CVE-2026-41197: Rust Brillig Array Undersize From Discarded Element Typescve-2026-41197-rust-brillig-array-undersize-from-discarded-element-types
The `Array` heap-value-type variant stores its `size` as a raw `u32`, discarding the element-type-aware semi-flattened slot count. When the inner element type is composite (a tuple/struct that occupies multiple Brillig slots per element), allocations sized from this raw count under-allocate the heap buffer and allow out-of-bounds writes when foreign-call/ora
