VUL: make sure cache entries are in range