static zend_long spl_ptr_llist_count(spl_ptr_llist *llist) /* {{{ */
{
	return (zend_long)llist->count;
}
/* }}} */

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.