So, I just checked and it seems that the parent pointed to a musl repository that contains old code.

The current code doesn't contain that undefined behavior-triggering expression: https://git.musl-libc.org/cgit/musl/tree/src/malloc/calloc.c