Hunk_Alloc accepts negative size to allocate

[wtfbbqhax]

note: candidate function not viable: no known conversion from 'int' to 'ha_pref' for 2nd argument
p Hunk_AllocDebug(-1, (ha_pref)0, "ABC", "XYZ", 100)
(void *) $0 = 0x0000000109000028

p Hunk_AllocDebug(-100, (ha_pref)0, "ABC", "XYZ", 100)
error: Execution was interrupted, reason: EXC_BAD_ACCESS (code=2, address=0x119001000).
The process has been returned to the state before expression evaluation.

[wtfbbqhax]

Perfect inputs with HUNK_DEBUG enabled

-1 will give you a pointer to zero 0 sized allocation

p (-1+31)&~31
(int) $23 = 0

-72, will gift you a -32 allocation attempt and an EXEC_BAD_ACCESS

p ((int)(-72 + sizeof(hunkblock_t))+31)&~3