It looks like they understand memory as a tree, but in complex structures it's a graph. I couldn't found how they handle ring topologies. I guess, this stealing stuff doesn't help.
IIRC, talloc basically doesn't handle rings. Note, however, that it's fairly easy to create a "reference to the entire ring" that cleans up some node/the entire ring when it's deallocated, or to explicitly deallocate some node of the ring.
For what it's worth, non-tree reference graphs are a lot rarer than you'd think. (Note, for instance, that Perl doesn't clean them up automatically except in a few specific cases; this is annoying, but Perl is clearly usable!)
