There's another problem: this kind of GC doesn't know much about the memory layout of the objects it manages, but only the addresses. When it finds a byte patte

There's another problem: this kind of GC doesn't know much about the memory layout of the objects it manages, but only the addresses. When it finds a byte pattern in memory that looks like it belongs to the objects it manages, it has to assume they are live. Sprinkling in `free()` whenever it can be judged to be safe helps to minimize this issue.