`__builtin_memset` intrinsic call in MLIL may have incorrect parameter types

Version and Platform (required):

• Binary Ninja Version: 5.0.7289-test Ultimate (96bf77cd)
• OS: Debian
• OS Version: trixie
• CPU Architecture: x64

Bug Description:
In some cases, function call argument types have a width incompatible with the formal parameter width. I've mostly seen this happen with __builtin_memset lifted from rep stosb.

Steps To Reproduce:
Open the binary with default settings, then run:

>>> func = bv.get_function_at(0x400000)
>>> func.mlil.ssa_form[3].dest.expr_type.target.parameters[1].type
<type: immutable:IntegerTypeClass 'int32_t'>
>>> func.mlil.ssa_form[3].params[1].expr_type
<type: immutable:IntegerTypeClass 'char', 0% confidence>

Expected Behavior:
The constant 0 should have a type int32_t, or a cast should be inserted.

Binary:
bug.zip

Additional Information:
This isn't visible in the UI at all but breaks a tool I'm developing that is sensitive to accuracy of type information in MLIL.

Reproduce the issue with the supplied bug.zip using the Python API entry points func.get_function_at, func.mlil.ssa_form, and the shown expr_type fields. Inspect how the __builtin_memset call and its second argument are typed; done means the constant 0 has type int32_t or an explicit cast is present.