I came across the following code in /sys/src/cmd/page/view.c:

srvfd = open(srv, ORDWR);
free(srv);
if(srvfd == -1){
	fprint(2, "page: can't open %s: %r\n", srv);
	wexits("no srv");
}

Notice that srv is used after being freed when open(2) fails.

This patch simply moves the call to free(2) after the if statement.  Wexits kills the program so no memory should be leaked by that branch.