FFI: re-implement double-cleaup protection