overfreed pointer