Wrong expansion of `extern "C" u8/u16` returns on bpfel

bpf.rs

#![feature(no_core, lang_items, auto_traits)]
#![no_core]
#![allow(internal_features)]
#![crate_type = "lib"]

#[lang = "copy"] trait Copy {}
#[lang = "pointee_sized"] pub trait PointeeSized {}
#[lang = "meta_sized"] pub trait MetaSized: PointeeSized {}
#[lang = "sized"] pub trait Sized: MetaSized {}
#[lang = "freeze"] auto trait Freeze {}
#[lang = "drop_glue"] fn drop_glue<T>(_: &mut T) {}

unsafe extern "C" {
    fn c_read_value(x: u32) -> u16;
}

#[unsafe(no_mangle)]
pub unsafe extern "C" fn observe(x: u32) -> u64 {
    unsafe { c_read_value(x) as u64 }
}

RUSTC_BOOTSTRAP=1 rustc +nightly-2026-05-10 --target bpfel-unknown-none -C opt-level=2 --emit=asm,llvm-ir --out-dir . bpf.rs

sed -n '/^observe:/,/^\.Lfunc_end/p' bpf.s

This prints:

observe:
   call c_read_value
   exit
.Lfunc_end0:

On BPF the returned value is r0. There is no r0 &= 65535 between call and exit, so if c_read_value leaves r0 = 0x12340016, observe returns 0x12340016 instead of 0x0000000000000016

EDIT: That's the root cause. This zeroext so that LLVM believes the upper bits are already zeroed, so it doesn't emits r0 &= 65535 and doesn't return the correct value

Start with the bpf.rs reproducer and its emitted assembly, then read compiler/rustc_target/src/callconv/bpf.rs at the cited lines to understand the zero-extension assumption. Verify the fix by compiling the example for bpfel and checking that observe masks the u16 return before exit, producing 0x0000000000000016.