Two descriptor chains this title uses could not be resolved:
- A descriptor whose address arrives through a phi. Walk the phi to its leaves
and accept the result when they agree, or when exactly one is a real address
and the rest are null/sentinel.
- A descriptor read through ReadFirstLane. This is safe for non-image
descriptors, where every lane holds the same handle, so accept it there. Image
descriptors keep the old restriction, gated by the dword count.