Index: usr.sbin/pmcstat/pmcstat.c
===================================================================
--- usr.sbin/pmcstat/pmcstat.c
+++ usr.sbin/pmcstat/pmcstat.c
@@ -192,22 +192,35 @@
 void
 pmcstat_cleanup(void)
 {
-	struct pmcstat_ev *ev, *tmp;
+	struct pmcstat_ev *ev;
+	struct pmcstat_target *pt;
 
 	/* release allocated PMCs. */
-	STAILQ_FOREACH_SAFE(ev, &args.pa_events, ev_next, tmp)
-	    if (ev->ev_pmcid != PMC_ID_INVALID) {
-		if (pmc_stop(ev->ev_pmcid) < 0)
-			err(EX_OSERR, "ERROR: cannot stop pmc 0x%x \"%s\"",
-			    ev->ev_pmcid, ev->ev_name);
-		if (pmc_release(ev->ev_pmcid) < 0)
-			err(EX_OSERR, "ERROR: cannot release pmc 0x%x \"%s\"",
-			    ev->ev_pmcid, ev->ev_name);
+	while (!STAILQ_EMPTY(&args.pa_events)) {
+		ev = STAILQ_FIRST(&args.pa_events);
+		STAILQ_REMOVE_HEAD(&args.pa_events, ev_next);
+		if (ev->ev_pmcid != PMC_ID_INVALID) {
+			if (pmc_stop(ev->ev_pmcid) < 0)
+				err(EX_OSERR,
+				    "ERROR: cannot stop pmc 0x%x \"%s\"",
+				    ev->ev_pmcid, ev->ev_name);
+			if (pmc_release(ev->ev_pmcid) < 0)
+				err(EX_OSERR,
+				    "ERROR: cannot release pmc 0x%x \"%s\"",
+				    ev->ev_pmcid, ev->ev_name);
+		}
 		free(ev->ev_name);
 		free(ev->ev_spec);
 		STAILQ_REMOVE(&args.pa_events, ev, pmcstat_ev, ev_next);
 		free(ev);
-	    }
+	}
+
+	/* release allocated target processes. */
+	while (!SLIST_EMPTY(&args.pa_targets)) {
+		pt = SLIST_FIRST(&args.pa_targets);
+		SLIST_REMOVE_HEAD(&args.pa_targets, pt_next);
+		free(pt);
+	}
 
 	/* de-configure the log file if present. */
 	if (args.pa_flags & (FLAG_HAS_PIPE | FLAG_HAS_OUTPUT_LOGFILE))
@@ -219,6 +232,8 @@
 	}
 
 	pmcstat_shutdown_logging();
+
+	free(args.pa_kernel);
 }
 
 void
@@ -614,7 +629,9 @@
 	len = 0;
 	if (sysctlbyname("kern.bootfile", NULL, &len, NULL, 0) == -1)
 		err(EX_OSERR, "ERROR: Cannot determine path of running kernel");
-	args.pa_kernel = malloc(len + 1);
+	args.pa_kernel = malloc(len);
+	if (args.pa_kernel == NULL)
+		errx(EX_SOFTWARE, "ERROR: Out of memory.");
 	if (sysctlbyname("kern.bootfile", args.pa_kernel, &len, NULL, 0) == -1)
 		err(EX_OSERR, "ERROR: Cannot determine path of running kernel");
 
@@ -796,6 +813,8 @@
 			/* extract event name */
 			c = strcspn(optarg, ", \t");
 			ev->ev_name = malloc(c + 1);
+			if (ev->ev_name == NULL)
+				errx(EX_SOFTWARE, "ERROR: Out of memory.");
 			(void) strncpy(ev->ev_name, optarg, c);
 			*(ev->ev_name + c) = '\0';
 
@@ -1503,8 +1522,6 @@
 
 	pmcstat_cleanup();
 
-	free(args.pa_kernel);
-
 	/* check if the driver lost any samples or events */
 	if (check_driver_stats) {
 		if (pmc_get_driver_stats(&ds_end) < 0)