There's only one reasonable behavior for a negative length to memcpy: raise an error. That would catch exactly this kind of error. I feel like it proves my point rather than contradicting it – if the argument to memcpy is unsigned, you have no way of detecting this programming error; your only option is taking that very large value as literal – which leads to a different and far less helpful error (in the best case).