The non-register branch of OP.DEC in Z80IL.py reuses the loaded value as the store address:
mem = operand_to_il(oper_type, oper_val, il, 1) # this is a load
tmp = il.sub(1, mem, il.const(1, 1), flags="not_c")
tmp = il.store(1, mem, tmp) # ...used as an address
35 (DEC (HL)) lifts as [[HL].b].b = sub.b{not_c}([HL].b, 1) — it stores to the address formed by the loaded byte.
OP.INC handles the same operand correctly with peel_load=True; DEC should match. 19 sites in one test binary.
The non-register branch of
OP.DECinZ80IL.pyreuses the loaded value as the store address:35(DEC (HL)) lifts as[[HL].b].b = sub.b{not_c}([HL].b, 1)— it stores to the address formed by the loaded byte.OP.INChandles the same operand correctly withpeel_load=True;DECshould match. 19 sites in one test binary.