The first BCC could be +4 instead of +3, but otherwise the patch looks fine. Yes, it looks like a bug unless the bounds were known to only ever result in a single overflow.