The guard ml.size_s() < 2 allowed size==2, but ml[2] was then accessed — OOB read on truncated or unusual df output lines.