Fix calling convention preconditions

[nspin]

Before this fix, the preconditions for function calls at the assembly level were too weak. In particular, in the case of a function which returns a large value on the stack, they allowed for a return value region in high memory that wraps around 0, potentially clobbering a stack in low memory. This prevented the tool from being able to verify refinement in a few specific cases, as the SMT solver was able to find counterexamples where this clobbering happens.

This fix strengthens the preconditions to forbid such clobbering, aligning with the calling convention we are modeling.

This fix effectively changes part of the precondition from sp <= r0 && sp <= r0 + len(var_c_rets) to sp <= r0 <= r0 + len(var_c_rets). The former permits the problematic case where r0 + len(var_c_rets) < r0, whereas the latter does not.

[nspin]

I know that this branch isn't under development, I just wanted to document this bug with a concrete fix.

As far as I can tell, this bug is also present in the decompilation-test branch, but I haven't been able to experiment due to other confounding bugs.

[Xaphiosis]

I'd suggest a first-line of "disallow stack value return wrap-around" or something, but other than that thumbs up. Sad to hear that it sounds like there are many other confounding bugs, but nice to see improvement!

[lsf37]

Cool, nice to see improvements on this. The style checker is complaining because the entire file is probably non-compliant. Would you mind adding a separate commit that applied the style fix?