Android's bionic libc strlen function does a similar read-beyond-the-buffer thing: https://cs.android.com/android/platform/superproject/+/maste...

I first learned about it when valgrind complained at every place I was calling strlen.