I should look into whether any of the open source static analysis tools would have detected this. Valgrind detects it at runtime, but I didn't understand what was causing the issue. Poking at it with gdb didn't help me much either, because I was looking in the wrong places.
4/