out of per-request-limited memory. That was part of the vulnerability that the state wasn't completely reset properly.