sha1-lookup: handle duplicates in sha1_pos()