Just a quick response without having done more than glance at the patch: it's our current practice to call free() without checking for null, as C89 guarantees that free() is a no-op in that case. Similarly for krb5_free_foo().