DREAMWEB: crash due to failed assertion in DreamWebEngine::deleteExFrame

[huntekye]

Version:
I encountered this issue first on ScummVM 2.8.1, and then built it from git with no change to the outcome.

For me the problem occurs at a specific point in the game, at which point the game crashes.
To reproduce:
I installed DreamWeb on Arch using the package manager yay, and confirmed that the bug occurs using both Sway (Wayland) and i3 (X11). In the game, while trying to leave the DreamWeb after killing General Stirling, Ryan uses to key to be transported back to Spark's bar, but at the moment that it seems the scene should change, instead the game crashes. Below is the full output I get from the dreamweb process:

$ scummvm -v
ScummVM 2.8.1 (Mar 16 2024 08:27:46)
Using SDL backend with SDL 2.30.8
Features compiled in: TAINTED Vorbis FLAC MP3 ALSA SEQ sndio TiMidity RGB zLib MPEG2 FluidSynth Theora AAC A/52 FreeType2 FriBiDi JPEG PNG GIF TTS cloud (servers, local) ENet SDL2 TinyGL OpenGL (with shaders)
$ dreamweb
WARNING: Couldn't initialize text to speech through speech-dispatcher!
User picked target 'dreamweb' (engine ID 'dreamweb', game ID 'dreamweb')...
   Looking for a plugin supporting this target... DreamWeb
Running DreamWeb (CD/DOS/English)
dreamweb.r00: 3b5c87717fc40cc5a5ae19c155662ee3, 152918 bytes.
dreamweb.r02: d6fe5e3590ec1eea42ff65c10b023e0f, 198681 bytes.
WARNING: Unknown scaler; defaulting to 1!
scummvm: engines/dreamweb/object.cpp:448: void DreamWeb::DreamWebEngine::deleteExFrame(uint8): Assertion `frame->ptr() + frame->width*frame->height <= _vars._exFramePos' failed.
/usr/bin/dreamweb: line 3: 37666 Aborted                 (core dumped) scummvm "$@" -f -p /usr/share/dreamweb dreamweb

And again with the git version of ScummVM:

$ scummvm -v
ScummVM 2.9.0git (Oct 24 2024 20:23:21)
Using SDL backend with SDL 2.30.8
Features compiled in: TAINTED Vorbis FLAC MP3 ALSA SEQ sndio TiMidity RGB zLib MPEG2 FluidSynth OpenMPT Theora VPX AAC A/52 FreeType2 FriBiDi JPEG PNG GIF TTS cloud (servers, local) ENet SDL2 TinyGL OpenGL (with shaders) 
$ dreamweb 
WARNING: DebugManager::addDebugChannels(): No debug channels were added, list is empty!
WARNING: DebugManager::addDebugChannels(): No debug channels were added, list is empty!
WARNING: Couldn't initialize text to speech through speech-dispatcher!
User picked target 'dreamweb' (engine ID 'dreamweb', game ID 'dreamweb')...
Running DreamWeb (CD/DOS/English)
dreamweb.r00: 3b5c87717fc40cc5a5ae19c155662ee3, 152918 bytes.
dreamweb.r02: d6fe5e3590ec1eea42ff65c10b023e0f, 198681 bytes.
WARNING: Unknown scaler; defaulting to 1!
scummvm: engines/dreamweb/object.cpp:448: void DreamWeb::DreamWebEngine::deleteExFrame(uint8): Assertion `frame->ptr() + frame->width*frame->height <= _vars._exFramePos' failed.
/usr/bin/dreamweb: line 3: 124674 Aborted                 (core dumped) scummvm "$@" -f -p /usr/share/dreamweb dreamweb

Where the last two lines seem to describe that ​this assertion failed. It's unclear to me exactly what a frame is in this context, but on the chance that this is related to the size of the screen/window, the following information might be helpful: Since I'm running on a MacBook Pro 14,1, the resolution is fairly high, 2560x1600, and although I usually run with Sway with the output scaled to 1.5, I checked that the problem is the same with the nominal scaling as well.
I've attached a save file, DREAMWEB.D01, at the correct point in the game, so one should simply have to load the game, walk to the plinth, use the key on it, and wait a few moments for the game to crash.

Game language:
English.

Game Version:
DreamWeb was downloaded from ​http://downloads.sourceforge.net/scummvm/dreamweb-cd-uk-1.1.zip, and when run it seems to report its version as Running DreamWeb (CD/DOS/English).

My system:

$ neofetch --off
OS: Arch Linux x86_64 
Host: MacBookPro14,1 1.0 
Kernel: 6.9.7-arch1-1 
Uptime: 4 hours, 30 mins 
Packages: 1552 (pacman) 
Shell: bash 5.2.37 
Resolution: 2560x1600 
WM: sway 
Theme: Arc-Dark [GTK2/3] 
Icons: Arc [GTK2/3] 
Terminal: terminator 
CPU: Intel i5-7360U (4) @ 3.600GHz 
GPU: Intel Iris Plus Graphics 640 
Memory: 6485MiB / 15860MiB 

Save game:
Attached; DREAMWEB.D01