Certain functions, including `urldecode()`, pass signed characters to ctype functions such as `isxdigit()`. On systems utilizing default signed characters and optimized table-lookup ctype functions, such as NetBSD, this behavior can result in accessing an array with a negative offset, potentially triggering a denial of service.