When Your Hash Becomes a String: Hunting Ruby’s Million-to-One Memory Bug

A deep technical investigation into a rare Ruby bug where FFI structs' internal Hashes were being freed by the garbage collector and replaced by Strings at the same memory address. The bug, caused by missing write barriers in FFI versions before 1.17.0, occurred roughly once per million process restarts but cascaded into thousands of errors when triggered. The author methodically ruled out musl libc issues, struct alignment problems, and ABI mismatches before discovering the root cause: FFI's C extension wasn't properly registering object references with Ruby's GC, allowing use-after-free conditions where objects could transform into completely different types at runtime.