Comment # 7 on bug 1059075 from Andreas Schwab

The generated code for probing "char zero[pad]":

    mov    r6, sp
    add    r3, r3, #7
    bic    r3, r3, #7
    cmp    r3, #4096
    bcc    .L128
.L186:
    sub    r3, r3, #4096
    sub    sp, sp, #4096
    cmp    r3, #4096
    str    r0, [sp, #8]
    bcs    .L186
.L128:
    ldr    r7, [fp, #-56]
    sub    sp, sp, r3
    mov    r1, #0
    add    r3, sp, #8
    mov    r0, r3
    str    r0, [sp, #8]

The offset of #8 means that it overwrites a nearby variable.