And then there's of course when calloc returns non-zeroed memory once in a while, which causes... 'interesting' bugs.

https://bugzilla.redhat.com/show_bug.cgi?id=1293976 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5229