Well, let's see if it works this time.
I was able to track the issue down to a double call to free(). But the really scary bit is that the behavior only exhibited itself on the webserver; on my development box, I never saw the bug.
Sigh.
Debugging on a production server—never a good thing.
But more on that after I finish dogfooding [1] the web interface on an iPad over the iPhone hotspot.