The leak is gone, almost certainly from a recent CVS commit: apparently the poisoning code was preventing buffers from getting freed. Now to see whether my app still leaks... damn, it still does. Ooh, that one is definitely my fault. Oh well, progress!