Reversing a custom key exchange and stream cipher to get on the wire, then a refcounted free that leaves a live pointer, ending in House of Apple on _IO_2_1_stdout_