RF455-101 RF 4.55: siege mode attacks always hit one target (no splash with area rockets): handleAttackSiege never calls aoeSplash

RF 4.55: siege mode attacks always hit one target (no splash with area rockets): handleAttackSiege never calls aoeSplash

Filed: draft, not filed.

Game: RF 4.55 (Dragonborn), server v0.4.0, Windows build (stock gameserver.exe, SHA-256 0b9c9099…). Client: the supported Taiwan build, RF_Online.bin SHA-256 46528aac…2bbc558 (2025-07-16), Language=Taiwan. Expected: a siege attack splashes like a normal attack with following ammo type.

Summary

• In siege mode (an Accretia launcher with a siege kit on), every siege attack (05/37) damages exactly one target.
• The same launcher with the same area rocket (m_nEffectGroup 6: Nuclear, Venom, Cyclone…) splashes onto the monsters next to the target in normal mode, but not once the kit is on.
• The siege path never reaches the splash code (read). handleAttackSiege doesn't look at the bullet's splash group, and resolveSiegeTarget always returns a list of one target.
• Flamethrower kits with cone fuel (group 5) go through the same handler, so they should be the same. That is inferred; I haven't tried it in game.

Server side (all read, v0.4.0)

• No splash call. (*Server).handleAttackSiege 0x140948740 calls siegePreconditions, isSiegeActing, isSieging, syncHeldEffects, siegeSnapshot, siegeKitFitsLiveWeapon, siegeClassCanLaunch, findLoadedBullet, siegeTargetInRange, siegeKitField, resolveSiegeTarget (0x140948f4c), protocol.AttackSiegeResult (0x140949228), broadcastScope, applyBulletEffect, consumeRound, consumeSiegeKit, finishMonsterKill and stunAfterAttack.
  • It never calls meleeSpreadShape, meleeSpreadSwing, aoeTargets or aoeSplash, so m_nEffectGroup is never read for a siege attack.
  • aoeSplash 0x14077ef20 has three callers: aoeTargets, meleeSpreadSwing (0x1408b6b7a, normal attacks) and unitAreaShot (0x14099ff02, MAU, RF455-075Released). None of them is on the siege path.
• One target, always. resolveSiegeTarget 0x14094a900 has two exits, monster and player.
  • Each allocates one 0x14-byte entry (runtime.newobject at 0x14094af34 / 0x14094b101).
  • Each returns it as a slice of length 1, capacity 1 (mov qword [rsp+0x110], 1 and [rsp+0x118], 1 at 0x14094af5c and 0x14094b129).
• The result could carry more. handleAttackSiege passes that slice to AttackSiegeResult 0x1406751c0 ([rsp+0x1e0], [rsp+0x1e8]). The packer handles any count (imul rdx, r9, 0xe at 0x1406751da, 14-byte entries), so 05/7A and the client are ready for several targets; the server only ever gives one.
• Bullet effects reach one target too: both applyBulletEffect calls pass a count of 1 (mov esi, 1 at 0x1409492a4 and 0x1409492ea).

Seen (read, server history.log, 2026-10-14): 18:11:11 1C/01 siege transform (kit index 1). Then five 05/37 siege attacks: one at 18:11:14 (one monster killed, Giant Baba) and four at 18:11:17–21 on one target (one monster killed, Infernal Drako). 18:11:22 1C/04 siege release. The log has no positions or per-target hits, so it only shows one kill per attack; the code above is what rules out the neighbours.

Suggested fix

• In handleAttackSiege, once resolveSiegeTarget hits a monster, do what meleeSpreadSwing does for normal attacks:
  • meleeSpreadShape(bullet);
  • for shape 5 or 6, collect neighbours with aoeSplash and apply the scaled damage with applyAoEDamage;
  • add them to the slice passed to AttackSiegeResult and to both applyBulletEffect calls.
• unitAreaShot already does this for MAU and could serve as the model.
• The radius should be retail: the normal attack's 42, or something from the kit.

Local workaround

None.