A size that makes addr + size wrap around 32 bits had Split() build a slab
that ends before it starts. Lookups then skipped it, and a later
Merge() ran FillHeads() over it with a huge count, writing far outside
heads_. Sizes come from games through HLE calls, and the large ones are
recorded even without detailed mem info. Seen in a Play crash report, on
the FlushMemInfo thread.
FillHeads() also took the address one past the end of heads_ for a slab
in the last slice, which Debug builds assert on.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
