fix: handle non-modulus-width elements in emulated IsZero

[0x5ea000000]

Description

emulated.Field.IsZero assumed the element it reduces always comes back with exactly the modulus limb count. Elements built by Field.FromBits can legally carry a different number of limbs with zero overflow, and Field.Reduce's fast path returns zero-overflow elements unchanged regardless of width. This broke IsZero in two ways:

• Wider than the modulus (e.g. a 512-bit FromBits result over a 4-limb modulus): the limb-wise ca == p comparison indexed out of range and panicked at circuit definition (index out of range [4] with length 4). This is reachable from std: scalarMulFakeGLV calls IsZero(s) on the incoming scalar, so passing a wide FromBits scalar (e.g. a SHA-512 output for Ed25519-style verification) into ScalarMul/MultiScalarMul on a fakeGLV curve crashes at compile time. Additionally, such a value is not bounded by 2p, so the 0-or-p classification would misclassify multiples of p (2p, p², …) as non-zero even without the panic.
• Narrower than the modulus: the comparison loop only checked the given prefix of p.Limbs, returning a false positive (IsZero == 1) for a non-zero element equal to the low limbs of p.

The fix forces a full modular reduction to the modulus width when the reduced element is wider than the modulus (one mulMod by one, only on this path), and compares against every modulus limb, treating missing high limbs as zero, when it is narrower.

An alternative would be to tighten Reduce's fast path itself (require len(a.Limbs) <= NbLimbs in addition to overflow == 0); that touches every consumer, so this PR keeps the change local to IsZero. Happy to rework in that direction if preferred.

Fixes #1805

Type of change

• Bug fix (non-breaking change which fixes an issue)

How has this been tested?

• New TestIsZeroNonModulusWidth (Goldilocks, BN254Fr, Mod1e512) covering: 2p and p² as wide zero-overflow elements (≡ 0 mod p), p² + 5 (non-zero), zero, and a single-limb element equal to the low limb of p (non-zero, previously a false positive). The wide cases panic and the narrow case fails before this fix.
• go test ./std/math/emulated/... passes locally.

How has this been benchmarked?

• Not benchmarked — the new mulMod reduction only triggers for elements wider than the modulus, which previously panicked; the width-matched path adds no constraints. The narrow-element path adds len(p.Limbs) - len(ca.Limbs) IsZero gates only for narrow elements.

Checklist:

• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• I did not modify files generated from templates
• golangci-lint does not output errors locally (not installed here; gofmt and go vet are clean)
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

🤖 Generated with Claude Code

---

Note

Medium Risk
Correctness fix in a core emulated-field primitive used by scalar multiplication; wrong IsZero results can break circuit soundness. Change is localized to IsZero and covered by new tests.

Overview
Fixes Field.IsZero for elements whose limb count differs from the modulus (e.g. FromBits results). Reduce's zero-overflow fast path left these unchanged, so the 0-or-p check either panicked on wide elements or returned false positives on narrow ones.

Wider than modulus: force a full mulMod reduction first (with a small-field fold that avoids native wraparound). Also short-circuits constant elements at compile time.

Narrower than modulus: compare against every modulus limb, treating missing high limbs as zero.

Adds edge-case tests covering 2p, p², high-limb multiples, and single-limb prefixes of p, plus constant-wide elements.

^{Reviewed by Cursor Bugbot for commit 68a23d8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 6d8d338. Configure here.}