In the heap allocator, new blocks allocated directly for an allocate request (instead of indirectly as part of a block split) would only set their order in the tracking map, not their free flag. This left uninitialized data in the block info map, which thus meant it was marked as free for looking up for merges. (Not for allocations, since the block didn't actually appear in the free list.)