Can you not do: for (size_t i = len-1; i < len; i--)? Isn't -1 defined to be the largest integer that the unsigned type can handle?

Edit: I guess that wasn't the point of your example (that it may not be easily recognisable as a bug?)