# PPU functions the host replaces (ps3recomp ppu_lifter.py --overrides, patch 1018).
# Their lifted bodies become func_<addr>__lifted; port/spu/kz3_ppu_overrides.cpp defines func_<addr>.
00CB26E0  # BinkShouldSkip (ASSUMPTION: name from behaviour): no skip on the frame after the wrap, see the RE notes
000111F8  # lookup2 hash (Bob Jenkins): native body (host reads), was the level load's hot spot
000203DC  # game heap allocator (heap*, size) under malloc 0x86428: logs failed allocations and the high-water mark (pass 12)
000C3A54  # PPU fiber scheduler run_all(S, list): host fibers (guest_fiber.c), pass 13
000C3A68  # PPU fiber scheduler wait(S, ptr): switch to the scheduler's host fiber
000C39BC  # PPU fiber scheduler finish(S): free the slot, back to the scheduler
000640E0  # wait_label(r3, idx, wanted): pass 14 diagnostic, logs stuck waits with the command context
001FF008  # queue_mlaa(renderer, 0, 0): skipped when the host FXAA pass is on (patch 2023, KZ3_HOST_AA), the RE notes section 18
0008AB70  # HardExit: log the game's fatal text and caller ([HardExit], kz3_log.h KZ3_HOOK_HARDEXIT; RE pass 64; 1.14: 0008C360)
000DDFF0  # link resolve: log unresolved dependent links ([link-miss], KZ3_HOOK_LINK_RESOLVE; 1.14: 000DFF30)
001FDA60  # MotionBlur(renderer, ...): post job 0x20 not queued when Options > Display > Motion blur is off (rsx patch 2107, kz3_motion_blur_on) [114=002093B0 high]
004C2F08  # PlayerProfile ctor: KZ3_SP_UNLOCK=1 writes +0x11F18 (SPAllUnlocked) after it (kz3_gameplay.h, B7; 1.14: 004CF158)
005A3350  # ControllerBase::SetViewAngles: KZ3_GAMEPLAY_TRACE=1 yaw/pitch/position line (B4; 1.14: 005B7760)
006861B0  # SoldierJoystickController::UpdateMoveInput: KZ3_GAMEPLAY_TRACE=1 move vector (B4; 1.14: 0069B330)
00B37FBC  # per-view visibility result descriptor rebuild (RE pass 73 s.11.2): KZ3_CULL_PROBE=1 counts at clear / +2 ms / rebuild (kz3_cull_probe.c; 1.14: unknown, asked re-data)
007EE150  # HUD manager render slot: KZ3_HUD_PROBE=1 call counter (kz3_hud_probe.c; 1.14: 0080FA30)
007ED438  # HUD render: KZ3_HUD_PROBE=1 gates G1 font flag / G2 state / manager / DrawHUD once per second (the RE notes 6.2; 1.14: 0080ECF8)
001BCDF8  # font system init (sets 0x1345C80): KZ3_HUD_PROBE=1 call counter (1.14: 001C8398)
0005B9F0  # frame-arena chunk take (arena, stamp, wait) -> chunk EA: KZ3_ARENA_PROBE=1 logs the old table word / label / epoch / frame (RE pass 74 s.11.5, kz3_arena_probe.c; 1.14: 0005C2D0)
001D8B08  # per-view job builder, spins on block+0x8A0 at entry: KZ3_ARENA_PROBE=1 logs the chain counter at entry and the wait (1.14: unknown, asked re-data)
00D42C7C  # brbDriver thread entry (audio ring producer): KZ3_AUDIO_TICK=1 wraps sc 0x82/0x8d on its thread (kz3_audio_probe.c, the RE notes; 1.14: 00D92638)
00D44810  # brbDriver mix step (per unit): KZ3_AUDIO_TICK=1 time + usleep polls per unit (1.14: 00D941D0)
00D44AB8  # mix pass job append (node, items, taken, last): KZ3_AUDIO_VOICE=1 voices/jobs per unit, node ages (kz3_mixjob_probe.c, the RE notes s.5.4; 1.14: 00D94A2C)
00325AD4  # Player::vf13 (HUD view request): KZ3_HUD_PROBE=1 logs msg / player+0x78 / HUD global (the RE notes 7.8 suspect 1; 1.14: 00331D14)
007BBB70  # player module vf14: KZ3_HUD_PROBE=1 order vs the HUD module (7.8 suspect 1-2; 1.14: 007D2A30)
007AF444  # HUD module vf14: KZ3_HUD_PROBE=1 order vs the player module (7.8 suspect 1; 1.14: 007C558C)
0036C01C  # HUD view add: KZ3_HUD_PROBE=1 logs HUD+4 count at exit (7.8 suspect 3; 1.14: 0037812C)
007F2970  # HUD vf16 per-frame update: KZ3_HUD_PROBE=1 count (7.8 suspect 4; 1.14: 00814378)
007F1A10  # HUD dirty-flag consumer: KZ3_HUD_PROBE=1 count + HUD+0xF0 (7.8 suspect 4; 1.14: 008133C8)
007F0470  # HUD viewport-setup lookup: KZ3_HUD_PROBE=1 HUD+0x216C / setup count (7.8 suspect 5; 1.14: 00811D6C)
007F0058  # HUD view create from a setup: KZ3_HUD_PROBE=1 count + r4 (7.8 suspect 5; 1.14: 00811938)
00A78818  # wid 9 list kick (ReadyCountStore 1): KZ3_AUDIO_SPU=1 kick time (kz3_audio_probe.c, the RE notes 5.3 P3; 1.14: 00A8F728)
00A78E54  # wid 9 list poll (handle, t): KZ3_AUDIO_SPU=1 outcome A/B/C/D, entries, row (P1; 1.14: 00A8FD64)
007EDF6C  # HUD view draw: KZ3_HUD_PROBE=1 view+0xC8 / +0xCC / entry+0x10 at entry and exit (the RE notes 7.9; 1.14: 0080F84C, view+0xD8)
0038CA7C  # view viewport setter: KZ3_HUD_PROBE=1 entry (7.9; 1.14: 00398BAC)
007E5570  # per-entry HUD view draw: KZ3_HUD_PROBE=1 count (7.9; 1.14: 00805B30)
001BDF84  # UI renderer draw (U): KZ3_HUD_PROBE=1 entry, U+4/+0xC/+0x10/+0x9D (the RE notes 7.10; 1.14: 001C9524)
001BDCB0  # UI renderer helper: KZ3_HUD_PROBE=1 call count (7.10; 1.14: 001C9250)
007ECB18  # HUD vf3 (sets HUD+0xD4/+0xD8 from U): KZ3_HUD_PROBE=1 exit (7.10; 1.14: 0080E3D4)
007BB404  # session Update (state machine; 4 -> 5 runs HUD vf3): KZ3_HUD_PROBE=1 logs state / movie state 0x13BC8D0 / pending 0x1587FE4 on change (the RE notes 7.13; 1.14: 007D2110)
007BAF7C  # session 4 -> 5 try (tests at 0x7BAFA4..0x7BB0A0): KZ3_HUD_PROBE=1 logs state after it (7.13; 1.14: 007D1C7C)
008C5080  # movie start (sets movie state 1): KZ3_HUD_PROBE=1 logs the first 50 calls (7.13; 1.14: 008F1128)
001D7E58  # occlusion block sizing (r3 = block; tiles +0x870/+0x874, pitch +0x878, planes buffer +0x898): KZ3_CULL_PLANES=1 remembers the block for the job 48 planes check (kz3_cull_planes.c, the RE notes s.13; 1.14: 001E35C8)
007FAEC4  # HUD element instance base ctor (vtable 0xF00600; every HUD*Resource::vf16 CreateInstance): KZ3_HUD_PROBE=1 count + first 40 (the RE notes Pass 42; 1.14: ?)
007FB9A0  # HUD element instance base vf5: KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
007FBB44  # HUD element instance base vf7: KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
008119B8  # HUDCrosshair instance vf16 (vtable 0xF00E18 slot 16): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
00810280  # HUDCrosshair instance vf6: KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
007FD908  # HUDPartText::vf2 (draw): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
007FC9A4  # HUDPartBackground::vf2 (draw): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
007FCE48  # HUDPartProgressBar::vf2 (draw): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
007FC328  # HUDPartIcon::vf2 (draw): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
001B9884  # text-context getter (HUD element text draws, G1): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
001FF878  # Renderer::BuildView (UI pass: r3 = *(U+0x10), r5 = {view count, 0x810-B views}): KZ3_HUD_PROBE=1 count + view words once per second (Pass 42; 1.14: ?)
001FB4A4  # Renderer view submit (BuildView's last step): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
001F3350  # first call of the 0x1BDF84 draw block (gates (a)-(c) passed): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
00200204  # UI renderer vf+0x30 (end of the 0x1BDF84 draw block): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: ?)
007FB164  # HUD element instance base vf2: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
007FB248  # HUD element instance base vf3: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
007FBCE4  # HUD element instance base vf10: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
007FBDB0  # HUD element instance base vf11: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
00810E60  # HUDCrosshair instance vf4: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
00811118  # HUDCrosshair instance vf10: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
008124B0  # HUDCrosshair instance vf11: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
008112CC  # HUDCrosshair instance vf14: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
007F49D0  # HUD per-view element container update (mode -> every element's vf3): KZ3_HUD_PROBE=1 entity / +0x108 / +0x584 / DrawHUD once per second (Pass 42; 1.14: ?)
0081BB34  # HUD element draw (parts), seen in the menu only: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
0084094C  # HUD element draw (parts), seen in the menu only: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
00616250  # Humanoid "spawn": sets Soldier+0x584 = 1 (the HUD mode-2 condition): KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
0065D658  # Humanoid state setter (+0x584 = 2 or 0): KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
00616880  # only direct caller of 0x616250: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: ?)
005A7158  # IsGodMode(entity): KZ3_GOD_MODE=1 answers 1 for the local player (kz3_gameplay.h test aids, pass 43; 1.14: 005BB618)
0061A480  # Humanoid owner infinite-ammo test: KZ3_INFINITE_AMMO=1|2 answers 1 for the local player (1.14: 0062F180)
0073D4B8  # DiscreteAmmoEjector per-shot decrement: KZ3_INFINITE_AMMO=2 keeps the local player's magazine (1.14: 00752F38)
00016700  # String from C string: KZ3_DEBUG_MENU=1 swaps "false" for "true" at the cheat_enabled call (lr 0x89A164; 1.14: 00016618)
0031B9F0  # Localizer lookup: online.ini region label on the region list (port/net/kz3_net_hooks.h, network pass 9; 1.14: 00327620)
00300250  # Asset Streaming WaitUntilIdle/shutdown (RE pass 106): KZ3_STREAM_PROBE=1 dumps M=*0x1585F68 entries + lists while it waits (kz3_stream_probe.c; 1.14: 0030BC20, wired pass 53)
00597170  # ControlledFollowCameraEntity::vf18 (follow-camera update; DirectionElastic vf18 0x599068 calls it): KZ3_CAM_PROBE=1 camera/target dump (kz3_cam_probe.c, pass 50, K2 black; 100-only, 1.14: not matched)
005B1558  # CameraEntity FOV helper (the RE notes): KZ3_CAM_PROBE=1 camera + FOV + view block (pass 50; 100-only, 1.14: 005B15F0)
00D9A908  # stream slot MakePacket(out, slot, arg) (RE pass 109 s.1): KZ3_PKT_PROBE=1 packet balance per slot (kz3_pkt_probe.c, pass 50; 100-only, 1.14: 00DEA410, not wired)
00D9A050  # Packet::Release(pkt) (RE pass 109 s.1): KZ3_PKT_PROBE=1 packet balance (pass 50; 100-only, 1.14: 00DE9B58, not wired)
0059FDA0  # DirectionElasticControlledFollowCameraEntity::ctor: KZ3_CAM_PROBE=1 count (pass 50 K2; 100-only)
0064043C  # VehicleOnRails::ctor: KZ3_CAM_PROBE=1 count (pass 50 K2; 100-only)
0063C784  # VehicleOnRails::vf18: KZ3_CAM_PROBE=1 count + this+0x70 block (pass 50 K2; 100-only)
0063CB40  # VehicleOnRails::vf136 (world matrix EA): KZ3_CAM_PROBE=1 matrix dump (pass 50 K2; 100-only)
005CBAE4  # MountableEntity::Mount(gun, humanoid, name, b, b) (RE pass 112 s.2): KZ3_MOUNT_PROBE=1 gates C1-C7 (kz3_mount_probe.c, pass 51; 100-only, 1.14: 005E0114)
00322940  # readiness test(entity) (RE pass 112 s.2 step 2): KZ3_MOUNT_PROBE=1 result at Mount's two call sites (pass 51; 100-only, 1.14: 0032EB80)
00331648  # event send(mgr, event, ...) (Mount's deferral, id 0x2D): KZ3_MOUNT_PROBE=1 (pass 51; 100-only, 1.14: 0033D888)
005CB61C  # Mount immediate path: KZ3_MOUNT_PROBE=1 count (pass 51; 100-only, 1.14: 005DFC4C)
005DCC6C  # MountedGun vf60 AttachUser: KZ3_MOUNT_PROBE=1 count + ret (pass 51; 100-only, 1.14: 005F12A4)
00694700  # HumanoidSubStateUsingInteractiveEntity vf103 (enter): KZ3_MOUNT_PROBE=1 count (pass 51; 100-only, 1.14: 006A9860)
005A5778  # ControlledEntity::TransferController: KZ3_MOUNT_PROBE=1 count (pass 51; 100-only, 1.14: 005B9C38)
005C8C10  # ControlledEntityController camera activate (slot 31): KZ3_MOUNT_PROBE=1 count + camera (pass 51; 100-only, 1.14: 005DD240)
005A00CC  # FirstPersonCameraEntity ctor thunk: KZ3_MOUNT_PROBE=1 count (pass 51; 100-only, 1.14: 005B44D4)
00A6674C  # stream voice RetirePackets(voice) (RE pass 112 s.4): KZ3_PKT_PROBE=1 head/tail/consumed (kz3_voice_probe.c, pass 51; 1.14: 00A7A25C, wired pass 53)
00A66928  # stream voice Update(voice): KZ3_PKT_PROBE=1 count + state (pass 51; 1.14: 00A7A438, wired pass 53)
00A66F8C  # PacketQueue::Push(voice, entry, flags) -> 1/0: KZ3_PKT_PROBE=1 count + DMA watch on the ring (pass 51; 1.14: 00A7AA9C, wired pass 53)
00A671A0  # stream voice reset (consumed := tail, RetirePackets): KZ3_PKT_PROBE=1 count + caller (pass 51; 100-only, 1.14: ?)
00A66D54  # stream voice dtor (vtable 0x12D1F28 +0x40): KZ3_PKT_PROBE=1 count + caller (pass 51; 100-only, 1.14: ?)
00A66B00  # stream voice dtor (vtable +0x44): KZ3_PKT_PROBE=1 count + caller (pass 51; 100-only, 1.14: ?)
00A69110  # voice-list update loop (calls voice vf +0x4C): KZ3_PKT_PROBE=1 count (pass 51; 100-only, 1.14: ?)
00A698A0  # voice-list update loop 2: KZ3_PKT_PROBE=1 count (pass 51; 100-only, 1.14: ?)
00A57B64  # stream manager request cancel (0x300250 calls it twice): KZ3_VOICE_DRAIN=1 drains stuck stream voices after it (pass 51 quit-hang workaround; 100-only, 1.14: 00A6B674, wired pass 53)
00A6F500  # mixer-node list update (calls child vf +0x4C): KZ3_PKT_PROBE=1 count (pass 51; 100-only, 1.14: ?)
00A456A8  # caller of a vf +0x4C (audio): KZ3_PKT_PROBE=1 count (pass 51; 100-only, 1.14: ?)
00A69EE4  # mixer-node list update (vf +0x4C at 0xA69F08): KZ3_PKT_PROBE=1 count (pass 51; 100-only, 1.14: ?)
00A6A498  # mixer-node vtable slot 0 (voice init calls it with the descriptor; ASSUMPTION attach): KZ3_PKT_PROBE=1 count (pass 51; 100-only, 1.14: ?)
00A65794  # stream voice vtable +0x50: KZ3_PKT_PROBE=1 count (pass 51; 100-only, 1.14: ?)
00089D7C  # WaitForJobGroup(E, poll_us) (RE pass 114 s.1): KZ3_AMA_PROBE=1 entry/exit + slow waits (kz3_ama_probe.c, pass 52; 100-only, 1.14: 0008B56C)
00A798B8  # job-list finished poll (-> 0xA78E54(D, 3)): KZ3_AMA_PROBE=1 state dump when one wait polls 200/2000/20000 times (pass 52; 100-only, 1.14: 00A907C8)
0008978C  # job-group push (A78648 + ReadyCountSwap): KZ3_AMA_PROBE=1 ring of the last 8 pushes (pass 52; 100-only, 1.14: 0008AF7C)
0079B3F0  # PathMover SetPath(this, name) (RE pass 114 s.2): KZ3_RAIL_PROBE=1 name + C8/140/24/20 after (kz3_rail_probe.c, pass 52; 100-only, 1.14: 007B1500)
0079B570  # PathMover Teleport(this): KZ3_RAIL_PROBE=1 count (pass 52; 100-only, 1.14: 007B1680)
0079A740  # FollowPathMover per-step Update(this, dt): KZ3_RAIL_PROBE=1 count, every 60th dump (pass 52; 100-only, 1.14: 007B0850)
00384D10  # PathMover vf48(this, out): KZ3_RAIL_PROBE=1 count, every 60th +0x68; pass 65: record dump on return (pass 52; 100-only, 1.14: 00390E20)
007B3598  # GameWorld::LogicStep: KZ3_RAIL_PROBE=1 count per second (pass 52; 100-only, 1.14: 007C96D0)
0079B4D8  # FollowPathMover GetTime -> f1: KZ3_RAIL_PROBE=1 count + last value (pass 52; 100-only, 1.14: ?)
007B3CD0  # frame function calling LogicStep (gates +0x180 < 3, u64 +0x78 >= +0xE8): KZ3_RAIL_PROBE=1 dump (pass 52; 100-only, 1.14: ?)
007B1C00  # GameModule vf18 Pause(W, r4) (RE pass 117, pacing s.8): KZ3_RAIL_PROBE=1 entry/exit +8/+0x88/+0xFC, lr (pass 53; 100-only, 1.14: 007C7D30)
007B1D30  # GameModule vf19 Resume(W): KZ3_RAIL_PROBE=1 entry/exit (pass 53; 100-only, 1.14: 007C7E60)
00849FB8  # SetGameTimeScale script native: KZ3_RAIL_PROBE=1 f1, +0xFC/+0x88 (pass 53; 100-only, 1.14: ?)
007BA8C8  # level-start state machine (state 5 stores +0x88 at 0x7BADEC): KZ3_RAIL_PROBE=1 when +8/+0x88 change (pass 53; 100-only, 1.14: 007D15C8)
008C4E7C  # loading/intro movie start (Pause at lr 0x8C5030): KZ3_RAIL_PROBE=1 entry/exit (pass 53; 100-only, 1.14: ?)
008C5808  # movie stop (Resume at lr 0x8C58C0): KZ3_RAIL_PROBE=1 entry/exit (pass 53; 100-only, 1.14: 008F1900)
001C56C0  # atomic +-1 of [r3+0x2060] (0x1514AD0+0x2060 = 0x1516B30, the not-ready count that holds K2 paused): KZ3_RAIL_PROBE=1 caller object (pass 53; 100-only, 1.14: ?)
000F7418  # ready(item): every resource id of item+0x80 loaded (table 0x13F50F0): KZ3_RAIL_PROBE=1 logs the ids when 0 (pass 53; 100-only, 1.14: ?)
003859D0  # PathMover SetPath(this, name) (RE pass 123, gameplay s.7.2; InertiaPathMover uses this row): KZ3_RAIL_PROBE=1 name, +0x60 path, +0x68 dirty after (pass 65; 100-only, 1.14: 00391AE0)
00385E14  # PathMover Teleport(this): KZ3_RAIL_PROBE=1 count (pass 65; 100-only, 1.14: 00391F24)
00385E58  # PathMover BlendToPath(this, name): KZ3_RAIL_PROBE=1 count (pass 65; 100-only, 1.14: 00391F68)
00B9B078  # PathMover GetTime -> f1 (+0x64 == 0 ? +0x6C : path time): KZ3_RAIL_PROBE=1 count + f1 (pass 65; 100-only, 1.14: 00BA5F98)
0031FB8C  # name-table lookup(table, &name, 1) -> object: KZ3_RAIL_PROBE=1 only from SetPath (lr 0x385A10) / CreateMover (lr 0x845D88) (pass 65; 100-only, 1.14: 0032BDBC)
00845D50  # CreateMover Lua native (row 0x13B5D84, OPD 0x1316830): KZ3_RAIL_PROBE=1 type name + new mover (pass 65; 100-only, 1.14: 00868740)
0004BC70  # GPU-pool handle register(mgr, handle) (RE pass 120 s.9.1): KZ3_POOL_PROBE=1 ids 1480..1580 (kz3_pool_probe.c, pass 54; 100-only, 1.14: 0004C4C0)
000497F4  # GPU-pool alloc(mgr, handle, size, align) writes res[0]: KZ3_POOL_PROBE=1 fails + ids 1480..1580 (pass 54; 100-only, 1.14: 0004A044)
0004CA24  # vertex-buffer create: KZ3_POOL_PROBE=1 logs 0 returns (pass 54; 100-only, 1.14: 0004D274)
001B4CB8  # VertexArrayResource load vf15: KZ3_POOL_PROBE=1 count + failures (pass 54; 100-only, 1.14: 001C0258)
001B4E14  # IndexArrayResource load vf15: KZ3_POOL_PROBE=1 count + failures (pass 54; 100-only, 1.14: 001C03B4)
0004A200  # stream-request service(S = 0x13F5040), per frame from Renderer::FrameTick: KZ3_POOL_PROBE=1 call count (pass 54; 100-only, 1.14: ?)
00049D2C  # stream request(S, handle): alloc + queue read: KZ3_POOL_PROBE=1 ids 1480..1580 (pass 54; 100-only, 1.14: ?)
001C5208  # build + push the Gfx.TextureStreaming SPU job (module 42, job_01181700) for 0x1514AD0: KZ3_POOL_PROBE=1 banks + K2's six ids (pass 54; 100-only, 1.14: ?)
0031E328  # frustum build(out r3, camera r4) for the texture-streaming views: KZ3_POOL_PROBE=1 in/out words (pass 55; 100-only, 1.14: ?)
001D0D50  # stream-view copy from a frustum (r3 view, r4 frustum): KZ3_POOL_PROBE=1 frustum words (pass 55; 100-only, 1.14: ?)
007F0948  # texture-streaming view build per render view (r4 = render view, [r4+0x10] camera, vcall vt+0x44): KZ3_POOL_PROBE=1 camera dump (pass 55; 100-only, 1.14: ?)
0031DFB8  # camera (vt 0xEBA1D8) vt+0x40: matrix cam+0x10..0x4F from a description (r4) via 0x36C30/0x75850, stvx: KZ3_POOL_PROBE=1 caller/source/result (pass 56; 100-only, 1.14: ?)
0031EB04  # camera (vt 0xEBA1D8) ctor, r4 = this: KZ3_CAM_WATCH=1 page-guard write watch on cam+0x10..0x4F (pass 56; 100-only, 1.14: ?)
0038C3D8  # render-camera description from a camera component (r3 out, r4 comp, matrix comp+0x60): KZ3_CAM_WATCH=1 dump + watch (pass 56; 100-only, 1.14: ?)
005BCB90  # entity part update: camera component matrix comp+0x60 from a vt+0x68 getter: KZ3_CAM_WATCH=1 logs this (pass 56; 100-only, 1.14: ?)
005E0C88  # part vt+0x68 (vt 0xED2340): gunner view matrix from two skeleton bones + smoothed yaw/pitch: KZ3_CAM_WATCH=1 inputs/output (pass 56; 100-only, 1.14: ?)
008E3DAC  # hkSpuJobThreadPool::processAllJobs(pool, queue, type): KZ3_JOIN2_PROBE=1 per-pool count (kz3_hkquit_probe.c, pass 57; 100-only, 1.14: 0090FDBC)
008E3E8C  # hkSpuJobThreadPool::waitForCompletion(pool): KZ3_JOIN2_PROBE=1 count / open wait (pass 57; 100-only, 1.14: 0090FE9C)
008E3C10  # ~hkSpuJobThreadPool(pool): KZ3_JOIN2_PROBE=1 pool/semaphore/queue dump (pass 57; 100-only, 1.14: 0090FC20)
008E0334  # hkPs3SpuUtil::destroyTaskset(util): KZ3_JOIN2_PROBE=1 enter/return (pass 57; 100-only, 1.14: 0090C444)
008E89A0  # Havok semaphore release: KZ3_JOIN2_PROBE=1 count (pass 57; 100-only, 1.14: 00914BD0)
008E88E4  # Havok semaphore acquire: KZ3_JOIN2_PROBE=1 count (pass 57; 100-only, 1.14: 00914B14)
00220A78  # wait until *flag == 1 (usleep(10) per poll; many callers): KZ3_STALL_DIAG=1 reports a wait over 3 s with the flag, caller and object (kz3_stall_diag.c, SPU pass 63; 1.14: unknown)
# Guest setjmp/longjmp host frames (KZ3 patch 1116, SPU pass 101; the RE notes "Pass 101", RE pass 145): every bl to the
# setjmp takes a host frame, the longjmp host-jumps to it. Only Lua's protected calls use them (setjmp sites in 0xA91FC,
# 0xAD1E4, 0xB92B8 at lj.b = r1+0x74, lj.status = r1+0x294: status=0x220 from the jmp_buf argument; longjmp from 0x9EE30).
setjmp  00ABBC68 status=0x220   # libc setjmp (aligns r3 to 16, saves r1/r2/r13-r31/f14-f31/v20-v31/LR/CR)
longjmp 00ABBD8C                # libc longjmp (restores them, r3 = val ? val : 1, blr)
001FB8F8  # BuildPost: Bloom strength (patch 2121, vp+0x230 scaled after the original; KZ3_BLOOM / display.ini bloom), RSX pass 114 [114=00207248 high]
