Looking at the specs in PEP 293 (https://www.python.org/dev/peps/pep-0293/), it is certainly possible for the error handler to return a newpos outside the range start - end, meaning in most cases: a value >= end.

There's a good reason for this: the codec may not be able to correctly determine the end of the sequence and so the end value presented by the codec is not necessarily a valid start to continue encoding/decoding. The error handler can e.g. choose to skip more input characters by trying to find the next valid sequence.

In the example script, the handler returns start, so the value is within the range. A limit would not solve the problem.

It seems that the reallocation logic of the codecs is the main problem here.