False positive with `byval` semantics when parameter is refined to `readnone`

[antoniofrighetto]

FunctionAttrs refines the second argument of the following IR to readnone:

%struct.f = type { [1024 x i32] }

define void @src(ptr %0, ptr noundef byval(%struct.f) %1) {
  call void @llvm.memset.p0.i64(ptr %0, i8 0, i64 4096, i1 false)
  ret void
}

declare void @llvm.memset.p0.i64(ptr, i8, i64, i1)

However Alive2 flags the refinement as invalid:

Transformation doesn't verify!

ERROR: Source is more defined than target

Example:
ptr %#0 = pointer(non-local, block_id=1, offset=0, attrs=8) / Address=#x0004
ptr byval(4096) noundef align(4) %#1 = pointer(non-local, block_id=1, offset=0, attrs=8) / Address=#x0004

Source:

SOURCE MEMORY STATE
===================
NON-LOCAL BLOCKS:
Block 0 >	size: 0	align: 1	alloc type: 0	alive: false	address: 0
Block 1 >	size: 4096	align: 4	alloc type: 0	alive: true	address: 4
Block 2 >	size: 0	align: 1	alloc type: 0	alive: true	address: 1

Target:
void = UB triggered!

Alive2: https://alive2.llvm.org/ce/z/qqfroB.