Or is this somehow ensured by debug pfree() implementation or does it work differently together with Valgrind?
Otherwise it seems that the calling code can still be hanging onto a list element from a freed chunk and (rather) happily accessing it, as opposed to almost ensured crash if that is zeroed before returning from enlarge_list().
