I had a consistent address for double-free of a driver in a test
environment and needed a quick way to track down both calls (well the
first one). Given dtrace is not much help with an (almost immediate)
panic I added sysctls under MALLOC_DEBUG that took the address and
either printed or paniced when we tried to free the address and was done
in a few minutes.
While this is a thing which could probably be done otherwise (gdb + Xwatch)
it seems a case people hit once in a while. Unless you think this can
be useful (possibly for other things as well) I have no intentions to
put it into the tree but wanted to have it up somewhere before it goes
out of my tree again.
On the other hand I'll be more than happy to learn about 5 more ways to
do this for a lot of people to possibly benefit from the collection of
debugging knowledge.