@davidfor: Oh. USB. That would certainly explain it. Thanks

.
Random thought: 512KB might be the actual size of the syslog ringbuffer, which is why I usually follow it somewhere when I'm not sure if I'm going to have enough backlog in a single "after the fact" logread call

.
(In practice, that usually involves a logread -f in a shell over USBNet, or over WiFi w/ ForceWifiOn for USB-related stuff).