The slab debugging code is supposed to poison freshly-allocated obejcts with
0x5a and freed ones with 0x6b, so we can distinguish use-uninitialised from
use-after-free.

It wasn't working right for recycled objects.  Fix.