Long-term test runs by QA at Dell suggests that there are memory leaks in the master smbd. Valgrind was used to isolate them. The following seem to be the issues:

diff -rupN old/source3/lib/debug.c new/source3/lib/debug.c
--- old/source3/lib/debug.c     2012-04-07 06:59:17.000000000 -0700
+++ new/source3/lib/debug.c     2012-05-16 15:01:23.000000000 -0700
@@ -657,9 +657,11 @@ bool reopen_logs( void )
                        SAFE_FREE(fname);
                        fname = SMB_STRDUP(logfname);
                        if (!fname) {
+                               TALLOC_FREE(logfname);
                                return false;
                        }
                }
+               TALLOC_FREE(logfname);
        }

        debugf = fname;
@@ -1051,18 +1053,17 @@ bool dbghdrclass(int level, int cls, con
                                 default_classname_table[cls]);
                }

+               char *curtime = current_timestring(talloc_tos(),
+                                          lp_debug_hires_timestamp());
                /* Print it all out at once to prevent split syslog output. */
                if( lp_debug_prefix_timestamp() ) {
-                   (void)Debug1( "[%s, %2d%s] ",
-                       current_timestring(talloc_tos(),
-                                          lp_debug_hires_timestamp()),
+                   (void)Debug1( "[%s, %2d%s] ", curtime,
                        level, header_str);
                } else {
-                   (void)Debug1( "[%s, %2d%s] %s(%s)\n",
-                       current_timestring(talloc_tos(),
-                                          lp_debug_hires_timestamp()),
+                   (void)Debug1( "[%s, %2d%s] %s(%s)\n", curtime,
                        level, header_str, location, func );
                }
+               TALLOC_FREE(curtime);
        }

        errno = old_errno;
diff -rupN old/source3/param/loadparm.c new/source3/param/loadparm.c
--- old/source3/param/loadparm.c        2012-04-07 06:59:17.000000000 -0700
+++ new/source3/param/loadparm.c        2012-05-16 11:18:51.000000000 -0700
@@ -9283,7 +9283,9 @@ bool lp_load_ex(const char *pszFname,
                }
        }

-       lp_add_auto_services(lp_auto_services());
+       char *serv = lp_auto_services();
+       lp_add_auto_services(serv);
+       TALLOC_FREE(serv);

        if (add_ipc) {
                /* When 'restrict anonymous = 2' guest connections to ipc$
diff -rupN old/source3/smbd/server.c new/source3/smbd/server.c
--- old/source3/smbd/server.c   2012-04-07 06:59:17.000000000 -0700
+++ new/source3/smbd/server.c   2012-05-16 11:15:00.000000000 -0700
@@ -804,6 +804,7 @@ bool reload_services(bool test)
                        set_dyn_CONFIGFILE(fname);
                        test = False;
                }
+               TALLOC_FREE(fname);
        }

        reopen_logs();

These appear to occur because lp_string uses talloc_tos() as a context, and it looks like the top stackframe is never cleaned up in the master process.