Constant propagation misses values that only become known after stack de-aliasing

[bdash]

Version and Platform (required):

• Binary Ninja Version: 5.4.9793-dev Ultimate, 12373795
• OS: macOS 26.5.1
• CPU Architecture: arm64

Steps To Reproduce:

1. Download nova guard works curiously and open the included .bndb.
2. Go to 0x3b698fde in HLIL:

  40 @ 3b698fde  r9.b = *(arg4 + 4 + rdi_1 + 0x6f3b9513)

3. Hover over rdi_1 and note that it reports to have a constant value of -0x6f3b9513, yet the constant is not propagated and the resulting expression is not simplified.

Additional Information:
If I explicitly set the value of rdi_1 to -0x6f3b9513 prior to 0x3b698fde then it is propagated and simplified as expected:

  35 @ 3b698fde  ASSERT(rdi_1, ConstantValue: 0xffffffff90c46aed)
  36 @ 3b698fde  r9.b = *(arg4 + 4)

It also simplifies other uses of rdi_1 later in the function.

This appears to be a consequence of the value of rdi being most recently modified via a partial field access:

3b76597e  and     dil, byte [rsp+rdi-0x6f3b9515 {var_8+0x2}]

which ends up in MLIL as:

   8 @ 3b76597e  rdi.dil = 0x17 & var_8:2.b

If I NOP the instruction at 0x3b76597e, then the value of rdi is constant propagated. It looks like the partial write is not resolved until after the constant propagation has been performed. This means the value of rdi is not known when constant propagation is performed, and so it is left as a variable.

[bdash]

I looked into this more, and the partial write via dil is a red herring.

rdi ends up computed from a stack slot var_8, which is written via a computed address [&var_8 + r9] at 0x3b698fb9. This means var_8 has its address taken and is considered aliased, so its value (and thus rdis value) is not known when constant propagation runs.

r9 ends up being computed as a constant 0. When the constant-propagating copy pass substitutes it, [&var_8 + r9] turns into a direct var_8 access and the potential aliasing goes away. This allows rdis value to be known, but only after the constant propagation has completed and it is too late for the code in question to benefit from it.