I don't know any format or application that uses this for legitimate purposes. The most frequent "application" seem to be exploits. As such I don't think the "y

I don't know any format or application that uses this for legitimate purposes. The most frequent "application" seem to be exploits. As such I don't think the "you're responsible" call would be very helpful. Or rather, you might just as well say "if you send a packet with an overflowing length field, you're responsible for whatever happens downstream".