I cant see anything wrong with your function, so I suspect there is something wrong with the function you pass your string to. Maybe it's trying to write into s but does write out of bounds insead, damaging the heap ??
Note: it is my understanding that s is allocated on C's heap and so will not be garbage collected by guile's GC but freed immediately by your dynwind handler as soon as the function exits.
