Confused by segfault with legitimate call to strerror(3) on amd64 / sysctl(3) setting `odd' errno's

[Garrett Cooper]

Hi amd64 and Hackers,
    Uh, I'm really confused why 1) this error (errno => ENOMEM) would
occur when I have more than enough free memory (both on x86 and amd64)
and 2) why strerror would segfault in the call to errx in the attached
sourcefile on amd64 only. Not initializing len causes the second
output sample (errno => 14, which is EFAULT).
    Any ideas?
    Please CC me if mailing on amd64@ as I'm not subscribed to the list.
Thanks,
-Garrett

/* Program */
#include <err.h>
#include <errno.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/sysctl.h>

int
main() {

        int mib[4];

        size_t len;

        if (sysctlnametomib("kern.ipc.shmmax", mib, &len) != 0) {
                printf("Errno: %d\n", errno);
                errx(errno, "Error: %s", strerror(errno));
        }

        printf("%lu\n", len);

        return 0;

}

# output for len preset to 0:
[gcooper at optimus ~]$ ./test2
Errno: 12
test2: Segmentation fault: 11 (core dumped)
[gcooper at optimus ~]$ uname -a
FreeBSD optimus.gateway.2wire.net 8.0-CURRENT FreeBSD 8.0-CURRENT #4:
Sun Jan 11 12:30:31 PST 2009
root at optimus.gateway.2wire.net:/usr/obj/usr/src/sys/OPTIMUS  amd64

[gcooper at orangebox /usr/home/gcooper]$ ./test
Errno: 12
test: Error: Cannot allocate memory
[gcooper at orangebox /usr/home/gcooper]$ uname -a
FreeBSD orangebox.gateway.2wire.net 8.0-CURRENT FreeBSD 8.0-CURRENT
#4: Sat Jan  3 22:54:52 PST 2009
gcooper at orangebox.gateway.2wire.net:/usr/obj/usr/src/sys/ORANGEBOX
i386

# output for len not preset to 0:
[gcooper at optimus ~]$ ./test2
Errno: 14
test2: Segmentation fault: 11 (core dumped)