> 8) & 0x7f;
			if (scan && !getenv("M2C_NO_INT9")) {
				host_set_key(scan, true);
				host_set_key(scan, false);
			}
			if (!getenv("M2C_NO_BIOSQ"))
				host_keyboard_push(key);
		}
	}
#endif
}

#ifndef NOCURSES
static void host_render_text_memory() {
	if (host_gfx_mode()) {
		// Graphics modes: show the char-cell shadow (text drawn via int10
		// AH=09) on the terminal at the mode's column width.
		static db cshadow[HostVga::TEXT_ROWS * HostVga::TEXT_COLS];
		const int cols = cga_text_cols();
		if (std::memcmp(host.vga.cga_cells, cshadow, sizeof(cshadow)) == 0) {
			return;
		}
		std::memcpy(cshadow, host.vga.cga_cells, sizeof(cshadow));
		for (int row = 0; row < HostVga::TEXT_ROWS; ++row) {
			for (int col = 0; col < cols; ++col) {
				const db ch = host.vga.cga_cells[row][col];
				mvaddch(row, col, ch ? ch : ' ');
			}
		}
		const db page = host_text_page(host.vga.active_page);
		move(host.vga.cursor_row[page], host.vga.cursor_col[page]);
		refresh();
		return;
	}
	if (host.vga.current_mode > 3 && host.vga.current_mode != 7) {
		return;
	}
	static db shadow[80 * 25 * 2] = {};
	const db *vram = reinterpret_cast<const db*>(&m) +
		(static_cast<size_t>(host.vga.current_mode == 7 ? 0xB0000 : 0xB8000));
	if (std::memcmp(vram, shadow, sizeof(shadow)) == 0) {
		return;
	}
	std::memcpy(shadow, vram, sizeof(shadow));
	for (int pos = 0; pos < 80 * 25; ++pos) {
		const db ch = vram[pos * 2] ? vram[pos * 2] : ' ';
		const db attr = vram[pos * 2 + 1];
		const int pair = ((attr >> 4) & 0x0f) * 16 + (attr & 0x0f);
		mvaddch(pos / 80, pos % 80, ch | COLOR_PAIR(pair));
	}
	const db page = host_text_page(host.vga.active_page);
	move(host.vga.cursor_row[page], host.vga.cursor_col[page]);
	refresh();
}
#endif

#ifndef NOSDL
/* Drain the SDL event queue into host key/mouse state. Runs on the game thread.
   Must be pumped continuously: a game that polls its int9 Key[] table in a
   tight loop (e.g. Tornado flight controls) never reaches the BIOS int16/int8
   waits where poll_host_events is invoked, so SDL_KEYDOWNs would queue forever
   and the game would appear to ignore input. */
static void host_pump_sdl_events() {
	if ((SDL_WasInit(SDL_INIT_VIDEO) & SDL_INIT_VIDEO) == 0) {
		return;
	}
	SDL_Event event;
	while (SDL_PollEvent(&event)) {
		switch (event.type) {
		case SDL_QUIT:
			executionFinished = true;
			jumpToBackGround = true;
			/* The window-close control must end the process now: the
			   generated flight loop only consults executionFinished when a
			   call happens to return false, so the flag alone leaves the
			   game running long after the window is gone. exit() still runs
			   atexit handlers (midi_flush, capture dump, etc). */
			exit(0);
			break;
		case SDL_MOUSEMOTION:
			host.mouse.x = event.motion.x;
			host.mouse.y = event.motion.y;
			host.mouse.motion_x += event.motion.xrel;
			host.mouse.motion_y += event.motion.yrel;
			clamp_host_mouse();
			break;
		case SDL_MOUSEBUTTONDOWN:
		case SDL_MOUSEBUTTONUP: {
			int bit = 0;
			if (event.button.button == SDL_BUTTON_LEFT) {
				bit = 1;
			} else if (event.button.button == SDL_BUTTON_RIGHT) {
				bit = 2;
			} else if (event.button.button == SDL_BUTTON_MIDDLE) {
				bit = 4;
			}
			if (event.type == SDL_MOUSEBUTTONDOWN) {
				host.mouse.buttons |= bit;
			} else {
				host.mouse.buttons &= ~bit;
			}
			break;
		}
		case SDL_KEYDOWN:
		case SDL_KEYUP: {
			const int pc_scan =
				sdl_scancode_to_pc(event.key.keysym.scancode);
			if (getenv("M2C_KEYDBG")) fprintf(stderr, "sdlkey sc=%d pc=%d dn=%d\n",
				event.key.keysym.scancode, pc_scan, event.type==SDL_KEYDOWN);
			host_set_key(pc_scan, event.type == SDL_KEYDOWN);
			// A key diverted to the game's held-key bitmask (mapped in its
			// INT 9 ISR table) is consumed by it; every other key still
			// chains to the BIOS buffer for INT 16h, as on real hardware.
			if (event.type == SDL_KEYDOWN && event.key.repeat == 0 &&
				!host_int9_diverts_key(pc_scan)) {
				host_keyboard_push(sdl_key_event_to_bios_key(event.key));
			}
			break;
		}
		default:
			break;
		}
	}
}
#endif

static void poll_host_events(struct _STATE* _state) {
	poll_host_stdin();
	host_int9_release_taps();
#ifndef NOCURSES
	host_render_text_memory();
#endif
#ifndef NOSDL
	host_pump_sdl_events();
#endif
	/* Idle interpreters that neither present nor poll 0x3DA would never tick
	   the keyscript; pace it here (~30ms) so scripted input still delivers. */
	if (!m2c_deterministic() && getenv("M2C_KEYSCRIPT")) {
		static uint64_t last_ks_ms = 0;
		const uint64_t now_ms = std::chrono::duration_cast<std::chrono::milliseconds>(
			std::chrono::steady_clock::now().time_since_epoch()).count();
		if (now_ms - last_ks_ms >= 30) {
			last_ks_ms = now_ms;
			host_keyscript_tick();
		}
	}
	host_run_timer(_state);
	host_drain_irq();
#ifndef NOSDL
	/* CGA graphics modes write pixels straight into guest VRAM at B800 — no
	   write hook exists there, so diff the framebuffer each poll and present
	   on change. Same for text modes: GW-BASIC pokes char/attr cells through
	   ES=B800 directly. */
	if ((host_gfx_mode() || host_text_mode()) && renderer) {
		static db cga_shadow[0x4000] = {};
		const db* vram = reinterpret_cast<const db*>(&m) + 0xB8000;
		if (std::memcmp(vram, cga_shadow, sizeof(cga_shadow)) != 0) {
			std::memcpy(cga_shadow, vram, sizeof(cga_shadow));
			vga_render_dirty = true;
		}
	}
	/* Flush any pending frame tail on screens that draw then idle waiting for
	   input without polling the retrace port; rate-limited so it stays cheap. */
	vga_present_pending();
#endif
	// M2C_MEMDUMP="file,off,len" — dump len bytes of guest image at &m+off.
	// Change-detection mode: FNV-1a the region each poll and write a
	// sequenced file_NNNNN dump only when it differs — a timing-independent
	// series of screen states matching det.cpp's DOSBOX_MEMDUMP_CHANGED.
	{	const char *spec = getenv("M2C_MEMDUMP");
		if (spec && *spec) {
			static char md_path[512]; static unsigned long md_off = 0, md_len = 0;
			static bool md_ready = false;
			if (!md_ready) {
				md_ready = std::sscanf(spec, "%511[^,],%lx,%lx", md_path, &md_off, &md_len) == 3;
			}
			if (md_ready) {
				static uint64_t md_prev = 0;
				static unsigned md_seq = 0;
				const db *p = ((const db*)&m2c::m) + md_off;
				uint64_t h = 1469598103934665603ull;
				for (unsigned long i = 0; i < md_len; ++i) h = (h ^ p[i]) * 1099511628211ull;
				if (h != md_prev) {
					md_prev = h;
					char path[600]; char seq[32];
					snprintf(seq, sizeof(seq), "_%05u", ++md_seq);
					snprintf(path, sizeof(path), "%s", md_path);
					char *dot = strrchr(path, '.');
					if (dot) { memmove(dot + strlen(seq), dot, strlen(dot) + 1); memcpy(dot, seq, strlen(seq)); }
					else snprintf(path + strlen(path), sizeof(path) - strlen(path), "%s", seq);
					FILE *f = std::fopen(path, "wb");
					if (f) { std::fwrite(p, 1, md_len, f); std::fclose(f); }
				}
			}
		}
	}
}

static bool host_keyboard_wait(struct _STATE* _state, dw* bios_key) {
	while (!executionFinished) {
		poll_host_events(_state);
		if (host_keyboard_pop(bios_key)) {
			return true;
		}
		std::this_thread::sleep_for(std::chrono::milliseconds(1));
	}
	return false;
}

#define MAX_FMT_SIZE 1024
void log_error(const char *fmt, ...) {
	char formatted_string[MAX_FMT_SIZE];
	va_list argptr;
	va_start(argptr,fmt);
	vsprintf (formatted_string,fmt, argptr);
	va_end(argptr);
#ifdef __LIBRETRO__
	log_cb(RETRO_LOG_ERROR,"%s",formatted_string);
#else
	if (logDebug!=NULL) { fprintf(logDebug,"%s",formatted_string); fflush(logDebug);}
	{ printf("%s",formatted_string); }
	/* Errors must be visible even when stdout is redirected into a trace
	 * file or /dev/null -- always mirror to stderr and flush. */
	{ fprintf(stderr, "%s", formatted_string); fflush(stderr); }
#endif
}
void log_debug(const char *fmt, ...) {
#if M2CDEBUG
	char formatted_string[MAX_FMT_SIZE];
	va_list argptr;
	va_start(argptr,fmt);
	vsprintf (formatted_string,fmt, argptr);
	va_end(argptr);
#ifdef __LIBRETRO__
	log_cb(RETRO_LOG_DEBUG,"%s",formatted_string);
#else
	if (logDebug!=NULL) { fprintf(logDebug,"%s",formatted_string); fflush(logDebug); } else { printf("%s",formatted_string); }
#endif
#endif
}

void log_info(const char *fmt, ...) {
	char formatted_string[MAX_FMT_SIZE];
	va_list argptr;
	va_start(argptr,fmt);
	vsprintf (formatted_string,fmt, argptr);
	va_end(argptr);
#ifdef __LIBRETRO__
	log_cb(RETRO_LOG_INFO,"%s",formatted_string);
#else
	if (logDebug!=NULL) { fprintf(logDebug,"%s",formatted_string); fflush(logDebug); } else { printf("%s",formatted_string); }
#endif
}

void log_debug2(const char *fmt, ...) {
#if M2CDEBUG>=2
	char formatted_string[MAX_FMT_SIZE];
	va_list argptr;
	va_start(argptr,fmt);
	vsprintf (formatted_string,fmt, argptr);
	va_end(argptr);
	log_debug(formatted_string);
#endif
}

void checkIfVgaRamEmpty() {
#ifndef NOSDL
 #if SDL_MAJOR_VERSION == 2
	int i;
	int vgaram_empty = 1;
	for(i = 0; i < VGARAM_SIZE; i++)
		if(vgaRam[i])
			vgaram_empty = 0;
	log_debug("vgaram_empty : %s\n", vgaram_empty ? "true" : "false");
	(void) vgaram_empty;
 #endif
#endif
}

void stackDump(struct _STATE* _state) {
	if (!_state) {
		log_debug("stackDump skipped: no CPU state provided\n");
		return;
	}
X86_REGREF

	log_debug("is_little_endian()=%d\n",isLittle);
	log_debug("sizeof(dd)=%zu\n",sizeof(dd));
	log_debug("sizeof(dd *)=%zu\n",sizeof(dd *));
	log_debug("sizeof(dw)=%zu\n",sizeof(dw));
	log_debug("sizeof(db)=%zu\n",sizeof(db));
//	log_debug("sizeof(jmp_buf)=%zu\n",sizeof(jmp_buf));
//	log_debug("sizeof(mem)=%zu\n",sizeof(m));
	log_debug("eax: %x\n",eax);
//	hexDump(&eax,sizeof(dd));
	log_debug("ebx: %x\n",ebx);
	log_debug("ecx: %x\n",ecx);
	log_debug("edx: %x\n",edx);
	log_debug("ebp: %x\n",ebp);
	log_debug("cs: %d -> %p\n",cs,(void *) realAddress(0,cs));
	log_debug("ds: %d -> %p\n",ds,(void *) realAddress(0,ds));
	log_debug("esi: %x\n",esi);
	log_debug("ds:esi %p\n",(void *) realAddress(esi,ds));
	log_debug("es: %d -> %p\n",es,(void *) realAddress(0,es));
	hexDump(&es,sizeof(dd));
	log_debug("edi: %x\n",edi);
	log_debug("es:edi %p\n",(void *) realAddress(edi,es));
	log_debug("es:edi hex dump skipped; diagnostic dumps must not dereference arbitrary emulated addresses\n");
	log_debug("fs: %d -> %p\n",fs,(void *) realAddress(0,fs));
	log_debug("gs: %d -> %p\n",gs,(void *) realAddress(0,gs));
//	log_debug("adress heap: %p\n",(void *) &m.heap);
#ifndef NOSDL
 #if SDL_MAJOR_VERSION == 2
	log_debug("adress vgaRam: %p\n",(void *) &vgaRam);
	log_debug("first pixels vgaRam: %x\n",*vgaRam);
 #endif
#endif
	log_debug("flags: ZF = %d\n",GET_ZF());
	log_debug("top stack=%d\n",stackPointer);
	// Diagnostic: dump the emulated stack window around ss:sp so the failing
	// return-address chain is visible even when debug logging is compiled out.
	{
		db* sb = (db*)m2c::stack_raddr_(ss, (dw)(stackPointer - 16));
		fprintf(stderr, "[stackdump] ss=%04x sp=%04x words from sp-16:\n", ss, stackPointer);
		for (int i = -16; i < 64; i += 2) {
			dw w = *(dw*)(sb + (i + 16));
			fprintf(stderr, "  sp%+03d = %04x\n", i, w);
		}
		// Dump the tracked native-return marks/values so a dispatch failure
		// shows which return markers are live and at what sp/depth.
		fprintf(stderr, "[marks] depth=%zu nmarks=%zu nvals=%zu\n",
			(size_t)native_return_call_depth,
			native_return_marks.size(), native_return_values.size());
		int shown = 0;
		for (auto it = native_return_marks.rbegin();
		     it != native_return_marks.rend() && shown < 12; ++it, ++shown) {
			fprintf(stderr, "  mark rip=%04x ss=%04x sp=%04x depth=%zu id=%zu\n",
				(unsigned)it->return_ip, it->stack_segment,
				it->stack_offset, it->call_depth, it->id);
		}
		for (auto it = native_return_values.rbegin();
		     it != native_return_values.rend() && shown < 24; ++it, ++shown) {
			fprintf(stderr, "  val  rip=%04x depth=%zu id=%zu carrier=%p\n",
				(unsigned)it->return_ip, it->call_depth, it->id, it->carrier);
		}
		fflush(stderr);
	}
	checkIfVgaRamEmpty();
}

// thanks to paxdiablo http://stackoverflow.com/users/14860/paxdiablo for the hexDump function
void hexDump (void *addr, int len) {
	int i;
	unsigned char buff[17];
	unsigned char *pc = (unsigned char*)addr;
	(void) buff;
	log_debug ("hexDump %p:\n", addr);

	if (len == 0) {
		log_debug("  ZERO LENGTH\n");
		return;
	}
	if (len < 0) {
		log_debug("  NEGATIVE LENGTH: %i\n",len);
		return;
	}

	// Process every byte in the data.
	for (i = 0; i < len; i++) {
		// Multiple of 16 means new line (with line offset).

		if ((i % 16) == 0) {
			// Just don't print ASCII for the zeroth line.
			if (i != 0)
				log_debug ("  %s\n", buff);

			// Output the offset.
			log_debug ("  %04x ", i);
		}

		// Now the hex code for the specific character.
		log_debug (" %02x", pc[i]);

		// And store a printable ASCII character for later.
		if ((pc[i] < 0x20) || (pc[i] > 0x7e))
			buff[i % 16] = '.';
		else
			buff[i % 16] = pc[i];
		buff[(i % 16) + 1] = '\0';
	}

	// Pad out last line if not exactly 16 characters.
	while ((i % 16) != 0) {
		log_debug ("   ");
		i++;
	}

	// And print the final ASCII bit.
	log_debug ("  %s\n", buff);
}

void asm2C_OUT(int16_t address, int data,_STATE* _state) {
#ifdef __DJGPP__
	outportb(address, data);
#else
X86_REGREF
	if ((data & ~0xff) != 0) {
		const int port = address & 0xffff;
		if (port == 0x3c4 || port == 0x3ce || port == 0x3d4) {
			asm2C_OUT(address, data & 0xff, _state);
			asm2C_OUT(address + 1, (data >> 8) & 0xff, _state);
			return;
		}
	}
	data &= 0xff;
	switch(address & 0xffff) {
	case 0x00:
	case 0x01:
	case 0x02:
	case 0x03:
	case 0x04:
	case 0x05:
	case 0x06:
	case 0x07:
	case 0x08:
	case 0x09:
	case 0x0a:
	case 0x0b:
	case 0x0c:
	case 0x0d:
	case 0x0e:
	case 0x0f:
		break; // 8237 DMA controller ports; hosted runtime does not execute DMA transfers.
	case 0x20:
	case 0x21:
		break;
		case 0x40:
			host.pit.channel0_latch = data;
			// In lobyte-then-hibyte mode (control 0x36) the first write is the
			// low divisor byte, the second the high byte. When the divisor
			// completes, derive the int8 tick period (PIT clock ~1.19318 MHz).
			if (!host.pit.channel0_waiting_high) {
				host.pit.channel0_low = data;
				host.pit.channel0_waiting_high = true;
			} else {
				host.pit.channel0_divisor = (uint16_t)((data << 8) | host.pit.channel0_low);
				host.pit.channel0_waiting_high = false;
				uint32_t d = host.pit.channel0_divisor ? host.pit.channel0_divisor : 0x10000;
				host_irq_period_us.store((int)((d / 1193181.818) * 1000000.0));
			}
			break;
	case 0x43:
		// Channel-0 control with lobyte/hibyte access (0x3x) restarts the
		// two-write divisor sequence on port 0x40.
		if ((data & 0xc0) == 0 && (data & 0x30) == 0x30) {
			host.pit.channel0_waiting_high = false;
		}
		break;
	case 0x61:
		host.ppi_port_b = data;
		break;
	case 0x64:
		break; // 8042 keyboard controller command port.
	case 0xc0:
	case 0xc1:
		tandy_snd_write(data);
		break; // Tandy SN76496/NCR8496 sound chip.
	case 0x3c0:
		if (host.vga.attr_waiting_for_index) {
			host.vga.attr_index = data & 0x1f;
		} else {
			host.vga.attr_regs[host.vga.attr_index] = data;
		}
		host.vga.attr_waiting_for_index = !host.vga.attr_waiting_for_index;
		break;
	case 0x3c4:
		host.vga.seq_index = data;
		break;
	case 0x3c5:
		host.vga.seq_regs[host.vga.seq_index] = data;
		break;
	case 0x3c7:
		host.vga.dac_read_index = (static_cast<size_t>(data) * 3) % (256 * 3);
		break;
	case 0x3c8:
		host.vga.dac_write_index = (static_cast<size_t>(data) * 3) % (256 * 3);
		host.vga.dac_write_start = host.vga.dac_write_index;
		host.vga.dac_write_count = 0;
		break;
	case 0x3c9:
		if (host.vga.dac_write_index < 256 * 3) {
			vgaPalette[host.vga.dac_write_index]=data;
			host.vga.dac_write_index = (host.vga.dac_write_index + 1) % (256 * 3);
			++host.vga.dac_write_count;
			vga_maybe_dump_dac_upload();
  #if SDL_MAJOR_VERSION == 2 && !defined(NOSDL) && M2CDEBUG != -1
			vga_render_dirty = true;
  #endif
		} else {
			log_error("error: dac_write_index>767 %zu\n", host.vga.dac_write_index);
		}
		break;
	case 0x3ce:
		host.vga.gc_index = data;
		break;
	case 0x3cf:
		host.vga.gc_regs[host.vga.gc_index] = data;
		break;
	case 0x3d4:
		host.vga.crtc_index = data;
		break;
	case 0x3d5:
		host.vga.crtc_regs[host.vga.crtc_index] = data;
		// A write to CRTC start regs (0x0c/0x0d) completes the mode-X page flip:
		// exactly once per game frame. Hash the VRAM image on each flip for a
		// deterministic per-frame sequence independent of SDL present cadence.
		if (host.vga.crtc_index == 0x0c || host.vga.crtc_index == 0x0d) {
			static size_t last_start = (size_t)-1;
			const size_t cur = vga_crtc_start_byte_offset();
			{static unsigned _fl=0; if (getenv("M2C_STATEDBG") && (++_fl<30 || _fl%300==0)) fprintf(stderr,"[crtcflip #%u idx=%#x data=%#x cur=%#x last=%#x]\n",_fl,(int)host.vga.crtc_index,(int)data,(unsigned)cur,(unsigned)last_start);}
			if (cur != last_start) {
				last_start = cur;
				/* A CRTC start-address change is the mode-X page flip: the frame's
				   commit point on real hardware. Present the freshly-exposed page —
				   without this a game that draws the hidden page then flips never
				   triggers an SDL present and the window freezes. */
#if !defined(NOSDL)
				if (renderer) {
					vga_present_now();
				}
#endif
				if (m2c_deterministic()) {
					++g_det_flip_tick;
					++g_dbg_flip;
					host_keyscript_tick();
					// Fixed-step: each page flip = one game frame advances the
					// sim clock by a constant quantum, independent of wall clock.
					host_advance_timer_counters_n(m2c_det_step());
					++*(dd*)host_physical_address(0x40, 0x6c); // BIOS tick ~18.2Hz
					if (dw* f = host_frames_counter()) *f = m2c_force_lf() > 0 ? m2c_force_lf() : m2c_det_step(); // constant dt
				}
				vga_dump_flip_index();
				m2c_frame_tick_hash();
			}
		}
		break;
	default:
		log_error("unknown OUT %x,%x at %x:%x\n",address, data,cs,eip);
		break;
	}
#endif
}

int8_t asm2C_IN(int16_t address,_STATE* _state) {
#ifdef __DJGPP__
	return inportb(address);
#else
X86_REGREF
	poll_host_events(_state);
		static bool vblTick = 1;
			switch(address & 0xffff) {
			case 0x00:
				return 0;
			case 0x20:
			case 0x21:
				return 0;
			case 0x40:
				return host.pit.channel0_latch;
			case 0x60:
				return host.keyboard_scan_code;
		case 0x61:
			return host.ppi_port_b;
		case 0x64:
			return 0;  // keyboard controller status: no pending host scancode
		case 0x201:
			{
				return 0xff;  // no joystick
			}
	case 0x3c1:
		return host.vga.attr_regs[host.vga.attr_index];
	case 0x3c4:
		{
			static const int disable_ega = std::getenv("M2C_DISABLE_EGA") ? 1 : 0;
			if (disable_ega) {
				return 0;
			}
			return host.vga.seq_index;
		}
	case 0x3c5:
		return host.vga.seq_regs[host.vga.seq_index];
	case 0x3cf:
		return host.vga.gc_regs[host.vga.gc_index];
	case 0x3c9:
		{
			maybe_apply_registered_palette();
			const db value = vgaPalette[host.vga.dac_read_index];
			host.vga.dac_read_index = (host.vga.dac_read_index + 1) % (256 * 3);
			return value;
		}
	case 0x3d4:
		return host.vga.crtc_index;
	case 0x3b4:
		return host.vga.crtc_index;
	case 0x3DA:
		host.vga.attr_waiting_for_index = true;
#if SDL_MAJOR_VERSION == 2 && !defined(NOSDL)
		{static unsigned _da=0; if (getenv("M2C_STATEDBG") && (++_da<40 || _da%600==0)) fprintf(stderr,"[in3da #%u rdr=%p dirty=%d tid=%llx]\n",_da,(void*)renderer,(int)vga_render_dirty,(unsigned long long)std::hash<std::thread::id>()(std::this_thread::get_id()));}
#endif
  #if SDL_MAJOR_VERSION == 2 && !defined(NOSDL) && M2CDEBUG != -1
		vga_present_forced();
  #endif
		if (m2c_deterministic()) {
			// Fixed-step: alternate the retrace bit so the vblank poll sees a
			// deterministic edge each frame without wall-clock pacing.
			vblTick = !vblTick;
			return vblTick ? 8 : 0;
		}
		{
			/* Model ~70 Hz vertical retrace on the wall clock. The guest's
			   wait-for-vblank loop (in al,0x3da; test al,8; jz) then paces the
			   frame loop at display rate instead of free-running a core at 100%.
			   While "not in retrace" we yield so that spin loop sleeps instead
			   of burning CPU. */
			using vblclock = std::chrono::steady_clock;
			static vblclock::time_point last = vblclock::time_point::min();
			static vblclock::time_point lastYield = vblclock::time_point::min();
			const vblclock::time_point now = vblclock::now();
			if (last == vblclock::time_point::min()) {
				last = now;
			}
			const auto us = std::chrono::duration_cast<std::chrono::microseconds>(now - last).count();
			if (us >= 14000) {           // ~70 Hz retrace interval elapsed
				last = now;
				jumpToBackGround = 1;
				return 8;                // in vertical retrace
			}
			// Not yet retrace: yield ~0.5 ms so the poll loop doesn't spin.
			if (now - lastYield >= std::chrono::microseconds(500)) {
				lastYield = now;
				std::this_thread::sleep_for(std::chrono::microseconds(200));
			}
			return 0;
		}
		//break;
	case 0x3d5:
		return host.vga.crtc_regs[host.vga.crtc_index];
	case 0x3b5:
		return host.vga.crtc_regs[host.vga.crtc_index];
	default:
		log_error("Unknown IN %x at %x:%x\n",address,cs,eip);
		return 0;
	}
#endif
}

uint16_t asm2C_INW(uint16_t address,_STATE* _state) {
#ifdef __DJGPP__
	return inportw(address);
#else
X86_REGREF
	switch(address) {
	case 0x3DA:
		break;
	default:
		log_error("Unknown IN %x at %x:%x\n",address,cs,eip);
		return 0;
	}
#endif
	return 0;
}

bool is_little_endian_real_check() {
	union
	{
		uint16_t x;
		uint8_t y[2];
	} u;

	u.x = 1;
	return u.y[0];
}

/**
 * is_little_endian:
 *
 * Checks if the system is little endian or big-endian.
 *
 * Returns: greater than 0 if little-endian,
 * otherwise big-endian.
 **/
bool is_little_endian()
{
#if defined(__x86_64) || defined(__i386) || defined(_M_IX86) || defined(_M_X64)
	return 1;
#elif defined(MSB_FIRST)
	return 0;
#else
	return is_little_endian_real_check();
#endif
}


#ifndef __BORLANDC__ //TODO
//#if !CYGWIN
double realElapsedTime(void) {              // returns 0 first time called
#ifndef _WIN32
	struct timeval tv;
    gettimeofday(&tv, 0);
    return ((tv.tv_sec /*- t0.tv_sec*/ + (tv.tv_usec /* - t0.tv_usec*/)) / 1000000.) * 18.;
#else
	return 0;
#endif
}
#endif
/*
#else
#include <windows.h>
double realElapsedTime(void) {              // granularity about 50 microsecs
    static LARGE_INTEGER freq, start;
    LARGE_INTEGER count;
    if (!QueryPerformanceCounter(&count))
        assert(0 && "QueryPerformanceCounter");
    if (!freq.QuadPart) {                   // one time initialization
        if (!QueryPerformanceFrequency(&freq))
            assert(0 && "QueryPerformanceFrequency");
        start = count;
    }
    return (double)(count.QuadPart) / freq.QuadPart;
}
#endif
*/
void call_dos_realint(struct _STATE* _state, int a)
{

#ifdef __DJGPP__
X86_REGREF
	log_debug2("call_dos_realint %x ax=%x bx=%x cx=%x dx=%x\n",a,ax,bx,cx,dx);
__dpmi_regs _dpmi_reg;
   _dpmi_reg.x.ax = ax;
   _dpmi_reg.x.bx = bx;
   _dpmi_reg.x.cx = cx;
   _dpmi_reg.x.dx = dx;
   _dpmi_reg.x.si = si;
   _dpmi_reg.x.di = di;
   _dpmi_reg.x.bp = bp;
   _dpmi_reg.x.ds = ds;
   _dpmi_reg.x.es = es;
   __dpmi_int(a, &_dpmi_reg);
   ds = _dpmi_reg.x.ds;
   es = _dpmi_reg.x.es;
   ax = _dpmi_reg.x.ax;
   bx = _dpmi_reg.x.bx;
   cx = _dpmi_reg.x.cx;
   dx = _dpmi_reg.x.dx;
   si = _dpmi_reg.x.si;
   di = _dpmi_reg.x.di;
   bp = _dpmi_reg.x.bp;
#endif

}

void call_dos_protint(struct _STATE* _state, int a)
{
#ifdef __DJGPP__
X86_REGREF
// int21h: 9, 39h, 3Ah, 3Bh, 3Ch, 3Dh, 3Fh, 40h, 41h, 43h, 47h, 56h
	log_debug2("call_dos_protint %x eax=%x ebx=%x ecx=%x edx=%x\n",a,eax,ebx,ecx,edx);
     union REGS _dpmi_reg;
   _dpmi_reg.d.eax = eax;
   _dpmi_reg.d.ebx = ebx;
   _dpmi_reg.d.ecx = ecx;
   _dpmi_reg.d.edx = (dd)raddr(ds,dx);
   _dpmi_reg.d.esi = esi;
   _dpmi_reg.d.edi = (dd)raddr(es,di);//edi;
   _dpmi_reg.d.ebp = ebp;
   _dpmi_reg.d.ebx = ebx;

   int86(a, &_dpmi_reg, &_dpmi_reg);

   eax = _dpmi_reg.d.eax;
   ebx = _dpmi_reg.d.ebx;
   ecx = _dpmi_reg.d.ecx;
//   edx = _dpmi_reg.d.edx;
   esi = _dpmi_reg.d.esi;
   edi = _dpmi_reg.d.edi;
   ebx = _dpmi_reg.d.ebx;
   ebp = _dpmi_reg.d.ebp;
   AFFECT_CF(_dpmi_reg.d.cflag&1);
#endif

}


void asm2C_init() {
	isLittle=is_little_endian();
#ifdef MSB_FIRST
	if (isLittle) {
		log_error("Inconsistency: is_little_endian=true and MSB_FIRST defined.\n");
		exit(1);
	}
#endif
	if (isLittle!=is_little_endian_real_check()) {
		log_error("Inconsistency in little/big endianess detection. Please check if the Makefile sets MSB_FIRST properly for this architecture.\n");
		exit(1);
	}
	log_debug2("asm2C_init is_little_endian:%d\n",isLittle);
}


void asm2C_INT(struct _STATE* _state, int a) {
X86_REGREF
	static FILE * file;
	int i;
	AFFECT_CF(0);
	int rc;
#if M2CDEBUG>=2
	{
		static char last[128] = "";
		static int rep = 0;
		char cur[128];
		snprintf(cur, sizeof(cur), "INT%02x ax=%04x bx=%04x cx=%04x dx=%04x ds=%04x es=%04x\n",
			a, ax & 0xffff, bx & 0xffff, cx & 0xffff, dx & 0xffff, ds, es);
		if (!strcmp(cur, last)) { ++rep; }
		else {
			if (rep) { fprintf(stderr, "   [repeated x%d]\n", rep); rep = 0; }
			fprintf(stderr, "%s", cur);
			strncpy(last, cur, sizeof(last) - 1);
		}
	}
#endif
#define SUCCESS         0       /* Function was successful      */
	log_debug2("INT %x ax=%x bx=%x cx=%x dx=%x\n",a,ax,bx,cx,dx);


	switch(a) {
	case 0x80:
	case 0x81:
		/* Hosted Tornado builds load DOS sound driver binaries and invoke them
		   through private interrupts. The binaries are not executed here; expose
		   a deterministic no-op driver so translated sound code does not fall
		   into the generic unsupported interrupt path. */
		if (ah == 0x05 || ah == 0x14) {
			al = 0; // Tornado treats AL == 55h as "card missing".
		}
		AFFECT_CF(0);
		return;
	case 0x10:
	{
		switch(ah)
			{
			case 0: { // set mode
				host.vga.current_mode = al;
				switch(al)
				 {
				case 0x03: {
#ifndef NOCURSES
					resize_term(25, 80);
					clear();
					refresh();
#endif
					host_text_clear_all();
#ifndef NOSDL
 #if SDL_MAJOR_VERSION == 2
					ensure_sdl_vga_window(640, 400);
 #endif
#endif
					log_debug2("Switch to text mode\n");
					return;
				}
			
			case 0x04:
			case 0x05:
			case 0x06: {
				log_debug2("Switch to CGA mode %x\n", al);
				host.vga.cga_color_select = 0;
				host.vga.cga_palette = 0;
				cga_clear_screen();
#ifdef __DJGPP__
        call_dos_realint(_state, a);
#endif

#ifndef NOSDL
 #if SDL_MAJOR_VERSION == 2

				// Render CGA pixel-doubled to 640x400 so the window keeps the
				// same footprint as text mode (a real CGA fills the same CRT
				// area as 80x25 text; 320x200 pixels are 2x2 blocks).
				ensure_sdl_vga_window(640, 400);
				if (renderer) {
					SDL_SetRenderDrawColor(renderer, 0, 0, 0, 255);
					SDL_RenderClear(renderer);
					SDL_RenderPresent(renderer);
				}
 #endif
#endif
				return;
			}

				case 0x83: {
#ifndef NOCURSES

					resize_term(25, 80);
					refresh();
#endif
					host_text_clear_all();
					log_debug2("Switch to text mode\n");
					return;
				}
			case 0x13: {
				log_debug2("Switch to VGA\n");
				vga_set_mode13_defaults();
#ifdef __DJGPP__
        call_dos_realint(_state, a);
#endif

#ifndef NOSDL
 #if SDL_MAJOR_VERSION == 2

				init_sdl_vga_window();
				if (renderer) {
					SDL_SetRenderDrawColor(renderer, 0, 0, 0, 255);
					SDL_RenderClear(renderer);
					SDL_RenderPresent(renderer);
				}
 #endif
#endif
				//stackDump(_state);
				return;
			 }
			}

			}
			case 0x0f: { // get current video mode
				al = host.vga.current_mode;
				ah = 80;
				bh = host.vga.active_page;
				return;
			}
			case 0x02: { // set cursor
				const db page = host_text_page(bh);
				host.vga.cursor_row[page] = host_text_row(dh);
				host.vga.cursor_col[page] = host_text_col(dl);
#ifndef NOCURSES
				    int y,x;
					if (dh >= getmaxy(stdscr) || dl >= getmaxx(stdscr))
				{
					curs_set(0);
				}
				else
				{
//					curs_set(1);
					move(dh, dl);
					refresh();
				}
#endif
					return;
			}
			case 0x03: { // get cursor position and shape
				const db page = host_text_page(bh);
				ch = host.vga.cursor_start;
				cl = host.vga.cursor_end;
				dh = host.vga.cursor_row[page];
				dl = host.vga.cursor_col[page];
				return;
			}
			case 0x05: { // select active display page
				host.vga.active_page = host_text_page(al);
				return;
			}
			case 0x06: { // scroll up / clear window
				if (host_gfx_mode()) {
					cga_scroll_up_window(ch, cl, dh, dl, al);
				} else {
					host_text_scroll_up_window(host.vga.active_page, bh, ch, cl, dh, dl, al);
				}
#ifndef NOCURSES
				if (al == 0) {
					clear();
					refresh();
				}
#endif
				return;
			}
			case 0x08: { // read character and attribute at cursor
				const db page = host_text_page(bh);
				const db row = host.vga.cursor_row[page];
				const db col = host.vga.cursor_col[page];
				if (host_gfx_mode()) {
					al = host.vga.cga_cells[row][col];
					ah = 0;
					return;
				}
				const HostVga::TextCell &cell = host.vga.text[page][row][col];
				al = cell.ch;
				ah = cell.attr;
				return;
			}
			case 0x01: { // set cursor shape
				host.vga.cursor_start = ch;
				host.vga.cursor_end = cl;
				return;
			}
			case 0x09: { // write character and attribute at cursor
				const db page = host_text_page(bh);
				if (host_gfx_mode()) {
					const db row = host.vga.cursor_row[page];
					const db col = host.vga.cursor_col[page];
					for (dw n = 0; n < (cx ? cx : 1); ++n) {
						cga_draw_cell(row, col + n, al, bl);
					}
					return;
				}
				host_text_write(page, host.vga.cursor_row[page], host.vga.cursor_col[page], al, bl, cx);
#ifndef NOCURSES
				for (dw n = 0; n < cx; ++n) {
					addch(al);
				}
				refresh();
#endif
				return;
			}
			case 0x0b: { // set background/border/palette color
				if (bh == 0) {
					host.vga.cga_color_select = bl;
				} else if (bh == 1) {
					host.vga.cga_palette = bl;
				}
				return;
			}
		case 0x11: {        //set charset size
			switch(al)
			{
			case 0x11: {
#ifndef NOCURSES
				resize_term(30, 80);
				refresh();
#endif
				return;
			}
			case 0x12: {
#ifndef NOCURSES
				resize_term(50, 80);
				refresh();
#endif
				return;
			}
			}
			break;
		}
		case 0x10: {
				switch (al) {
				case 0x03:
					// Toggle intensity/blink. Hosted text output does not model
					// attribute blinking.
					return;
				case 0x00: // set individual palette (attribute) register: BL=index, BH=value
					host.vga.attr_regs[bl & 0x1f] = bh;
					return;
				case 0x01: // set overscan (border) color register: BH=value
					host.vga.attr_regs[0x11] = bh;
					return;
				case 0x02: { // set all palette registers + overscan: ES:DX -> 17 bytes
					db *src = host_physical_address(es, dx);
					if (src) {
						std::copy(src, src + 17, host.vga.attr_regs);
					}
					return;
				}
				case 0x07: // read individual palette register: BL=index -> BH
					bh = host.vga.attr_regs[bl & 0x1f];
					return;
				case 0x08: // read overscan register -> BH
					bh = host.vga.attr_regs[0x11];
					return;
				case 0x09: { // read all palette registers + overscan: ES:DX -> 17 bytes
					db *dst = host_physical_address(es, dx);
					if (dst) {
						std::copy(host.vga.attr_regs, host.vga.attr_regs + 17, dst);
					}
					return;
				}
				case 0x10: { // set individual DAC color register: BX=reg, DH=red, CH=green, CL=blue
					if (bx < 256) {
						vgaPalette[bx * 3 + 0] = dh;
						vgaPalette[bx * 3 + 1] = ch;
						vgaPalette[bx * 3 + 2] = cl;
#if SDL_MAJOR_VERSION == 2 && !defined(NOSDL) && M2CDEBUG != -1
						vga_render_dirty = true;
#endif
					}
					return;
				}
				case 0x12: { // set block of DAC color registers: ES:DX -> RGB triples, BX=first, CX=count
					db *src = host_physical_address(es, dx);
					if (src) {
						for (dw i = 0; i < cx && (bx + i) < 256; ++i) {
							vgaPalette[(bx + i) * 3 + 0] = src[i * 3 + 0];
							vgaPalette[(bx + i) * 3 + 1] = src[i * 3 + 1];
							vgaPalette[(bx + i) * 3 + 2] = src[i * 3 + 2];
						}
#if SDL_MAJOR_VERSION == 2 && !defined(NOSDL) && M2CDEBUG != -1
						vga_render_dirty = true;
#endif
					}
					return;
				}
				case 0x15: { // read individual DAC color register: BX=reg -> DH=red, CH=green, CL=blue
					if (bx < 256) {
						dh = vgaPalette[bx * 3 + 0];
						ch = vgaPalette[bx * 3 + 1];
						cl = vgaPalette[bx * 3 + 2];
					}
					return;
				}
				case 0x17: { // read block of DAC color registers: ES:DX -> buffer, BX=first, CX=count
					db *dst = host_physical_address(es, dx);
					if (dst) {
						for (dw i = 0; i < cx && (bx + i) < 256; ++i) {
							dst[i * 3 + 0] = vgaPalette[(bx + i) * 3 + 0];
							dst[i * 3 + 1] = vgaPalette[(bx + i) * 3 + 1];
							dst[i * 3 + 2] = vgaPalette[(bx + i) * 3 + 2];
						}
					}
					return;
				}
				}
			break;
		}
		case 0x1a: {        //vga
			switch(al)
			{
			case 0: {
				bx=8;  //vga
				al=0x1a;
				return;
			}
			}
			break;
			}
			case 0xef: {
				// OEM BIOS extension. Hosted mode has no adapter-specific action to
				// perform, but the call must report success.
				AFFECT_CF(0);
				return;
			}
		}
		break;
	}
	case 0x1A:
	{
#ifdef __DJGPP__
		call_dos_realint(_state, a);
		return;
#else
		const time_t raw_time = m2c_host_time();
		struct tm local_tm;
#if defined(_WIN32)
		localtime_s(&local_tm, &raw_time);
#else
		localtime_r(&raw_time, &local_tm);
#endif
		switch (ah) {
		case 0x00: {
			const uint32_t seconds = static_cast<uint32_t>(
				local_tm.tm_hour * 3600 + local_tm.tm_min * 60 + local_tm.tm_sec);
			const uint32_t ticks = static_cast<uint32_t>(seconds * 18.2065);
			cx = static_cast<dw>(ticks >> 16);
			dx = static_cast<dw>(ticks & 0xffff);
			al = 0;
			AFFECT_CF(0);
			return;
		}
		case 0x02:
			ch = host_to_bcd(local_tm.tm_hour);
			cl = host_to_bcd(local_tm.tm_min);
			dh = host_to_bcd(local_tm.tm_sec);
			dl = 0;
			AFFECT_CF(0);
			return;
		case 0x04: {
			const int year = local_tm.tm_year + 1900;
			ch = host_to_bcd(year / 100);
			cl = host_to_bcd(year % 100);
			dh = host_to_bcd(local_tm.tm_mon + 1);
			dl = host_to_bcd(local_tm.tm_mday);
			AFFECT_CF(0);
			return;
		}
		default:
			log_debug("Unsupported BIOS time INT 1Ah ah:0x%x al:0x%x\n", ah, al);
			AFFECT_CF(1);
			return;
		}
#endif
	}
	case 0x16:
	{
#ifdef __DJGPP__
		call_dos_realint(_state, a);
		return;
#else
		poll_host_events(_state);
		dw bios_key = 0;
		switch (ah) {
		case 0x00:
		case 0x10:
			if (host_keyboard_wait(_state, &bios_key)) {
				ax = bios_key;
				AFFECT_ZF(0);
			} else {
				ax = 0;
				AFFECT_ZF(1);
			}
			return;
		case 0x01:
		case 0x11:
			if (host_keyboard_peek(&bios_key)) {
				ax = bios_key;
				AFFECT_ZF(0);
			} else {
				ax = 0;
				AFFECT_ZF(1);
			}
			return;
		case 0x02:
			al = host_keyboard_shift_flags();
			return;
		case 0x05:
			al = host_keyboard_push(cx) ? 0 : 1;
			return;
		case 0x12:
			ax = host_keyboard_shift_flags();
			return;
		default:
			log_debug("Unsupported BIOS keyboard INT 16h ah:0x%x al:0x%x\n", ah, al);
			ax = 0;
			AFFECT_ZF(1);
			return;
		}
#endif
	}
	case 0x21:
		{
		if (ah == 0x48 || ah == 0x49 || ah == 0x4b || ah == 0x4c || ah == 0x09 || ah == 0x4a || ah == 0x3f)
			log_debug("int21 ah=%02x bx=%x dx=%x es=%x ds=%x at %x:%x\n", ah, bx, dx, es, ds, cs, eip);
		}
#ifdef __DJGPP__
		switch(ah)
		{
			case 0x9:
			case 0x19:
			case 0x1A:
			case 0x39:
			case 0x3A:
			case 0x3B:
			case 0x3C:
			case 0x3D:
			case 0x3E:
			case 0x3F:
			case 0x40:
			case 0x41:
			case 0x43:
			case 0x4e:
			case 0x4f:
//			case 0x47:
//			case 0x56:
			case 0x58:
			{
			call_dos_protint(_state, 0x21);
			return;
			}
			case 0x42:
			{
		        call_dos_realint(_state, a);
			}
			default:
				break;
		}
#endif
		switch(ah)
		{
		case 0x02: // Display character in DL
		{
#ifdef __DJGPP__
			call_dos_realint(_state, a);
#else
			std::putchar(dl);
			std::fflush(stdout);
			AFFECT_ZF(0);
#endif
			return;
		}
		case 0x06: // Direct console I/O
		{
#ifdef __DJGPP__
			call_dos_realint(_state, a);
#else
			if (dl == 0xff) {
				poll_host_events(_state);
				dw bios_key = 0;
				if (host_keyboard_pop(&bios_key)) {
					al = static_cast<db>(bios_key & 0xff);
					AFFECT_ZF(0);
				} else {
					al = 0;
					AFFECT_ZF(1);
				}
			} else {
				std::putchar(dl);
				std::fflush(stdout);
				al = dl;
				AFFECT_ZF(0);
			}
#endif
			return;
		}
		case 0x9:
		{
			char * s=(char *) realAddress(dx,ds);
			for (i=0; s[i]!='$'; i++) {
				printf("%c", s[i]);
			}
			return;
		}
		case 0xe: // select disk
		{
#ifdef __DJGPP__
//        call_dos_realint(_state, a);
     unsigned int _drives;
     _dos_setdrive(dl+1, &_drives);
     al = _drives;
#else
			al=1;
#endif
			return;
		}
		case 0x11: // search fcb
		case 0x12: // search fcb
		{
			al=0xff;
			return;
		}
		case 0x19: // Get default disk
		{
#ifdef __DJGPP__
        call_dos_realint(_state, a);
#else
			// def disk is C:
			al=0x2;
#endif
			return;
		}
		case 0x1A: // Set disk transfer addr
		{
			diskTransferAddr=(find_t *)realAddress(dx,ds);
			dta_seg = ds;
			dta_off = dx;
			return;
		}
		case 0x2F: // Get disk transfer addr -> ES:BX
		{
			es = dta_seg ? dta_seg : host.current_psp;
			bx = dta_off;
			return;
		}
			case 0x25: // Set disk transfer addr
			{
				*(dw *)host_physical_address(0,al*4)=dx;
				*(dw *)host_physical_address(0,al*4+2)=ds;
				rm_vec_set[al] = 1;
			if (getenv("M2C_IRQDBG") && (al==0x08||al==0x09||al==0x1c))
				fprintf(stderr,"SETVECT int=%02x ds:dx=%04x:%04x wptr=%p\n",(unsigned)al,(unsigned)ds,(unsigned)dx,(void*)host_physical_address(0,al*4));
			if (al == 0x08) {
				host.timer.enabled = true;
				host.timer.last_us = host_now_us();
				host.timer.accum_us = 0;
				host.timer.divider_20hz = 0;
				host_start_timer_thread();
				}
				return;
			}
				case 0x26:
					/* DOS "create PSP": copy the current program segment prefix
					 * into the segment supplied in DX. */
					{
						const void* psp = host_physical_address(host.current_psp, 0);
						if (m2c::copy_linked_program_segment_prefix) {
							m2c::copy_linked_program_segment_prefix(dx, psp, 0x100);
						} else {
							std::memmove(host_physical_address(dx, 0), psp, 0x100);
						}
					}
				AFFECT_CF(0);
				return;
			case 0x30: // ver
			{
				ax=5;
                        bx=0xff00;
                        cx=0;
			return;
		}
		case 0x35: // Set disk transfer addr
		{
			if (al == 0x33) {
				bx = 0x33 * 4;
				es = 0;
			} else {
				bx=*(dw *)host_physical_address(0,al*4);
				es=*(dw *)host_physical_address(0,al*4+2);
				if (getenv("M2C_IRQDBG") && (al==0x08||al==0x09))
					fprintf(stderr,"GETVECT int=%02x -> es:bx=%04x:%04x\n",(unsigned)al,(unsigned)es,(unsigned)bx);
			}
			return;
		}
		case 0x2a:
		{
#ifdef __DJGPP__
        call_dos_realint(_state, a);
			return;
#else
			const time_t raw_time = m2c_host_time();
			struct tm local_tm;
#if defined(_WIN32)
			localtime_s(&local_tm, &raw_time);
#else
			localtime_r(&raw_time, &local_tm);
#endif
			cx = static_cast<dw>(local_tm.tm_year + 1900);
			dh = static_cast<db>(local_tm.tm_mon + 1);
			dl = static_cast<db>(local_tm.tm_mday);
			al = static_cast<db>(local_tm.tm_wday);
			return;
#endif
		}
		case 0x2b:
			al = (cx >= 1980 && cx <= 2099 && dh >= 1 && dh <= 12 && dl >= 1 && dl <= 31) ? 0 : 0xff;
			return;
		case 0x2d:
			al = (ch <= 23 && cl <= 59 && dh <= 59 && dl <= 99) ? 0 : 0xff;
			return;
		case 0x2c:
		{
#ifdef __DJGPP__
        call_dos_realint(_state, a);
			return;
#else
			const time_t raw_time = m2c_host_time();
			struct tm local_tm;
#if defined(_WIN32)
			localtime_s(&local_tm, &raw_time);
#else
			localtime_r(&raw_time, &local_tm);
#endif
			ch = static_cast<db>(local_tm.tm_hour);
			cl = static_cast<db>(local_tm.tm_min);
			dh = static_cast<db>(local_tm.tm_sec);
			dl = 0;
			return;
#endif
		}
		case 0x3c: // create file (CX = attr)
		case 0x5a: // create temp file (DS:DX = dir path ending with '\')
		case 0x5b: // create new file (fail if exists)
		{
			char fileName[1040];
			if (ah == 0x5a) {
				// Build a name inside the given directory.
				char dir[1000];
				std::snprintf(dir, sizeof(dir), "%s", (const char *)realAddress(dx, ds));
				std::snprintf(fileName, sizeof(fileName), "%stl%04x.tmp", dir, (unsigned)(getpid() & 0xffff));
			} else {
				std::snprintf(fileName, sizeof(fileName), "%s", (const char *)realAddress(dx, ds));
			}
			if (fileName[0] == '\0') {
				ax = 3; // path not found
				AFFECT_CF(1);
				break;
			}
			if (ah == 0x5b && access(fileName, F_OK) == 0) {
				ax = 0x50; // file exists
				AFFECT_CF(1);
				break;
			}
			FILE * f = fopen(fileName, "w+b");
			log_debug2("dos create %s -> %p\n", fileName, (void *)f);
			if (!f) {
				ax = (access(fileName, F_OK) == 0 || ah == 0x5a) ? 5 : 3;
				AFFECT_CF(1);
				break;
			}
			dw h = dos_alloc_handle(f);
			if (h == 0xffff) { ax = 4; AFFECT_CF(1); break; }
			log_debug2("dos create %s -> handle %d\n", fileName, h);
			ax = h;
			AFFECT_CF(0);
			return;
		}
		case 0x3d: //open
		{
				char fileName[1000];
					snprintf(fileName,sizeof(fileName),"%s",(const char *) realAddress(dx, ds));
				if (fileName[0] == '\0') {
					ax = 2;
					AFFECT_CF(1);
					return;
				}
				const char * mode;
				switch (al & 7) {
				case 0: mode = "rb"; break;
				case 1: mode = "r+b"; break;
				case 2: mode = "r+b"; break;
				default: mode = "rb"; break;
				}
				FILE * f = fopen(fileName, mode);
				if (!f) {
					char resolved[1000];
					if (dos_resolve_case(fileName, resolved, sizeof(resolved)))
						f = fopen(resolved, mode);
				}
				log_debug2("Opening file %s -> %p\n",fileName,(void *) f);
				if (m2c_stats_enabled()) {
					std::fprintf(stderr, "dos open %s -> %p\n", fileName, static_cast<void *>(f));
				}
				if (f!=NULL) {
					dw h = dos_alloc_handle(f);
					if (h == 0xffff) { ax=4; AFFECT_CF(1); return; }
					eax=h;
					AFFECT_CF(0);
				} else {
					AFFECT_CF(1);
					ax = (errno == ENOENT) ? 2 : 5;
					std::fprintf(stderr, "Error opening file %s\n", fileName);
				}
			/*
			   // [Index]AH = 3Dh - "OPEN" - OPEN EXISTING FILE
			   Entry:

			   AL = access and sharing modes
			   DS:DX -> ASCIZ filename
			   Return:

			   CF clear if successful, AX = file handle
			    CF set on error AX = error code (01h,02h,03h,04h,05h,0Ch,56h)
			 */
			// TODO
			return;
		}
		case 0x3e: //close
		{
			log_debug2("Closing file. bx:%d\n",bx);
			FILE * f = dos_get_file(bx);
			if (!f && file && bx == 1) f = file;   // legacy single-handle compat
			if (!f) {
				// Closing a handle that was never opened is accepted
				// silently by the reference environment; keep it a no-op
				// so exit-time handle sweeps stay idempotent instead of
				// cascading into the fatal-error reporter.
				AFFECT_CF(0);
				return;
			}
			if (bx >= DOS_HANDLE_BASE && f != file) dos_files[bx - DOS_HANDLE_BASE] = nullptr;
			if (fclose(f)) {
				ax = 6;
				AFFECT_CF(1);
				log_error("Error closing file ? bx:%d\n",bx);
				return;
			}
			if (bx < DOS_HANDLE_BASE) dos_std[bx] = nullptr;
			if (f == file) file = NULL;
			AFFECT_CF(0);
			return;
		}
		case 0x41: // delete file (DS:DX -> ASCIZ name)
		{
			char fileName[1000];
			std::snprintf(fileName, sizeof(fileName), "%s", (const char *)realAddress(dx, ds));
			char resolved[1000];
			const char* target = dos_resolve_case(fileName, resolved, sizeof(resolved)) ? resolved : fileName;
			if (unlink(target) == 0) {
				AFFECT_CF(0);
			} else {
				ax = 2; // file not found
				AFFECT_CF(1);
			}
			return;
		}
		case 0x40: // write to file/device
		{
			// BX = handle, CX = count, DS:DX -> buffer
			void * buffer = (db *)realAddress(dx, ds);
			FILE * f = dos_get_file(bx);
			if (bx <= 4) {
				// std device: write to host stdout/stderr
				size_t w = fwrite(buffer, 1, cx, bx <= 2 ? stdout : stderr);
				ax = (dw)w;
				AFFECT_CF(0);
				return;
			}
			if (!f) {
				ax = 6;
				AFFECT_CF(1);
				return;
			}
			size_t w = fwrite(buffer, 1, cx, f);
			log_debug2("dos write handle=%d count=%d -> %zu\n", bx, cx, w);
			if (w != cx && ferror(f)) {
				ax = 5;
				AFFECT_CF(1);
				return;
			}
			ax = (dw)w;
			AFFECT_CF(0);
			return;
		}
		case 0x44: // ioctl (subset: get info)
		{
			// AL=0 get device info word; AL=8 check removable; others: fail
			if (al == 0) {
				dx = (bx <= 4) ? 0x80d3 : 0x0000; // isdev bit for std handles
				AFFECT_CF(0);
			} else if (al == 8) {
				ax = 1; // not removable
				AFFECT_CF(0);
			} else {
				ax = 1;
				AFFECT_CF(1);
			}
			return;
		}
		case 0x45: // dup handle
		{
			FILE * f = dos_get_file(bx);
			if (!f) { ax = 6; AFFECT_CF(1); return; }
			// Underlying OS dup so both handles share the file offset.
			// Mode must match the fd access mode or fdopen fails EINVAL.
			int dfd = dup(fileno(f));
			if (dfd < 0) { ax = 4; AFFECT_CF(1); return; }
			int acc = fcntl(dfd, F_GETFL) & O_ACCMODE;
			const char * dmode = acc == O_RDONLY ? "rb" : acc == O_WRONLY ? "ab" : "r+b";
			FILE * nf = fdopen(dfd, dmode);
			if (!nf) { close(dfd); ax = 4; AFFECT_CF(1); return; }
			dw h = dos_alloc_handle(nf);
			if (h == 0xffff) { ax = 4; AFFECT_CF(1); return; }
			ax = h;
			AFFECT_CF(0);
			return;
		}
		case 0x46: // force duplicate handle
		{
			FILE * f = dos_get_file(bx);
			if (!f) { ax = 6; AFFECT_CF(1); return; }
			if (cx >= DOS_HANDLE_BASE && cx - DOS_HANDLE_BASE < 0x40) {
				if (dos_files[cx - DOS_HANDLE_BASE])
					fclose(dos_files[cx - DOS_HANDLE_BASE]);
				dos_files[cx - DOS_HANDLE_BASE] = fdopen(dup(fileno(f)), "r+b");
				if (!dos_files[cx - DOS_HANDLE_BASE]) { ax = 4; AFFECT_CF(1); return; }
			}
			AFFECT_CF(0);
			return;
		}
		case 0x4d: // get child return code
		{
			ax = (dw)(dos_last_child_rc & 0xffff);
			ah = 0;   // terminated normally
			AFFECT_CF(0);
			return;
		}
		case 0x56: // rename file
		{
			char oldn[1000], newn[1000];
			std::snprintf(oldn, sizeof(oldn), "%s", (const char *)realAddress(dx, ds));
			std::snprintf(newn, sizeof(newn), "%s", (const char *)realAddress(di, es));
			if (rename(oldn, newn) == 0) { AFFECT_CF(0); }
			else { ax = (errno == ENOENT) ? 2 : 5; AFFECT_CF(1); }
			return;
		}
		case 0x57: // get/set file date+time (stub: get returns zeros)
		{
			if (!dos_get_file(bx)) { ax = 6; AFFECT_CF(1); return; }
			if (al == 0) { cx = dx = 0; AFFECT_CF(0); }
			else { AFFECT_CF(0); }
			return;
		}
		case 0x67: // set handle count
		case 0x68: // commit file
		{
			FILE * f = dos_get_file(bx);
			if (ah == 0x68 && !f) { ax = 6; AFFECT_CF(1); return; }
			if (ah == 0x68) fflush(f);
			AFFECT_CF(0);
			return;
		}
		case 0x3f: // read
		{
			/*
			   [Index]AH = 3Fh - "READ" - READ FROM FILE OR DEVICE

			   Entry:

			   BX = file handle
			   CX = number of bytes to read
			   DS:DX -> buffer for data
			   Return:

			   CF clear if successful - AX = number of bytes actually read (0 if at EOF before call)
			    CF set on error AX = error code (05h,06h)
			 */
			//char grosbuff[100000];
			void * buffer=(db *) realAddress(dx, ds);
			// log_debug2("Reading ecx=%d cx=%d eds=%x edx=%x -> %p file: %p\n",m.ecx,cx,m.ds,m.edx,buffer,(void *)  file);
			FILE * rf = dos_get_file(bx);
			if (!rf && file) rf = file;   // legacy single-handle compat

			if (!rf) {
				log_debug2("dos read: no open file (bx=%04x)\n", bx);
				eax = 6; // invalid handle
				AFFECT_CF(1);
			} else if (bx >= DOS_HANDLE_BASE && feof(rf)) {
				log_debug2("feof(handle %d)\n", bx);
				eax=0;
				AFFECT_CF(0);
			} else {
				size_t r=fread (buffer,1,cx,rf);
				if (r!=cx) {
					// short read is EOF (not an OS error) - only report real errors
					if(!feof(rf)) {
						log_error("Error reading ? %d %zu %p\n",cx,r,(void *) rf);
						AFFECT_CF(1);
					}
				} else {
					log_debug2("Reading OK %p\n",(void *) rf);
				}
				eax=r;
				AFFECT_CF(0);
				if (m2c_stats_enabled()) {
					std::fprintf(
						stderr,
						"dos read handle=%04x count=%u -> %u buffer=%p\n",
						bx,
						static_cast<unsigned>(cx),
						static_cast<unsigned>(eax),
						buffer
					);
				}
			}
			/*
			   if (ax!=cx) {
			    log_debug("Error reading ? %d %d\n",ax,cx);
			    m.AFFECT_CF(1);

			   }
			 */
			return;
		}
		// [Index]AH=42h - "LSEEK" - SET CURRENT FILE POSITION
		case 0x42:
		{
			/*

			   AH=42h - "LSEEK" - SET CURRENT FILE POSITION

			   Entry:

			   AL = origin of move 00h start of file 01h current file position 02h end of file
			   BX = file handle
			   CX:DX = offset from origin of new file position

			 */
			int seek = 0;
			switch(al) {
			case 0x0:
				seek = SEEK_SET;
				break;
			case 0x1:
				seek = SEEK_CUR;
				break;
			case 0x2:
				seek = SEEK_END;
				break;
			}
			long int offset=(((long int )cx)<<16)+dx;
			log_debug2("Seeking to offset %ld %d\n",offset,seek);
			FILE * sf = dos_get_file(bx);
			if (!sf && file) sf = file;
			if (!sf) {
				log_debug2("dos seek: no open file (bx=%04x)\n", bx);
				eax = 6;
				AFFECT_CF(1);
			} else if (fseek(sf,offset,seek)!=0) {
				log_error("Error seeking\n");
				eax = 6;
				AFFECT_CF(1);
			} else {
				const long pos = ftell(sf);
				dx = (dw)((pos >> 16) & 0xffff);
				ax = (dw)(pos & 0xffff);
				AFFECT_CF(0);
			}
			return;
		}
		case 0x47: // Get cur dir
		{
			// cur dir is root
			*(char *) realAddress(dx, ds)='\0';
			ax = 0x0100;
			return;
		}
		case 0x48:
		{

			//   ;2.29 - Function 048h - Allocate Memory Block:
			//   ;In:  AH     = 48h
			//   ;  BX  = size of block in 16xbytes (must be non-zero)
			//   ;Out: if successful:
			//   ;    carry flag clear
			//   ;    AX  =  address of allocated memory block
/*
			if (bx==0xffff)
				{ AFFECT_CF(1);
				  return;
				}

			int32_t nbBlocks=(bx<<4);
			log_debug2("Function 0501h - Allocate Memory Block: %d para\n",bx);

			if (heapPointer+nbBlocks>=HEAP_SIZE) {
				AFFECT_CF(1);
				log_error("Not enough memory (increase HEAP_SIZE)\n");
				exit(1);
				return;
			} else {
				dd a=offsetof(struct Memory,heap)+heapPointer;
				heapPointer+=nbBlocks;
				{
					log_debug2("New top of heap: %x\n",(dd) offsetof(struct Memory,heap)+heapPointer);
				}
				ax=a >> 4;
				log_debug2("Return pointer %x, seg ax =%x\n",a,ax);
				return;
			}
*/
      /* Allocate memory */
      if ((rc = DosMemAlloc(bx, mem_access_mode, &ax, &bx)) < 0)
      {
        DosMemLargest(&bx);
        if (DosMemCheck() != SUCCESS)
           {log_error("MCB chain corrupted\n");exit(1);}
           AFFECT_CF(1);
           return;
      }
	AFFECT_CF(rc!=SUCCESS);
      ax++;   /* DosMemAlloc() returns seg of MCB rather than data */
	return;
			break;
		}
      /* Free memory */
	    case 0x49:
      if ((rc = DosMemFree(es - 1)) < SUCCESS)
      {
        if (DosMemCheck() != SUCCESS)
           {log_error("MCB chain corrupted\n");exit(1);}
           AFFECT_CF(1);
      }
	AFFECT_CF(rc!=SUCCESS);
	return;
      break;

	      /* Set memory block size */
			    case 0x4a:
#ifndef __DJGPP__
	      /* Hosted builds do not own the DOS PSP MCB chain. Treat resize as
	       * successful so startup code can release conventional memory. */
	      ax = es;
		AFFECT_CF(0);
		return;
#else
	        if (DosMemCheck() != SUCCESS)
	           {log_error("before 4a: MCB chain corrupted\n");exit(1);}

	      if ((rc = DosMemChange(es, bx, &bx)) < 0)
	      {
        if (DosMemCheck() != SUCCESS)
           {log_error("after 4a: MCB chain corrupted\n");exit(1);}
#ifndef __DJGPP__
        log_debug2("Ignoring hosted DOS resize failure es:%x bx:%x rc:%d\n", es, bx, rc);
        rc = SUCCESS;
#else
        AFFECT_CF(1);
#endif
	      }
	      ax = es; /* Undocumented MS-DOS behaviour expected by BRUN45! */
		AFFECT_CF(rc!=SUCCESS);
		return;
#endif
		      break;
			case 0x51:
				bx = host.current_psp;
				AFFECT_CF(0);
				return;
			case 0x4E: // find first matching file
			{
				// cur dir is root
				const char *fileName = reinterpret_cast<const char *>(realAddress(dx, ds));
				log_debug2("Find first file %s\n", fileName);
				if (fileName[0] == '\0') {
					log_error("Find first with empty filename ds=%04x dx=%04x\n", ds, dx);
					stackDump(_state);
				}
	#ifdef __DJGPP__
     AFFECT_CF(_dos_findfirst((const char *) raddr(ds, dx), cx,
                                 diskTransferAddr));
#else
			FILE *found = fopen(fileName, "rb");
			if (found == nullptr) {
				ax = 2;  // file not found
				AFFECT_CF(1);
				return;
			}
			fclose(found);
			if (diskTransferAddr == nullptr) {
				diskTransferAddr = reinterpret_cast<find_t *>(defaultDiskTransferArea);
			}
			std::snprintf(reinterpret_cast<char *>(diskTransferAddr) + 0x1e, 13, "%s", fileName);
			ax = 0;
			AFFECT_CF(0);
#endif
			return;
		}
		case 0x4F: // find next matching file
		{
			// cur dir is root
			log_debug2("Find next file %s\n",(void *) (db *) realAddress(dx, ds));
#ifdef __DJGPP__
     AFFECT_CF(_dos_findnext(diskTransferAddr));
#else
			AFFECT_CF(1);
#endif
			return;
		}
		case 0x4b: // EXEC - load overlay (AL=03h); code runs via dispatch_external_code
		{
			if (al != 0x03) {
				AFFECT_CF(1);
				ax = 1;
				return;
			}
			const dw loadseg = *(dw*)realAddress(bx, es);
			const dw relocfactor = *(dw*)realAddress(bx + 2, es);
			const char* fname = (const char*)realAddress(dx, ds);
			FILE* ovf = fopen(fname, "rb");
			if (!ovf) {
				AFFECT_CF(1);
				ax = 2;
				return;
			}
			// Detect a registered translated overlay before loading so the
			// image write and relocations route into its private image buffer
			// instead of m's heap.
			m2c_overlay_module* bound = nullptr;
			{
				char nm[96]; size_t i = 0;
				for (; fname[i] && i < sizeof(nm) - 1; ++i) nm[i] = toupper((db)fname[i]);
				nm[i] = 0;
				for (auto* mod : m2c_overlays) {
					if (mod && mod->name_match && strstr(nm, mod->name_match)) {
						bound = mod;
						break;
					}
				}
				if (bound) {
					bound->seg = loadseg;
					bound->code_seg = (dw)(loadseg + bound->code_seg_off);
				}
			}
			db hdr[0x20];
			bool bad = fread(hdr, 1, 0x20, ovf) != 0x20 || hdr[0] != 'M' || (hdr[1] != 'Z' && hdr[1] != 'M');
			dw hsize = 0, nreloc = 0; dw reloff = 0;
			if (!bad) {
				hsize = (*(dw*)(hdr + 8)) * 16;
				nreloc = *(dw*)(hdr + 6);
				reloff = *(dw*)(hdr + 0x18);
			}
			fseek(ovf, 0, SEEK_END);
			const long fsz = ftell(ovf);
			if (bound) {
				bound->img_paras = (dw)((fsz - hsize + 15) / 16 + 2);
				if (bound->img_paras * 16 > bound->img_size) { bad = true; }
			}
			if (!bad && hsize < fsz) {
				fseek(ovf, hsize, SEEK_SET);
				db* base = (db*)host_physical_address(loadseg, 0);
				bad = fread(base, 1, fsz - hsize, ovf) != (size_t)(fsz - hsize);
				for (dw i = 0; !bad && i < nreloc; ++i) {
					db rent[4];
					fseek(ovf, reloff + i * 4, SEEK_SET);
					if (fread(rent, 1, 4, ovf) != 4) { bad = true; break; }
					const dw roff = *(dw*)rent;
					const dw rseg = *(dw*)(rent + 2);
					dw* w = (dw*)host_physical_address(loadseg + rseg, roff);
					*w += relocfactor;
				}
			}
			fclose(ovf);
			if (bad) {
				AFFECT_CF(1);
				ax = 8;
				return;
			}
			host.overlay_segs.push_back({loadseg, (dw)(loadseg + (fsz - hsize + 15) / 16 + 8)});
			if (bound) {
				log_error("overlay module bound: image %x code %x paras %x\n", bound->seg, bound->code_seg, bound->img_paras);
			}
			log_error("EXEC overlay %s loaded at %x fsz=%ld hsize=%x nreloc=%d img=%02x%02x%02x%02x base=%p\n",
				fname, loadseg, fsz, (unsigned)hsize, (int)nreloc,
				((db*)host_physical_address(loadseg,0))[0], ((db*)host_physical_address(loadseg,0))[1],
				((db*)host_physical_address(loadseg,0))[2], ((db*)host_physical_address(loadseg,0))[3],
				(void*)host_physical_address(loadseg,0));
			AFFECT_CF(0);
			return;
		}
		case 0x4c:
		{
			jumpToBackGround = 1;
			executionFinished = 1;
			exitCode = al;
			// Runtime status, not guest output — stderr keeps it in test
			// logs while guest stdout stays clean for golden comparisons.
			std::fprintf(stderr, "Graceful exit al=%d\n", al);
			exit(al);
			return;
		}
		case 0x58: // mem allocation policy
		{
#ifdef __DJGPP__
        call_dos_realint(_state, a);
			return;
#endif
			return;
		}
		default:
			break;
		}
		return;
	case 0x31:
		switch(ax)
		{
		case 0x0:
		{
			
			//   ;2.0 - Function 0000h - Allocate Descriptors:
			//   ;--------------------------------------------
			//   ;  Allocates one or more descriptors in the client's descriptor table. The
			//   ;descriptor(s) allocated must be initialized by the application with other
			//   ;function calls.
			//   ;In:
			//   ;  AX     = 0000h
			//   ;  CX     = number of descriptors to allocate
			//   ;Out:
			//   ;  if successful:
			//   ;    carry flag clear
			//   ;    AX     = base selector
			 
			log_debug2("Function 0000h - Allocate %d Descriptors\n",cx);
			dw base_sel = m2c_ldt_alloc(cx);
			if (!base_sel) {
				AFFECT_CF(1);
				log_error("Not enough free LDT descriptors\n");
				return;
			}
			ax = base_sel;
			AFFECT_CF(0);
			log_debug2("Return base selector %x\n", ax);
			return;
		}
		case 0x02:
		{

			//   This function Converts a real mode segment into a protected mode descriptor.
			//   BX =    real mode segment
			//   Out:
			//   if successful:
			//   carry flag clear
			//   AX =  selector
			//  if failed:
			//   carry flag set

			log_debug2("Function 0002h - real segment %x -> selector\n", bx);
			// Per spec, repeated conversions of the same real-mode segment
			// return the same selector.
			for (int i = 0; i < NB_LDT; ++i) {
				const PmDesc& d = m2c_ldt[i];
				if (d.used && !d.owned && d.lin == ((dd)bx << 4)) {
					ax = (dw)((i << 3) | 7);
					AFFECT_CF(0);
					return;
				}
			}
			{
				dw sel = m2c_ldt_alloc(1);
				if (!sel) { AFFECT_CF(1); return; }
				PmDesc& d = m2c_ldt[m2c_ldt_idx(sel)];
				d.base = (db*)&m + ((dd)bx << 4);
				d.lin = (dd)bx << 4;
				ax = sel;
				AFFECT_CF(0);
				log_debug2("Returns new selector: %x\n", ax);
			}
			return;
		}
		case 0x01: // Free descriptor(s): BX = base selector
		{
			if (!m2c_ldt[m2c_ldt_idx(bx)].used) {
				AFFECT_CF(1);
				log_error("Function 0001h - bad selector %x\n", bx);
				return;
			}
			m2c_ldt_free(bx);
			AFFECT_CF(0);
			return;
		}
		case 0x06: // Get Segment Base Address: BX = sel -> CX:DX linear base
		{
			if (!m2c_ldt[m2c_ldt_idx(bx)].used) {
				AFFECT_CF(1);
				log_error("Function 0006h - bad selector %x\n", bx);
				return;
			}
			dd base = m2c_ldt_get_lin(bx);
			cx = (dw)(base >> 16);
			dx = (dw)(base & 0xffff);
			AFFECT_CF(0);
			return;
		}
		//   ;2.5 - Function 0007h - Set Segment Base Address:
		//   ; Sets the 32bit linear base address field in the descriptor for the specified
		//   ; segment.
		//   ; In:   AX     = 0007h
		//   ; BX     = selector
		//   ;  CX:DX  = 32bit linear base address of segment

		case 0x07:
		{
			dd lin = (dw)dx + ((dd)cx << 16);
			log_debug2("Function 0007h - Set Segment Base: sel=%x lin=%x\n", bx, lin);
			PmDesc& d = m2c_ldt[m2c_ldt_idx(bx)];
			if (!d.used) {
				AFFECT_CF(1);
				log_error("Error: selector number doesnt exist\n");
				return;
			}
			d.lin = lin;
			if (lin < m2c_m_extent()) {
				d.base = (db*)&m + lin;
			} else {
				// Synthetic linear of an owned region (0501 result):
				// alias into the recorded host block (mid-block bases OK).
				for (int i = 0; i < NB_LDT; ++i) {
					if (m2c_ldt[i].owned && m2c_ldt[i].extent &&
					    lin >= m2c_ldt[i].lin &&
					    lin < m2c_ldt[i].lin + m2c_ldt[i].extent) {
						d.base = m2c_ldt[i].base + (lin - m2c_ldt[i].lin);
						break;
					}
				}
				if (!d.base && !d.owned) {
					log_error("Function 0007h - linear %x not mapped\n", lin);
				}
			}
			AFFECT_CF(0);
			return;
		}
		case 0x08:
		{

			//   ;2.6 - Function 0008h - Set Segment Limit:
			//   ;-----------------------------------------
			//   ;  Sets the limit field in the descriptor for the specified segment.
			//   ;  In:
			//   ;  AX     = 0008h
			//   ;  BX     = selector
			//   ;  CX:DX  = 32bit segment limit
			//   ;  Out:
			//   ;  if successful:
			//   ;    carry flag clear
			//   ;  if failed:
			//   ;    carry flag set


			// Record the limit; backing is always >=64KB so emulation
			// resolution is unaffected, but clients may read it back.
			{
				PmDesc& d = m2c_ldt[m2c_ldt_idx(bx)];
				if (!d.used) { AFFECT_CF(1); return; }
				d.limit = (dw)dx + ((dd)cx << 16);
				log_debug2("Function 0008h - Set Limit sel=%x -> %x\n", bx, d.limit);
				AFFECT_CF(0);
			}
			return;
		}
		case 0x09: // Set Descriptor Access Rights: BX=sel, CL=rights
		{
			PmDesc& d = m2c_ldt[m2c_ldt_idx(bx)];
			if (!d.used) { AFFECT_CF(1); return; }
			d.rights = cx;
			AFFECT_CF(0);
			return;
		}
		case 0x501:
		{

			//   ;2.29 - Function 0501h - Allocate Memory Block:
			//   ;In:  AX     = 0501h
			//   ;  BX:CX  = size of block in bytes (must be non-zero)
			//   ;Out: if successful:
			//   ;    carry flag clear
			//   ;    BX:CX  = linear address of allocated memory block
			//   ;    SI:DI  = memory block handle (used to resize and free block)

			dd size = ((dd)bx << 16) + cx;
			log_debug2("Function 0501h - Allocate Memory Block: %u bytes\n", size);

			// One descriptor per 64KB, one contiguous host block; the handle
			// returned is the base selector, so sel+8/__AHINCR steps across
			// the block exactly like real LDT descriptors.
			int n = (int)((size + 0xffff) >> 16);
			if (n <= 0) { AFFECT_CF(1); return; }
			dw sel = m2c_ldt_alloc(n);
			if (!sel) { AFFECT_CF(1); return; }
			dd bytes = (dd)n << 16;
			db* blk = static_cast<db*>(calloc(1, bytes));
			if (!blk) { AFFECT_CF(1); return; }
			for (int i = 0; i < n; ++i) {
				PmDesc& d = m2c_ldt[m2c_ldt_idx(sel) + i];
				d.base = blk + ((dd)i << 16);
				d.lin = m2c_pm_next_linear + ((dd)i << 16);
				d.limit = 0xffff;
				d.owned = (i == 0);
				d.extent = (i == 0) ? bytes : 0;
			}
			m2c_pm_next_linear += bytes;
			cx = (dw)(m2c_ldt[m2c_ldt_idx(sel)].lin & 0xffff);
			bx = (dw)(m2c_ldt[m2c_ldt_idx(sel)].lin >> 16);
			di = sel;
			si = 0;
			AFFECT_CF(0);
			log_debug2("Return lin %x:%x handle %x\n", bx, cx, di);
			return;
		}
		case 0x502: // Free Memory Block: SI:DI = handle (base selector)
		{
			dw sel = (dw)((si << 16) | di);
			if (!m2c_ldt[m2c_ldt_idx(sel)].used) { AFFECT_CF(1); return; }
			m2c_ldt_free(sel);
			AFFECT_CF(0);
			return;
		}
		case 0x200: // get real-mode interrupt vector -> CX:DX
		{
			cx = *(dw *)realAddress(bl * 4 + 2, 0);
			dx = *(dw *)realAddress(bl * 4, 0);
			AFFECT_CF(0);
			return;
		}
		case 0x201: // set real-mode interrupt vector = CX:DX
		{
			*(dw *)realAddress(bl * 4, 0) = dx;
			*(dw *)realAddress(bl * 4 + 2, 0) = cx;
			AFFECT_CF(0);
			return;
		}
		case 0x202: // get processor exception handler -> CX:EDX
		case 0x204: // get PM interrupt vector -> CX:EDX
		{
			if (pm_vec_set[bl]) {
				cx = pm_vec_sel[bl];
				edx = pm_vec_off[bl];
			} else {
				// Report the real-mode IVT entry as an opaque far pointer.
				cx = *(dw *)realAddress(bl * 4 + 2, 0);
				edx = *(dw *)realAddress(bl * 4, 0);
			}
			AFFECT_CF(0);
			return;
		}
		case 0x203: // set processor exception handler = CX:EDX
		case 0x205: // set PM interrupt vector = CX:EDX
		{
			pm_vec_sel[bl] = cx;
			pm_vec_off[bl] = edx;
			pm_vec_set[bl] = 1;
			// When the handler's selector aliases `m` (generated code always
			// does — code descriptors over image segments), mirror the real
			// paragraph into the IVT so real-mode INT dispatch reaches it.
			const PmDesc& d = m2c_ldt[m2c_ldt_idx(cx)];
			if (d.used && d.base >= (db*)&m &&
			    d.base < (db*)&m + m2c_m_extent()) {
				*(dw *)realAddress(bl * 4, 0) = (dw)(edx & 0xffff);
				*(dw *)realAddress(bl * 4 + 2, 0) = (dw)(m2c_ldt_get_lin(cx) >> 4);
			}
			AFFECT_CF(0);
			return;
		}
		default:
			break;
		}
		break;
	case 0x33:
	{
#ifdef __DJGPP__
        call_dos_realint(_state, a);
			return;
#endif
			poll_host_events(_state);
		switch (ax) {
		case 0x0000:
			host.mouse.installed = true;
			host.mouse.visible = false;
			host.mouse.buttons = 0;
			host.mouse.motion_x = 0;
			host.mouse.motion_y = 0;
			clamp_host_mouse();
			ax = 0xffff;
			bx = 2;
			return;
		case 0x0001:
			host.mouse.visible = true;
			return;
		case 0x0002:
			host.mouse.visible = false;
			return;
		case 0x0003:
			bx = host.mouse.buttons;
			cx = host.mouse.x;
			dx = host.mouse.y;
			return;
		case 0x0004:
			host.mouse.last_x = host.mouse.x;
			host.mouse.last_y = host.mouse.y;
			host.mouse.x = cx;
			host.mouse.y = dx;
			clamp_host_mouse();
			host.mouse.motion_x += host.mouse.x - host.mouse.last_x;
			host.mouse.motion_y += host.mouse.y - host.mouse.last_y;
			return;
		case 0x0005:
		case 0x0006:
			ax = host.mouse.buttons;
			bx = 0;
			cx = host.mouse.x;
			dx = host.mouse.y;
			return;
		case 0x0007:
			host.mouse.min_x = std::min<int>(cx, dx);
			host.mouse.max_x = std::max<int>(cx, dx);
			clamp_host_mouse();
			return;
		case 0x0008:
			host.mouse.min_y = std::min<int>(cx, dx);
			host.mouse.max_y = std::max<int>(cx, dx);
			clamp_host_mouse();
			return;
		case 0x0010:
		case 0x1000:
			// Define mouse hidden region. The host runtime does not draw a hardware cursor.
			return;
		case 0x000b:
			cx = static_cast<dw>(host.mouse.motion_x);
			dx = static_cast<dw>(host.mouse.motion_y);
			host.mouse.motion_x = 0;
			host.mouse.motion_y = 0;
			return;
		default:
			log_debug("Unsupported mouse INT 33h ax:0x%x bx:0x%x cx:0x%x dx:0x%x\n", ax, bx, cx, dx);
			ax = 0;
			bx = 0;
			return;
		}
	}
	default:
#ifdef __DJGPP__
        call_dos_realint(_state, a);
			return;
#endif
		break;
	}
	AFFECT_CF(1);
	log_error("Error DOSInt 0x%x ah:0x%x al:0x%x: bx:0x%x not supported.\n",a,ah,al,bx);
}

//jmp_buf jmpbuffer;

/*
void program() {
int i;
#ifdef INCLUDEMAIN
dest=NULL;src=NULL;i=0; //to avoid a warning.
#endif
if (executionFinished) goto moveToBackGround;
if (jumpToBackGround) {
jumpToBackGround = 0;
#ifdef MRBOOM
if (nosetjmp) stackPointer=0; // this an an hack to avoid setJmp in saved state.
if (nosetjmp==2) goto directjeu;
if (nosetjmp==1) goto directmenu;
#endif
RET;
			}
//R(JMP(_main));
//...
executionFinished = 1;
moveToBackGround:
return ;//(executionFinished == 0);
}
*/

const char* log_spaces(int n)
{
 static const char s[]="                                                                                          ";
//	memset(s, ' ', n); 
//	*(s+n) = 0; 
  return s+(88-n);
}

dw getscan()
{
 dw o=0;
#ifndef NOCURSES
 int chr = getch();
 o = chr;
 //if (ch==ERR) return(0);

//log_debug(">> %x\n",ch);

 switch (chr)
{
case ERR: {o=0;break;}

case 0x31: {o=0x2;break;}
case 0x32: {o=0x3;break;}
case 0x33: {o=0x4;break;}
case 0x34: {o=0x5;break;}
case 0x35: {o=0x6;break;}
case 0x36: {o=0x7;break;}
case 0x37: {o=0x8;break;}
case 0x38: {o=0x9;break;}
case 0x39: {o=0xa;break;}
case 0x30: {o=0xb;break;}

case KEY_F(1): {o=0x3B;break;}
case KEY_F(2): {o=0x3C;break;}
case KEY_F(3): {o=0x3D;break;}
case KEY_F(4): {o=0x3E;break;}
case KEY_F(5): {o=0x3F;break;}
case KEY_F(6): {o=0x40;break;}
case KEY_F(7): {o=0x41;break;}
case KEY_F(8): {o=0x42;break;}
case KEY_F(9): {o=0x43;break;}
case KEY_F(10): {o=0x44;break;}
case KEY_LEFT: {o=0xe04B;break;}
case KEY_B2: {o=0x4C;break;}
case KEY_RIGHT: {o=0xe04D;break;}
case KEY_END: {o=0x4F;break;}
case KEY_DOWN: {o=0xe050;break;}
case KEY_NPAGE: {o=0xe051;break;}
case KEY_IC: {o=0xe052;break;}
case KEY_DC: {o=0xe053;break;}
case KEY_F(13): {o=0x54;break;}
case KEY_F(14): {o=0x55;break;}
case KEY_F(15): {o=0x56;break;}
case KEY_F(11): {o=0x57;break;}
case KEY_F(12): {o=0x58;break;}
case KEY_F(18): {o=0x59;break;}
case KEY_F(19): {o=0x5A;break;}
case KEY_F(20): {o=0x5B;break;}
case KEY_F(21): {o=0x5C;break;}
case KEY_F(22): {o=0x5D;break;}
case KEY_F(25): {o=0x5E;break;}
case KEY_F(26): {o=0x5F;break;}
case KEY_F(27): {o=0x60;break;}
case KEY_F(28): {o=0x61;break;}
case KEY_F(29): {o=0x62;break;}
case KEY_F(30): {o=0x63;break;}
case KEY_F(31): {o=0x64;break;}
case KEY_F(32): {o=0x65;break;}
case KEY_F(33): {o=0x66;break;}
case KEY_F(34): {o=0x67;break;}
case KEY_F(37): {o=0x68;break;}
case KEY_F(38): {o=0x69;break;}
case KEY_F(39): {o=0x6A;break;}
case KEY_F(40): {o=0x6B;break;}
case KEY_F(41): {o=0x6C;break;}
case KEY_F(42): {o=0x6D;break;}
case KEY_F(43): {o=0x6E;break;}
case KEY_F(44): {o=0x6F;break;}
case KEY_F(45): {o=0x70;break;}
case KEY_F(46): {o=0x71;break;}
case KEY_BTAB: {o=0xF;break;}
case KEY_HOME: {o=0xe047;break;}
case KEY_UP: {o=0xe048;break;}
case KEY_PPAGE: {o=0xe049;break;}
case KEY_F(23): {o=0x87;break;}
case KEY_F(24): {o=0x88;break;}
case KEY_F(35): {o=0x89;break;}
case KEY_F(36): {o=0x8A;break;}
case KEY_F(47): {o=0x8B;break;}
case KEY_F(48): {o=0x8C;break;}
#ifdef __PDCURSES__
case ALT_ESC: {o=0x1;break;}
case ALT_BKSP: {o=0xE;break;}
case ALT_Q: {o=0x10;break;}
case ALT_W: {o=0x11;break;}
case ALT_E: {o=0x12;break;}
case ALT_R: {o=0x13;break;}
case ALT_T: {o=0x14;break;}
case ALT_Y: {o=0x15;break;}
case ALT_U: {o=0x16;break;}
case ALT_I: {o=0x17;break;}
case ALT_O: {o=0x18;break;}
case ALT_P: {o=0x19;break;}
case ALT_LBRACKET: {o=0x1A;break;}
case ALT_RBRACKET: {o=0x1B;break;}
case ALT_ENTER: {o=0x1C;break;}
case ALT_A: {o=0x1E;break;}
case ALT_S: {o=0x1F;break;}
case ALT_D: {o=0x20;break;}
case ALT_F: {o=0x21;break;}
case ALT_G: {o=0x22;break;}
case ALT_H: {o=0x23;break;}
case ALT_J: {o=0x24;break;}
case ALT_K: {o=0x25;break;}
case ALT_L: {o=0x26;break;}
case ALT_SEMICOLON: {o=0x27;break;}
case ALT_FQUOTE: {o=0x28;break;}
case ALT_BQUOTE: {o=0x29;break;}
case ALT_BSLASH: {o=0x2B;break;}
case ALT_Z: {o=0x2C;break;}
case ALT_X: {o=0x2D;break;}
case ALT_C: {o=0x2E;break;}
case ALT_V: {o=0x2F;break;}
case ALT_B: {o=0x30;break;}
case ALT_N: {o=0x31;break;}
case ALT_M: {o=0x32;break;}
case ALT_COMMA: {o=0x33;break;}
case ALT_STOP: {o=0x34;break;}
case ALT_FSLASH: {o=0x35;break;}
case ALT_PADSTAR: {o=0x37;break;}
case ALT_PADMINUS: {o=0x4A;break;}
case ALT_PADPLUS: {o=0x4E;break;}
case CTL_LEFT: {o=0x73;break;}
case CTL_RIGHT: {o=0x74;break;}
case CTL_END: {o=0x75;break;}
case CTL_PGDN: {o=0x76;break;}
case CTL_HOME: {o=0x77;break;}
case ALT_1: {o=0x78;break;}
case ALT_2: {o=0x79;break;}
case ALT_3: {o=0x7A;break;}
case ALT_4: {o=0x7B;break;}
case ALT_5: {o=0x7C;break;}
case ALT_6: {o=0x7D;break;}
case ALT_7: {o=0x7E;break;}
case ALT_8: {o=0x7F;break;}
case ALT_9: {o=0x80;break;}
case ALT_0: {o=0x81;break;}
case ALT_MINUS: {o=0x82;break;}
case ALT_EQUAL: {o=0x83;break;}
case CTL_PGUP: {o=0x84;break;}
//case KEY_F(11): {o=0x85;break;}
//case KEY_F(12): {o=0x86;break;}
case CTL_UP: {o=0x8D;break;}
case CTL_PADMINUS: {o=0x8E;break;}
case CTL_PADCENTER: {o=0x8F;break;}
case CTL_PADPLUS: {o=0x90;break;}
case CTL_DOWN: {o=0x91;break;}
case CTL_INS: {o=0x92;break;}
case CTL_DEL: {o=0x93;break;}
case CTL_TAB: {o=0x94;break;}
case CTL_PADSLASH: {o=0x95;break;}
case CTL_PADSTAR: {o=0x96;break;}
case ALT_HOME: {o=0x97;break;}
case ALT_UP: {o=0x98;break;}
case ALT_PGUP: {o=0x99;break;}
case ALT_LEFT: {o=0x9B;break;}
case ALT_RIGHT: {o=0x9D;break;}
case ALT_END: {o=0x9F;break;}
case ALT_DOWN: {o=0xA0;break;}
case ALT_PGDN: {o=0xA1;break;}
case ALT_INS: {o=0xA2;break;}
case ALT_DEL: {o=0xA3;break;}
case ALT_PADSLASH: {o=0xA4;break;}
case ALT_TAB: {o=0xA5;break;}
case ALT_PADENTER: {o=0xA6;break;}
#endif
 }
#endif
 return o;
}

void realtocurs()
{
#ifndef NOCURSES
    for(int colorNumber=0;colorNumber<16; colorNumber++)
	{
	short red   =  (510*((colorNumber & 4)>>2) + 255*((colorNumber & 8)>>3))/3;
	short green =  (510*((colorNumber & 2)>>1)    + 255*((colorNumber & 8)>>3))/3;
	short blue  =  (510*((colorNumber & 1)) + 255*((colorNumber & 8)>>3))/3;
	if (colorNumber == 6) green >>= 1;
	}

    for( int b=0;b<16; b++)
    {
       for( int f=0;f<16; f++)
        {

		   init_pair((b<<4)+f, f, b);
        }
    }
#endif
}


/*
static short realtocurs[16] =
{
    COLOR_BLACK, COLOR_BLUE, COLOR_GREEN, COLOR_CYAN, COLOR_RED,
    COLOR_MAGENTA, COLOR_YELLOW, COLOR_WHITE, 
//    COLOR_BLACK, COLOR_BLUE, COLOR_GREEN, COLOR_CYAN, COLOR_RED,
//    COLOR_MAGENTA, COLOR_YELLOW, COLOR_WHITE

    COLOR_BLACK + 8, COLOR_BLUE + 8, COLOR_GREEN + 8, COLOR_CYAN + 8, COLOR_RED + 8,
    COLOR_MAGENTA + 8, COLOR_YELLOW + 8, COLOR_WHITE + 8

};
    for( int b=0;b<16; b++)
{
       for( int f=0;f<16; f++)
        {
           if(b !=0 && f !=0)
                init_pair((b<<4)+f, realtocurs[f], realtocurs[b]);
        }
}
*/


/*
"Programming for MS-DOS" (Ray Duncan)

                  COM                            EXE
                  ===                            ===
CS:IP           PSP:0100H             Defined by program's END statement
AL              00 if default FCB#1 has valid drive, FF if invalid drive
AH              Ditto, FCB#2
 Bill comment : FCB1 is filled from the first command argument, FCB2 from the
    second. From DOS5 (or maybe DOS6 - it's a long time ago...) FCB1 was
    left empty and FCB2 was filled from argument 1. AFAIAA, this was never
    fixed. What effect it has on this claim (re AX contents) I'm not sure.

DS              PSP                              PSP
ES              PSP                              PSP
SS              PSP                              Seg with STACK attribute
SP              0FFFEH or top word in avail.     Size of STACK segment
                 memory, whichever is least.

From: "The MS-DOS Encyclopaedia" (also Duncan) - talking about .EXE files. There is no comment on this point when discussing .COM files.

"The other processor registers (BX,CX,DX,BP,SI and DI) contain unknown values when the program receives control from MS-DOS."
*/

int init(struct _STATE *state);

void mainproc(_offsets _i, struct _STATE *state);

#ifndef NOCURSES
chtype vga_to_curses[256];
#endif

void prepare_cp437_to_curses() {
#ifndef NOCURSES

    for (size_t i = 0; i < 256; i++) { vga_to_curses[i] = i; }
    vga_to_curses['\0'] = ' ';
    vga_to_curses[0x04] = ACS_DIAMOND;
    vga_to_curses[0x18] = ACS_UARROW;
    vga_to_curses[0x19] = ACS_DARROW;
    vga_to_curses[0x1a] = ACS_RARROW;
    vga_to_curses[0x1b] = ACS_LARROW;
    vga_to_curses[0x9c] = ACS_STERLING;
    vga_to_curses[0xb0] = ACS_BOARD;
    vga_to_curses[0xb1] = ACS_CKBOARD;
    vga_to_curses[0xb3] = ACS_VLINE;
    vga_to_curses[0xb4] = ACS_RTEE;
    vga_to_curses[0xbf] = ACS_URCORNER;
    vga_to_curses[0xc0] = ACS_LLCORNER;
    vga_to_curses[0xc1] = ACS_BTEE;
    vga_to_curses[0xc2] = ACS_TTEE;
    vga_to_curses[0xc3] = ACS_LTEE;
    vga_to_curses[0xc4] = ACS_HLINE;
    vga_to_curses[0xc5] = ACS_PLUS;
    vga_to_curses[0xce] = ACS_LANTERN;
    vga_to_curses[0xd8] = ACS_NEQUAL;
    vga_to_curses[0xd9] = ACS_LRCORNER;
    vga_to_curses[0xda] = ACS_ULCORNER;
    vga_to_curses[0xdb] = ACS_BLOCK;
    vga_to_curses[0xe3] = ACS_PI;
    vga_to_curses[0xf1] = ACS_PLMINUS;
    vga_to_curses[0xf2] = ACS_GEQUAL;
    vga_to_curses[0xf3] = ACS_LEQUAL;
    vga_to_curses[0xf8] = ACS_DEGREE;
    vga_to_curses[0xfe] = ACS_BULLET;
#endif
}
/*
#include <thread>         // std::thread
std::thread int8_thread;
void int8_thread_proc()
{
_STATE state;
_STATE* _state = &state;
X86_REGREF

//R(MOV(cs, seg_offset(_text)));	// mov cs,_TEXT

  R(MOV(ss, seg_offset(int8stack)));	// mov cs,_TEXT
#if _BITS == 32
  esp = ((dd)(db*)&m.int8stack[STACK_SIZE - 4]);
#else
  esp=0;
  sp = STACK_SIZE - 4;
#endif

  es=0;

while(true)
	{
		bx=*(dw *)realAddress(8*4,0);
//		es=(dw *)realAddress(8*4+2,0);

		if (bx)
		{

			CALL(static_cast<_offsets>(bx));
std::this_thread::sleep_for(std::chrono::microseconds(1));
		}
	}
}
*/
 int init(struct _STATE* _state)
 {
    X86_REGREF
    
    log_debug("~~~ heap_size=%d heap_para=%x heap_seg=%x\n", HEAP_SIZE, (HEAP_SIZE >> 4), seg_para(heap) );
    /* We expect ram_top as Kbytes, so convert to paragraphs */
    mcb_init(seg_para(heap), (HEAP_SIZE >> 4) - seg_para(heap) - 1, MCB_LAST);
    
    R(MOV(ss, seg_offset(stack)));
 #if _BITS == 32
    esp = ((dd)(db*)&stack[STACK_SIZE - 4]);
 #else
    esp = 0;
    /* Win16/NE programs start with cs:eip, ss:sp and ds from the NE header
       rather than the MZ/EXE convention below; the optional program hook
       installs that state (and applies segment fixups / initial data) and
       returns true to suppress the defaults. */
    if (!(m2c_ne_entry_setup && m2c_ne_entry_setup(_state))) {
        sp = STACK_SIZE - 4;
        cs = 0; // translated code space: bare k* dispatch offsets require a zero segment so `__disp |= cs<<16` is a no-op
        eip = 6; // real MZ entry ip: pushed return words land in the true code-offset range so register-carried return juggling (delta<=4) and dispatch cases match as they did under the emulator
        ds = es = M2C_PSP_SEG; // EXE-style entry: DS/ES point at the PSP
    }
    *(dw*)(raddr(0, 0x408)) = 0x378; //LPT
    /* DOS loader fills PSP:0002 with the top of the program's memory block
       ("top of memory", in paragraphs). Programs like GW-BASIC copy the
       control block into their data segment and read CPMMEM from offset 2.
       Report 640K - the top of conventional memory on the emulated PC. */
    *(dw*)(host_physical_address(host.current_psp, 2)) = 0xA000;
 #endif

    /* BIOS POST boots the display in text mode with the page-0 buffer filled
       with blanks at attribute 0x07. Programs that write straight to B800
       (GW-BASIC's OEM layer) and ones that go through INT 10h must both see
       that state; mirror it into guest VRAM before entry. */
    host_text_clear_page(0, 0x07);

    /* Machine-signature bytes in the F000 shadow are planted by the program's
       game glue (it owns which BIOS identity to present) before the guest
       first reads them -- the runtime supplies only the zeroed shadow. */

    /* Seed the real-mode IVT with standard BIOS vectors (F000:xxxx). Programs
       that hook an interrupt save the previous vector and later chain to it
       (e.g. a game's RetViaDOSIntr-style jump through a saved vector).
       Without a BIOS default the saved vector is uninitialized garbage that
       aborts the dispatch; F000:xxxx resolves to the "Jumping to BIOS" case
       and unwinds cleanly. This runs BEFORE the data-image Initializer():
       images that carry their own low-memory bytes (a real DOS snapshot's
       IVT, or program data flat-mapped at physical 0) must win over these
       defaults; images that leave the vectors untouched keep them. */
    {
        db* ivt = (db*)host_physical_address(0, 0);
        auto seed = [&](int intno, dw off) {
            *(dw*)(ivt + intno * 4) = off;
            *(dw*)(ivt + intno * 4 + 2) = 0xF000;
        };
        seed(0x08, 0xFEA5); // IRQ0 timer tick (IBM PC TIM_INT)
        seed(0x09, 0xE987); // IRQ1 keyboard (KB_INT)
        seed(0x1C, 0xFF53); // user timer tick (dummy iret)
        seed(0x1A, 0xFF53); // RTC services (dummy iret when no thunk)
        seed(0x33, 0xFF53); // mouse driver stub: absent driver = dummy iret
                           // so int33 calls unwind instead of dispatching
                           // into an uninitialized vector offset
    }
    if (m2c::Initializer) {
        m2c::Initializer();
    }

    host_irq_main_state = _state;
    if (!std::getenv("M2C_NO_IRQ")) host_start_irq_thread();

//	*(dw *)realAddress(8*4,0)=k_int8old;
//    int8_thread = std::thread(int8_thread_proc);
//	int8_thread.detach();
    
    return(0);
 }

 void log_regs_m2c(const char *file, int line, const char *instr, _STATE* _state)
 {
  ++counter;
  if (!debug) return;
  X86_REGREF
  log_debug("%x %05d %04X:%08X  %-54s EAX:%08X EBX:%08X ECX:%08X EDX:%08X ESI:%08X EDI:%08X EBP:%08X ESP:%08X DS:%04X ES:%04X FS:%04X GS:%04X SS:%04X CF:%d ZF:%d SF:%d OF:%d AF:%d PF:%d IF:%d\n", \
                         counter,line,cs,eip,instr,       eax,     ebx,     ecx,     edx,     esi,     edi,     ebp,     esp,     ds,     es,     fs,     gs,     ss,     GET_CF()   ,GET_ZF()   ,GET_SF()   ,GET_OF()   ,GET_AF()   ,GET_PF(),   GET_IF());
 }

}

static void write_dos_command_tail(int argc, char *argv[]) {
    db tail[126] = {};
    size_t tail_len = 0;

    for (int i = 1; i < argc && tail_len < 126; ++i) {
        if (!argv[i]) {
            continue;
        }
        tail[tail_len++] = ' ';
        for (const char *arg = argv[i]; *arg && tail_len < 126; ++arg) {
            tail[tail_len++] = static_cast<db>(*arg);
        }
    }

    db *psp = ((db *) &m2c::m) + (static_cast<size_t>(m2c::host.current_psp) << 4);
    psp[0x80] = static_cast<db>(tail_len);
    for (size_t i = 0; i < tail_len; ++i) {
        psp[0x81 + i] = tail[i];
    }
    psp[0x81 + tail_len] = 0x0d;
    m2c::copy_linked_program_segment_prefix(m2c::host.current_psp, psp, 0x100);
}

int main(int argc, char *argv[]) {
    struct m2c::_STATE state;
    struct m2c::_STATE *_state = &state;
    X86_REGREF

    eax = ebx = ecx = edx = ebp = esi = edi = fs = gs = 0; // according to ms-dos 6.22 debuger
    cs=eip=0;

    AFFECT_DF(0);
    AFFECT_CF(0);
    AFFECT_ZF(0);
    AFFECT_SF(0);
    AFFECT_OF(0);
    AFFECT_AF(0);
    AFFECT_PF(0);
    AFFECT_IF(0);
    cx = 0xff; // dummy size of executable


    try {
        m2c::_indent = 0;
        if (m2c::debug)
            m2c::logDebug = fopen("asm.log", "w");
#ifndef NOCURSES
        initscr();
        resize_term(25, 80);
        noecho(); // do not echo

        if (!has_colors()) {
            printw("Unable to use colors");
        }
        start_color();

        m2c::realtocurs();
        curs_set(0);

        refresh();
        cbreak(); // put keys directly to program
        keypad(stdscr, TRUE); // provide keypad buttons
#endif

        m2c::init(_state);

        write_dos_command_tail(argc, argv);
        (*m2c::_ENTRY_POINT_)((m2c::_offsets) 0, _state);
    }
    catch (const std::exception &e) {
        printf("std::exception& %s\n", e.what());
    }
    catch (...) {
        printf("some exception\n");
    }
    return (0);
}