This line:
doublebasemul(r->coeffs + ctr - 4, b->coeffs + ctr - 4, ax, (ctr - 4) / 4, add);
Adds a counter to the pointer and then subtracts four. The array is quite small (four bytes) and so ctr takes it out of representable bounds and -4 brings it back in.
The size of coeffs is know at compile time. It should be possible to determine that +ctr may take the pointer out of bounds.