Created attachment 155950 [details] Fix Found by clang static analyzer: http://scan.freebsd.org/scan-build/WORLD/2015-04-20-amd64/report-ee9ce2.html#EndPath And also Coverity (CID 1245771). I cannot really check this so hopefully someone else can review.
It looks like you need to free r->alink too.
(In reply to Andrey V. Elsukov from comment #1) I may be missing something r->alink[0] is NULL, so I think the freeing the array will do nothing.
A commit references this bug: Author: glebius Date: Mon Apr 27 05:44:10 UTC 2015 New revision: 282051 URL: https://svnweb.freebsd.org/changeset/base/282051 Log: Fix memory leak. PR: 199670 Reviewed by: ae Changes: head/sys/netpfil/ipfw/ip_fw_nat.c