The calculation here https://github.com/aspnet/Common/blob/dev/src/Microsoft.Extensions.Primitives/StringSegment.cs#L50 can overflow to a negative value if both offset and length are big enough.