WritePipeAsync(HANDLE pipe, LPVOID data, DWORD size, DWORD count, LPHANDLE events)
{
    return AsyncPipeOp(write, pipe, data, size, count, events);
}

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.