HIGH_BIT_ALLOC_POINTER

ooballoc.wat (86 bytes) — warp_alloc returns 0x8000_0000: an alloc pointer with bit 31 set. Signed-int narrowing would wrap it negative and WRITE the marshalled args below the linear-memory base — a sandbox-escape OOB host-memory write.