Yes, this does seem to be a bug.
To fix this bug right wants some refactoring. Let us
take this in stages.
Version 2.18 of debmirror (which I mean to upload as
adopting new maintainer) partly refactors the relevant
code. We'll let the partly refactored 2.18 stay in
sid and testing a while, in case the refactoring has
inadvertently broken something. After that, I or
someone else can try to fix the bug itself.
I have tested the refactoring. As far as I can tell,
it cleans up the relevant part of the program's
internal logic without materially altering the
program's external behavior, but also therefore without
fixing the bug.
If someone besides me ends up trying to fix the bug:
I can recommend starting by searching in the debmirror
script executable for the symbol
do_contents_for_each_dist_arch_sect, which my recent
refactoring has introduced pursuant to this bug. I
suspect that the bug lies in the neighborhood of one of
the several occurrences of this symbol. I also suspect
that the bug will now be easier to isolate than it
was before, provided that you can read Perl at a
moderately advanced level.
You can also search in the debmirror script executable
for the hash key do_for_source, which is not yet used,
but which I have introduced to prepare to attack
this bug.