Fix audit findings: crash safety, correctness, rendering, performance

Crash/UB:
- gate every hook behind an init-stage flag until config/surface/input are ready
- publish module maps as immutable atomic snapshots instead of reallocating
  shared vectors under unlocked readers
- validate the %ebp walk in the RandomSeed/RandomFloat hooks against the stack
- bounds-check every RecvTable/RecvProp/string dereference with module_range()
- preserve the Itanium vtable header when cloning (client, CInput, model render,
  studio render)
- reject negative usercmd sequence numbers; guard config_load against a null
  section target; cap the bone parent walk; check mprotect; drop PROT_EXEC on
  the GOT patch; absorb server.so .bss tail

Correctness:
- filter dormant entities across ESP, aimbot, triggerbot, melee, items and
  projectiles (slot self-tested against the local player)
- reset the server-health latch per map and only latch on valid model indices
- bone cache sized for the 128-target scan; set valid=false on every failure;
  head_position keeps searching past an invalid bone
- vischeck steps past glass by probing until clear, and ignores entities owned
  by the target (held weapons, bone followers)
- aimbot: maxs no longer disables it, AABB-aware FOV prefilter, lock hysteresis,
  lead point re-checked for FOV and visibility
- spread: seed hook arms on the no-spread toggle alone; engine toggle only
  controls the RandomFloat zeroing
- resolve m_hOwnerEntity/m_hOwner; NPC lead velocity from the server entity
- vector_angles pitch range, point_ground normal test, underwater jump+duck no
  longer skips combat, semi-auto press/release edge for synthetic fire
- item/projectile markers and blast rings refresh origin per frame while
  discovery stays at 10 Hz; trajectory uses the real m_DmgRadius and honours
  the blast-radius toggle

Rendering/GUI:
- one overlay draw per engine frame (FRAME_RENDER_START boundary), fixing
  alpha stacking and the speed-graph flicker
- clipped lines/outlines and ellipsised text instead of drawing past the
  content pane or shifting over neighbours
- dropdown dismissal consumes the click; hover ignores hidden controls
- chams: reset AlphaModulate, reference shared materials once, restore prop
  tint colour; fonts created once per handle
- projection uses Source's 4:3 aspect scaling and roll; screen size refreshed
  each frame; FOV circle gated on the aim toggles, not the bind

Performance:
- TTL caches for NPC relation, friendly/neutral and damage class
- model names memoised per model index
- entity pointer -> index cache for the triggerbot (was a 4096-slot walk/tick)

Build:
- real Makefile with -MMD dependency tracking, debug/release objects and an
  always-relink rule; build.sh kept as a thin wrapper

1 files changed, 40 insertions, 59 deletions

diff --git a/src/menu.cpp b/src/menu.cpp
index 1064365..f3a9bb9 100644
--- a/src/menu.cpp
+++ b/src/menu.cpp
@@ -19,10 +19,10 @@ void init_conmsg() {
   if (g_conmsg)
     return;
   // fallback: dlopen libtier0.so from the engine directory
-  size_t slash = g_engine.path.find_last_of('/');
+  size_t slash = mod_engine().path.find_last_of('/');
   if (slash == std::string::npos)
     return;
-  std::string tier0 = g_engine.path.substr(0, slash + 1) + "libtier0.so";
+  std::string tier0 = mod_engine().path.substr(0, slash + 1) + "libtier0.so";
   void *h = dlopen(tier0.c_str(), RTLD_NOLOAD | RTLD_LAZY | RTLD_GLOBAL);
   if (!h)
     h = dlopen(tier0.c_str(), RTLD_LAZY | RTLD_GLOBAL);
@@ -640,6 +640,11 @@ static bool config_load() {
           g_esp_col_friendly[key[1] == 'r' ? 0 : key[1] == 'g' ? 1 : 2] = v;
         }
       }
+      // Scalar-only sections ([view], [movement], [chams_*]) intentionally
+      // leave cur == nullptr. A stray active=/bind= line in one of them must
+      // not be dereferenced (hand-edited or corrupt config).
+      if (!cur)
+        continue;
       if (strcmp(key, "active") == 0)
         cur->active = atoi(val) != 0;
       else if (strcmp(key, "bind") == 0)
@@ -867,6 +872,11 @@ bool feature_active(int feature) {
   return f->bind == 0 || key_held(f->bind);
 }
 
+bool feature_enabled(int feature) {
+  FeatureState *f = feature_state(feature);
+  return f && f->active;
+}
+
 bool feature_has_bind(int feature) {
   FeatureState *f = feature_state(feature);
   return f && f->bind != 0;
@@ -924,81 +934,39 @@ bool aimbot_fov_circle() { return g_aim_fov_circle; }
 struct ISurface;
 using HFont = unsigned long;
 
-ISurface *g_surface = nullptr;
 static HFont g_font = 0;
 static HFont g_font_small = 0;
 
-// VGUI_Surface030 vtable slots (confirmed via binary disassembly of vguimatsurface.so):
-//  8 = PushMakeCurrent(VPANEL, bool useInsets) — reads args at 0xc/0x10(%ebp)
-//  9 = PopMakeCurrent(VPANEL) — pops the make-current stack at this+0x264/0x270
-// 10 = DrawSetColor(int r, int g, int b, int a) — stores rgba at this+0x24
-// 12 = DrawFilledRect(int x0, int y0, int x1, int y1) — alpha check at this+0x27
-// 17 = DrawSetTextFont(HFont), 18 = DrawSetTextColor(int r,g,b,a)
-// 20 = DrawSetTextPos(int x, int y), 22 = DrawPrintText(wchar_t*, len, drawType)
-// 66 = CreateFont(), 67 = AddGlyphSetToFont(font, name, tall, weight,
-//      blur, scanlines, flags, rangeMin, rangeMax)
-static constexpr int SURF_GetEmbeddedPanel = 6;
-static constexpr int SURF_PushMakeCurrent = 8;
-static constexpr int SURF_PopMakeCurrent = 9;
-static constexpr int SURF_DrawSetColor = 10;
-static constexpr int SURF_DrawFilledRect = 12;
-static constexpr int SURF_DrawSetTextFont = 17;
-static constexpr int SURF_DrawSetTextColor = 18;
-static constexpr int SURF_DrawSetTextPos = 20;
-static constexpr int SURF_DrawPrintText = 22;
-static constexpr int SURF_CreateFont = 66;
-static constexpr int SURF_AddGlyphSetToFont = 67;
-
-static int surf_get_embedded_panel() {
-  using Fn = int (*)(void *);
-  return vfunc<Fn>(g_surface, SURF_GetEmbeddedPanel)(g_surface);
-}
+// ISurface access lives in overlay.cpp; these wrappers keep the call sites in
+// this file unchanged.
+static int surf_get_embedded_panel() { return overlay_embedded_panel(); }
 static void surf_push_make_current(int panel, bool use_insets) {
-  using Fn = void (*)(void *, int, bool);
-  vfunc<Fn>(g_surface, SURF_PushMakeCurrent)(g_surface, panel, use_insets);
+  overlay_push_make_current(panel, use_insets);
 }
 static void surf_pop_make_current(int panel) {
-  using Fn = void (*)(void *, int);
-  vfunc<Fn>(g_surface, SURF_PopMakeCurrent)(g_surface, panel);
+  overlay_pop_make_current(panel);
 }
 static void surf_draw_set_color(int r, int g, int b, int a) {
-  using Fn = void (*)(void *, int, int, int, int);
-  vfunc<Fn>(g_surface, SURF_DrawSetColor)(g_surface, r, g, b, a);
+  overlay_color(r, g, b, a);
 }
 static void surf_draw_filled_rect(int x0, int y0, int x1, int y1) {
-  using Fn = void (*)(void *, int, int, int, int);
-  vfunc<Fn>(g_surface, SURF_DrawFilledRect)(g_surface, x0, y0, x1, y1);
+  overlay_fill(x0, y0, x1, y1);
 }
 static void surf_draw_set_text_color(int r, int g, int b, int a) {
-  using Fn = void (*)(void *, int, int, int, int);
-  vfunc<Fn>(g_surface, SURF_DrawSetTextColor)(g_surface, r, g, b, a);
-}
-static void surf_draw_set_text_font(HFont f) {
-  using Fn = void (*)(void *, HFont);
-  vfunc<Fn>(g_surface, SURF_DrawSetTextFont)(g_surface, f);
-}
-static void surf_draw_set_text_pos(int x, int y) {
-  using Fn = void (*)(void *, int, int);
-  vfunc<Fn>(g_surface, SURF_DrawSetTextPos)(g_surface, x, y);
+  overlay_text_color(r, g, b, a);
 }
+static void surf_draw_set_text_font(HFont f) { overlay_text_font(f); }
+static void surf_draw_set_text_pos(int x, int y) { overlay_text_pos(x, y); }
 static void surf_draw_print_text(const wchar_t *text, int count) {
-  using Fn = void (*)(void *, const wchar_t *, int, int);
-  vfunc<Fn>(g_surface, SURF_DrawPrintText)(g_surface, text, count, 0); // 0 = FONT_DRAW_DEFAULT
-}
-static HFont surf_create_font() {
-  using Fn = HFont (*)(void *);
-  return vfunc<Fn>(g_surface, SURF_CreateFont)(g_surface);
+  overlay_print_text(text, count);
 }
+static HFont surf_create_font() { return overlay_create_font(); }
 static bool surf_set_font_glyph_set(HFont f, const char *name, int tall,
                                     int weight, int blur, int scanlines,
                                     int flags, int range_min = 0,
                                     int range_max = 0) {
-  using Fn = bool (*)(void *, HFont, const char *, int, int, int, int, int, int,
-                      int);
-  return vfunc<Fn>(g_surface, SURF_AddGlyphSetToFont)(g_surface, f, name, tall,
-                                                     weight, blur, scanlines,
-                                                     flags, range_min,
-                                                     range_max);
+  return overlay_add_glyph_set(f, name, tall, weight, blur, scanlines, flags,
+                               range_min, range_max);
 }
 
 // wide string conversion for DrawPrintText
@@ -1071,6 +1039,11 @@ void fullbright_update() {
 // (see hkdDrawPrintText hook in hl2h.cpp): we wrap our draws in
 // PushMakeCurrent/PopMakeCurrent so they are submitted with a clean clip.
 void outer_draw() {
+  // PaintTraverseEx runs for every VGUI panel and DrawPrintText for every text
+  // draw, so collapse them to one draw per engine frame (see overlay.h).
+  if (!overlay_should_draw())
+    return;
+
   poll_keyboard();
   fullbright_update();
   world_tint_update();
@@ -1083,10 +1056,16 @@ void outer_draw() {
   bool esp_on = feature_active(FEAT_ESP);
   bool items_on = feature_active(FEAT_ITEM_ESP);
   bool projs_on = feature_active(FEAT_PROJECTILES);
+  // The FOV circle belongs to the aim features, not to ESP, and it is a visual
+  // aid: use the enable toggle rather than the bind, otherwise it only appears
+  // while the aim key is held (default bind is mouse5).
+  bool aim_on = (feature_enabled(FEAT_AIMBOT) ||
+                 feature_enabled(FEAT_SILENTAIM)) &&
+                aimbot_fov_circle();
   bool toasts = gui_toasts_active();
   if (!g_surface ||
       (!gui_is_open() && !draw_test && !esp_on && !items_on && !projs_on &&
-       !toasts))
+       !aim_on && !toasts))
     return;
 
   // Level/menu -> game transitions can invalidate the VGUI font handle.
@@ -1147,6 +1126,8 @@ void outer_draw() {
   if (!panel)
     return;
   surf_push_make_current(panel, false);
+  if (aim_on && overlay_font)
+    esp_draw_fov_circle();
   if (esp_on && overlay_font)
     esp_draw();
   if (items_on && overlay_font)