Sandbox escape via incorrect narrow-value reload extension

Out-of-bounds memory access in Wasmtime using Cranelift 0.73.0 allows context-dependent attackers to read memory outside the WebAssembly heap. The x64 register allocator sign-extends a spilled i32 during reload even when instruction selection removed a required zero-extension, allowing pointer arithmetic to address memory up to 2 GiB before the heap. Exploitation requires the new x64 backend, a qualifying value and spill sequence, and accessible mapped memory outside the heap; bounds checks or a sufficient guard region prevent cross-heap access.