>> My current theory is that they had some code in their "ScrapeShield" feature that did something like this:

>> int Length = ObfuscateEmailAddressesInHtml(&OutputBuffer, CachedPage);

>> write(fd, OutputBuffer, Length);

>> But they weren't checking if the obfuscation parsers returned a negative value because of malformed HTML. This would explain the data I'm seeing.

I haven't used C in my professional career (I mainly use Java), so the fact that this function allowed a negative value, for "num bytes to write", to be passed to it and then even went on to write data without throwing an error for passing a negative value baffles me. I'm genuinely curious why this function doesn't throw an error for negative "num bytes to write". Is there any use case which I'm missing where it would be valid to send a negative value and expect it to write negative number of bytes?

[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=1139