if VBO is activated in the current context, it doesn't check if offset passed via glVertexPointer() is exceeds amount of
 data passed to vertex buffer object.

glBindBufferOES(GL_ARRAY_BUFFER_ES, nVBOVertices);
glVertexPointer(3, GL_FLOAT, 0, 0x60000000);
glDrawArrays(GL_TRIANGLES, 0, nVertexCount);

It is silly example but in my case I specified 32768 vertices offset instead of 31255, and it was enough to hang all QNX
 box.

What is vertex maximum count (or memory size in bytes) limit when vertices  are passed to VBO ?

What about limits for VAs ? On devg-extreme2 glGetIntegerv() returns 65536 for GL_MAX_ELEMENTS_VERTICES and 
GL_MAX_ELEMENTS_INDICES. But by mistake I've passed near 98K of vertices and all primitives have been drawn, like there 
are no any limits.