2 files changed, 33 insertions, 4 deletions

diff --git a/FIX_PLAN.md b/FIX_PLAN.md
index e4e149e..2c84122 100644
--- a/FIX_PLAN.md
+++ b/FIX_PLAN.md
@@ -778,6 +778,16 @@ Caches are cleared by `esp_reset_session()` on map change/respawn. The ESP scan
 itself is unchanged: projection only happens for the handful of entities that
 survive the class/life/friendly filters, not for every entity.
 
+### Batch 5 — chams shadow passes
+
+`IVModelRender::ForcedMaterialOverride` (slot 1) is now hooked as well, purely
+to track the engine's current forced material. `DrawModelExecute` skips chams
+when an override is already active, so shadow-depth and reflection passes draw
+with their own material instead of being substituted with chams and then having
+the engine's override cleared for every model drawn afterwards. This is the fix
+for the corruption described in P2-6; it needs an in-game check because it
+relies on the engine always going through the vtable for that call.
+
 ### Known remaining work
 
 Deliberately deferred, with reasons:
@@ -787,9 +797,6 @@ Deliberately deferred, with reasons:
   slot plus a way to get the networkable from a raw entity pointer, or a
   cached pointer→index map. Not worth the risk for a hot path that fires a few
   times per second.
-- **P2-6 shadow-depth `ForcedMaterialOverride`** — requires reading the
-  engine's current override, which VEngineModel016 does not expose. Needs an
-  alternative detection (draw flags in `DrawModelState_t`) validated in-game.
 - **P3-2 declarative settings table** — large rewrite of `config_save`,
   `config_load`, `config_reset_defaults` and `build_cards`. It can regress
   config persistence, so it should follow an in-game pass.
diff --git a/src/studio.cpp b/src/studio.cpp
index 69a2e07..8b0a710 100644
--- a/src/studio.cpp
+++ b/src/studio.cpp
@@ -212,6 +212,20 @@ ModelExecFn g_orig_model_exec = nullptr;
 ForceOverrideFn g_force_override = nullptr;
 void *g_style_mats[8] = {};
 
+// The engine forces a material for special passes (shadow depth, reflections)
+// and clears it again. Without tracking that, the chams pass could not tell
+// "no override" from "engine override in progress": it hijacked the shadow pass
+// with chams materials and then cleared the engine's override for every model
+// drawn afterwards.
+static ForceOverrideFn g_real_force_override = nullptr;
+static void *g_current_override = nullptr;
+
+static void hkdForceOverride(void *self, void *mat, int type) {
+  g_current_override = mat;
+  if (g_real_force_override)
+    g_real_force_override(self, mat, type);
+}
+
 const char *chams_material_name(int idx) {
   switch (idx) {
   case 1: return "debug/debugwireframe";
@@ -330,6 +344,12 @@ void hkdModelExecute(void *self, const void *state, const void *info,
     g_orig_model_exec(self, state, info, bone);
     return;
   }
+  // Shadow-depth/reflection passes arrive with a material already forced. Let
+  // them draw normally instead of substituting chams.
+  if (g_current_override) {
+    g_orig_model_exec(self, state, info, bone);
+    return;
+  }
   if (feature_active(FEAT_CHAMS) && info && g_force_override) {
     // ModelRenderInfo_t::entity_index is at 0x30 on 32-bit.
     int idx = *(const int *)((const char *)info + 0x30);
@@ -568,7 +588,8 @@ void chams_init() {
     logf("chams: model render has no vtable");
     return;
   }
-  g_force_override = (ForceOverrideFn)vt[1];
+  g_real_force_override = (ForceOverrideFn)vt[1];
+  g_force_override = g_real_force_override;
   g_orig_model_exec = (ModelExecFn)vt[19];
   if (!mod_engine().contains((uintptr_t)g_force_override) ||
       !mod_engine().contains((uintptr_t)g_orig_model_exec)) {
@@ -581,6 +602,7 @@ void chams_init() {
     logf("chams: vtable clone failed");
     return;
   }
+  nvt[1] = (void *)&hkdForceOverride; // track engine-forced passes
   nvt[19] = (void *)&hkdModelExecute;
   g_modelrender = g_iface.modelrender;
   *(void ***)g_modelrender = nvt;