More OOB heap reads, signed sizes