From c942e606040f06f88332f7ce3b7efbae6214770b Mon Sep 17 00:00:00 2001
From: hja <hugo@hja.pt>
Date: Sat, 14 Nov 2026 09:26:19 +0000
Subject: [PATCH] Fix double-free in FreeBSD socket-table error handling

---
 lib/dialects/freebsd/dsock.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/lib/dialects/freebsd/dsock.c b/lib/dialects/freebsd/dsock.c
index 89326e23..c3481942 100644
--- a/lib/dialects/freebsd/dsock.c
+++ b/lib/dialects/freebsd/dsock.c
@@ -121,6 +121,7 @@ static int cmp_xinpcb_sock_pcb(const void *a, const void *b) {
         return 0;
 }
 
+/* PCB buffers are owned by the caller, including on failure. */
 static int get_unix_pcbs(const char *name, struct xunpcb **pcbs,
                          size_t *n_pcbs) {
     size_t len;
@@ -149,8 +150,6 @@ static int get_unix_pcbs(const char *name, struct xunpcb **pcbs,
 end:
     *pcbs = (struct xunpcb *)buffer;
     *n_pcbs = count;
-    if (ret)
-        free(buffer);
     return ret;
 }
 
@@ -181,8 +180,6 @@ static int get_tcp_pcbs(struct xtcpcb **pcbs, size_t *n_pcbs) {
 end:
     *pcbs = (struct xtcpcb *)buffer;
     *n_pcbs = count;
-    if (ret)
-        free(buffer);
     return ret;
 }
 
@@ -213,9 +210,7 @@ static int get_udp_pcbs(struct xinpcb **pcbs, size_t *n_pcbs) {
 end:
     *pcbs = (struct xinpcb *)buffer;
     *n_pcbs = count;
-    if (ret)
-        free(buffer);
-    return 0;
+    return ret;
 }
 
 struct pcb_lists *read_pcb_lists(void) {