ASSERT(11.90.20672) core/translate.c:334 spill_or_restore && r == reg - REG_START_SPILL && !spill && spill_tls

**Describe the bug**

In Aarch64, When:

+ `x28` is used by the app and spilled by DynamoRIO
+ An app label is inserted after that
+ a faulting meta-instruction is inserted after that label
+ the meta-instruction faults

The assertion `core/translate.c:334 spill_or_restore && r == reg - REG_START_SPILL && !spill && spill_tls` is triggered.

**To Reproduce**

I made a minimum reproducible example in this repository:

https://github.com/WilliamQiufeng/dynamorio-regspill-mre

This contains an assembly with a client instrumenting that. The assembly contains `mov x0, x28; b _start` and the client will add a faulting meta-instruction before `b _start`.

Then build and run or use the `run.sh` script to see the error (pasted in the **Pasted Text** section)

**Expected behavior**

It is expected to just trigger a segmentation fault, instead of triggering the assertion. If the faulting instruction is a drx buffer store, it should be expected to trigger a flush and continue normal execution instead of ASSERT.

**Screenshots or Pasted Text**

```

```

**Versions**
- DynamoRIO 11.90.20672
- 64-bit Aarch64 Linux

Start by building and running the linked dynamorio-regspill-mre repository, or use its run.sh script, to reproduce the AArch64 assertion. Then inspect core/translate.c:334 and trace spill_or_restore for the faulting meta-instruction after the app label. Done means the reproduction triggers the expected segmentation fault without ASSERT, and a faulting drx buffer store flushes and continues normally.

Written by the indexing model from the issue text.