Right, the behavior for "out of bounds" addressing is frequently (ab)used. Tagged pointers have been used in loads of stuff. I think x86_64 prohibits this and the MMU will fault if there are interesting things in the high bits, but it still works on aarch64 systems.