Hey folks,

While bisecting my shell configuration for an unrelated issue, I ran into what looks like a use-after-free on exporting XPC_SERVICE_NAME from a subshell. Minimized example shown below:

❯ env -i -S'XPC_SERVICE_NAME=0' zsh --no-rcs
Varuns-MacBook-Pro% export
HOME=/Users/varun
LOGNAME=varun
OLDPWD=/Users/varun
PWD=/Users/varun
SHLVL=1
XPC_SERVICE_NAME=0
Varuns-MacBook-Pro% (export XPC_SERVICE_NAME=0)
zsh(29836,0x104d1c580) malloc: *** error for object 0x14c9043d0: pointer being freed was not allocated
zsh(29836,0x104d1c580) malloc: *** set a breakpoint in malloc_error_break to debug
zsh: abort      ( export XPC_SERVICE_NAME=0 ; )

Configuration information:
- zsh 5.8.1 (x86_64-apple-darwin21.0) (from /bin/zsh). This bug doesn't seem arch-specific, but I'll note that the x86_64 in the version is misleading, the binary is a universal one (arm64e + x86_64).
- macOS 12.4 (21F79) running on an M1 Mac.

Let me know if you're having trouble reproducing the issue.

Cheers,
Varun