[PATCH] fix the sanity check in evaluate_ptr_sub()