bmalloc: eager scavenge leaves behind a bogus allocator