In function outnet_serviced_query(), first serviced_query object is created at

which potentially allocates memory for the fields qbuf, zone, tls_auth_name and opt_list.

And later under some conditions, this object can be destroyed, but only qbuf and zone fields are released at

and

Probably, the function serviced_delete() or serviced_node_del() should be used instead for destroying the serviced_query object.