test: check that 'sub' can't make the offset go negative