xcb_shm_create_segment_reply_fds documentation seems wrong

This is the generated code:

/**
 * Return the reply fds
 * @param c      The connection
 * @param reply  The reply
 *
 * Returns the array of reply fds of the request asked by
 *
 * The returned value must be freed by the caller using free().
 */
int *
xcb_shm_create_segment_reply_fds (xcb_connection_t                *c  /**< */,
                                  xcb_shm_create_segment_reply_t  *reply);

Behind the scenes, this simply forwards to xcb_get_reply_fds.

The Problem: When calling free() on the returned value, it immediately crashes with free(): invalid pointer. Looking at xcb_get_reply_fds, I don't think the return value can be freed, only the reply obtained via xcb_shm_create_segment_reply is to be freed. The returned value from xcb_shm_create_segment_reply_fds is probably invalidated, as soon as the reply is freed, though... (such behavior should probably also be documented).