Mail with single \r, partial fetch, error "Broken virtual size in mailbox"

I run Dovecot 2.3.21 with the mdbox mailbox format.

If I do a certain partial fetch on a mail with a single carriage return \r Dovecot closes the connection and logs the following error:

Error: Mailbox INBOX: Deleting corrupted cache record uid=1: UID 1: Broken virtual size in mailbox INBOX: read(/var/spool/dovecot/user/storage/m.1): FETCH BODY[]<18.100> got too little data: 5 vs 6

This happens every time, doveadm force-resync doesn't help.

Here's how to reproduce the issue:

Deliver a mail with a single carriage return \r (here after the header/body separator, but that's not important):

echo -ne "Subject: Test\r\n\r\n\rBody\r\n" | doveadm save -u user

Then do a partial fetch from a specific offset:

. fetch 1 body[]<18.100>

• 1 FETCH (BODY[]<18> {6} ody Connection closed by foreign host.

Offset 18 with length 6 should "Body\r\n", that's why the response is 1 byte short ("got too little data: 5 vs 6" in the error message), by why is \r causing this? Other offsets seem to work.