Beamos Hit Detection Glitch

Beamos Hit Detection Glitch

Ocarina of Time: https://www.youtube.com/watch?v=rd9T-qE9J4Y
Majora's Mask: https://www.youtube.com/watch?v=3GbKicciTRY

As usual, the following addresses are for Ocarina of Time NTSC 1.0. Also note that I haven't looked into the Majora's Mask version of the glitch.

When a Beamos is hit by a weapon-like entity, a pointer value located at  Instance + 0x258 (a common collision structure) + 0x08 stores a pointer to what actor instance has struck it. However, when stunned by a Deku Nut, the Beamos seems to stop detecting what actor is hitting it (if any) every frame which in turn causes the pointer's value to get stale, allowing the Deku Nut to be de-allocated several frames before the pointer value is updated to null again.

Beamos call function 800264C8 to detect whether it has been bombed. To do so, this function checks the value of the Instance + 0x258 + 0x08 pointer to see if it's not null, then if so checks the byte at the pointed instance + 0x02  to see if it stores an 0x03, representing that the actor is an explosive type actor.

On being struck by a Deku Nut, the Beamos transitions to an animation state where it closes it's eye, lasting for 10 frames. During this state, the Beamos continuously checks to see if it's being hit by an explosive. Since the Deku Nut is deallocated before the animation ends, it's possible to load in another actor or other entity in it's place. If whatever is being loaded writes an 0x03 at the old Deku Nut Instance + 0x02 address, the Beamos will detect that it's been hit by a Bomb.

In the Master Quest video linked above, the sequence of events that occurred most likely happened as such:

*  When a Deku Nut is first thrown, it actually begins it's life as an Arrow actor. Because arrow actor instances are bigger than both Bomb and Deku Nut instances, there must have been a small gap of free space viable for allocating the Deku Nut and Bomb instances, but not the Arrow actor (a difference of a few bytes in NTSC 1.0).
*  The Arrow instance spawns a Deku Nut instance, which in turn stuns all 4 Beamos, causing all 4 to store a reference to the Deku Nut instance.
*  The Deku Nut instance is no longer needed, and is de-allocated, which allows space for the Bomb instance to be loaded
*  When the Bomb is drawn out, it overwrites the remnants of the Deku Nut instance, causing all 4 Beamos to detect that they've been hit by a Bomb.
*  All 4 Beamos decrement their health by 1. The Beamos on the far end dies due to the fact that it only has 1 health, instead of 2 like the rest.

Final Notes:

Pressing C-Up allows you to complete Link's Deku Nut throw animation, allowing you to use an item instantly afterwards. This can be useful to make the trick a little less precise, though I don't think it will change the frame that the Deku Nut despawns.