mountain 3 crash: rollingbouldermountain spawners end while their boulders still write parent.v13 (use after free), seen in game, one-word level fix tested; diag tooling in notes/dev

notes/dev/mountain3-diag/wadfix.py

@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+"""wadfix.py IN OUT: RollingBoulderMountain never ends (its final 'wait until v13 == 0' compares with 0.5)."""
+import struct, sys
+d = bytearray(open(sys.argv[1], 'rb').read())
+pat = struct.pack('<6I', 0x1002f, 0xd0004, 0x44, 0x4e, 0xfffc0012, 0xb4)  # freezeOffCamera 1; v13; pushShort 0; eq; jzYield -4; end
+i = d.find(pat)
+assert i >= 0 and d.find(pat, i + 1) < 0, 'pattern not unique'
+struct.pack_into('<I', d, i + 8, 0x08000044)  # pushShort 0.5
+open(sys.argv[2], 'wb').write(d)
+print('patched at 0x%x' % (i + 8))