Two use-after-free issues exist in the connection ID iterator FFI (Foreign Function Interface) functions. The functions `quiche connection id iter next()` and `quiche conn retired scid next()` return a pointer to a `ConnectionId` via function arguments, but the owned `ConnectionId` is dropped at the end of the function scope. This affects only applications using these FFI functions, which are disabled by default via a build-time feature flag. Exploitation leads to dereferencing freed memory, typically resulting in undefined behavior and process crashes (denial of service), or potentially limited information disclosure and incorrect connection identifier handling depending on the allocator state.