Heh, I sent the valgrind logs separately but they were so large they were held for moderation. This is just the summarised version. It lists the freed blocks that were accessed and the sequence of invalid accesses. It's clear that the CCC is accessing pointers after freeing them. Jeremy Henty Freed blocks: [1]: 0x4AB7910:(IOData_t *), freed by a_IO_ccc (IO.c:385) [2]: 0x4AB78C0:(ChainLink *Info), freed by a_IO_ccc (IO.c:386) [3]: 0x4AB5768:(ChainLink *Info), freed by a_Dpi_ccc (dpi.c:696) [4]: 0x4AB5718:(ChainLink *Info), freed by a_Capi_ccc (capi.c:536) [5]: 0x4AACE10:(capi_conn_t *), freed by a_Capi_ccc (capi.c:535) [6]: 0x4AACE68:(DilloUrl *), freed by a_Capi_ccc (capi.c:535) [7]: 0x4AB57B8:(dpi_conn_t *), freed by a_Dpi_ccc (dpi.c:695) [8]: 0x4AB5818:(Dstr *), freed by a_Dpi_ccc (dpi.c:695) [9]: 0x4AB5858:(Dstr_char_t *), freed by a_Dpi_ccc (dpi.c:672) [10]: 0x4AB7960:(Dstr *ds), freed by a_IO_ccc (IO.c:385) [11]: 0x4AB79A0:(Dstr_char_t *), freed by a_IO_ccc (IO.c:385) [1] read at IO_read (IO.c:194) [2] read at a_IO_ccc (IO.c:402) (many times) [3] read at a_IO_ccc (IO.c:402) (many times) [4] read at a_Capi_ccc (capi.c:569) [5] write at a_Capi_ccc (capi.c:570) [5] read at a_Capi_ccc (capi.c:572) [6] read at a_Url_cmp (url.c:442) [5] read at a_Capi_ccc (capi.c:574) [5] read at Capi_conn_unref (capi.c:132) (twice) [4] freed by a_Capi_ccc (capi.c:579) [3] read at a_Dpi_ccc (dpi.c:672) [7] read at Dpi_conn_free (dpi.c:124) [7] read at Dpi_conn_free (dpi.c:125) [8] read at dStr_free (dlib.c:291) [8] read at dStr_free (dlib.c:292) [9] freed by a_Dpi_ccc (dpi.c:672) [8] freed by a_Dpi_ccc (dpi.c:672) [7] freed by a_Dpi_ccc (dpi.c:672) [3] freed by a_Dpi_ccc (dpi.c:673) [1] read at IO_read (IO.c:194) (many times) [10] read at dStr_free (dlib.c:291) [1] read at dStr_free (dlib.c:292) [11] freed by a_IO_ccc (IO.c:404) [10] freed by a_IO_ccc (IO.c:404) [1] freed by a_IO_ccc (IO.c:404) [2] freed by a_IO_ccc (IO.c:405)