A full login hashed the password twice: once on the account login packet
(0x80) and again on the game login (0x91). The second one re-authenticates a
session authenticated milliseconds earlier, in the same process -- the auth id
guarding it is only issued by PlayServer, which is reachable only after the
first verify succeeded.
Now that the id is bound to the account and address it was issued to, matching
it is proof enough. Per-login game loop cost drops from ~17ms to ~8.5ms.
An id that is unknown, expired, or from another address is treated as an
invalid client and disconnected, which is what an unknown id already did. An id
that is live but issued for a different account proves nothing, so that login
falls back to verifying the password exactly as before.
Also adds the missing return on the unknown-id path, which previously fell
through with a default entry and nulled the client version.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
9da1d2e8ef