hwpmc uses pmc_release_pmc_descriptor() to handle a bunch of PMC cleanup. This function also calls pmc_destroy_pmc_descriptor(), which currently doesn't do anything besides verify a few assertions.
In particular, pmc_release_pmc_descriptor() doesn't actually free() the descriptor - it's up to the caller to do that. There are a few places where this call was missing. I fixed this by changing pmc_destroy_pmc_descriptor() to free() the descriptor (this is consistent with pmc_destroy_owner_descriptor()), and adding missing calls.