Comment 35 for bug 2026757

From that trace, it looks like it is in this code in dhcp_config_free() when it makes the free() call:

#ifdef HAVE_DHCP6
      if (config->flags & CONFIG_ADDR6)
        {
          struct addrlist *addr, *tmp;

          for (addr = config->addr6; addr; addr = tmp)
            {
              tmp = addr->next;
              free(addr);
            }
        }
#endif

That *seems* Ok at first look, right? I do like the while() loop above it better :)

I do see a potential issue when IPv6 addresses are added to this list, but I think it would just cause a memory leak, search for CONFIG_ADDR6 in that file. Guess I'll have to send that to the list, I can't unsee it now.

You might just need to step through that code to see what 'addr' actually is.