Oh oh, I suspect the typical bsearch int overflow bug with hi = nst - 1; both being int.

But I don't see a tracker, and it's not really realistic. You'd need INT_MAX tokens to overflow