From b28f80f1a426cf5e1fb2dea455d3e6b31833b9ed Mon Sep 17 00:00:00 2001
From: KeelrLeek <156356974+KeelrLeek@users.noreply.github.com>
Date: Wed, 7 Oct 2026 18:10:13 -0500
Subject: [PATCH] Queue skips catch and unwind funclets (they open on the
 parent's frame); ruling #12777

---
 harbor/queue.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/harbor/queue.py b/harbor/queue.py
index e491938..c33ebf0 100644
--- a/harbor/queue.py
+++ b/harbor/queue.py
@@ -207,6 +207,10 @@ class FunctionQueue:
             head = self.r.read(addr, 10) if int(facts[addr].get("size") or 0) == 10 else b""
             if head[:1] and 0xB8 <= head[0] <= 0xBF and head[5:6] == b"\xe9":
                 continue        # mov reg, imm32; jmp: an at-exit destructor thunk or an SEH handler stub (compiler's)
+            first = self.r.read(addr, 3)
+            if len(first) == 3 and first[0] in (0x8B, 0x8D, 0xFF, 0x83, 0xC7, 0x89) and (first[1] & 0xC7) == 0x45 \
+                    and first[2] >= 0x80:
+                continue        # opens on the parent's [ebp-x] with no frame: a catch or unwind funclet (ruling #12777)
             score, reasons = self.score(addr, facts, named, rejected, similar_readable, with_convention=False)
             ranked.append((score, addr, reasons))
         ranked.sort(reverse=True)