The offset for the pointer count field for small arrays is in bytes but is used in two places to make a word offset. This only works because the offset is zero.
Hmm, it's actually not entirely clear to me how this could easily be tested given that oFFSET_StgMutArrPtrs_ptrs can't really be easily changed from zero.
I'm going to merge this as is. Feel free to open a new Diff adding a test if either of you think of one.