> ** NULL assignment detected

That's without any hardware support (MMU) on DOS; compiler-generated code does the null checks.

Without it, you get unpredictable results for that bit of UB; the program can trample bytes around the null address.

I got lucky here with the compiler detecting the problem given that it wasn't just limited to using a null pointer. Depending on the buffer offset being handed back, it could have hit anywhere in the data segment.