@Override
	public void restoreXml(XmlPullParser parser, SleighLanguage language) throws XmlParseException {
		ArrayList<InjectParameter> inlist = new ArrayList<>();
		ArrayList<InjectParameter> outlist = new ArrayList<>();
		XmlElement el = parser.start();			// The <pcode> tag
		String injectstr = el.getAttribute("inject");
		if (injectstr != null) {
			if (injectstr.equals("uponentry")) {
				subType = 0;
			}
			else if (injectstr.equals("uponreturn")) {
				subType = 1;
			}
			else {
				throw new XmlParseException("Unknown \"inject\" attribute value: " + injectstr);
			}
		}
		String pshiftstr = el.getAttribute("paramshift");
		paramShift = SpecXmlUtils.decodeInt(pshiftstr);
		boolean isDynamic = SpecXmlUtils.decodeBoolean(el.getAttribute("dynamic"));
		incidentalCopy = SpecXmlUtils.decodeBoolean(el.getAttribute("incidentalcopy"));
		XmlElement subel = parser.peek();
		while (subel.isStart()) {
			subel = parser.start();
			if (subel.getName().equals("body")) {
				parseString = parser.end(subel).getText();
				break;
			}
			String paramName = subel.getAttribute("name");
			int size = SpecXmlUtils.decodeInt(subel.getAttribute("size"));
			InjectParameter param = new InjectParameter(paramName, size);
			if (subel.getName().equals("input")) {
				inlist.add(param);
			}
			else {
				outlist.add(param);
			}
			parser.end(subel);
			subel = parser.peek();
		}
		parser.end(el);
		if (parseString != null) {
			parseString = parseString.trim();
			if (parseString.length() == 0) {
				parseString = null;
			}
		}
		if (parseString == null && (!isDynamic)) {
			throw new XmlParseException("Missing pcode <body> in injection: " + source);
		}

		setInputParameters(inlist);
		setOutputParameters(outlist);
		orderParameters();
	}
All input and output parameters must have a unique index.
Order them so that inputs come first, then outputs
Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/lang/InjectPayloadSleigh.java