tinfoil patch: make sure pixel_ptr never goes negative