I was browsing the source in old [GitHub repo](https://github.com/inolen/redream) and have found a potential bug in the [scheduler](https://github.com/inolen/redream/blob/master/src/guest/scheduler.c). I realise there is a very good chance that this code has been rewritten behind the scenes, but I thought I should raise it in case. It looks like clients can hold pointers to expired and recycled timers. Example: 1. Client A schedules a timer and holds the returned pointer to Timer N 2. Timer N expires during tick(). It is cancelled internally and added to the free list. 3. Client A now holds a pointer to a cancelled timer. The cancel API is robust against cancelling it again via the active flag. However, client A does not cancel the timer. 4. Client B schedules a timer and is returned a pointer to recycled timer N 5. Now clients A and B both hold a pointer to the same timer. 6. Client A cancels timer N 7. Client B's timer never expires and the associated callback is never called. One possible solution is to return unique IDs instead of pointers, which could incorporate a generation index. Great project. Hope you plan to release the source again sometime!