I found that afpd would crash with a segfault as soon as one particular user connected. I spent a week tracking this down. I wish I'd seen your bug report sooner. A cursory code inspection led me to believe that this code could not cause any problems. The array "list" is 4k long, so reading one byte further into it should not cause any problems. I did not see the negative values of "i" that you observed, though this would happen if you read a value larger than 127 in the garbage space. My crash only...