Another problem when an xcursor's mc_pg[0] refers to a sub-page but has not been kept updated: The comparison 'mc_pg[i] == mp' below fails and mc_ki[i] does not get modified:

if (m3->mc_pg[i] == mp && m3->mc_ki[i] >= mc->mc_ki[i]) { m3->mc_ki[i]++; }

Then it's too late to fixup the sub-page pointer later, the xcursor refers to the wrong node in the sub-page. The above code is from mdb_cursor_put(), but there are other similar cases elsewhere.