AIKIDO-2026-875537

TL;DR

The fast interpreter compiles a module in two passes while loading it. A constant-deduplication mismatch lets the second pass make different const-offset decisions than the first, so it emits copy operations that were not accounted for when the code buffer was sized. Loading a crafted module therefore writes past the end of the allocated code buffer on the heap before any guest code runs. The fix keeps the deduplication decisions consistent across both passes.