Today's random factoid: Linux' implementation of the Berkeley Packet Filter supports an extension where certain ancillary variables (such as the packet's protocol, or whether it's an incoming or outgoing packet) are mapped into a memory space at negative addresses, and has seemingly done so since at least 2.2. This can be very useful, but for some reason it's completely undocumented (a web search brings mostly up copies of the kernel source itself), so you'll have to use the source if you want to find it.
libpcap seems to use it in some cases, though.