I've found maybe 4 different crash points

One for sprites (standard sprite draw, tries to write at row -1 on rare occasions)

Possibly 2 that relate to MH's interpolation animation (write at row -1, haven't figured out root issue with the second one but I can stop it). One other one that I can't recall.
One effective method to neutralize these (whether or not fixed, but by doing so the ability to easily catch them) is marking the start and the end of the surface cache and check writes against that range. I'm not getting slow-downs by doing this, probably because the C codes optimizes well.
What I have done to trap these guys is run demos in higher resolutions using the C code and give it low cpu priority (results in larger host_frametime amounts). Some of them rear up quickly (Quake demo2.dem can get issues real quick), but some of them will not necessarily cause crashes immediately despite trying to write out of range.
I'll document it better the next time I have the opportunity. Hitting the sprite one made very irritated after I had managed to fix/evade 3 circumstances, another one showed up
