static int setup_channel(lua_State *L, int status, lua_KContext ctx) {
    int rc;
    LIBSSH2_CHANNEL **channel = (LIBSSH2_CHANNEL **) lua_touserdata(L, 2);

    while ((rc = libssh2_channel_request_pty(*channel, "vanilla")) == LIBSSH2_ERROR_EAGAIN) {
        luaL_getmetafield(L, 1, "filter");
        lua_pushvalue(L, 1);
        lua_callk(L, 1, 0, 0, setup_channel);
    }
    if (rc != 0)
        return luaL_error(L, "Requesting pty");

    return 1;
}

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.