fix: free() invalid next size (fast)