av_push, as documented, takes ownership of one reference count.
Ok, yes, I saw that documentation, and was unclear whether "takes ownership of one reference count" meant what it seems to mean (receives the existing reference count, up to a max of one), or whether it owns the responsibility of managing the ref-count by adding one to it. I knew I was trying to read too much into it but still managed to get it wrong. ;)
Thanks for clarification, and thanks for pointing out the AV* bug! That one was the one I wasn't even considering to be an issue. :) Strange though; I had been passing back 150000 element arrays in a loop that had thousands of iterations (just doing some testing) and hadn't seen the memory leak. Given the quantity of data, in retrospect it should have been enough of a leak to cause some swapping to take place, which I never saw.