From 0bc334661a2a16694f819ed9033ee05f479d817f Mon Sep 17 00:00:00 2001
From: As9xm <197338912+As9xm@users.noreply.github.com>
Date: Thu, 10 Sep 2026 21:20:41 +0300
Subject: [PATCH] Fix LOCK 16-bit INC/DEC using 32-bit primop in interpreter
 path

RunF066 handles F0 66 FF /0,/1 (LOCK INC/DEC Ew). The non-DYNAREC path applied inc32/dec32 to ED->dword[0], corrupting the upper 16 bits and computing OF/SF/ZF/AF/PF at the wrong operand width. The DYNAREC path just above correctly uses inc16/dec16, as does the non-LOCK Grp5 Ew handler in x86run66.c (EW->word[0] = inc16/dec16). Narrow the interpreter LOCK path to ED->word[0] with inc16/dec16.
---
 src/emu/x86runf066.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/emu/x86runf066.c b/src/emu/x86runf066.c
index d563f7c2a9..2ae75ded2d 100644
--- a/src/emu/x86runf066.c
+++ b/src/emu/x86runf066.c
@@ -147,7 +147,7 @@ uintptr_t RunF066(x86emu_t *emu, uintptr_t addr)
                         } while(arm_lock_write_h(ED, inc16(emu, tmp16u)));
 #else
                     pthread_mutex_lock(&emu->context->mutex_lock);
-                    ED->dword[0] = inc32(emu, ED->dword[0]);
+                    ED->word[0] = inc16(emu, ED->word[0]);
                     pthread_mutex_unlock(&emu->context->mutex_lock);
 #endif
                     break;
@@ -168,7 +168,7 @@ uintptr_t RunF066(x86emu_t *emu, uintptr_t addr)
                         } while(arm_lock_write_h(ED, dec16(emu, tmp16u)));
 #else
                     pthread_mutex_lock(&emu->context->mutex_lock);
-                    ED->dword[0] = dec32(emu, ED->dword[0]);
+                    ED->word[0] = dec16(emu, ED->word[0]);
                     pthread_mutex_unlock(&emu->context->mutex_lock);
 #endif
                     break;