PR #21549 introduced a subtle overflow bug that seemed impossible, but can empirically happen. This PR fixes it by saturating to zero. I did try to write a regression test for this, but couldn't manage it. Instead, I'll attach before-and-after screen recordings.