migration: don't segfault on invalid input