NSMutableData appendBytes is setting length to -1 and crashing - ios

Question

I'm getting a rare and intermittent crash which looks like appendBytes being called with -1 as it's length.
now, I've hard coded the "length" argument every time I've used this method so I can't see how this could happen and worse still I can't see how I could test for and avoid this crash.
here's the top of the stack and the exception (note the ~4.2b length):
*** Terminating app due to uncaught exception 'NSMallocException', reason: '*** -[NSConcreteMutableData appendBytes:length:]: unable to allocate memory for length (4294967295)'
*** Call stack at first throw:
(
0 CoreFoundation 0x91ec5a67 __raiseError + 231
1 libobjc.A.dylib 0x9950a149 objc_exception_throw + 155
2 CoreFoundation 0x91e2d289 +[NSException raise:format:arguments:] + 137
3 CoreFoundation 0x91e2d1f9 +[NSException raise:format:] + 57
4 Foundation 0x92d2489e _NSMutableDataGrowBytes + 1136
5 Foundation 0x92d24391 -[NSConcreteMutableData appendBytes:length:] + 354
here's a simplified version of the code that's supposedly crashing:
if (self.isConnectedToService) {
NSMutableData *myData = [NSMutableData data];
float newValue = PanValue;
const char theTwo[] = {(char)Chan_L, (char)PanParam};
[myData appendBytes:&theTwo length:2];
[myData appendBytes:&newValue length:4];
}
So length is always 2 or 4.
I've tested different situations in which the buffers contain more or less than 2 and 4 and I've never managed to cause this crash intentionally.
I've got the same code running on both MacOS10.7.4 and iOS6.0(on iPad3) and see this issue occasionally on both platforms.
so how is appendBytes getting that bogus value?