Pointer confusion

All the code to this can be found in my CVS.

I've got this struct:

typedef struct _keypair {
  struct _keypair *p_prev; /* now we're doubly linked!! */
  struct _keypair *p_next; /* we're implementing a linked list */
  char            *key;
  char            *value;
} keypair;

Everything works fine until I go to delete my hash, and then things break. Here is an exerpt from gdb with all of my debugging statements:

p_next=[0x8050e90/success]
ht->p_next=[0x8050dd0/frgrp_6_sortorder] in bucket [1]
[success] belongs in bucket [0]
[success] belongs in bucket [0]
get("success") returning [0x8050e90][success]->[OK]
Deleting [0x8050e90/success]
Adjusting pointers...bucket[0]->[(nil)]
Freeing key [0x8050ea8/success]...success

Program received signal SIGSEGV, Segmentation fault.
0x40140c7b in chunk_free (ar_ptr=0x401d9cc0, p=0x8050ea0) at malloc.c:3145
3145    malloc.c: No such file or directory.
(gdb) up
#1  0x40140b03 in __libc_free (mem=0x8050eb8) at malloc.c:3057
3057    in malloc.c

What baffles me is this: the address that chunk_free is barfing on is 0x18 (24 in decimal) bytes before the address I'm trying to free. Why is it even looking at that address (which should, by my math, be one of the bytes in the p_next pointer for the kids reading at home)?

If I simply add the code:

#ifdef DEBUG3
  if(!strcmp(p_this->key, "success")) {
    puts("Skipping keypair that barfs");
    return 0;
  }
#endif

Then it barfs elsewhere, but I don't think they're related.

Any bright ideas?