The output certainly suggests something is calling TlsAlloc between the call made for destructor_key.value and the one for private_drbg, and that index is never freed. You always get 7 when allocating destructor_key.value because that index was freed when you unloaded OpenSSL, and so it's the next available one when you load OpenSSL again.
It may not be OpenSSL itself that's calling TlsAlloc and not releasing an index - it may be one of its dependencies.
Have you duplicated this under a debugger, with a breakpoint on TlsAlloc? The earlier messages suggest that you may have, but it's not entirely clear from what you posted. You ought to be able to catch the offending call and get at least a partial traceback.
If you're having trouble tracing it, you could try adding this:
{int i; for (i=8; i<private_drbg; i++) TlsSetValue(i, (LPVOID)-1);}
right after the code that calls TlsAlloc for private_drbg, and seeing what blows up. Not entirely conventional, but it might be revealing.
--
Michael Wojcik
Distinguished Engineer, Micro Focus
