&gt; I&#x27;ve no clue about the trailing NUL on the record itself, perhaps a safety feature?<p>Could be. Or perhaps there&#x27;s enough code paths in common between string parsing and document parsing that they decided to put a trailing null byte on both.<p>Stepping back a bit, though, the fact that BSON is optimized for &quot;direct&quot; use in C code is really scary. That suggests that any failure to completely validate BSON data could open up vulnerabilities in C code manipulating it.