before overwrite: freelist[n-1] [0x003401b8] Flink 0x003401b8 Blink 0x003401b8 freelist[n] [0x003401c0] Flink 0x00341fb0 Blink 0x00341fb0 chunk [0x00341fa8] Flink 0x003401c0 Blink 0x003401c0 after overwrite: freelist[n-1] [0x003401b8] same (Flink 0x003401b8 Blink 0x003401b8) freelist[n] [0x003401c0] same (Flink 0x00341fb0 Blink 0x00341fb0) chunk [0x00341fa8] Flink 0x003401bc Blink 0x003401c4 after 1st alloc (returned 0x00341fb0): freelist[n-1] [0x003401b8] same (Flink 0x003401b8 Blink 0x003401b8) freelist[n] [0x003401c0] Flink 0x003401c4 Blink 0x003401bc after 2nd alloc (returned 0x003401bc): freelist[n-1] [0x003401b8] Flink 0x0008015c Blink 0x003401b8 freelist[n] [0x003401c0] same (Flink 0x003401c4 Blink 0x003401bc) After copying 0x909090909090909090 into newly allocated chunk freelist[n-1] [0x003401b8] Flink 0x0008015c Blink 0x90909090 freelist[n] [0x003401c0] Flink 0x90909090 Blink 0x90909090