AddressSanitizer CHECK failed with RISC-V program

I compiled this program with asan on:

```c
#include
#include
#include
#include

int lego(size_t n) {
size_t vl = __riscv_vsetvl_e8m1(n);
__rvv_bool2_t mask = __riscv_vmset_m_b2(vl);
size_t count = __riscv_vcpop_m_b2(mask, vl);
return count;
}

int main() {
long long ret = lego(50);
printf("ret=%lld\n", ret);
return 0;
}
```

Compile command:

```sh
clang --target=riscv64-unknown-linux-gnu -march=rv64gcv -mabi=lp64d -menable-experiment
al-extensions -I/data/yunboni/utils/compilers/llvm_latest_rvv/lib/clang/22/include/riscv_vector.h -fsanitize=address test.c
```

Then run it:

```sh
qemu-riscv64 -L /usr/riscv64-linux-gnu ./a.out
```

It got errors:

```sh
AddressSanitizer: CHECK failed: asan_globals.cpp:276 "((AddrIsInMem(g->beg))) != (0)" (0x0, 0x0) (tid=3675936)
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3675936==ERROR: AddressSanitizer: SEGV on unknown address 0x355556b83828 (pc 0x55555559d102 bp 0x2aaaab2a7a70 sp 0x2aaaab2a7210 T0)
==3675936==The signal is caused by a READ memory access.

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV
==3675936==ABORTING
```

My clang version:

```sh
clang version 22.0.0git (https://github.com/llvm/llvm-project.git 3defab36b73d60e616f5d6fe0e88e435c3dfc0dc)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /data/yunboni/utils/compilers/llvm_latest_rvv/bin
Build config: +assertions
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/13
Candidate multilib: .;@m64
Candidate multilib: 32;@m32
Candidate multilib: x32;@mx32
Selected multilib: .;@m64
```

qemu version:

```sh
qemu-riscv64 version 8.2.2 (Debian 1:8.2.2+ds-0ubuntu1.10)
Copyright (c) 2003-2023 Fabrice Bellard and the QEMU Project developers
```

Reproduce the failure with the provided C program, Clang command, and qemu-riscv64 environment. Start at the AddressSanitizer CHECK reported in asan_globals.cpp:276 and compare the RISC-V execution path with the generated program; done means the reproducer runs without the CHECK, DEADLYSIGNAL, or SEGV.

Written by the indexing model from the issue text.