GLK: Glulxe - Crash when saving in Counterfeit Monkey

[Gemba]

How to reproduce:

1. Add (1) to ScummVM
2. Launch game
3. Continue until after the intro (e.g. after you see the map in CounterfeitMonkey)
4. Hit Ctrl-F5 to save
5. Enter save name, hit save
6. Result: Debug console opens with: ERROR: Glulx fatal error: Inconsistent stack frame during save.!

-and-

1. Add (2) to ScummVM
2. Launch game
3. Continue until after the intro
4. Hit Ctrl-F5 to save
5. Enter save name, hit save
6. Result: ScummVM crashes with SIGSEGV

   Thread 1 "scummvm" received signal SIGSEGV, Segmentation fault.
   0x0000555556cfa7a2 in Glk::Glulx::Glulx::write_stackstate (
       this=0x55555bf81be0, dest=0x7fffffff95d0, portable=1)
       at engines/glk/glulx/serial.cpp:687
   687			        frm != 0 && (frm2 = Stk4(frm - 4)) != lastframe;
   

Expected:
Save function returns successfully to game.

Version info:
ScummVM 2.9.0git1538-g81546b36b19 (Jan 14 2024 13:26:16)
Using SDL backend with SDL 2.26.5
Features compiled in: Vorbis FLAC ALSA SEQ sndio TiMidity RGB zLib FluidSynth Theora FreeType2 FriBiDi JPEG PNG cloud (servers) ENet SDL2 TinyGL OpenGL (with shaders)

On Debian Bookworm (amd64)

Additional context
I tried both games in the glulxe reference implementation (3) and both games showed not this reported behaviour, i.e. game state was properly saved.

What I was able to identify that this statement resolves to the wrong value (=outside the stackptr) for CounterfeitMonkey: frm2 = Stk4(frm - 4), see in context (4) and from there things derail. But I have no clue why as the code is identical to the reference implementation (only differ in glui32 (=uint32_t) vs. uint32 in ScummVM.

In contrast Adventure (5) did save the game properly in ScummVM.

See also: ticket:11516#comment:4

References
(1) ​https://github.com/i7/counterfeit-monkey/releases/download/r11.1/CounterfeitMonkey-11.gblorb (also tried earlier versions down to and including rel. 9)
(2) ​http://ifarchive.org/if-archive/games/competition2017/The%20Wizard%20Sniffer/The_Wizard_Sniffer.gblorb
(3) ​https://github.com/erkyrath/glulxe.git (commit 84f21bd)
(4) ​https://github.com/scummvm/scummvm/blob/81546b36b194ac16a4e2a3519ffb64af47ef4f38/engines/glk/glulx/serial.cpp#L687
(5) ​https://www.ifarchive.org/if-archive/games/glulx/advent.ulx