This also applies to C++ <locale> functions, like std::isspace.

Another fun one: With FD_CLR, FD_ISSET, FD_SET you can corrupt memory by merely passing a socket descriptor that is not 0..1024. Pass a negative integer for some undefined behavior as well (shift by negative value occurs here [1])

[1] https://github.com/lattera/glibc/blob/895ef79e04a953cac14938...