From 654e36622f41e64bff1e4f05d3c81e2d3ce36689 Mon Sep 17 00:00:00 2001
From: Yang Liu <numbksco@gmail.com>
Date: Thu, 23 Jul 2026 14:08:29 +0800
Subject: [PATCH] [DYNAREC] Fixed 16-bit XADD register clobbering (#4094)

---
 src/dynarec/arm64/dynarec_arm64_660f.c | 6 ++++--
 src/dynarec/la64/dynarec_la64_660f.c   | 4 +++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/dynarec/arm64/dynarec_arm64_660f.c b/src/dynarec/arm64/dynarec_arm64_660f.c
index 29ce7ef60..2891aaa9e 100644
--- a/src/dynarec/arm64/dynarec_arm64_660f.c
+++ b/src/dynarec/arm64/dynarec_arm64_660f.c
@@ -2058,7 +2058,7 @@ uintptr_t dynarec64_660F(dynarec_arm_t* dyn, uintptr_t addr, uintptr_t ip, int n
             } else {
                 SMREAD();
                 addr = geted(dyn, addr, ninst, nextop, &wback, x1, &fixedaddress, NULL, 0, 0, rex, NULL, 0, 1);
-                v1 = fpu_get_scratch(dyn, ninst);      
+                v1 = fpu_get_scratch(dyn, ninst);
             }
             u8 = F8;
             GETGX_empty(v0);
@@ -2923,9 +2923,11 @@ uintptr_t dynarec64_660F(dynarec_arm_t* dyn, uintptr_t addr, uintptr_t ip, int n
             nextop = F8;
             GETGW(x1);
             GETEW(x2, 0);
-            BFIx(TO_NAT(((nextop & 0x38) >> 3) + (rex.r << 3)), ed, 0, 16);
+            u8 = TO_NAT(((nextop & 0x38) >> 3) + (rex.r << 3));
+            if (!(MODREG && wback == u8)) MOVx_REG(x6, ed);
             emit_add16(dyn, ninst, ed, gd, x4, x5);
             EWBACK;
+            if (!(MODREG && wback == u8)) BFIx(u8, x6, 0, 16);
             break;
         case 0xC2:
             INST_NAME("CMPPD Gx, Ex, Ib");
diff --git a/src/dynarec/la64/dynarec_la64_660f.c b/src/dynarec/la64/dynarec_la64_660f.c
index 7312366e1..2d08dc7aa 100644
--- a/src/dynarec/la64/dynarec_la64_660f.c
+++ b/src/dynarec/la64/dynarec_la64_660f.c
@@ -2689,9 +2689,11 @@ uintptr_t dynarec64_660F(dynarec_la64_t* dyn, uintptr_t addr, uintptr_t ip, int
             SETFLAGS(X_ALL, SF_SET_PENDING, NAT_FLAGS_FUSION);
             nextop = F8;
             GETGWEW(x1, x2, 0);
-            BSTRINS_D(TO_NAT(((nextop & 0x38) >> 3) + (rex.r << 3)), ed, 15, 0);
+            u8 = TO_NAT(((nextop & 0x38) >> 3) + (rex.r << 3));
+            if (!(MODREG && wback == u8)) MV(x7, ed);
             emit_add16(dyn, ninst, ed, gd, x4, x5, x6);
             EWBACK;
+            if (!(MODREG && wback == u8)) BSTRINS_D(u8, x7, 15, 0);
             break;
         case 0xC2:
             INST_NAME("CMPPD Gx, Ex, Ib");