[racket] FFI: Giving a double pointer to a function

So I recently started to poke at my humble little bindings to the
Chipmunk library again. (someone sent me an email asking for help,
which reminded me that I hadn't worked on it in a while) The problem
is that I'm still stumbling over the same block that made me stop in
the first place a number of months back. One of the function in the
Chipmunk library (cpArbiterGetShapes) takes two double pointers to a
cpShape. (cpShape**) So far, I have been unable to figure out how to
make this work without a future function that accesses the cpShape
crashing the entire Racket runtime, including the IDE window I have
open.

So the function definition for cpArbiterGetShapes is:
static inline void cpArbiterGetShapes(const cpArbiter *arb, cpShape
**a, cpShape **b)

And my current binding in Racket is:
(_fun _cpArbiter-pointer
              (_ptr io _cpShape-pointer)
              (_ptr io _cpShape-pointer)
              -> _void)

And the (pertinent) code where I use it is:
(let*
      ([water (cast (malloc _cpShape-pointer) _pointer _cpShape-pointer)]
       [poly (cast (malloc _cpShape-pointer) _pointer _cpShape-pointer)]
       [water-ptr (cast (malloc _cpShape-pointer) _pointer _cpShape-pointer)]
       [poly-ptr (cast (malloc _cpShape-pointer) _pointer _cpShape-pointer)])
    (memcpy water-ptr water (ctype-sizeof _cpShape-pointer))
    (memcpy poly-ptr poly (ctype-sizeof _cpShape-pointer))
    (cpArbiterGetShapes arb water-ptr poly-ptr)
    (let*
        (...
         [count (cpPolyShapeGetNumVerts poly)] ;Note that it crashes
on this line

Which is following the buoyancy demo included in Chipmunk by default
as close as possible. Also note that cpPolyShapeGetNumVerts is
supposed to take a _cpShape-pointer. I'm really not sure how to do
what I need in Racket given this situation, and all I've really seen
in the Racket documentation is just single pointers. I've also tried
just allocating water and poly with not water-ptr and poly-ptr and
just using those, but that crashes Racket just the same. I would
really, really, really appreciate any help with this. It's bugging me
that I can't get this solved and I really want this to work.

Thank you so much in advance for any assistance provided. (also I
apologize if this ends up badly formatted. I'm not sure of formatting
rules for a listserv when sending through email)