diff --git a/examples/issue-0046.sx b/examples/issue-0046.sx
new file mode 100644
index 0000000..e3b99c0
--- /dev/null
+++ b/examples/issue-0046.sx
@@ -0,0 +1,30 @@
+// issue-0046 — nested comptime call + return: state leak from
+// outer `lowerComptimeCall` into the wrapper fn built by
+// `createComptimeFunction`. Without saving/restoring
+// `inline_return_target`, the wrapper inherits an inline-return
+// slot belonging to a different basic block; the interp executes
+// the wrapper and trips a null-pointer store at
+// `storeAtRawPtr`.
+//
+// Repro: comptime fn (`$x: s32`) whose body has BOTH a nested
+// comptime call (`print`) AND a `return X;` statement. Pre-fix:
+// interp panics. Post-fix: prints "inside" then "n=42".
+//
+// The pack-fn variant of the same bug (filed in the original
+// issue as face 2) was fixed earlier when step-2b moved pack-fn
+// calls off the inline path into the mono path. Plain comptime
+// fns stay on the inline path; their fix is the
+// `createComptimeFunction` state save/restore.
+
+#import "modules/std.sx";
+
+helper :: ($x: s32) -> s64 {
+    print("inside\n");
+    return 42;
+}
+
+main :: () -> s32 {
+    n := helper(7);
+    print("n={}\n", n);
+    return 0;
+}
diff --git a/tests/expected/issue-0046.exit b/tests/expected/issue-0046.exit
new file mode 100644
index 0000000..573541a
--- /dev/null
+++ b/tests/expected/issue-0046.exit
@@ -0,0 +1 @@
+0
diff --git a/tests/expected/issue-0046.txt b/tests/expected/issue-0046.txt
new file mode 100644
index 0000000..5772865
--- /dev/null
+++ b/tests/expected/issue-0046.txt
@@ -0,0 +1,2 @@
+inside
+n=42