br_on_cast / br_on_cast_fail accept a target label with an empty result type

br_on_cast / br_on_cast_fail forward the operand (typed as the cast target) to the target label on the taken / fall-through branch, so the spec requires that label's type to end in a reference type — in particular it must be non-empty (arity ≥ 1). Wizard does not reject a target label with an empty result type (arity 0); it accepts and runs the module. (When the label has the wrong type but the right arity — e.g. i32 — Wizard correctly rejects, so the missing check is specifically the non-empty / arity requirement.)

Minimal repro

(module (type $s (struct (field i32)))
  (func (export "go") (result i32)
    (block $l                          ;; empty result type — illegal br_on_cast target
      (br_on_cast $l anyref (ref $s) (struct.new $s (i32.const 42)))
      (drop) (return (i32.const 111)))
    (i32.const 222)))

wasm-tools, wasmtime, WasmEdge and V8 reject this at validation; Wizard accepts and returns 222. br_on_cast_fail with an empty-result label behaves the same (returns 111).

A correct target label ((result (ref $s))) validates and runs on every engine; a wrong-typed but non-empty label ((result i32)) is correctly rejected by Wizard too — so the gap is specifically the empty (arity-0) label.

Start at the validation handling for br_on_cast and br_on_cast_fail, then run the minimal WAT reproduction from the issue. Done means an empty-result target label is rejected while a correctly typed non-empty label remains valid and a wrong-typed non-empty label remains rejected.