Colin Percival wrote: > (1) The platform is i386. [...] > still be broken if conditions (1)-(3) apply AND the buffer extends > beyond 4GB (i.e., there is an integer overflow in computing "data + len"). How that could be? Isn't userland address space on i386 limited by 4GB? -Maxim