Made observable by the fuzz tests in commit e0a2b390c144e123e2fc8a289fdff36815476964

Crash in https://github.com/bitcoin/bitcoin/blob/d8f1e1327f9c2f9fcc804468f6a981580acdf30a/src/addrman.h#L261

OSS-Fuzz reproducer: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36208

Can be reproduced locally in a few CPU hours via `FUZZ=addrman_deserialize ./src/test/fuzz/fuzz -use_value_profile=1` (using the qa-assets seed as starting point).
if (format >= Format::V2_ASMAP) {
            s >> serialized_asmap_checksum;
        }
        const bool restore_bucketing{nUBuckets == ADDRMAN_NEW_BUCKET_COUNT &&
                                     serialized_asmap_checksum == supplied_asmap_checksum};
        if (!restore_bucketing) {
            LogPrint(BCLog::ADDRMAN, "Bucketing method was updated, re-bucketing addrman entries from disk\n");
        }
        for (auto bucket_entry : bucket_entries) {
            int bucket{bucket_entry.first};
            const int entry_index{bucket_entry.second};
            CAddrInfo& info = mapInfo[entry_index];
            
            
            
            if (info.nRefCount >= ADDRMAN_NEW_BUCKETS_PER_ADDRESS) continue;
            int bucket_position = info.GetBucketPosition(nKey, true, bucket);
            if (restore_bucketing && vvNew[bucket][bucket_position] == -1) {
                
                vvNew[bucket][bucket_position] = entry_index;
                ++info.nRefCount;
            } else {
                
                
                bucket = info.GetNewBucket(nKey, m_asmap);
                bucket_position = info.GetBucketPosition(nKey, true, bucket);
                if (vvNew[bucket][bucket_position] == -1) {
                    vvNew[bucket][bucket_position] = entry_index;
                    ++info.nRefCount;
                }