From the March 2026 audit (commit `13917ea1`):
`ParseState` packs RHS operation counters into `topLevel0`/`topLevel1`. Memory byte `0x5F` (last byte of `topLevel1`) is reserved for the total LHS item count. The system uses `MAX_STACK_RHS_OFFSET = 0x3f` (63) with `highwater()` gating via `if (newStackRHSOffset >= MAX_STACK_RHS_OFFSET)`, so the parser allows 63 top-level RHS items (indices 0–62).
In `pushOpToSource()`, when processing the operations count for the 63rd RHS item (offset 62), the memory pointer resolves to `state + 0x20 + 62 + 1 = 0x5F` — exactly the LHS counter byte. Every opcode pushed to the 63rd RHS item silently increments the total LHS item count.
Impact: silently corrupts parser FSM. Inflates LHS count, destroys `stackLHSIndex` for named stack variables, breaks `endLine()` validation, can compile logically corrupted bytecode that bypasses stack-depth safety rails.
Path: `src/lib/parse/LibParseState.sol`
Fix: Update the constant to reject offsets before they reach `0x5F`. Max safe offset is 61 (62 RHS items):
```solidity
uint256 constant MAX_STACK_RHS_OFFSET = 0x3e;
```
From the March 2026 audit (commit `13917ea1`):
`ParseState` packs RHS operation counters into `topLevel0`/`topLevel1`. Memory byte `0x5F` (last byte of `topLevel1`) is reserved for the total LHS item count. The system uses `MAX_STACK_RHS_OFFSET = 0x3f` (63) with `highwater()` gating via `if (newStackRHSOffset >= MAX_STACK_RHS_OFFSET)`, so the parser allows 63 top-level RHS items (indices 0–62).
In `pushOpToSource()`, when processing the operations count for the 63rd RHS item (offset 62), the memory pointer resolves to `state + 0x20 + 62 + 1 = 0x5F` — exactly the LHS counter byte. Every opcode pushed to the 63rd RHS item silently increments the total LHS item count.
Impact: silently corrupts parser FSM. Inflates LHS count, destroys `stackLHSIndex` for named stack variables, breaks `endLine()` validation, can compile logically corrupted bytecode that bypasses stack-depth safety rails.
Path: `src/lib/parse/LibParseState.sol`
Fix: Update the constant to reject offsets before they reach `0x5F`. Max safe offset is 61 (62 RHS items):
```solidity
uint256 constant MAX_STACK_RHS_OFFSET = 0x3e;
```