Function reference_eval_oob_report 

pub fn reference_eval_oob_report(
    program: &Program,
    inputs: &[Value],
) -> Result<(Vec<Value>, OobReport), Error>

reference_eval plus an OobReport of every out-of-bounds access the interpreter silently absorbed during the run.

The interpreter DEFINES OOB loads as zero-fill and OOB stores as a no-op so its output stays deterministic, but that silent absorption is exactly what masks a GPU/CPU parity hazard: an IR program with an ungated data-derived index “works” here yet a real GPU (CUDA does no bounds-checking) reads garbage or corrupts memory. Use this to assert a program NEVER relies on that masking: a correctly bounds-gated program handles an out-of-contract index with explicit control flow, so it records OobReport::total() == 0 even on hostile input. A nonzero total means the IR indexed past a buffer end and needs an explicit gate (the class of fix applied to ziftsieve/base64/sketch/simplicial).

The tally is per-thread and reset at the start of this call, so it measures exactly this run.

Errors

Same as reference_eval.