parse_code reads an NVN2 stage's Ampere instructions until ProgramCaptureState
says the program ended. The capture's end rules are narrower than the
lowering's (a loop left only by predicated EXITs ends at its closing branch
to itself; a library function can end the shader with EXIT), so it can read
on past the program's end. A word there that decodes as a branch to before
the start, between two instructions or 1 MiB or more on refused the whole
program: compute program 79116b290d46542f, "the branch at instruction 16404
(+0x40140) goes outside the program", on every platform.

Now the capture ends before that word. The lowering, which takes a program
only to its own end with every branch inside it, decides: the program
translates if it ends before the word (one log line says so), and is refused
for the word, as before, if the code before it does not lower. Programs that
parsed before are unchanged: the capture refuses exactly the same words.

The same in the four other copies of the capture loop: the WebGPU renderer
(rx_shader.cpp), the bake tools (shaderbatch.cpp, bake_ds.cpp) and shadertool.

tests/test_capture_past_end.py compiles parse_code from the source over
synthetic packages built in the test.

Assisted-by: Claude Opus 5.5
Co-Authored-By: Claude Opus 5.5 <[email protected]>

@@ -3329,0 +3338,4 @@
+            // (longshot) BRX goes to the table's value plus its own address plus its offset, which reaches back only 8 MiB
+            // (24 bits). Past that, JMX: the value plus the offset alone, -8 (the frontend's AnalyzeBRX adds the 8 back)
+            const s64 back = -s64{address_of(static_cast<u32>(result.instructions.size()))} - 8;
+            const bool absolute = back < -0x800000;