security: protect from stack expantion into low vm addresses