1 files changed, 25 insertions, 11 deletions

diff --git a/src/bones.cpp b/src/bones.cpp
index c777067..c4168a9 100644
--- a/src/bones.cpp
+++ b/src/bones.cpp
@@ -100,7 +100,10 @@ struct BoneEntry {
   Matrix3x4 mats[MAX_BONES];
 };
 
-static BoneEntry g_entries[64];
+// Sized for the 128-target scan with headroom: failed updates also allocate an
+// entry, and 64 slots evicted live NPCs mid-frame.
+constexpr int BONE_CACHE = 192;
+static BoneEntry g_entries[BONE_CACHE];
 static int g_next = 0;
 static int g_logged = 0;
 static bool g_renderable_warned = false;
@@ -112,14 +115,14 @@ static double bone_now() {
 }
 
 static BoneEntry *find_entry(int idx) {
-  for (int i = 0; i < 64; i++)
+  for (int i = 0; i < BONE_CACHE; i++)
     if (g_entries[i].ent && g_entries[i].idx == idx)
       return &g_entries[i];
   return nullptr;
 }
 
 static BoneEntry *alloc_entry(int idx, void *ent) {
-  BoneEntry *e = &g_entries[g_next++ % 64];
+  BoneEntry *e = &g_entries[g_next++ % BONE_CACHE];
   memset(e, 0, sizeof(*e));
   e->idx = idx;
   e->ent = ent;
@@ -321,13 +324,17 @@ bool bones_update(int idx, void *ent) {
 
   const void *expected =
       vfunc<GetModelIdxFn>(g_iface.modelinfo, 2)(g_iface.modelinfo, modelindex);
-  if (!expected)
+  if (!expected) {
+    e->valid = false;
     return false;
+  }
 
   // IClientUnknown::GetClientRenderable = primary vtable slot 6.
   void *r = vfunc<GetRenderableFn>(ent, 6)(ent);
-  if (!r)
+  if (!r) {
+    e->valid = false;
     return false;
+  }
   // Validate the interface before using SetupBones on it.
   const void *rmodel = vfunc<GetModelFn>(r, 9)(r);
   if (rmodel != expected) {
@@ -418,9 +425,14 @@ int bone_nearest_core_parent(int idx, int bone) {
     return -1;
   int p = bone_at(e->hdr, bone)->parent;
   if (!e->humanoid) {
-    while (p >= 0 && p < e->count && !e->bone_valid[p])
+    // Same cycle guard as the core path: a malformed model can self-parent a
+    // bone whose matrix is invalid, which would spin here forever.
+    for (int guard = 0; p >= 0 && p < e->count && guard < 64; guard++) {
+      if (e->bone_valid[p])
+        return p;
       p = bone_at(e->hdr, p)->parent;
-    return (p >= 0 && p < e->count) ? p : -1;
+    }
+    return -1;
   }
   for (int guard = 0; p >= 0 && p < e->count && guard < 64; guard++) {
     if (e->core[p] && e->bone_valid[p])
@@ -487,14 +499,16 @@ bool head_position(int idx, Vector &out) {
       if (boxes[i].bone < 0 || boxes[i].bone >= e->count)
         continue;
       const char *bn = bone_name_raw(e->hdr, boxes[i].bone);
-      if (bn && head_like_name(bn))
-        return hitbox_world(e, boxes[i], out);
+      // Keep looking: the first name match can be a bone whose matrix failed
+      // validation, and returning its false result aborted the whole search.
+      if (bn && head_like_name(bn) && hitbox_world(e, boxes[i], out))
+        return true;
     }
   }
   for (int i = 0; i < e->count; i++) {
     const char *bn = bone_name_raw(e->hdr, i);
-    if (bn && head_like_name(bn))
-      return bone_pos(idx, i, out);
+    if (bn && head_like_name(bn) && bone_pos(idx, i, out))
+      return true;
   }
   // Last resort for non-humanoid models with unnamed heads/hitboxes: the
   // first hitbox is the body (still a valid aim point).