mdb_cursor_del()'s NUMKEYS() check in your fix
(f34b61f9471d1c03fe0517b9d817c50c920e378a) looks like a general
cursor tracking issue, so XCURSOR_REFRESH() should check it too.
Unless we've got some ugliness where mp_lower is temporarily
too small, but I haven't spotted anything like that.
The mdb_cursor_del() is still wrong: The mn_flags check doesn't skip
non-DUPDATA nodes. Using XCURSOR_REFRESH() fixes it. And it should
use XCURSOR_INITED() like other XCURSOR_REFRESH() callers.
Suggested fixes - branch "xcursor-its8722" @ symas.