See the Caos Coding Cave for details, but here's the summary.
The function that determines which CA index to use returns -1 here and this is never caught.
Immediately preceding the values determining CA state is the room type, so this gets mucked with as if it was a floating-point value (but it's not one!).
Subtracting (presumably) zero to something that, as a floating-point number, is almost zero results in zero.
If the subtracted amount is enough to make the type-float negative (could occur if the agent has a CA emission enabled), this would probably result in a very wrong type.
This last point may explain the crashes as room types are checked in an unverified manner during exactly one function.
However this wouldn't be completely consistent because the APPR command attempts to restore the existing state afterwards, so it comes down to floating-point demons.
This hasn't yet been 100% confirmed, so I haven't edited it into the main page yet. Peer review required.
However the changes I just made regarding which rooms are affected can be proven with a room type monitoring script ( https://github.com/20kdc/c3ds-projects/blob/main/caosproxy/tools/wastemon.py ). --20kdc 14:14, 21 June 2022 (UTC)