On Wed, 2018-06-13 at 13:02 -0600, David Mulder via samba-technical wrote: > Isn't 'changes' owned by 'frame' (line 4215)? So it gets freed in the > fail block with TALLOC_FREE(frame); You're right. Sorry for that and thanks for checking. Cheers Swen