From c1c397d559b9247abe17f64a6a18940587d34887 Mon Sep 17 00:00:00 2001
From: chaosratel <138471433+kiffpuppygames@users.noreply.github.com>
Date: Mon, 2 Nov 2026 19:12:35 +0000
Subject: [PATCH] fix: SCRIPT_FUNCTION fields after executeFunction sit 8 bytes
 later

SCRIPT_FUNCTION is one entry of the game's console-command and
script-command arrays. In Starfield 1.16.244 an entry is still 0x58
bytes, but + 0x38 is a single byte written with executeFunction (then 7
bytes of padding), compileFunction is at + 0x40, conditionFunction at
+ 0x48 and the two flag bytes at + 0x50 and + 0x51. The declared layout
keeps Fallout 4's field order with the 8 extra bytes at the end, so the
size check passed.

TESConditionItem::IsTrue (71429) calls the condition function from
+ 0x48, the script compiler (65834) calls the compile function from
+ 0x40, and the function that copies the entries into the arrays (46078)
copies exactly these offsets. The flag names carry over by position only.

Code that tests compileFunction == nullptr reads the always-zero byte at
+ 0x38 today and the real compile pointer, set in every filled entry,
after this.
---
 include/RE/S/Script.h | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/include/RE/S/Script.h b/include/RE/S/Script.h
index 817646f1..7d0fc1e1 100644
--- a/include/RE/S/Script.h
+++ b/include/RE/S/Script.h
@@ -74,17 +74,16 @@ namespace RE
 		std::uint32_t       pad24;                // 24
 		SCRIPT_PARAMETER*   params;               // 28
 		ExecuteFunction_t   executeFunction;      // 30
-		void*               compileFunction;      // 38
-		ConditionFunction_t conditionFunction;    // 40
-		std::uint8_t        editorFilter;         // 48
-		std::uint8_t        invalidatesCellList;  // 49
-		std::uint8_t        unk4A;                // 4A
-		std::uint8_t        unk4B;                // 4B
-		std::uint8_t        unk4C;                // 4C
-		std::uint8_t        unk4E;                // 4D
-		std::uint8_t        unk4F;                // 4F
-		std::uint8_t        unk50;                // 50
-		std::uint8_t        unk51;                // 51
+		std::uint8_t        unk38;                // 38
+		std::uint8_t        pad39;                // 39
+		std::uint16_t       pad3A;                // 3A
+		std::uint32_t       pad3C;                // 3C
+		void*               compileFunction;      // 40
+		ConditionFunction_t conditionFunction;    // 48
+		std::uint8_t        editorFilter;         // 50
+		std::uint8_t        invalidatesCellList;  // 51
+		std::uint16_t       pad52;                // 52
+		std::uint32_t       pad54;                // 54
 	};
 	static_assert(sizeof(SCRIPT_FUNCTION) == 0x58);