ANGLE’s Metal backend rewrites index buffers to emulate primitive restart, convert index formats, and expand line loops. Correct sizing and positioning of the rewritten data is subtle: primitive restart splits a draw into clipped ranges whose clippedRange.begin pushes each range’s destination writes further into the output buffer, per-primitive expansion enlarges each range, and the byte offset where converted indices live in the device buffer is distinct from the element index of the first vertex within the original GL buffer.

The bug is arithmetic that collapses these distinctions: the output buffer is sized from the total index count while ignoring restart-induced begin offsets and expansion, a converted-pool byte offset is conflated with the absolute origin of restart indices in the original buffer, or a raw application-supplied vertex count is fed into transform-feedback/output sizing without rounding to whole primitives. The result is a destination write past the allocation or an index read against the wrong origin — an OOB write/read in the GPU process, reachable from WebGL content that chooses the index data and draw mode.