diff --git a/pageant.c b/pageant.c
index 140760b5..699cd579 100644
--- a/pageant.c
+++ b/pageant.c
@@ -2338,6 +2338,7 @@ int pageant_reencrypt_key(struct pageant_pubkey *key, char **retstr)
 
     if (key->ssh_version == 1) {
         *retstr = dupstr("Can't re-encrypt an SSH-1 key");
+        pageant_client_op_free(pco);
         return PAGEANT_ACTION_FAILURE;
     } else {
         put_byte(pco, SSH2_AGENTC_EXTENSION);
diff --git a/unix/uxser.c b/unix/uxser.c
index 991d6fd8..d4a1e0ba 100644
--- a/unix/uxser.c
+++ b/unix/uxser.c
@@ -357,10 +357,14 @@ static void serial_reconfig(Backend *be, Conf *conf)
 {
     Serial *serial = container_of(be, Serial, backend);
 
-    /*
-     * FIXME: what should we do if this returns an error?
-     */
-    serial_configure(serial, conf);
+    char *err = serial_configure(serial, conf);
+    if (err) {
+        /*
+         * FIXME: apart from freeing the dynamically allocated
+         * message, what should we do if this returns an error?
+         */
+        sfree(err);
+    }
 }
 
 static void serial_select_result(int fd, int event)
diff --git a/windows/wincliloop.c b/windows/wincliloop.c
index 34b9a42e..26a4d3aa 100644
--- a/windows/wincliloop.c
+++ b/windows/wincliloop.c
@@ -127,6 +127,8 @@ void cli_main_loop(cliloop_pre_t pre, cliloop_post_t post, void *ctx)
         if (!post(ctx, extra_handle_index))
             break;
     }
+
+    sfree(sklist);
 }
 
 bool cliloop_null_pre(void *vctx, const HANDLE **eh, size_t *neh)