Are you running with default JIT parameters - or did you tweak any?
I have seen this sort of thing happen when things overflow uint16_t.
You can try running with:
if (((MSize)(uint16_t)(snap->mapofs + m)) != (snap->mapofs + m)) abort();
to check if this is the case.
