Use memmove instead of memcpy.  Fixes coverity complaint.

But doesn't change anything, because "hdr_len" is always a small
value.  It's just not checked as such, so coverity doesn't pick up
on it
Use fr_rand() instead of random().  It's stronger.
Free the correct variable.  Closes CID #1233596