Fix unit map storage for 16-bit variables

Store unit map attributes as vmvar_t and derive VR/VW transfer sizes
from their element type. This prevents buffer overruns after vmvar_t
became uint16_t and fixes upward movement in Rance IV.

Add scenario coverage for both transfer directions and verify that
adjacent variables remain intact.

src/cmdv.c

@@ -90,7 +90,7 @@ typedef struct {
 #define UNITMAP_ATTRIB_WALKRESULT (3)
 
 /* UnitMAP 全体へのポインタ */
-static int *UnitMap = NULL;
+static vmvar_t *UnitMap = NULL;
 /* VC command */
 static int nPageNum;
 static int x0Map;
@@ -160,7 +160,7 @@ void commandVC() { /* from Rance4 */
 		return;
 	}
 	
-	UnitMap = (int *)calloc(cxMap * cyMap * nPageNum * UNITMAP_ATTRIB_DEPTH, sizeof(int));
+	UnitMap = calloc(cxMap * cyMap * nPageNum * UNITMAP_ATTRIB_DEPTH, sizeof(*UnitMap));
 	srcimg  = (UnitMapSrcImg *)calloc(nPageNum, sizeof(UnitMapSrcImg));
 	
 	if (NULL == UnitMap || NULL == srcimg) {
@@ -458,7 +458,7 @@ void commandVR() { /* from Rance4 */
 	int nPage = getCaliValue();
 	int nType = getCaliValue();
 	vmvar_t *var  = getCaliVariable();
-	int *dst;
+	vmvar_t *dst;
 	
 	TRACE("VR %d,%d,%p:",nPage, nType, var);
 	
@@ -481,14 +481,14 @@ void commandVR() { /* from Rance4 */
 		return;
 	}
 	
-	memcpy(dst, var, sizeof(int) * MAPSIZE_PER_ATTRIB);
+	memcpy(dst, var, MAPSIZE_PER_ATTRIB * sizeof(*dst));
 }
 
 void commandVW() { /* from Rance4 */
 	int nPage = getCaliValue();
 	int nType = getCaliValue();
 	vmvar_t *var  = getCaliVariable();
-	int *src;
+	vmvar_t *src;
 	
 	TRACE("VW %d,%d,%p:",nPage, nType, var);
 	
@@ -511,7 +511,7 @@ void commandVW() { /* from Rance4 */
 		return;
 	}
 	
-	memcpy(var, src, sizeof(int) * MAPSIZE_PER_ATTRIB);
+	memcpy(var, src, MAPSIZE_PER_ATTRIB * sizeof(*src));
 }
 
 void commandVE() { /* from T2 */

test/test.adv

@@ -15,6 +15,7 @@
 	%#stack.adv:
 	%#math.adv:
 	%#variable.adv:
+	%#unitmap.adv:
 
 	HH0,tests_passed: ' tests passed' R
 	HH0,tests_failed: ' tests failed' R

test/test.hed

@@ -7,6 +7,7 @@ strvar.adv
 stack.adv
 math.adv
 variable.adv
+unitmap.adv
 
 #DLLHeader
 ShString.HEL

test/unitmap.adv

@@ -0,0 +1,30 @@
+	MS FILE,"unitmap.adv":
+	!unitmap_src0:11!!unitmap_src1:22!!unitmap_src2:33!!unitmap_src3:44!
+	!unitmap_dst0:0!!unitmap_dst1:0!!unitmap_dst2:0!!unitmap_dst3:0!!unitmap_sentinel:1234!
+
+	VC 1,0,0,2,2,1,1:
+
+	; VR copies consecutive 16-bit VM variables to the unit map.
+	VR 0,3,unitmap_src0:
+	VG 0,3,0,0:
+	~AssertEquals RND,11,__LINE__:
+	VG 0,3,1,0:
+	~AssertEquals RND,22,__LINE__:
+	VG 0,3,0,1:
+	~AssertEquals RND,33,__LINE__:
+	VG 0,3,1,1:
+	~AssertEquals RND,44,__LINE__:
+
+	; VW performs the reverse conversion without overwriting adjacent variables.
+	VS 0,3,0,0,101:
+	VS 0,3,1,0,102:
+	VS 0,3,0,1,103:
+	VS 0,3,1,1,104:
+	VW 0,3,unitmap_dst0:
+	~AssertEquals unitmap_dst0,101,__LINE__:
+	~AssertEquals unitmap_dst1,102,__LINE__:
+	~AssertEquals unitmap_dst2,103,__LINE__:
+	~AssertEquals unitmap_dst3,104,__LINE__:
+	~AssertEquals unitmap_sentinel,1234,__LINE__:
+
+	%0: