> the seventh byte past the buffer is then zeroed/set to the null terminator. I wonder if and how this is exploitable.

Well, looking at the upstream code, the original value is saved away before zeroing it out and then unconditionally restored after running crypt.

If sudo is single threaded and crypt() doesn't malloc() anything, I don't think that can be exploited. Worst case would be a segfault if the password was somehow close enough to a page boundary.