dotnet: handling differences between .NET decompilation and ground truth CIL

capa analyzes .NET files at the CIL level to extract capabilities. Unfortunately, this may differ from the decompilation generated by tools like dnSpy. Let's use this issue to track specific instances where the decompilation has differed greatly from the underlying CIL instructions.

The issue names no files, tests, or entry points. Start by identifying a reproducible case where capa's CIL-level analysis differs substantially from dnSpy's decompilation, then document the underlying CIL and the differing interpretation. Done means a concrete discrepancy is recorded with enough detail to guide a follow-up change.

Written by the indexing model from the issue text.