sub_140A9B9B0, loop at address 140A9BB30. The descent branch code is assembled from two commissions on the AABB entity (+0x68/+0x74). When the box is nan, both comparisons are unordered, the branch code is always 0, the exit condition is cmp r8d, 3 is unreachable, descent continues until the index goes out of bounds—reading at the broken address in mov ecx, [r13+rax*8].

Nan source: for a character bound to a turret compartment, the server's worldview becomes nan for 1–2 frames, while rotation remains orthonormal, and the box collapses to a point. The client sees the correct position within the same milliseconds (measured by a counter request, latency 33–49 ms). All landing inputs are operational: turret matrix, slot point, aiming angles are within limits, aiming transmissions are zero.

140a9bafc movss xmm0, [r8+68h] ← takes the AABB entity (+0x68 min, +0x74 max)

140a9bb02 movss [rbp+var_80], xmm0 ← copies the box to the stack

loc_140A9BB30: ← DESCEND CYCLE

140a9bb3b mov ecx, [r13+rax*8] ← node axis ← FALLS HERE

140a9bb40 movss xmm1, [r13+rax*8+4] ← partition plane

140a9bb49 movss xmm0, [rbp+rcx*4+var_74] ← max of the box along this axis

140a9bb4f comiss xmm0, xmm1

140a9bb52 setnb r8b ← bit 0

140a9bb56 comiss xmm1, [rbp+rcx*4+var_80] ← plane vs. min

140a9bb5b cmova eax, r15d ← bit 1

140a9bb62 cmp r8d, 3 ← 3 = both sides, exit

140a9bb73 jns back to loop