Using the spine-c runtime. The vertexCount is parsed in spSkeletonJson_readSkeletonData and multiplied by two to get the number of floats to parse:
_readVertices(self, attachmentMap, SUPER(box), Json_getInt(attachmentMap, "vertexCount", 0) << 1);
But then inside _readVertices:
attachment->verticesCount = verticesLength;
I changed it locally to this:
attachment->verticesCount = verticesLength >> 1;
It looks like PathAttachment and MeshAttachment might have the same problem. Maybe _readVertices should take vertexCount instead of the number of floats?