char *sbrk( int incr ); also returns -1 (presumably this really means (char *)-1) on failure. This is a holdover from the good old days of PDP-11 UNIX; it really ought to be NULL also. (There is some hilarious code in a few SVR2 utilities that checks the return of malloc() for -1. Fixed at BRL.)