Found with the Clang static analyzer.
Index: constraint.c =================================================================== RCS file: /cvs/src/usr.sbin/ntpd/constraint.c,v retrieving revision 1.14 diff -u -p -r1.14 constraint.c --- constraint.c 18 Jul 2015 21:50:47 -0000 1.14 +++ constraint.c 9 Sep 2015 14:39:36 -0000 @@ -768,6 +768,7 @@ tls_readline(struct tls *tls, size_t *le if (maxlength != NULL && (*maxlength)-- == 0) { log_warnx("maximum length exceeded"); + free(buf); return (NULL); }