Is it possible that the free does not fail for the functor itself but for a member variable (for instance a pointer which is freed in the destructor)?Wikipedia says that 0xFEEEFEEE is "Used by Microsoft's HeapFree() to mark freed heap memory".Yes, and it's a begining of 72 bytes block of feeefeee. Apparently, it means that out_buffer.data was already freed. But I can't realize how it can be...