I was able to glitch the speeder cutscene (some hacks required, but real strats may exist) to see if it was possible to fly to K4 on a speeder. Didn't end up working, but I'll share it here anyways.

This was very tedious to set up:

• Make a new game, and open the speeder gate, but do not trigger the cutscene inside. If we do not open the gate early, it will stay closed forever.
• Hit a major progression point. Not sure what qualifies. I used hacks to get to DIM #2 (I did NOT need to collect the SpellStone)
• Return, and the speeder will be rideable! No cutscene event triggered.

The game seems to void out at a certain point with a speeder though. At first, I thought it was because we didn't get Tricky, but then I tried getting Tricky in DIM #2 with hacks (Remember, we rescue him again! So you can actually still get him if you skip him in Ice Mountain).

To be 100% sure, I killed the 3x SharpClaw, and solved all the puzzles backwards. Then I went ALL the way back to Ice Mountain, and the speeder still soft-locks.

(Skip to 0:30, bad editing on my part)

==========

I have a file that I can test out the Super Quake spell swap on. I just need to get the ability and try it out.

Edit: I tried it, because you have to start from aim-mode with FireBlast, you cannot gain any forward speed to move. At least I couldn't.

==========

Unfortunately, we can't unlock the Volcano Point doors with SS3 unless we did it with SS1 earlier. This means skipping SS1 is still not viable or we will soft-lock when we try to return to get Freeze Blast.

The only way we can skip SS1, SS3, and Freeze Blast is to:

• Find K4 early so that we don't need SS3
• Figure out how to get through K5 without Freeze Blast
• Figure out how to get access to Cape Claw cannon without Freeze Blast

My Cape Claw OOB discovery eliminates the Fire Gem Freeze Blast, so there are only 2 left. If we find K4 early and eliminate all Freeze Blasts from the route, then we can finally skip half of DIM and skip Walled City #1 (assuming the K4 early solution doesn't use SGQ)

I attempted to open the SnowHorn sewer gate and trigger the "return to Thorntail" cutscene without getting Tricky. This route failed, but I learned a few cool things.

1. We can recover from cutscene void outs in ThornTail Hallow via Moon Mountain Pass (sorta)
2. I found a very useful method for controlling height. If you can clip the camera into a different area or OOB, Fox will start falling. Keep zooming! Eventually Fox will stop moving when he reaches a valid Y position.
3. Fox can collide with wind during a cutscene void (this does not restore his collision with ground)
4. Fox can fall to his death during a cutscene void

Route:

• Blow up WarpStone door
• Perform a low swim
• Move the camera into SnowHorn wastes. This is the trigger for the Queen Earthwalker GrubTub dialogue, not sure if it's also the trigger for the "Tricky running to his mother" dialogue.
• Save/Quit, otherwise MM Pass won't load.
• Void out and navigate to MM Pass, and clip into the wind. This requires optimal height/positioning.
• Collect the Fuel Cell to recover
• Void out anyways when coming back, gg

Pay very close attention at ~1:34 for the height control technique (ignore the swim bug at 0:23, this was from a hack, as well as any camera jumps from loading save states):

Also "void out" is a bit overloaded. We now have cutscene voids, OOB voids, missed loading trigger voids, fall to death voids. Technically these are all quite different.

EDIT: Also I forgot, if you hit that fuel cell from far back, you can clip Fox into the wall! It's just useless because it doesn't connect to MM pass, so we can't do OOB navigation :( Otherwise this could be a way to skip the door.

EDIT 2: Also tried directly going to Queen EarthWalker and hitting the GrubTub dialogue trigger and voiding out. Same result.

EDIT 3: It is not possible to use the wind to get back OOB on the other side of the MM Pass link. Once you exit the wind, Fox changes to a falling animation, and you can no longer zoom.

EDIT 4: It's also possible to enter the portal for the Fire Blast upgrade room, but only with hacks. Fox still collides with automatic warps it seems. Still voids out when you leave though.

The concept is viable (in theory), just not from the 3x SharpClaw cutscene. I voided out on the Garunde cutscene and used hacks to get to the Fuel Cell, and was able to recover the game's state.

This means if we can void out at the speeder race (via a memory leak maybe), it could be possible to fall into the K4 shrine, assuming we can hit the loading triggers on the way down.

EDIT: What I wrote below is not valid. It is possible! See BvqRzxi5's post below! ~~A few other problems, I did some additional testing, and Tricky stays outside the cage when leaving the K4 shrine anyways. We'd have to find a way to die in that small room without Tricky. Or ESW out without dying (which probably isn't possible). We can't re-enter the warp either.

Rough roads ahead for K4 early.~~

Voidouts can be canceled with a cutscene overlap. Here I attempt DIME without Tricky:

Unfortunately hitting the Frost Weed Tree = crash (still crashes after a Save/Quit, for those who are curious)

From Discord: My hope was that it would be possible to skip Ice Mountain by doing a DIME setup, then running back and opening the gate, then talking to Queen EarthWalker to regain Tricky (without ever getting him the first time) Unfortunately, there are no items to pick up by the gate coming back into ThornTail to recover from the void-out.

At least we know it's possible to recover from even more cutscene void-outs.

I found another way to do this in DIM with a very basic ESW setup.

• Progress to DIM
• RESW to overwrite another file, then continue DIM (using a gate load bypass to skip that mammoth)
• Progress until Tricky gets kidnaped / imprisoned
• ESW back to the start of DIM
• Talking to that mammoth voids out

I have no idea if there is any sequence of events that could cause us to void walk and skip the 2nd half of DIM. We need Tricky for the final boss sadly.

===================

During some testing, I also found that it is not possible to ESW to leave the first part of Ice Mountain. It only works if Tricky is being chased by the SharpClaw.

I tried this route:

• <Setup ESW file at DIM>
• <New file, progress until the SharpClaw chase him around the ice>
• Die and ESW to DIM
• Fly back to Dinosaur planet
• Perform a DIME setup, but stop early to open the gate
• Lose Tricky
• Perform another DIME setup. Will have to swim against the currents, but its OK to clip inbounds once we get passed them
• SnowHorn wastes will be unloaded. Just get close and save/quit to reload it
• Hike up the mountain -- The Ice Block has spawned, even though we didn't unlock it!

Killing the SharpClaws still voids out. Ice block does not seem to be useful, you still fall if you try to push it before the cutscene void-out.

Some cutscenes, when done at the wrong time, cause Fox to void out. For example, doing Cape Claw before obtaining Tricky = void out and a soft-lock. I noticed however that Fox doesn't necessarily fall forever. Using zooms, it is possible to lock Fox's Y position in place.

The game is in a glitched state where it is impossible to save, use abilities, or collide with terrain/water. But it is possible to recover from this state!

Here is an example of this glitch in Cape Claw before rescuing Tricky:

Here is how I was able to somewhat recover from this state by collecting a Fuel Cell:

The exciting part is that there are 2 Fuel Cells in the K4 cage, and we can void out on the cutscene for killing the 3x SharpClaw nearby!

Here is my K4 attempt: I can't seem to keep enough height to get into the cage. I tried using hacks to get the Fuel cell, but it didn't work the same way it did in Cape Claw:

Maybe we need a different cutscene to void out on, or a different setup?

=========================

How I was able to recover:

• Finding a Fuel Cell in the Cape Claw Well.
• Activating Slippy's cold water dialog (used hacks). This also triggered the Tricky dialog that was supposed to play after the 3x SharpClaw die. After the cutscenes played, I regained control.

=========================

How to lock Fox's Y position using zooms after a cutscene void out:

• If Fox is above ground, the zoom will do nothing
• If Fox is below the terrain, the zoom might freeze Fox's Y position. I haven't figured this part out entirely. The lower Fox is, the better the odds.
• You must also be moving for it to work. Zooming while movement is neutral does not seem to freeze the position.
• Moving to new parts of the map might make Fox fall again. You will need to zoom again.

=========================

KNOWN CUTSCENE VOID-OUTS

• Cape Claw Early before getting Tricky.
• Ice mountain (From a DIM setup) before getting Tricky.
• Attempt DIME without Tricky. Talking to Garunde Te = void out. This can be canceled with a cutscene overlap of collecting a mana crystal if you can get a SharpClaw to load, but then hitting the FrostWeed tree will crash the game.
• Perform a DIME setup, but backtrack to Thorntail Hallow. Open the gate that normally gets opened after finding Tricky.
• Do a DIME setup with a low swim -- swim directly for SnowHorn wastes, no need to hit sewer loading triggers. Move the camera into SnowHorn wastes. Swim back to ThornTail, and the Queen will be in the GrubTub dialog introduction state causing a void out. (No need to activate the gate cutscene first for this to work)
• LightFoot Village -- I forgot the setup for this.
• ESW cutscene void outs aren't well documented.

=========================

K4 ATTEMPTS I'VE TRIED:

• Normal navigation with void walking. I can't ever keep enough height.
• Talking to mammoth before voidout
• Item discovery prompts before voidout
• Moving the iceblock (required ESW to setup) before voidout
• Lifting boulders before voidout
• Dying when killing last SharpClaw (It didn't seem to save the last kill)

I updated my guide (https://www.speedrun.com/sfa/guide/m3cys) with a 1st draft of a new Fuel Cell route. It's pretty hard to figure out since Ocean Point 1 and 2 are done after Dragon rock. This means the Fuel Cells there are useless.

Fuel cells that are no longer viable:

• 4x in Ocean Point
• 2x on the way back from Cape Claw (boost pad by LFV)
• 1x in Cape Claw from dropping down on the way to the waterfall. It's no longer optimal for the route.

Candidate replacements:

• 4x on River Path in SnowHorn wastes
• 2x in Volcano Force Point. 1 under bridge (adds 12s), 1 before the warp to placing SS3 (adds 7s).

The run back from Cape Claw #1 and a Death Warp ESW are actually pretty close time wise I think (needs confirmation). I think running back is 20s slower (an additional 12s slower if the 2x Fuel Cells are collected)

However, on the 2nd trip to Cape Claw, not only do we not have a choice due to a soft-lock, but we also skip a long cutscene, which makes ESW optimal.

Edit: The original post had issues due to a WC2 soft-lock, but due to new ESW discoveries, this is viable again. Even more viable now that K4 Early works.

We can save significant time by running the game with two files, and using ESW to warp between them.

Here is the PDF route https://www.speedrun.com/sfa/guide/m3cys

Edit: The final ESW causes a soft-lock, so this video is no longer valid and doesn't save time. Just keeping it here for historical reasons.

NOTES:

1. K3 early and DIM can be done in either order. Perhaps just do whichever is easiest to choke first -- Test of Fear vs Seam skip.
2. Getting Freeze Blast later is now possible (during SS3 turn in), but doing so loses time. This is because you MUST open both SS1 doors & flame the grates. Skipping any of these results in a soft-lock when placing SS3.
3. Skipping SS2 does not seem to be possible. The SS4 warp pad does not fully load until after SS2 is placed.
4. It may be possible to skip the water block puzzle entirely if we can swim past it. I couldn't find any setups. Swimming around it results in void outs, and there is no wiggle room.
5. If we find a way to swim into the temple, we can skip the first RNG puzzle. Unfortunately, it would only skip the SS2 version of the puzzle.
6. Approaching the water block puzzle from behind opens the gate if it is closed

Cape Claw OOB navigation tips:

• The right side of the mouth (when facing statue) seems easier to set up the air swim. Do not go too far in or you will clip inside and get stuck.
• You can gain height before the puzzle room as long as Cape Claw is loaded instead of the puzzle map
• It is much easier to navigate the west side of Cape Claw (side shown in video). Less potential void outs. It is also easier to set up the camera for gaining height in the water block puzzle.
• Be VERY careful how you clip into the puzzle room. You want to approach the climbable ledge from the left side. Otherwise, Tricky will spawn below, and you will lose time because you will have to raise the water.

Giving an update from Discord, based on Rena Kunisaki's findings:

• It's definitely caused by crystal plants. For some reason only the one(s) near the WarpStone cause the glitch (still working out the details on exactly which ones)
• Chopping down a plant after performing this glitch causes it to not grow back. It will grow back if you go back out of bounds or reload the area otherwise.
• We have not been able to replicate this on other plants in other areas.
• 1 EXPGFX slot (80 max) and 3 EXPGFX objects, and a couple heap slots are leaked per zoom
• The crash occurs due to a lack of heap slots, not EXPGFX slots.
• This means size of objects is not a factor, just the amount of them. This could be a good thing, as we do not have to worry about "object size Tetris", just the number of leaked objects.

Edit 2: Rena also shared the map that was added above to the original post. It seems the leak may occur when passing between the boundaries of two areas while voided out.

I've been playing around with these a bit, they seem like they will be useful. I noticed in the Dolphin logs there are both invalid reads AND invalid writes. The invalid writes give some hope of arbitrary code execution 🤔

One question, what are you using to track memory usage?

I'm not seeing any memory info with these debug codes. Also Dolphin has some memory debug features but they seem incomplete and not super useful.

Edit: For the nerds here, it looks like somebody is actively reverse-engineering this game with Ghidra: https://github.com/RenaKunisaki/StarFoxAdventures -- Building on this work is probably crucial for understanding this bug fully. I'll reach out to the author and see if they have any free cycles to look at this.

Edit 2: They responded -- reposting some info here from Discord

• Boneheaded trial and error approaches are unlikely to be useful here. This will require real reverse-engineering.
• ASLR is not in play, so all behavior should be reproducible based on positioning & previous events. Zelda OOT bugs are quite similar in this regard, so we should be learning as much as we can from their methodology.
• Disabling Dolphin MMU should give us crashes consistent with real hardware.
• "The number of objects loaded does not increase each time, and drops to 3 (as expected) when out of bounds, so the problem isn't an object not getting unloaded, but failing to unload some resource of its own"

Just adding more info to the info dump:

• It is possible to gain control during the CapeClaw intro cutscene. However, you are more likely to crash, glitch out the camera, or fall through the ground. If there is a cutscene we would want to gain control of, it's worth trying this glitch (success rate is likely < 5% though).
• When the game is under load (textures are weird), sometimes using Tricky's ball plays a sound effect, but does not spawn
• I suspect this was known, but if you save while the game is super broken, a console reload returns the game to normal.
• Spamming this glitch in Thorntail Hollow slowly destroys that area. GrubTub Well can become unloaded, the shop triggers can become unloaded, DIM path can unload, Cape Claw path can unload, MM Pass path can unload. The collision for Fox's ship can become weird and much larger. Bombable doors can reseal (but become uninteractable). Unfortunately, there is no way I've found to destroy other areas quite as severely.

The more I look into this glitch, the less I seem to understand it.

Also, I managed to perform a low-swim and unload the WarpStone, and the glitch no longer works

I tried this 3 different times, including in the original spot, and the glitch no longer worked.

I also tried the same low-swim into the shop with the WarpStone unloaded, and again the trick no longer works.

This is more evidence that the WarpStone or something that loads with the WarpStone is responsible for the leak.

I also managed to later find the location of the load triggers for the WarpStone. Unfortunately zooming near the sewers crashes at around ~10 zooms (After SS1 obtained).

Edit: I thought this setup crashed less, but it also seems to be dependent on the state of the game. See youtube comments for details, but I don't think this setup is perfect. :'(

I tested this at various points in the game to see how many zooms it took before a crash on Dolphin. I used the original glitch setup.

Disclaimer: GC/Wii may be different. As always with this trick, there seems to be a margin of error of ± 2 zooms.

WarpStone first available - 9 Rescued Tricky - 11 Obtained SS1 - 19 Obtained SS2 - 18 Obtained K3 - 18 Turned in K3 - 17 Obtained SS3 - 17 SS3 Placed - 9 Obtained K4 - 11 Turned in K4 - 17 Obtained SS4 - 16 SS4 Placed - 16

======================

Untested, since these are not in the any% route: SS1 Placed K2 Obtained/Placed (K1 is irrelevant since that is done with Krystal)

======================

It seems that Thorntail Hallow can end up in two main states, with (roughly) 17± 2 zooms required, and 10 ± 2 zooms required.

Edit: It's also positioning based. I guess it depends on what objects are loaded.

It may have nothing to do with the game progression, and instead only which maps or objects have been recently loaded.

Finally, I could have swore there was a time when I was first trying this trick that it took me like 25-27 zooms. I can't reproduce it, maybe I'm wrong/crazy. If anyone figures that out, please post here!

Strange scenario:

• Perform a low swim ()
• Hit the shop loading triggers (one by climbable bricks, one by the wall after the climbable ledge)
• Clip above the shop
• Zoom Leak spam. The game will start lagging, especially for zoom #7 and a few after that. But it never crashes, and eventually the lag goes away.
• I soft-locked after trying to use FireBlast.

Skip to ~0:40 if you do not care about the setup. Best viewed on 2x speed.

In other attempts, the game crashes after about ~7 zooms ONLY if you attempt to open the pause menu or continue the game normally. Zooms will not crash the game by themselves in this scenario.

This seems to indicate there is something even weirder going on than a simple memory leak.

Edit: Ignore a lot of my initial findings. I used emulator settings that apparently would otherwise crash on an actual console.

I've been attempting to unload the K4 gate, but no luck.

I've been able to unload:

• The log bridge before the K4 gate. This seems pretty significant, actually.
• Icons for items in the C stick menu (usually the power chamber key)
• Campfires
• Sharpclaws (rare)
• Textures for mamoths
• The lock to the snowhorn gate, but not the gate itself
• Textures for spider webs in the pass between Thorntail Hallow and Snowhorn areas
• The Snowhorn Trials mammoth
• I've had some terrain not load (walking on it causes a void out)

However I've never gotten the ice gate to unload, nor the gate that requires a key. The only time the ice gate was gone was when I had already burned it.

Makes me wonder if unloading doors is possible.

Some attempts here, with 16 unloads on Dolphin

Edit: Ignore a lot of my initial findings. I used emulator settings that apparently would otherwise crash on an actual console.

For those who are new, this glitch is set up by performing an air swim first. See https://www.speedrun.com/sfa/guide/oe1h4

For basic routing information, check out https://www.speedrun.com/sfa/guide/m3cys

=======================

I'm time constrained too, but I think I'll try and poke at this some when I can.

Things that I think are worth looking into:

• v1.00 and v1.0.1 differences
• Whether this can be used to unload parts of Cape Claw to get OOB and skip needing early Frost Blast (~5 minutes saved). Maybe OOB isn't even needed, and we can keep the fire unloaded. (https://www.speedrun.com/sfa/thread/j98z7)
• Unloading the moon pass door (I tried this several ways with no luck)
• Obviously K4 early
• The effects on creating new games
• Unloading the cage at the top of the Krazoa Palace. This alone would save like 2 hours I think.
• Everything imaginable

It seems that the current state of ThornTail Hallow, as well as StarFox's position influences the # of zooms required to finish the memory leak.

Early game takes ~10, later it takes ~17.

If you jam yourself into the bottom left corner of the map, it usually takes 1-2 extra zooms to crash. Edit: Even then, this seems RNG based.

The only thing I've been able to keep unloaded are exploding door textures, and the shop. It caused the camera to get weird too.

=======================

To manipulate a particular zone, I've been using this strategy:

• Get to the zone you want to mess with
• Save and quit
• Enter game, and backtrack to ThornTail Hallow
• Swim OOB and perform this glitch
• Now when you quit without saving and re-enter, the memory leak will be active in the zone of choice

Even if K4 early was discovered, there are no meaningful escapes that I've found.

Death, revives, and save/reloads are not enough to get back out. In my personal opinion, K4 early is not viable without a way to warp out of the cage.

Getting to K4 by navigating the edges of the map is stopped by the cage. The cage extends very far out of the walls.

I'm also working on recording all water plane heights. To swim into the K4 room, a swim level between -536.0 and -517.0 is required. There are no water planes that meet this requirement:

Tricky Pool: -75 Snow Wastes Platforms Top: -402 Snow Wastes Waterfall: between -558 and -561 Snow Wastes Waterfall end (OOB): between -588 and -592 Snow Wastes Drain/Reservoir: -558 Waterfall Glitch: between -646.5 and -645 Sewers: -777 Low Swim (Starting River): -797 Frozen Wastes Waterfall bottom: -974 North maze pool: -1070 South maze pool: -1070

Note: Depth != PlayerY. The player will actually be 21 units above the surface depth.

I'm currently finishing up a spread sheet with all water depths. I'll post it in Guides when it's done.

If a method for clipping into this cage was discovered, it could cut ~2 hours from the run.

The route would then become "Get any Krazoa spirit (except #1 or #5), warp to Krazoa palace, clip into cage, defeat Andross"

In this video, after obtaining Krazoa #6, the game will glitch and play the cutscene for Krazoa #5 (2:20 in the video). This will cause Star Fox to warp to his ship and escape the cage! This makes the glitch much more theoretically feasible.

However clipping into things in this game seems exceptionally difficult. If anyone has theories, I'm all ears.

Edit: Unloading the gate doors might also be worth trying, but as far as I can tell the warp would be unloaded too.

I doubt I'm the first to find this, but I didn't see it elsewhere. This is a way to swim at a much lower height than a typical waterfall swim setup. This provides an alternative way to Dark Ice Mines Early.

Cons: Slower than a standard DIME performed without mistakes. The clip through the waterfall wall is kinda tricky, and the out of bounds navigation is fairly slippery. Pros: No longer need to get the perfect waterfall setup to clip through the ceiling in the sewer.

I have not found any other uses for this yet. It does not seem to be very useful for Cape Claw Early, as this setup will miss most of the loading triggers and inevitably softlock.

The Blow Horn locations get loaded under the Krazoa 4 gate. As far as I know, they can only be accessed with hacks. They appear to be inactive, so even if we discovered a way to get to them, they are not usable.

They probably get warped to their correct locations and activated when the event starts.

Edit: To be as thorough as possible, I decided to look into the mechanics of the blow horn:

Seems one pad exists to start the event, and the other one just teleports around. Exploits seem unlikely.