@@ -31,6 +31,7 @@ __pycache__/
 *.pyc
 
 docs/dependency-tree.md
+docs/TODO.md
 
 # NuGet packages produced by dotnet pack
 artifacts/
 
@@ -26,6 +26,19 @@ Drops `net8.0`, adds macOS support, and removes `ImGui4NET.Backend.Null`.
   architectures.
 - Backends for macOS: `OpenGL2`, `OpenGL3`, `Glut`, `Metal`, `Metal4` and `OSX`.
   GLFW, SDL2/3 and Vulkan need headers that are not part of the SDK.
+- **Fix: `MemoryEditor` crashed with `0xC0000005`.** `Button("Options", null)`
+  and `BeginChild("##scrolling", null, ...)` passed a null pointer to a
+  `const ImVec2&` parameter, which Dear ImGui dereferences unconditionally. Both
+  now pass a zeroed `ImVec2`, matching what `ImGui::Button(label)` does in C++.
+  C++ references are generated as nullable pointers, so the compiler could not
+  catch this; a by-reference parameter would be `in ImVec2`/`ref ImVec2` instead.
+- `Glut.MouseWheelFunc` is marked `[Obsolete]` with an explanation. Dear ImGui
+  declares it unconditionally in `imgui_impl_glut.h` but compiles the body only
+  under `__FREEGLUT_EXT_H__`, which Apple's GLUT framework does not define, so
+  the macOS dylibs export 11 of the 12 declared entry points. One binding
+  assembly serves every RID, so the method stays — calling it on macOS throws
+  `EntryPointNotFoundException`, and the attribute makes that a compile-time
+  warning at the call site instead of a runtime surprise.
 - **New package `ImGui4NET.Backend.Metal4`.** Metal 4 renderer backend for
   `osx-arm64` only. Unlike every other backend it records `minos=26.0`
   (`-mmacosx-version-min=26.0`), because `imgui_impl_metal4.mm` binds
@@ -58,6 +71,9 @@ Drops `net8.0`, adds macOS support, and removes `ImGui4NET.Backend.Null`.
   - `ImTextureQueue`'s per-texture records stay in native memory: their address
     is stored in `ImTextureData.QueueUserData` and dereferenced by the render
     thread.
+    - `ImDrawDataSnapshot` reuses one key buffer instead of allocating a new
+      `uint[]` on every `NewFrame`, so the steady-state snapshot path is
+      allocation-free.
 - `Metal` and `OSX` are Objective-C++. Their bindings come from
   `tools/gen-objc-backend.sh`, which parses with `-x objective-c++` and hands the
   header to `postprocess.py --macho-symbols`: a Mach-O symbol table stores every
 
@@ -1,6 +1,7 @@
 using System.Drawing;
 using System.Drawing.Imaging;
 using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
 using OpenTK.Graphics.OpenGL4;
 using GlPixelFormat = OpenTK.Graphics.OpenGL4.PixelFormat;
 
@@ -11,6 +12,7 @@ namespace ImGui4NET.Sample.OpenGL3;
 /// inspected without a live window. Press F12, or pass a path on the command
 /// line to grab a frame automatically.
 /// </summary>
+[SupportedOSPlatform("windows")]
 internal static class Screenshot
 {
     /// <summary>Reads the current back buffer and writes it as a PNG.</summary>
 
@@ -33,7 +33,7 @@
     -->
     <PropertyGroup>
       <ImGuiVersion Condition="'$(ImGuiVersion)' == ''">1.93.0</ImGuiVersion>
-      <LibraryRevision Condition="'$(LibraryRevision)' == ''">3</LibraryRevision>
+      <LibraryRevision Condition="'$(LibraryRevision)' == ''">4</LibraryRevision>
 
       <Version>$(ImGuiVersion).$(LibraryRevision)</Version>
       <AssemblyVersion>$(Version)</AssemblyVersion>
 
@@ -33,6 +33,13 @@ public static partial class Methods
         [DllImport("imgui_backend_glut", CallingConvention = CallingConvention.Cdecl, EntryPoint = "_Z24ImGui_ImplGLUT_MouseFunciiii", ExactSpelling = true)]
         public static extern void MouseFunc(int button, int state, int x, int y);
 
+        /// <remarks>
+        /// Unavailable on macOS: <c>imgui_impl_glut.cpp</c> compiles the body
+        /// only under <c>__FREEGLUT_EXT_H__</c>, which Apple's GLUT framework
+        /// does not define, so the symbol is missing from the macOS dylib.
+        /// Calling this there throws <see cref="EntryPointNotFoundException"/>.
+        /// </remarks>
+        [Obsolete("MouseWheelFunc is not available on macOS.")]
         [DllImport("imgui_backend_glut", CallingConvention = CallingConvention.Cdecl, EntryPoint = "_Z29ImGui_ImplGLUT_MouseWheelFunciiii", ExactSpelling = true)]
         public static extern void MouseWheelFunc(int button, int dir, int x, int y);
 
 
@@ -45,6 +45,10 @@ private sealed class Entry
 
     private readonly Dictionary<uint, Entry> _cache = [];
 
+    // Scratch buffer reused by CompactUnused so a steady-state snapshot does not
+    // allocate a fresh key array every frame.
+    private uint[] _compactKeys = [];
+
     /// <summary>
     /// Releases every copied draw list and clears the snapshot.
     /// </summary>
@@ -123,21 +127,34 @@ private void CompactUnused(double currentTime)
     {
         double threshold = currentTime - MemoryCompactTimer;
 
-        uint[] keys = new uint[_cache.Count];
-        _cache.Keys.CopyTo(keys, 0);
+            int count = _cache.Count;
+            if (count == 0)
+            {
+                return;
+            }
 
-        foreach (uint key in keys)
-        {
-            Entry entry = _cache[key];
-            if (entry.LastUsedTime > threshold)
+            uint[] keys = _compactKeys;
+            if (keys.Length < count)
             {
-                continue;
+                keys = new uint[count * 2];
+                _compactKeys = keys;
             }
 
-            FreeDrawList(entry.OurCopy);
-            _cache.Remove(key);
+            _cache.Keys.CopyTo(keys, 0);
+
+            for (int index = 0; index < count; index++)
+            {
+                uint key = keys[index];
+                Entry entry = _cache[key];
+                if (entry.LastUsedTime > threshold)
+                {
+                    continue;
+                }
+
+                FreeDrawList(entry.OurCopy);
+                _cache.Remove(key);
+            }
         }
-    }
 
     /// <summary>Mirror of <c>ImDrawDataSnapshot::GetDrawListID</c>: hash of the pointer.</summary>
     private static uint GetDrawListID(ImDrawList* srcList)
 
@@ -113,6 +113,24 @@ public sealed unsafe class MemoryEditor : IDisposable
     private sbyte* _dataInputBuf;
     private sbyte* _addrInputBuf;
 
+    /// <summary>
+    /// Per-call payload handed to <see cref="DataInputCallback"/>.
+    /// </summary>
+    /// <remarks>
+    /// The address of an instance is passed as <c>user_data</c>, so it lives on
+    /// the stack for the duration of one <c>InputText</c> call and must stay
+    /// blittable.
+    /// <para>
+    /// <see cref="DataInputUserData.CurrentBufOverwrite"/> is <c>char[3]</c> in
+    /// C++ and holds the two hex digits plus a terminator.
+    /// </para>
+    /// </remarks>
+    private struct DataInputUserData
+    {
+        public fixed sbyte CurrentBufOverwrite[3];
+        public int CursorPos;
+    }
+
     private bool _disposed;
 
     // Scratch buffer for the data preview; needs no persistence.
@@ -310,7 +328,11 @@ public void DrawContents(void* memDataVoid, nuint memSize, nuint baseDisplayAddr
                 + ImGui.GetTextLineHeightWithSpacing() * 3f;
         }
 
-        ImVec2 scrollingSize = new() { x = -float.MinValue, y = -footerHeight };
+        // C++ writes this as ImVec2(-FLT_MIN, -footer_height): -FLT_MIN is the
+        // smallest positive normal negated, a sentinel meaning "fill the
+        // remaining width". C#'s float.MinValue is -FLT_MAX instead, which
+        // would make BeginChild clamp the width to 4 pixels and hide the data.
+        ImVec2 scrollingSize = new() { x = -1.17549435e-38f, y = -footerHeight };
         int childFlags = (int)ImGuiChildFlags.ImGuiChildFlags_None;
         int childWindowFlags = (int)ImGuiWindowFlags.ImGuiWindowFlags_NoMove
             | (int)ImGuiWindowFlags.ImGuiWindowFlags_NoNav;
@@ -393,9 +415,10 @@ public void DrawContents(void* memDataVoid, nuint memSize, nuint baseDisplayAddr
             ? ImGui.GetColorU32((int)ImGuiCol.ImGuiCol_TextDisabled)
             : colorText;
 
-        string addressFormat = OptUpperCaseHex ? "X" : "x";
+        // .NET has no "%02X " equivalent: a trailing space turns "X2 " into a
+        // custom format string that is emitted literally. The separator is
+        // appended after formatting instead.
         string byteFormat = OptUpperCaseHex ? "X2" : "x2";
-        string byteSpaceFormat = OptUpperCaseHex ? "X2 " : "x2 ";
 
         MouseHovered = false;
         MouseHoveredAddr = 0;
@@ -406,11 +429,11 @@ public void DrawContents(void* memDataVoid, nuint memSize, nuint baseDisplayAddr
             {
                 nuint addr = (nuint)lineI * (nuint)Cols;
 
-                DrawAddressLine(drawList, s, lineI, baseDisplayAddr, addr, colorText, addressFormat);
+                DrawAddressLine(drawList, s, lineI, baseDisplayAddr, addr, colorText, OptUpperCaseHex);
 
                 addr = (nuint)lineI * (nuint)Cols;
                 DrawHexCells(drawList, memData, memSize, s, ref addr, colorText, colorDisabled,
-                    byteFormat, byteSpaceFormat, previewDataTypeSize, ref dataNext, ref dataEditingAddrNext);
+                    byteFormat, previewDataTypeSize, ref dataNext, ref dataEditingAddrNext);
 
                 if (OptShowAscii)
                 {
@@ -469,7 +492,8 @@ private void HandleGotoRequest(nuint memSize, ImVec2 availSize)
 
         if (_gotoAddr < memSize)
         {
-            ImGui.BeginChild("##scrolling", null, 0, 0);
+            ImVec2 scrollingSize = new() { x = 0f, y = 0f };
+            ImGui.BeginChild("##scrolling", &scrollingSize, 0, 0);
             ImGui.SetScrollY((_gotoAddr / (nuint)Cols) * ImGui.GetTextLineHeight() - availSize.y * 0.5f);
             ImGui.EndChild();
 
@@ -543,18 +567,18 @@ private void HandleOptionsPopup(Sizes s, ImVec2 contentsPosStart, ImVec2 content
     // -----------------------------------------------------------------------
 
     private void DrawAddressLine(ImDrawList* drawList, Sizes s, int lineI, nuint baseDisplayAddr,
-        nuint addr, uint colorText, string digitsFormat)
+            nuint addr, uint colorText, bool upperCase)
     {
         _ = drawList;
         _ = colorText;
 
         nuint displayAddr = baseDisplayAddr + addr;
-        string text = FormatHex(displayAddr, s.AddrDigitsCount) + ": ";
+        string text = FormatHex(displayAddr, s.AddrDigitsCount, OptUpperCaseHex) + ": ";
         ImGui.TextUnformatted(text);
     }
 
     private void DrawHexCells(ImDrawList* drawList, byte* memData, nuint memSize, Sizes s,
-        ref nuint addr, uint colorText, uint colorDisabled, string byteFormat, string byteSpaceFormat,
+            ref nuint addr, uint colorText, uint colorDisabled, string byteFormat,
         nuint previewDataTypeSize, ref bool dataNext, ref nuint dataEditingAddrNext)
     {
         for (int n = 0; n < Cols && addr < memSize; n++, addr++)
@@ -617,13 +641,13 @@ private void DrawHexCells(ImDrawList* drawList, byte* memData, nuint memSize, Si
             }
             else
             {
-                DrawStaticByte(memData, addr, colorDisabled, byteFormat, byteSpaceFormat, ref dataEditingAddrNext);
+                DrawStaticByte(memData, addr, colorDisabled, byteFormat, ref dataEditingAddrNext);
             }
         }
     }
 
     private void DrawStaticByte(byte* memData, nuint addr, uint colorDisabled,
-        string byteFormat, string byteSpaceFormat, ref nuint dataEditingAddrNext)
+            string byteFormat, ref nuint dataEditingAddrNext)
     {
         byte b = ReadFn != null ? ReadFn(memData, addr, UserData) : memData[addr];
 
@@ -645,7 +669,7 @@ private void DrawStaticByte(byte* memData, nuint addr, uint colorDisabled,
             }
             else
             {
-                ImGui.TextUnformatted(b.ToString(byteSpaceFormat));
+                ImGui.TextUnformatted(b.ToString(byteFormat) + " ");
             }
         }
         else if (b == 0 && OptGreyOutZeroes)
@@ -656,7 +680,7 @@ private void DrawStaticByte(byte* memData, nuint addr, uint colorDisabled,
         }
         else
         {
-            ImGui.TextUnformatted(b.ToString(byteSpaceFormat));
+            ImGui.TextUnformatted(b.ToString(byteFormat) + " ");
         }
 
         if (ImGui.IsItemHovered() != 0)
@@ -672,19 +696,58 @@ private void DrawStaticByte(byte* memData, nuint addr, uint colorDisabled,
         }
     }
 
+    // Mirrors ImGuiInputTextCallbackData's HasSelection(). Kept as a helper
+    // because the generated struct exposes fields only.
+    private static bool HasSelection(ImGuiInputTextCallbackData* data)
+        => data->SelectionStart != data->SelectionEnd;
+
+    /// <summary>
+    /// Port of the <c>InputTextUserData::Callback</c> in the C++ original.
+    /// </summary>
+    /// <remarks>
+    /// <c>InputText</c> owns the master copy of the text it edits, so when the
+    /// user is not selecting anything the content is forced back to the byte
+    /// currently in memory. Without this the widget would keep whatever was
+    /// typed before the editor scrolled that address out of view.
+    /// <para>
+    /// The callback only runs because <c>CallbackAlways</c> is requested; Dear
+    /// ImGui asserts the pointer is non-null in that case, so passing a flag
+    /// without a callback aborts the process.
+    /// </para>
+    /// </remarks>
+    [UnmanagedCallersOnly(CallConvs = [typeof(CallConvCdecl)])]
+    private static int DataInputCallback(ImGuiInputTextCallbackData* data)
+    {
+        DataInputUserData* userData = (DataInputUserData*)data->UserData;
+        if (!HasSelection(data))
+        {
+            userData->CursorPos = data->CursorPos;
+        }
+
+        if (data->SelectionStart == 0 && data->SelectionEnd == data->BufTextLen)
+        {
+            ImGuiInputTextCallbackData.DeleteChars(data, 0, data->BufTextLen);
+            ImGuiInputTextCallbackData.InsertChars(data, 0, new string(userData->CurrentBufOverwrite));
+            data->SelectionStart = 0;
+            data->SelectionEnd = 2;
+            data->CursorPos = 0;
+        }
+
+        return 0;
+    }
+
     private void DrawEditingByte(ImDrawList* drawList, byte* memData, Sizes s, nuint addr,
         string byteFormat, ref bool dataNext, ref nuint dataEditingAddrNext)
     {
         _ = drawList;
-        _ = s;
 
         bool dataWrite = false;
         ImGui.PushID((void*)addr);
 
         if (_dataEditingTakeFocus)
         {
             ImGui.SetKeyboardFocusHere(0);
-            WriteCString(_addrInputBuf, InputBufSize, FormatHex(addr, s.AddrDigitsCount));
+            WriteCString(_addrInputBuf, InputBufSize, FormatHex(addr, s.AddrDigitsCount, OptUpperCaseHex));
 
             byte current = ReadFn != null ? ReadFn(memData, addr, UserData) : memData[addr];
             WriteCString(_dataInputBuf, InputBufSize, current.ToString(byteFormat));
@@ -704,7 +767,12 @@ private void DrawEditingByte(ImDrawList* drawList, byte* memData, Sizes s, nuint
 
         ImGui.SetNextItemWidth(s.GlyphWidth * 2f);
 
-        if (ImGui.InputText("##data", _dataInputBuf, InputBufSize, flags) != 0)
+        DataInputUserData userData = default;
+        userData.CursorPos = -1;
+        byte live = ReadFn != null ? ReadFn(memData, addr, UserData) : memData[addr];
+        WriteCString(userData.CurrentBufOverwrite, 3, live.ToString(byteFormat));
+
+        if (ImGui.InputText("##data", _dataInputBuf, InputBufSize, flags, &DataInputCallback, &userData) != 0)
         {
             dataWrite = dataNext = true;
         }
@@ -720,6 +788,12 @@ private void DrawEditingByte(ImDrawList* drawList, byte* memData, Sizes s, nuint
             dataWrite = dataNext = false;
         }
 
+        // A cursor past the first digit means the user finished the byte.
+        if (userData.CursorPos >= 2)
+        {
+            dataWrite = dataNext = true;
+        }
+
         if (!ReadOnly && dataWrite && TryParseHexByte(_dataInputBuf, out byte value))
         {
             if (WriteFn != null)
@@ -811,18 +885,19 @@ private void DrawOptionsLine(Sizes s, void* memData, nuint memSize, nuint baseDi
 
         ImGuiStyle* style = ImGui.GetStyle();
         string rangeFormat = OptUpperCaseHex
-            ? $"Range {FormatHex(baseDisplayAddr, s.AddrDigitsCount)}.."
-            : $"Range {FormatHex(baseDisplayAddr, s.AddrDigitsCount)}..";
+            ? $"Range {FormatHex(baseDisplayAddr, s.AddrDigitsCount, OptUpperCaseHex)}.."
+                        : $"Range {FormatHex(baseDisplayAddr, s.AddrDigitsCount, OptUpperCaseHex)}..";
 
-        if (ImGui.Button("Options", null) != 0)
+        ImVec2 optionsButtonSize = new() { x = 0f, y = 0f };
+        if (ImGui.Button("Options", &optionsButtonSize) != 0)
         {
             ImGui.OpenPopup("OptionsPopup");
         }
 
         ImGui.SameLine(0f, -1f);
         _ = rangeFormat;
         ImGui.TextUnformatted(
-            $"Range {FormatHex(baseDisplayAddr, s.AddrDigitsCount)}..{FormatHex(baseDisplayAddr + memSize - 1, s.AddrDigitsCount)}");
+            $"Range {FormatHex(baseDisplayAddr, s.AddrDigitsCount, OptUpperCaseHex)}..{FormatHex(baseDisplayAddr + memSize - 1, s.AddrDigitsCount, OptUpperCaseHex)}");
 
         ImGui.SameLine(0f, -1f);
         ImGui.SetNextItemWidth((s.AddrDigitsCount + 1) * s.GlyphWidth + style->FramePadding.x * 2f);
@@ -1055,8 +1130,8 @@ private static string FormatBinary(byte* buf, int width)
     // Small helpers
     // -----------------------------------------------------------------------
 
-    private static string FormatHex(nuint value, int digits)
-        => value.ToString("X" + digits.ToString());
+    private static string FormatHex(nuint value, int digits, bool upper)
+            => value.ToString((upper ? "X" : "x") + digits.ToString());
 
     private static void WriteCString(sbyte* buffer, int size, string text)
     {