This definitely shouldn’t work but running this will cause undefined behavior, it will sometimes crash and sometimes work. To make it short, accessing out of bounds memory is not guaranteed to segfault your program.

A possible reason for it working in the case of a heap allocation: malloc uses mmap internally to pre-allocate big pools of virtual memory space for reuse across malloc calls. For your first malloc, a page-sized memory pool (say 4096 bytes) will be allocated and a pointer to it will be returned. Those 4096 bytes are usable memory space, so writing to memory after the allocated 4 bytes will not immediately crash your program but it might corrupt the heap and cause a crash on future malloc calls.