There's no bounds testing in hget(): some valid sequences of operations will cause buffer overflows. For example, this should segfault:

    int (**table)[2] = hnew();

    for (int j=0; j<40; ++j) {
      hset(table, (10 + j*SIZE), 0);
    }

The problem is, the probing function doesn't wrap (the "t += h" part), so if you have have several colliding keys, it will probe for them past the end of the table.