PretouchTask unconditionally (atomically) adds _chunk_size to _cur_addr to claim the next chunk. That addition can overflow. There is followup code that attempts to detect and handle overflow, but since pointer arithmetic overflow is UB, that isn't reliable.