Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -9335,12 +9335,11 @@
 ** if this is the first reference to the page.
 **
 ** Also check that the page number is in bounds.
 */
 static int checkRef(IntegrityCk *pCheck, Pgno iPage){
-  if( iPage==0 ) return 1;
-  if( iPage>pCheck->nPage ){
+  if( iPage>pCheck->nPage || iPage==0 ){
     checkAppendMsg(pCheck, "invalid page number %d", iPage);
     return 1;
   }
   if( getPageReferenced(pCheck, iPage) ){
     checkAppendMsg(pCheck, "2nd reference to page %d", iPage);
@@ -9391,21 +9390,16 @@
   int iPage,            /* Page number for first page in the list */
   int N                 /* Expected number of pages in the list */
 ){
   int i;
   int expected = N;
-  int iFirst = iPage;
-  while( N-- > 0 && pCheck->mxErr ){
+  int nErrAtStart = pCheck->nErr;
+  while( iPage!=0 && pCheck->mxErr ){
     DbPage *pOvflPage;
     unsigned char *pOvflData;
-    if( iPage<1 ){
-      checkAppendMsg(pCheck,
-         "%d of %d pages missing from overflow list starting at %d",
-          N+1, expected, iFirst);
-      break;
-    }
     if( checkRef(pCheck, iPage) ) break;
+    N--;
     if( sqlite3PagerGet(pCheck->pPager, (Pgno)iPage, &pOvflPage, 0) ){
       checkAppendMsg(pCheck, "failed to get page %d", iPage);
       break;
     }
     pOvflData = (unsigned char *)sqlite3PagerGetData(pOvflPage);
@@ -9445,14 +9439,16 @@
       }
     }
 #endif
     iPage = get4byte(pOvflData);
     sqlite3PagerUnref(pOvflPage);
-
-    if( isFreeList && N<(iPage!=0) ){
-      checkAppendMsg(pCheck, "free-page count in header is too small");
-    }
+  }
+  if( N && nErrAtStart==pCheck->nErr ){
+    checkAppendMsg(pCheck,
+      "%s is %d but should be %d",
+      isFreeList ? "size" : "overflow list length",
+      expected-N, expected);
   }
 }
 #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
 
 /*

Index: test/corrupt2.test
==================================================================
--- test/corrupt2.test
+++ test/corrupt2.test
@@ -589,11 +589,11 @@
 } {2}
 
 do_execsql_test 14.3 {
   PRAGMA integrity_check;
 } {{*** in database main ***
-Main freelist: free-page count in header is too small}}
+Main freelist: size is 3 but should be 2}}
 
 # Use 2 of the free pages on the free-list.
 #
 do_execsql_test 14.4 {
   INSERT INTO t1 VALUES(randomblob(2500));
@@ -601,11 +601,11 @@
 } {0}
 
 do_execsql_test 14.5 {
   PRAGMA integrity_check;
 } {{*** in database main ***
-Page 3 is never used}}
+Main freelist: size is 1 but should be 0}}
 
 
 finish_test
 
 finish_test

Index: test/corrupt3.test
==================================================================
--- test/corrupt3.test
+++ test/corrupt3.test
@@ -65,22 +65,26 @@
 } 0      ;# First chained overflow is 0
 
 integrity_check corrupt3-1.6
 
 # Make the overflow chain loop back on itself.   See if the
-# corruption is detected.   (Actually, the last pointer in
-# an overflow chain is ignored, so this is not an error.)
+# corruption is detected.
 #
 do_test corrupt3-1.7 {
   db close
   hexio_write test.db 2048 [hexio_render_int32 3]
   sqlite3 db test.db
   catchsql {
     SELECT x FROM t1
   }
 } [list 0 $bigstring]
-integrity_check corrupt3-1.8
+do_test corrupt3-1.8 {
+  catchsql {
+    PRAGMA integrity_check
+  }
+} {0 {{*** in database main ***
+On tree page 2 cell 0: 2nd reference to page 3}}}
 
 # Change the pointer for the first page of the overflow
 # change to be a non-existant page.
 #
 do_test corrupt3-1.9 {
@@ -109,9 +113,9 @@
 do_test corrupt3-1.12 {
   catchsql {
     PRAGMA integrity_check
   }
 } {0 {{*** in database main ***
-On tree page 2 cell 0: 1 of 1 pages missing from overflow list starting at 0
+On tree page 2 cell 0: overflow list length is 0 but should be 1
 Page 3 is never used}}}
 
 finish_test