RF455-089 RF 4.55 : race leader skills show no visual (the server never sends state-flag bit 43)

Related to [RF455-083New](https://oldschoolops.com/bugs/RF455-083) (the link effect never reaches allies), but a separate bug: this one is the caster's own visual.

Game: RF 4.55 (Dragonborn), server v0.3.1, Windows build (stock gameserver.exe, SHA-256 c10012f3…f699a). Client: the supported Taiwan build, RF_Online.bin SHA-256 46528aac…2bbc558 (2025-07-16), Language=Taiwan.

Summary

A council member (Consul, Strike/Defense/Support team) who casts a race leader skill (Conqueror's Protection or Roar, Bellato Union's Protection or Touch, Decem's Protection or Touch) gets the buff, its icon and its timer, but no visual. The client has a visual for these buffs: a race-coloured aura (wave, rings and race mark) that it plays while bit 43 of the character's 64-bit state flags is set. The server never sets bit 43.

The client doesn't pick this visual from the skill, unlike ordinary buffs, which is why the skill data looks empty. Leader skills are kept in their own buff list, which the skill-based buff visual never reads. Their only visual is the bit-43 aura.

How each part is known:

• Client code: read in RF_Online.bin (disassembly and a decompiler). Addresses below.
• Client data: read from Effect\MagicSptList.spt, Effect\EffectEntityList.spt, Effect\EffectEntity61.rpk and DataTable\SkillForce.edf (decrypted).
• Server: read in the stock v0.3.1 gameserver.exe with a Go symbol disassembler.
• Who should carry bit 43, and for how long

1. How the client shows a buff's visual

When a buff arrives (11/0A effect_add_inform, 0x5a1370 → 0x43de70), CCharacter vtable +0x104 (0x43dc60) puts it into one of three lists, by the skill record's class byte (+0xc, tested by 0x463260):

• class 5 (the chip-war race buffs) → a one-entry list at fx+0x54 (0x443090);
• class 4 (the leader skills) → a two-entry list at fx+0xf4, with times at +0x234 and a count at +0x244 (0x464090 → 0x443210);
• any other class → the main buff list (0x443890).

fx is the character's effect block at +0x3cc (0x415070).

Each frame, the effect updater 0x7dde30 takes the newest buff of the main list in each of its two slots and plays a loop effect whose id comes from the skill code: ((code & 0xffff) << 4) | 0x3F600000 for a skill (0x7de141–0x7de169). Precision AF00D → 0x3F6F00D0 → \character\loop\hit_UP_mag.spt. Nothing in the effect code reads the class-4 list, so a leader buff never gets this skill-based loop.

For the class-4 list, the updater plays one fixed aura per race (0x7de54f–0x7de68e). It runs only inside the branch for fx+0x44 == 2 (state bit 17, a council member; 0x7de465–0x7de471). In that branch:

• fx+0x24c set and no aura running: start 0x3F6F1F70 (Bellato), 0x3F6F1FB0 (Cora) or 0x3F6F1FF0 (Accretia), chosen by the character's race (0x7dc870), and keep it in fx+0x248;
• fx+0x24c clear with an aura running: play the matching …1 "dissipate" id and stop it.

fx+0x24c is written only by 0x44ef90, called from the state-flag handler 0x44dee0 at 0x44ea64–0x44ea96: (flags >> 43) & 1. The handler runs for 03/24, 04/09, 04/15 and 04/19. For bit 17 it sets fx+0x44 = 2 and jumps past the bit-42 test to the bit-43 test (0x44e7ba → 0x44e986 → 0x44ea64). So a council member's flag stays 2, and bit 43 alone decides the aura.

2. The assets exist

Effect\MagicSptList.spt, section "지원대장버프" (support-leader buff):

arc_buff_mag.spt is inside Effect\EffectEntity61.rpk, and EffectEntityList.spt entries 59400–59416 name its parts (\Effect\CSkill_1\M_Buff\src\arc\ring.spt, buff_wave.spt, scroll_plan.spt, the race marks).

3. The server never sets bit 43

• In all of gommo/games/rf455/ (715,652 disassembled lines), the only 1<<42 or 1<<43 constant is bts rcx, 0x2a (bit 42) in guildLifeStateWord (0x140848105).
• raceBossStateBits (0x140904900) gives 0x10000 (bit 16) for rank 0 and 0x20000 (bit 17) for ranks 1–8. That is correct, so a council member's fx+0x44 is 2.
• (*client).effectStateBitsLocked (0x14092b7c0) returns only 4 and 0x100. No active effect maps to bit 43.

The leader buff is applied (history.log: continuous effect applied {"selector": 0, "index": 57, "effect_bit": 57, "cont_type": 1, "dur_s": 1200}), but the state flags the client gets never have bit 43, so the aura never starts.

4. The cast itself has no burst in the data

The self-cast effect id is (code << 4) | variant (0x451e20, from CPlayer vtable +0x8c → 0x451400 → 0x451580), then & 0xF00FFFFF | 0x30000000 | weapon << 20, falling back to | 0x0FF00000 (0x7ef9d0). That gives 0x3FFF1FF0–0x3FFF1FF8 for Conqueror's Protection, and none of those is in MagicSptList.spt. Precision's 0x3FFF00D0–0x3FFF00D2 are. So the leader skills only play the cast motion; their visual is the aura above. This part is client data and isn't a server bug.

Expected

While a character has a leader buff active (skill rows AF1F7–AF202), the server sets bit 43 in its state flags and sends the flags (03/24 to the owner, 04/xx to the players around them) when the buff starts and ends. The client then plays the race aura on start and the dissipate effect on expiry.

• Read: the client draws it only for characters with bit 17 (council ranks 1–8).
• Inferred: whether the Race Leader (bit 16) or allies who get the link effect (RF455-083New) should also carry bit 43. The client wouldn't draw it for them unless they also have bit 17.

Suggested fix

Add bit 43 (1 << 43) to the character's state flags in the server code that builds them, whenever a continuous effect from a class-4 skill (AF1F7–AF202) is active. Re-send the flags in applyContEffectTo and when that effect expires.

How to reproduce in game

1. Make a character a council member: race boss 1 <name> (any rank 1–8).
2. Cast Conqueror's Protection (Accretia) or the race's equivalent.
3. The buff icon and timer appear. No aura plays on the character, for the caster or for anyone watching.

Where to look

• Server (v0.3.1): raceBossStateBits 0x140904900, guildLifeStateWord 0x1408480a0, (*client).effectStateBitsLocked 0x14092b7c0, (*client).recomputeStateLocked 0x140916280, applyContEffectTo 0x1408968e0.
• Client (for checking): state-flag handler 0x44dee0 (bit 43 at 0x44ea64), effect updater 0x7dde30 (aura at 0x7de54f), class-4 list 0x443210.