We've tidied up many overflow scenarios but
apparently not this one.

Similar trouble may lurk in ReadChars()