fix: resolve _GLIBCXX_DEBUG assertion failures in debug build

Three latent bugs exposed by _GLIBCXX_DEBUG bounds checking:

1. batched_affine_addition.cpp: subspan(total_num_pairs, 2*total_num_pairs)
   requested 2*total_num_pairs elements but only total_num_pairs are used.
   Fixed count argument to total_num_pairs.

2. scalar_multiplication.hpp: MSMData::from_work_unit accessed empty vector
   via &v[0] when all scalars are zero. Changed to v.data() + offset.

3. gemini_impl.hpp: compute_fold_polynomials accessed multilinear_challenge
   out of bounds when polynomial degree > 2^(challenge size). Added bounds
   check to fall back to u=0 for rounds beyond the challenge array.

Author: AztecBot

barretenberg/cpp/src/barretenberg/commitment_schemes/gemini/gemini_impl.hpp

@@ -137,8 +137,9 @@ std::vector<typename GeminiProver_<Curve>::Polynomial> GeminiProver_<Curve>::com
         // size of the previous polynomial/2
         const size_t n_l = 1 << (log_n - l - 1);
 
-        // Opening point is the same for all
-        const Fr u_l = multilinear_challenge[l];
+        // Use the challenge value when available; otherwise fold with u=0 (take even part only).
+        // This handles the edge case where the polynomial degree exceeds 2^virtual_log_n.
+        const Fr u_l = (l < virtual_log_n) ? multilinear_challenge[l] : Fr(0);
 
         // A_l_fold = Aₗ₊₁(X) = (1-uₗ)⋅even(Aₗ)(X) + uₗ⋅odd(Aₗ)(X)
         auto A_l_fold = fold_polynomials[l].data();
@@ -161,7 +162,7 @@ std::vector<typename GeminiProver_<Curve>::Polynomial> GeminiProver_<Curve>::com
     // value at every point, (f(X) - f(x)) / (X - x) = 0, so these contribute nothing to the Shplonk quotient Q(X).
     // On the verifier side, padding_indicator_array zeros their contributions independently.
     const auto& last = fold_polynomials.back();
-    const Fr u_last = multilinear_challenge[log_n - 1];
+    const Fr u_last = (log_n - 1 < virtual_log_n) ? multilinear_challenge[log_n - 1] : Fr(0);
     const Fr final_eval = last.at(0) + u_last * (last.at(1) - last.at(0));
     Polynomial const_fold(1);
     const_fold.at(0) = final_eval;

barretenberg/cpp/src/barretenberg/ecc/batched_affine_addition/batched_affine_addition.cpp

@@ -143,7 +143,7 @@ std::span<typename BatchedAffineAddition<Curve>::Fq> BatchedAffineAddition<
     // Define scratch space for batched inverse computations and eventual storage of denominators
     BB_ASSERT_GTE(add_sequences.scratch_space.size(), 2 * total_num_pairs);
     std::span<Fq> denominators = add_sequences.scratch_space.subspan(0, total_num_pairs);
-    std::span<Fq> differences = add_sequences.scratch_space.subspan(total_num_pairs, 2 * total_num_pairs);
+    std::span<Fq> differences = add_sequences.scratch_space.subspan(total_num_pairs, total_num_pairs);
 
     // Compute and store successive products of differences (x_2 - x_1)
     Fq accumulator = 1;

barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.hpp

@@ -122,7 +122,7 @@ template <typename Curve> class MSM {
                 .scalars = all_scalars[work_unit.batch_msm_index],
                 .points = all_points[work_unit.batch_msm_index],
                 .scalar_indices =
-                    std::span<const uint32_t>{ &all_indices[work_unit.batch_msm_index][work_unit.start_index],
+                    std::span<const uint32_t>{ all_indices[work_unit.batch_msm_index].data() + work_unit.start_index,
                                                work_unit.size },
                 .point_schedule = point_schedule_buffer,
             };