// ReturnSizeConfusion.sol
contract Victim {
    function callExternal(address target) external returns (bytes memory) {
        (bool success, bytes memory ret) = target.call(abi.encodeWithSignature("someFunc()"));
        require(success, "call failed");
        // Vulnerability: assumes ret is at least 32 bytes, but could be empty
        uint256 value;
        assembly {
            value := mload(add(ret, 32))
        }
        return ret;
    }
}