I investigated one corrupted database and find that it has very many orphan backversions but few in-use ones. That's because of
return corrupt(tdbb, VAL_REL_CHAIN_ORPHANS, relation, vdr_rel_backversion_counter - vdr_rel_chain_counter, vdr_rel_chain_counter);
Then I find that there are data pages with backversions but they are absent in pointer page. I found that it may happen if server crashed before flushing PP. Carefulwrite work correctly in this case.
Improvement can be to build map of visited datapages directly while walking relation and map of visited data pages by reference to backversions. In such way we can find real data pages and even return them into pointer page and page inventary page.