The initial sync performed when creating a mirror can overrun the end of the
mapped sections of the underlying devices, corrupting data that doesn't
belong to device-mapper.

        do {
                *region = find_next_zero_bit((unsigned long *) lc->sync_bits,
                                             lc->region_count,
                                             lc->sync_search);
                lc->sync_search = *region + 1;
 
                if (*region == lc->region_count)
                        return 0;
 
        } while (log_test_bit(lc->recovering_bits, *region));

        log_set_bit(lc, lc->recovering_bits, *region);
                                                                                
If every bit up to lc->sync_bits is 1 (easily reproduced by setting
the 'nosync' option which is not supposed to do any syncing) *region gets set
to a value that exceeds lc->region_count and you see 'attempt to access beyond
end of device' errors.