... identical data files ... which have been copied to a test location, not each host's live wtmp file.

Oh. That discounts that idea. My apologies.

The other possibility that comes to mind as a result of your expanded description of the problem, is that some parts of the file are being interpreted as unicode with the result that multiple bytes are being read and treated as a single character.

The way to verify that possibility is to ensure that the file is being treated as 'raw' using the 3-arg open:

open(WTMP, '<:raw', './wtmp') || die "Unable to open wtmp file: $!\n";
[download]

Or binmode

open(WTMP, './wtmp') || die "Unable to open wtmp file: $!\n";
binmode( WTMP, ':raw' )
[download]

Either way should tell you if this is the problem.