RF455-091 RF 4.55: right-clicking a buff to remove it does nothing (the client's 03/3F request has no handler)

Game: RF 4.55 (Dragonborn), server v0.3.1, Windows build (stock gameserver.exe). Client: the supported Taiwan build, RF_Online.bin SHA-256 46528aac…2bbc558 (2025-07-16), Language=Taiwan. Expected (wiki): Update 4.151 "Ataraxia's Arrival": a player can delete an active buff by right-clicking it in the active buff list on the right of the screen.

Summary

• The client sends the request (read, and seen live). Right-clicking a buff icon sends 03/3F with a 1-byte body, the icon's slot in the buff list.
• The server drops it (read). v0.3.1 has no handler for 03/3F. It logs it as an unknown opcode and sends nothing back, so the buff stays.
• The reply is named in the client: 03/40 result_del_buff_zocl. The client's handler for it does nothing, so the buff icon goes away only when the server sends the normal effect-removal message.

Client side (RF_Online.bin)

• Sender (read). 0x567970 (a CNetworkMgr method, ret 4) builds header type 3, sub 0x3F (mov byte [ebp-8], 3 / mov byte [ebp-7], 0x3f) and a 1-byte body taken from its argument, then calls CNetworkMgr::SendMsg 0x562be0 with length 1.
• Caller (read). 0x413df0, an avatar method (ecx = [0x1028ac0]), calls 0x411740(0) and then 0x567970(index). Two other avatar paths call it too (0x411df1, 0x48ffed).
• The right-click (read). The buff list's event handler 0x6c2490 (CGUISkillForceQueue, the secondary vtable at this-offset 136):
  • On event code 8 (cmp word [msg+4], 8 at 0x6c2c87) it loops over the icons of list 0. The count comes from 0x6c0e10, and each icon record is 0x5e0 bytes.
  • It finds the icon that raised the event (cmp [msg], icon at 0x6c2d48) and calls 0x413df0 with that icon's index (0x6c2e1c, 0x6c2e30, 0x6c2e44).
  • Event code 5 in the same handler builds the icon's tooltip. That event 8 is the right button is inferred from the live test below.
• Reply (read). The name tables (CNetworkMgr::LogReceiveNetMessage) call 03/40 result_del_buff_zocl, in the init_msg group next to the sender. Its handler 0x5679b0 reads the first byte of the body and does nothing else.
  • So the client removes the icon only on the normal 11/0B effect_remove_inform_zocl (inferred: no other path to removing the icon was found).

Server side (v0.3.1)

• No handler (read). Nothing registers 03/3F, and the protocol package has no del-buff type. The dispatcher hex-logs the request as an unknown opcode.
• Live (read, logs\history.log, 2026-10-12). A player right-clicked buff icons one after another:

  [21:22:09] RECV {"opcode": "03/3F", "body_len": 1, "body": "04"}
  [21:22:09] RECV {"opcode": "03/3F", "body_len": 1, "body": "00"}
  [21:22:09] RECV {"opcode": "03/3F", "body_len": 1, "body": "01"}
  [21:22:10] RECV {"opcode": "03/3F", "body_len": 1, "body": "03"}
  [21:22:10] RECV {"opcode": "03/3F", "body_len": 1, "body": "05"}
  [21:22:10] RECV {"opcode": "03/3F", "body_len": 1, "body": "02"}
  [21:22:11] RECV {"opcode": "03/3F", "body_len": 1, "body": "00"}

None of the buffs was removed. 03/3F appears in no earlier log.

• The removal machinery already exists (read). Affects end only through sfTempHelpRemove 0x1408269a0 (a remove-buffs skill), sweepExpiredAffects 0x140897780 (the timer) and applyContCure (the cure potion). All three end in (*Server).announceAffectsRemoved 0x1408979a0, which sends 07/6D and 11/0B (mov word [rax], 0xb11 at 0x140897b09) and calls notifyPartyEffect.

Suggested fix

Add a handler for 03/3F {u8 slot}:

1. Map slot to the affect that the client shows at that position in its buff list (list 0). That is the order in which the server announced the player's beneficial affects.
2. If it is a beneficial affect the player may drop, remove it.
3. Send the usual removal through announceAffectsRemoved (07/6D, 11/0B, party notice).
4. Reply 03/40 {u8}, for example the slot or a result code. The client reads one byte and ignores it.

Ignore any other slot. Whether retail let a player drop debuffs too is open; the client only sends for list 0.

Local workaround

None. A buff can't be removed before it runs out, except with a remove-buffs skill