diff --git a/DumpList.java b/DumpList.java
index 360c89a..20b1b48 100644
--- a/DumpList.java
+++ b/DumpList.java
@@ -54,6 +54,7 @@ public class DumpList extends GhidraScript {
         for (long a : targets) {
             if (a < LO || a > HI) continue;
             Function f = fm.getFunctionAt(as.getAddress(a));
+            if (f == null) f = fm.getFunctionContaining(as.getAddress(a));
             if (f == null) {
                 pw.println("############ NO_FUNCTION 0x" + Long.toHexString(a) + " ############");
                 continue;
diff --git a/SearchRefs.java b/SearchRefs.java
index 370bb5b..31a6289 100644
--- a/SearchRefs.java
+++ b/SearchRefs.java
@@ -8,7 +8,7 @@ import java.io.PrintWriter;
 public class SearchRefs extends GhidraScript {
     @Override
     public void run() throws Exception {
-        String[] targets = {"18052e260","180536300","180535880","180536f90","18052da00"};
+        String[] targets = {"18003fa20","1800025e0","180008500","1800104e0"};
         AddressSpace as = currentProgram.getAddressFactory().getDefaultAddressSpace();
         PrintWriter pw = new PrintWriter(new java.io.BufferedWriter(
             new java.io.FileWriter("/home/m/re-tools/xrefs.txt")));
@@ -18,7 +18,7 @@ public class SearchRefs extends GhidraScript {
             pw.println("### TARGET " + ts);
             ReferenceIterator it = currentProgram.getReferenceManager().getReferencesTo(t);
             int n=0;
-            while (it.hasNext() && n<200) {
+            while (it.hasNext() && n<120) {
                 Reference r = it.next();
                 pw.println("  from " + r.getFromAddress() + " type=" + r.getReferenceType());
                 n++;
diff --git a/focus_decomp.txt b/focus_decomp.txt
index 3e9ea0c..1beb238 100644
--- a/focus_decomp.txt
+++ b/focus_decomp.txt
@@ -1,216 +1,118 @@
-############ FUN_ 180536300 size=475 ############
+############ FUN_ 18000845d size=51 ############
 
-void FUN_180536300(longlong param_1,undefined8 param_2,undefined8 param_3,longlong param_4,
-                  int param_5,undefined8 param_6,longlong param_7)
+undefined8 FUN_180008440(longlong param_1,longlong param_2,int param_3)
 
 {
-  longlong lVar1;
-  longlong lVar2;
-  longlong lVar3;
-  longlong lVar4;
-  float fVar5;
-  int iVar6;
-  int iVar7;
-  
-  iVar7 = *(int *)(param_1 + 0x240080);
-  lVar1 = param_7 + (longlong)(param_5 * 8) * 4;
-  lVar2 = lVar1 + (longlong)param_5 * 4;
-  fVar5 = *(float *)(param_1 + 0x24);
-  lVar3 = lVar2 + (longlong)(param_5 * 2) * 4;
-  lVar4 = lVar3 + (longlong)(param_5 * 2) * 4;
-  iVar6 = __std_type_info_compare(0x182650db8,0x182650db8);
-  FUN_18052da00(lVar1,param_3,(float)(DAT_1824c4248 / (double)((float)iVar7 * fVar5)),param_5);
-  if (*(char *)(param_4 + 0x810) == '\0') {
-    FUN_18052db50(lVar3,DAT_1824c3ea4,param_5);
-    FUN_18052db50(lVar4,0,param_5);
-    if (0 < *(int *)(param_4 + 0x814)) {
-      if (iVar6 == 0) {
-        FUN_180535880();
-      }
-      else {
-        FUN_180536f90(lVar2,param_7,param_4,lVar1,param_5);
-      }
-      iVar7 = __std_type_info_compare(0x182650db8,0x182650db8);
-      if (iVar7 == 0) {
-                    /* WARNING: Subroutine does not return */
-        thunk_FUN_181ba94b0();
-      }
-                    /* WARNING: Subroutine does not return */
-      thunk_FUN_181ba94b0(lVar2,param_7,param_5);
-    }
-    if ((1 < *(int *)(param_4 + 0x814)) &&
-       (*(char *)((longlong)(*(int *)(param_4 + 0x814) + -1) + 0x818 + param_4) == '\0')) {
-      FUN_18052d990(lVar4,lVar3,param_5);
-    }
-    FUN_18052dbc0(param_2,lVar4,param_5);
-  }
-  else {
-    FUN_18052db50(param_2,DAT_1824c3ea4,param_5);
-  }
-  return;
-}
-
-
-
-############ FUN_ 180535880 size=283 ############
-
-/* WARNING: Removing unreachable block (ram,0x000180535987) */
-/* WARNING: Removing unreachable block (ram,0x0001805359d3) */
-/* WARNING: Removing unreachable block (ram,0x00018053598d) */
-
-void FUN_180535880(undefined8 param_1,undefined8 param_2,undefined8 *param_3,undefined8 param_4,
-                  undefined4 param_5)
-
-{
-  double *pdVar1;
-  double *pdVar2;
-  undefined1 auStack_c8 [32];
-  undefined8 local_a8;
-  float local_a0;
-  float local_9c;
-  float local_98;
-  float local_90;
-  float local_8c;
-  float local_88;
-  ulonglong local_80;
-  
-  local_80 = DAT_182615970 ^ (ulonglong)auStack_c8;
-  pdVar1 = (double *)*param_3;
-  pdVar2 = (double *)param_3[1];
-  local_8c = (float)pdVar2[1];
-  local_9c = (float)pdVar1[1];
-  local_88 = (float)pdVar2[2];
-  local_a0 = (float)*pdVar1;
-  local_90 = (float)*pdVar2;
-  local_98 = (float)pdVar1[2];
-  local_a8 = param_4;
-                    /* WARNING: Subroutine does not return */
-  thunk_FUN_181ba94b0(local_a0,param_2,param_5);
-}
-
-
-
-############ FUN_ 180536f90 size=249 ############
-
-/* WARNING: Removing unreachable block (ram,0x000180537079) */
-/* WARNING: Removing unreachable block (ram,0x0001805370c8) */
-/* WARNING: Removing unreachable block (ram,0x00018053707f) */
-
-void FUN_180536f90(undefined8 param_1,undefined8 param_2,undefined8 *param_3,undefined8 param_4,
-                  undefined4 param_5)
-
-{
-  undefined8 *puVar1;
-  undefined8 *puVar2;
-  undefined1 auStack_f8 [32];
-  undefined8 local_d8;
-  undefined8 local_c8;
-  undefined8 uStack_c0;
-  undefined8 local_b8;
-  undefined4 local_b0;
-  undefined4 uStack_ac;
-  undefined4 uStack_a8;
-  undefined4 uStack_a4;
-  undefined8 local_a0;
-  undefined4 local_98;
-  undefined4 uStack_94;
-  undefined4 uStack_90;
-  undefined4 uStack_8c;
-  ulonglong local_88;
-  
-  local_88 = DAT_182615970 ^ (ulonglong)auStack_f8;
-  puVar1 = (undefined8 *)*param_3;
-  puVar2 = (undefined8 *)param_3[1];
-  local_b0 = *(undefined4 *)(puVar1 + 1);
-  uStack_ac = *(undefined4 *)((longlong)puVar1 + 0xc);
-  uStack_a8 = *(undefined4 *)(puVar1 + 2);
-  uStack_a4 = *(undefined4 *)((longlong)puVar1 + 0x14);
-  local_98 = *(undefined4 *)(puVar2 + 1);
-  uStack_94 = *(undefined4 *)((longlong)puVar2 + 0xc);
-  uStack_90 = *(undefined4 *)(puVar2 + 2);
-  uStack_8c = *(undefined4 *)((longlong)puVar2 + 0x14);
-  local_c8 = *puVar1;
-  local_a0 = *puVar2;
-  uStack_c0 = 0;
-  local_d8 = param_4;
-  local_b8 = local_c8;
-                    /* WARNING: Subroutine does not return */
-  thunk_FUN_181ba94b0(&local_c8,param_2,param_5);
-}
-
-
-
-############ FUN_ 18052e260 size=577 ############
-
-undefined8 FUN_18052e260(longlong param_1,int param_2)
-
-{
-  undefined8 uVar1;
-  int iVar2;
-  undefined4 uVar3;
-  int iVar4;
-  int iVar5;
-  uint uVar6;
-  undefined8 uVar7;
-  longlong lVar8;
-  longlong *plVar9;
-  undefined4 uVar10;
-  
-  iVar5 = *(int *)(param_1 + 100) / 2 + 1;
-  if (*(char *)(param_1 + 0x240464) != '\0') {
-    *(undefined1 *)(param_1 + 0x240464) = 0;
-    FUN_18052fbd0(param_1 + 0x3d8);
-  }
-  uVar1 = *(undefined8 *)(param_1 + 0x540788);
-  iVar4 = *(int *)(param_1 + 0x2404d8);
-  if (iVar4 < 1) {
-    if (*(char *)(param_1 + 0x5408ad) != '\0') {
-      *(undefined1 *)(param_1 + 0x5408ad) = 0;
-      *(int *)(param_1 + 0x2404d8) = iVar5;
+  if ((param_1 != 0) && (param_2 != 0)) {
+    if (param_3 < 1) {
+      return 0xfffffffa;
     }
+    FUN_18003fa20();
     return 0;
   }
-  iVar2 = iVar5;
-  if (iVar4 < iVar5) {
-    iVar2 = iVar4;
+  return 0xfffffff8;
+}
+
+
+
+############ FUN_ 18000c6a0 size=507 ############
+
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+undefined8 FUN_18000c5e0(longlong param_1,longlong param_2,longlong param_3,int param_4)
+
+{
+  undefined1 *puVar1;
+  undefined1 *puVar2;
+  ulonglong uVar3;
+  undefined1 auStack_498 [32];
+  undefined1 local_470 [512];
+  undefined1 auStack_270 [576];
+  ulonglong local_30;
+  
+  local_30 = DAT_182615970 ^ (ulonglong)auStack_498;
+  if (((param_3 == 0) || (param_1 == 0)) || (param_2 == 0)) {
+    if ((local_30 ^ (ulonglong)auStack_498) == DAT_182615970) {
+      return 0xfffffff8;
+    }
+  }
+  else if (param_4 < 1) {
+    if ((local_30 ^ (ulonglong)auStack_498) == DAT_182615970) {
+      return 0xfffffffa;
+    }
+  }
+  else {
+    uVar3 = -((ulonglong)local_470 & 0x3f) & 0x3f;
+    puVar1 = local_470 + uVar3;
+    puVar2 = auStack_270 + uVar3;
+    for (; 0x40 < param_4; param_4 = param_4 + -0x40) {
+      thunk_FUN_1801560a0(param_2,puVar1,puVar2,0x40);
+      FUN_180008500(param_1,puVar1,0x40);
+      FUN_180008500(param_1,puVar2,0x40);
+      FUN_180044700(puVar2,puVar1,param_3,0x40);
+      param_1 = param_1 + 0x200;
+      param_2 = param_2 + 0x200;
+      param_3 = param_3 + 0x400;
+    }
+    thunk_FUN_1801560a0(param_2,puVar1,puVar2,param_4);
+    FUN_180008500(param_1,puVar1,param_4);
+    FUN_180008500(param_1,puVar2,param_4);
+    FUN_180044700(puVar2,puVar1,param_3,param_4);
+    if ((local_30 ^ (ulonglong)auStack_498) == DAT_182615970) {
+      return 0;
+    }
   }
-  *(int *)(param_1 + 0x2404d8) = iVar2;
-  if (iVar2 < param_2) {
-    param_2 = iVar2;
+}
+
+
+
+############ FUN_ 18000c711 size=507 ############
+
+/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
+
+undefined8 FUN_18000c5e0(longlong param_1,longlong param_2,longlong param_3,int param_4)
+
+{
+  undefined1 *puVar1;
+  undefined1 *puVar2;
+  ulonglong uVar3;
+  undefined1 auStack_498 [32];
+  undefined1 local_470 [512];
+  undefined1 auStack_270 [576];
+  ulonglong local_30;
+  
+  local_30 = DAT_182615970 ^ (ulonglong)auStack_498;
+  if (((param_3 == 0) || (param_1 == 0)) || (param_2 == 0)) {
+    if ((local_30 ^ (ulonglong)auStack_498) == DAT_182615970) {
+      return 0xfffffff8;
+    }
   }
-  uVar6 = 0;
-  if (0 < *(int *)(param_1 + 0x2404d0)) {
-    plVar9 = (longlong *)(param_1 + 0x5407e8);
-    lVar8 = 0;
-    do {
-      if (uVar6 < *(uint *)(param_1 + 0x444)) {
-        uVar7 = *(undefined8 *)(lVar8 + *(longlong *)(param_1 + 0x438));
-      }
-      else {
-        uVar7 = 0;
-      }
-      FUN_180536300(param_1 + 0x3d8,*plVar9 + (longlong)(iVar5 - iVar2) * 4,
-                    *(longlong *)(param_1 + 0x540758) + (longlong)(iVar5 - iVar2) * 4,uVar7,param_2)
-      ;
-      uVar6 = uVar6 + 1;
-      plVar9 = plVar9 + 2;
-      lVar8 = lVar8 + 8;
-    } while ((int)uVar6 < *(int *)(param_1 + 0x2404d0));
+  else if (param_4 < 1) {
+    if ((local_30 ^ (ulonglong)auStack_498) == DAT_182615970) {
+      return 0xfffffffa;
+    }
   }
-  *(int *)(param_1 + 0x2404d8) = *(int *)(param_1 + 0x2404d8) - param_2;
-  if ((*(int *)(param_1 + 0x2404d8) < 1) && (0 < *(int *)(param_1 + 0x30))) {
-    expf(DAT_1824c4208);
-    uVar3 = DAT_1824c3ea4;
-    uVar10 = (undefined4)DAT_1824c4140;
-    iVar4 = __std_type_info_compare(0x182650db8,0x182650db8);
-    if (iVar4 != 0) {
-                    /* WARNING: Subroutine does not return */
-      thunk_FUN_181ba94b0(uVar10,uVar1,iVar5);
-    }
-                    /* WARNING: Subroutine does not return */
-    thunk_FUN_181ba94b0(uVar3);
+  else {
+    uVar3 = -((ulonglong)local_470 & 0x3f) & 0x3f;
+    puVar1 = local_470 + uVar3;
+    puVar2 = auStack_270 + uVar3;
+    for (; 0x40 < param_4; param_4 = param_4 + -0x40) {
+      thunk_FUN_1801560a0(param_2,puVar1,puVar2,0x40);
+      FUN_180008500(param_1,puVar1,0x40);
+      FUN_180008500(param_1,puVar2,0x40);
+      FUN_180044700(puVar2,puVar1,param_3,0x40);
+      param_1 = param_1 + 0x200;
+      param_2 = param_2 + 0x200;
+      param_3 = param_3 + 0x400;
+    }
+    thunk_FUN_1801560a0(param_2,puVar1,puVar2,param_4);
+    FUN_180008500(param_1,puVar1,param_4);
+    FUN_180008500(param_1,puVar2,param_4);
+    FUN_180044700(puVar2,puVar1,param_3,param_4);
+    if ((local_30 ^ (ulonglong)auStack_498) == DAT_182615970) {
+      return 0;
+    }
   }
-  return 1;
 }
 
 
diff --git a/focus_list.txt b/focus_list.txt
index 37458b8..ae5372b 100644
--- a/focus_list.txt
+++ b/focus_list.txt
@@ -1 +1 @@
-180536300,180535880,180536f90,18052e260
+18000845d,18000c6a0,18000c711
diff --git a/roadmap.md b/roadmap.md
index 38efddb..25dc756 100644
--- a/roadmap.md
+++ b/roadmap.md
@@ -158,3 +158,14 @@
 - Param/curve generators (exp/log/pow/tan based, DAT_1824c4xxx): FUN_1805316e0 (6238), FUN_180529fe0 (2051), FUN_18052e9b0 (3167).
 - Dispatch index global `DAT_1826159a0` written only in PACE wrappers 18000101b/180001046.
 - big spectral-area functions are mostly param/memory/PACE; the real dsp sticks are dispatch kernels (245 targets).
+
+### DSP kernel map (xref cross-check)
+- **Complex multiply** `FUN_18003fa20(double*, cplx[][16], n)` — called ONLY from `FUN_180008440` (init area, twiddle build) — NOT a dispatch slot.
+- **Double mul** `FUN_180008500` — dispatch slot @182615f20; called from **FUN_18000c5e0** (double FFT stage kernel, 507B):
+  loop over 0x40-chunks: `thunk_FUN_1801560a0(param_2,re,im,0x40)` (load twiddle), `FUN_180008500(param_1,re,n)`,
+  `FUN_180008500(param_1,im,n)`, `FUN_180044700(im,re,param_3,n)`.
+- **Double add** `FUN_1800025e0` slot @1826159e8; **float max** `FUN_1800104e0` slot @1826164a0; `180010860` = vmax/vmin with const.
+- Decompiler entry-point trick: `getFunctionAt` misses overlapping/obfuscated entries => use `getFunctionContaining` (DumpList updated).
+- OBtained: full FFT-plan model, factor tables, per-type kernels, block->detector->mask flow.
+- Next sub-goal: trace the FFT-stage kernel call order used by detector (which plan fields drive per-stage twiddle/mul) 
+  => then C++ re-implementation is a direct transcription of that order.
diff --git a/xrefs.txt b/xrefs.txt
index 8c50be1..49025a9 100644
--- a/xrefs.txt
+++ b/xrefs.txt
@@ -1,21 +1,15 @@
-### TARGET 18052e260
-  from 18269df60 type=DATA
-  from 182532028 type=DATA
-  from 182532084 type=DATA
-  from 182532094 type=DATA
-  from 18052b99c type=UNCONDITIONAL_CALL
-### TARGET 180536300
-  from 18269e434 type=DATA
-  from 182532b78 type=DATA
-  from 182532b88 type=DATA
-  from 18052e349 type=UNCONDITIONAL_CALL
-  from 18058e3df type=UNCONDITIONAL_CALL
-### TARGET 180535880
-  from 18269e3ec type=DATA
-  from 180536446 type=UNCONDITIONAL_CALL
-### TARGET 180536f90
-  from 18269e458 type=DATA
-  from 18053644d type=UNCONDITIONAL_CALL
-### TARGET 18052da00
-  from 18269dec4 type=DATA
-  from 1805363ae type=UNCONDITIONAL_CALL
+### TARGET 18003fa20
+  from 18000845d type=UNCONDITIONAL_CALL
+### TARGET 1800025e0
+  from 18267c078 type=DATA
+  from 1826159e8 type=DATA
+### TARGET 180008500
+  from 18267c708 type=DATA
+  from 18000c6a0 type=UNCONDITIONAL_CALL
+  from 18000c6b1 type=UNCONDITIONAL_CALL
+  from 18000c711 type=UNCONDITIONAL_CALL
+  from 18000c71f type=UNCONDITIONAL_CALL
+  from 182615f20 type=DATA
+### TARGET 1800104e0
+  from 18267cd08 type=DATA
+  from 1826164a0 type=DATA