Add worn-slot sanity check to catch stale equipment-slot pointers.

A were-creature's lycanthropy bite can panic the game with
"extract_nobj: object lost": set_ulycn() calls retouch_equipment()
to force-drop gear the new were-form can no longer touch, and the
forced drop reaches freeinv() with a wielded object that is no longer
in invent. The wielded slot (uwep) was left pointing at an object
that had already departed the invent chain on an earlier turn, so
the drop fails its inventory lookup and panics.

The per-turn obj_sanity_check() never caught this because
sanity_check_worn() only validates the invent->slot direction: for
each worn object found in invent, it confirms the matching ufoo
points back to it. A slot pointing the other way, at an object that
has left invent, is never visited and rides undetected until the
downstream freeinv().

Add worn_slot_sanity(), the missing slot->invent check, to report
the stale slot at (or one turn after) the producing action with turn
context, instead of crashing later.

* mkobj.c:
  - new worn_slot_sanity() walks the 14 invent-resident worn-slot
    globals (uwep..ublindf; ball/chain and the steed saddle are
    excluded) and reports any slot whose object is absent from the
    invent chain. It compares pointers only, never dereferencing the
    possibly-dangling suspect, and dedups per slot so a persistent
    stale slot reports once rather than every turn (mirrors
    dmonsfree's orphan-warning pattern). Called from
    obj_sanity_check() alongside the existing list checks.

* artifact.c:
  - call worn_slot_sanity() at the top of retouch_equipment(), under
    the same sanity/fuzzer gate, so a slot corrupted earlier in the
    same turn is reported immediately before the forced drop turns it
    into a panic.

* extern.h:
  - declare worn_slot_sanity().

Author: k21971

doc/evilhack-changelog.md

@@ -5502,4 +5502,5 @@ The following changes to date are:
 - Fix: off-hand artifact extrinsics lost after a returning thrown weapon
 - Grant skeletal dragons immunity to their own breath element
 - Fix: covetous monster freezes when hero stands at a map edge
+- Add worn-slot sanity check to catch stale equipment-slot pointers
 

include/extern.h

@@ -1546,6 +1546,7 @@ E long FDECL(peek_at_iced_corpse_age, (struct obj *));
 E long FDECL(blood_freshness, (struct obj *));
 E int FDECL(hornoplenty, (struct obj *, BOOLEAN_P, struct obj *));
 E void NDECL(obj_sanity_check);
+E void FDECL(worn_slot_sanity, (const char *));
 E struct obj *FDECL(obj_nexto, (struct obj *));
 E struct obj *FDECL(obj_nexto_xy, (struct obj *, int, int, BOOLEAN_P));
 E struct obj *FDECL(obj_absorb, (struct obj **, struct obj **));

src/artifact.c

@@ -4735,6 +4735,11 @@ int dropflag; /* 0==don't drop, 1==drop all, 2==drop weapon */
     if (!nesting++)
         clear_bypasses(); /* init upon initial entry */
 
+    /* catch a worn slot already pointing outside invent on entry, before
+       a forced drop turns it into a freeinv() "object lost" panic */
+    if (iflags.sanity_check || iflags.debug_fuzzer)
+        worn_slot_sanity("retouch_equipment entry");
+
     dropit = (dropflag > 0); /* drop all or drop weapon */
     /* check secondary weapon first, before possibly unwielding primary */
     if (u.twoweap) {

src/mkobj.c

@@ -2885,6 +2885,7 @@ obj_sanity_check()
             }
 
     objlist_sanity(invent, OBJ_INVENT, "invent sanity");
+    worn_slot_sanity("worn-slot sanity");
     objlist_sanity(migrating_objs, OBJ_MIGRATING, "migrating sanity");
     objlist_sanity(mchest, OBJ_MCHEST, "magic chest sanity");
     objlist_sanity(level.buriedobjlist, OBJ_BURIED, "buried sanity");
@@ -2914,6 +2915,59 @@ obj_sanity_check()
                       (struct monst *) 0);
 }
 
+/* verify every set worn-equipment slot still points into invent.
+   sanity_check_worn() only checks the invent->slot direction (for each
+   worn object in invent, the matching ufoo points back to it); a slot
+   left pointing at an object that has departed invent is invisible to
+   that check and otherwise surfaces only later, as a freeinv() ->
+   extract_nobj("object lost") panic. ball/chain are excluded (a chained
+   ball can legitimately rest on the floor) and the steed saddle is not a
+   hero slot. the suspect pointer is never dereferenced -- it may be
+   dangling -- so detection is pure pointer comparison and the report
+   prints only its address, the slot name, and the turn */
+void
+worn_slot_sanity(mesg)
+const char *mesg;
+{
+    static const struct {
+        struct obj **slotp;
+        const char *nm;
+    } slots[] = {
+        { &uwep, "uwep" },     { &uswapwep, "uswapwep" },
+        { &uquiver, "uquiver" },
+        { &uarm, "uarm" },     { &uarmc, "uarmc" },   { &uarmh, "uarmh" },
+        { &uarms, "uarms" },   { &uarmg, "uarmg" },   { &uarmf, "uarmf" },
+        { &uarmu, "uarmu" },   { &uleft, "uleft" },   { &uright, "uright" },
+        { &uamul, "uamul" },   { &ublindf, "ublindf" }
+    };
+    /* per-slot dedup so a persistent stale slot reports once, not every
+       turn (mirrors dmonsfree's orphan_warned_id) */
+    static struct obj *warned[SIZE(slots)];
+    struct obj *o, *otmp;
+    int i;
+
+    for (i = 0; i < (int) SIZE(slots); i++) {
+        o = *slots[i].slotp;
+        if (!o) {
+            warned[i] = 0;
+            continue;
+        }
+        for (otmp = invent; otmp; otmp = otmp->nobj)
+            if (otmp == o)
+                break;
+        if (otmp) {
+            warned[i] = 0; /* slot is healthy */
+            continue;
+        }
+        /* slot is set but its object is no longer in invent */
+        if (o != warned[i]) {
+            warned[i] = o;
+            impossible("%s: worn slot %s -> %s not in invent (turn %ld)",
+                       mesg, slots[i].nm, fmt_ptr((genericptr_t) o), moves);
+        }
+    }
+}
+
 /* sanity check for objects on specified list (fobj, &c) */
 STATIC_OVL void
 objlist_sanity(objlist, wheretype, mesg)