Could `ref->addr` be off page at this point (i.e., could we be leaking memory here when we clear the pointer)?