aarch64: Cranelift's apple_aarch64 calling convention writes past the end of outgoing arguments

[alexcrichton]

This input:

test run
set enable_llvm_abi_extensions=true
target aarch64

function %callee(i64, i64, i64, i64, i64, i64, i64, i64, i64, i16 sext, i16 sext, i8 sext) -> i64 apple_aarch64 {
block0(v0: i64, v1: i64, v2: i64, v3: i64, v4: i64, v5: i64, v6: i64, v7: i64, v8: i64, v9: i16, v10: i16, v11: i8):
    return v0
}

function %caller() -> i64 {
    ss0 = explicit_slot 8
    sig0 = (i64, i64, i64, i64, i64, i64, i64, i64, i64, i16 sext, i16 sext, i8 sext) -> i64 apple_aarch64
    fn0 = %callee sig0
block0:
    v0 = iconst.i64 0
    v20 = iconst.i64 0x1122_3344_5566_7788
    v21 = stack_addr.i64 ss0
    store.i64 v20, v21
    v1 = iconst.i16 -1
    v2 = iconst.i8 -1
    v3 = call fn0(v0, v0, v0, v0, v0, v0, v0, v0, v0, v1, v1, v2)
    v4 = load.i64 v21
    return v4
}
; run: %caller() == 0x1122334455667788

yields:

$ cargo run -p cranelift-tools --target aarch64-unknown-linux-gnu test ./repro_i16.clif
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.08s
     Running `qemu-aarch64 -L /usr/aarch64-linux-gnu -E LD_LIBRARY_PATH=/usr/aarch64-linux-gnu/lib -E WASMTIME_TEST_NO_HOG_MEMORY=1 /home/alex/code/wasmtime2/target/aarch64-unknown-linux-gnu/debug/clif-util test ./repro_i16.clif`
[2026-07-25T00:52:00Z ERROR cranelift_filetests::concurrent] FAIL: run
FAIL ./repro_i16.clif: run

Caused by:
    Failed test: run: %caller() == 1234605616436508552, actual: 1234605619298697215
1 tests
Error: 1 failure

A full LLM writeup, if it's useful, is here