for-init declaration from internal call returns Panic(0)

Source

// SPDX-License-Identifier: MIT
pragma solidity 0.8.35;

/* ===ARENA-MANIFEST===
{
  "deploy": { "contract": "T", "args": [], "value": 0 },
  "entry":  { "function": "f", "args": [] },
  "note":   "SOUNDNESS_GAP: a for-loop initializer declaration whose value comes from an internal CALL. solc 0.8.35 returns 4 (the loop sums 0+1+2 and g() bumps n once); solidity-lean runs and reverts Panic(0). A call in the for-CONDITION and in the for-POST slot both work, and an initializer built from a binary expression, a cast tower, a mapping read or a builtin such as keccak256 also works - only a user-call initializer in the for-init slot diverges."
}
===END-ARENA-MANIFEST=== */

contract T {
    uint256 n;

    function g() internal returns (uint256) {
        n += 1;
        return 0;
    }

    function f() external returns (uint256) {
        uint256 acc;
        for (uint256 i = g(); i < 3; i++) {
            acc += i;
        }
        return acc + n;
    }
}