Cyrus Skipists - unread mail flag vanishes

[Michael]

Hello list,

is there anywhere some kind of a format description or spec how cyrus
skiplist format is supposed to work? I didn't find it. (btw: cyrus at
all seems to be poorly documented)

At first I have to say: my kolab install is old. It's a debian lenny
installation with kolab from squid/testing. 
i.e. kolab-cyrus is 2.2.13-5+lenny2.

My problem is: I'm using kolab with claws mail as a simple mail client.
But sometimes either of claws-mail or cyrus forgets the already read
mail (read status flag). While at one moment there are some not new
but unread mail in my mailbox (widespread, not necessarily contiguous;
marked in claws mail with blue letter symbol) at a later moment there
are no unread mails. (I didn't read those mails and I'm pretty
sure no one else did it.)

First I thought the skiplist gets corrupted but there are no DBERRORs
in the logs nor other folders get corrupted. Only one folder, the main
folder (INBOX), no sub folders.

The corresponding skiplist entry (after converting to flat file format)
is the following (6 unread mails):

7fb13dc64b8d3e3b        1 1289910886 2269 1289902471
1:2253,2260:2265,2267:2269

Without reading those mails some days later on:
7fb13dc64b8d3e3b        1 1290418603 2337 1290417399 1:2337

The first two columns are unknown to me. The first one seems to be some
kind of a pointer to the corresponding mail folder. Seems not to be an
inode directly. What else? I thought cyrus maintains no dedicated
databases!?

The third and fifth column seems to be some kind of a date. The last
update?

The fourth seems to be the highest numbered filename (so if there's a
mail in a file named .2338 it is unread in both cases)

The last column seems to be the skiplist by itself. While the later one
skips all mails (2337 out of 2337), the first one doesn't skip
2254-2259 and 2266.

So the Skiplist by itself seems to be intact. It simply skips
all those actually unread mails which it should not skip.

For me it happened 3 times in the last weeks. But I wasn't able to
observe it right in the moment it happened. Maybe it happens if
I'm on my way in the train where (sometimes) the internet connection
collapses and even claws-mail crashes. But I cannot say this for sure.

My question now is: How does those skiplists get updated and where are
possible "attack vectors" to corrupt single lines in it? Some
logs to investigate? Specs of the columns?
Client side verbose logs? Server side?

Anyone using cyrus (with or without claws mail) observing/detecting the
same issues?

Regards
Michael