My version of bash:

GNU bash, version 5.0.17(1)-release (x86_64-pc-linux-gnu)

I'm currently on Ubuntu 18.04.

Reproduction:

env -i /bin/bash
/bin/ca?

I'm just now learning bash and I'm curious why the above snippet results in the following:

a@a:/$ /bin/ca?
cal: not a valid year /bin/cat

Afaik, this single ? is consumed as a wildcard, and is resolved to be /bin/cal. That much is clear, I guess. Why in the world does this result in argv[1] becoming /bin/cat (I'm assuming)? What kind of magic is going on here?

EDIT:

strace /bin/ca?

Confirms that argv is modified:

execve("/bin/cal", ["/bin/cal", "/bin/cat"], 0x7ffed1f359b8 /* 54 vars */) = 0

Why is this so?