I recommend using -fsanitize=undefined -fsanitize=integer if you can build with clang - it will print a warning when an unsigned int underflows which catches a terrifying amount of similar bugs the first time it is run (there are a lot of false positives in hash functions, etc though but imho it's well worth using regularly)
The code was check-all-pairs, e.g.
Which worked just fine for int size, but failed spectacularly for size_t size when size==0.I totally should have caught that one, but I just couldn't see it until someone else pointed it out. And then it was obvious, like many bugs.