Summary

imp_getBlock and imp_removeBlock first look the IMP up in the regular
trampoline set; if that misses, they fall back to sret_trampolines. But the
fallback discarded the result of the second indexForIMP() call, leaving
idx at -1:

int idx = indexForIMP(anImp, &set);
if (idx == -1)
{
    set = sret_trampolines;
    indexForIMP(anImp, &set);   // result thrown away; idx stays -1
}
if (idx == -1) { return NULL; } // ... so struct-return IMPs always land here

As a result imp_getBlock always returned NULL for a struct-return (sret)
block IMP, and imp_removeBlock returned NO without releasing the block —
leaking the block and its trampoline slot.

Fix

Assign the fallback indexForIMP() result to idx in both functions.

Reproduction / test

Test/BlockImpTest.m already creates an sret block IMP (the struct big
block) but only checked imp_getBlock/imp_removeBlock on the non-sret IMP.
Before the fix, asserting imp_getBlock(imp) == blk on the sret IMP fails
(returns NULL); after, it passes. The test now exercises both functions on
the struct-return IMP (all four BlockImpTest variants pass).