[dylanneve1]

A census of a native-int iOS boot found SIMD&FP loads/stores and literal loads to be the most common instructions ending native-int regions in the middle of a TB. (PAC branches and B/BL come up more often, but they end the TB anyway.) memcpy and objc paths use Q pairs. This PR covers them:

• Instructions: LDR/STR of B/H/S/D/Q registers in every addressing mode; LDP/STP of S/D/Q registers; LDR (literal) into general-purpose and SIMD&FP registers. SIMD&FP forms only apply without SVE/SME.
• How the data moves: vector registers aren't mapped to host registers, so the data goes through the CPU state. A load is the host load into v31 (v30 for the second register of a pair), then a 128-bit store to the CPU state. That also zeroes the bits above the access, as the guest load does.
• TLB and slow path: a pair takes one TLB check covering both registers. The slow path calls the TCG helper once per register, like TCG does. Literal addresses are the guest pc plus the offset.

Testing:

• native_int_gen.py now also emits these forms (all sizes and addressing modes, pairs, page-crossing) and literal loads, and folds V0-V7 and V16-V31 into the hash.
• native_int_check.S test 8: Q and D-pair loads across a page boundary, and a faulting Q load whose destination stays unchanged and whose preceding registers are exact.
• run-a13-tests.py: 41/41 on an M1 macOS build. A 300-seed soak had 0 mismatches against native-int off and against the host CPU.
• 4 restore boots with native-int=on on the Android emulator all reached waiting_host (median 9.8 s) with no panic.

🤖 Generated with Claude Code