`end = start + count` can overflow if `start` is very large. That leads to a segfault later in the function. Add test case for it.
