Internal function pointer written to storage stores an abstract index, not the code offset

Source

// SPDX-License-Identifier: MIT
pragma solidity 0.8.35;

/* ===ARENA-MANIFEST===
{
  "deploy": { "contract": "T", "args": [], "value": 0 },
  "entry": { "function": "run", "args": [] },
  "feature": "internal-fnptr-storage-slot-representation",
  "note": "An INTERNAL function pointer written to a storage state variable is stored with a divergent slot value. solc/EVM stores the function's code offset (a concrete jump destination, e.g. 116 for this program); solidity-lean stores 1, an abstract index into its own function table. The entry never CALLS the pointer and returns a constant, so the return value is identical on both engines and only the storage observable differs (wrong-state).\n\nKNOCKOUT MATRIX (each adjudicated separately on this rig):\n  - call the pointer instead of returning a constant  -> still diverges (call result is CORRECT, 72 on both; only the slot differs)\n  - wrap the pointer in a struct                      -> still diverges\n  - copy the holder storage-to-storage before reading -> still diverges\n  - same struct/copy shape with a uint256 member      -> NO_DIVERGENCE (control)\nSo neither calling, nor struct wrapping, nor copying is necessary: the minimal necessary+sufficient ingredient is simply WRITING an internal function pointer to storage. This is the smallest form.\n\nSCOPE NOTE, stated plainly: this may be an intentional modelling limit rather than a defect. A semantics model that does not perform code generation cannot know solc's code layout, so an abstract function-table index is arguably the only representation available to it. If that is the project's position, the divergence is still on-chain observable (the slot is readable via SLOAD / eth_getStorageAt) and appears to have no entry in the exclusion register, so it likely belongs there as a documented exclusion rather than being silently reachable. Submitted on that basis. The register contains fnptr rows only for EXTERNAL function pointers (DL144, G18), both fixed; nothing covers the internal-pointer storage representation."
}
===END-ARENA-MANIFEST=== */

contract T {
    function () internal pure returns (uint256) f;

    function h() internal pure returns (uint256) {
        return 72;
    }

    function run() external returns (uint256) {
        f = h;
        return 5;
    }
}