You're reading freed memory, so the behavior is undefined and you can't rely on the contents at all. Also, glibc has a known bug with M_PERTURB causing an off-by-sizeof(size_t) overwrite, so the expected pattern won't fully appear.