The strstr implementation contains the following snippet which results in out-of-bounds reads in memchr (we detect them on CHERI because we have byte-granularity bounds of small buffers): /* Fast estimate for MIN(l,63) */ size_t grow = l | 63; const unsigned char *z2 = memchr(z, 0, grow); The use of `|` means this is very much not an approximation of `MIN(l,63)`. What is actually intended here? For CheriBSD (via FreeBSD) I need a way to avoid out-of-bounds reads entirely (`MIN(l,63)` does seem to work in simple system-level testing, but given the mismatch it's unclear that's what was intended). Thanks, Brooks