smbd_smb2_setinfo_send() uses:

                data = NULL;
                data_size = in_input_buffer.length;
                if (data_size > 0) {
                        data = (char *)SMB_MALLOC_ARRAY(char, data_size);
                        if (tevent_req_nomem(data, req)) {
                                return tevent_req_post(req, ev);
                        }
                        memcpy(data, in_input_buffer.data, data_size);
                }

This is not cleanup in all code pathes.