The description of the memchr function in C11, 7.24.5.1p2, says that memchr cannot access the part of the array after the located char: "The implementation shall behave as if it reads the characters sequentially and stops as soon as a matching character is found." The glibc manual doesn't provide this guarantee: "This function finds the first occurrence of the byte @var{c} (converted to an @code{unsigned char}) in the initial @var{size} bytes of the object beginning at @var{block}. The return value is a pointer to the located byte, or a null pointer if no match was found." https://sourceware.org/git/?p=glibc.git;a=blob;f=manual/string.texi;h=016fd0b9a05f3126a1594e942c5e6da0669d0410;hb=HEAD#l1716 The implementation is probably fine so only the manual is wrong.