This is the sole instance of CNavigator, it's essentially a singleton: https://github.com/BSzili/OpenJK/blob/master/codeJK2/game/g_nav.cpp#L28
The hits always happen after dlclose() when this is destroyed. I still think this is only a symptom of something else messing up the memory, hence the FreePooled warnings about the wrong size being freed up.

Anyway, I'll first try my own DLL loader to see if it's any better. If not then I can start printing the address of class members, etc.