I wrote:

datacount*datasize (passed to page_spill) can overflow on 32-bit, I thought that's what you meant.

That is, I thought you meant checking data[1].mv_size <= UINT_MAX will stop the multiply from overflowon on 64-bit, but that doesn't help on 32-bit.