the macro expansion of "char *cp;" turned into char *(curproc[cpu()]); which declares a dynamically sized array of char* called curproc. so then &cp == &(curproc[cpu()]) was actually a stack variable as "expected". it was one past the end of the array, but the implicit alloca allocated more than was necessary. do not tell me that making cp a #define was a bad idea. there are worse problems to fix. more on that later.