Function push_frame 

pub unsafe fn push_frame(
    ctx: *mut RuntimeContext,
    count: SlotCount,
) -> ShadowFrameGuard

Claim count zeroed slots on ctx’s shadow stack, the way a generated prologue does.

This is the one place the reservation’s limit is checked at runtime: Rust callers do not go through the prologue’s depth guard, so the argument in SHADOW_STACK_SLOTS does not cover them.

Safety

ctx must point at a live context wired by Runtime::context, and the runtime that owns the stack must outlive the returned guard.

Panics

If ctx is null, its shadow header is null, or the frame would not fit.