Made observable by the fuzz tests in commit e0a2b390c144e123e2fc8a289fdff36815476964

Crash in https://github.com/bitcoin/bitcoin/blob/d8f1e1327f9c2f9fcc804468f6a981580acdf30a/src/addrman.h#L261

OSS-Fuzz reproducer: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36208

Can be reproduced locally in a few CPU hours via `FUZZ=addrman_deserialize ./src/test/fuzz/fuzz -use_value_profile=1` (using the qa-assets seed as starting point).
template <typename Stream>
    void Serialize(Stream& s_) const
        EXCLUSIVE_LOCKS_REQUIRED(!cs)
    {
        LOCK(cs);
        
        OverrideStream<Stream> s(&s_, s_.GetType(), s_.GetVersion() | ADDRV2_FORMAT);
        s << static_cast<uint8_t>(FILE_FORMAT);
        
        
        static constexpr uint8_t lowest_compatible = Format::V3_BIP155;
        s << static_cast<uint8_t>(INCOMPATIBILITY_BASE + lowest_compatible);
        s << nKey;
        s << nNew;
        s << nTried;
        int nUBuckets = ADDRMAN_NEW_BUCKET_COUNT ^ (1 << 30);
        s << nUBuckets;
        std::unordered_map<int, int> mapUnkIds;
        int nIds = 0;
        for (const auto& entry : mapInfo) {
            mapUnkIds[entry.first] = nIds;
            const CAddrInfo &info = entry.second;
            if (info.nRefCount) {
                assert(nIds != nNew); 
                s << info;
                nIds++;
            }
        }
        nIds = 0;
        for (const auto& entry : mapInfo) {