xtensa: fix swapped isIntN arguments in decodeOffset_16_16Operand

[jmestwa-coder]

Your checklist for this pull request

• I've documented or updated the documentation of every API function and struct this PR changes.
• I've added tests that prove my fix is effective or that my feature works (if possible)

Detailed description

decodeOffset_16_16Operand passes the untrusted immediate as the width argument to isIntN:

• the call is isIntN(Imm, 8), but the signature is isIntN(unsigned N, int64_t x), so Imm is used as the bit count
• the three sibling offset decoders correctly use isIntN(16, Imm)
• Imm is a 4-bit field, so Imm == 0 shifts by (unsigned)(0 - 1) inside isIntN, which UBSan flags at MathExtras.h:62; it also wrongly rejects offsets 1..4

Swapped the arguments back to isIntN(8, Imm).

Test plan

ee.ldf.128.ip with a zero offset field reaches it: cstool -d esp32 2f704484. On an ASAN/UBSan build the old code aborts with shift exponent 4294967295 is too large; after the fix it decodes clean as ee.ldf.128.ip f8, f9, f7, f4, a2, 0. Added test_ub_isintn_xtensa_offset to tests/integration/test_poc.c for that word.

Closing issues

[Rot127]

cc @b1llow

[Rot127]

Sorry, clicked to fast. Please add the instruction to issues.yml as test case

[jmestwa-coder]

added the word to issues.yaml as a test case (ee.ldf.128.ip f8, f9, f7, f4, a2, 0). passes under cstest.

[Rot127]

Please also test the details. More test coverage is always better.