fix: bytes test read one byte past the fixed map into the heap

rt.MW is the end of the fixed map (PW) since the growing heap landed; the
heap starts right there, so ld16(addr_b(rt.MW)-1) read the heap's first
byte: 0 on the default map by luck, 0x40 on the small map (16384).
Probe the real byte-op bound instead: core answers syscall(9,10) with the
host reservation MW; micro ports, whose bound is their memory size, fall
back to syscall(9,0).

2 files changed, 5 insertions, 2 deletions

diff --git a/src/core/core.c b/src/core/core.c
index 7d1b91e..d758cb6 100644
--- a/src/core/core.c
+++ b/src/core/core.c
@@ -382,6 +382,7 @@ static Cell hostcall(Cell op, Cell a, Cell b, Cell c)
 		}
 		if (a == 7 || a == 8) return stack_expand(a == 8, b, &cb_s, &cb_r);
 		if (a == 9) return code_reserve(b);
+		if (a == 10) return MW;	/* where byte loads and stores stop: the host reservation, not memory_words */
 		return -1;
 	case 43: { /* clone an isolated execution context with a bidirectional channel */
 #if !defined(_WIN32) && !defined(__wasm__)
diff --git a/tests/programs/bytes.zc b/tests/programs/bytes.zc
index 1332c26..97a0480 100644
--- a/tests/programs/bytes.zc
+++ b/tests/programs/bytes.zc
@@ -13,7 +13,7 @@ fn sumbytes(n) {
 	return s;
 }
 fn main() {
-	let buf[3], b;
+	let buf[3], b, lim;
 	buf[0] = 0; buf[1] = 0; buf[2] = 0;
 	b = rt.addr_b(buf);
 	rt.st8(b, 0x11);
@@ -32,7 +32,9 @@ fn main() {
 	rt.put_n(buf[1]); sp();
 	rt.st8(0 - 1, 99);
 	rt.put_n(rt.ld8(0 - 1)); sp();
-	rt.put_n(rt.ld16(rt.addr_b(rt.MW) - 1)); sp();
+	lim = rt.syscall(9, 10, 0, 0);
+	if (lim < 0) lim = rt.syscall(9, 0, 0, 0);
+	rt.put_n(rt.ld16(rt.addr_b(lim) - 1)); sp();
 	rt.put_n(sumbytes(1000));
 	rt.put_c(10);
 	let p = f;