[racket] using s16vector-set! on malloc'ed values

Unsafe-s16vector-set! is *MUCH* faster than ptr-set!.  About 10x faster, apparently. 

In the rsound package, I want to use unsafe-s16vector-set! on a region of memory that's allocated by malloc--or, more specifically, the malloc associated with a dll, because windows cares about things like this.

Here's some code that doesn't work:

#lang racket

(require ffi/unsafe
         ffi/vector)

(define ptr (malloc 1000))

(s16vector-set! ptr 0 2244)

In fact, it causes a seg fault.

If I understand correctly, this is because this is taking the "pointer value"--probably an 8-byte or 16-byte structure that holds a pointer--and treats it like it's a massive s16vector. What I want instead is to dereference the enclosed pointer, to get a pointer to the actual malloc'ed block, and use *that* as the putative s16vector.

Unfortunately, there's no "dereference" operator that I can find, or an "address-of". 

I'm sure there's some combination of clever things I can do to get this to work, but I can't *quite* figure it out!

Grr!

Any help appreciated.

John