From this disassembly, %r8 (which is 'written' parameter) is saved on stack (`movq %r8, -0x68(%rbp)`), it is moved to %rdx in the end for assignment. I think it is likely that some code inside the fucntion before '*written' assignment smashes the stack and 'written' (and a whole change introduced by this patch) is a random victim.