Yup, that was one massive screw-up. Part of P0030, funded by zorg.
Yes, you're reading that correctly. If the cursor is at 255, reading a 16-bit value will fill the upper 8 bits with the neighboring cursor value, which always is 0xFF. Funded by -Tom-.