Summary

In splash_register deferred-registration path decoders count only incremented inside realloc branch whose condition requires decoders%DECODER_ARRAY_DELTA==0. After first registration decoders becomes 1 and since 1%4!=0 the realloc branch (and thus decoders++) is never reached again. decoders permanently stuck at 1: splash_init only ever tests decoder_set[0] every later splash_register overwrites decoder_set[1] and splash_init cleanup sweep only NULLs index 0 leaving stale pointers at indices>=1 un-cleaned weakening UAF defense. Trace: 1st call decoders=0 0%4==0 realloc decoders=1 decoder_set[0]=D1; 2nd call loop exits i=1 i>=decoders true but 1%4==0 false realloc skipped decoders stays 1 decoder_set[1]=D2; 3rd call identical decoder_set[1]=D3 OVERWRITES D2. No direct memory-safety all writes within 4-slot allocation. Functional correctness: only first-registered decoder ever selected subsequent decoders silently lost. Security relevance: defeats stale-pointer cleanup sweep.