I have a resmgr at attached to /dev/bucase QNX 6.4.1 (x86)
it has the next structure
# ls /dev/bucase/*
/dev/bucase/file1

/dev/bucase/test:
f     ff

So when I use next sequence of calls after start of resmgr

# echo /dev/bucase/*
/dev/bucase/file1 /dev/bucase/test
# echo /dev/bucase/test/*
echo /dev/bucase/test/*
/dev/bucase/test/f
So second call to echo fails, cause I have two entries in test directory
But ls /dev/bucase/test always work properly

# ls /dev/bucase/test
f     ff

Attaching minimum code with bug

Problem doesn't occur when I comment string that frees reply buffer to MsgReply call.

int handle_readdir(resmgr_context_t *ctp, io_read_t *msg, iofunc_ocb_t* ocb, struct myentry* entry){
	char* reply = (char*)malloc(msg->i.nbytes);
        int rsize;
       //Cycle at directory entries

       rsize = (char*)de - reply;
	if (-1 == MsgReply(ctp->rcvid, rsize, realrep, rsize)){
		perror("!!!!!readdir MsgReply");
	}
	free(reply); //A comment of this string helps to avoid the problem but I cant clarify it (reply must be copied at the 
moment of its freeing, isnt it?)
	return _RESMGR_NOREPLY;
}