The program twotypes requires keeping track of two ptr types, shared and stack for a register. The analysis has been implemented in latest PREVAIL, but not in type domain, as it keeps track of only one type, not more. The significant code snippet is:
uint8_t* ptr;
if (rand32 & 1) {
ptr = map_value;
} else {
ptr = stack_buffer + 128;
}