I am working on a project that must accurately keep time over weeks & months. Therefore, the millis() rollover is important. A colleague helped modify the wiring.c & .h files to include a function that directly returns the timer0_overflow_count. Similar to gpvillamil's schema, the bitwise AND isolates only the long portion (timer0_overflow_count & 0xFFFF). Therefore, the overflow is known and can be trapped.
Using this, I ran a simple program for over 9 hours and captured:
Therefore, it would appear that the millis() overflow occurs at 34,359,739ms or 9h, 32m, 39s, and 739ms. I'll be working on rollover trap based on millis() so that the code is compatible w/ Arduino 6...
Till then, I've done the following code modifications, but I would instead recommend making your own header:
unsigned long ticks()
// timer 0 increments every 8 cycles, and overflows when it reaches 256.
unsigned long ticks(void);