No spread: zero pellet offsets inside FireBullets

Picking the best of 256 pending seeds still leaves the shotgun's 8/12 pellets
a few degrees apart. CShotManipulator::ApplySpread is inlined into
CBaseEntity::FireBullets and draws x/y through the global
CUniformRandomStream; hook its RandomFloat slot and return 0 when the calling
frame's shooter is the local server player. This collapses every pellet onto
the shot direction while NPC fire and client prediction keep their randomness.

2 files changed, 72 insertions, 0 deletions

diff --git a/CONTEXT.md b/CONTEXT.md
index bd3507a..75b2f0a 100644
--- a/CONTEXT.md
+++ b/CONTEXT.md
@@ -298,6 +298,14 @@ vocabulary / decisions.
   `CBaseEntity::FireBullets`; the `CUniformRandomStream` wrappers and
   constructor-time `RandomSeed(0)` resets pass other objects and are left
   alone.
+- Seed choice alone cannot remove all of a shotgun's pellet spread: the best
+  of 256 sequences still leaves its 8/12 draws apart. `CShotManipulator::
+  ApplySpread` is inlined into `CBaseEntity::FireBullets` and draws x/y via
+  the global `CUniformRandomStream` (`_ZTV20CUniformRandomStream` + 8, slot 1
+  = `RandomFloat(float,float)`; confirmed against `libvstdlib.so`). The hook
+  returns 0 for those draws only when the calling frame's `this` (at
+  `ebp+8`) is the local server player, so every pellet follows the exact shot
+  direction. NPC fire and the client's prediction stream keep normal values.
 - This attacks the random cone offset only. The cone size, the pistol's
   `m_flAccuracyPenalty` growth, the server view punch added to
   `GetAutoaimVector`, and any damage falloff are server-side state. In
diff --git a/src/hl2h.cpp b/src/hl2h.cpp
index 7ce35d3..02bf584 100644
--- a/src/hl2h.cpp
+++ b/src/hl2h.cpp
@@ -574,8 +574,72 @@ static void install_seed_hook() {
        (void *)g_real_random_seed);
 }
 
+
+// ---------------------------------------------------------------------------
+// pellet spread: zero the random offsets inside FireBullets
+// ---------------------------------------------------------------------------
+//
+// CShotManipulator::ApplySpread is inlined into CBaseEntity::FireBullets and
+// draws its x/y offsets through the global CUniformRandomStream (vtable slot
+// 1, confirmed against libvstdlib: _ZTV20CUniformRandomStream + 8 + 4). The
+// seed search can only choose the least-bad sequence, which still leaves the
+// shotgun's pellets slightly apart. Returning 0 for these draws makes every
+// pellet follow the shot direction exactly. The hook is conditional on the
+// calling frame belonging to the local server player, so NPC fire and the
+// client's own prediction stream keep their randomness.
+
+static float (*g_orig_uniform_float)(void *, float, float) = nullptr;
+static bool g_uniform_hook_installed = false;
+
+static float hkdUniformRandomFloat(void *self, float mn, float mx) {
+  if (g_local_server_player && feature_active(FEAT_SPREAD) &&
+      spread_no_spread_enabled()) {
+    void *frame = nullptr;
+    __asm__ volatile("movl %%ebp, %0" : "=r"(frame));
+    if (frame) {
+      frame = *(void **)frame; // caller's ebp (CBaseEntity::FireBullets)
+      void *who = frame ? *(void **)((char *)frame + 8) : nullptr;
+      if (who && (uintptr_t)who == g_local_server_player)
+        return 0.0f;
+    }
+  }
+  return g_orig_uniform_float ? g_orig_uniform_float(self, mn, mx) : mn;
+}
+
+static void install_uniform_random_hook() {
+  if (g_uniform_hook_installed)
+    return;
+  void *vt = dlsym(RTLD_DEFAULT, "_ZTV20CUniformRandomStream");
+  if (!vt) {
+    logf("spread: CUniformRandomStream vtable not found");
+    return;
+  }
+  void **ap = (void **)((char *)vt + 8); // skip offset-to-top and typeinfo
+  void *rf = dlsym(RTLD_DEFAULT, "_ZN20CUniformRandomStream11RandomFloatEff");
+  int slot = 1; // RandomFloat(min,max) follows SetSeed in the vtable
+  if (rf) {
+    for (int i = 0; i < 8; i++) {
+      if (ap[i] == rf) {
+        slot = i;
+        break;
+      }
+    }
+  }
+  g_orig_uniform_float = (float (*)(void *, float, float))ap[slot];
+  uintptr_t page = (uintptr_t)&ap[slot] & ~(uintptr_t)0xFFF;
+  if (mprotect((void *)page, 0x1000, PROT_READ | PROT_WRITE) != 0) {
+    logf("spread: could not make the random vtable writable");
+    return;
+  }
+  ap[slot] = (void *)&hkdUniformRandomFloat;
+  g_uniform_hook_installed = true;
+  logf("spread: CUniformRandomStream::RandomFloat slot %d (%p) -> %p", slot,
+       (void *)g_orig_uniform_float, (void *)&hkdUniformRandomFloat);
+}
+
 static void do_move(int seq, float frametime) {
   install_seed_hook();
+  install_uniform_random_hook();
   static bool g_echo_sent = false;
   if (!g_input || !g_net.ok())
     return;