I don't think we have any platforms which doesn't do (1), but Martin
   suggested that Sparc doesn't do (2). The question is, do we want to do
   that in general? The check should be quite cheap and protect against
   passing negative integers as len.


checking for overflow of addr + len would be OK, but len is already
an unsigned value.



.mrg.