Use after free, the QUEUE_FOREACH macro reads q[0] at loop end. Pop items off the queue instead.