无法解释的OverflowException将代表屏幕坐标的IntPtr转换为Int32

我们有一个WinForms AnyCPU应用程序，其中供应商库控件偶尔会在运行多个监视器的64位用户盒上抛出以下异常:

System.OverflowException: Arithmetic operation resulted in an overflow.
   at VendorLibraryName.VendorControl.WndProc(Message& m)
   at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)

我查看了供应商库控件的WndProc处理程序，唯一看起来可能会产生溢出的代码是这样的(注释是我的-这是反编译的):

switch (msg)
{
    case 132: // NCHITTEST 
    case 672: // NCMOUSEHOVER 
    // Technically dangerous: convert IntPtr to Int32 in a 64-bit process.
    // However, note that for these message codes, 
    // LParam represents a "packed" x and y screen-coordinate. 
    // Given my understanding of how this packing occurs, I can't think
    // of how to construct an LParam such that it would overflow an Int32.
    SomeMethod(x: (int)m.LParam & 65535, y: (int)m.LParam >> 16);
    // More code...

下面是实际的IL转换和位偏移:

IL_0092: ldarg.1
IL_0093: call instance native int [System.Windows.Forms]System.Windows.Forms.Message::get_LParam()
// As far as I can tell, this is the only instruction on which overflow could occur
IL_0098: call int32 [mscorlib]System.IntPtr::op_Explicit(native int)
IL_009d: ldc.i4 65535
IL_00a2: and
IL_00a3: ldarg.1
// Same thing here...
IL_00a4: call instance native int [System.Windows.Forms]System.Windows.Forms.Message::get_LParam()
IL_00a9: call int32 [mscorlib]System.IntPtr::op_Explicit(native int)
IL_00ae: ldc.i4.s 16
IL_00b0: shr

显然，这个例程看起来容易出现溢出问题，因为有Message的转换。64位进程中的LParam (IntPtr)为Int32。事实上，这个例程是错误的，因为它没有正确地处理负坐标——它看起来像是将windows的GET_X_LPARAM和GET_Y_PARAM宏错误地移植到c#中。

然而，我无法看到如何为NCHITTEST/NCMOUSEHOVER构建LParam，这在实际中会溢出Int32的范围。(I 认为下16位由带符号的 16位X坐标组成，其余位由带符号扩展的16位Y坐标组成。如果我错了，请纠正我，因为这可能是一个严重的误解)。

我无法用许多不同的监视器配置和窗口位置在我的开发盒上重现异常。

什么屏幕坐标会导致溢出?或者这个块是否有其他方式导致溢出?