Thanks for the detailed bug report. In addition to the minimal fix referenced in the ticket, I also (in commit 6d82212636eec154bb7322ce7a6e02fd6d1aa596) moved the loop body into a helper function so that its memory management could conform to our normal pattern.