Guard the write side, and bound a subscript by the extent the DWARF states

[macabeus]

Item 3 of the analysis-surface audit: the setup that silently isn't what you asked for.

The write side had no API

The scripting engine exposed reads but no writes, so a script needing one dropped to rt.gba.bus.write* — which rounds a misaligned store down and discards a store to ROM, both silently. A misaligned store does not merely write the wrong place; it overwrites the value next door, changing the state being observed.

write8 / write16 / write32 / writeBytes(address, size, value) are new and carry the read guards: misaligned and undecoded addresses throw, and so does a write to read-only memory.

Subscripts, bounded by the DWARF

readVariable / writeVariable paths take subscripts, and every index is checked against the extent the DWARF states:

readVariable('gLayers[2].width'); // an element
readVariable('gGrid[1][3]'); // every dimension
readVariable('gLayers[4].width');
// throws: "gLayers" has 4 element(s) in dimension 0, so index 4 is past the end

Element 4 of a 4-element array is a real address — whatever the linker placed next — so without the bound it reads as plausible data and writes as corruption of something never named. On a real decomp ELF, a 4×28-byte layer array's element 4 begins at exactly the address of the pointer that array's owner dereferences.

Scope, stated plainly: the bound applies only where the index is expressed. An address computed past the end lands wholly inside its neighbour, which from an address alone is indistinguishable from a deliberate write there. The guard cannot recover the intent, and the tests say so rather than implying otherwise.

Extents, and where they come from

symbolExtent(name) returns { size, source } — 'st_size' or 'dwarf' — or null when nothing states it. Which one answers depends on how the symbol was declared: a global defined in C is STT_OBJECT and the assembler sizes it; one placed by the linker (gFoo = 0x03000000;) is SHN_ABS/NOTYPE with no size, so its extent can only come from the type of a C extern declaration. Measured:

project	data syms	st_size	dwarf	none
agbcc-min	20	19	0	1
devkitarm-min	19	18	0	1
mips-min	13	12	0	1
ppc-min	13	12	0	1
a real decomp	489	0	453	36

Decomps hit the second case constantly, because a fixed RAM address cannot be a C definition — but that follows from the declaration, not from the genre.

A write starting inside a known extent and running past its end is refused, naming what it would have hit:

writeBytes: writing 4 bytes at 0x300349e runs past the end of "gLayers"
            (112 bytes, from dwarf), into "gLevelStatePtr".

addressToSymbol now resolves linker-placed globals too. Excluding NOTYPE/SHN_ABS left it unable to name a single data global in a decomp ELF — null for all 489.

Verification

Everything new is tested against the real project ELFs in test-projects, across all four toolchains and both byte orders, using fixtures each project already compiles (g_rom_table, Probe.name, and the ldscript-placed gAbsGlobal on the two ARM projects). Malformed paths go through resolveVariable on a real ELF rather than testing the parser directly.

Both new guards were ablated: disabling the bounds check fails 8 tests (2 × 4 projects); excluding NOTYPE symbols from the address index fails the linker-placed-global tests on both ARM projects. The overrun guard's ablation failed to fail on the first attempt — it had no coverage at all until a test was written for it.

253 tests in debug-info (was 223), 67 in gba-emulator (was 60). check-types, lint, format:check, build and test all exit 0.

Not included

The reported press() / pressSequence() disagreement does not reproduce. Measured per button on a real game, both register identically in the game's own edge-detected input global, in both measurement styles — 0 disagreements across all 10 buttons. Nothing was changed for it.