[BUG] AVM transpiler wraps Brillig memory addresses into u16 operands

[Kuhai9801]

What are you trying to do?

Transpile Brillig bytecode to AVM bytecode while preserving the source memory addresses used by fixed-width AVM opcodes such as RETURN, CALLDATACOPY, and related helpers.

Code Reference

Public repro:

https://github.com/Kuhai9801/aztec-avm-address-truncation-ci/actions/runs/27598108031

The guarded repro checks the audited source patterns in:

avm-transpiler/src/transpile.rs

at commit 872362d2dc1dc2dd09538a90425e3f26df967575, including to_u32() as u16 lowerings.

Aztec Version

next at 872362d2dc1dc2dd09538a90425e3f26df967575.

OS

Reproduced in public GitHub Actions on Ubuntu.

Browser

N/A.

Node Version

N/A.

Additional Context

Expected: if a Brillig MemoryAddress does not fit in a fixed u16 AVM operand, transpilation should reject it or otherwise preserve the high bits.

Actual: MemoryAddress(70000) lowers to U16(4464), and distinct Brillig addresses 4464 and 70000 encode to the same AVM operand.

The affected lowering should reject out-of-range addresses or preserve the full Brillig address instead of silently wrapping.