The new cryptoapi code introduced a memory allocation in cfs_crypto_hash_init for hdesc that's never freed anywhere other than on error path in cfs_crypto_hash_init itself.