When memcpy is called, the size parameter is passed in the register r16.  The attached code causes all 32-bits of r16 to be loaded with random value.  Then a 16-bit wide variable is passed, through multiple levels of calls, as the size parameter to memcpy.  This variable is copied into the lower 16-bits of r16, but the upper bits are never cleared.  Thus, memcpy starts with a random value in the upper 16-bits of r16, the size parameter.  This eventually causes a CPU exception to occur.

To build the test case ...

% clpru -@options.txt main.c

main.c has several descriptive comments. Inspect the generated file main.asm.