Do you think address or thread sanitizer would have been able to catch this? It sounds like it would.

Can you provide names of these clients you’re mentioning?

I also discovered XMPP recently. I’ve been evaluating my options for private and secure messaging and it’s at the top of my list along with Signal. I wouldn’t use a public server, personally. You should host it yourself or join one that someone you trust is hosting. Server admins are privy to a lot of metadata. I’m on the fence right now but with the IETF actively working on MLS and MIMI, I am not sure if XMPP will live on. By all means play around with it and let us know how it goes!