CVE-2026-49263: Capstone WASM `br_table` instruction-size truncation can cause no-progress disassembly and parser desynchronization

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm() and csdisasmiter() APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate length in a wider local variable but returns it through a uint16t instruction-size path. When the encoded instruction length is exactly 65,536 bytes, the size wraps to zero and csdisasm() can repeatedly decode the same instruction without advancing. For larger lengths, csdisasmiter() advances into the middle of the brtable payload and decodes target bytes as subsequent instructions. This is an availability and parser-integrity issue. Version 6.0.0-Alpha9 patches the issue.