To reproduce from 'emacs -Q /path/to/dcl.c’ (file attached):
   1. M-x `subword-mode' (side question: should C-c C-w still use the
      obsolete alias `c-subword-mode'?).
   2. Navigate to the function 'int dirdcl(void)' and use
      `narrow-to-defun' (C-x n d).
   3. From the top of the buffer, use `forward-word' with an arg greater
      than 1 (like C-u 2 M-f).
   4. Repeat this with C-x z z z z... until you get an error around the
      start of the while loop (2nd to last message in list below).
   5. Moving point forward then trying the same command again will yield
       the last message with a number greater than `point-max' (5741).

Other notes:
      - The bug dissapears with a widened buffer or when narrowing to
        earlier functions.
      - `backward-word’ doesn’t seem to have the same problem.
      - I'm reporting this from OSX 10.14.6 (homebrew), but it also occurs on
        Arch Linux (emacs being installed from the standard pacman repos).

Thanks,
Ian

————————————————————————————————————————————————

In GNU Emacs 27.2 (build 1, x86_64-apple-darwin18.7.0, NS appkit-1671.60 Version 10.14.6 (Build 18G95))
 of 2021-03-27 built on builder10-14.porkrind.org
Windowing system distributor 'Apple', version 10.3.1671
System Description:  Mac OS X 10.14.6

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.
Subword mode enabled in current buffer
You can run the command ‘subword-mode’ with M-x sub-mo RET
Subword mode enabled in current buffer
Mark saved where search started
Repeating command 2 forward-word [22 times]
funcall-interactively: Error in syntax_table logic for to-the-end intervals
funcall-interactively: Point 5751 after end of properties

Configured using:
 'configure --with-ns '--enable-locallisppath=/Library/Application
 Support/Emacs/${version}/site-lisp:/Library/Application
 Support/Emacs/site-lisp' --with-modules'

Configured features:
NOTIFY KQUEUE ACL GNUTLS LIBXML2 ZLIB TOOLKIT_SCROLL_BARS NS MODULES
THREADS JSON PDUMPER GMP

Important settings:
  value of $LANG: en_CA.UTF-8
  locale-coding-system: utf-8-unix

Major mode: C/*l

Minor modes in effect:
  subword-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t
  abbrev-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message rmc puny dired dired-loaddefs
format-spec rfc822 mml mml-sec password-cache epa derived epg epg-config
gnus-util rmail rmail-loaddefs text-property-search time-date subr-x seq
byte-opt gv bytecomp byte-compile cconv mm-decode mm-bodies mm-encode
mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047
rfc2045 ietf-drums mm-util mail-prsvr mail-utils repeat misearch
multi-isearch cap-words superword subword cc-mode cc-fonts easymenu
cc-guess cc-menus cc-cmds cc-styles cc-align cc-engine cc-vars cc-defs
cl-loaddefs cl-lib tooltip eldoc electric uniquify ediff-hook vc-hooks
lisp-float-type mwheel term/ns-win ns-win ucs-normalize mule-util
term/common-win tool-bar dnd fontset image regexp-opt fringe
tabulated-list replace newcomment text-mode elisp-mode lisp-mode
prog-mode register page tab-bar menu-bar rfn-eshadow isearch timer
select scroll-bar mouse jit-lock font-lock syntax facemenu font-core
term/tty-colors frame minibuffer cl-generic cham georgian utf-8-lang
misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms
cp51932 hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese composite charscript charprop case-table epa-hook
jka-cmpr-hook help simple abbrev obarray cl-preloaded nadvice loaddefs
button faces cus-face macroexp files text-properties overlay sha1 md5
base64 format env code-pages mule custom widget hashtable-print-readable
backquote threads kqueue cocoa ns multi-tty make-network-process emacs)

Memory information:
((conses 16 67774 7216)
 (symbols 48 8485 1)
 (strings 32 21588 2096)
 (string-bytes 1 819438)
 (vectors 16 12983)
 (vector-slots 8 159689 12408)
 (floats 8 21 47)
 (intervals 56 528 0)
 (buffers 1000 12))