FFI::MemoryPointer#free() eventually invokes CachingNativeMemoryAllocator.AllocatedMemoryIO.free(), which frees the native memory. In doing so, it also nulls out a keep-alive referent, but does so before it frees the native memory, not after, which can possibly lead to that memory chunk being recycled into another allocation, and then freed.