A stumper!

Q2.3 turned out to be quite a bugger of a problem. Originally I thought
I might need to scan the heap, but I don't even know if that's possible.
I took a stab at it, though.