Over on [1], Tom mentioned that we might want to rethink the decision to not protect chunk headers with Valgrind. That thread fixed a bug that was accessing array element -1, which effectively was reading the MemoryChunk at the start of the allocated chunk as an array element.
Seems the link to the original thread is not pasted. Here it is.