fleetcfg: garbled host names with 200 hosts, and a leak that grows when malloc fails. One bug or two?

I maintain a small C tool, fleetcfg, that loads a Lua config returning a list of hosts, copies them into a HostList, then prints them. The TCP probe is still a TODO.

Two observations, and I can't tell if they're related:

1. With the real 200-host prod config, a few lines in the final listing show an empty name or odd bytes. The 3-host test config never does. I suspect the Lua side, maybe what luaL_dofile leaves on the stack. I've pretty much ruled out the lua_gc call, since the output was right before I added it. That is not confirmed.

2. With an LD_PRELOAD wrapper that fails malloc/realloc after N calls, a failure inside hostlist_push prints "out of memory" and exits 1 as designed. But valgrind reports "definitely lost", and the block grows with the host count. I assumed the Lua cleanup misses something and that hostlist_free covers the rest.

valgrind --leak-check=full ./fleetcfg $PWD/prod hosts.lua

My checkout path has a space in it, and the valgrind output looked odd to me.

Relevant pieces:

l->items = realloc(l->items, ncap * sizeof(Host));
if (l->items == NULL)
    return -1;

const char *name = lua_tostring(L, -2);
...
lua_pop(L, 3);
...
hostlist_push(out, name, port)

Where would you start looking? I can't promise the two are separate, and I haven't run anything under a debugger yet.