add checks against "impossible" integer wraps
(just in case we read crap from the disk and not what we have written)
don't overwrite FAIL_ETOOMANY
deref only after NULL check