NSMutableData appendBytes sets the length to -1 and fails

I am getting a rare and intermittent crash that looks like appendBytes being called with -1 as the length. now I have hardcoded the "length" argument every time I have used this method, so I cannot see how this can happen and worse. I don't see how I can check and avoid this crash.

here's the top of the stack and the exception (note the ~ 4.2b length):

*** Terminating app due to uncaught exception 'NSMallocException', reason: '*** -[NSConcreteMutableData appendBytes:length:]: unable to allocate memory for length (4294967295)'
*** Call stack at first throw:
(
    0   CoreFoundation                      0x91ec5a67 __raiseError + 231
    1   libobjc.A.dylib                     0x9950a149 objc_exception_throw + 155
    2   CoreFoundation                      0x91e2d289 +[NSException raise:format:arguments:] + 137
    3   CoreFoundation                      0x91e2d1f9 +[NSException raise:format:] + 57
    4   Foundation                          0x92d2489e _NSMutableDataGrowBytes + 1136
    5   Foundation                          0x92d24391 -[NSConcreteMutableData appendBytes:length:] + 354 

      

        
        
        
      

    

here's a simplified version of the code that supposedly fails:

        if (self.isConnectedToService) {
            NSMutableData *myData = [NSMutableData data];

                float newValue = PanValue;
                const char theTwo[] =  {(char)Chan_L, (char)PanParam};
                [myData appendBytes:&theTwo length:2];
                [myData appendBytes:&newValue length:4];
        }

      

        
        
        
      

    

So the length is always 2 or 4.

I've tested various situations where buffers contain more or less 2 and 4, and I could never intentionally cause this crash.

I have the same code working on both macOS10.7.4 and iOS6.0 (on iPad3) and sometimes see this issue on both platforms.

so how does appendBytes get this dummy value?