diff --git a/help/afl.sh b/help/afl.sh
new file mode 100644
index 000000000..02d4363fa
--- /dev/null
+++ b/help/afl.sh
@@ -0,0 +1,32 @@
+#!/bin/sh
+: "${AFL_PREFIX:=afl-}"
+: "${AFL_CC:=afl-gcc}"
+: "${RESULT_DIR:=${AFL_PREFIX}result}"
+
+clean_lib() {
+  echo "🛀 cleaning $1"
+  cd "$1" && make clean all && cd ..
+}
+
+compile() {
+  export CC="$AFL_CC"
+  clean_lib util
+  clean_lib ast
+  clean_lib "$PWD"
+}
+
+prepare() {
+  CRASH_DIR=${AFL_PREFIX}crash
+  if [ -d "$CRASH_DIR" ]
+  then echo "✋ $CRASH_DIR already contains at risk data"
+  else mkdir "$CRASH_DIR"
+  fi
+  for file in "$RESULT_DIR"/*/crashes/id*
+  do
+    NEW_NAME="$(basename "$file" | sed 's/id:0*\([0-9]*\),.*/\1.gw/')"
+    cp "$file" "$NEW_NAME"
+  done
+}
+
+#compile
+prepare
diff --git a/help/struct_check.sh b/help/struct_check.sh
index 6e906358a..34fa0af36 100755
--- a/help/struct_check.sh
+++ b/help/struct_check.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 : "${PRG:=./gwion}"
 
-pahole -s ${PRG} | while read name size gap
-do [ $size -gt 64 ] && echo $name $size
-   [ $gap -gt 0 ] && echo "$name has a gap"
+pahole -s ${PRG} | while read -r name size gap
+do [ "$size" -gt 64 ] && echo "$name $size"
+   [ "$gap" -gt 0 ] && echo "$name has a gap"
 done
diff --git a/help/test.sh b/help/test.sh
index cb5825880..6ae46d1ac 100644
--- a/help/test.sh
+++ b/help/test.sh
@@ -465,7 +465,7 @@ clean() {
 [ -f test.log ] && rm test.log
 [ $# -ne 0 ] && do_test "${@}" | consummer
 
-if [ -f test.log ] && [ -z $NO_LOG ]
+if [ -f test.log ] && [ -z "$NO_LOG" ]
 then
   cat test.log
   exit 1
diff --git a/src/emit/emit.c b/src/emit/emit.c
index 641f2da3e..2d9a3e0c7 100644
--- a/src/emit/emit.c
+++ b/src/emit/emit.c
@@ -165,9 +165,10 @@ ANN static void emit_pre_ctor(const Emitter emit, const Type type) {
 }
 
 #define regxxx(name, instr) \
-ANN static inline void reg##name(const Emitter emit, const m_uint sz) { \
+ANN static inline Instr reg##name(const Emitter emit, const m_uint sz) { \
   const Instr instr = emit_add_instr(emit, Reg##instr); \
   instr->m_val = sz; \
+  return instr; \
 }
 regxxx(pop, Pop)
 regxxx(pushi, PushImm)
@@ -210,9 +211,13 @@ ANN ArrayInfo* emit_array_extend_inner(const Emitter emit, const Type t, const E
 ANN void emit_ext_ctor(const Emitter emit, const VM_Code code) {
   const Instr cpy = emit_add_instr(emit, Reg2Reg);
   cpy->m_val2 = -SZ_INT;
-  regpushi(emit, (m_uint)code);
+  const Instr set_code = regseti(emit, (m_uint)code);
+  set_code->m_val2 = SZ_INT;
   const m_uint offset = emit_code_offset(emit);
-  regseti(emit, offset);
+  const Instr regset = regseti(emit, offset);
+  regset->m_val2 = SZ_INT *2;
+  const Instr push = emit_add_instr(emit, RegPush);
+  push->m_val = SZ_INT *2;
   const Instr prelude = emit_add_instr(emit, !GET_FLAG(code, builtin) ? FuncUsr : FuncMember);
   prelude->m_val2 = 2;
   prelude->m_val = SZ_INT;
@@ -573,7 +578,7 @@ ANN static m_bool emit_exp_decl_non_static(const Emitter emit, const Var_Decl va
     if(missing_depth) {
       const Instr push = emit_add_instr(emit, Reg2Reg);
       push->m_val = -(1 + missing_depth) * SZ_INT;
-      regpop(emit, (missing_depth + 1) * SZ_INT);
+      regpop(emit, (missing_depth) * SZ_INT);
     }
   }
   return GW_OK;
@@ -881,6 +886,8 @@ ANN m_bool emit_exp_call1(const Emitter emit, const Func f) {
     m_uint val2 = back->m_val2;
     back->opcode = eReg2Reg;
     back->m_val = SZ_INT;
+    const Instr push = emit_add_instr(emit, RegPush);
+    push->m_val = SZ_INT;
     const Instr instr = emit_add_instr(emit, (f_instr)(m_uint)exec);
     instr->m_val = val;
     instr->m_val2 = val2;
diff --git a/src/lib/func.c b/src/lib/func.c
index ca08dcdb3..1c63f774c 100644
--- a/src/lib/func.c
+++ b/src/lib/func.c
@@ -211,9 +211,9 @@ static OP_EMIT(opem_fptr_cast) {
     fptr_instr(emit, cast->exp->type->e->d.func, 1);
   if(GET_FLAG(cast->exp->type->e->d.func, member)) {
     const Instr instr = emit_add_instr(emit, RegPop);
-    instr->m_val = SZ_INT*2;
+    instr->m_val = SZ_INT;
     const Instr dup = emit_add_instr(emit, Reg2Reg);
-    dup->m_val2 = SZ_INT;
+    dup->m_val = -SZ_INT;
   }
   return GW_OK;
 }
diff --git a/src/vm/vm.c b/src/vm/vm.c
index 11610db16..876fcf09c 100644
--- a/src/vm/vm.c
+++ b/src/vm/vm.c
@@ -362,7 +362,6 @@ ANN void vm_run(const VM* vm) { // lgtm [cpp/use-of-goto]
   DISPATCH();
 regtoreg:
   *(m_uint*)(reg + (m_int)instr->m_val) = *(m_uint*)(reg + (m_int)instr->m_val2);
-  reg += SZ_INT;
   DISPATCH()
 regtoregaddr:
   *(m_uint**)reg = &*(m_uint*)(reg-SZ_INT);