=== 1. baseline: stock prop_number.c, guard-page heap ===
[*] prop_string object (40 bytes) sits flush against a PROT_NONE guard page
[*] bitfield read lands at +40..43 => 4 bytes OOB

[*] control: guarded prop_number_integer_value(str) ...
[*]   -> 0 (no trap: type guard works)

[*] probe: UNguarded prop_number_unsigned(str) ...
--- baseline exit=139

=== 2. fixed: prop_object_is_number() guard added ===
Segmentation fault (core dumped)
[*] prop_string object (40 bytes) sits flush against a PROT_NONE guard page
[*] bitfield read lands at +40..43 => 4 bytes OOB

[*] control: guarded prop_number_integer_value(str) ...
[*]   -> 0 (no trap: type guard works)

[*] probe: UNguarded prop_number_unsigned(str) ...
[*]   -> 0 (NO TRAP -- read stayed in bounds?!)
--- fixed exit=0