The 'nexttimer' counter in vireventglib.c is a static int starting at 1, incremented for every new timeout registration. After running for a long period (1+ years with frequent client connections), it overflows past INT_MAX and becomes negative. A negative timer ID causes multiple issues: 1. virKeepAliveStart: skips virObjectRef(), leaving the keepalive object with only 1 reference (should be 2). When the connection closes, virObjectUnref() drops refcount to 0, freeing the object while the GSource is still active -> use-after-free with 'bad magic number' logs. 2. virKeepAliveStop: skips virEventRemoveTimeout(), the GSource is never destroyed, continuing to fire on freed memory. 3. virNetServerClientNew: sockTimer creation fails, all new connections rejected with 'Connection reset by peer'. In production (libvirtd running 1 year 8 months), this caused: - 1 leaked keepalive GSource (use-after-free, continuous 'bad magic' logs) - 282 million leaked sockTimer structures (19.6GB RSS) - All virsh commands failing with 'Connection reset by peer' Patch 1: Prevent nexttimer overflow in vireventglib.c (root cause fix) Patch 2: Fix timer ID checks in virkeepalive.c (defensive fix, use != -1 instead of > 0 to handle negative IDs) Yong Chen (2): util: Guard against integer overflow in nexttimer rpc: Use != -1 instead of > 0 for timer ID checks src/rpc/virkeepalive.c | 14 +++++++++++++- src/util/vireventglib.c | 3 +++ 2 files changed, 16 insertions(+), 1 deletion(-) -- 2.55.0.windows.3