if(numMarkers<1000) numMarkers++;assert(numMarkers<=1000);for(int i=0;i<numMarkers;i++){ assert(i<numMarkers && numMarkers<=1000); marker.Blit(markers.x, markers.y);}
How does this read past the bounds? numMarkers is at most 1000, so i is at most 999.
However:
markers[markerIndex].x=(int)x+16;markers[markerIndex].y=(int)y+16;markerIndex++;if(markerIndex>1000) markerIndex=0;
In this case, markerIndex can reach 1000 and cause an overflow.