Since I was doing somebody else a favour to fix another game, I did have another look at this series.
Since the sound playback is known to malfunction, it has got something to do with sound playback. So I checked how its sound driver was accessing files and it seemed to have quite good error-handling.
After walking for a while more, then suddenly:
Code:
dsidb S> cont
at=000a0000 v0-1=ff0c0fcc,ff0c0fc0 a0-3=00000003,000b0780,006f16c8,000f10f0
t0-7=00000003,00432880,00000001,000000b0, 00000000,00000000,00000000,00000000
s0-7=000a5450,0000001d,0003000d,00000003, 0000000d,00000000,00000000,00000000
t8=00000000 t9=00000000 k0=00033c4c k1=00000000 gp=000ad440 sp=006f16b8
fp=006f17e0 ra=0009c558 lo=00000400 hi=00000000 PC=0009c628 bada=00001003
$cr=0x1000001c [ CE1 Bus error (load/store) ]
$sr=0x00000404 [ IM0 IEp ]
<SE_Sequencer_Module+0x22f0>:
0x0009c620: 0x00041080 sll $v0,$a0,2
0x0009c624: 0x00431021 addu $v0,$v0,$v1
->0x0009c628: 0x8c420000 lw $v0,0($v0)
0x0009c62c: 0x2408ffff li $t0,-1
0x0009c630: 0x1048ffcb beq $v0,$t0,0x0009c560 # <SE_Sequencer_Module+0x2230>
0x0009c634| 0x00e23021 addu $a2,$a3,$v0
0x0009c638: 0x8cc20000 lw $v0,0($a2)
dsidb S>
This happened within the Sony MODSESQ module. Since the IREMSND driver is not suspending interrupts and is calling the functions of various Sony sound modules from multiple threads (at least the tick thread and the RPC service), the IREMSND driver might be broken here. By documentation, the Sony sound functions are not thread-safe, and should not be called from multiple threads.
But because all imported sound functions are affected, I don't know how to easily test this (the patch will probably be huge).
There was actually a very simple locking mechanism, which involves a flag that can only be set by the RPC thread.
Unfortunately, replacing it with a semaphore did not help prevent the complicated sound module set from crashing...
I'll leave this here in case somebody has some better idea on how to fix this. It is the only new lead I got though.