Thanks for the explanation @StarOne01!
Overall, your patch sounds reasonable to me. I see ugt as an implementation trick. In fact, 0 <= x < n is equivalent to x <_u n for n >= 0, and the check is applied to base + IV, making it correct on a per-element basis. In general, the justification, should be implements the documented rule, not negative values wrap.
There are two options, as pointed out by @matthias-springer here. In my view, a second OOB check for >= 0 is much more readable, though it is a matter of opinion. This could potentially be outweighed by a good comment. ![]()