Thanks for the report. You can get hints about place where the memory is allocated from the output above.
tcpconn_new(1134): 66464 -> core/tcp_main.c, line 1134 is allocating the memory with shm_malloc(..)
You find the timeout handling also in this file, but it in different places depending on the nature of the connection.