Made observable by the fuzz tests in commit e0a2b390c144e123e2fc8a289fdff36815476964

Crash in https://github.com/bitcoin/bitcoin/blob/d8f1e1327f9c2f9fcc804468f6a981580acdf30a/src/addrman.h#L261

OSS-Fuzz reproducer: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36208

Can be reproduced locally in a few CPU hours via `FUZZ=addrman_deserialize ./src/test/fuzz/fuzz -use_value_profile=1` (using the qa-assets seed as starting point).
template <typename Stream>
    void Unserialize(Stream& s_)
        EXCLUSIVE_LOCKS_REQUIRED(!cs)
    {
        LOCK(cs);
        assert(vRandom.empty());
        Format format;
        s_ >> Using<CustomUintFormatter<1>>(format);
        int stream_version = s_.GetVersion();
        if (format >= Format::V3_BIP155) {
            
            
            stream_version |= ADDRV2_FORMAT;
        }
        OverrideStream<Stream> s(&s_, s_.GetType(), stream_version);
        uint8_t compat;
        s >> compat;
        const uint8_t lowest_compatible = compat - INCOMPATIBILITY_BASE;
        if (lowest_compatible > FILE_FORMAT) {
            throw std::ios_base::failure(strprintf(
                "Unsupported format of addrman database: %u. It is compatible with formats >=%u, "
                "but the maximum supported by this version of %s is %u.",
                format, lowest_compatible, PACKAGE_NAME, static_cast<uint8_t>(FILE_FORMAT)));
        }
        s >> nKey;
        s >> nNew;
        s >> nTried;
        int nUBuckets = 0;
        s >> nUBuckets;
        if (format >= Format::V1_DETERMINISTIC) {