Crash on iOS9 when using Apple's CFNetwork library

Many clients have hit a crash due to an Apple library using operator delete on a memory block that was not allocated with operator new. This happens with the following callstack on iOS9 in UE4.13 or later:

0 EFGame 0x019121a8 FMallocBinned::GetAllocationSize(void*, unsigned long&) (in efgame) (MallocBinned.cpp:1061)
1 EFGame 0x0194b6e2 FMallocPoisonProxy::Free(void*) (in efgame) (MallocPoisonProxy.h:78)
2 EFGame 0x0191dc40 FMemory::Free(void*) (in efgame) + 194
3 EFGame 0x0097443c operator delete(void*) (in efgame) + 14
4 CFNetwork 0x25c6bbf4 XTubeManager::~XTubeManager() + 112
5 CFNetwork 0x25c6bb30 XTubeManager::~XTubeManager() + 8
6 CFNetwork 0x25c68a1e -[__NSURLSessionLocal _onqueue_checkForCompletion] + 162
7 CFNetwork 0x25c699f6 -[__NSURLSessionLocal _onqueue_completeInvalidation:] + 106
8 libdispatch.dylib 0x252efcbe _dispatch_call_block_and_release + 10
9 libdispatch.dylib 0x252f9e7e _dispatch_queue_drain + 1762
10 libdispatch.dylib 0x252f2e16 _dispatch_queue_invoke + 282
11 libdispatch.dylib 0x252fb6a0 _dispatch_root_queue_drain + 1572
12 libdispatch.dylib 0x252fb07a _dispatch_worker_thread3 + 94
13 libsystem_pthread.dylib 0x2548ee0c _pthread_wqthread + 1024
14 libsystem_pthread.dylib 0x2548e9fc start_wqthread + 8

requires sample iOS project using CFNetwork
see external URLs for some examples

0 EFGame 0x019121a8 FMallocBinned::GetAllocationSize(void*, unsigned long&) (in efgame) (MallocBinned.cpp:1061)
1 EFGame 0x0194b6e2 FMallocPoisonProxy::Free(void*) (in efgame) (MallocPoisonProxy.h:78)
2 EFGame 0x0191dc40 FMemory::Free(void*) (in efgame) + 194
3 EFGame 0x0097443c operator delete(void*) (in efgame) + 14
4 CFNetwork 0x25c6bbf4 XTubeManager::~XTubeManager() + 112
5 CFNetwork 0x25c6bb30 XTubeManager::~XTubeManager() + 8
6 CFNetwork 0x25c68a1e -[__NSURLSessionLocal _onqueue_checkForCompletion] + 162
7 CFNetwork 0x25c699f6 -[__NSURLSessionLocal _onqueue_completeInvalidation:] + 106
8 libdispatch.dylib 0x252efcbe _dispatch_call_block_and_release + 10
9 libdispatch.dylib 0x252f9e7e _dispatch_queue_drain + 1762
10 libdispatch.dylib 0x252f2e16 _dispatch_queue_invoke + 282
11 libdispatch.dylib 0x252fb6a0 _dispatch_root_queue_drain + 1572
12 libdispatch.dylib 0x252fb07a _dispatch_worker_thread3 + 94
13 libsystem_pthread.dylib 0x2548ee0c _pthread_wqthread + 1024
14 libsystem_pthread.dylib 0x2548e9fc start_wqthread + 8

How does TextureRenderTarget2D get TArray<uint8> type data?

Why does the REMOVE method of map container remove elements have memory leaks?

How to delete some elements correctly when deleting an array loop?

Do I need to call Destory method to remove components from Actor when Destory method to remove Actor?

Where can I download the source address of the deployment cotum service associated with the PixelStream plugin?

UMG RichText not appear image when packaged

How do I set a material as a post-processing material?

What is the cause of the packaging error falling back to 'GameUserSettings' in ue5?

How would I go about lerping the rotation instead of it snapping when turning (pls dont sue me epic)

What is the difference between Camera and CineCamera?