Hojun-Cho
b86b9d76e2
Pre-fix the N_UN TK_STAR arm applied the generic pointer-load `MOVQ (AX), AX` to a *fn operand. cgexpr on the operand already left AX = fn-addr (post-#180 LEAQ); the spurious second load read the first instruction word, and the subsequent CALL AX jumped through that junk address and segfaulted. Cstage: cmd/w6c/cgen.c N_UN TK_STAR opens with a TY_NAMED-peel + TY_FN early-break — leave AX as the fn-addr cgexpr produced. Wwstage twin in selfhost/cmd/wcc/cgenexpr.ww cgun TK_STAR walks the n.type_ tinfo chain the same way (TY_NAMED peel then TY_FN check) and returns before the generic load. Mirrors ref/harec/src/check.c expr_call's STORAGE_POINTER→STORAGE_FUNCTION path (harec skips the deref since the pointer IS the address). Both stages must land together per rule-10 (cstage-only would break 990-997 byte-id gates — same lesson as #180). Probe: test/wcc/765_star_fn_deref.c, 5 rows table-driven — minimal / branched-callee / alias-chain / fn-with-args / fn-tuple-return. Every row is cstage-only via stage_mask because wwstage's checker bails asserttyped on `(*f)(...)` (filed as #181 — N_CALL type_ stamp gap on deref-call); #181's own probe will lock the wwstage runtime once the bail lifts. Gate-blind risk (ken's note): byte-id alone cannot catch this class because both stages drop the SAME instruction symmetrically, so cs.s == ww.s holds either way. Runtime exit-code is the only correctness net here. Combined.ww regenerated for selfhost/cmd/{w6c,wwdump}/main. combined.ww per #110 freshness gate.