I decided to feed the source (well, the ITS build, for the moment) through the scan-build utility, and it did indeed turn up a bunch of issues, some of which are trivial patches (e.g. unused or uninitialized variables), others (use-after-frees, for example) that are probably best subject to the gaze of someone who has actually spent time with the code, and in any event I don't want to step on anyone's toes. Would it be best just to attach the results for people to pick over?