md2.c was doing memset(m, 0, sizeof(m)), and so was only clearing the first 4 bytes of the passed md2 structure in MD2_Final. Fix this to clear the entire structure, as expected.