OOB_IN_RANGE_RESULT

oobinrange.wat (88 bytes) — the vector the three high-bit siblings above cannot express: warp_run returns (resPtr = 65530, resLen = 100) on a one-page memory. Neither word has bit 31 set, the pointer is an ordinary offset inside linear memory, and the window [65530, 65630) runs 94 bytes past the end of it.

HIGH_BIT_RESULT_POINTER, HIGH_BIT_RESULT_LENGTH and HIGH_BIT_ALLOC_POINTER all fail the same way — bit 31 set — so a host whose only guard is if (word < 0) reject passes every one of them and still reads past the end of linear memory here. That is the whole reason this vector exists; see WasmRuntimeConformanceSuite.resultWindowPastMemoryEndIsBounded.