It's just a minimal example.

> Its primary merit is that it makes use-after-free cases immediately obvious, since they're going to trigger a segfault.

But then it hides double free errors.

    int count = 0;

    void foo_destroy(struct foo **f) { free(*f); count--; *f = NULL; }

    void bar() {
        struct foo *f = malloc(sizeof(struct foo));

        foo_destroy(&f); // ok
        foo_destroy(&f); // no error, but count is now wrong
    }