void* IOBuf::operator new(size_t size) {
  if (size > kMaxIOBufSize) {
    throw_exception<std::bad_alloc>();
  }
  size_t fullSize = offsetof(HeapStorage, buf) + size;
  auto storage = static_cast<HeapStorage*>(checkedMalloc(fullSize));

  new (&storage->prefix) HeapPrefix(kIOBufInUse, fullSize);

  if (io_buf_alloc_cb) {
    io_buf_alloc_cb(storage, fullSize);
  }

  return &(storage->buf);
}
The software writes data past the end, or before the beginning, of the intended buffer.