Well, the contact counter is set with theStats::AddKadNode() / theStats::RemoveKadNode(), which are called in CContact::CContact() / CContact::~CContact().
However a debug log entry reveals that for some CContact a destruct is called, but no construct.

So the count becomes negative, thus 65xxx (since it's unsigned short).
I'm suspecting something rotten concerning the assigning, pushing and popping of full CContact objects (not pointers) in the UDPFirewallTester.