A negative int8 written to a mapping value slot is sign-extended over the whole slot (0xff..ff vs 0xff)

Source

// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.35;

/* ===ARENA-MANIFEST===
{
  "deploy": {
    "contract": "T",
    "args": []
  },
  "entry": {
    "function": "run",
    "args": []
  },
  "feature": "negative-narrow-int-in-mapping-value-slot",
  "note": "solc 0.8.35 + EVM: `mapping(uint256 => int8) mv; mv[3] = int8(-1);` writes 0xff to the mapping value slot -- an int8 occupies only the low byte, the rest of the slot stays zero. solidity-lean writes 0xff..ff (2^256-1), sign-extending the value across the WHOLE slot. The return value agrees, so only the post-call storage map exposes it; on-chain this would corrupt anything else packed into that slot. Reproduces for packed struct fields, packed signed arrays and ternary-unified narrow values."
}
===END-ARENA-MANIFEST=== */

contract T {
    mapping(uint256 => int8) mv;
    function run() public returns (uint256) {
        mv[3] = int8(-1);
        return uint256(int256(mv[3]));
    }
}