malloc(3) dumps core for large size parameters around 0xffff0000.

Fix: 

I don't have one.
How-To-Repeat: 
Compile the following code and execute it.  Then something similar to the
following should happen:
% ./foo
malloc: Cannot allocate memory
zsh: 2153 segmentation fault (core dumped)  ./foo

#include <sys/types.h>
#include <sys/param.h>

#include <stdio.h>
#include <stdlib.h>

main()
{
	char *p;

	p = (char *)malloc(0x8fff0000);
	if (p == NULL)
		perror("malloc");
	else
		free(p);

	p = (char *)malloc(0xffff0000);
	if (p == NULL)
		perror("malloc");

	exit(0);
}