The function declares realId and then indexes with it thirteen times -
the load-status tables, AudioLoad_SearchCaches, the table entry it reads
size and address from, every cache allocation, and the status write at the
end - but nothing assigns it. It has read an uninitialised local since
"Custom Sequences" (#2066) dropped the assignment in 2022.

Restoring the line puts back the value the rest of the function expects.
For SEQUENCE_TABLE and FONT_TABLE, AudioLoad_GetRealTableIndex returns the
id unchanged, so this is only a correctness fix in practice: the paths that
reach this function today go through the sequence script's async load
command, which is rare enough that the garbage index has not been tied to
any report.

#6917 guarded the three seqLoadStatus accessors against sequenceMapSize
because the array was allocated at exactly that size, so a custom sequence
id past it read and wrote off the end.

#6932 sized the array to sequenceMapSize + 0xF to match sequenceMap, which
covers the whole id space rather than rejecting the ids outside it, and also
protects the writers those guards never saw: AudioHeap_AllocCached and
AudioHeap_PopCache index seqLoadStatus directly.

The guards are now not just redundant but bounded wrong - they treat the ids
in [sequenceMapSize, sequenceMapSize + 0xF) as absent from a table that now
has room for them. Nothing breaks today because every entry starts at 5, so
AudioLoad_IsSeqLoadComplete answers true regardless and
AudioLoad_SetSeqLoadStatus already declines to overwrite a 5 - but once the
heap cache path moves such an entry off 5, the guard blocks an update that
should happen.

Reverting them restores the three functions to their decompiled form. The
sizing from #6932 and the id check in AudioLoad_SyncInitSeqPlayerInternal
remain the actual protection.

Root cause of three identical field crashes (audio thread, opcode fetch
through a pointer with its low 32 bits overwritten, seconds after scene
transitions): AudioHeap_AllocPermanent writes permanentCache[index] with
index = permanentPool.count and no bound against the 32-entry array. In
SoH every soundfont sync-load is forced permanent, and custom sequences
whose SEQ.xml says CachePolicy="Temporary" ALSO allocate permanently
(the factory stores the LUS enum where CACHE_TEMPORARY == 0, while
AudioLoad_SyncLoad's switch reads 0 with the ROM convention
'permanent'). A pack with ~60 streamed customs plus vanilla fonts pushes
count past 32 within a session, after which each allocation sprays a
{ptr, size, tableType/id} triplet at 24-byte stride through
gAudioContext - entry[135]'s ptr field lands exactly on
seqPlayers[0].scriptState.pc and entry[156] on seqPlayers[1]'s (both
verified against the crash-dump registers).

- permanentCache raised 32 -> 512 (12 KB) and AllocPermanent refuses
  allocations past the array instead of corrupting memory.
- Same unbounded-index disease fixed in the three sibling writers:
  AllocCached's persistent path (16-entry array; CACHE_EITHER degrades
  to temporary, hard persistent requests fail cleanly),
  AllocPersistentSampleCacheEntry, AllocTemporarySampleCacheEntry.
- seqLoadStatus malloc sized for the full id space (sequenceMapSize +
  0xF) matching sequenceMap; custom ids above sequenceMapSize previously
  overflowed the allocation by up to 15 bytes.

Upstream SoH bugs, not branch-introduced - this branch's many-track
packs merely made the overflow reachable in normal play. Standalone
upstreamable fix.

Custom SAF sequence IDs can exceed sequenceMapSize, causing out-of-bounds
reads/writes on the seqLoadStatus byte array (sized exactly sequenceMapSize).

This is the direct cause of intermittent battle music failure with BGM packs
(issue #5706): on the second encounter, AudioLoad_SyncLoadSeq reads a garbage
value from heap memory past seqLoadStatus[] and may find 1 (loading in
progress), causing it to return NULL early — the sequence player is never
initialized and no battle music plays.

Symmetric fix to the fontLoadStatus guards in PR #6916:
- AudioLoad_IsSeqLoadComplete: return true for OOB seqIds (custom SAF
  sequences are resource-manager-backed, not in the async-load status table)
- AudioLoad_SetSeqLoadStatus: skip update for seqId >= sequenceMapSize
- AudioLoad_SyncLoadSeq: skip the in-progress check for OOB seqIds

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

AudioLoad_IsFontLoadComplete had a stub `return true` that bypassed all
load-status checks, masking an out-of-bounds write: for large SAF packs
(many custom sequences) SetFontLoadStatus indexed fontLoadStatus[] with
fontId values larger than the fontMapSize-sized array, causing heap
corruption and semi-random crashes.

Remove the stub. Add a (size_t)fontId >= fontMapSize guard in both the
check and the setter: out-of-range IDs (custom SAF sequences that carry
no associated soundfont) are treated as "loaded" in the check and
silently skipped in the write, matching prior observable behavior while
eliminating the OOB access.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The custom-sequence registration loop printed each assigned seqNum to
stdout via a bare printf, spamming the console with context-free numbers
on every launch. Convert it to LUSLOG_DEBUG and include the sequence name
so it is hidden by default yet useful for diagnosing music-pack loading.

The resolved replacement id (which can exceed 255) rode a single
per-player seqToPlay slot, written at enqueue but consumed
asynchronously on the audio thread; back-to-back starts and
priority-queue promotions clobbered it. sSeqFlags[0x6F] was also indexed
by raw id, reading out of bounds past the authentic range.

- func_800F9280 resolves the replacement and packs the full 16-bit id
  into the 0x82/0x85 play command; the handler reads opArgs & 0xFFFF.
  Audio_QueueSeqCmd no longer pre-writes the shared slot.
- SyncInitSeqPlayerInternal uses the command-carried id and bounds-checks
  it against the calloc'd sequence map (+0xF headroom for reserved-range
  skips).
- Route sSeqFlags reads through a bounded Audio_GetSeqFlags helper.
- Warn and skip gracefully past the 16-bit id limit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Fix TimeSplit crash on empty name

Initialize OptionValue::mVal to fix undefined behavior

Fix undefined behavior in GraveHoleJumps surface type copy.
The memcpy was reading 33 SurfaceTypes regardless of the actual count,
causing a buffer overread since NTSC 1.0 only has 31 surface types and
later versions have 32. Now uses the actual surfaceTypesCount from the
collision header.

Fix undefined behavior in framebuffer OTR signature check.
Use calloc instead of malloc for framebuffer allocation to zero-initialize
the memory. This fixes Valgrind warnings about reading uninitialized values
when ResourceMgr_OTRSigCheck reads from framebuffer pointers to check for
the "__OTR__" signature.

Fix undefined behavior in fontLoadStatus initialization.
Use calloc instead of malloc when allocating fontLoadStatus array
to ensure zero-initialization. This fixes Valgrind warnings about
conditional jumps depending on uninitialized values in
AudioLoad_SetFontLoadStatus.

Add destructor to MessageViewer to free allocated buffers

Free individual strings from ResourceMgr_ListFiles before freeing the array in audio_load.c