DragonFlyBSD

mmap passed a size of 0 with PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON returns
a pointer to the base of the mapped ld-elf.so.2 rather than an EINVAL, which is
the expected return for len = 0.

#include <stdlib.h>
#include <sys/mman.h>

main() {
char *buf = mmap(NULL, 0, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANON, -1, 0);
printf("%p \n", buf);
pause();
}

demonstrates; look at /proc/<pid>/map after the mmap().