Test case:

2788:0100 BBFFFF            mov     bx, FFFF
2788:0103 B448              mov     ah, 48
2788:0105 CD21              int     21
2788:0107 B448              mov     ah, 48
2788:0109 CD21              int     21
2788:010B B80158            mov     ax, 5801
2788:010E BB0200            mov     bx, 0002
2788:0111 CD21              int     21
2788:0113 B448              mov     ah, 48
2788:0115 BB0000            mov     bx, 0000
2788:0118 CD21              int     21
2788:011A 90                nop
2788:011B CC                int3
2788:011C 90                nop

If an allocation of 0 paragraphs is attempted while all MCBs are allocated, and the strategy is last fit, a wild pointer would be read. This could corrupt random memory and return an invalid success status of the allocation.

(Allocating an empty block is unusual, but should be fully supported. Upon success it should allocate an empty MCB with memory block size zero.)