I believe this issue dates back to the introduction of the wtag field in 2da6c03. We never caught this in PHPC because our custom free function (for bson_mem_vtable_t) would NOP on a null pointer; however, I'm not sure why this wouldn't have been caught for the default memory handler, which uses free().