Your example is officially undefined behavior. I'll refer to the C standard:
[C11 §6.5.2.1 ¶3]
Successive subscript operators designate an element of a multidimensional array object. If E is an n-dimensional array (n >= 2) with dimensions i x j x . . . x k, then E (used as other than an lvalue) is converted to a pointer to an (n - 1)-dimensional array with dimensions j x . . . x k. If the unary * operator is applied to this pointer explicitly, or implicitly as a result of subscripting, the result is the referenced (n - 1)-dimensional array, which itself is converted into a pointer if used as other than an lvalue. It follows from this that arrays are stored in row-major order (last subscript varies fastest).
[C11 §6.5.6 ¶8]
When an expression that has integer type is added to or subtracted from a pointer, the result has the type of the pointer operand. If the pointer operand points to an element of an array object, and the array is large enough, the result points to an element offset from the original element such that the difference of the subscripts of the resulting and original array elements equals the integer expression. In other words, if the expression P points to the i-th element of an array object, the expressions (P)+N (equivalently, N+(P)) and (P)-N (where N has the value n) point to, respectively, the i+n-th and i-n-th elements of the array object, provided they exist. Moreover, if the expression P points to the last element of an array object, the expression (P)+1 points one past the last element of the array object, and if the expression Q points one past the last element of an array object, the expression (Q)-1 points to the last element of the array object. If both the pointer operand and the result point to elements of the same array object, or one past the last element of the array object, the evaluation shall not produce an overflow; otherwise, the behavior is undefined. If the result points one past the last element of the array object, it shall not be used as the operand of a unary * operator that is evaluated.
The emphasis above is mine. The expression a[2][-2]
carries a lot of meaning per the above two paragraphs. According to the first paragraphs a[2]
will refer to an array, specifically the third int[2]
contained in a
. At this point, any subscript operator applied further needs to be valid in regards to this array of 2 integers.
Since [-2]
is now applied to an int[2]
, the resulting pointer arithmetic goes outside the aggregate it's applied to, and according to the second paragraph, is undefined behavior.
Having said that, most implementations I'm aware of do the thing one may expect, and the other answers document well how it is that you got those values.