mdb_cursor_del()'s NUMKEYS() check in your fix (f34b61f9471d1c03fe0517b9d817c50c920e378a) looks like a general cursor tracking issue, so XCURSOR_REFRESH() should check it too. Unless we've got some ugliness where mp_lower is temporarily too small, but I haven't spotted anything like that.

The mdb_cursor_del() is still wrong: The mn_flags check doesn't skip non-DUPDATA nodes. Using XCURSOR_REFRESH() fixes it. And it should use XCURSOR_INITED() like other XCURSOR_REFRESH() callers.

Suggested fixes - branch "xcursor-its8722" @ symas.