Ok, so not only does your code malloc inside a signal handler, so does Event.

Well, Event.xs shows that when signal is called, it does copying.

_signal_signal(THIS, items == 2? sv_mortalcopy(ST(1)) : 0);
[download]

sv_mortalcopy mallocs. Since you are calling the signal handler from inside the signal handler, it never frees that memory. Simple solution: Don't call the signal handler from inside the signal handler.