Finding memory corruption in an extension

An extension I'm creating is causing Postgres to crash, almost certainly due to memory corruption.  I am using palloc0/pfree, calling SET_VARSIZE, and generally following the procedures documented here: https://www.postgresql.org/docs/12/xfunc-c.html. I am also testing my code outside of Postgres (using alloc/free instead of palloc0/pfree), and valgrind is not finding any corruption or leaks.

The crash is not completely reproducible, but when it does happen, it's pretty fast -- create a table, insert a couple of rows, explain a query. (My goal is to create a GIN index on my datatype, but this crash occurs without the index.)