Program crash via incorrect LR restoration tracking

Code-generation error in LLVM before 18.1.3 allows attackers to crash affected ARM programs through corrupted return control flow. The ARM load/store optimizer marks LR as restored after examining only the return instruction it changes, rather than every return in the function, so later register allocation can overwrite an unspilled return address. Exploitation requires a susceptible function to be compiled with the ARM backend; the resulting program usually crashes on valid inputs, although the corrupted return can form a jump-oriented-programming gadget.