O'Neill shouldn't have access to ballistae, but does have access to ballistae.

[Huichelaar]

If you add

BLST [6,22] 0x35

to the traps in Events/Release_map.event and start Boss Rush, O'Neill's danger radius implies he can access the ballista, even when his class and character structs have the relevant bit unset.

[masterofcontroversy]

Looks like the cause of the issue is the range display code using r12/ip for a check ballista flag and expecting it to remain untouched through function calls.

SkillSystem_FE8/EngineHacks/Necessary/ItemRangeFix/RangeDisplay/All_Moveable_Squares.s

Line 21 in ec33765

mov r12,r1 @r12 has ballista check flag

SkillSystem_FE8/EngineHacks/Necessary/ItemRangeFix/RangeDisplay/Write_Range.s

Lines 4 to 8 in ec33765

	@r0 has x, r1 has y, r2 has bitfield, r3 has halfword, r12 has ballista flag
	push {r4-r7,r14}
	mov r7,r8
	push {r7}
	mov r8,r12

In this particular case, GetInitialSkillList overwrites r12/ip while being used for testing range skills.