Steps to reproduce:

* Build with `integer` sanitizer
* Start: `UBSAN_OPTIONS="suppressions=$(pwd)/test/sanitizer_suppressions/ubsan:print_stacktrace=1:halt_on_error=1:report_error_type=1" ./src/qt/bitcoin-qt -chain=main`
* Enter `getdescriptorinfo "sh(multi(1,xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/5/5/5/2/8/5/8/8/8/2/2/5/8/5/2/5/85/58/5/2/5/5/5/5/2/58/2/5/8/0000/00/8/5/2/001/1/246/8/501/46/8/5/8/5/000/8/52/5/8/5/2/8/2/5/8/5/246/8/5/2/8/2/5/8/5/2/5/8/8/2/5/5/5/58/88/2/6/8/5/2/8/2/5/8/2/588/5/2/5/8/5/2/8/5/1/5/4/5/5/5/2/6/8/5/2/8/2/5/8/5/2/5/58/58/2/5/8/58/588/2/52/5/5/5/58/8/2/6/8/5/2/8/2/5/8/2/588/5/2/5/8/5/2/8/5/15/58/58/2/6/8/5/2/8/2/5/8/5/2/5/8/58/2/5/58/58/588/2/5/2/8/5/8/5/4/5/58/588/2/6/8/5/2/8/2/5/8/2/8/5/2/8/2/5/8/5/2/5/58/58/2/5/5/5/58/588/2/6/8/5/2/8/2/5/8/2/8/588/2/6/8/5/2/8/2/5/5/8/5/2/0/8/5/2/00/4/5/5/588/2/6/8/5/2/8/25/5/8/2/5/58/58/8/4/1,[00000000]xprv9uPDJpEQgRQfDcW7BkF7eTya6RPxXeJCqCJGHuCJ4GiRVLzkTXBAJMu2qaMWPrS7AANYqdq6vcBcBUdJCVVFceUvJFjaPdGZ2y9WACViL4L/58)0)"` into the console
{
        std::vector<std::pair<CPubKey, KeyOriginInfo>> entries;
        entries.reserve(m_pubkey_args.size());
        
        for (const auto& p : m_pubkey_args) {
            entries.emplace_back();
            if (!p->GetPubKey(pos, arg, entries.back().first, entries.back().second, read_cache, write_cache)) return false;
        }
        std::vector<CScript> subscripts;
        FlatSigningProvider subprovider;
        for (const auto& subarg : m_subdescriptor_args) {
            std::vector<CScript> outscripts;
            if (!subarg->ExpandHelper(pos, arg, read_cache, outscripts, subprovider, write_cache)) return false;
            assert(outscripts.size() == 1);
            subscripts.emplace_back(std::move(outscripts[0]));
        }
        out = Merge(std::move(out), std::move(subprovider));
        std::vector<CPubKey> pubkeys;
        pubkeys.reserve(entries.size());
        for (auto& entry : entries) {
            pubkeys.push_back(entry.first);
            out.origins.emplace(entry.first.GetID(), std::make_pair<CPubKey, KeyOriginInfo>(CPubKey(entry.first), std::move(entry.second)));
        }
        output_scripts = MakeScripts(pubkeys, Span{subscripts}, out);
        return true;
    }
    bool Expand(int pos, const SigningProvider& provider, std::vector<CScript>& output_scripts, FlatSigningProvider& out, DescriptorCache* write_cache = nullptr) const final