sysv->msgbuf looks like it is allocated with malloc() and freed with xfree(), are you sure these are using the same allocator under the covers?