We ran into a bug where a -1 BCI can be installed into a stack backtrace, and the code to fetch it out uses a ushort fetch (which is correct because bytecodes normally range from 0 to 65535) - so the -1 gets interpreted as a max bytecode and is outside the expected range.