document "chunk canary corrupted" error

src/lib/libc/stdlib/malloc.3

@@ -30,9 +30,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"	$OpenBSD: malloc.3,v 1.95 2016/04/03 09:31:45 otto Exp $
+.\"	$OpenBSD: malloc.3,v 1.96 2016/10/07 12:59:04 otto Exp $
 .\"
-.Dd $Mdocdate: April 3 2016 $
+.Dd $Mdocdate: October 7 2016 $
 .Dt MALLOC 3
 .Os
 .Sh NAME
@@ -377,6 +377,11 @@ The pointer passed to
 or
 .Fn reallocarray
 has been modified.
+.It Dq chunk canary corrupted 0xhhhhllll
+A byte after the requested size has been overwritten,
+indicating a heap overflow.
+The high word is the length of the chunk,
+the low word is the offset at which corruption was detected.
 .It Dq recursive call
 An attempt was made to call recursively into these functions, i.e., from a
 signal handler.