Have you tried printing out the contents of 'j' when it exists? Since the introduction of 'j' is what is causing the SEGV to stop then I would guess its contents is influencing the outcome.

Everyone is so focused on 'k', I have yet to see anyone mention 'i'. The sprintf must traverse whatever contents 'i' is pointing to and emit that to 'k'. I suspect that 'j' and 'i' have more a relation than 'j' and 'k'.

If I had to take a guess, 'j' (when it exists) has, at some point, a null terminator ('\0') within it, and 'i' is (at some point before the SEGV) running into the contents of 'j'. This, of course, limits the amount of "garbage" you can both read and stick into the unreferenced 'k' and thus lessens the potential to SEGV.

Take 'j' out of the picture and the sprintf obviously runs into an area of memory it should not. My guess, while the sprintf is traversing 'i' either you overflow the heck out of 'k' because there is no null terminator in memory for quite some time or there is no null terminator before the sprintf gets into the text segment and the OS does not like it breaching the data segment.

I would test my theory, but AIX cores regardless of the presence of 'j'.