merge_loc_conf populated only the 32 valid alphabet slots of the ngx_palloc'd basis32 table, leaving 224 slots uninitialized; decode_base32's invalid-character sentinel (77) was never written, so invalid base32 input was decoded from uninitialized memory. memset the table to 77 before populating the alphabet.