@lanodan It's not clear to me that the shell itself is permitted to have undefined behavior (which would include allowance to execute rm -rf /) just because the arithmetic expression would as a C expression. Even if this is permitted, it's a serious QoI and security fault since arithmetic is often evaluated from untrusted inputs.