Any group of 4 bytes in memory can contain any of 2^32 values.

4GB of memory contains 2^29 (1/2 a billion) 8-byte aligned, 4-byte fields.

If a runaway loop writing random bytes overruns its buffer and scribbles over one of the 32-bit fields, what are the odds that the 4-bytes, viewed as an unsigned 32-bit integer, would match that fields offset into the 4GB of ram?

Illustratively:

memory:(hex)[00000000........][00000008........][00000010........][000
+00018........]...[12345678........][12345680........]...
offset:(dec) 0                 8                 16                24 
+              ... 305419896
[download]

The premise is that if free blocks are maintained with their offset into the 4GB block, and a buffer overun occurs, then any block that has been overwritten is easily detectable, with a high degree of certainty. A far higher degree than if the typical fixed known bit-pattern is written there.

Corruption could write any of the possible values anywhere; and if a fixed bit-pattern is used as the marker, there is, assuming total random corruption, a 1 in 2^32 chance of a specific field being mistaken for the fixed bit pattern. But with potentially 2^29 fields, those odds reduce markedly. I think to 1:(2^32/2^29) = 1 in 8 chance if the whole 4GB were corrupted.

But the odds that an exact offset value will be written at that exact offset has to be many time higher. But how high?