We were using _TMdT_ as a type metadata pointer, but it's really a full metadata symbol we need to offset to get the type metadata address. Swift SVN r5376