The bug is in clearRefpointers. I believe the effect is to bail out too early,
leaving soft refs valid and expanding when memory could have been reused.

The bug is in the calculation of freemem:
   freemem += obj_len((char *)bag[i].ref - sizeof(hdr));

I first noticed that the ".ref" expression points to another handle, not an
object, so we should be doing ".ref->obj". After that I noticed that this is
the wrong object. We really need:
     freemem += obj_len((char *)obj_getslot(bag[i].ref, 0)->obj - sizeof(hdr));