Yes, the semantics of `incref=False` is that the newly created wrapper takes ownership of a reference, typically obtained from a constructor. Each `ffi.gc` object is supposed to call its "decref" callback exactly once, and there should be exactly one of those for every "incref" calls (including those done by cairo itself in constructors.)

Re: "the following fails": Yes, I’m getting 2 instead of 1 as well. This is a bug. I’m not sure what’s going on, but will investigate.

(Re: "The following should crash", use-after-free does not always crash, but it is undefined. If you do get 0 without crashing, the memory probably haven’t be reused/recycled yet.)