---
id: "bug-1858"
status: "fixed"
status_updated: "2026-09-24"
status_note: "9e9f2798"
component: "scheduler"
severity: "unknown"
timestamp: "2026-09-24T13:12:53Z"
last_seen: "2026-09-24T13:12:53Z"
occurrences: 1
files: ["src/scheduler/src/core_events.c", "src/scheduler/src/schedobj.c"]
tags: ["scheduler", "asan", "sim", "bad-free", "soak"]
related: []
fix_commits: ["9e9f2798"]
legacy: true
gitea_issue: 277
gitea_synced_status: "fixed"
---

# bug-1858: AddressSanitizer: attempting free on address which was not malloc()-ed in core_upsert_queue…

## Description
AddressSanitizer: attempting free on address which was not malloc()-ed in core_upsert_queue (core_events.c:383) <- core_apply_config_queues <- xce_core_push_events <- sched_sim_driver_run; address 56 bytes inside a 57-byte makeString instance. Seen as HA soak (sequential) FAIL: scheduler replay-parity SIMVERIFY errors=1 (simverify-3, rc=1)

## Environment
_Not recorded (migrated from buglog.json)._

## Reproduction
_Not recorded (migrated from buglog.json)._

## Root cause
q->resreq is an interned, refcounted xstring from makeString() (pointer past the object header), but core_upsert_queue releases the old value with FREEUP()/free() instead of dereference(). Only fires when a CONFIG_PUSH updates an existing queue whose resreq is non-NULL (e.g. a queue restored from snapshot via snapshot_load.c:313). Same bad free(q->resreq) exists in the normal-mode path, schedobj.c:603 (sched_update_existing_queue). Convention elsewhere: qobj.c:69 dereference(q->queue.resreq).

## Fix
UPDATE (2026-09-24): Fix (uncommitted): core_events.c core_upsert_queue and schedobj.c sched_update_existing_queue now dereference() the old interned q->resreq (NULL-guarded) instead of FREEUP()/free(). Regression tests added (red first, both hit the exact bad-free): test_core_events.c test_queue_update_replaces_existing_interned_resreq, test_job_update.c test_update_existing_queue_replaces_interned_resreq (the existing queue-update test had deliberately skipped the resreq branch). Verified 2026-09-24: scheduler suite 87/87 (ASAN); the crashing HA-soak recording scheduler-replay-20260924-130653.replay now replays with rc=0, 0 ASAN errors, 0 mismatches.

## Verification
_Not recorded (migrated from buglog.json)._

## References
- Gitea: #277