dfa: protect pointer range checks against overflows.