# PPU functions the host replace (v1.14 EBOOT)s (ppu_lifter.py --overrides). Row = ADDR  # description [tag]; tag = 114=ADDR conf (twin in the other table) or 100-only/114-only: reason.
# Checked by tools/assets/test_override_tables.py (function starts, twins, addr_map). Twins: the RE notes s.35/36.2.
00CC29C0  # BinkShouldSkip (ASSUMPTION: name from behaviour): no skip on the frame after the wrap, see the RE notes [100=00CB26E0 high]
00011208  # lookup2 hash (Bob Jenkins): native body (host reads), was the level load's hot spot [100=000111F8 high]
00020714  # game heap allocator (heap*, size) under malloc 0x86428: logs failed allocations and the high-water mark (pass 12) [100=000203DC high]
000C59F4  # PPU fiber scheduler run_all(S, list): host fibers (guest_fiber.c), pass 13 [100=000C3A54 high]
000C5A08  # PPU fiber scheduler wait(S, ptr): switch to the scheduler's host fiber [100=000C3A68 high]
000C595C  # PPU fiber scheduler finish(S): free the slot, back to the scheduler [100=000C39BC high]
00064F88  # wait_label(r3, idx, wanted): pass 14 diagnostic, logs stuck waits with the command context [100=000640E0 high]
0020A958  # queue_mlaa(renderer, 0, 0): skipped when the host FXAA pass is on (patch 2023, KZ3_HOST_AA), the RE notes section 18 [100=001FF008 high]
002093B0  # MotionBlur(renderer, ...): post job 0x20 not queued when Options > Display > Motion blur is off (rsx patch 2107) [100=001FDA60 high]
0008C360  # HardExit: log the game's fatal text and caller ([HardExit], kz3_log.h KZ3_HOOK_HARDEXIT; RE pass 64 [100=0008AB70 medium]
000DFF30  # link resolve: log unresolved dependent links ([link-miss], KZ3_HOOK_LINK_RESOLVE [100=000DDFF0 high]
004CF158  # PlayerProfile ctor: KZ3_SP_UNLOCK=1 writes +0x11F18 (SPAllUnlocked) after it (kz3_gameplay.h, B7 [100=004C2F08 medium]
005B7760  # ControllerBase::SetViewAngles: KZ3_GAMEPLAY_TRACE=1 yaw/pitch/position line (B4 [100=005A3350 high]
0069B330  # SoldierJoystickController::UpdateMoveInput: KZ3_GAMEPLAY_TRACE=1 move vector (B4 [100=006861B0 medium]
00B42FCC  # per-view visibility result descriptor rebuild (RE pass 73 s.11.2): KZ3_CULL_PROBE=1 counts at clear / +2 ms / rebuild (kz3_cull_probe.c; 1.14: unknown, asked re-data) [100=00B37FBC high]
0080FA30  # HUD manager render slot: KZ3_HUD_PROBE=1 call counter (kz3_hud_probe.c [100=007EE150 high]
0080ECF8  # HUD render: KZ3_HUD_PROBE=1 gates G1 font flag / G2 state / manager / DrawHUD once per second (the RE notes 6.2 [100=007ED438 medium]
001C8398  # font system init (sets 0x1345C80): KZ3_HUD_PROBE=1 call counter [100=001BCDF8 medium]
0005C2D0  # frame-arena chunk take (arena, stamp, wait) -> chunk EA: KZ3_ARENA_PROBE=1 logs the old table word / label / epoch / frame (RE pass 74 s.11.5, kz3_arena_probe.c [100=0005B9F0 high]
001E4278  # per-view job builder, spins on block+0x8A0 at entry: KZ3_ARENA_PROBE=1 logs the chain counter at entry and the wait (1.14: unknown, asked re-data) [100=001D8B08 high]
00D92638  # brbDriver thread entry (audio ring producer): KZ3_AUDIO_TICK=1 wraps sc 0x82/0x8d on its thread (kz3_audio_probe.c, the RE notes [100=00D42C7C high]
00D941D0  # brbDriver mix step (per unit): KZ3_AUDIO_TICK=1 time + usleep polls per unit [100=00D44810 high]
00D94A2C  # mix pass job append (node, items, taken, last): KZ3_AUDIO_VOICE=1 voices/jobs per unit (kz3_mixjob_probe.c, the RE notes s.5.4) [100=00D44AB8 high]
00331D14  # Player::vf13 (HUD view request): KZ3_HUD_PROBE=1 logs msg / player+0x78 / HUD global (the RE notes 7.8 suspect 1 [100=00325AD4 high]
007D2A30  # player module vf14: KZ3_HUD_PROBE=1 order vs the HUD module (7.8 suspect 1-2 [100=007BBB70 medium]
007C558C  # HUD module vf14: KZ3_HUD_PROBE=1 order vs the player module (7.8 suspect 1 [100=007AF444 medium]
0037812C  # HUD view add: KZ3_HUD_PROBE=1 logs HUD+4 count at exit (7.8 suspect 3 [100=0036C01C high]
00814378  # HUD vf16 per-frame update: KZ3_HUD_PROBE=1 count (7.8 suspect 4 [100=007F2970 high]
008133C8  # HUD dirty-flag consumer: KZ3_HUD_PROBE=1 count + HUD+0xF0 (7.8 suspect 4 [100=007F1A10 medium]
00811D6C  # HUD viewport-setup lookup: KZ3_HUD_PROBE=1 HUD+0x216C / setup count (7.8 suspect 5 [100=007F0470 high]
00811938  # HUD view create from a setup: KZ3_HUD_PROBE=1 count + r4 (7.8 suspect 5 [100=007F0058 high]
0008CF08  # SetCrashDumpField: fields to the logger ([crashdump] at debug, field 10 kept for [link-miss], field 3 left to [HardExit]; KZ3_HOOK_CRASHDUMP_FIELD), the RE notes s.28, 34 [114-only: function does not exist in 1.00 (s.36.2)]
000DD600  # ResourceManager::Find: log lookups that return 0 (KZ3_RES_MISS=0 off), the RE notes s.28 [114-only: new in 1.14 (s.36.2)]
00398BAC  # view viewport setter: KZ3_HUD_PROBE=1 entry (7.9; 1.14: 00398BAC) [100=0038CA7C high]
0080F84C  # HUD view draw: KZ3_HUD_PROBE=1 view+0xC8 / +0xCC / entry+0x10 at entry and exit (the RE notes 7.9; 1.14: 0080F84C, view+0xD8) [100=007EDF6C high]
00805B30  # per-entry HUD view draw: KZ3_HUD_PROBE=1 count (7.9; 1.14: 00805B30) [100=007E5570 medium]
00A8F728  # wid 9 list kick (ReadyCountStore 1): KZ3_AUDIO_SPU=1 kick time (kz3_audio_probe.c, the RE notes 5.3 P3; 1.14: 00A8F728) [100=00A78818 high]
00A8FD64  # wid 9 list poll (handle, t): KZ3_AUDIO_SPU=1 outcome A/B/C/D, entries, row (P1; 1.14: 00A8FD64) [100=00A78E54 high]
001C9524  # UI renderer draw (U): KZ3_HUD_PROBE=1 entry, U+4/+0xC/+0x10/+0x9D (the RE notes 7.10; 1.14: 001C9524) [100=001BDF84 high]
001C9250  # UI renderer helper: KZ3_HUD_PROBE=1 call count (7.10; 1.14: 001C9250) [100=001BDCB0 high]
0080E3D4  # HUD vf3 (sets HUD+0xD4/+0xD8 from U): KZ3_HUD_PROBE=1 exit (7.10; 1.14: 0080E3D4) [100=007ECB18 high]
00964880  # SIXAXIS default (B8 Motion Sensor): profile = r3, stb r30,0xB6(r31) at 0x9648F8; KZ3_HOOK_SIXAXIS_DEFAULT, the RE notes s.14 [114-only: no 1.00 hook; macro exists in kz3_ppu_overrides.cpp]
009652DC  # SIXAXIS pad-type hook (B8): profile = r3, stb r4,0xB6(r7) at 0x9652F8; KZ3_HOOK_SIXAXIS_PADTYPE (1.00 twin 0x94CDAC is identical but has no hook) [114-only: no 1.00 hook; macro exists in kz3_ppu_overrides.cpp]
009703A0  # SIXAXIS profile load (B8): profile = r4, stb r3,0xB6(r30) at 0x9704A8; KZ3_HOOK_SIXAXIS_LOAD [114-only: no 1.00 hook; macro exists in kz3_ppu_overrides.cpp]
007D2110  # session Update (state machine; 4 -> 5 runs HUD vf3): KZ3_HUD_PROBE=1 logs state / movie state 0x13BC8D0 / pending 0x1587FE4 on change (the RE notes 7.13; 1.14: 007D2110) [100=007BB404 high]
007D1C7C  # session 4 -> 5 try (tests at 0x7BAFA4..0x7BB0A0): KZ3_HUD_PROBE=1 logs state after it (7.13; 1.14: 007D1C7C, prologue match only: ASSUMPTION) [100=007BAF7C medium]
008F1128  # movie start (sets movie state 1): KZ3_HUD_PROBE=1 logs the first 50 calls (7.13; 1.14: 008F1128, prologue match only: ASSUMPTION) [100=008C5080 medium]
001E35C8  # occlusion block sizing (r3 = block; tiles +0x870/+0x874, pitch +0x878, planes buffer +0x898): KZ3_CULL_PLANES=1 remembers the block for the planes check (kz3_cull_planes.c, the RE notes s.13; 1.14: 001E35C8) [100=001D7E58 high]
0081D14C  # HUD element instance base ctor (vtable 0xF00600; every HUD*Resource::vf16 CreateInstance): KZ3_HUD_PROBE=1 count + first 40 (the RE notes Pass 42; 1.14: 0081D14C) [100=007FAEC4 high]
0081DC28  # HUD element instance base vf5: KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 0081DC28) [100=007FB9A0 high]
0081DDCC  # HUD element instance base vf7: KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 0081DDCC) [100=007FBB44 high]
00834220  # HUDCrosshair instance vf16 (vtable 0xF00E18 slot 16): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 00834220) [100=008119B8 medium]
00832ABC  # HUDCrosshair instance vf6: KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 00832ABC) [100=00810280 high]
0081FBEC  # HUDPartText::vf2 (draw): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 0081FBEC) [100=007FD908 high]
0081EC7C  # HUDPartBackground::vf2 (draw): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 0081EC7C) [100=007FC9A4 high]
0081F124  # HUDPartProgressBar::vf2 (draw): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 0081F124) [100=007FCE48 high]
0081E5D8  # HUDPartIcon::vf2 (draw): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 0081E5D8) [100=007FC328 high]
001C4E24  # text-context getter (HUD element text draws, G1): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 001C4E24) [100=001B9884 high]
0020B1C8  # Renderer::BuildView (UI pass: r3 = *(U+0x10), r5 = {view count, 0x810-B views}): KZ3_HUD_PROBE=1 count + view words once per second (Pass 42; 1.14: 0020B1C8) [100=001FF878 high]
00206DEC  # Renderer view submit (BuildView's last step): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 00206DEC) [100=001FB4A4 high]
001FEAD0  # first call of the 0x1BDF84 draw block (gates (a)-(c) passed): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 001FEAD0) [100=001F3350 high]
0020BB54  # UI renderer vf+0x30 (end of the 0x1BDF84 draw block): KZ3_HUD_PROBE=1 count (Pass 42; 1.14: 0020BB54) [100=00200204 high]
0081D3EC  # HUD element instance base vf2: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 0081D3EC) [100=007FB164 high]
0081D4D0  # HUD element instance base vf3: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 0081D4D0) [100=007FB248 high]
0081DF6C  # HUD element instance base vf10: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 0081DF6C) [100=007FBCE4 medium]
0081E038  # HUD element instance base vf11: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 0081E038) [100=007FBDB0 high]
008336A0  # HUDCrosshair instance vf4: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 008336A0) [100=00810E60 medium]
00833958  # HUDCrosshair instance vf10: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 00833958) [100=00811118 high]
00834D34  # HUDCrosshair instance vf11: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 00834D34) [100=008124B0 high]
00833B0C  # HUDCrosshair instance vf14: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 00833B0C) [100=008112CC high]
008163D8  # HUD per-view element container update (mode -> every element's vf3): KZ3_HUD_PROBE=1 entity / +0x108 / +0x584 / DrawHUD once per second (Pass 42; 1.14: 008163D8) [100=007F49D0 medium]
0083E368  # HUD element draw (parts), seen in the menu only: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 0083E368) [100=0081BB34 high]
008633DC  # HUD element draw (parts), seen in the menu only: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 008633DC) [100=0084094C high]
0062A990  # Humanoid "spawn": sets Soldier+0x584 = 1 (the HUD mode-2 condition): KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 0062A990) [100=00616250 high]
00672238  # Humanoid state setter (+0x584 = 2 or 0): KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 00672238) [100=0065D658 high]
0062AFB8  # only direct caller of 0x616250: KZ3_HUD_PROBE=1 count + callers (Pass 42; 1.14: 0062AFB8) [100=00616880 medium]
005BB618  # IsGodMode stub (li r3,0) -> KZ3_GOD_MODE [100=005A7158 medium]
0062F180  # owner infinite-ammo test (profile read removed) [100=0061A480 medium]
00752F38  # ejector per-shot [100=0073D4B8 high]
00016618  # String from C string, debug menu at lr 0x8BEF00 ("true" 0xEDD3A4) [100=00016700 medium]
00327620  # Localizer lookup, region label (assign helper 0x244C4) [100=0031B9F0 high]
0030BC20  # Asset Streaming WaitUntilIdle/shutdown (RE pass 106): KZ3_STREAM_PROBE=1 dumps M=*0x15FB668 while it waits (kz3_stream_probe.c, SPU pass 53) [100=00300250 high]
00A7A25C  # stream voice RetirePackets(voice) (RE pass 112 s.4): KZ3_PKT_PROBE=1 head/tail/consumed (kz3_voice_probe.c, SPU pass 53) [100=00A6674C high]
00A7A438  # stream voice Update(voice): KZ3_PKT_PROBE=1 count + state (kz3_voice_probe.c, SPU pass 53) [100=00A66928 high]
00A7AA9C  # PacketQueue::Push(voice, entry, flags) -> 1/0: KZ3_PKT_PROBE=1 count + DMA watch on the ring (kz3_voice_probe.c, SPU pass 53) [100=00A66F8C high]
00A6B674  # stream manager request cancel (0x30BC20 calls it twice): KZ3_VOICE_DRAIN=1 drains stuck stream voices after it (opt-in quit-hang workaround, SPU pass 53) [100=00A57B64 high]

# Guest setjmp/longjmp host frames (KZ3 patch 1116, RE pass 147): twins of 1.00 0x00ABBC68 / 0x00ABBD8C in port/spu/ppu_overrides.txt.
# The 0x1D8 bytes from each setjmp are word-for-word identical in EBOOT.elf and EBOOT-114.elf (checked in the ELF files), so status=0x220 carries over.
setjmp  00AC63E4 status=0x220   # libc setjmp [100=00ABBC68]
longjmp 00AC6508                # libc longjmp [100=00ABBD8C]
000284A0  # SelectPatchSetSP: the overlay's patch directory follows the game's switch (kz3_vfs_follow_patch_set; the RE notes s.33/s.37, pass 155) [114-only: patch sets are new in 1.14 (s.36.2)]
000284D8  # SelectPatchSetMP: same, multiplayer set (Botzone, net 34) [114-only: patch sets are new in 1.14 (s.36.2)]
000D9900  # loader pass for one lump: log the result ([lump-pass] load; KZ3_LUMP_TRACE=0 off), the RE notes s.44 [114-only: new in 1.14 (s.36.2), no twin]
0009488C  # object pass inside it: log the result ([lump-pass] objects) [114-only: new in 1.14 (s.36.2), no twin]
00320D38  # batch driver: log package name and result byte ([lump-pass] batch) [114-only: new in 1.14 (s.36.2), no twin]
00095DFC  # [lump-stage] log a failing result (object pass stage 0x10), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
000960B8  # [lump-stage] log a failing result (stage 0x14), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
00097AB0  # [lump-stage] log a failing result (stage 0x24), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
000981A0  # [lump-stage] log a failing result (stage 0x28), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
000DE3A0  # [lump-stage] log a failing result (stage 0x2C (counts)), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
0009694C  # [lump-stage] log a failing result (stage 0x18), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
00098404  # [lump-stage] log a failing result (stage 0x30), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
000DE9D4  # [lump-stage] log a failing result (stage 0x34 (resident lookup 0xDC2D0 / create)), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
000DF530  # [lump-stage] log a failing result (stage 0x20 (object bodies)), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
0009359C  # [lump-stage] log a failing result (byte stream refill), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
000268F4  # [lump-stage] log a failing result (stream GetLength), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
00029BD8  # [lump-stage] log a failing result (stream Read), KZ3_LUMP_TRACE=0 off, the RE notes s.45 [114-only: new in 1.14 (s.36.2), no twin]
00207248  # BuildPost: Bloom strength (patch 2121, vp+0x230 scaled after the original; KZ3_BLOOM / display.ini bloom), the RE notes s.51 [100=001FB8F8 high]
