The system call handlers don't validate the memory addresses / lengths passed to for memset, memcpy, and many other system calls. Reported by @mickael9 and also recently fixed in a quake3e commit.