Yep, you are correct. I was requesting a buffer of data, passing the length of the buffer instead of the last position in the buffer as required, which would be the length minus 1. That one extra write overwrites whatever just happens to be in the memory location after the buffer, thus the randomness of the crash. Sorry for the noise. Been debugging for days, and only after I break down and ask someone do I find the cause (of this and several other apparently random crashes). 