If I'm understanding the characterisation of the bug correctly, I think this implies that memory locations ending in 0xff would not suffer from the corruption.