The first line is not actually dereferencing anything - it's taking the address of the pointer, and returning another pointer with offset p from the original one.

As far as I know, C allows arbitrary pointer arithmetic (including pointing to an out-of-bounds address) as long as you don't read/write into the invalid memory. If the p check fails, nothing will be done with pfd.

If I'm wrong, please correct me.