What is type punning and why is it risky in C?

A strong answer

A strong candidate frames What is type punning and why is it risky in C? around the exact memory layout, compiler semantics, and hardware execution model covered in Unions, Bitfields, and Type Punning. Explain type punning via unions, strict aliasing violations, and safe alternatives like memcpy.

Now suppose you are building a network serializer, a graphics engine, or a hardware emulator. You do not want the integer approximation of pi. You want the exact 32-bit pattern that the CPU stored in RAM under the IEEE-754 floating-point standard.

When compiled with -O0, this appears to work. But when compiled with -O2 or -O3, modern compilers may reorder the write to f and the read from bits, or eliminate the read entirely.

In a production interview, always connect the specification rule to its concrete runtime consequence: state what lives on the stack versus the heap or static storage segment, how the compiler or operating system validates alignments, lifetimes, and error codes, and what happens under adversarial or boundary inputs (such as zero-length buffers, integer overflow, concurrent mutation, or partial I/O). Backing your explanation with a small trace of register/memory state transitions immediately separates senior systems engineers from candidates who only memorized syntax.

What the interviewer is listening for

• Mastery of core invariant: Diagram shared memory layout and calculate allocation sizing for unions.
• Mastery of core invariant: Inspect raw binary bit patterns using standards-compliant union type punning.
• Mastery of core invariant: Pack boolean flags and registers into discrete bit widths using bitfield syntax.
• Hardware and ABI awareness: Explaining how sizes, alignments, calling conventions, or kernel boundaries behave on real 64-bit targets rather than relying on implementation-defined assumptions.
• Defensive engineering: Naming the exact compiler flags (-Wall -Wextra -Werror), static analyzers, or runtime sanitizers (-fsanitize=address,undefined,thread) that verify correctness in CI.

Common mistakes

• Explaining only surface syntax without tracing the underlying memory addresses, ownership lifetime, or kernel/user-space state transitions.
• Assuming undefined behavior (such as signed overflow, uninitialized reads, strict-aliasing violations, or dangling pointers) will "just work" because it passed an unoptimized -O0 debug build.
• Ignoring return codes, partial reads/writes, alignment padding, or cleanup paths when an allocation or syscall fails midway through a function.