Of course, after I point the finger to LibreSSL [1] for the memory leak, I find the leak … in my own code.
Sigh.
Not knowing what else to do, I thought I would go through my TLS (Transport Layer Security) Lua module [2] to make sure I didn't miss anything. That's when I noticed that I was keeping a reference to a connection so that I can deal with the callbacks [3] from libtls. I was expecting the __gc() method to clean things up, but with a (non-weak) reference, that was never going to happen.
Yes, just because you are using a garbage collected language doesn't mean you can't still have memory leaks.
I verified that, yes indeed, the references were being kept around after the request was finished. It was then straightforward to fix the issue.
That's not to say that libtls still isn't leaking memory—it is, but (it seems) only when you initialize it (which means it's not as bad). But I'll know in a day or two if I fixed the leak. I hope that was it.
[2] https://github.com/spc476/lua-conmanorg/blob/master/src/tls.c
[3] https://github.com/spc476/lua-conmanorg/blob/master/src/tls.c#L107