[Niruri]

Description

Describe the changes

Load Scp049SenseAbility.Cooldown before calling AbilityCooldown.Trigger(double) in the allowed branch emitted by FinishingSense3.

What is the current behavior?

When FinishingSense is patched, ServerProcessCmd can enter this branch with HasTarget == true. The generated IL currently pushes this (a Scp049SenseAbility) and ev.CooldownTime, then invokes AbilityCooldown.Trigger(double). The receiver is not an AbilityCooldown, so this call is incorrectly typed.

This was investigated after intermittent SCP-049 sense-related disconnects on an EXILED 9.15.2 server. The relevant production stack was:

Disconnecting connId=<redacted> to prevent exploits from an Exception in MessageHandler:
NullReferenceException: Object reference not set to an instance of an object
  Mirror.NetworkWriter.WriteBlittable[T]
  Mirror.NetworkWriter.WriteByte
  RecyclablePlayerIdReaderWriter.WriteRecyclablePlayerId
  Utils.Networking.ReferenceHubReaderWriter.WriteReferenceHub
  PlayerRoles.PlayableScps.Scp049.Scp049SenseAbility.ServerWriteRpc
  ...Scp049SenseAbility.ServerProcessCmd_Patch0
  PlayerRoles.Subroutines.SubroutineMessage.Apply

The server uses dynamic patching, and the affected game mode subscribes to Scp049.FinishingSense. The same missing field load exists in upstream dev. The invalid receiver was independently confirmed by invoking the framework's transpiler without loading the server's gameplay plugin. A clean client/server reproduction and the precise Mono dispatch behavior behind the observed stack have not yet been verified.

What is the new behavior?

The generated call now loads this.Cooldown as its receiver:

ldarg.0                   // allowed branch target
ldfld Scp049SenseAbility::Cooldown
ldloc ev
callvirt FinishingSenseEventArgs::get_CooldownTime()
callvirt AbilityCooldown::Trigger(double)

The event-provided duration is retained, and the allowed branch still enters before the receiver load.

Does this PR introduce a breaking change?

No. This is a one-instruction correction; no public API changes.

Other information

Validation:

• Release build of Exiled.Events.csproj and its project dependencies using the official SL-References/Dev.zip: passed with 0 warnings and 0 errors.
• Invoked the actual compiled FinishingSense3.Transpiler with a minimal IL fixture containing the real Cooldown and SubroutineBase.ServerSendRpc(bool) anchors.
• The same check failed on the unmodified dev assembly and passed after this change. It checks that the single emitted Trigger(double) call loads an assignable receiver from this.Cooldown, retains ev.CooldownTime, and keeps the allowed branch label before the receiver load.
• git diff --check: passed.
• This is an emitted-IL check, not a live Unity/Mono server test. Live verification should cover an active target with IsAllowed = true, a subscriber changing CooldownTime, cancellation, and rapid/repeated sense input.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentations

Submission checklist

• I have checked the project can be compiled
• I have tested my changes and it worked as expected (emitted-IL regression check described above)

Patches (if there are any changes related to Harmony patches)

• I have checked no IL patching errors in the console

Other

• Still requires more testing (live Unity/Mono server verification)

[louis1706]

that look like a big skill issue nice spot

[Someone-193]

Really niche bug. Sorry you had to deal with it