Finally tracked this down to a piece of code I have looked at a thousand
times. We were allocating space for a pointer to a struct instead of for
the struct itself, so when we wrote to the second word of the struct, we
were off in the weeds somewhere.