HeapRing: missed a free() in a corner case