/// Soundness PoC (newyork type inference): a value stored to the free-memory-pointer
/// slot `0x40` must not be narrowed to a 64-bit pointer width when it is also
/// observable at full width elsewhere.
///
/// `f0`'s parameter `p0` is stored to the FMP slot (`mstore(64, p0)`) — which
/// inference treated as a bounded pointer and narrowed to i64 — but `p0` is also
/// stored full-width at offset 8 and read back by `mload(24)`. The i64 narrowing
/// of the parameter inserts a call-boundary guard that traps (consumes all gas)
/// when a caller passes an argument `>= 2^64`. The first call passes `b`
/// (`calldataload(32)`, a full 256-bit word), so newyork ran out of gas where EVM
/// (and the stock pipeline) execute successfully. The fix records the FMP-stored
/// value as an ordinary full-width memory value.
object "FnNativeFmpBug" {
  code { datacopy(0, dataoffset("FnNativeFmpBug_deployed"), datasize("FnNativeFmpBug_deployed")) return(0, datasize("FnNativeFmpBug_deployed")) }
  object "FnNativeFmpBug_deployed" {
    code {
      let a := calldataload(0) let b := calldataload(32) let d := calldataload(96) let r := 0
      function f0(p0, p1) -> ret {
        mstore(8, p0)
        mstore(64, p0)
        mstore8(8, p1)
        ret := mload(24)
      }
      r := add(mul(r, 0x100000001b3), f0(b, a))
      r := add(mul(r, 0x100000001b3), f0(2719014241053524200, d))
      r := add(mul(r, 0x100000001b3), f0(391540675041506305, b))
      mstore(0, r)
      return(0, 32)
    }
  }
}