Index: head/lib/libufs/sblock.c
===================================================================
--- head/lib/libufs/sblock.c
+++ head/lib/libufs/sblock.c
@@ -150,6 +150,7 @@
 	int fd;
 
 	fd = *(int *)devfd;
+	free(*bufp);
 	if ((*bufp = malloc(size)) == NULL)
 		return (ENOSPC);
 	if (pread(fd, *bufp, size, loc) != size)
Index: head/stand/libsa/ufs.c
===================================================================
--- head/stand/libsa/ufs.c
+++ head/stand/libsa/ufs.c
@@ -687,6 +687,7 @@
 	int error;
 
 	f = (struct open_file *)devfd;
+	free(*bufp);
 	if ((*bufp = malloc(size)) == NULL)
 		return (ENOSPC);
 	error = (f->f_dev->dv_strategy)(f->f_devdata, F_READ, loc / DEV_BSIZE,
Index: head/sys/geom/geom_io.c
===================================================================
--- head/sys/geom/geom_io.c
+++ head/sys/geom/geom_io.c
@@ -966,6 +966,8 @@
 	 */
 	if (loc % cp->provider->sectorsize != 0)
 		return (ENOENT);
+	if (*bufp != NULL)
+		g_free(*bufp);
 	*bufp = g_read_data(cp, loc, size, NULL);
 	if (*bufp == NULL)
 		return (ENOENT);
Index: head/sys/geom/journal/g_journal_ufs.c
===================================================================
--- head/sys/geom/journal/g_journal_ufs.c
+++ head/sys/geom/journal/g_journal_ufs.c
@@ -70,10 +70,13 @@
 	struct fs *fs;
 	int error;
 
+	fs = NULL;
 	if (SBLOCKSIZE % cp->provider->sectorsize != 0 ||
 	    ffs_sbget(cp, &fs, -1, NULL, g_use_g_read_data) != 0) {
 		GJ_DEBUG(0, "Cannot find superblock to mark file system %s "
 		    "as dirty.", cp->provider->name);
+		if (fs != NULL)
+			g_free(fs);
 		return;
 	}
 	GJ_DEBUG(0, "clean=%d flags=0x%x", fs->fs_clean, fs->fs_flags);
Index: head/sys/geom/label/g_label_ufs.c
===================================================================
--- head/sys/geom/label/g_label_ufs.c
+++ head/sys/geom/label/g_label_ufs.c
@@ -75,9 +75,14 @@
 	pp = cp->provider;
 	label[0] = '\0';
 
+	fs = NULL;
 	if (SBLOCKSIZE % pp->sectorsize != 0 ||
-	    ffs_sbget(cp, &fs, -1, NULL, g_use_g_read_data) != 0)
+	    ffs_sbget(cp, &fs, -1, NULL, g_use_g_read_data) != 0) {
+		if (fs != NULL)
+			g_free(fs);
 		return;
+	}
+
 	/*
 	 * Check for magic. We also need to check if file system size
 	 * is almost equal to providers size, because sysinstall(8)
Index: head/sys/ufs/ffs/ffs_subr.c
===================================================================
--- head/sys/ufs/ffs/ffs_subr.c
+++ head/sys/ufs/ffs/ffs_subr.c
@@ -172,6 +172,7 @@
 	int32_t *lp;
 	char *buf;
 
+	*fsp = NULL;
 	if (altsuperblock != -1) {
 		if ((ret = readsuper(devfd, fsp, altsuperblock, readfunc)) != 0)
 			return (ret);
@@ -209,9 +210,11 @@
 		size = fs->fs_bsize;
 		if (i + fs->fs_frag > blks)
 			size = (blks - i) * fs->fs_fsize;
+		buf = NULL;
 		ret = (*readfunc)(devfd,
 		    dbtob(fsbtodb(fs, fs->fs_csaddr + i)), (void **)&buf, size);
 		if (ret) {
+			UFS_FREE(buf, filltype);
 			UFS_FREE(fs->fs_csp, filltype);
 			fs->fs_csp = NULL;
 			return (ret);
Index: head/sys/ufs/ffs/ffs_vfsops.c
===================================================================
--- head/sys/ufs/ffs/ffs_vfsops.c
+++ head/sys/ufs/ffs/ffs_vfsops.c
@@ -1075,6 +1075,7 @@
 	struct buf *bp;
 	int error;
 
+	free(*bufp, M_UFSMNT);
 	*bufp = malloc(size, M_UFSMNT, M_WAITOK);
 	if ((error = bread((struct vnode *)devfd, btodb(loc), size, NOCRED,
 	    &bp)) != 0) {