If you fill a buffer past 2GB, and then try to serialize a hash into it, you crash the program.

b = BSON::ByteBuffer.new
5.times { b.put_bytes("x" * (512*1024*1024)) }   # 2.5 GiB
b.put_hash({ "a" => 1 })
buffer length = 2684354560
[BUG] Bus Error at 0x0000000d7c000000
c:0003 p:---- s:0013 e:000012 l:y b:---- CFUNC  :put_hash

This happens because position (2684354560) truncates to a negative int32_t, so pvt_replace_int32 does memcpy(READ_PTR(b) + negative, ...) — a write ~2 GiB below the allocation. Same defect at write.c:694 for put_array.

(This was found while investigating SECBUG-4394, but is unrelated to it.)