Call Chaos crash

[Seravy]

You can see it at the end of this video.
https://www.youtube.com/watch?v=ePdAWl8fJW8

Confirmed to be present in 1.31 as well as CoM.
However, you need to install W122 and W204 to enable the AI to cast it, as there is a bug preventing the AI to cast the spell in most (not all) combats.

What I managed to find out so far :
-Removing the call at $B028C fixes the bug, but messes up the display. It's a call to an EGA display procedure, used everywhere in the game. It can't be the source of the bug, even though it is.
-The above procedure seems to use the memory reserved for battle units, which might be related. However, this data is supposed to be loaded back afterwards. Plenty of other display related stuff does that without problems, even opening the spellbook does.
-There is no crash if the caster is the player, or the player's hero. It only seems to happen if the caster is the AI's hero or the AI itself.
-The crash doesn't seem to happen on turn 1, only on turn 2 (if the attacker is the AI, they don't have a turn one, only the defender has a turn 1), which is weird.
-The crash seems to happen before the effects are drawn or are applied, but after the sound.

Any idea or information is welcome, I'm somewhat stuck.
The greatest problem is I found absolutely no connection between what causes the crash (specifically the AI using the spell) and where it happens (during the call to a display procedure which works perfectly everywhere else.).

There might be some sort of a memory corruption prior to casting the spell, which is responsible for this.
Edit : Auto isn't triggering the bug either if the hero casts the spell on the player's side. Auto does use the same process the AI does so this would rule out the memory corruption coming from there.

I'm out of ideas.

While disabling the call to the graphics procedure does let the battle continue without a crash, it also means nothing appears on screen, not even the "X has cast" message. A quite unacceptable solution, only slightly better than the crash itself, all that damage coming out of nowhere.

[FrancoK]

1. If it crash during AI turn, but not during player turn, the spell could use a temporary space needed by AI and not needed by player.
If there is a buffer for AI and one for P with starting/finishing addresses, check if the spell access AI buffers.

2. Maybe the procedure called by AI pushes more info in the stack that it pulls or the opposite; during/before/after the call.

3. Since the procedure called is video related, maybe there is an offset out of range that corrupts memory, difficult to get without a variable check.

[Seravy]

1. If it crash during AI turn, but not during player turn, the spell could use a temporary space needed by AI and not needed by player.
If there is a buffer for AI and one for P with starting/finishing addresses, check if the spell access AI buffers.

2. Maybe the procedure called by AI pushes more info in the stack that it pulls or the opposite; during/before/after the call.

I think these would make it always crash, not just half the time. I've had games where it never crashed, in the one I'm using to test, it always crashes on turn 2 of the combat and never on turn 1, the AI can cast it during turn 1.

3. Since the procedure called is video related, maybe there is an offset out of range that corrupts memory, difficult to get without a variable check.

I believe this is the most likely reason. I don't understand why auto is not doing the same though, as it is also handled by the AI.
There isn't anything Call Chaos specifically does differently than other spells while being selected for casting as far as I know, but I'll check again when I have time for it.