One of them appends; the other shifts live cells around inside storage. That difference is a use-after-free from plain JS under GC pressure.

Declaration order alone decided whether a multi-memory module was rejected. IPInt then had to bounds-check a pairing the validator promised it would never see.

Element-segment offsets above 4 GiB landed at index 0 instead of failing instantiation, carrying attacker-chosen funcrefs. WebKit fixed this class once already, one path over.

A table64 maximum just past 2^32 narrows on the way into storage, so every consumer looks right in isolation. One of those consumers is a JIT constant.