getelementptr offsets are signed, not unsigned. Yet they were used as unsigned integers in interp. Somehow this worked most of the time, until finally there was some code that did a getelementptr with a negative index.