br_on_cast / br_on_cast_fail accept a target label with an empty result type

[jasisz]

br_on_cast / br_on_cast_fail forward the operand (typed as the cast target) to the target label on the taken / fall-through branch, so the spec requires that label's type to end in a reference type — in particular it must be non-empty (arity ≥ 1). Wizard does not reject a target label with an empty result type (arity 0); it accepts and runs the module. (When the label has the wrong type but the right arity — e.g. i32 — Wizard correctly rejects, so the missing check is specifically the non-empty / arity requirement.)

Minimal repro

(module (type $s (struct (field i32)))
  (func (export "go") (result i32)
    (block $l                          ;; empty result type — illegal br_on_cast target
      (br_on_cast $l anyref (ref $s) (struct.new $s (i32.const 42)))
      (drop) (return (i32.const 111)))
    (i32.const 222)))

wasm-tools, wasmtime, WasmEdge and V8 reject this at validation; Wizard accepts and returns 222. br_on_cast_fail with an empty-result label behaves the same (returns 111).

A correct target label ((result (ref $s))) validates and runs on every engine; a wrong-typed but non-empty label ((result i32)) is correctly rejected by Wizard too — so the gap is specifically the empty (arity-0) label.

[jasisz]

Related to but distinct from #538 (closed): that was a stack-validation failure on a multi-value br_on_cast_fail ((result f32 (ref ...))) — over-strict, since fixed. This report is the opposite direction: the validator accepts a br_on_cast / br_on_cast_fail whose target label has an empty (arity-0) result type — an under-validation gap with a different trigger.