// updown.sv — counter with a bug for simultaneous up/down
module updown (
  input  logic       clk, rst, up, down,
  output logic [3:0] cnt
);
  always_ff @(posedge clk) begin
    if (rst)       cnt <= 4'd0;
    else if (up)   cnt <= cnt + 4'd1;     // BUG: up && down should leave cnt unchanged
    else if (down) cnt <= cnt - 4'd1;
  end
endmodule