Check sbrk().
Check all user-level reads and writes are inbound.