overlapping FIXED mmap clobbering

gistfile1.c

#include <stdio.h>
#include <sys/mman.h>
#include <err.h>

int main(int argc, char **argv) {
    char *slab = NULL, *after = NULL, *overlap = NULL;
    int sz = 4096;
#define CHECK(P) if (P == NULL) err(1, #P);
    slab = mmap(NULL, sz, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON,-1,0);
    CHECK(slab);
    slab[0] = 'a';             /* write to actually page it in */
    after = mmap(slab + sz, sz,
        PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON|MAP_FIXED,-1,0);
    CHECK(after);
    after[0] = 'b';
    overlap = mmap(slab + sz, sz,
        PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON|MAP_FIXED,-1,0);
    CHECK(overlap);
    overlap[1] = 'c';

    printf("'%c' '%c' '%c'\n", slab[0], after[0], overlap[1]);
    /*
     * $ uname -a
     * Darwin laptop.lan 11.4.0 Darwin Kernel Version 11.4.0: Mon Apr  9 19:32:15 PDT 2012; root:xnu-1699.26.8~1/RELEASE_X86_64 x86_64
     * $ ./clobber
     * 'a' '^@' 'c'     # the ^@ is 0x00
     * 
     * On OSX, `overlap` clobbers `after` with 0x00 bytes. 
     */
    return 0;
}