After diving into the code, this is what I found:

Starting the stage¶

The function responsible for starting a stage is dComIfG_play_c::setStartStage(dStage_startStage_c *), this one is called once when the phase_1 function is executed after pressing reset.

Setting the next stage¶

The function responsible for setting the next stage is dComIfGp_setNextStage(char const *, short, signed char, signed char, float, unsigned long, int, signed char, short, int, int) and is called by dComIfG_changeOpeningScene(scene_class *, short).

Next stage setup after pressing RESET¶

In order to call dComIfG_changeOpeningScene (which is called by dComIfG_resetToOpening(scene_class *)), the following conditions have to be met:

In the dComIfG_resetToOpening(scene_class *) function (dComIfG_changeOpeningScene's caller)¶

r13 = 0x80525ea0

1.  u32 ptr = *(r13-0x4E10)     // @0x80521090      (value = 0x80537440)
    u8 b = *(ptr + 0x10)        // @0x80537440+0x10 (value = 0x00)
    Condition: b == 0

2.  u8 b = *(ptr + 0x11)        // @0x80537440+0x11 (value = 0x00)
    Condition: b == 0

3.  u32 v = *(ptr)              // @0x80537440+0x00 (value = 0x00000001)
                                // Set in mDoRst_resetCallBack(int, void *) m_Do_Reset.o 
    Condition: v != 0

4.  u32 ptr2 = *(r13-0x4F00)    // @0x80520FA0      (value = 0x805EE410)
    u32 fadeout = *(ptr2+4)     // @0x805EE410+4    (value = 0x00000001)
                                // Set in JUTFader::startFadeOut(int) JUtility.a JUTFader.o
    Condition: fadeout != 2

In the dScnPly_Draw(dScnPly_c *) function (dComIfG_resetToOpening's caller)¶

Condition: fopOvlpM_IsPeek() != true

When these 5 conditions are met, the dComIfG_changeOpeningScene function is called. Regarding the normal behaviour, when RESET is pressed (either via the Wii button or the HOME menu) it sets the next stage to be "F_SP102", then calls dScnPly_Draw a bunch of time to draw the fadeout animation and finally calls phase_1. However, when the bug occurs, the next stage isn't set because those conditions aren't met, especially since fopOvlpM_IsPeek() == true. Overwriting the return value allows to reach the title screen but won't produce the save slot loading glitch. Moreover, when the bug happens the next stage isn't set, so it reloads the previous one which is "F_SP121" and dScnPly_Draw is never called again which is weird.

I'll investigate and try to find why. However, if it's a timing issue, the savestate might have saved the "bad" timing and might be useless to check if the issue has been fixed.

I tried to find a consistent setup to reproduce the glitch from the title screen savestate I provided and I realised that breakpoints or waiting too much won't trigger the glitch. The i_data = NULL mentioned in the debug message seems to be located on the heap, so I assume it's a memory corruption glitch. According to the memory breakpoints it could be either the DVD reading/writing to it or the game reloading a scene.

Either way, I don't know how accurate this is compared to the real console since it could behave differently. Could someone please reproduce the following steps when the glitch occurs on a real console (using the appropriate debugging tools):

Breakpoint setup¶

Put a breakpoint on 0x8001abf8 (mDoRst_resetCallBack)
When hit, put a breakpoint on:

• 0x802e637c (JUTReportConsole_f)
• 0x80009358 (OSReport_Error)

Then, resume the execution.

Debug messages¶

JUTReportConsole_f¶

When the JUTReportConsole_f's breakpoint is hit,
  1. Extract the string located in memory based on r3 value
  2. Count the number of "%" character in the string and extract the same number of register (starting at r4)
    -> Example: if there are 2 "%" characters, write down the r4 and r5 values
    -> (Optional) if the register value is an address, write down the string
        r3 = 0x804076de ("Start StageName:RoomNo [%s:%d]")
        r4 = 0x8047f628 ("F_SP121")
        r5 = 0x00000001
  3. Describe where and when the breakpoint is hit

Then, resume the execution.

OSReport_Error¶

Same as JUTReportConsole_f

This can be closed, because I just got it to work on Dolphin the same as it does on console. Sepalani can confirm.

Sorry for wasting everyone's time.