bye, bye xfree(); ok markus@

82 files changed, 969 insertions, 1100 deletions

diff --git a/usr.bin/ssh/addrmatch.c b/usr.bin/ssh/addrmatch.c
index e5b1e697c86..b2c86b46e0d 100644
--- a/usr.bin/ssh/addrmatch.c
+++ b/usr.bin/ssh/addrmatch.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: addrmatch.c,v 1.6 2012/06/21 00:16:07 dtucker Exp $ */
+/*	$OpenBSD: addrmatch.c,v 1.7 2013/05/17 00:13:13 djm Exp $ */
 
 /*
  * Copyright (c) 2004-2008 Damien Miller <djm@mindrot.org>
@@ -416,7 +416,7 @@ addr_match_list(const char *addr, const char *_list)
 				goto foundit;
 		}
 	}
-	xfree(o);
+	free(o);
 
 	return ret;
 }
@@ -490,7 +490,7 @@ addr_match_cidr_list(const char *addr, const char *_list)
 			continue;
 		}
 	}
-	xfree(o);
+	free(o);
 
 	return ret;
 }
diff --git a/usr.bin/ssh/auth-chall.c b/usr.bin/ssh/auth-chall.c
index 477dc358f31..e108a72f217 100644
--- a/usr.bin/ssh/auth-chall.c
+++ b/usr.bin/ssh/auth-chall.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-chall.c,v 1.12 2006/08/03 03:34:41 deraadt Exp $ */
+/* $OpenBSD: auth-chall.c,v 1.13 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  *
@@ -58,11 +58,11 @@ get_challenge(Authctxt *authctxt)
 		fatal("get_challenge: numprompts < 1");
 	challenge = xstrdup(prompts[0]);
 	for (i = 0; i < numprompts; i++)
-		xfree(prompts[i]);
-	xfree(prompts);
-	xfree(name);
-	xfree(echo_on);
-	xfree(info);
+		free(prompts[i]);
+	free(prompts);
+	free(name);
+	free(echo_on);
+	free(info);
 
 	return (challenge);
 }
diff --git a/usr.bin/ssh/auth-options.c b/usr.bin/ssh/auth-options.c
index d3a922842fb..032dcada72d 100644
--- a/usr.bin/ssh/auth-options.c
+++ b/usr.bin/ssh/auth-options.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.c,v 1.57 2012/12/02 20:46:11 djm Exp $ */
+/* $OpenBSD: auth-options.c,v 1.58 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -70,15 +70,15 @@ auth_clear_options(void)
 	while (custom_environment) {
 		struct envstring *ce = custom_environment;
 		custom_environment = ce->next;
-		xfree(ce->s);
-		xfree(ce);
+		free(ce->s);
+		free(ce);
 	}
 	if (forced_command) {
-		xfree(forced_command);
+		free(forced_command);
 		forced_command = NULL;
 	}
 	if (authorized_principals) {
-		xfree(authorized_principals);
+		free(authorized_principals);
 		authorized_principals = NULL;
 	}
 	forced_tun_device = -1;
@@ -147,7 +147,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 			opts += strlen(cp);
 			if (forced_command != NULL)
-				xfree(forced_command);
+				free(forced_command);
 			forced_command = xmalloc(strlen(opts) + 1);
 			i = 0;
 			while (*opts) {
@@ -165,7 +165,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    file, linenum);
 				auth_debug_add("%.100s, line %lu: missing end quote",
 				    file, linenum);
-				xfree(forced_command);
+				free(forced_command);
 				forced_command = NULL;
 				goto bad_option;
 			}
@@ -178,7 +178,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 		if (strncasecmp(opts, cp, strlen(cp)) == 0) {
 			opts += strlen(cp);
 			if (authorized_principals != NULL)
-				xfree(authorized_principals);
+				free(authorized_principals);
 			authorized_principals = xmalloc(strlen(opts) + 1);
 			i = 0;
 			while (*opts) {
@@ -196,7 +196,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    file, linenum);
 				auth_debug_add("%.100s, line %lu: missing end quote",
 				    file, linenum);
-				xfree(authorized_principals);
+				free(authorized_principals);
 				authorized_principals = NULL;
 				goto bad_option;
 			}
@@ -230,7 +230,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    file, linenum);
 				auth_debug_add("%.100s, line %lu: missing end quote",
 				    file, linenum);
-				xfree(s);
+				free(s);
 				goto bad_option;
 			}
 			s[i] = '\0';
@@ -267,7 +267,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    file, linenum);
 				auth_debug_add("%.100s, line %lu: missing end quote",
 				    file, linenum);
-				xfree(patterns);
+				free(patterns);
 				goto bad_option;
 			}
 			patterns[i] = '\0';
@@ -275,7 +275,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 			switch (match_host_and_ip(remote_host, remote_ip,
 			    patterns)) {
 			case 1:
-				xfree(patterns);
+				free(patterns);
 				/* Host name matches. */
 				goto next_option;
 			case -1:
@@ -285,7 +285,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    "invalid criteria", file, linenum);
 				/* FALLTHROUGH */
 			case 0:
-				xfree(patterns);
+				free(patterns);
 				logit("Authentication tried for %.100s with "
 				    "correct key but not from a permitted "
 				    "host (host=%.200s, ip=%.200s).",
@@ -321,7 +321,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    file, linenum);
 				auth_debug_add("%.100s, line %lu: missing "
 				    "end quote", file, linenum);
-				xfree(patterns);
+				free(patterns);
 				goto bad_option;
 			}
 			patterns[i] = '\0';
@@ -335,7 +335,7 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				auth_debug_add("%.100s, line %lu: "
 				    "Bad permitopen specification", file,
 				    linenum);
-				xfree(patterns);
+				free(patterns);
 				goto bad_option;
 			}
 			host = cleanhostname(host);
@@ -344,12 +344,12 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    "<%.100s>", file, linenum, p ? p : "");
 				auth_debug_add("%.100s, line %lu: "
 				    "Bad permitopen port", file, linenum);
-				xfree(patterns);
+				free(patterns);
 				goto bad_option;
 			}
 			if ((options.allow_tcp_forwarding & FORWARD_LOCAL) != 0)
 				channel_add_permitted_opens(host, port);
-			xfree(patterns);
+			free(patterns);
 			goto next_option;
 		}
 		cp = "tunnel=\"";
@@ -368,13 +368,13 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum)
 				    file, linenum);
 				auth_debug_add("%.100s, line %lu: missing end quote",
 				    file, linenum);
-				xfree(tun);
+				free(tun);
 				forced_tun_device = -1;
 				goto bad_option;
 			}
 			tun[i] = '\0';
 			forced_tun_device = a2tun(tun, NULL);
-			xfree(tun);
+			free(tun);
 			if (forced_tun_device == SSH_TUNID_ERR) {
 				debug("%.100s, line %lu: invalid tun device",
 				    file, linenum);
@@ -482,7 +482,7 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
 				if (*cert_forced_command != NULL) {
 					error("Certificate has multiple "
 					    "force-command options");
-					xfree(command);
+					free(command);
 					goto out;
 				}
 				*cert_forced_command = command;
@@ -498,7 +498,7 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
 				if ((*cert_source_address_done)++) {
 					error("Certificate has multiple "
 					    "source-address options");
-					xfree(allowed);
+					free(allowed);
 					goto out;
 				}
 				remote_ip = get_remote_ipaddr();
@@ -506,7 +506,7 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
 				    allowed)) {
 				case 1:
 					/* accepted */
-					xfree(allowed);
+					free(allowed);
 					break;
 				case 0:
 					/* no match */
@@ -519,12 +519,12 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
 					    "is not permitted to use this "
 					    "certificate for login.",
 					    remote_ip);
-					xfree(allowed);
+					free(allowed);
 					goto out;
 				case -1:
 					error("Certificate source-address "
 					    "contents invalid");
-					xfree(allowed);
+					free(allowed);
 					goto out;
 				}
 				found = 1;
@@ -546,8 +546,8 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
 			goto out;
 		}
 		buffer_clear(&data);
-		xfree(name);
-		xfree(data_blob);
+		free(name);
+		free(data_blob);
 		name = data_blob = NULL;
 	}
 	/* successfully parsed all options */
@@ -557,13 +557,13 @@ parse_option_list(u_char *optblob, size_t optblob_len, struct passwd *pw,
 	if (ret != 0 &&
 	    cert_forced_command != NULL &&
 	    *cert_forced_command != NULL) {
-		xfree(*cert_forced_command);
+		free(*cert_forced_command);
 		*cert_forced_command = NULL;
 	}
 	if (name != NULL)
-		xfree(name);
+		free(name);
 	if (data_blob != NULL)
-		xfree(data_blob);
+		free(data_blob);
 	buffer_free(&data);
 	buffer_free(&c);
 	return ret;
@@ -625,7 +625,7 @@ auth_cert_options(Key *k, struct passwd *pw)
 	/* CA-specified forced command supersedes key option */
 	if (cert_forced_command != NULL) {
 		if (forced_command != NULL)
-			xfree(forced_command);
+			free(forced_command);
 		forced_command = cert_forced_command;
 	}
 	return 0;
diff --git a/usr.bin/ssh/auth-rsa.c b/usr.bin/ssh/auth-rsa.c
index b913efad1a8..80b1a01d822 100644
--- a/usr.bin/ssh/auth-rsa.c
+++ b/usr.bin/ssh/auth-rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-rsa.c,v 1.81 2012/10/30 21:29:54 djm Exp $ */
+/* $OpenBSD: auth-rsa.c,v 1.82 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -278,7 +278,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
 		file = expand_authorized_keys(
 		    options.authorized_keys_files[i], pw);
 		allowed = rsa_key_allowed_in_file(pw, file, client_n, rkey);
-		xfree(file);
+		free(file);
 	}
 
 	restore_uid();
@@ -328,7 +328,7 @@ auth_rsa(Authctxt *authctxt, BIGNUM *client_n)
 	fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
 	verbose("Found matching %s key: %s",
 	    key_type(key), fp);
-	xfree(fp);
+	free(fp);
 	key_free(key);
 
 	packet_send_debug("RSA authentication accepted.");
diff --git a/usr.bin/ssh/auth.c b/usr.bin/ssh/auth.c
index 449873751ac..5f50f7ab3b1 100644
--- a/usr.bin/ssh/auth.c
+++ b/usr.bin/ssh/auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.101 2013/02/06 00:22:21 dtucker Exp $ */
+/* $OpenBSD: auth.c,v 1.102 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -99,17 +99,17 @@ allowed_user(struct passwd * pw)
 		if (stat(shell, &st) != 0) {
 			logit("User %.100s not allowed because shell %.100s "
 			    "does not exist", pw->pw_name, shell);
-			xfree(shell);
+			free(shell);
 			return 0;
 		}
 		if (S_ISREG(st.st_mode) == 0 ||
 		    (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)) == 0) {
 			logit("User %.100s not allowed because shell %.100s "
 			    "is not executable", pw->pw_name, shell);
-			xfree(shell);
+			free(shell);
 			return 0;
 		}
-		xfree(shell);
+		free(shell);
 	}
 
 	if (options.num_deny_users > 0 || options.num_allow_users > 0 ||
@@ -265,7 +265,7 @@ expand_authorized_keys(const char *filename, struct passwd *pw)
 	i = snprintf(ret, sizeof(ret), "%s/%s", pw->pw_dir, file);
 	if (i < 0 || (size_t)i >= sizeof(ret))
 		fatal("expand_authorized_keys: path too long");
-	xfree(file);
+	free(file);
 	return (xstrdup(ret));
 }
 
@@ -307,7 +307,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
 			load_hostkeys(hostkeys, host, user_hostfile);
 			restore_uid();
 		}
-		xfree(user_hostfile);
+		free(user_hostfile);
 	}
 	host_status = check_key_in_hostkeys(hostkeys, key, &found);
 	if (host_status == HOST_REVOKED)
@@ -540,7 +540,7 @@ auth_key_is_revoked(Key *key)
 		key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
 		error("WARNING: authentication attempt with a revoked "
 		    "%s key %s ", key_type(key), key_fp);
-		xfree(key_fp);
+		free(key_fp);
 		return 1;
 	}
 	fatal("key_in_file returned junk");
@@ -571,7 +571,7 @@ auth_debug_send(void)
 	while (buffer_len(&auth_debug)) {
 		msg = buffer_get_string(&auth_debug, NULL);
 		packet_send_debug("%s", msg);
-		xfree(msg);
+		free(msg);
 	}
 }
 
diff --git a/usr.bin/ssh/auth1.c b/usr.bin/ssh/auth1.c
index b19640d5ba6..98142886e39 100644
--- a/usr.bin/ssh/auth1.c
+++ b/usr.bin/ssh/auth1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth1.c,v 1.77 2012/12/02 20:34:09 djm Exp $ */
+/* $OpenBSD: auth1.c,v 1.78 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -123,7 +123,7 @@ auth1_process_password(Authctxt *authctxt, char *info, size_t infolen)
 	authenticated = PRIVSEP(auth_password(authctxt, password));
 
 	memset(password, 0, dlen);
-	xfree(password);
+	free(password);
 
 	return (authenticated);
 }
@@ -182,7 +182,7 @@ auth1_process_rhosts_rsa(Authctxt *authctxt, char *info, size_t infolen)
 	key_free(client_host_key);
 
 	snprintf(info, infolen, " ruser %.100s", client_user);
-	xfree(client_user);
+	free(client_user);
 
 	return (authenticated);
 }
@@ -199,7 +199,7 @@ auth1_process_tis_challenge(Authctxt *authctxt, char *info, size_t infolen)
 	debug("sending challenge '%s'", challenge);
 	packet_start(SSH_SMSG_AUTH_TIS_CHALLENGE);
 	packet_put_cstring(challenge);
-	xfree(challenge);
+	free(challenge);
 	packet_send();
 	packet_write_wait();
 
@@ -218,7 +218,7 @@ auth1_process_tis_response(Authctxt *authctxt, char *info, size_t infolen)
 	packet_check_eom();
 	authenticated = verify_response(authctxt, response);
 	memset(response, 'r', dlen);
-	xfree(response);
+	free(response);
 
 	return (authenticated);
 }
diff --git a/usr.bin/ssh/auth2-chall.c b/usr.bin/ssh/auth2-chall.c
index 2cfba12ae16..79559e3ebcd 100644
--- a/usr.bin/ssh/auth2-chall.c
+++ b/usr.bin/ssh/auth2-chall.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-chall.c,v 1.37 2013/03/07 19:27:25 markus Exp $ */
+/* $OpenBSD: auth2-chall.c,v 1.38 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2001 Per Allansson.  All rights reserved.
@@ -102,11 +102,9 @@ kbdint_free(KbdintAuthctxt *kbdintctxt)
 {
 	if (kbdintctxt->device)
 		kbdint_reset_device(kbdintctxt);
-	if (kbdintctxt->devices) {
-		xfree(kbdintctxt->devices);
-		kbdintctxt->devices = NULL;
-	}
-	xfree(kbdintctxt);
+	free(kbdintctxt->devices);
+	bzero(kbdintctxt, sizeof(*kbdintctxt));
+	free(kbdintctxt);
 }
 /* get next device */
 static int
@@ -133,7 +131,7 @@ kbdint_next_device(Authctxt *authctxt, KbdintAuthctxt *kbdintctxt)
 		}
 		t = kbdintctxt->devices;
 		kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
-		xfree(t);
+		free(t);
 		debug2("kbdint_next_device: devices %s", kbdintctxt->devices ?
 		    kbdintctxt->devices : "<empty>");
 	} while (kbdintctxt->devices && !kbdintctxt->device);
@@ -227,11 +225,11 @@ send_userauth_info_request(Authctxt *authctxt)
 	packet_write_wait();
 
 	for (i = 0; i < kbdintctxt->nreq; i++)
-		xfree(prompts[i]);
-	xfree(prompts);
-	xfree(echo_on);
-	xfree(name);
-	xfree(instr);
+		free(prompts[i]);
+	free(prompts);
+	free(echo_on);
+	free(name);
+	free(instr);
 	return 1;
 }
 
@@ -270,10 +268,9 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
 
 	for (i = 0; i < nresp; i++) {
 		memset(response[i], 'r', strlen(response[i]));
-		xfree(response[i]);
+		free(response[i]);
 	}
-	if (response)
-		xfree(response);
+	free(response);
 
 	switch (res) {
 	case 0:
diff --git a/usr.bin/ssh/auth2-gss.c b/usr.bin/ssh/auth2-gss.c
index d78c2dad0e0..70e7d6d4ae3 100644
--- a/usr.bin/ssh/auth2-gss.c
+++ b/usr.bin/ssh/auth2-gss.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-gss.c,v 1.19 2013/04/05 00:14:00 djm Exp $ */
+/* $OpenBSD: auth2-gss.c,v 1.20 2013/05/17 00:13:13 djm Exp $ */
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -77,8 +77,7 @@ userauth_gssapi(Authctxt *authctxt)
 	do {
 		mechs--;
 
-		if (doid)
-			xfree(doid);
+		free(doid);
 
 		present = 0;
 		doid = packet_get_string(&len);
@@ -97,7 +96,7 @@ userauth_gssapi(Authctxt *authctxt)
 	gss_release_oid_set(&ms, &supported);
 
 	if (!present) {
-		xfree(doid);
+		free(doid);
 		authctxt->server_caused_failure = 1;
 		return (0);
 	}
@@ -105,7 +104,7 @@ userauth_gssapi(Authctxt *authctxt)
 	if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
 		if (ctxt != NULL)
 			ssh_gssapi_delete_ctx(&ctxt);
-		xfree(doid);
+		free(doid);
 		authctxt->server_caused_failure = 1;
 		return (0);
 	}
@@ -118,7 +117,7 @@ userauth_gssapi(Authctxt *authctxt)
 	packet_put_string(doid, len);
 
 	packet_send();
-	xfree(doid);
+	free(doid);
 
 	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
 	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
@@ -149,7 +148,7 @@ input_gssapi_token(int type, u_int32_t plen, void *ctxt)
 	maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
 	    &send_tok, &flags));
 
-	xfree(recv_tok.value);
+	free(recv_tok.value);
 
 	if (GSS_ERROR(maj_status)) {
 		if (send_tok.length != 0) {
@@ -204,7 +203,7 @@ input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
 	maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
 	    &send_tok, NULL));
 
-	xfree(recv_tok.value);
+	free(recv_tok.value);
 
 	/* We can't return anything to the client, even if we wanted to */
 	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
@@ -277,7 +276,7 @@ input_gssapi_mic(int type, u_int32_t plen, void *ctxt)
 		logit("GSSAPI MIC check failed");
 
 	buffer_free(&b);
-	xfree(mic.value);
+	free(mic.value);
 
 	authctxt->postponed = 0;
 	dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
diff --git a/usr.bin/ssh/auth2-hostbased.c b/usr.bin/ssh/auth2-hostbased.c
index c10cb321697..2ab0dae6d6f 100644
--- a/usr.bin/ssh/auth2-hostbased.c
+++ b/usr.bin/ssh/auth2-hostbased.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-hostbased.c,v 1.14 2010/08/04 05:42:47 djm Exp $ */
+/* $OpenBSD: auth2-hostbased.c,v 1.15 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -127,11 +127,11 @@ done:
 	debug2("userauth_hostbased: authenticated %d", authenticated);
 	if (key != NULL)
 		key_free(key);
-	xfree(pkalg);
-	xfree(pkblob);
-	xfree(cuser);
-	xfree(chost);
-	xfree(sig);
+	free(pkalg);
+	free(pkblob);
+	free(cuser);
+	free(chost);
+	free(sig);
 	return authenticated;
 }
 
@@ -206,7 +206,7 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
 			verbose("Accepted %s public key %s from %s@%s",
 			    key_type(key), fp, cuser, lookup);
 		}
-		xfree(fp);
+		free(fp);
 	}
 
 	return (host_status == HOST_OK);
diff --git a/usr.bin/ssh/auth2-jpake.c b/usr.bin/ssh/auth2-jpake.c
index ed0eba47b47..78a6b881790 100644
--- a/usr.bin/ssh/auth2-jpake.c
+++ b/usr.bin/ssh/auth2-jpake.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-jpake.c,v 1.5 2012/12/02 20:34:09 djm Exp $ */
+/* $OpenBSD: auth2-jpake.c,v 1.6 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
  *
@@ -179,7 +179,7 @@ derive_rawsalt(const char *username, u_char *rawsalt, u_int len)
 		    __func__, len, digest_len);
 	memcpy(rawsalt, digest, len);
 	bzero(digest, digest_len);
-	xfree(digest);
+	free(digest);
 }
 
 /* ASCII an integer [0, 64) for inclusion in a password/salt */
@@ -258,7 +258,7 @@ fake_salt_and_scheme(Authctxt *authctxt, char **salt, char **scheme)
 		    makesalt(22, authctxt->user));
 		*scheme = xstrdup("bcrypt");
 	}
-	xfree(style);
+	free(style);
 	debug3("%s: fake %s salt for user %s: %s",
 	    __func__, *scheme, authctxt->user, *salt);
 }
@@ -361,7 +361,7 @@ auth2_jpake_get_pwdata(Authctxt *authctxt, BIGNUM **s,
 	JPAKE_DEBUG_BN((*s, "%s: s = ", __func__));
 #endif
 	bzero(secret, secret_len);
-	xfree(secret);
+	free(secret);
 }
 
 /*
@@ -403,12 +403,12 @@ auth2_jpake_start(Authctxt *authctxt)
 
 	bzero(hash_scheme, strlen(hash_scheme));
 	bzero(salt, strlen(salt));
-	xfree(hash_scheme);
-	xfree(salt);
+	free(hash_scheme);
+	free(salt);
 	bzero(x3_proof, x3_proof_len);
 	bzero(x4_proof, x4_proof_len);
-	xfree(x3_proof);
-	xfree(x4_proof);
+	free(x3_proof);
+	free(x4_proof);
 
 	/* Expect step 1 packet from peer */
 	dispatch_set(SSH2_MSG_USERAUTH_JPAKE_CLIENT_STEP1,
@@ -455,8 +455,8 @@ input_userauth_jpake_client_step1(int type, u_int32_t seq, void *ctxt)
 
 	bzero(x1_proof, x1_proof_len);
 	bzero(x2_proof, x2_proof_len);
-	xfree(x1_proof);
-	xfree(x2_proof);
+	free(x1_proof);
+	free(x2_proof);
 
 	if (!use_privsep)
 		JPAKE_DEBUG_CTX((pctx, "step 2 sending in %s", __func__));
@@ -469,7 +469,7 @@ input_userauth_jpake_client_step1(int type, u_int32_t seq, void *ctxt)
 	packet_write_wait();
 
 	bzero(x4_s_proof, x4_s_proof_len);
-	xfree(x4_s_proof);
+	free(x4_s_proof);
 
 	/* Expect step 2 packet from peer */
 	dispatch_set(SSH2_MSG_USERAUTH_JPAKE_CLIENT_STEP2,
@@ -510,7 +510,7 @@ input_userauth_jpake_client_step2(int type, u_int32_t seq, void *ctxt)
 	    &pctx->h_k_sid_sessid, &pctx->h_k_sid_sessid_len));
 
 	bzero(x2_s_proof, x2_s_proof_len);
-	xfree(x2_s_proof);
+	free(x2_s_proof);
 
 	if (!use_privsep)
 		JPAKE_DEBUG_CTX((pctx, "confirm sending in %s", __func__));
diff --git a/usr.bin/ssh/auth2-kbdint.c b/usr.bin/ssh/auth2-kbdint.c
index 99656e6b942..2a6e4c89f40 100644
--- a/usr.bin/ssh/auth2-kbdint.c
+++ b/usr.bin/ssh/auth2-kbdint.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-kbdint.c,v 1.5 2006/08/03 03:34:41 deraadt Exp $ */
+/* $OpenBSD: auth2-kbdint.c,v 1.6 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -52,8 +52,8 @@ userauth_kbdint(Authctxt *authctxt)
 	if (options.challenge_response_authentication)
 		authenticated = auth2_challenge(authctxt, devs);
 
-	xfree(devs);
-	xfree(lang);
+	free(devs);
+	free(lang);
 	return authenticated;
 }
 
diff --git a/usr.bin/ssh/auth2-passwd.c b/usr.bin/ssh/auth2-passwd.c
index aae3096e6a7..8ce7cad81b8 100644
--- a/usr.bin/ssh/auth2-passwd.c
+++ b/usr.bin/ssh/auth2-passwd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-passwd.c,v 1.9 2006/08/03 03:34:41 deraadt Exp $ */
+/* $OpenBSD: auth2-passwd.c,v 1.10 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -58,7 +58,7 @@ userauth_passwd(Authctxt *authctxt)
 		/* discard new password from packet */
 		newpass = packet_get_string(&newlen);
 		memset(newpass, 0, newlen);
-		xfree(newpass);
+		free(newpass);
 	}
 	packet_check_eom();
 
@@ -67,7 +67,7 @@ userauth_passwd(Authctxt *authctxt)
 	else if (PRIVSEP(auth_password(authctxt, password)) == 1)
 		authenticated = 1;
 	memset(password, 0, len);
-	xfree(password);
+	free(password);
 	return authenticated;
 }
 
diff --git a/usr.bin/ssh/auth2-pubkey.c b/usr.bin/ssh/auth2-pubkey.c
index 3f50a5600fa..d74f20e70de 100644
--- a/usr.bin/ssh/auth2-pubkey.c
+++ b/usr.bin/ssh/auth2-pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.35 2013/03/07 00:19:59 djm Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.36 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -151,7 +151,7 @@ userauth_pubkey(Authctxt *authctxt)
 		    buffer_len(&b))) == 1)
 			authenticated = 1;
 		buffer_free(&b);
-		xfree(sig);
+		free(sig);
 	} else {
 		debug("test whether pkalg/pkblob are acceptable");
 		packet_check_eom();
@@ -179,8 +179,8 @@ done:
 	debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg);
 	if (key != NULL)
 		key_free(key);
-	xfree(pkalg);
-	xfree(pkblob);
+	free(pkalg);
+	free(pkblob);
 	return authenticated;
 }
 
@@ -197,7 +197,7 @@ match_principals_option(const char *principal_list, struct KeyCert *cert)
 		    principal_list, NULL)) != NULL) {
 			debug3("matched principal from key options \"%.100s\"",
 			    result);
-			xfree(result);
+			free(result);
 			return 1;
 		}
 	}
@@ -333,7 +333,7 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
 				reason = "Certificate does not contain an "
 				    "authorized principal";
  fail_reason:
-				xfree(fp);
+				free(fp);
 				error("%s", reason);
 				auth_debug_add("%s", reason);
 				continue;
@@ -343,13 +343,13 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
 			    &reason) != 0)
 				goto fail_reason;
 			if (auth_cert_options(key, pw) != 0) {
-				xfree(fp);
+				free(fp);
 				continue;
 			}
 			verbose("Accepted certificate ID \"%s\" "
 			    "signed by %s CA %s via %s", key->cert->key_id,
 			    key_type(found), fp, file);
-			xfree(fp);
+			free(fp);
 			found_key = 1;
 			break;
 		} else if (key_equal(found, key)) {
@@ -364,7 +364,7 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)
 			fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
 			verbose("Found matching %s key: %s",
 			    key_type(found), fp);
-			xfree(fp);
+			free(fp);
 			break;
 		}
 	}
@@ -422,10 +422,8 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
 	ret = 1;
 
  out:
-	if (principals_file != NULL)
-		xfree(principals_file);
-	if (ca_fp != NULL)
-		xfree(ca_fp);
+	free(principals_file);
+	free(ca_fp);
 	return ret;
 }
 
@@ -630,7 +628,7 @@ user_key_allowed(struct passwd *pw, Key *key)
 		    options.authorized_keys_files[i], pw);
 
 		success = user_key_allowed2(pw, key, file);
-		xfree(file);
+		free(file);
 	}
 
 	return success;
diff --git a/usr.bin/ssh/auth2.c b/usr.bin/ssh/auth2.c
index 4301ecdc84f..c94728f4b7d 100644
--- a/usr.bin/ssh/auth2.c
+++ b/usr.bin/ssh/auth2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2.c,v 1.127 2013/03/07 19:27:25 markus Exp $ */
+/* $OpenBSD: auth2.c,v 1.128 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -126,7 +126,7 @@ auth2_read_banner(void)
 	close(fd);
 
 	if (n != len) {
-		xfree(banner);
+		free(banner);
 		return (NULL);
 	}
 	banner[n] = '\0';
@@ -153,8 +153,7 @@ userauth_banner(void)
 	packet_send();
 	debug("userauth_banner: sent");
 done:
-	if (banner)
-		xfree(banner);
+	free(banner);
 }
 
 /*
@@ -199,7 +198,7 @@ input_service_request(int type, u_int32_t seq, void *ctxt)
 		debug("bad service request %s", service);
 		packet_disconnect("bad service request %s", service);
 	}
-	xfree(service);
+	free(service);
 }
 
 /*ARGSUSED*/
@@ -272,9 +271,9 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
 	}
 	userauth_finish(authctxt, authenticated, method, NULL);
 
-	xfree(service);
-	xfree(user);
-	xfree(method);
+	free(service);
+	free(user);
+	free(method);
 }
 
 void
@@ -331,7 +330,7 @@ userauth_finish(Authctxt *authctxt, int authenticated, const char *method,
 		packet_put_char(partial);
 		packet_send();
 		packet_write_wait();
-		xfree(methods);
+		free(methods);
 	}
 }
 
diff --git a/usr.bin/ssh/authfd.c b/usr.bin/ssh/authfd.c
index c6807b7f7c6..88a9a9a86b8 100644
--- a/usr.bin/ssh/authfd.c
+++ b/usr.bin/ssh/authfd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfd.c,v 1.86 2011/07/06 18:09:21 tedu Exp $ */
+/* $OpenBSD: authfd.c,v 1.87 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -222,7 +222,7 @@ ssh_close_authentication_connection(AuthenticationConnection *auth)
 {
 	buffer_free(&auth->identities);
 	close(auth->fd);
-	xfree(auth);
+	free(auth);
 }
 
 /* Lock/unlock agent */
@@ -341,7 +341,7 @@ ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int versio
 		blob = buffer_get_string(&auth->identities, &blen);
 		*comment = buffer_get_string(&auth->identities, NULL);
 		key = key_from_blob(blob, blen);
-		xfree(blob);
+		free(blob);
 		break;
 	default:
 		return NULL;
@@ -434,7 +434,7 @@ ssh_agent_sign(AuthenticationConnection *auth,
 	buffer_put_string(&msg, blob, blen);
 	buffer_put_string(&msg, data, datalen);
 	buffer_put_int(&msg, flags);
-	xfree(blob);
+	free(blob);
 
 	if (ssh_request_reply(auth, &msg, &msg) == 0) {
 		buffer_free(&msg);
@@ -608,7 +608,7 @@ ssh_remove_identity(AuthenticationConnection *auth, Key *key)
 		key_to_blob(key, &blob, &blen);
 		buffer_put_char(&msg, SSH2_AGENTC_REMOVE_IDENTITY);
 		buffer_put_string(&msg, blob, blen);
-		xfree(blob);
+		free(blob);
 	} else {
 		buffer_free(&msg);
 		return 0;
diff --git a/usr.bin/ssh/authfile.c b/usr.bin/ssh/authfile.c
index 474b4ab8587..1f0910ddaad 100644
--- a/usr.bin/ssh/authfile.c
+++ b/usr.bin/ssh/authfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfile.c,v 1.96 2013/04/19 01:06:50 djm Exp $ */
+/* $OpenBSD: authfile.c,v 1.97 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -498,8 +498,8 @@ key_parse_private_rsa1(Buffer *blob, const char *passphrase, char **commentp)
 	return prv;
 
 fail:
-	if (commentp)
-		xfree(*commentp);
+	if (commentp != NULL)
+		free(*commentp);
 	key_free(prv);
 	return NULL;
 }
@@ -816,10 +816,10 @@ key_load_cert(const char *filename)
 	pub = key_new(KEY_UNSPEC);
 	xasprintf(&file, "%s-cert.pub", filename);
 	if (key_try_load_public(pub, file, NULL) == 1) {
-		xfree(file);
+		free(file);
 		return pub;
 	}
-	xfree(file);
+	free(file);
 	key_free(pub);
 	return NULL;
 }
diff --git a/usr.bin/ssh/bufaux.c b/usr.bin/ssh/bufaux.c
index f5a5d881222..efff2d0d4bd 100644
--- a/usr.bin/ssh/bufaux.c
+++ b/usr.bin/ssh/bufaux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufaux.c,v 1.50 2010/08/31 09:58:37 djm Exp $ */
+/* $OpenBSD: bufaux.c,v 1.51 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -179,7 +179,7 @@ buffer_get_string_ret(Buffer *buffer, u_int *length_ptr)
 	/* Get the string. */
 	if (buffer_get_ret(buffer, value, len) == -1) {
 		error("buffer_get_string_ret: buffer_get failed");
-		xfree(value);
+		free(value);
 		return (NULL);
 	}
 	/* Append a null character to make processing easier. */
@@ -214,7 +214,7 @@ buffer_get_cstring_ret(Buffer *buffer, u_int *length_ptr)
 			error("buffer_get_cstring_ret: string contains \\0");
 		else {
 			bzero(ret, length);
-			xfree(ret);
+			free(ret);
 			return NULL;
 		}
 	}
diff --git a/usr.bin/ssh/bufbn.c b/usr.bin/ssh/bufbn.c
index 18cdd70d4b2..cce94e87fee 100644
--- a/usr.bin/ssh/bufbn.c
+++ b/usr.bin/ssh/bufbn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufbn.c,v 1.6 2007/06/02 09:04:58 djm Exp $*/
+/* $OpenBSD: bufbn.c,v 1.7 2013/05/17 00:13:13 djm Exp $*/
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -67,7 +67,7 @@ buffer_put_bignum_ret(Buffer *buffer, const BIGNUM *value)
 	if (oi != bin_size) {
 		error("buffer_put_bignum_ret: BN_bn2bin() failed: oi %d != bin_size %d",
 		    oi, bin_size);
-		xfree(buf);
+		free(buf);
 		return (-1);
 	}
 
@@ -78,7 +78,7 @@ buffer_put_bignum_ret(Buffer *buffer, const BIGNUM *value)
 	buffer_append(buffer, buf, oi);
 
 	memset(buf, 0, bin_size);
-	xfree(buf);
+	free(buf);
 
 	return (0);
 }
@@ -165,13 +165,13 @@ buffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value)
 	if (oi < 0 || (u_int)oi != bytes - 1) {
 		error("buffer_put_bignum2_ret: BN_bn2bin() failed: "
 		    "oi %d != bin_size %d", oi, bytes);
-		xfree(buf);
+		free(buf);
 		return (-1);
 	}
 	hasnohigh = (buf[1] & 0x80) ? 0 : 1;
 	buffer_put_string(buffer, buf+hasnohigh, bytes-hasnohigh);
 	memset(buf, 0, bytes);
-	xfree(buf);
+	free(buf);
 	return (0);
 }
 
@@ -195,21 +195,21 @@ buffer_get_bignum2_ret(Buffer *buffer, BIGNUM *value)
 
 	if (len > 0 && (bin[0] & 0x80)) {
 		error("buffer_get_bignum2_ret: negative numbers not supported");
-		xfree(bin);
+		free(bin);
 		return (-1);
 	}
 	if (len > 8 * 1024) {
 		error("buffer_get_bignum2_ret: cannot handle BN of size %d",
 		    len);
-		xfree(bin);
+		free(bin);
 		return (-1);
 	}
 	if (BN_bin2bn(bin, len, value) == NULL) {
 		error("buffer_get_bignum2_ret: BN_bin2bn failed");
-		xfree(bin);
+		free(bin);
 		return (-1);
 	}
-	xfree(bin);
+	free(bin);
 	return (0);
 }
 
diff --git a/usr.bin/ssh/bufec.c b/usr.bin/ssh/bufec.c
index dff9c69c90e..a3825cf6e4f 100644
--- a/usr.bin/ssh/bufec.c
+++ b/usr.bin/ssh/bufec.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufec.c,v 1.1 2010/08/31 11:54:45 djm Exp $ */
+/* $OpenBSD: bufec.c,v 1.2 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2010 Damien Miller <djm@mindrot.org>
  *
@@ -73,7 +73,7 @@ buffer_put_ecpoint_ret(Buffer *buffer, const EC_GROUP *curve,
  out:
 	if (buf != NULL) {
 		bzero(buf, len);
-		xfree(buf);
+		free(buf);
 	}
 	BN_CTX_free(bnctx);
 	return ret;
@@ -126,7 +126,7 @@ buffer_get_ecpoint_ret(Buffer *buffer, const EC_GROUP *curve,
  out:
 	BN_CTX_free(bnctx);
 	bzero(buf, len);
-	xfree(buf);
+	free(buf);
 	return ret;
 }
 
diff --git a/usr.bin/ssh/buffer.c b/usr.bin/ssh/buffer.c
index 656454bf84e..de32c0e0a86 100644
--- a/usr.bin/ssh/buffer.c
+++ b/usr.bin/ssh/buffer.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: buffer.c,v 1.32 2010/02/09 03:56:28 djm Exp $ */
+/* $OpenBSD: buffer.c,v 1.33 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -48,7 +48,7 @@ buffer_free(Buffer *buffer)
 	if (buffer->alloc > 0) {
 		memset(buffer->buf, 0, buffer->alloc);
 		buffer->alloc = 0;
-		xfree(buffer->buf);
+		free(buffer->buf);
 	}
 }
 
diff --git a/usr.bin/ssh/canohost.c b/usr.bin/ssh/canohost.c
index 1f428d9a88e..c0afca6d283 100644
--- a/usr.bin/ssh/canohost.c
+++ b/usr.bin/ssh/canohost.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: canohost.c,v 1.66 2010/01/13 01:20:20 dtucker Exp $ */
+/* $OpenBSD: canohost.c,v 1.67 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -38,7 +38,7 @@ static int cached_port = -1;
 
 /*
  * Return the canonical name of the host at the other end of the socket. The
- * caller should free the returned string with xfree.
+ * caller should free the returned string.
  */
 
 static char *
@@ -281,10 +281,8 @@ get_local_name(int fd)
 void
 clear_cached_addr(void)
 {
-	if (canonical_host_ip != NULL) {
-		xfree(canonical_host_ip);
-		canonical_host_ip = NULL;
-	}
+	free(canonical_host_ip);
+	canonical_host_ip = NULL;
 	cached_port = -1;
 }
 
diff --git a/usr.bin/ssh/channels.c b/usr.bin/ssh/channels.c
index 7ae54b9f3b6..e8c503d614f 100644
--- a/usr.bin/ssh/channels.c
+++ b/usr.bin/ssh/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.320 2013/04/06 16:07:00 markus Exp $ */
+/* $OpenBSD: channels.c,v 1.321 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -396,7 +396,7 @@ channel_free(Channel *c)
 
 	s = channel_open_message();
 	debug3("channel %d: status: %s", c->self, s);
-	xfree(s);
+	free(s);
 
 	if (c->sock != -1)
 		shutdown(c->sock, SHUT_RDWR);
@@ -404,29 +404,23 @@ channel_free(Channel *c)
 	buffer_free(&c->input);
 	buffer_free(&c->output);
 	buffer_free(&c->extended);
-	if (c->remote_name) {
-		xfree(c->remote_name);
-		c->remote_name = NULL;
-	}
-	if (c->path) {
-		xfree(c->path);
-		c->path = NULL;
-	}
-	if (c->listening_addr) {
-		xfree(c->listening_addr);
-		c->listening_addr = NULL;
-	}
+	free(c->remote_name);
+	c->remote_name = NULL;
+	free(c->path);
+	c->path = NULL;
+	free(c->listening_addr);
+	c->listening_addr = NULL;
 	while ((cc = TAILQ_FIRST(&c->status_confirms)) != NULL) {
 		if (cc->abandon_cb != NULL)
 			cc->abandon_cb(c, cc->ctx);
 		TAILQ_REMOVE(&c->status_confirms, cc, entry);
 		bzero(cc, sizeof(*cc));
-		xfree(cc);
+		free(cc);
 	}
 	if (c->filter_cleanup != NULL && c->filter_ctx != NULL)
 		c->filter_cleanup(c->self, c->filter_ctx);
 	channels[c->self] = NULL;
-	xfree(c);
+	free(c);
 }
 
 void
@@ -1075,10 +1069,8 @@ channel_decode_socks4(Channel *c, fd_set *readset, fd_set *writeset)
 	strlcpy(username, p, sizeof(username));
 	buffer_consume(&c->input, len);
 
-	if (c->path != NULL) {
-		xfree(c->path);
-		c->path = NULL;
-	}
+	free(c->path);
+	c->path = NULL;
 	if (need == 1) {			/* SOCKS4: one string */
 		host = inet_ntoa(s4_req.dest_addr);
 		c->path = xstrdup(host);
@@ -1211,10 +1203,8 @@ channel_decode_socks5(Channel *c, fd_set *readset, fd_set *writeset)
 	buffer_get(&c->input, (char *)&dest_addr, addrlen);
 	buffer_get(&c->input, (char *)&dest_port, 2);
 	dest_addr[addrlen] = '\0';
-	if (c->path != NULL) {
-		xfree(c->path);
-		c->path = NULL;
-	}
+	free(c->path);
+	c->path = NULL;
 	if (s5_req.atyp == SSH_SOCKS5_DOMAIN) {
 		if (addrlen >= NI_MAXHOST) {
 			error("channel %d: dynamic request: socks5 hostname "
@@ -1374,7 +1364,7 @@ channel_post_x11_listener(Channel *c, fd_set *readset, fd_set *writeset)
 				packet_put_cstring(buf);
 			packet_send();
 		}
-		xfree(remote_ipaddr);
+		free(remote_ipaddr);
 	}
 }
 
@@ -1388,7 +1378,7 @@ port_open_helper(Channel *c, char *rtype)
 
 	if (remote_port == -1) {
 		/* Fake addr/port to appease peers that validate it (Tectia) */
-		xfree(remote_ipaddr);
+		free(remote_ipaddr);
 		remote_ipaddr = xstrdup("127.0.0.1");
 		remote_port = 65535;
 	}
@@ -1401,7 +1391,7 @@ port_open_helper(Channel *c, char *rtype)
 	    rtype, c->listening_port, c->path, c->host_port,
 	    remote_ipaddr, remote_port);
 
-	xfree(c->remote_name);
+	free(c->remote_name);
 	c->remote_name = xstrdup(buf);
 
 	if (compat20) {
@@ -1433,7 +1423,7 @@ port_open_helper(Channel *c, char *rtype)
 			packet_put_cstring(c->remote_name);
 		packet_send();
 	}
-	xfree(remote_ipaddr);
+	free(remote_ipaddr);
 }
 
 static void
@@ -1679,7 +1669,7 @@ channel_handle_wfd(Channel *c, fd_set *readset, fd_set *writeset)
 		if (c->datagram) {
 			/* ignore truncated writes, datagrams might get lost */
 			len = write(c->wfd, buf, dlen);
-			xfree(data);
+			free(data);
 			if (len < 0 && (errno == EINTR || errno == EAGAIN))
 				return 1;
 			if (len <= 0) {
@@ -2203,7 +2193,7 @@ channel_output_poll(void)
 						debug("channel %d: datagram "
 						    "too big for channel",
 						    c->self);
-						xfree(data);
+						free(data);
 						continue;
 					}
 					packet_start(SSH2_MSG_CHANNEL_DATA);
@@ -2211,7 +2201,7 @@ channel_output_poll(void)
 					packet_put_string(data, dlen);
 					packet_send();
 					c->remote_window -= dlen + 4;
-					xfree(data);
+					free(data);
 				}
 				continue;
 			}
@@ -2383,13 +2373,13 @@ channel_input_extended_data(int type, u_int32_t seq, void *ctxt)
 	if (data_len > c->local_window) {
 		logit("channel %d: rcvd too much extended_data %d, win %d",
 		    c->self, data_len, c->local_window);
-		xfree(data);
+		free(data);
 		return;
 	}
 	debug2("channel %d: rcvd ext data %d", c->self, data_len);
 	c->local_window -= data_len;
 	buffer_append(&c->extended, data, data_len);
-	xfree(data);
+	free(data);
 }
 
 /* ARGSUSED */
@@ -2555,10 +2545,8 @@ channel_input_open_failure(int type, u_int32_t seq, void *ctxt)
 		}
 		logit("channel %d: open failed: %s%s%s", id,
 		    reason2txt(reason), msg ? ": ": "", msg ? msg : "");
-		if (msg != NULL)
-			xfree(msg);
-		if (lang != NULL)
-			xfree(lang);
+		free(msg);
+		free(lang);
 		if (c->open_confirm) {
 			debug2("callback start");
 			c->open_confirm(c->self, 0, c->open_confirm_ctx);
@@ -2616,8 +2604,8 @@ channel_input_port_open(int type, u_int32_t seq, void *ctxt)
 	packet_check_eom();
 	c = channel_connect_to(host, host_port,
 	    "connected socket", originator_string);
-	xfree(originator_string);
-	xfree(host);
+	free(originator_string);
+	free(host);
 	if (c == NULL) {
 		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
 		packet_put_int(remote_id);
@@ -2652,7 +2640,7 @@ channel_input_status_confirm(int type, u_int32_t seq, void *ctxt)
 	cc->cb(type, c, cc->ctx);
 	TAILQ_REMOVE(&c->status_confirms, cc, entry);
 	bzero(cc, sizeof(*cc));
-	xfree(cc);
+	free(cc);
 }
 
 /* -- tcp forwarding */
@@ -3026,7 +3014,7 @@ channel_request_rforward_cancel(const char *host, u_short port)
 
 	permitted_opens[i].listen_port = 0;
 	permitted_opens[i].port_to_connect = 0;
-	xfree(permitted_opens[i].host_to_connect);
+	free(permitted_opens[i].host_to_connect);
 	permitted_opens[i].host_to_connect = NULL;
 
 	return 0;
@@ -3065,7 +3053,7 @@ channel_input_port_forward_request(int is_root, int gateway_ports)
 	    host_port, gateway_ports);
 
 	/* Free the argument string. */
-	xfree(hostname);
+	free(hostname);
 
 	return (success ? 0 : -1);
 }
@@ -3120,7 +3108,7 @@ channel_update_permitted_opens(int idx, int newport)
 	} else {
 		permitted_opens[idx].listen_port = 0;
 		permitted_opens[idx].port_to_connect = 0;
-		xfree(permitted_opens[idx].host_to_connect);
+		free(permitted_opens[idx].host_to_connect);
 		permitted_opens[idx].host_to_connect = NULL;
 	}
 }
@@ -3153,12 +3141,9 @@ channel_clear_permitted_opens(void)
 	int i;
 
 	for (i = 0; i < num_permitted_opens; i++)
-		if (permitted_opens[i].host_to_connect != NULL)
-			xfree(permitted_opens[i].host_to_connect);
-	if (num_permitted_opens > 0) {
-		xfree(permitted_opens);
-		permitted_opens = NULL;
-	}
+		free(permitted_opens[i].host_to_connect);
+	free(permitted_opens);
+	permitted_opens = NULL;
 	num_permitted_opens = 0;
 }
 
@@ -3168,12 +3153,9 @@ channel_clear_adm_permitted_opens(void)
 	int i;
 
 	for (i = 0; i < num_adm_permitted_opens; i++)
-		if (permitted_adm_opens[i].host_to_connect != NULL)
-			xfree(permitted_adm_opens[i].host_to_connect);
-	if (num_adm_permitted_opens > 0) {
-		xfree(permitted_adm_opens);
-		permitted_adm_opens = NULL;
-	}
+		free(permitted_adm_opens[i].host_to_connect);
+	free(permitted_adm_opens);
+	permitted_adm_opens = NULL;
 	num_adm_permitted_opens = 0;
 }
 
@@ -3267,7 +3249,7 @@ connect_next(struct channel_connect *cctx)
 static void
 channel_connect_ctx_free(struct channel_connect *cctx)
 {
-	xfree(cctx->host);
+	free(cctx->host);
 	if (cctx->aitop)
 		freeaddrinfo(cctx->aitop);
 	bzero(cctx, sizeof(*cctx));
@@ -3630,7 +3612,7 @@ x11_input_open(int type, u_int32_t seq, void *ctxt)
 		c->remote_id = remote_id;
 		c->force_drain = 1;
 	}
-	xfree(remote_host);
+	free(remote_host);
 	if (c == NULL) {
 		/* Send refusal to the remote host. */
 		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
@@ -3738,7 +3720,7 @@ x11_request_forwarding_with_spoofing(int client_session_id, const char *disp,
 	packet_put_int(screen_number);
 	packet_send();
 	packet_write_wait();
-	xfree(new_data);
+	free(new_data);
 }
 
 
diff --git a/usr.bin/ssh/cipher-3des1.c b/usr.bin/ssh/cipher-3des1.c
index 8af7b792d56..3f480024bfd 100644
--- a/usr.bin/ssh/cipher-3des1.c
+++ b/usr.bin/ssh/cipher-3des1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cipher-3des1.c,v 1.7 2010/10/01 23:05:32 djm Exp $ */
+/* $OpenBSD: cipher-3des1.c,v 1.8 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2003 Markus Friedl.  All rights reserved.
  *
@@ -84,7 +84,7 @@ ssh1_3des_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
 	    EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 ||
 	    EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) {
 		memset(c, 0, sizeof(*c));
-		xfree(c);
+		free(c);
 		EVP_CIPHER_CTX_set_app_data(ctx, NULL);
 		return (0);
 	}
@@ -117,7 +117,7 @@ ssh1_3des_cleanup(EVP_CIPHER_CTX *ctx)
 		EVP_CIPHER_CTX_cleanup(&c->k2);
 		EVP_CIPHER_CTX_cleanup(&c->k3);
 		memset(c, 0, sizeof(*c));
-		xfree(c);
+		free(c);
 		EVP_CIPHER_CTX_set_app_data(ctx, NULL);
 	}
 	return (1);
diff --git a/usr.bin/ssh/cipher.c b/usr.bin/ssh/cipher.c
index e7ea118eaa6..25ecaa324fa 100644
--- a/usr.bin/ssh/cipher.c
+++ b/usr.bin/ssh/cipher.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cipher.c,v 1.88 2013/04/19 01:06:50 djm Exp $ */
+/* $OpenBSD: cipher.c,v 1.89 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -199,14 +199,14 @@ ciphers_valid(const char *names)
 		c = cipher_by_name(p);
 		if (c == NULL || c->number != SSH_CIPHER_SSH2) {
 			debug("bad cipher %s [%s]", p, names);
-			xfree(cipher_list);
+			free(cipher_list);
 			return 0;
 		} else {
 			debug3("cipher ok: %s [%s]", p, names);
 		}
 	}
 	debug3("ciphers ok: [%s]", names);
-	xfree(cipher_list);
+	free(cipher_list);
 	return 1;
 }
 
@@ -294,8 +294,8 @@ cipher_init(CipherContext *cc, const Cipher *cipher,
 		    cipher->discard_len) == 0)
 			fatal("evp_crypt: EVP_Cipher failed during discard");
 		memset(discard, 0, cipher->discard_len);
-		xfree(junk);
-		xfree(discard);
+		free(junk);
+		free(discard);
 	}
 }
 
diff --git a/usr.bin/ssh/clientloop.c b/usr.bin/ssh/clientloop.c
index f26302226f9..2f3f8a59a2e 100644
--- a/usr.bin/ssh/clientloop.c
+++ b/usr.bin/ssh/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.249 2013/05/16 02:00:34 dtucker Exp $ */
+/* $OpenBSD: clientloop.c,v 1.250 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -385,10 +385,8 @@ client_x11_get_proto(const char *display, const char *xauth_path,
 		unlink(xauthfile);
 		rmdir(xauthdir);
 	}
-	if (xauthdir)
-		xfree(xauthdir);
-	if (xauthfile)
-		xfree(xauthfile);
+	free(xauthdir);
+	free(xauthfile);
 
 	/*
 	 * If we didn't get authentication data, just make up some
@@ -544,7 +542,7 @@ client_global_request_reply(int type, u_int32_t seq, void *ctxt)
 	if (--gc->ref_count <= 0) {
 		TAILQ_REMOVE(&global_confirms, gc, entry);
 		bzero(gc, sizeof(*gc));
-		xfree(gc);
+		free(gc);
 	}
 
 	packet_set_alive_timeouts(0);
@@ -817,13 +815,13 @@ client_status_confirm(int type, Channel *c, void *ctx)
 			chan_write_failed(c);
 		}
 	}
-	xfree(cr);
+	free(cr);
 }
 
 static void
 client_abandon_status_confirm(Channel *c, void *ctx)
 {
-	xfree(ctx);
+	free(ctx);
 }
 
 void
@@ -990,12 +988,9 @@ process_cmdline(void)
 out:
 	signal(SIGINT, handler);
 	enter_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
-	if (cmd)
-		xfree(cmd);
-	if (fwd.listen_host != NULL)
-		xfree(fwd.listen_host);
-	if (fwd.connect_host != NULL)
-		xfree(fwd.connect_host);
+	free(cmd);
+	free(fwd.listen_host);
+	free(fwd.connect_host);
 }
 
 /* reasons to suppress output of an escape command in help output */
@@ -1252,7 +1247,7 @@ process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
 				buffer_append(berr, string, strlen(string));
 				s = channel_open_message();
 				buffer_append(berr, s, strlen(s));
-				xfree(s);
+				free(s);
 				continue;
 
 			case 'C':
@@ -1438,7 +1433,7 @@ client_new_escape_filter_ctx(int escape_char)
 void
 client_filter_cleanup(int cid, void *ctx)
 {
-	xfree(ctx);
+	free(ctx);
 }
 
 int
@@ -1649,10 +1644,8 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 			}
 		}
 	}
-	if (readset)
-		xfree(readset);
-	if (writeset)
-		xfree(writeset);
+	free(readset);
+	free(writeset);
 
 	/* Terminate the session. */
 
@@ -1754,7 +1747,7 @@ client_input_stdout_data(int type, u_int32_t seq, void *ctxt)
 	packet_check_eom();
 	buffer_append(&stdout_buffer, data, data_len);
 	memset(data, 0, data_len);
-	xfree(data);
+	free(data);
 }
 static void
 client_input_stderr_data(int type, u_int32_t seq, void *ctxt)
@@ -1764,7 +1757,7 @@ client_input_stderr_data(int type, u_int32_t seq, void *ctxt)
 	packet_check_eom();
 	buffer_append(&stderr_buffer, data, data_len);
 	memset(data, 0, data_len);
-	xfree(data);
+	free(data);
 }
 static void
 client_input_exit_status(int type, u_int32_t seq, void *ctxt)
@@ -1844,8 +1837,8 @@ client_request_forwarded_tcpip(const char *request_type, int rchan)
 	c = channel_connect_by_listen_address(listen_port,
 	    "forwarded-tcpip", originator_address);
 
-	xfree(originator_address);
-	xfree(listen_address);
+	free(originator_address);
+	free(listen_address);
 	return c;
 }
 
@@ -1879,7 +1872,7 @@ client_request_x11(const char *request_type, int rchan)
 	/* XXX check permission */
 	debug("client_request_x11: request from %s %d", originator,
 	    originator_port);
-	xfree(originator);
+	free(originator);
 	sock = x11_connect_display();
 	if (sock < 0)
 		return NULL;
@@ -2000,7 +1993,7 @@ client_input_channel_open(int type, u_int32_t seq, void *ctxt)
 		}
 		packet_send();
 	}
-	xfree(ctype);
+	free(ctype);
 }
 static void
 client_input_channel_req(int type, u_int32_t seq, void *ctxt)
@@ -2046,7 +2039,7 @@ client_input_channel_req(int type, u_int32_t seq, void *ctxt)
 		packet_put_int(c->remote_id);
 		packet_send();
 	}
-	xfree(rtype);
+	free(rtype);
 }
 static void
 client_input_global_request(int type, u_int32_t seq, void *ctxt)
@@ -2065,7 +2058,7 @@ client_input_global_request(int type, u_int32_t seq, void *ctxt)
 		packet_send();
 		packet_write_wait();
 	}
-	xfree(rtype);
+	free(rtype);
 }
 
 void
@@ -2115,7 +2108,7 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
 			/* Split */
 			name = xstrdup(env[i]);
 			if ((val = strchr(name, '=')) == NULL) {
-				xfree(name);
+				free(name);
 				continue;
 			}
 			*val++ = '\0';
@@ -2129,7 +2122,7 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
 			}
 			if (!matched) {
 				debug3("Ignored env %s", name);
-				xfree(name);
+				free(name);
 				continue;
 			}
 
@@ -2138,7 +2131,7 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
 			packet_put_cstring(name);
 			packet_put_cstring(val);
 			packet_send();
-			xfree(name);
+			free(name);
 		}
 	}
 
diff --git a/usr.bin/ssh/compat.c b/usr.bin/ssh/compat.c
index 23fc439e664..3c4d68edfd8 100644
--- a/usr.bin/ssh/compat.c
+++ b/usr.bin/ssh/compat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: compat.c,v 1.80 2012/08/17 01:30:00 djm Exp $ */
+/* $OpenBSD: compat.c,v 1.81 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl.  All rights reserved.
  *
@@ -202,7 +202,7 @@ proto_spec(const char *spec)
 			break;
 		}
 	}
-	xfree(s);
+	free(s);
 	return ret;
 }
 
@@ -228,7 +228,7 @@ compat_cipher_proposal(char *cipher_prop)
 	buffer_append(&b, "\0", 1);
 	fix_ciphers = xstrdup(buffer_ptr(&b));
 	buffer_free(&b);
-	xfree(orig_prop);
+	free(orig_prop);
 	debug2("Original cipher proposal: %s", cipher_prop);
 	debug2("Compat cipher proposal: %s", fix_ciphers);
 	if (!*fix_ciphers)
diff --git a/usr.bin/ssh/dns.c b/usr.bin/ssh/dns.c
index b17e61152ed..08827216fbd 100644
--- a/usr.bin/ssh/dns.c
+++ b/usr.bin/ssh/dns.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dns.c,v 1.28 2012/05/23 03:28:28 djm Exp $ */
+/* $OpenBSD: dns.c,v 1.29 2013/05/17 00:13:13 djm Exp $ */
 
 /*
  * Copyright (c) 2003 Wesley Griffin. All rights reserved.
@@ -258,7 +258,7 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
 
 		if (hostkey_digest_type != dnskey_digest_type) {
 			hostkey_digest_type = dnskey_digest_type;
-			xfree(hostkey_digest);
+			free(hostkey_digest);
 
 			/* Initialize host key parameters */
 			if (!dns_read_key(&hostkey_algorithm,
@@ -278,10 +278,10 @@ verify_host_key_dns(const char *hostname, struct sockaddr *address,
 			    hostkey_digest_len) == 0)
 				*flags |= DNS_VERIFY_MATCH;
 		}
-		xfree(dnskey_digest);
+		free(dnskey_digest);
 	}
 
-	xfree(hostkey_digest); /* from key_fingerprint_raw() */
+	free(hostkey_digest); /* from key_fingerprint_raw() */
 	freerrset(fingerprints);
 
 	if (*flags & DNS_VERIFY_FOUND)
@@ -324,7 +324,7 @@ export_dns_rr(const char *hostname, Key *key, FILE *f, int generic)
 			for (i = 0; i < rdata_digest_len; i++)
 				fprintf(f, "%02x", rdata_digest[i]);
 			fprintf(f, "\n");
-			xfree(rdata_digest); /* from key_fingerprint_raw() */
+			free(rdata_digest); /* from key_fingerprint_raw() */
 			success = 1;
 		}
 	}
diff --git a/usr.bin/ssh/groupaccess.c b/usr.bin/ssh/groupaccess.c
index a2cdb04c676..fd4a40ecee0 100644
--- a/usr.bin/ssh/groupaccess.c
+++ b/usr.bin/ssh/groupaccess.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: groupaccess.c,v 1.13 2008/07/04 03:44:59 djm Exp $ */
+/* $OpenBSD: groupaccess.c,v 1.14 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2001 Kevin Steves.  All rights reserved.
  *
@@ -29,6 +29,7 @@
 #include <grp.h>
 #include <unistd.h>
 #include <stdarg.h>
+#include <stdlib.h>
 #include <string.h>
 
 #include "xmalloc.h"
@@ -112,7 +113,7 @@ ga_free(void)
 
 	if (ngroups > 0) {
 		for (i = 0; i < ngroups; i++)
-			xfree(groups_byname[i]);
+			free(groups_byname[i]);
 		ngroups = 0;
 	}
 }
diff --git a/usr.bin/ssh/gss-genr.c b/usr.bin/ssh/gss-genr.c
index a13f634547f..58395d791a7 100644
--- a/usr.bin/ssh/gss-genr.c
+++ b/usr.bin/ssh/gss-genr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: gss-genr.c,v 1.20 2009/06/22 05:39:28 dtucker Exp $ */
+/* $OpenBSD: gss-genr.c,v 1.21 2013/05/17 00:13:13 djm Exp $ */
 
 /*
  * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
@@ -55,8 +55,8 @@ void
 ssh_gssapi_set_oid_data(Gssctxt *ctx, void *data, size_t len)
 {
 	if (ctx->oid != GSS_C_NO_OID) {
-		xfree(ctx->oid->elements);
-		xfree(ctx->oid);
+		free(ctx->oid->elements);
+		free(ctx->oid);
 	}
 	ctx->oid = xmalloc(sizeof(gss_OID_desc));
 	ctx->oid->length = len;
@@ -79,7 +79,7 @@ ssh_gssapi_error(Gssctxt *ctxt)
 
 	s = ssh_gssapi_last_error(ctxt, NULL, NULL);
 	debug("%s", s);
-	xfree(s);
+	free(s);
 }
 
 char *
@@ -160,8 +160,8 @@ ssh_gssapi_delete_ctx(Gssctxt **ctx)
 	if ((*ctx)->name != GSS_C_NO_NAME)
 		gss_release_name(&ms, &(*ctx)->name);
 	if ((*ctx)->oid != GSS_C_NO_OID) {
-		xfree((*ctx)->oid->elements);
-		xfree((*ctx)->oid);
+		free((*ctx)->oid->elements);
+		free((*ctx)->oid);
 		(*ctx)->oid = GSS_C_NO_OID;
 	}
 	if ((*ctx)->creds != GSS_C_NO_CREDENTIAL)
@@ -171,7 +171,7 @@ ssh_gssapi_delete_ctx(Gssctxt **ctx)
 	if ((*ctx)->client_creds != GSS_C_NO_CREDENTIAL)
 		gss_release_cred(&ms, &(*ctx)->client_creds);
 
-	xfree(*ctx);
+	free(*ctx);
 	*ctx = NULL;
 }
 
@@ -218,7 +218,7 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
 	    &gssbuf, GSS_C_NT_HOSTBASED_SERVICE, &ctx->name)))
 		ssh_gssapi_error(ctx);
 
-	xfree(gssbuf.value);
+	free(gssbuf.value);
 	return (ctx->major);
 }
 
diff --git a/usr.bin/ssh/hostfile.c b/usr.bin/ssh/hostfile.c
index 4f472815a4a..c1b87904a3e 100644
--- a/usr.bin/ssh/hostfile.c
+++ b/usr.bin/ssh/hostfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: hostfile.c,v 1.50 2010/12/04 13:31:37 djm Exp $ */
+/* $OpenBSD: hostfile.c,v 1.51 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -93,7 +93,7 @@ extract_salt(const char *s, u_int l, char *salt, size_t salt_len)
 	b64salt[b64len] = '\0';
 
 	ret = __b64_pton(b64salt, salt, salt_len);
-	xfree(b64salt);
+	free(b64salt);
 	if (ret == -1) {
 		debug2("extract_salt: salt decode error");
 		return (-1);
@@ -324,16 +324,14 @@ free_hostkeys(struct hostkeys *hostkeys)
 	u_int i;
 
 	for (i = 0; i < hostkeys->num_entries; i++) {
-		xfree(hostkeys->entries[i].host);
-		xfree(hostkeys->entries[i].file);
+		free(hostkeys->entries[i].host);
+		free(hostkeys->entries[i].file);
 		key_free(hostkeys->entries[i].key);
 		bzero(hostkeys->entries + i, sizeof(*hostkeys->entries));
 	}
-	if (hostkeys->entries != NULL)
-		xfree(hostkeys->entries);
-	hostkeys->entries = NULL;
-	hostkeys->num_entries = 0;
-	xfree(hostkeys);
+	free(hostkeys->entries);
+	bzero(hostkeys, sizeof(*hostkeys));
+	free(hostkeys);
 }
 
 static int
diff --git a/usr.bin/ssh/jpake.c b/usr.bin/ssh/jpake.c
index ab6715901d4..df07ff0d698 100644
--- a/usr.bin/ssh/jpake.c
+++ b/usr.bin/ssh/jpake.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: jpake.c,v 1.7 2012/06/18 11:43:53 dtucker Exp $ */
+/* $OpenBSD: jpake.c,v 1.8 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
  *
@@ -104,7 +104,7 @@ jpake_free(struct jpake_ctx *pctx)
 	do {					\
 		if ((v) != NULL) {		\
 			bzero((v), (l));	\
-			xfree(v);		\
+			free(v);		\
 			(v) = NULL;		\
 			(l) = 0;		\
 		}				\
@@ -132,7 +132,7 @@ jpake_free(struct jpake_ctx *pctx)
 #undef JPAKE_BUF_CLEAR_FREE
 
 	bzero(pctx, sizeof(*pctx));
-	xfree(pctx);
+	free(pctx);
 }
 
 /* dump entire jpake_ctx. NB. includes private values! */
@@ -443,7 +443,7 @@ jpake_check_confirm(const BIGNUM *k,
 	    expected_confirm_hash_len) == 0)
 		success = 1;
 	bzero(expected_confirm_hash, expected_confirm_hash_len);
-	xfree(expected_confirm_hash);
+	free(expected_confirm_hash);
 	debug3("%s: success = %d", __func__, success);
 	return success;
 }
diff --git a/usr.bin/ssh/kex.c b/usr.bin/ssh/kex.c
index fbea006433f..bc1d6f9ba61 100644
--- a/usr.bin/ssh/kex.c
+++ b/usr.bin/ssh/kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.90 2013/04/19 12:07:08 djm Exp $ */
+/* $OpenBSD: kex.c,v 1.91 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  *
@@ -111,12 +111,12 @@ kex_names_valid(const char *names)
 	    (p = strsep(&cp, ","))) {
 		if (kex_alg_by_name(p) == NULL) {
 			error("Unsupported KEX algorithm \"%.100s\"", p);
-			xfree(s);
+			free(s);
 			return 0;
 		}
 	}
 	debug3("kex names ok: [%s]", names);
-	xfree(s);
+	free(s);
 	return 1;
 }
 
@@ -176,8 +176,8 @@ kex_prop_free(char **proposal)
 	u_int i;
 
 	for (i = 0; i < PROPOSAL_MAX; i++)
-		xfree(proposal[i]);
-	xfree(proposal);
+		free(proposal[i]);
+	free(proposal);
 }
 
 /* ARGSUSED */
@@ -214,7 +214,7 @@ kex_finish(Kex *kex)
 	buffer_clear(&kex->peer);
 	/* buffer_clear(&kex->my); */
 	kex->flags &= ~KEX_INIT_SENT;
-	xfree(kex->name);
+	free(kex->name);
 	kex->name = NULL;
 }
 
@@ -271,7 +271,7 @@ kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
 	for (i = 0; i < KEX_COOKIE_LEN; i++)
 		packet_get_char();
 	for (i = 0; i < PROPOSAL_MAX; i++)
-		xfree(packet_get_string(NULL));
+		free(packet_get_string(NULL));
 	/*
 	 * XXX RFC4253 sec 7: "each side MAY guess" - currently no supported
 	 * KEX method has the server move first, but a server might be using
@@ -399,7 +399,7 @@ choose_hostkeyalg(Kex *k, char *client, char *server)
 	k->hostkey_type = key_type_from_name(hostkeyalg);
 	if (k->hostkey_type == KEY_UNSPEC)
 		fatal("bad hostkey alg '%s'", hostkeyalg);
-	xfree(hostkeyalg);
+	free(hostkeyalg);
 }
 
 static int
@@ -453,7 +453,7 @@ kex_choose_conf(Kex *kex)
 		roaming = match_list(KEX_RESUME, peer[PROPOSAL_KEX_ALGS], NULL);
 		if (roaming) {
 			kex->roaming = 1;
-			xfree(roaming);
+			free(roaming);
 		}
 	}
 
diff --git a/usr.bin/ssh/kexdhc.c b/usr.bin/ssh/kexdhc.c
index 759a9e43d42..312302c2264 100644
--- a/usr.bin/ssh/kexdhc.c
+++ b/usr.bin/ssh/kexdhc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexdhc.c,v 1.12 2010/11/10 01:33:07 djm Exp $ */
+/* $OpenBSD: kexdhc.c,v 1.13 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  *
@@ -122,7 +122,7 @@ kexdh_client(Kex *kex)
 	if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
 		fatal("kexdh_client: BN_bin2bn failed");
 	memset(kbuf, 0, klen);
-	xfree(kbuf);
+	free(kbuf);
 
 	/* calc and verify H */
 	kex_dh_hash(
@@ -136,14 +136,14 @@ kexdh_client(Kex *kex)
 	    shared_secret,
 	    &hash, &hashlen
 	);
-	xfree(server_host_key_blob);
+	free(server_host_key_blob);
 	BN_clear_free(dh_server_pub);
 	DH_free(dh);
 
 	if (key_verify(server_host_key, signature, slen, hash, hashlen) != 1)
 		fatal("key_verify failed for server_host_key");
 	key_free(server_host_key);
-	xfree(signature);
+	free(signature);
 
 	/* save session id */
 	if (kex->session_id == NULL) {
diff --git a/usr.bin/ssh/kexdhs.c b/usr.bin/ssh/kexdhs.c
index 7fc426dff75..abbd54465bc 100644
--- a/usr.bin/ssh/kexdhs.c
+++ b/usr.bin/ssh/kexdhs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexdhs.c,v 1.12 2010/11/10 01:33:07 djm Exp $ */
+/* $OpenBSD: kexdhs.c,v 1.13 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  *
@@ -115,7 +115,7 @@ kexdh_server(Kex *kex)
 	if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
 		fatal("kexdh_server: BN_bin2bn failed");
 	memset(kbuf, 0, klen);
-	xfree(kbuf);
+	free(kbuf);
 
 	key_to_blob(server_host_public, &server_host_key_blob, &sbloblen);
 
@@ -154,8 +154,8 @@ kexdh_server(Kex *kex)
 	packet_put_string(signature, slen);
 	packet_send();
 
-	xfree(signature);
-	xfree(server_host_key_blob);
+	free(signature);
+	free(server_host_key_blob);
 	/* have keys, free DH */
 	DH_free(dh);
 
diff --git a/usr.bin/ssh/kexecdhc.c b/usr.bin/ssh/kexecdhc.c
index cb409d6c9d2..977b9aa1537 100644
--- a/usr.bin/ssh/kexecdhc.c
+++ b/usr.bin/ssh/kexecdhc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexecdhc.c,v 1.3 2013/04/19 01:06:50 djm Exp $ */
+/* $OpenBSD: kexecdhc.c,v 1.4 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -116,7 +116,7 @@ kexecdh_client(Kex *kex)
 	if (BN_bin2bn(kbuf, klen, shared_secret) == NULL)
 		fatal("%s: BN_bin2bn failed", __func__);
 	memset(kbuf, 0, klen);
-	xfree(kbuf);
+	free(kbuf);
 
 	/* calc and verify H */
 	kex_ecdh_hash(
@@ -132,14 +132,14 @@ kexecdh_client(Kex *kex)
 	    shared_secret,
 	    &hash, &hashlen
 	);
-	xfree(server_host_key_blob);
+	free(server_host_key_blob);
 	EC_POINT_clear_free(server_public);
 	EC_KEY_free(client_key);
 
 	if (key_verify(server_host_key, signature, slen, hash, hashlen) != 1)
 		fatal("key_verify failed for server_host_key");
 	key_free(server_host_key);
-	xfree(signature);
+	free(signature);
 
 	/* save session id */
 	if (kex->session_id == NULL) {
diff --git a/usr.bin/ssh/kexecdhs.c b/usr.bin/ssh/kexecdhs.c
index a624cd01eec..5a3307e5152 100644
--- a/usr.bin/ssh/kexecdhs.c
+++ b/usr.bin/ssh/kexecdhs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexecdhs.c,v 1.3 2013/04/19 01:06:50 djm Exp $ */
+/* $OpenBSD: kexecdhs.c,v 1.4 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -108,7 +108,7 @@ kexecdh_server(Kex *kex)
 	if (BN_bin2bn(kbuf, klen, shared_secret) == NULL)
 		fatal("%s: BN_bin2bn failed", __func__);
 	memset(kbuf, 0, klen);
-	xfree(kbuf);
+	free(kbuf);
 
 	/* calc H */
 	key_to_blob(server_host_public, &server_host_key_blob, &sbloblen);
@@ -148,8 +148,8 @@ kexecdh_server(Kex *kex)
 	packet_put_string(signature, slen);
 	packet_send();
 
-	xfree(signature);
-	xfree(server_host_key_blob);
+	free(signature);
+	free(server_host_key_blob);
 	/* have keys, free server key */
 	EC_KEY_free(server_key);
 
diff --git a/usr.bin/ssh/kexgexc.c b/usr.bin/ssh/kexgexc.c
index a761a2cb389..b988d30e54c 100644
--- a/usr.bin/ssh/kexgexc.c
+++ b/usr.bin/ssh/kexgexc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexgexc.c,v 1.12 2010/11/10 01:33:07 djm Exp $ */
+/* $OpenBSD: kexgexc.c,v 1.13 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2000 Niels Provos.  All rights reserved.
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -160,7 +160,7 @@ kexgex_client(Kex *kex)
 	if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
 		fatal("kexgex_client: BN_bin2bn failed");
 	memset(kbuf, 0, klen);
-	xfree(kbuf);
+	free(kbuf);
 
 	if (datafellows & SSH_OLD_DHGEX)
 		min = max = -1;
@@ -183,13 +183,13 @@ kexgex_client(Kex *kex)
 
 	/* have keys, free DH */
 	DH_free(dh);
-	xfree(server_host_key_blob);
+	free(server_host_key_blob);
 	BN_clear_free(dh_server_pub);
 
 	if (key_verify(server_host_key, signature, slen, hash, hashlen) != 1)
 		fatal("key_verify failed for server_host_key");
 	key_free(server_host_key);
-	xfree(signature);
+	free(signature);
 
 	/* save session id */
 	if (kex->session_id == NULL) {
diff --git a/usr.bin/ssh/kexgexs.c b/usr.bin/ssh/kexgexs.c
index 0b90986fb19..cabe3b5c813 100644
--- a/usr.bin/ssh/kexgexs.c
+++ b/usr.bin/ssh/kexgexs.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexgexs.c,v 1.14 2010/11/10 01:33:07 djm Exp $ */
+/* $OpenBSD: kexgexs.c,v 1.15 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2000 Niels Provos.  All rights reserved.
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
@@ -152,7 +152,7 @@ kexgex_server(Kex *kex)
 	if (BN_bin2bn(kbuf, kout, shared_secret) == NULL)
 		fatal("kexgex_server: BN_bin2bn failed");
 	memset(kbuf, 0, klen);
-	xfree(kbuf);
+	free(kbuf);
 
 	key_to_blob(server_host_public, &server_host_key_blob, &sbloblen);
 
@@ -198,8 +198,8 @@ kexgex_server(Kex *kex)
 	packet_put_string(signature, slen);
 	packet_send();
 
-	xfree(signature);
-	xfree(server_host_key_blob);
+	free(signature);
+	free(server_host_key_blob);
 	/* have keys, free DH */
 	DH_free(dh);
 
diff --git a/usr.bin/ssh/key.c b/usr.bin/ssh/key.c
index bcb3152094d..a313096dd97 100644
--- a/usr.bin/ssh/key.c
+++ b/usr.bin/ssh/key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.c,v 1.102 2013/05/10 04:08:01 djm Exp $ */
+/* $OpenBSD: key.c,v 1.103 2013/05/17 00:13:13 djm Exp $ */
 /*
  * read_bignum():
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -181,15 +181,13 @@ cert_free(struct KeyCert *cert)
 	buffer_free(&cert->certblob);
 	buffer_free(&cert->critical);
 	buffer_free(&cert->extensions);
-	if (cert->key_id != NULL)
-		xfree(cert->key_id);
+	free(cert->key_id);
 	for (i = 0; i < cert->nprincipals; i++)
-		xfree(cert->principals[i]);
-	if (cert->principals != NULL)
-		xfree(cert->principals);
+		free(cert->principals[i]);
+	free(cert->principals);
 	if (cert->signature_key != NULL)
 		key_free(cert->signature_key);
-	xfree(cert);
+	free(cert);
 }
 
 void
@@ -231,7 +229,7 @@ key_free(Key *k)
 		k->cert = NULL;
 	}
 
-	xfree(k);
+	free(k);
 }
 
 static int
@@ -375,7 +373,7 @@ key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
 		EVP_DigestUpdate(&ctx, blob, len);
 		EVP_DigestFinal(&ctx, retval, dgst_raw_length);
 		memset(blob, 0, len);
-		xfree(blob);
+		free(blob);
 	} else {
 		fatal("key_fingerprint_raw: blob is null");
 	}
@@ -582,7 +580,7 @@ key_fingerprint(Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep)
 		break;
 	}
 	memset(dgst_raw, 0, dgst_raw_len);
-	xfree(dgst_raw);
+	free(dgst_raw);
 	return retval;
 }
 
@@ -722,11 +720,11 @@ key_read(Key *ret, char **cpp)
 		n = uudecode(cp, blob, len);
 		if (n < 0) {
 			error("key_read: uudecode %s failed", cp);
-			xfree(blob);
+			free(blob);
 			return -1;
 		}
 		k = key_from_blob(blob, (u_int)n);
-		xfree(blob);
+		free(blob);
 		if (k == NULL) {
 			error("key_read: key_from_blob %s failed", cp);
 			return -1;
@@ -861,8 +859,8 @@ key_write(const Key *key, FILE *f)
 		fprintf(f, "%s %s", key_ssh_name(key), uu);
 		success = 1;
 	}
-	xfree(blob);
-	xfree(uu);
+	free(blob);
+	free(uu);
 
 	return success;
 }
@@ -1253,12 +1251,12 @@ key_names_valid2(const char *names)
 		switch (key_type_from_name(p)) {
 		case KEY_RSA1:
 		case KEY_UNSPEC:
-			xfree(s);
+			free(s);
 			return 0;
 		}
 	}
 	debug3("key names ok: [%s]", names);
-	xfree(s);
+	free(s);
 	return 1;
 }
 
@@ -1380,16 +1378,11 @@ cert_parse(Buffer *b, Key *key, const u_char *blob, u_int blen)
 
  out:
 	buffer_free(&tmp);
-	if (principals != NULL)
-		xfree(principals);
-	if (critical != NULL)
-		xfree(critical);
-	if (exts != NULL)
-		xfree(exts);
-	if (sig_key != NULL)
-		xfree(sig_key);
-	if (sig != NULL)
-		xfree(sig);
+	free(principals);
+	free(critical);
+	free(exts);
+	free(sig_key);
+	free(sig);
 	return ret;
 }
 
@@ -1502,10 +1495,8 @@ key_from_blob(const u_char *blob, u_int blen)
 	if (key != NULL && rlen != 0)
 		error("key_from_blob: remaining bytes in key blob %d", rlen);
  out:
-	if (ktype != NULL)
-		xfree(ktype);
-	if (curve != NULL)
-		xfree(curve);
+	free(ktype);
+	free(curve);
 	if (q != NULL)
 		EC_POINT_free(q);
 	buffer_free(&b);
@@ -1843,7 +1834,7 @@ key_certify(Key *k, Key *ca)
 	default:
 		error("%s: key has incorrect type %s", __func__, key_type(k));
 		buffer_clear(&k->cert->certblob);
-		xfree(ca_blob);
+		free(ca_blob);
 		return -1;
 	}
 
@@ -1879,7 +1870,7 @@ key_certify(Key *k, Key *ca)
 
 	buffer_put_string(&k->cert->certblob, NULL, 0); /* reserved */
 	buffer_put_string(&k->cert->certblob, ca_blob, ca_len);
-	xfree(ca_blob);
+	free(ca_blob);
 
 	/* Sign the whole mess */
 	if (key_sign(ca, &sig_blob, &sig_len, buffer_ptr(&k->cert->certblob),
@@ -1890,7 +1881,7 @@ key_certify(Key *k, Key *ca)
 	}
 	/* Append signature and we are done */
 	buffer_put_string(&k->cert->certblob, sig_blob, sig_len);
-	xfree(sig_blob);
+	free(sig_blob);
 
 	return 0;
 }
diff --git a/usr.bin/ssh/mac.c b/usr.bin/ssh/mac.c
index 111afe08b96..eddf8fe1510 100644
--- a/usr.bin/ssh/mac.c
+++ b/usr.bin/ssh/mac.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mac.c,v 1.22 2013/04/19 01:06:50 djm Exp $ */
+/* $OpenBSD: mac.c,v 1.23 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  *
@@ -226,13 +226,13 @@ mac_valid(const char *names)
 	    (p = strsep(&cp, MAC_SEP))) {
 		if (mac_setup(NULL, p) < 0) {
 			debug("bad mac %s [%s]", p, names);
-			xfree(maclist);
+			free(maclist);
 			return (0);
 		} else {
 			debug3("mac ok: %s [%s]", p, names);
 		}
 	}
 	debug3("macs ok: [%s]", names);
-	xfree(maclist);
+	free(maclist);
 	return (1);
 }
diff --git a/usr.bin/ssh/match.c b/usr.bin/ssh/match.c
index 499f7475790..462e0e00ce9 100644
--- a/usr.bin/ssh/match.c
+++ b/usr.bin/ssh/match.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: match.c,v 1.27 2008/06/10 23:06:19 djm Exp $ */
+/* $OpenBSD: match.c,v 1.28 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -38,6 +38,7 @@
 #include <sys/types.h>
 
 #include <ctype.h>
+#include <stdlib.h>
 #include <string.h>
 
 #include "xmalloc.h"
@@ -224,14 +225,14 @@ match_user(const char *user, const char *host, const char *ipaddr,
 
 	if ((ret = match_pattern(user, pat)) == 1)
 		ret = match_host_and_ip(host, ipaddr, p);
-	xfree(pat);
+	free(pat);
 
 	return ret;
 }
 
 /*
  * Returns first item from client-list that is also supported by server-list,
- * caller must xfree() returned string.
+ * caller must free the returned string.
  */
 #define	MAX_PROP	40
 #define	SEP	","
@@ -262,15 +263,15 @@ match_list(const char *client, const char *server, u_int *next)
 				if (next != NULL)
 					*next = (cp == NULL) ?
 					    strlen(c) : (u_int)(cp - c);
-				xfree(c);
-				xfree(s);
+				free(c);
+				free(s);
 				return ret;
 			}
 		}
 	}
 	if (next != NULL)
 		*next = strlen(c);
-	xfree(c);
-	xfree(s);
+	free(c);
+	free(s);
 	return NULL;
 }
diff --git a/usr.bin/ssh/misc.c b/usr.bin/ssh/misc.c
index 02b9aa33453..e7a2c0c3cc2 100644
--- a/usr.bin/ssh/misc.c
+++ b/usr.bin/ssh/misc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: misc.c,v 1.88 2013/04/24 16:01:46 tedu Exp $ */
+/* $OpenBSD: misc.c,v 1.89 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2005,2006 Damien Miller.  All rights reserved.
@@ -237,13 +237,13 @@ a2tun(const char *s, int *remote)
 		*remote = SSH_TUNID_ANY;
 		sp = xstrdup(s);
 		if ((ep = strchr(sp, ':')) == NULL) {
-			xfree(sp);
+			free(sp);
 			return (a2tun(s, NULL));
 		}
 		ep[0] = '\0'; ep++;
 		*remote = a2tun(ep, NULL);
 		tun = a2tun(sp, NULL);
-		xfree(sp);
+		free(sp);
 		return (*remote == SSH_TUNID_ERR ? *remote : tun);
 	}
 
@@ -476,7 +476,7 @@ replacearg(arglist *args, u_int which, char *fmt, ...)
 	if (which >= args->num)
 		fatal("replacearg: tried to replace invalid arg %d >= %d",
 		    which, args->num);
-	xfree(args->list[which]);
+	free(args->list[which]);
 	args->list[which] = cp;
 }
 
@@ -487,8 +487,8 @@ freeargs(arglist *args)
 
 	if (args->list != NULL) {
 		for (i = 0; i < args->num; i++)
-			xfree(args->list[i]);
-		xfree(args->list);
+			free(args->list[i]);
+		free(args->list);
 		args->nalloc = args->num = 0;
 		args->list = NULL;
 	}
diff --git a/usr.bin/ssh/moduli.c b/usr.bin/ssh/moduli.c
index bc9a61031ca..f622d944513 100644
--- a/usr.bin/ssh/moduli.c
+++ b/usr.bin/ssh/moduli.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: moduli.c,v 1.26 2012/07/06 00:41:59 dtucker Exp $ */
+/* $OpenBSD: moduli.c,v 1.27 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright 1994 Phil Karn <karn@qualcomm.com>
  * Copyright 1996-1998, 2003 William Allen Simpson <wsimpson@greendragon.com>
@@ -429,9 +429,9 @@ gen_candidates(FILE *out, u_int32_t memory, u_int32_t power, BIGNUM *start)
 
 	time(&time_stop);
 
-	xfree(LargeSieve);
-	xfree(SmallSieve);
-	xfree(TinySieve);
+	free(LargeSieve);
+	free(SmallSieve);
+	free(TinySieve);
 
 	logit("%.24s Found %u candidates", ctime(&time_stop), r);
 
@@ -705,7 +705,7 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted,
 	}
 
 	time(&time_stop);
-	xfree(lp);
+	free(lp);
 	BN_free(p);
 	BN_free(q);
 	BN_CTX_free(ctx);
diff --git a/usr.bin/ssh/monitor.c b/usr.bin/ssh/monitor.c
index e537d9d5abf..ccdd7f4bfeb 100644
--- a/usr.bin/ssh/monitor.c
+++ b/usr.bin/ssh/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.123 2013/05/16 04:09:13 dtucker Exp $ */
+/* $OpenBSD: monitor.c,v 1.124 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -459,7 +459,7 @@ monitor_read_log(struct monitor *pmonitor)
 	do_log2(level, "%s [preauth]", msg);
 
 	buffer_free(&logmsg);
-	xfree(msg);
+	free(msg);
 
 	return 0;
 }
@@ -550,12 +550,9 @@ static void
 monitor_reset_key_state(void)
 {
 	/* reset state */
-	if (key_blob != NULL)
-		xfree(key_blob);
-	if (hostbased_cuser != NULL)
-		xfree(hostbased_cuser);
-	if (hostbased_chost != NULL)
-		xfree(hostbased_chost);
+	free(key_blob);
+	free(hostbased_cuser);
+	free(hostbased_chost);
 	key_blob = NULL;
 	key_bloblen = 0;
 	key_blobtype = MM_NOKEY;
@@ -636,8 +633,8 @@ mm_answer_sign(int sock, Buffer *m)
 	buffer_clear(m);
 	buffer_put_string(m, signature, siglen);
 
-	xfree(p);
-	xfree(signature);
+	free(p);
+	free(signature);
 
 	mm_request_send(sock, MONITOR_ANS_SIGN, m);
 
@@ -668,7 +665,7 @@ mm_answer_pwnamallow(int sock, Buffer *m)
 
 	authctxt->user = xstrdup(username);
 	setproctitle("%s [priv]", pwent ? username : "unknown");
-	xfree(username);
+	free(username);
 
 	buffer_clear(m);
 
@@ -740,9 +737,7 @@ int mm_answer_auth2_read_banner(int sock, Buffer *m)
 	banner = auth2_read_banner();
 	buffer_put_cstring(m, banner != NULL ? banner : "");
 	mm_request_send(sock, MONITOR_ANS_AUTH2_READ_BANNER, m);
-
-	if (banner != NULL)
-		xfree(banner);
+	free(banner);
 
 	return (0);
 }
@@ -758,7 +753,7 @@ mm_answer_authserv(int sock, Buffer *m)
 	    __func__, authctxt->service, authctxt->style);
 
 	if (strlen(authctxt->style) == 0) {
-		xfree(authctxt->style);
+		free(authctxt->style);
 		authctxt->style = NULL;
 	}
 
@@ -778,7 +773,7 @@ mm_answer_authpassword(int sock, Buffer *m)
 	authenticated = options.password_authentication &&
 	    auth_password(authctxt, passwd);
 	memset(passwd, 0, strlen(passwd));
-	xfree(passwd);
+	free(passwd);
 
 	buffer_clear(m);
 	buffer_put_int(m, authenticated);
@@ -817,10 +812,10 @@ mm_answer_bsdauthquery(int sock, Buffer *m)
 	mm_request_send(sock, MONITOR_ANS_BSDAUTHQUERY, m);
 
 	if (success) {
-		xfree(name);
-		xfree(infotxt);
-		xfree(prompts);
-		xfree(echo_on);
+		free(name);
+		free(infotxt);
+		free(prompts);
+		free(echo_on);
 	}
 
 	return (0);
@@ -840,7 +835,7 @@ mm_answer_bsdauthrespond(int sock, Buffer *m)
 	    auth_userresponse(authctxt->as, response, 0);
 	authctxt->as = NULL;
 	debug3("%s: <%s> = <%d>", __func__, response, authok);
-	xfree(response);
+	free(response);
 
 	buffer_clear(m);
 	buffer_put_int(m, authok);
@@ -928,9 +923,9 @@ mm_answer_keyallowed(int sock, Buffer *m)
 		/* Log failed attempt */
 		auth_log(authctxt, 0, 0, auth_method, NULL,
 		    compat20 ? " ssh2" : "");
-		xfree(blob);
-		xfree(cuser);
-		xfree(chost);
+		free(blob);
+		free(cuser);
+		free(chost);
 	}
 
 	debug3("%s: key %p is %s",
@@ -973,7 +968,7 @@ monitor_valid_userblob(u_char *data, u_int datalen)
 		    (len != session_id2_len) ||
 		    (timingsafe_bcmp(p, session_id2, session_id2_len) != 0))
 			fail++;
-		xfree(p);
+		free(p);
 	}
 	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
 		fail++;
@@ -986,8 +981,8 @@ monitor_valid_userblob(u_char *data, u_int datalen)
 		    userstyle, p);
 		fail++;
 	}
-	xfree(userstyle);
-	xfree(p);
+	free(userstyle);
+	free(p);
 	buffer_skip_string(&b);
 	if (datafellows & SSH_BUG_PKAUTH) {
 		if (!buffer_get_char(&b))
@@ -996,7 +991,7 @@ monitor_valid_userblob(u_char *data, u_int datalen)
 		p = buffer_get_cstring(&b, NULL);
 		if (strcmp("publickey", p) != 0)
 			fail++;
-		xfree(p);
+		free(p);
 		if (!buffer_get_char(&b))
 			fail++;
 		buffer_skip_string(&b);
@@ -1025,7 +1020,7 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser,
 	    (len != session_id2_len) ||
 	    (timingsafe_bcmp(p, session_id2, session_id2_len) != 0))
 		fail++;
-	xfree(p);
+	free(p);
 
 	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
 		fail++;
@@ -1039,12 +1034,12 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser,
 		fail++;
 	}
 	free(userstyle);
-	xfree(p);
+	free(p);
 	buffer_skip_string(&b);	/* service */
 	p = buffer_get_cstring(&b, NULL);
 	if (strcmp(p, "hostbased") != 0)
 		fail++;
-	xfree(p);
+	free(p);
 	buffer_skip_string(&b);	/* pkalg */
 	buffer_skip_string(&b);	/* pkblob */
 
@@ -1054,13 +1049,13 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser,
 		p[len - 1] = '\0';
 	if (strcmp(p, chost) != 0)
 		fail++;
-	xfree(p);
+	free(p);
 
 	/* verify client user */
 	p = buffer_get_string(&b, NULL);
 	if (strcmp(p, cuser) != 0)
 		fail++;
-	xfree(p);
+	free(p);
 
 	if (buffer_len(&b) != 0)
 		fail++;
@@ -1109,9 +1104,9 @@ mm_answer_keyverify(int sock, Buffer *m)
 	    __func__, key, (verified == 1) ? "verified" : "unverified");
 
 	key_free(key);
-	xfree(blob);
-	xfree(signature);
-	xfree(data);
+	free(blob);
+	free(signature);
+	free(data);
 
 	auth_method = key_blobtype == MM_USERKEY ? "publickey" : "hostbased";
 
@@ -1239,7 +1234,7 @@ mm_answer_pty_cleanup(int sock, Buffer *m)
 	if ((s = session_by_tty(tty)) != NULL)
 		mm_session_close(s);
 	buffer_clear(m);
-	xfree(tty);
+	free(tty);
 	return (0);
 }
 
@@ -1371,7 +1366,7 @@ mm_answer_rsa_challenge(int sock, Buffer *m)
 
 	monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 1);
 
-	xfree(blob);
+	free(blob);
 	key_free(key);
 	return (0);
 }
@@ -1403,9 +1398,9 @@ mm_answer_rsa_response(int sock, Buffer *m)
 		fatal("%s: received bad response to challenge", __func__);
 	success = auth_rsa_verify_response(key, ssh1_challenge, response);
 
-	xfree(blob);
+	free(blob);
 	key_free(key);
-	xfree(response);
+	free(response);
 
 	auth_method = key_blobtype == MM_RSAUSERKEY ? "rsa" : "rhosts-rsa";
 
@@ -1452,20 +1447,20 @@ monitor_apply_keystate(struct monitor *pmonitor)
 		packet_set_protocol_flags(child_state.ssh1protoflags);
 		packet_set_encryption_key(child_state.ssh1key,
 		    child_state.ssh1keylen, child_state.ssh1cipher);
-		xfree(child_state.ssh1key);
+		free(child_state.ssh1key);
 	}
 
 	/* for rc4 and other stateful ciphers */
 	packet_set_keycontext(MODE_OUT, child_state.keyout);
-	xfree(child_state.keyout);
+	free(child_state.keyout);
 	packet_set_keycontext(MODE_IN, child_state.keyin);
-	xfree(child_state.keyin);
+	free(child_state.keyin);
 
 	if (!compat20) {
 		packet_set_iv(MODE_OUT, child_state.ivout);
-		xfree(child_state.ivout);
+		free(child_state.ivout);
 		packet_set_iv(MODE_IN, child_state.ivin);
-		xfree(child_state.ivin);
+		free(child_state.ivin);
 	}
 
 	memcpy(&incoming_stream, &child_state.incoming,
@@ -1486,13 +1481,13 @@ monitor_apply_keystate(struct monitor *pmonitor)
 	buffer_clear(packet_get_input());
 	buffer_append(packet_get_input(), child_state.input, child_state.ilen);
 	memset(child_state.input, 0, child_state.ilen);
-	xfree(child_state.input);
+	free(child_state.input);
 
 	buffer_clear(packet_get_output());
 	buffer_append(packet_get_output(), child_state.output,
 		      child_state.olen);
 	memset(child_state.output, 0, child_state.olen);
-	xfree(child_state.output);
+	free(child_state.output);
 
 	/* Roaming */
 	if (compat20)
@@ -1524,11 +1519,11 @@ mm_get_kex(Buffer *m)
 	blob = buffer_get_string(m, &bloblen);
 	buffer_init(&kex->my);
 	buffer_append(&kex->my, blob, bloblen);
-	xfree(blob);
+	free(blob);
 	blob = buffer_get_string(m, &bloblen);
 	buffer_init(&kex->peer);
 	buffer_append(&kex->peer, blob, bloblen);
-	xfree(blob);
+	free(blob);
 	kex->done = 1;
 	kex->flags = buffer_get_int(m);
 	kex->client_version_string = buffer_get_string(m, NULL);
@@ -1571,12 +1566,12 @@ mm_get_keystate(struct monitor *pmonitor)
 
 	blob = buffer_get_string(&m, &bloblen);
 	current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen);
-	xfree(blob);
+	free(blob);
 
 	debug3("%s: Waiting for second key", __func__);
 	blob = buffer_get_string(&m, &bloblen);
 	current_keys[MODE_IN] = mm_newkeys_from_blob(blob, bloblen);
-	xfree(blob);
+	free(blob);
 
 	/* Now get sequence numbers for the packets */
 	seqnr = buffer_get_int(&m);
@@ -1601,13 +1596,13 @@ mm_get_keystate(struct monitor *pmonitor)
 	if (plen != sizeof(child_state.outgoing))
 		fatal("%s: bad request size", __func__);
 	memcpy(&child_state.outgoing, p, sizeof(child_state.outgoing));
-	xfree(p);
+	free(p);
 
 	p = buffer_get_string(&m, &plen);
 	if (plen != sizeof(child_state.incoming))
 		fatal("%s: bad request size", __func__);
 	memcpy(&child_state.incoming, p, sizeof(child_state.incoming));
-	xfree(p);
+	free(p);
 
 	/* Network I/O buffers */
 	debug3("%s: Getting Network I/O buffers", __func__);
@@ -1729,7 +1724,7 @@ mm_answer_gss_setup_ctx(int sock, Buffer *m)
 
 	major = ssh_gssapi_server_ctx(&gsscontext, &goid);
 
-	xfree(goid.elements);
+	free(goid.elements);
 
 	buffer_clear(m);
 	buffer_put_int(m, major);
@@ -1754,7 +1749,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
 	in.value = buffer_get_string(m, &len);
 	in.length = len;
 	major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
-	xfree(in.value);
+	free(in.value);
 
 	buffer_clear(m);
 	buffer_put_int(m, major);
@@ -1786,8 +1781,8 @@ mm_answer_gss_checkmic(int sock, Buffer *m)
 
 	ret = ssh_gssapi_checkmic(gsscontext, &gssbuf, &mic);
 
-	xfree(gssbuf.value);
-	xfree(mic.value);
+	free(gssbuf.value);
+	free(mic.value);
 
 	buffer_clear(m);
 	buffer_put_int(m, ret);
@@ -1857,8 +1852,8 @@ mm_answer_jpake_step1(int sock, Buffer *m)
 
 	bzero(x3_proof, x3_proof_len);
 	bzero(x4_proof, x4_proof_len);
-	xfree(x3_proof);
-	xfree(x4_proof);
+	free(x3_proof);
+	free(x4_proof);
 
 	monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_GET_PWDATA, 1);
 	monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_STEP1, 0);
@@ -1887,8 +1882,8 @@ mm_answer_jpake_get_pwdata(int sock, Buffer *m)
 
 	bzero(hash_scheme, strlen(hash_scheme));
 	bzero(salt, strlen(salt));
-	xfree(hash_scheme);
-	xfree(salt);
+	free(hash_scheme);
+	free(salt);
 
 	monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_STEP2, 1);
 
@@ -1927,8 +1922,8 @@ mm_answer_jpake_step2(int sock, Buffer *m)
 
 	bzero(x1_proof, x1_proof_len);
 	bzero(x2_proof, x2_proof_len);
-	xfree(x1_proof);
-	xfree(x2_proof);
+	free(x1_proof);
+	free(x2_proof);
 
 	buffer_clear(m);
 
@@ -1939,7 +1934,7 @@ mm_answer_jpake_step2(int sock, Buffer *m)
 	mm_request_send(sock, MONITOR_ANS_JPAKE_STEP2, m);
 
 	bzero(x4_s_proof, x4_s_proof_len);
-	xfree(x4_s_proof);
+	free(x4_s_proof);
 
 	monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_KEY_CONFIRM, 1);
 
@@ -2007,7 +2002,7 @@ mm_answer_jpake_check_confirm(int sock, Buffer *m)
 	JPAKE_DEBUG_CTX((pctx, "check_confirm done in %s", __func__));
 
 	bzero(peer_confirm_hash, peer_confirm_hash_len);
-	xfree(peer_confirm_hash);
+	free(peer_confirm_hash);
 
 	buffer_clear(m);
 	buffer_put_int(m, authenticated);
diff --git a/usr.bin/ssh/monitor_mm.c b/usr.bin/ssh/monitor_mm.c
index 183eeaeea09..147a3360839 100644
--- a/usr.bin/ssh/monitor_mm.c
+++ b/usr.bin/ssh/monitor_mm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_mm.c,v 1.16 2009/06/22 05:39:28 dtucker Exp $ */
+/* $OpenBSD: monitor_mm.c,v 1.17 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * All rights reserved.
@@ -31,6 +31,7 @@
 
 #include <errno.h>
 #include <stdarg.h>
+#include <stdlib.h>
 #include <string.h>
 
 #include "xmalloc.h"
@@ -121,7 +122,7 @@ mm_freelist(struct mm_master *mmalloc, struct mmtree *head)
 		next = RB_NEXT(mmtree, head, mms);
 		RB_REMOVE(mmtree, head, mms);
 		if (mmalloc == NULL)
-			xfree(mms);
+			free(mms);
 		else
 			mm_free(mmalloc, mms);
 	}
@@ -139,7 +140,7 @@ mm_destroy(struct mm_master *mm)
 		fatal("munmap(%p, %lu): %s", mm->address, (u_long)mm->size,
 		    strerror(errno));
 	if (mm->mmalloc == NULL)
-		xfree(mm);
+		free(mm);
 	else
 		mm_free(mm->mmalloc, mm);
 }
@@ -190,7 +191,7 @@ mm_malloc(struct mm_master *mm, size_t size)
 	if (mms->size == 0) {
 		RB_REMOVE(mmtree, &mm->rb_free, mms);
 		if (mm->mmalloc == NULL)
-			xfree(mms);
+			free(mms);
 		else
 			mm_free(mm->mmalloc, mms);
 	}
@@ -246,7 +247,7 @@ mm_free(struct mm_master *mm, void *address)
 		prev->size += mms->size;
 		RB_REMOVE(mmtree, &mm->rb_free, mms);
 		if (mm->mmalloc == NULL)
-			xfree(mms);
+			free(mms);
 		else
 			mm_free(mm->mmalloc, mms);
 	} else
@@ -270,7 +271,7 @@ mm_free(struct mm_master *mm, void *address)
 	RB_REMOVE(mmtree, &mm->rb_free, mms);
 
 	if (mm->mmalloc == NULL)
-		xfree(mms);
+		free(mms);
 	else
 		mm_free(mm->mmalloc, mms);
 }
diff --git a/usr.bin/ssh/monitor_wrap.c b/usr.bin/ssh/monitor_wrap.c
index 031284844b2..e78ceeb912c 100644
--- a/usr.bin/ssh/monitor_wrap.c
+++ b/usr.bin/ssh/monitor_wrap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.75 2013/01/08 18:49:04 markus Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.76 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -275,7 +275,7 @@ out:
 #undef M_CP_STRARRAYOPT
 
 	copy_set_server_options(&options, newopts, 1);
-	xfree(newopts);
+	free(newopts);
 
 	buffer_free(&m);
 
@@ -301,7 +301,7 @@ mm_auth2_read_banner(void)
 
 	/* treat empty banner as missing banner */
 	if (strlen(banner) == 0) {
-		xfree(banner);
+		free(banner);
 		banner = NULL;
 	}
 	return (banner);
@@ -394,7 +394,7 @@ mm_key_allowed(enum mm_keytype type, char *user, char *host, Key *key)
 	buffer_put_cstring(&m, user ? user : "");
 	buffer_put_cstring(&m, host ? host : "");
 	buffer_put_string(&m, blob, len);
-	xfree(blob);
+	free(blob);
 
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYALLOWED, &m);
 
@@ -437,7 +437,7 @@ mm_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
 	buffer_put_string(&m, blob, len);
 	buffer_put_string(&m, sig, siglen);
 	buffer_put_string(&m, data, datalen);
-	xfree(blob);
+	free(blob);
 
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYVERIFY, &m);
 
@@ -606,7 +606,7 @@ mm_send_keystate(struct monitor *monitor)
 		keylen = packet_get_encryption_key(key);
 		buffer_put_string(&m, key, keylen);
 		memset(key, 0, keylen);
-		xfree(key);
+		free(key);
 
 		ivlen = packet_get_keyiv_len(MODE_OUT);
 		packet_get_keyiv(MODE_OUT, iv, ivlen);
@@ -629,13 +629,13 @@ mm_send_keystate(struct monitor *monitor)
 		fatal("%s: conversion of newkeys failed", __func__);
 
 	buffer_put_string(&m, blob, bloblen);
-	xfree(blob);
+	free(blob);
 
 	if (!mm_newkeys_to_blob(MODE_IN, &blob, &bloblen))
 		fatal("%s: conversion of newkeys failed", __func__);
 
 	buffer_put_string(&m, blob, bloblen);
-	xfree(blob);
+	free(blob);
 
 	packet_get_state(MODE_OUT, &seqnr, &blocks, &packets, &bytes);
 	buffer_put_int(&m, seqnr);
@@ -655,13 +655,13 @@ mm_send_keystate(struct monitor *monitor)
 	p = xmalloc(plen+1);
 	packet_get_keycontext(MODE_OUT, p);
 	buffer_put_string(&m, p, plen);
-	xfree(p);
+	free(p);
 
 	plen = packet_get_keycontext(MODE_IN, NULL);
 	p = xmalloc(plen+1);
 	packet_get_keycontext(MODE_IN, p);
 	buffer_put_string(&m, p, plen);
-	xfree(p);
+	free(p);
 
 	/* Compression state */
 	debug3("%s: Sending compression state", __func__);
@@ -723,10 +723,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen)
 	buffer_free(&m);
 
 	strlcpy(namebuf, p, namebuflen); /* Possible truncation */
-	xfree(p);
+	free(p);
 
 	buffer_append(&loginmsg, msg, strlen(msg));
-	xfree(msg);
+	free(msg);
 
 	if ((*ptyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1 ||
 	    (*ttyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1)
@@ -904,7 +904,7 @@ mm_auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
 		if ((key = key_from_blob(blob, blen)) == NULL)
 			fatal("%s: key_from_blob failed", __func__);
 		*rkey = key;
-		xfree(blob);
+		free(blob);
 	}
 	buffer_free(&m);
 
@@ -931,7 +931,7 @@ mm_auth_rsa_generate_challenge(Key *key)
 
 	buffer_init(&m);
 	buffer_put_string(&m, blob, blen);
-	xfree(blob);
+	free(blob);
 
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSACHALLENGE, &m);
 	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSACHALLENGE, &m);
@@ -960,7 +960,7 @@ mm_auth_rsa_verify_response(Key *key, BIGNUM *p, u_char response[16])
 	buffer_init(&m);
 	buffer_put_string(&m, blob, blen);
 	buffer_put_string(&m, response, 16);
-	xfree(blob);
+	free(blob);
 
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_RSARESPONSE, &m);
 	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_RSARESPONSE, &m);
diff --git a/usr.bin/ssh/mux.c b/usr.bin/ssh/mux.c
index 2460db75f96..fcfb301d6e5 100644
--- a/usr.bin/ssh/mux.c
+++ b/usr.bin/ssh/mux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mux.c,v 1.40 2013/04/22 01:17:18 dtucker Exp $ */
+/* $OpenBSD: mux.c,v 1.41 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
  *
@@ -274,13 +274,12 @@ process_mux_master_hello(u_int rid, Channel *c, Buffer *m, Buffer *r)
 		char *value = buffer_get_string_ret(m, NULL);
 
 		if (name == NULL || value == NULL) {
-			if (name != NULL)
-				xfree(name);
+			free(name);
 			goto malf;
 		}
 		debug2("Unrecognised slave extension \"%s\"", name);
-		xfree(name);
-		xfree(value);
+		free(name);
+		free(value);
 	}
 	state->hello_rcvd = 1;
 	return 0;
@@ -311,21 +310,17 @@ process_mux_new_session(u_int rid, Channel *c, Buffer *m, Buffer *r)
 	    (cctx->term = buffer_get_string_ret(m, &len)) == NULL ||
 	    (cmd = buffer_get_string_ret(m, &len)) == NULL) {
  malf:
-		if (cmd != NULL)
-			xfree(cmd);
-		if (reserved != NULL)
-			xfree(reserved);
+		free(cmd);
+		free(reserved);
 		for (j = 0; j < env_len; j++)
-			xfree(cctx->env[j]);
-		if (env_len > 0)
-			xfree(cctx->env);
-		if (cctx->term != NULL)
-			xfree(cctx->term);
-		xfree(cctx);
+			free(cctx->env[j]);
+		free(cctx->env);
+		free(cctx->term);
+		free(cctx);
 		error("%s: malformed message", __func__);
 		return -1;
 	}
-	xfree(reserved);
+	free(reserved);
 	reserved = NULL;
 
 	while (buffer_len(m) > 0) {
@@ -333,7 +328,7 @@ process_mux_new_session(u_int rid, Channel *c, Buffer *m, Buffer *r)
 		if ((cp = buffer_get_string_ret(m, &len)) == NULL)
 			goto malf;
 		if (!env_permitted(cp)) {
-			xfree(cp);
+			free(cp);
 			continue;
 		}
 		cctx->env = xrealloc(cctx->env, env_len + 2,
@@ -354,7 +349,7 @@ process_mux_new_session(u_int rid, Channel *c, Buffer *m, Buffer *r)
 
 	buffer_init(&cctx->cmd);
 	buffer_append(&cctx->cmd, cmd, strlen(cmd));
-	xfree(cmd);
+	free(cmd);
 	cmd = NULL;
 
 	/* Gather fds from client */
@@ -365,12 +360,11 @@ process_mux_new_session(u_int rid, Channel *c, Buffer *m, Buffer *r)
 			for (j = 0; j < i; j++)
 				close(new_fd[j]);
 			for (j = 0; j < env_len; j++)
-				xfree(cctx->env[j]);
-			if (env_len > 0)
-				xfree(cctx->env);
-			xfree(cctx->term);
+				free(cctx->env[j]);
+			free(cctx->env);
+			free(cctx->term);
 			buffer_free(&cctx->cmd);
-			xfree(cctx);
+			free(cctx);
 
 			/* prepare reply */
 			buffer_put_int(r, MUX_S_FAILURE);
@@ -395,14 +389,14 @@ process_mux_new_session(u_int rid, Channel *c, Buffer *m, Buffer *r)
 		close(new_fd[0]);
 		close(new_fd[1]);
 		close(new_fd[2]);
-		xfree(cctx->term);
+		free(cctx->term);
 		if (env_len != 0) {
 			for (i = 0; i < env_len; i++)
-				xfree(cctx->env[i]);
-			xfree(cctx->env);
+				free(cctx->env[i]);
+			free(cctx->env);
 		}
 		buffer_free(&cctx->cmd);
-		xfree(cctx);
+		free(cctx);
 		return 0;
 	}
 
@@ -607,7 +601,7 @@ mux_confirm_remote_forward(int type, u_int32_t seq, void *ctxt)
 	buffer_put_int(&out, MUX_S_FAILURE);
 	buffer_put_int(&out, fctx->rid);
 	buffer_put_cstring(&out, failmsg);
-	xfree(failmsg);
+	free(failmsg);
  out:
 	buffer_put_string(&c->output, buffer_ptr(&out), buffer_len(&out));
 	buffer_free(&out);
@@ -636,11 +630,11 @@ process_mux_open_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
 	}
 
 	if (*fwd.listen_host == '\0') {
-		xfree(fwd.listen_host);
+		free(fwd.listen_host);
 		fwd.listen_host = NULL;
 	}
 	if (*fwd.connect_host == '\0') {
-		xfree(fwd.connect_host);
+		free(fwd.connect_host);
 		fwd.connect_host = NULL;
 	}
 
@@ -651,10 +645,8 @@ process_mux_open_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
 	    ftype != MUX_FWD_DYNAMIC) {
 		logit("%s: invalid forwarding type %u", __func__, ftype);
  invalid:
-		if (fwd.listen_host)
-			xfree(fwd.listen_host);
-		if (fwd.connect_host)
-			xfree(fwd.connect_host);
+		free(fwd.listen_host);
+		free(fwd.connect_host);
 		buffer_put_int(r, MUX_S_FAILURE);
 		buffer_put_int(r, rid);
 		buffer_put_cstring(r, "Invalid forwarding request");
@@ -756,13 +748,10 @@ process_mux_open_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
 	buffer_put_int(r, MUX_S_OK);
 	buffer_put_int(r, rid);
  out:
-	if (fwd_desc != NULL)
-		xfree(fwd_desc);
+	free(fwd_desc);
 	if (freefwd) {
-		if (fwd.listen_host != NULL)
-			xfree(fwd.listen_host);
-		if (fwd.connect_host != NULL)
-			xfree(fwd.connect_host);
+		free(fwd.listen_host);
+		free(fwd.connect_host);
 	}
 	return ret;
 }
@@ -788,11 +777,11 @@ process_mux_close_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
 	}
 
 	if (*fwd.listen_host == '\0') {
-		xfree(fwd.listen_host);
+		free(fwd.listen_host);
 		fwd.listen_host = NULL;
 	}
 	if (*fwd.connect_host == '\0') {
-		xfree(fwd.connect_host);
+		free(fwd.connect_host);
 		fwd.connect_host = NULL;
 	}
 
@@ -849,10 +838,8 @@ process_mux_close_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
 		buffer_put_int(r, MUX_S_OK);
 		buffer_put_int(r, rid);
 
-		if (found_fwd->listen_host != NULL)
-			xfree(found_fwd->listen_host);
-		if (found_fwd->connect_host != NULL)
-			xfree(found_fwd->connect_host);
+		free(found_fwd->listen_host);
+		free(found_fwd->connect_host);
 		found_fwd->listen_host = found_fwd->connect_host = NULL;
 		found_fwd->listen_port = found_fwd->connect_port = 0;
 	} else {
@@ -861,12 +848,9 @@ process_mux_close_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
 		buffer_put_cstring(r, error_reason);
 	}
  out:
-	if (fwd_desc != NULL)
-		xfree(fwd_desc);
-	if (fwd.listen_host != NULL)
-		xfree(fwd.listen_host);
-	if (fwd.connect_host != NULL)
-		xfree(fwd.connect_host);
+	free(fwd_desc);
+	free(fwd.listen_host);
+	free(fwd.connect_host);
 
 	return ret;
 }
@@ -883,14 +867,12 @@ process_mux_stdio_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
 	if ((reserved = buffer_get_string_ret(m, NULL)) == NULL ||
 	   (chost = buffer_get_string_ret(m, NULL)) == NULL ||
 	    buffer_get_int_ret(&cport, m) != 0) {
-		if (reserved != NULL)
-			xfree(reserved);
-		if (chost != NULL)
-			xfree(chost);
+		free(reserved);
+		free(chost);
 		error("%s: malformed message", __func__);
 		return -1;
 	}
-	xfree(reserved);
+	free(reserved);
 
 	debug2("%s: channel %d: request stdio fwd to %s:%u",
 	    __func__, c->self, chost, cport);
@@ -902,7 +884,7 @@ process_mux_stdio_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
 			    __func__, i);
 			for (j = 0; j < i; j++)
 				close(new_fd[j]);
-			xfree(chost);
+			free(chost);
 
 			/* prepare reply */
 			buffer_put_int(r, MUX_S_FAILURE);
@@ -926,7 +908,7 @@ process_mux_stdio_fwd(u_int rid, Channel *c, Buffer *m, Buffer *r)
  cleanup:
 		close(new_fd[0]);
 		close(new_fd[1]);
-		xfree(chost);
+		free(chost);
 		return 0;
 	}
 
@@ -988,7 +970,7 @@ process_mux_stop_listening(u_int rid, Channel *c, Buffer *m, Buffer *r)
 	if (mux_listener_channel != NULL) {
 		channel_free(mux_listener_channel);
 		client_stop_mux();
-		xfree(options.control_path);
+		free(options.control_path);
 		options.control_path = NULL;
 		mux_listener_channel = NULL;
 		muxserver_sock = -1;
@@ -1184,8 +1166,8 @@ muxserver_listen(void)
 				close(muxserver_sock);
 				muxserver_sock = -1;
 			}
-			xfree(orig_control_path);
-			xfree(options.control_path);
+			free(orig_control_path);
+			free(options.control_path);
 			options.control_path = NULL;
 			options.control_master = SSHCTL_MASTER_NO;
 			return;
@@ -1210,7 +1192,7 @@ muxserver_listen(void)
 		goto disable_mux_master;
 	}
 	unlink(options.control_path);
-	xfree(options.control_path);
+	free(options.control_path);
 	options.control_path = orig_control_path;
 
 	set_nonblock(muxserver_sock);
@@ -1295,13 +1277,13 @@ mux_session_confirm(int id, int success, void *arg)
 	cc->mux_pause = 0; /* start processing messages again */
 	c->open_confirm_ctx = NULL;
 	buffer_free(&cctx->cmd);
-	xfree(cctx->term);
+	free(cctx->term);
 	if (cctx->env != NULL) {
 		for (i = 0; cctx->env[i] != NULL; i++)
-			xfree(cctx->env[i]);
-		xfree(cctx->env);
+			free(cctx->env[i]);
+		free(cctx->env);
 	}
-	xfree(cctx);
+	free(cctx);
 }
 
 /* ** Multiplexing client support */
@@ -1479,8 +1461,8 @@ mux_client_hello_exchange(int fd)
 		char *value = buffer_get_string(&m, NULL);
 
 		debug2("Unrecognised master extension \"%s\"", name);
-		xfree(name);
-		xfree(value);
+		free(name);
+		free(value);
 	}
 	buffer_free(&m);
 	return 0;
@@ -1589,7 +1571,7 @@ mux_client_forward(int fd, int cancel_flag, u_int ftype, Forward *fwd)
 	fwd_desc = format_forward(ftype, fwd);
 	debug("Requesting %s %s",
 	    cancel_flag ? "cancellation of" : "forwarding of", fwd_desc);
-	xfree(fwd_desc);
+	free(fwd_desc);
 
 	buffer_init(&m);
 	buffer_put_int(&m, cancel_flag ? MUX_C_CLOSE_FWD : MUX_C_OPEN_FWD);
diff --git a/usr.bin/ssh/packet.c b/usr.bin/ssh/packet.c
index aa852389d85..dc9b87f75f4 100644
--- a/usr.bin/ssh/packet.c
+++ b/usr.bin/ssh/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.185 2013/05/16 04:09:13 dtucker Exp $ */
+/* $OpenBSD: packet.c,v 1.186 2013/05/17 00:13:13 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -755,13 +755,13 @@ set_newkeys(int mode)
 		memset(enc->iv,  0, enc->iv_len);
 		memset(enc->key, 0, enc->key_len);
 		memset(mac->key, 0, mac->key_len);
-		xfree(enc->name);
-		xfree(enc->iv);
-		xfree(enc->key);
-		xfree(mac->name);
-		xfree(mac->key);
-		xfree(comp->name);
-		xfree(active_state->newkeys[mode]);
+		free(enc->name);
+		free(enc->iv);
+		free(enc->key);
+		free(mac->name);
+		free(mac->key);
+		free(comp->name);
+		free(active_state->newkeys[mode]);
 	}
 	active_state->newkeys[mode] = kex_get_newkeys(mode);
 	if (active_state->newkeys[mode] == NULL)
@@ -1012,7 +1012,7 @@ packet_send2(void)
 			memcpy(&active_state->outgoing_packet, &p->payload,
 			    sizeof(Buffer));
 			TAILQ_REMOVE(&active_state->outgoing, p, next);
-			xfree(p);
+			free(p);
 			packet_send2_wrapped();
 		}
 	}
@@ -1062,7 +1062,7 @@ packet_read_seqnr(u_int32_t *seqnr_p)
 			packet_check_eom();
 		/* If we got a packet, return it. */
 		if (type != SSH_MSG_NONE) {
-			xfree(setp);
+			free(setp);
 			return type;
 		}
 		/*
@@ -1448,9 +1448,9 @@ packet_read_poll_seqnr(u_int32_t *seqnr_p)
 				packet_get_char();
 				msg = packet_get_string(NULL);
 				debug("Remote: %.900s", msg);
-				xfree(msg);
+				free(msg);
 				msg = packet_get_string(NULL);
-				xfree(msg);
+				free(msg);
 				break;
 			case SSH2_MSG_DISCONNECT:
 				reason = packet_get_int();
@@ -1461,7 +1461,7 @@ packet_read_poll_seqnr(u_int32_t *seqnr_p)
 				    SYSLOG_LEVEL_INFO : SYSLOG_LEVEL_ERROR,
 				    "Received disconnect from %s: %u: %.400s",
 				    get_remote_ipaddr(), reason, msg);
-				xfree(msg);
+				free(msg);
 				cleanup_exit(255);
 				break;
 			case SSH2_MSG_UNIMPLEMENTED:
@@ -1480,7 +1480,7 @@ packet_read_poll_seqnr(u_int32_t *seqnr_p)
 			case SSH_MSG_DEBUG:
 				msg = packet_get_string(NULL);
 				debug("Remote: %.900s", msg);
-				xfree(msg);
+				free(msg);
 				break;
 			case SSH_MSG_DISCONNECT:
 				msg = packet_get_string(NULL);
@@ -1764,7 +1764,7 @@ packet_write_wait(void)
 		}
 		packet_write_poll();
 	}
-	xfree(setp);
+	free(setp);
 }
 
 /* Returns true if there is buffered data to write to the connection. */
diff --git a/usr.bin/ssh/readconf.c b/usr.bin/ssh/readconf.c
index bacdbdc284c..a18e37b882a 100644
--- a/usr.bin/ssh/readconf.c
+++ b/usr.bin/ssh/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.201 2013/05/16 10:43:34 dtucker Exp $ */
+/* $OpenBSD: readconf.c,v 1.202 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -302,22 +302,20 @@ clear_forwardings(Options *options)
 	int i;
 
 	for (i = 0; i < options->num_local_forwards; i++) {
-		if (options->local_forwards[i].listen_host != NULL)
-			xfree(options->local_forwards[i].listen_host);
-		xfree(options->local_forwards[i].connect_host);
+		free(options->local_forwards[i].listen_host);
+		free(options->local_forwards[i].connect_host);
 	}
 	if (options->num_local_forwards > 0) {
-		xfree(options->local_forwards);
+		free(options->local_forwards);
 		options->local_forwards = NULL;
 	}
 	options->num_local_forwards = 0;
 	for (i = 0; i < options->num_remote_forwards; i++) {
-		if (options->remote_forwards[i].listen_host != NULL)
-			xfree(options->remote_forwards[i].listen_host);
-		xfree(options->remote_forwards[i].connect_host);
+		free(options->remote_forwards[i].listen_host);
+		free(options->remote_forwards[i].connect_host);
 	}
 	if (options->num_remote_forwards > 0) {
-		xfree(options->remote_forwards);
+		free(options->remote_forwards);
 		options->remote_forwards = NULL;
 	}
 	options->num_remote_forwards = 0;
@@ -1448,7 +1446,7 @@ parse_forward(Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
 		i = 0; /* failure */
 	}
 
-	xfree(p);
+	free(p);
 
 	if (dynamicfwd) {
 		if (!(i == 1 || i == 2))
@@ -1474,13 +1472,9 @@ parse_forward(Forward *fwd, const char *fwdspec, int dynamicfwd, int remotefwd)
 	return (i);
 
  fail_free:
-	if (fwd->connect_host != NULL) {
-		xfree(fwd->connect_host);
-		fwd->connect_host = NULL;
-	}
-	if (fwd->listen_host != NULL) {
-		xfree(fwd->listen_host);
-		fwd->listen_host = NULL;
-	}
+	free(fwd->connect_host);
+	fwd->connect_host = NULL;
+	free(fwd->listen_host);
+	fwd->listen_host = NULL;
 	return (0);
 }
diff --git a/usr.bin/ssh/readpass.c b/usr.bin/ssh/readpass.c
index 3a661fa806f..f3c5cbfbabe 100644
--- a/usr.bin/ssh/readpass.c
+++ b/usr.bin/ssh/readpass.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readpass.c,v 1.48 2010/12/15 00:49:27 djm Exp $ */
+/* $OpenBSD: readpass.c,v 1.49 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  *
@@ -183,7 +183,7 @@ ask_permission(const char *fmt, ...)
 		if (*p == '\0' || *p == '\n' ||
 		    strcasecmp(p, "yes") == 0)
 			allowed = 1;
-		xfree(p);
+		free(p);
 	}
 
 	return (allowed);
diff --git a/usr.bin/ssh/roaming_client.c b/usr.bin/ssh/roaming_client.c
index 94b4f10d1f8..0a404278bc8 100644
--- a/usr.bin/ssh/roaming_client.c
+++ b/usr.bin/ssh/roaming_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: roaming_client.c,v 1.4 2011/12/07 05:44:38 djm Exp $ */
+/* $OpenBSD: roaming_client.c,v 1.5 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2004-2009 AppGate Network Security AB
  *
@@ -183,10 +183,10 @@ roaming_resume(void)
 		debug("server doesn't allow resume");
 		goto fail;
 	}
-	xfree(str);
+	free(str);
 	for (i = 1; i < PROPOSAL_MAX; i++) {
 		/* kex algorithm taken care of so start with i=1 and not 0 */
-		xfree(packet_get_string(&len));
+		free(packet_get_string(&len));
 	}
 	i = packet_get_char(); /* first_kex_packet_follows */
 	if (i && (c = strchr(kexlist, ',')))
@@ -222,8 +222,7 @@ roaming_resume(void)
 	return 0;
 
 fail:
-	if (kexlist)
-		xfree(kexlist);
+	free(kexlist);
 	if (packet_get_connection_in() == packet_get_connection_out())
 		close(packet_get_connection_in());
 	else {
diff --git a/usr.bin/ssh/rsa.c b/usr.bin/ssh/rsa.c
index f8e52086962..9788a016c27 100644
--- a/usr.bin/ssh/rsa.c
+++ b/usr.bin/ssh/rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa.c,v 1.29 2006/11/06 21:25:28 markus Exp $ */
+/* $OpenBSD: rsa.c,v 1.30 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -93,8 +93,8 @@ rsa_public_encrypt(BIGNUM *out, BIGNUM *in, RSA *key)
 
 	memset(outbuf, 0, olen);
 	memset(inbuf, 0, ilen);
-	xfree(outbuf);
-	xfree(inbuf);
+	free(outbuf);
+	free(inbuf);
 }
 
 int
@@ -119,8 +119,8 @@ rsa_private_decrypt(BIGNUM *out, BIGNUM *in, RSA *key)
 	}
 	memset(outbuf, 0, olen);
 	memset(inbuf, 0, ilen);
-	xfree(outbuf);
-	xfree(inbuf);
+	free(outbuf);
+	free(inbuf);
 	return len;
 }
 
diff --git a/usr.bin/ssh/schnorr.c b/usr.bin/ssh/schnorr.c
index a61cc8d486b..e6547bb3195 100644
--- a/usr.bin/ssh/schnorr.c
+++ b/usr.bin/ssh/schnorr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: schnorr.c,v 1.6 2013/05/16 09:08:41 dtucker Exp $ */
+/* $OpenBSD: schnorr.c,v 1.7 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
  *
@@ -98,7 +98,7 @@ schnorr_hash(const BIGNUM *p, const BIGNUM *q, const BIGNUM *g,
  out:
 	buffer_free(&b);
 	bzero(digest, digest_len);
-	xfree(digest);
+	free(digest);
 	digest_len = 0;
 	if (success == 0)
 		return h;
@@ -569,7 +569,7 @@ modp_group_free(struct modp_group *grp)
 	if (grp->q != NULL)
 		BN_clear_free(grp->q);
 	bzero(grp, sizeof(*grp));
-	xfree(grp);
+	free(grp);
 }
 
 /* main() function for self-test */
@@ -604,7 +604,7 @@ schnorr_selftest_one(const BIGNUM *grp_p, const BIGNUM *grp_q,
 	if (schnorr_verify_buf(grp_p, grp_q, grp_g, g_x, "junk", 4,
 	    sig, siglen) != 0)
 		fatal("%s: verify should have failed (bit error)", __func__);
-	xfree(sig);
+	free(sig);
 	BN_free(g_x);
 	BN_CTX_free(bn_ctx);
 }
diff --git a/usr.bin/ssh/scp.c b/usr.bin/ssh/scp.c
index 57542bd1ce0..1e4fe7fc2b7 100644
--- a/usr.bin/ssh/scp.c
+++ b/usr.bin/ssh/scp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: scp.c,v 1.172 2013/05/16 09:08:41 dtucker Exp $ */
+/* $OpenBSD: scp.c,v 1.173 2013/05/17 00:13:14 djm Exp $ */
 /*
  * scp - secure remote copy.  This is basically patched BSD rcp which
  * uses ssh to do the data transfer (instead of using rcmd).
@@ -557,7 +557,7 @@ toremote(char *targ, int argc, char **argv)
 	}
 
 	if (tuser != NULL && !okname(tuser)) {
-		xfree(arg);
+		free(arg);
 		return;
 	}
 
@@ -584,13 +584,13 @@ toremote(char *targ, int argc, char **argv)
 			    *src == '-' ? "-- " : "", src);
 			if (do_cmd(host, suser, bp, &remin, &remout) < 0)
 				exit(1);
-			(void) xfree(bp);
+			free(bp);
 			host = cleanhostname(thost);
 			xasprintf(&bp, "%s -t %s%s", cmd,
 			    *targ == '-' ? "-- " : "", targ);
 			if (do_cmd2(host, tuser, bp, remin, remout) < 0)
 				exit(1);
-			(void) xfree(bp);
+			free(bp);
 			(void) close(remin);
 			(void) close(remout);
 			remin = remout = -1;
@@ -641,12 +641,12 @@ toremote(char *targ, int argc, char **argv)
 					exit(1);
 				if (response() < 0)
 					exit(1);
-				(void) xfree(bp);
+				free(bp);
 			}
 			source(1, argv + i);
 		}
 	}
-	xfree(arg);
+	free(arg);
 }
 
 void
@@ -690,11 +690,11 @@ tolocal(int argc, char **argv)
 		xasprintf(&bp, "%s -f %s%s",
 		    cmd, *src == '-' ? "-- " : "", src);
 		if (do_cmd(host, suser, bp, &remin, &remout) < 0) {
-			(void) xfree(bp);
+			free(bp);
 			++errs;
 			continue;
 		}
-		xfree(bp);
+		free(bp);
 		sink(1, argv + argc - 1);
 		(void) close(remin);
 		remin = remout = -1;
@@ -1002,8 +1002,7 @@ sink(int argc, char **argv)
 
 			need = strlen(targ) + strlen(cp) + 250;
 			if (need > cursize) {
-				if (namebuf)
-					xfree(namebuf);
+				free(namebuf);
 				namebuf = xmalloc(need);
 				cursize = need;
 			}
@@ -1042,8 +1041,7 @@ sink(int argc, char **argv)
 			}
 			if (mod_flag)
 				(void) chmod(vect[0], mode);
-			if (vect[0])
-				xfree(vect[0]);
+			free(vect[0]);
 			continue;
 		}
 		omode = mode;
diff --git a/usr.bin/ssh/servconf.c b/usr.bin/ssh/servconf.c
index 71dfdde809c..518d86e7547 100644
--- a/usr.bin/ssh/servconf.c
+++ b/usr.bin/ssh/servconf.c
@@ -1,5 +1,5 @@
 
-/* $OpenBSD: servconf.c,v 1.238 2013/05/16 10:44:06 dtucker Exp $ */
+/* $OpenBSD: servconf.c,v 1.239 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -479,7 +479,7 @@ derelativise_path(const char *path)
 	if (getcwd(cwd, sizeof(cwd)) == NULL)
 		fatal("%s: getcwd: %s", __func__, strerror(errno));
 	xasprintf(&ret, "%s/%s", cwd, expanded);
-	xfree(expanded);
+	free(expanded);
 	return ret;
 }
 
@@ -1666,8 +1666,7 @@ int server_match_spec_complete(struct connection_info *ci)
 } while (0)
 #define M_CP_STROPT(n) do {\
 	if (src->n != NULL) { \
-		if (dst->n != NULL) \
-			xfree(dst->n); \
+		free(dst->n); \
 		dst->n = src->n; \
 	} \
 } while(0)
@@ -1751,7 +1750,7 @@ parse_server_config(ServerOptions *options, const char *filename, Buffer *conf,
 		    linenum++, &active, connectinfo) != 0)
 			bad_options++;
 	}
-	xfree(obuf);
+	free(obuf);
 	if (bad_options > 0)
 		fatal("%s: terminating, %d bad configuration options",
 		    filename, bad_options);
diff --git a/usr.bin/ssh/serverloop.c b/usr.bin/ssh/serverloop.c
index 59831cf8055..1381dcf2b6e 100644
--- a/usr.bin/ssh/serverloop.c
+++ b/usr.bin/ssh/serverloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: serverloop.c,v 1.166 2013/05/16 09:08:41 dtucker Exp $ */
+/* $OpenBSD: serverloop.c,v 1.167 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -662,7 +662,7 @@ server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
 				/* Display list of open channels. */
 				cp = channel_open_message();
 				buffer_append(&stderr_buffer, cp, strlen(cp));
-				xfree(cp);
+				free(cp);
 			}
 		}
 		max_fd = MAX(connection_in, connection_out);
@@ -690,10 +690,8 @@ server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
 		/* Process output to the client and to program stdin. */
 		process_output(writeset);
 	}
-	if (readset)
-		xfree(readset);
-	if (writeset)
-		xfree(writeset);
+	free(readset);
+	free(writeset);
 
 	/* Cleanup and termination code. */
 
@@ -853,10 +851,8 @@ server_loop2(Authctxt *authctxt)
 	}
 	collect_children();
 
-	if (readset)
-		xfree(readset);
-	if (writeset)
-		xfree(writeset);
+	free(readset);
+	free(writeset);
 
 	/* free all channels, no more reads and writes */
 	channel_free_all();
@@ -891,7 +887,7 @@ server_input_stdin_data(int type, u_int32_t seq, void *ctxt)
 	packet_check_eom();
 	buffer_append(&stdin_buffer, data, data_len);
 	memset(data, 0, data_len);
-	xfree(data);
+	free(data);
 }
 
 static void
@@ -948,8 +944,8 @@ server_request_direct_tcpip(void)
 		    originator, originator_port, target, target_port);
 	}
 
-	xfree(originator);
-	xfree(target);
+	free(originator);
+	free(target);
 
 	return c;
 }
@@ -1073,7 +1069,7 @@ server_input_channel_open(int type, u_int32_t seq, void *ctxt)
 		}
 		packet_send();
 	}
-	xfree(ctype);
+	free(ctype);
 }
 
 static void
@@ -1115,7 +1111,7 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt)
 			    listen_address, listen_port,
 			    &allocated_listen_port, options.gateway_ports);
 		}
-		xfree(listen_address);
+		free(listen_address);
 	} else if (strcmp(rtype, "cancel-tcpip-forward") == 0) {
 		char *cancel_address;
 		u_short cancel_port;
@@ -1127,7 +1123,7 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt)
 
 		success = channel_cancel_rport_listener(cancel_address,
 		    cancel_port);
-		xfree(cancel_address);
+		free(cancel_address);
 	} else if (strcmp(rtype, "no-more-sessions@openssh.com") == 0) {
 		no_more_sessions = 1;
 		success = 1;
@@ -1140,7 +1136,7 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt)
 		packet_send();
 		packet_write_wait();
 	}
-	xfree(rtype);
+	free(rtype);
 }
 
 static void
@@ -1172,7 +1168,7 @@ server_input_channel_req(int type, u_int32_t seq, void *ctxt)
 		packet_put_int(c->remote_id);
 		packet_send();
 	}
-	xfree(rtype);
+	free(rtype);
 }
 
 static void
diff --git a/usr.bin/ssh/session.c b/usr.bin/ssh/session.c
index 04f8e0ebe1e..cf04d33df6a 100644
--- a/usr.bin/ssh/session.c
+++ b/usr.bin/ssh/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.264 2013/04/19 01:03:01 djm Exp $ */
+/* $OpenBSD: session.c,v 1.265 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -182,7 +182,7 @@ auth_input_request_forwarding(struct passwd * pw)
 		packet_send_debug("Agent forwarding disabled: "
 		    "mkdtemp() failed: %.100s", strerror(errno));
 		restore_uid();
-		xfree(auth_sock_dir);
+		free(auth_sock_dir);
 		auth_sock_dir = NULL;
 		goto authsock_err;
 	}
@@ -227,11 +227,10 @@ auth_input_request_forwarding(struct passwd * pw)
 	return 1;
 
  authsock_err:
-	if (auth_sock_name != NULL)
-		xfree(auth_sock_name);
+	free(auth_sock_name);
 	if (auth_sock_dir != NULL) {
 		rmdir(auth_sock_dir);
-		xfree(auth_sock_dir);
+		free(auth_sock_dir);
 	}
 	if (sock != -1)
 		close(sock);
@@ -347,8 +346,8 @@ do_authenticated1(Authctxt *authctxt)
 			packet_check_eom();
 			success = session_setup_x11fwd(s);
 			if (!success) {
-				xfree(s->auth_proto);
-				xfree(s->auth_data);
+				free(s->auth_proto);
+				free(s->auth_data);
 				s->auth_proto = NULL;
 				s->auth_data = NULL;
 			}
@@ -395,7 +394,7 @@ do_authenticated1(Authctxt *authctxt)
 				if (do_exec(s, command) != 0)
 					packet_disconnect(
 					    "command execution failed");
-				xfree(command);
+				free(command);
 			} else {
 				if (do_exec(s, NULL) != 0)
 					packet_disconnect(
@@ -860,7 +859,7 @@ child_set_env(char ***envp, u_int *envsizep, const char *name,
 			break;
 	if (env[i]) {
 		/* Reuse the slot. */
-		xfree(env[i]);
+		free(env[i]);
 	} else {
 		/* New variable.  Expand if necessary. */
 		envsize = *envsizep;
@@ -983,8 +982,8 @@ do_setup_env(Session *s, const char *shell)
 				child_set_env(&env, &envsize, str, str + i + 1);
 			}
 			custom_environment = ce->next;
-			xfree(ce->s);
-			xfree(ce);
+			free(ce->s);
+			free(ce);
 		}
 	}
 
@@ -996,7 +995,7 @@ do_setup_env(Session *s, const char *shell)
 	laddr = get_local_ipaddr(packet_get_connection_in());
 	snprintf(buf, sizeof buf, "%.50s %d %.50s %d",
 	    get_remote_ipaddr(), get_remote_port(), laddr, get_local_port());
-	xfree(laddr);
+	free(laddr);
 	child_set_env(&env, &envsize, "SSH_CONNECTION", buf);
 
 	if (s->ttyfd != -1)
@@ -1117,7 +1116,7 @@ do_nologin(struct passwd *pw)
 
 	if (stat(nl, &sb) == -1) {
 		if (nl != def_nl)
-			xfree(nl);
+			free(nl);
 		return;
 	}
 
@@ -1692,7 +1691,7 @@ session_pty_req(Session *s)
 	s->ypixel = packet_get_int();
 
 	if (strcmp(s->term, "") == 0) {
-		xfree(s->term);
+		free(s->term);
 		s->term = NULL;
 	}
 
@@ -1700,8 +1699,7 @@ session_pty_req(Session *s)
 	debug("Allocating pty.");
 	if (!PRIVSEP(pty_allocate(&s->ptyfd, &s->ttyfd, s->tty,
 	    sizeof(s->tty)))) {
-		if (s->term)
-			xfree(s->term);
+		free(s->term);
 		s->term = NULL;
 		s->ptyfd = -1;
 		s->ttyfd = -1;
@@ -1762,7 +1760,7 @@ session_subsystem_req(Session *s)
 		logit("subsystem request for %.100s failed, subsystem not found",
 		    subsys);
 
-	xfree(subsys);
+	free(subsys);
 	return success;
 }
 
@@ -1784,8 +1782,8 @@ session_x11_req(Session *s)
 
 	success = session_setup_x11fwd(s);
 	if (!success) {
-		xfree(s->auth_proto);
-		xfree(s->auth_data);
+		free(s->auth_proto);
+		free(s->auth_data);
 		s->auth_proto = NULL;
 		s->auth_data = NULL;
 	}
@@ -1807,7 +1805,7 @@ session_exec_req(Session *s)
 	char *command = packet_get_string(&len);
 	packet_check_eom();
 	success = do_exec(s, command) == 0;
-	xfree(command);
+	free(command);
 	return success;
 }
 
@@ -1853,8 +1851,8 @@ session_env_req(Session *s)
 	debug2("Ignoring env request %s: disallowed name", name);
 
  fail:
-	xfree(name);
-	xfree(val);
+	free(name);
+	free(val);
 	return (0);
 }
 
@@ -2036,24 +2034,16 @@ session_close_single_x11(int id, void *arg)
 		if (s->x11_chanids[i] != id)
 			session_close_x11(s->x11_chanids[i]);
 	}
-	xfree(s->x11_chanids);
+	free(s->x11_chanids);
 	s->x11_chanids = NULL;
-	if (s->display) {
-		xfree(s->display);
-		s->display = NULL;
-	}
-	if (s->auth_proto) {
-		xfree(s->auth_proto);
-		s->auth_proto = NULL;
-	}
-	if (s->auth_data) {
-		xfree(s->auth_data);
-		s->auth_data = NULL;
-	}
-	if (s->auth_display) {
-		xfree(s->auth_display);
-		s->auth_display = NULL;
-	}
+	free(s->display);
+	s->display = NULL;
+	free(s->auth_proto);
+	s->auth_proto = NULL;
+	free(s->auth_data);
+	s->auth_data = NULL;
+	free(s->auth_display);
+	s->auth_display = NULL;
 }
 
 static void
@@ -2111,24 +2101,18 @@ session_close(Session *s)
 	debug("session_close: session %d pid %ld", s->self, (long)s->pid);
 	if (s->ttyfd != -1)
 		session_pty_cleanup(s);
-	if (s->term)
-		xfree(s->term);
-	if (s->display)
-		xfree(s->display);
-	if (s->x11_chanids)
-		xfree(s->x11_chanids);
-	if (s->auth_display)
-		xfree(s->auth_display);
-	if (s->auth_data)
-		xfree(s->auth_data);
-	if (s->auth_proto)
-		xfree(s->auth_proto);
+	free(s->term);
+	free(s->display);
+	free(s->x11_chanids);
+	free(s->auth_display);
+	free(s->auth_data);
+	free(s->auth_proto);
 	if (s->env != NULL) {
 		for (i = 0; i < s->num_env; i++) {
-			xfree(s->env[i].name);
-			xfree(s->env[i].val);
+			free(s->env[i].name);
+			free(s->env[i].val);
 		}
-		xfree(s->env);
+		free(s->env);
 	}
 	session_proctitle(s);
 	session_unused(s->self);
diff --git a/usr.bin/ssh/sftp-client.c b/usr.bin/ssh/sftp-client.c
index fa999180e30..d73c6825394 100644
--- a/usr.bin/ssh/sftp-client.c
+++ b/usr.bin/ssh/sftp-client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-client.c,v 1.97 2012/07/02 12:13:26 dtucker Exp $ */
+/* $OpenBSD: sftp-client.c,v 1.98 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
  *
@@ -387,8 +387,8 @@ do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests,
 		} else {
 			debug2("Unrecognised server extension \"%s\"", name);
 		}
-		xfree(name);
-		xfree(value);
+		free(name);
+		free(value);
 	}
 
 	buffer_free(&msg);
@@ -502,7 +502,7 @@ do_lsreaddir(struct sftp_conn *conn, char *path, int printflag,
 				error("Couldn't read directory: %s",
 				    fx2txt(status));
 				do_close(conn, handle, handle_len);
-				xfree(handle);
+				free(handle);
 				buffer_free(&msg);
 				return(status);
 			}
@@ -545,14 +545,14 @@ do_lsreaddir(struct sftp_conn *conn, char *path, int printflag,
 				(*dir)[++ents] = NULL;
 			}
  next:
-			xfree(filename);
-			xfree(longname);
+			free(filename);
+			free(longname);
 		}
 	}
 
 	buffer_free(&msg);
 	do_close(conn, handle, handle_len);
-	xfree(handle);
+	free(handle);
 
 	/* Don't return partial matches on interrupt */
 	if (interrupted && dir != NULL && *dir != NULL) {
@@ -575,11 +575,11 @@ void free_sftp_dirents(SFTP_DIRENT **s)
 	int i;
 
 	for (i = 0; s[i]; i++) {
-		xfree(s[i]->filename);
-		xfree(s[i]->longname);
-		xfree(s[i]);
+		free(s[i]->filename);
+		free(s[i]->longname);
+		free(s[i]);
 	}
-	xfree(s);
+	free(s);
 }
 
 int
@@ -753,7 +753,7 @@ do_realpath(struct sftp_conn *conn, char *path)
 	debug3("SSH_FXP_REALPATH %s -> %s size %lu", path, filename,
 	    (unsigned long)a->size);
 
-	xfree(longname);
+	free(longname);
 
 	buffer_free(&msg);
 
@@ -900,7 +900,7 @@ do_readlink(struct sftp_conn *conn, char *path)
 
 	debug3("SSH_FXP_READLINK %s -> %s", path, filename);
 
-	xfree(longname);
+	free(longname);
 
 	buffer_free(&msg);
 
@@ -1050,7 +1050,7 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 		    local_path, strerror(errno));
 		do_close(conn, handle, handle_len);
 		buffer_free(&msg);
-		xfree(handle);
+		free(handle);
 		return(-1);
 	}
 
@@ -1114,7 +1114,7 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 				read_error = 1;
 			max_req = 0;
 			TAILQ_REMOVE(&requests, req, tq);
-			xfree(req);
+			free(req);
 			num_req--;
 			break;
 		case SSH2_FXP_DATA:
@@ -1133,11 +1133,11 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 				max_req = 0;
 			}
 			progress_counter += len;
-			xfree(data);
+			free(data);
 
 			if (len == req->len) {
 				TAILQ_REMOVE(&requests, req, tq);
-				xfree(req);
+				free(req);
 				num_req--;
 			} else {
 				/* Resend the request for the missing data */
@@ -1209,7 +1209,7 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 	}
 	close(local_fd);
 	buffer_free(&msg);
-	xfree(handle);
+	free(handle);
 
 	return(status);
 }
@@ -1281,8 +1281,8 @@ download_dir_internal(struct sftp_conn *conn, char *src, char *dst,
 		} else
 			logit("%s: not a regular file\n", new_src);
 
-		xfree(new_dst);
-		xfree(new_src);
+		free(new_dst);
+		free(new_src);
 	}
 
 	if (pflag) {
@@ -1318,7 +1318,7 @@ download_dir(struct sftp_conn *conn, char *src, char *dst,
 
 	ret = download_dir_internal(conn, src_canon, dst,
 	    dirattrib, pflag, printflag, 0);
-	xfree(src_canon);
+	free(src_canon);
 	return ret;
 }
 
@@ -1469,7 +1469,7 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
 			debug3("In write loop, ack for %u %u bytes at %lld",
 			    ack->id, ack->len, (long long)ack->offset);
 			++ackid;
-			xfree(ack);
+			free(ack);
 		}
 		offset += len;
 		if (offset < 0)
@@ -1479,7 +1479,7 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
 
 	if (showprogress)
 		stop_progress_meter();
-	xfree(data);
+	free(data);
 
 	if (status != SSH2_FX_OK) {
 		error("Couldn't write to remote file \"%s\": %s",
@@ -1499,7 +1499,7 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
 
 	if (do_close(conn, handle, handle_len) != SSH2_FX_OK)
 		status = -1;
-	xfree(handle);
+	free(handle);
 
 	return status;
 }
@@ -1585,8 +1585,8 @@ upload_dir_internal(struct sftp_conn *conn, char *src, char *dst,
 			}
 		} else
 			logit("%s: not a regular file\n", filename);
-		xfree(new_dst);
-		xfree(new_src);
+		free(new_dst);
+		free(new_src);
 	}
 
 	do_setstat(conn, dst, &a);
@@ -1608,7 +1608,7 @@ upload_dir(struct sftp_conn *conn, char *src, char *dst, int printflag,
 	}
 
 	ret = upload_dir_internal(conn, src, dst_canon, pflag, printflag, 0);
-	xfree(dst_canon);
+	free(dst_canon);
 	return ret;
 }
 
diff --git a/usr.bin/ssh/sftp-common.c b/usr.bin/ssh/sftp-common.c
index e29039904d4..4851a15ef0b 100644
--- a/usr.bin/ssh/sftp-common.c
+++ b/usr.bin/ssh/sftp-common.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-common.c,v 1.23 2010/01/15 09:24:23 markus Exp $ */
+/* $OpenBSD: sftp-common.c,v 1.24 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2001 Damien Miller.  All rights reserved.
@@ -124,8 +124,8 @@ decode_attrib(Buffer *b)
 			type = buffer_get_string(b, NULL);
 			data = buffer_get_string(b, NULL);
 			debug3("Got file attribute \"%s\"", type);
-			xfree(type);
-			xfree(data);
+			free(type);
+			free(data);
 		}
 	}
 	return &a;
diff --git a/usr.bin/ssh/sftp-glob.c b/usr.bin/ssh/sftp-glob.c
index 552bf9131c7..dfb370f33af 100644
--- a/usr.bin/ssh/sftp-glob.c
+++ b/usr.bin/ssh/sftp-glob.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-glob.c,v 1.23 2011/10/04 14:17:32 djm Exp $ */
+/* $OpenBSD: sftp-glob.c,v 1.24 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
  *
@@ -48,7 +48,7 @@ fudge_opendir(const char *path)
 	r = xmalloc(sizeof(*r));
 
 	if (do_readdir(cur.conn, (char *)path, &r->dir)) {
-		xfree(r);
+		free(r);
 		return(NULL);
 	}
 
@@ -76,7 +76,7 @@ static void
 fudge_closedir(struct SFTP_OPENDIR *od)
 {
 	free_sftp_dirents(od->dir);
-	xfree(od);
+	free(od);
 }
 
 static int
diff --git a/usr.bin/ssh/sftp-server.c b/usr.bin/ssh/sftp-server.c
index 87a2d278397..7e74f9d9fc0 100644
--- a/usr.bin/ssh/sftp-server.c
+++ b/usr.bin/ssh/sftp-server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-server.c,v 1.96 2013/01/04 19:26:38 jmc Exp $ */
+/* $OpenBSD: sftp-server.c,v 1.97 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2000-2004 Markus Friedl.  All rights reserved.
  *
@@ -310,11 +310,11 @@ handle_close(int handle)
 
 	if (handle_is_ok(handle, HANDLE_FILE)) {
 		ret = close(handles[handle].fd);
-		xfree(handles[handle].name);
+		free(handles[handle].name);
 		handle_unused(handle);
 	} else if (handle_is_ok(handle, HANDLE_DIR)) {
 		ret = closedir(handles[handle].dirp);
-		xfree(handles[handle].name);
+		free(handles[handle].name);
 		handle_unused(handle);
 	} else {
 		errno = ENOENT;
@@ -358,7 +358,7 @@ get_handle(void)
 	handle = get_string(&hlen);
 	if (hlen < 256)
 		val = handle_from_string(handle, hlen);
-	xfree(handle);
+	free(handle);
 	return val;
 }
 
@@ -441,7 +441,7 @@ send_handle(u_int32_t id, int handle)
 	handle_to_string(handle, &string, &hlen);
 	debug("request %u: sent handle handle %d", id, handle);
 	send_data_or_handle(SSH2_FXP_HANDLE, id, string, hlen);
-	xfree(string);
+	free(string);
 }
 
 static void
@@ -569,7 +569,7 @@ process_open(void)
 	}
 	if (status != SSH2_FX_OK)
 		send_status(id, status);
-	xfree(name);
+	free(name);
 }
 
 static void
@@ -670,7 +670,7 @@ process_write(void)
 		}
 	}
 	send_status(id, status);
-	xfree(data);
+	free(data);
 }
 
 static void
@@ -696,7 +696,7 @@ process_do_stat(int do_lstat)
 	}
 	if (status != SSH2_FX_OK)
 		send_status(id, status);
-	xfree(name);
+	free(name);
 }
 
 static void
@@ -798,7 +798,7 @@ process_setstat(void)
 			status = errno_to_portable(errno);
 	}
 	send_status(id, status);
-	xfree(name);
+	free(name);
 }
 
 static void
@@ -883,7 +883,7 @@ process_opendir(void)
 	}
 	if (status != SSH2_FX_OK)
 		send_status(id, status);
-	xfree(path);
+	free(path);
 }
 
 static void
@@ -932,13 +932,13 @@ process_readdir(void)
 		if (count > 0) {
 			send_names(id, count, stats);
 			for (i = 0; i < count; i++) {
-				xfree(stats[i].name);
-				xfree(stats[i].long_name);
+				free(stats[i].name);
+				free(stats[i].long_name);
 			}
 		} else {
 			send_status(id, SSH2_FX_EOF);
 		}
-		xfree(stats);
+		free(stats);
 	}
 }
 
@@ -961,7 +961,7 @@ process_remove(void)
 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
 	}
 	send_status(id, status);
-	xfree(name);
+	free(name);
 }
 
 static void
@@ -986,7 +986,7 @@ process_mkdir(void)
 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
 	}
 	send_status(id, status);
-	xfree(name);
+	free(name);
 }
 
 static void
@@ -1007,7 +1007,7 @@ process_rmdir(void)
 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
 	}
 	send_status(id, status);
-	xfree(name);
+	free(name);
 }
 
 static void
@@ -1020,7 +1020,7 @@ process_realpath(void)
 	id = get_int();
 	path = get_string(NULL);
 	if (path[0] == '\0') {
-		xfree(path);
+		free(path);
 		path = xstrdup(".");
 	}
 	debug3("request %u: realpath", id);
@@ -1033,7 +1033,7 @@ process_realpath(void)
 		s.name = s.long_name = resolvedname;
 		send_names(id, 1, &s);
 	}
-	xfree(path);
+	free(path);
 }
 
 static void
@@ -1087,8 +1087,8 @@ process_rename(void)
 			status = SSH2_FX_OK;
 	}
 	send_status(id, status);
-	xfree(oldpath);
-	xfree(newpath);
+	free(oldpath);
+	free(newpath);
 }
 
 static void
@@ -1113,7 +1113,7 @@ process_readlink(void)
 		s.name = s.long_name = buf;
 		send_names(id, 1, &s);
 	}
-	xfree(path);
+	free(path);
 }
 
 static void
@@ -1136,8 +1136,8 @@ process_symlink(void)
 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
 	}
 	send_status(id, status);
-	xfree(oldpath);
-	xfree(newpath);
+	free(oldpath);
+	free(newpath);
 }
 
 static void
@@ -1157,8 +1157,8 @@ process_extended_posix_rename(u_int32_t id)
 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
 	}
 	send_status(id, status);
-	xfree(oldpath);
-	xfree(newpath);
+	free(oldpath);
+	free(newpath);
 }
 
 static void
@@ -1175,7 +1175,7 @@ process_extended_statvfs(u_int32_t id)
 		send_status(id, errno_to_portable(errno));
 	else
 		send_statvfs(id, &st);
-        xfree(path);
+        free(path);
 }
 
 static void
@@ -1214,8 +1214,8 @@ process_extended_hardlink(u_int32_t id)
 		status = (ret == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
 	}
 	send_status(id, status);
-	xfree(oldpath);
-	xfree(newpath);
+	free(oldpath);
+	free(newpath);
 }
 
 static void
@@ -1236,7 +1236,7 @@ process_extended(void)
 		process_extended_hardlink(id);
 	else
 		send_status(id, SSH2_FX_OP_UNSUPPORTED);	/* MUST */
-	xfree(request);
+	free(request);
 }
 
 /* stolen from ssh-agent */
diff --git a/usr.bin/ssh/sftp.c b/usr.bin/ssh/sftp.c
index 4ca8432942b..1445affe223 100644
--- a/usr.bin/ssh/sftp.c
+++ b/usr.bin/ssh/sftp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp.c,v 1.144 2013/05/16 09:08:41 dtucker Exp $ */
+/* $OpenBSD: sftp.c,v 1.145 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
  *
@@ -290,7 +290,7 @@ local_do_ls(const char *args)
 		/* XXX: quoting - rip quoting code from ftp? */
 		snprintf(buf, len, _PATH_LS " %s", args);
 		local_do_shell(buf);
-		xfree(buf);
+		free(buf);
 	}
 }
 
@@ -321,7 +321,7 @@ make_absolute(char *p, char *pwd)
 	/* Derelativise */
 	if (p && p[0] != '/') {
 		abs_str = path_append(pwd, p);
-		xfree(p);
+		free(p);
 		return(abs_str);
 	} else
 		return(p);
@@ -531,7 +531,7 @@ process_get(struct sftp_conn *conn, char *src, char *dst, char *pwd,
 		tmp = xstrdup(g.gl_pathv[i]);
 		if ((filename = basename(tmp)) == NULL) {
 			error("basename %s: %s", tmp, strerror(errno));
-			xfree(tmp);
+			free(tmp);
 			err = -1;
 			goto out;
 		}
@@ -547,7 +547,7 @@ process_get(struct sftp_conn *conn, char *src, char *dst, char *pwd,
 		} else {
 			abs_dst = xstrdup(filename);
 		}
-		xfree(tmp);
+		free(tmp);
 
 		if (!quiet)
 			printf("Fetching %s to %s\n", g.gl_pathv[i], abs_dst);
@@ -560,12 +560,12 @@ process_get(struct sftp_conn *conn, char *src, char *dst, char *pwd,
 			    pflag || global_pflag) == -1)
 				err = -1;
 		}
-		xfree(abs_dst);
+		free(abs_dst);
 		abs_dst = NULL;
 	}
 
 out:
-	xfree(abs_src);
+	free(abs_src);
 	globfree(&g);
 	return(err);
 }
@@ -617,7 +617,7 @@ process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd,
 		tmp = xstrdup(g.gl_pathv[i]);
 		if ((filename = basename(tmp)) == NULL) {
 			error("basename %s: %s", tmp, strerror(errno));
-			xfree(tmp);
+			free(tmp);
 			err = -1;
 			goto out;
 		}
@@ -633,7 +633,7 @@ process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd,
 		} else {
 			abs_dst = make_absolute(xstrdup(filename), pwd);
 		}
-		xfree(tmp);
+		free(tmp);
 
 		if (!quiet)
 			printf("Uploading %s to %s\n", g.gl_pathv[i], abs_dst);
@@ -649,10 +649,8 @@ process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd,
 	}
 
 out:
-	if (abs_dst)
-		xfree(abs_dst);
-	if (tmp_dst)
-		xfree(tmp_dst);
+	free(abs_dst);
+	free(tmp_dst);
 	globfree(&g);
 	return(err);
 }
@@ -700,7 +698,7 @@ do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
 		/* Add any subpath that also needs to be counted */
 		tmp = path_strip(path, strip_path);
 		m += strlen(tmp);
-		xfree(tmp);
+		free(tmp);
 
 		if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) != -1)
 			width = ws.ws_col;
@@ -726,7 +724,7 @@ do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
 
 		tmp = path_append(path, d[n]->filename);
 		fname = path_strip(tmp, strip_path);
-		xfree(tmp);
+		free(tmp);
 
 		if (lflag & LS_LONG_VIEW) {
 			if (lflag & (LS_NUMERIC_VIEW|LS_SI_UNITS)) {
@@ -738,7 +736,7 @@ do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
 				lname = ls_file(fname, &sb, 1,
 				    (lflag & LS_SI_UNITS));
 				printf("%s\n", lname);
-				xfree(lname);
+				free(lname);
 			} else
 				printf("%s\n", d[n]->longname);
 		} else {
@@ -750,7 +748,7 @@ do_ls_dir(struct sftp_conn *conn, char *path, char *strip_path, int lflag)
 				c++;
 		}
 
-		xfree(fname);
+		free(fname);
 	}
 
 	if (!(lflag & LS_LONG_VIEW) && (c != 1))
@@ -820,7 +818,7 @@ do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
 			lname = ls_file(fname, g.gl_statv[i], 1,
 			    (lflag & LS_SI_UNITS));
 			printf("%s\n", lname);
-			xfree(lname);
+			free(lname);
 		} else {
 			printf("%-*s", colspace, fname);
 			if (c >= columns) {
@@ -829,7 +827,7 @@ do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path,
 			} else
 				c++;
 		}
-		xfree(fname);
+		free(fname);
 	}
 
 	if (!(lflag & LS_LONG_VIEW) && (c != 1))
@@ -1346,24 +1344,24 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
 			break;
 		}
 		if ((aa = do_stat(conn, tmp, 0)) == NULL) {
-			xfree(tmp);
+			free(tmp);
 			err = 1;
 			break;
 		}
 		if (!(aa->flags & SSH2_FILEXFER_ATTR_PERMISSIONS)) {
 			error("Can't change directory: Can't check target");
-			xfree(tmp);
+			free(tmp);
 			err = 1;
 			break;
 		}
 		if (!S_ISDIR(aa->perm)) {
 			error("Can't change directory: \"%s\" is not "
 			    "a directory", tmp);
-			xfree(tmp);
+			free(tmp);
 			err = 1;
 			break;
 		}
-		xfree(*pwd);
+		free(*pwd);
 		*pwd = tmp;
 		break;
 	case I_LS:
@@ -1496,10 +1494,8 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd,
 
 	if (g.gl_pathc)
 		globfree(&g);
-	if (path1)
-		xfree(path1);
-	if (path2)
-		xfree(path2);
+	free(path1);
+	free(path2);
 
 	/* If an unignored error occurs in batch mode we should abort. */
 	if (err_abort && err != 0)
@@ -1608,8 +1604,8 @@ complete_cmd_parse(EditLine *el, char *cmd, int lastarg, char quote,
 		complete_display(list, 0);
 
 		for (y = 0; list[y] != NULL; y++)  
-			xfree(list[y]);	
-		xfree(list);
+			free(list[y]);	
+		free(list);
 		return count;
 	}
 
@@ -1622,7 +1618,7 @@ complete_cmd_parse(EditLine *el, char *cmd, int lastarg, char quote,
 	list[count] = NULL;
 
 	if (count == 0) {
-		xfree(list);
+		free(list);
 		return 0;
 	}
 
@@ -1632,8 +1628,8 @@ complete_cmd_parse(EditLine *el, char *cmd, int lastarg, char quote,
 		complete_display(list, 0);
 
 	for (y = 0; list[y]; y++)  
-		xfree(list[y]);	
-	xfree(list);
+		free(list[y]);	
+	free(list);
 
 	if (tmp != NULL) {
 		tmplen = strlen(tmp);
@@ -1654,7 +1650,7 @@ complete_cmd_parse(EditLine *el, char *cmd, int lastarg, char quote,
 			if (y > 0 && el_insertstr(el, argterm) == -1)
 				fatal("el_insertstr failed.");
 		}
-		xfree(tmp);
+		free(tmp);
 	}
 
 	return count;
@@ -1718,7 +1714,7 @@ complete_match(EditLine *el, struct sftp_conn *conn, char *remote_path,
 		if (tmp[tmplen] == '/')
 			pwdlen = tmplen + 1;	/* track last seen '/' */
 	}
-	xfree(tmp);
+	free(tmp);
 
 	if (g.gl_matchc == 0) 
 		goto out;
@@ -1733,7 +1729,7 @@ complete_match(EditLine *el, struct sftp_conn *conn, char *remote_path,
 
 	tmp2 = complete_ambiguous(file, g.gl_pathv, g.gl_matchc);
 	tmp = path_strip(tmp2, isabs ? NULL : remote_path);
-	xfree(tmp2);
+	free(tmp2);
 
 	if (tmp == NULL)
 		goto out;
@@ -1795,7 +1791,7 @@ complete_match(EditLine *el, struct sftp_conn *conn, char *remote_path,
 		if (i > 0 && el_insertstr(el, ins) == -1)
 			fatal("el_insertstr failed.");
 	}
-	xfree(tmp);
+	free(tmp);
 
  out:
 	globfree(&g);
@@ -1821,7 +1817,7 @@ complete(EditLine *el, int ch)
 	memcpy(line, lf->buffer, cursor);
 	line[cursor] = '\0';
 	argv = makeargv(line, &carg, 1, &quote, &terminated);
-	xfree(line);
+	free(line);
 
 	/* Get all the arguments on the line */
 	len = lf->lastchar - lf->buffer;
@@ -1833,7 +1829,7 @@ complete(EditLine *el, int ch)
 	/* Ensure cursor is at EOL or a argument boundary */
 	if (line[cursor] != ' ' && line[cursor] != '\0' &&
 	    line[cursor] != '\n') {
-		xfree(line);
+		free(line);
 		return ret;
 	}
 
@@ -1861,7 +1857,7 @@ complete(EditLine *el, int ch)
 			ret = CC_REDISPLAY;
 	}
 
-	xfree(line);	
+	free(line);	
 	return ret;
 }
 
@@ -1915,9 +1911,9 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
 			snprintf(cmd, sizeof cmd, "cd \"%s\"", dir);
 			if (parse_dispatch_command(conn, cmd,
 			    &remote_path, 1) != 0) {
-				xfree(dir);
-				xfree(remote_path);
-				xfree(conn);
+				free(dir);
+				free(remote_path);
+				free(conn);
 				return (-1);
 			}
 		} else {
@@ -1930,12 +1926,12 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
 
 			err = parse_dispatch_command(conn, cmd,
 			    &remote_path, 1);
-			xfree(dir);
-			xfree(remote_path);
-			xfree(conn);
+			free(dir);
+			free(remote_path);
+			free(conn);
 			return (err);
 		}
-		xfree(dir);
+		free(dir);
 	}
 
 	setlinebuf(stdout);
@@ -1990,8 +1986,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
 		if (err != 0)
 			break;
 	}
-	xfree(remote_path);
-	xfree(conn);
+	free(remote_path);
+	free(conn);
 
 	if (el != NULL)
 		el_end(el);
diff --git a/usr.bin/ssh/ssh-add.c b/usr.bin/ssh/ssh-add.c
index 6c70f4e2649..149a9768f55 100644
--- a/usr.bin/ssh/ssh-add.c
+++ b/usr.bin/ssh/ssh-add.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-add.c,v 1.105 2012/12/05 15:42:52 markus Exp $ */
+/* $OpenBSD: ssh-add.c,v 1.106 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -84,7 +84,7 @@ clear_pass(void)
 {
 	if (pass) {
 		memset(pass, 0, strlen(pass));
-		xfree(pass);
+		free(pass);
 		pass = NULL;
 	}
 }
@@ -209,7 +209,7 @@ add_file(AuthenticationConnection *ac, const char *filename, int key_only)
 			pass = read_passphrase(msg, RP_ALLOW_STDIN);
 			if (strcmp(pass, "") == 0) {
 				clear_pass();
-				xfree(comment);
+				free(comment);
 				buffer_free(&keyblob);
 				return -1;
 			}
@@ -276,8 +276,8 @@ add_file(AuthenticationConnection *ac, const char *filename, int key_only)
 		fprintf(stderr, "The user must confirm each use of the key\n");
  out:
 	if (certpath != NULL)
-		xfree(certpath);
-	xfree(comment);
+		free(certpath);
+	free(comment);
 	key_free(private);
 
 	return ret;
@@ -302,7 +302,7 @@ update_card(AuthenticationConnection *ac, int add, const char *id)
 		    add ? "add" : "remove", id);
 		ret = -1;
 	}
-	xfree(pin);
+	free(pin);
 	return ret;
 }
 
@@ -324,14 +324,14 @@ list_identities(AuthenticationConnection *ac, int do_fp)
 				    SSH_FP_HEX);
 				printf("%d %s %s (%s)\n",
 				    key_size(key), fp, comment, key_type(key));
-				xfree(fp);
+				free(fp);
 			} else {
 				if (!key_write(key, stdout))
 					fprintf(stderr, "key_write failed");
 				fprintf(stdout, " %s\n", comment);
 			}
 			key_free(key);
-			xfree(comment);
+			free(comment);
 		}
 	}
 	if (!had_identities) {
@@ -357,7 +357,7 @@ lock_agent(AuthenticationConnection *ac, int lock)
 			passok = 0;
 		}
 		memset(p2, 0, strlen(p2));
-		xfree(p2);
+		free(p2);
 	}
 	if (passok && ssh_lock_agent(ac, lock, p1)) {
 		fprintf(stderr, "Agent %slocked.\n", lock ? "" : "un");
@@ -365,7 +365,7 @@ lock_agent(AuthenticationConnection *ac, int lock)
 	} else
 		fprintf(stderr, "Failed to %slock agent.\n", lock ? "" : "un");
 	memset(p1, 0, strlen(p1));
-	xfree(p1);
+	free(p1);
 	return (ret);
 }
 
diff --git a/usr.bin/ssh/ssh-agent.c b/usr.bin/ssh/ssh-agent.c
index ca962f1094b..af2e7c2aa6e 100644
--- a/usr.bin/ssh/ssh-agent.c
+++ b/usr.bin/ssh/ssh-agent.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-agent.c,v 1.172 2011/06/03 01:37:40 dtucker Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.173 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -158,10 +158,9 @@ static void
 free_identity(Identity *id)
 {
 	key_free(id->key);
-	if (id->provider != NULL)
-		xfree(id->provider);
-	xfree(id->comment);
-	xfree(id);
+	free(id->provider);
+	free(id->comment);
+	free(id);
 }
 
 /* return matching private key for given public key */
@@ -189,7 +188,7 @@ confirm_key(Identity *id)
 	if (ask_permission("Allow use of key %s?\nKey fingerprint %s.",
 	    id->comment, p))
 		ret = 0;
-	xfree(p);
+	free(p);
 
 	return (ret);
 }
@@ -216,7 +215,7 @@ process_request_identities(SocketEntry *e, int version)
 			u_int blen;
 			key_to_blob(id->key, &blob, &blen);
 			buffer_put_string(&msg, blob, blen);
-			xfree(blob);
+			free(blob);
 		}
 		buffer_put_cstring(&msg, id->comment);
 	}
@@ -334,10 +333,9 @@ process_sign_request2(SocketEntry *e)
 	buffer_append(&e->output, buffer_ptr(&msg),
 	    buffer_len(&msg));
 	buffer_free(&msg);
-	xfree(data);
-	xfree(blob);
-	if (signature != NULL)
-		xfree(signature);
+	free(data);
+	free(blob);
+	free(signature);
 	datafellows = odatafellows;
 }
 
@@ -364,7 +362,7 @@ process_remove_identity(SocketEntry *e, int version)
 	case 2:
 		blob = buffer_get_string(&e->request, &blen);
 		key = key_from_blob(blob, blen);
-		xfree(blob);
+		free(blob);
 		break;
 	}
 	if (key != NULL) {
@@ -492,7 +490,7 @@ process_add_identity(SocketEntry *e, int version)
 			cert = buffer_get_string(&e->request, &len);
 			if ((k = key_from_blob(cert, len)) == NULL)
 				fatal("Certificate parse failed");
-			xfree(cert);
+			free(cert);
 			key_add_private(k);
 			buffer_get_bignum2(&e->request, k->dsa->priv_key);
 			break;
@@ -502,7 +500,7 @@ process_add_identity(SocketEntry *e, int version)
 			curve = buffer_get_string(&e->request, NULL);
 			if (k->ecdsa_nid != key_curve_name_to_nid(curve))
 				fatal("%s: curve names mismatch", __func__);
-			xfree(curve);
+			free(curve);
 			k->ecdsa = EC_KEY_new_by_curve_name(k->ecdsa_nid);
 			if (k->ecdsa == NULL)
 				fatal("%s: EC_KEY_new_by_curve_name failed",
@@ -533,7 +531,7 @@ process_add_identity(SocketEntry *e, int version)
 			cert = buffer_get_string(&e->request, &len);
 			if ((k = key_from_blob(cert, len)) == NULL)
 				fatal("Certificate parse failed");
-			xfree(cert);
+			free(cert);
 			key_add_private(k);
 			if ((exponent = BN_new()) == NULL)
 				fatal("%s: BN_new failed", __func__);
@@ -564,7 +562,7 @@ process_add_identity(SocketEntry *e, int version)
 			cert = buffer_get_string(&e->request, &len);
 			if ((k = key_from_blob(cert, len)) == NULL)
 				fatal("Certificate parse failed");
-			xfree(cert);
+			free(cert);
 			key_add_private(k);
 			buffer_get_bignum2(&e->request, k->rsa->d);
 			buffer_get_bignum2(&e->request, k->rsa->iqmp);
@@ -572,11 +570,11 @@ process_add_identity(SocketEntry *e, int version)
 			buffer_get_bignum2(&e->request, k->rsa->q);
 			break;
 		default:
-			xfree(type_name);
+			free(type_name);
 			buffer_clear(&e->request);
 			goto send;
 		}
-		xfree(type_name);
+		free(type_name);
 		break;
 	}
 	/* enable blinding */
@@ -594,7 +592,7 @@ process_add_identity(SocketEntry *e, int version)
 	}
 	comment = buffer_get_string(&e->request, NULL);
 	if (k == NULL) {
-		xfree(comment);
+		free(comment);
 		goto send;
 	}
 	while (buffer_len(&e->request)) {
@@ -608,7 +606,7 @@ process_add_identity(SocketEntry *e, int version)
 		default:
 			error("process_add_identity: "
 			    "Unknown constraint type %d", type);
-			xfree(comment);
+			free(comment);
 			key_free(k);
 			goto send;
 		}
@@ -624,7 +622,7 @@ process_add_identity(SocketEntry *e, int version)
 		tab->nentries++;
 	} else {
 		key_free(k);
-		xfree(id->comment);
+		free(id->comment);
 	}
 	id->comment = comment;
 	id->death = death;
@@ -646,7 +644,7 @@ process_lock_agent(SocketEntry *e, int lock)
 	if (locked && !lock && strcmp(passwd, lock_passwd) == 0) {
 		locked = 0;
 		memset(lock_passwd, 0, strlen(lock_passwd));
-		xfree(lock_passwd);
+		free(lock_passwd);
 		lock_passwd = NULL;
 		success = 1;
 	} else if (!locked && lock) {
@@ -655,7 +653,7 @@ process_lock_agent(SocketEntry *e, int lock)
 		success = 1;
 	}
 	memset(passwd, 0, strlen(passwd));
-	xfree(passwd);
+	free(passwd);
 
 	buffer_put_int(&e->output, 1);
 	buffer_put_char(&e->output,
@@ -728,12 +726,9 @@ process_add_smartcard_key(SocketEntry *e)
 		keys[i] = NULL;
 	}
 send:
-	if (pin)
-		xfree(pin);
-	if (provider)
-		xfree(provider);
-	if (keys)
-		xfree(keys);
+	free(pin);
+	free(provider);
+	free(keys);
 	buffer_put_int(&e->output, 1);
 	buffer_put_char(&e->output,
 	    success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
@@ -749,7 +744,7 @@ process_remove_smartcard_key(SocketEntry *e)
 
 	provider = buffer_get_string(&e->request, NULL);
 	pin = buffer_get_string(&e->request, NULL);
-	xfree(pin);
+	free(pin);
 
 	for (version = 1; version < 3; version++) {
 		tab = idtab_lookup(version);
@@ -767,7 +762,7 @@ process_remove_smartcard_key(SocketEntry *e)
 	else
 		error("process_remove_smartcard_key:"
 		    " pkcs11_del_provider failed");
-	xfree(provider);
+	free(provider);
 	buffer_put_int(&e->output, 1);
 	buffer_put_char(&e->output,
 	    success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
@@ -932,10 +927,8 @@ prepare_select(fd_set **fdrp, fd_set **fdwp, int *fdl, u_int *nallocp,
 
 	sz = howmany(n+1, NFDBITS) * sizeof(fd_mask);
 	if (*fdrp == NULL || sz > *nallocp) {
-		if (*fdrp)
-			xfree(*fdrp);
-		if (*fdwp)
-			xfree(*fdwp);
+		free(*fdrp);
+		free(*fdwp);
 		*fdrp = xmalloc(sz);
 		*fdwp = xmalloc(sz);
 		*nallocp = sz;
diff --git a/usr.bin/ssh/ssh-dss.c b/usr.bin/ssh/ssh-dss.c
index 9ffd87fabd9..24f8123b5e6 100644
--- a/usr.bin/ssh/ssh-dss.c
+++ b/usr.bin/ssh/ssh-dss.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-dss.c,v 1.27 2010/08/31 09:58:37 djm Exp $ */
+/* $OpenBSD: ssh-dss.c,v 1.28 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -134,17 +134,17 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
 		if (strcmp("ssh-dss", ktype) != 0) {
 			error("ssh_dss_verify: cannot handle type %s", ktype);
 			buffer_free(&b);
-			xfree(ktype);
+			free(ktype);
 			return -1;
 		}
-		xfree(ktype);
+		free(ktype);
 		sigblob = buffer_get_string(&b, &len);
 		rlen = buffer_len(&b);
 		buffer_free(&b);
 		if (rlen != 0) {
 			error("ssh_dss_verify: "
 			    "remaining bytes in signature %d", rlen);
-			xfree(sigblob);
+			free(sigblob);
 			return -1;
 		}
 	}
@@ -166,7 +166,7 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
 
 	/* clean up */
 	memset(sigblob, 0, len);
-	xfree(sigblob);
+	free(sigblob);
 
 	/* sha1 the data */
 	EVP_DigestInit(&md, evp_md);
diff --git a/usr.bin/ssh/ssh-ecdsa.c b/usr.bin/ssh/ssh-ecdsa.c
index 42e81c7917e..cdac9d65b7d 100644
--- a/usr.bin/ssh/ssh-ecdsa.c
+++ b/usr.bin/ssh/ssh-ecdsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-ecdsa.c,v 1.5 2012/01/08 13:17:11 miod Exp $ */
+/* $OpenBSD: ssh-ecdsa.c,v 1.6 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
@@ -115,16 +115,16 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
 	if (strcmp(key_ssh_name_plain(key), ktype) != 0) {
 		error("%s: cannot handle type %s", __func__, ktype);
 		buffer_free(&b);
-		xfree(ktype);
+		free(ktype);
 		return -1;
 	}
-	xfree(ktype);
+	free(ktype);
 	sigblob = buffer_get_string(&b, &len);
 	rlen = buffer_len(&b);
 	buffer_free(&b);
 	if (rlen != 0) {
 		error("%s: remaining bytes in signature %d", __func__, rlen);
-		xfree(sigblob);
+		free(sigblob);
 		return -1;
 	}
 
@@ -145,7 +145,7 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
 
 	/* clean up */
 	memset(sigblob, 0, len);
-	xfree(sigblob);
+	free(sigblob);
 
 	/* hash the data */
 	EVP_DigestInit(&md, evp_md);
diff --git a/usr.bin/ssh/ssh-keygen.c b/usr.bin/ssh/ssh-keygen.c
index a6e9549c3a5..813663f20e2 100644
--- a/usr.bin/ssh/ssh-keygen.c
+++ b/usr.bin/ssh/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.226 2013/04/19 01:01:00 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.227 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -245,7 +245,7 @@ load_identity(char *filename)
 			    RP_ALLOW_STDIN);
 		prv = key_load_private(filename, pass, NULL);
 		memset(pass, 0, strlen(pass));
-		xfree(pass);
+		free(pass);
 	}
 	return prv;
 }
@@ -281,7 +281,7 @@ do_convert_to_ssh2(struct passwd *pw, Key *k)
 	dump_base64(stdout, blob, len);
 	fprintf(stdout, "%s\n", SSH_COM_PUBLIC_END);
 	key_free(k);
-	xfree(blob);
+	free(blob);
 	exit(0);
 }
 
@@ -406,12 +406,12 @@ do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
 	debug("ignore (%d %d %d %d)", i1, i2, i3, i4);
 	if (strcmp(cipher, "none") != 0) {
 		error("unsupported cipher %s", cipher);
-		xfree(cipher);
+		free(cipher);
 		buffer_free(&b);
-		xfree(type);
+		free(type);
 		return NULL;
 	}
-	xfree(cipher);
+	free(cipher);
 
 	if (strstr(type, "dsa")) {
 		ktype = KEY_DSA;
@@ -419,11 +419,11 @@ do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
 		ktype = KEY_RSA;
 	} else {
 		buffer_free(&b);
-		xfree(type);
+		free(type);
 		return NULL;
 	}
 	key = key_new_private(ktype);
-	xfree(type);
+	free(type);
 
 	switch (key->type) {
 	case KEY_DSA:
@@ -466,7 +466,7 @@ do_convert_private_ssh2_from_blob(u_char *blob, u_int blen)
 	/* try the key */
 	key_sign(key, &sig, &slen, data, sizeof(data));
 	key_verify(key, sig, slen, data, sizeof(data));
-	xfree(sig);
+	free(sig);
 	return key;
 }
 
@@ -733,15 +733,15 @@ do_download(struct passwd *pw)
 			    fp, key_type(keys[i]));
 			if (log_level >= SYSLOG_LEVEL_VERBOSE)
 				printf("%s\n", ra);
-			xfree(ra);
-			xfree(fp);
+			free(ra);
+			free(fp);
 		} else {
 			key_write(keys[i], stdout);
 			fprintf(stdout, "\n");
 		}
 		key_free(keys[i]);
 	}
-	xfree(keys);
+	free(keys);
 	pkcs11_terminate();
 	exit(0);
 #else
@@ -778,13 +778,13 @@ do_fingerprint(struct passwd *pw)
 		if (log_level >= SYSLOG_LEVEL_VERBOSE)
 			printf("%s\n", ra);
 		key_free(public);
-		xfree(comment);
-		xfree(ra);
-		xfree(fp);
+		free(comment);
+		free(ra);
+		free(fp);
 		exit(0);
 	}
 	if (comment) {
-		xfree(comment);
+		free(comment);
 		comment = NULL;
 	}
 
@@ -843,8 +843,8 @@ do_fingerprint(struct passwd *pw)
 		    comment ? comment : "no comment", key_type(public));
 		if (log_level >= SYSLOG_LEVEL_VERBOSE)
 			printf("%s\n", ra);
-		xfree(ra);
-		xfree(fp);
+		free(ra);
+		free(fp);
 		key_free(public);
 		invalid = 0;
 	}
@@ -965,8 +965,8 @@ printhost(FILE *f, const char *name, Key *public, int ca, int hash)
 		    key_type(public));
 		if (log_level >= SYSLOG_LEVEL_VERBOSE)
 			printf("%s\n", ra);
-		xfree(ra);
-		xfree(fp);
+		free(ra);
+		free(fp);
 	} else {
 		if (hash && (name = host_hash(name, NULL, 0)) == NULL)
 			fatal("hash_host failed");
@@ -992,7 +992,7 @@ do_known_hosts(struct passwd *pw, const char *name)
 		if (strlcpy(identity_file, cp, sizeof(identity_file)) >=
 		    sizeof(identity_file))
 			fatal("Specified known hosts path too long");
-		xfree(cp);
+		free(cp);
 		have_identity = 1;
 	}
 	if ((in = fopen(identity_file, "r")) == NULL)
@@ -1223,7 +1223,7 @@ do_change_passphrase(struct passwd *pw)
 		private = key_load_private(identity_file, old_passphrase,
 		    &comment);
 		memset(old_passphrase, 0, strlen(old_passphrase));
-		xfree(old_passphrase);
+		free(old_passphrase);
 		if (private == NULL) {
 			printf("Bad passphrase.\n");
 			exit(1);
@@ -1246,30 +1246,30 @@ do_change_passphrase(struct passwd *pw)
 		if (strcmp(passphrase1, passphrase2) != 0) {
 			memset(passphrase1, 0, strlen(passphrase1));
 			memset(passphrase2, 0, strlen(passphrase2));
-			xfree(passphrase1);
-			xfree(passphrase2);
+			free(passphrase1);
+			free(passphrase2);
 			printf("Pass phrases do not match.  Try again.\n");
 			exit(1);
 		}
 		/* Destroy the other copy. */
 		memset(passphrase2, 0, strlen(passphrase2));
-		xfree(passphrase2);
+		free(passphrase2);
 	}
 
 	/* Save the file using the new passphrase. */
 	if (!key_save_private(private, identity_file, passphrase1, comment)) {
 		printf("Saving the key failed: %s.\n", identity_file);
 		memset(passphrase1, 0, strlen(passphrase1));
-		xfree(passphrase1);
+		free(passphrase1);
 		key_free(private);
-		xfree(comment);
+		free(comment);
 		exit(1);
 	}
 	/* Destroy the passphrase and the copy of the key in memory. */
 	memset(passphrase1, 0, strlen(passphrase1));
-	xfree(passphrase1);
+	free(passphrase1);
 	key_free(private);		 /* Destroys contents */
-	xfree(comment);
+	free(comment);
 
 	printf("Your identification has been saved with the new passphrase.\n");
 	exit(0);
@@ -1297,11 +1297,11 @@ do_print_resource_record(struct passwd *pw, char *fname, char *hname)
 	if (public != NULL) {
 		export_dns_rr(hname, public, stdout, print_generic);
 		key_free(public);
-		xfree(comment);
+		free(comment);
 		return 1;
 	}
 	if (comment)
-		xfree(comment);
+		free(comment);
 
 	printf("failed to read v2 public key from %s.\n", fname);
 	exit(1);
@@ -1339,7 +1339,7 @@ do_change_comment(struct passwd *pw)
 		private = key_load_private(identity_file, passphrase, &comment);
 		if (private == NULL) {
 			memset(passphrase, 0, strlen(passphrase));
-			xfree(passphrase);
+			free(passphrase);
 			printf("Bad passphrase.\n");
 			exit(1);
 		}
@@ -1370,13 +1370,13 @@ do_change_comment(struct passwd *pw)
 	if (!key_save_private(private, identity_file, passphrase, new_comment)) {
 		printf("Saving the key failed: %s.\n", identity_file);
 		memset(passphrase, 0, strlen(passphrase));
-		xfree(passphrase);
+		free(passphrase);
 		key_free(private);
-		xfree(comment);
+		free(comment);
 		exit(1);
 	}
 	memset(passphrase, 0, strlen(passphrase));
-	xfree(passphrase);
+	free(passphrase);
 	public = key_from_private(private);
 	key_free(private);
 
@@ -1397,7 +1397,7 @@ do_change_comment(struct passwd *pw)
 	fprintf(f, " %s\n", new_comment);
 	fclose(f);
 
-	xfree(comment);
+	free(comment);
 
 	printf("The comment in your key file has been changed.\n");
 	exit(0);
@@ -1514,7 +1514,7 @@ load_pkcs11_key(char *path)
 		}
 		key_free(keys[i]);
 	}
-	xfree(keys);
+	free(keys);
 	key_free(public);
 	return private;
 #else
@@ -1558,7 +1558,7 @@ do_ca_sign(struct passwd *pw, int argc, char **argv)
 			fatal("No PKCS#11 key matching %s found", ca_key_path);
 	} else if ((ca = load_identity(tmp)) == NULL)
 		fatal("Couldn't load CA key \"%s\"", tmp);
-	xfree(tmp);
+	free(tmp);
 
 	for (i = 0; i < argc; i++) {
 		/* Split list of principals */
@@ -1571,7 +1571,7 @@ do_ca_sign(struct passwd *pw, int argc, char **argv)
 				if (*(plist[n] = xstrdup(cp)) == '\0')
 					fatal("Empty principal name");
 			}
-			xfree(otmp);
+			free(otmp);
 		}
 	
 		tmp = tilde_expand_filename(argv[i], pw->pw_uid);
@@ -1609,7 +1609,7 @@ do_ca_sign(struct passwd *pw, int argc, char **argv)
 		if ((cp = strrchr(tmp, '.')) != NULL && strcmp(cp, ".pub") == 0)
 			*cp = '\0';
 		xasprintf(&out, "%s-cert.pub", tmp);
-		xfree(tmp);
+		free(tmp);
 
 		if ((fd = open(out, O_WRONLY|O_CREAT|O_TRUNC, 0644)) == -1)
 			fatal("Could not open \"%s\" for writing: %s", out,
@@ -1632,7 +1632,7 @@ do_ca_sign(struct passwd *pw, int argc, char **argv)
 		}
 
 		key_free(public);
-		xfree(out);
+		free(out);
 	}
 	pkcs11_terminate();
 	exit(0);
@@ -1729,7 +1729,7 @@ parse_cert_times(char *timespec)
 
 	if (cert_valid_to <= cert_valid_from)
 		fatal("Empty certificate validity interval");
-	xfree(from);
+	free(from);
 }
 
 static void
@@ -1807,13 +1807,13 @@ show_options(const Buffer *optbuf, int v00, int in_critical)
 		    strcmp(name, "source-address") == 0)) {
 			data = buffer_get_string(&option, NULL);
 			printf(" %s\n", data);
-			xfree(data);
+			free(data);
 		} else {
 			printf(" UNKNOWN OPTION (len %u)\n",
 			    buffer_len(&option));
 			buffer_clear(&option);
 		}
-		xfree(name);
+		free(name);
 		if (buffer_len(&option) != 0)
 			fatal("Option corrupt: extra data at end");
 	}
@@ -2049,7 +2049,7 @@ do_gen_krl(struct passwd *pw, int updating, int argc, char **argv)
 		tmp = tilde_expand_filename(ca_key_path, pw->pw_uid);
 		if ((ca = key_load_public(tmp, NULL)) == NULL)
 			fatal("Cannot load CA public key %s", tmp);
-		xfree(tmp);
+		free(tmp);
 	}
 
 	if (updating)
@@ -2583,14 +2583,14 @@ passphrase_again:
 			 */
 			memset(passphrase1, 0, strlen(passphrase1));
 			memset(passphrase2, 0, strlen(passphrase2));
-			xfree(passphrase1);
-			xfree(passphrase2);
+			free(passphrase1);
+			free(passphrase2);
 			printf("Passphrases do not match.  Try again.\n");
 			goto passphrase_again;
 		}
 		/* Clear the other copy of the passphrase. */
 		memset(passphrase2, 0, strlen(passphrase2));
-		xfree(passphrase2);
+		free(passphrase2);
 	}
 
 	if (identity_comment) {
@@ -2604,12 +2604,12 @@ passphrase_again:
 	if (!key_save_private(private, identity_file, passphrase1, comment)) {
 		printf("Saving the key failed: %s.\n", identity_file);
 		memset(passphrase1, 0, strlen(passphrase1));
-		xfree(passphrase1);
+		free(passphrase1);
 		exit(1);
 	}
 	/* Clear the passphrase. */
 	memset(passphrase1, 0, strlen(passphrase1));
-	xfree(passphrase1);
+	free(passphrase1);
 
 	/* Clear the private key and the random number generator. */
 	key_free(private);
@@ -2644,8 +2644,8 @@ passphrase_again:
 		printf("%s %s\n", fp, comment);
 		printf("The key's randomart image is:\n");
 		printf("%s\n", ra);
-		xfree(ra);
-		xfree(fp);
+		free(ra);
+		free(fp);
 	}
 
 	key_free(public);
diff --git a/usr.bin/ssh/ssh-keyscan.c b/usr.bin/ssh/ssh-keyscan.c
index 6a5b93137a2..660e4e06efa 100644
--- a/usr.bin/ssh/ssh-keyscan.c
+++ b/usr.bin/ssh/ssh-keyscan.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keyscan.c,v 1.86 2012/04/11 13:34:17 djm Exp $ */
+/* $OpenBSD: ssh-keyscan.c,v 1.87 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
  *
@@ -248,7 +248,7 @@ keygrab_ssh2(con *c)
 		exit(1);
 	}
 	nonfatal_fatal = 0;
-	xfree(c->c_kex);
+	free(c->c_kex);
 	c->c_kex = NULL;
 	packet_close();
 
@@ -314,7 +314,7 @@ conalloc(char *iname, char *oname, int keytype)
 	do {
 		name = xstrsep(&namelist, ",");
 		if (!name) {
-			xfree(namebase);
+			free(namebase);
 			return (-1);
 		}
 	} while ((s = tcpconnect(name)) < 0);
@@ -348,10 +348,10 @@ confree(int s)
 	if (s >= maxfd || fdcon[s].c_status == CS_UNUSED)
 		fatal("confree: attempt to free bad fdno %d", s);
 	close(s);
-	xfree(fdcon[s].c_namebase);
-	xfree(fdcon[s].c_output_name);
+	free(fdcon[s].c_namebase);
+	free(fdcon[s].c_output_name);
 	if (fdcon[s].c_status == CS_KEYS)
-		xfree(fdcon[s].c_data);
+		free(fdcon[s].c_data);
 	fdcon[s].c_status = CS_UNUSED;
 	fdcon[s].c_keytype = 0;
 	TAILQ_REMOVE(&tq, &fdcon[s], c_link);
@@ -538,8 +538,8 @@ conloop(void)
 		} else if (FD_ISSET(i, r))
 			conread(i);
 	}
-	xfree(r);
-	xfree(e);
+	free(r);
+	free(e);
 
 	c = TAILQ_FIRST(&tq);
 	while (c && (c->c_tv.tv_sec < now.tv_sec ||
diff --git a/usr.bin/ssh/ssh-keysign.c b/usr.bin/ssh/ssh-keysign.c
index 2443f921462..822cc291ead 100644
--- a/usr.bin/ssh/ssh-keysign.c
+++ b/usr.bin/ssh/ssh-keysign.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keysign.c,v 1.36 2011/02/16 00:31:14 djm Exp $ */
+/* $OpenBSD: ssh-keysign.c,v 1.37 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2002 Markus Friedl.  All rights reserved.
  *
@@ -73,7 +73,7 @@ valid_request(struct passwd *pw, char *host, Key **ret, u_char *data,
 	p = buffer_get_string(&b, &len);
 	if (len != 20 && len != 32)
 		fail++;
-	xfree(p);
+	free(p);
 
 	if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
 		fail++;
@@ -85,13 +85,13 @@ valid_request(struct passwd *pw, char *host, Key **ret, u_char *data,
 	p = buffer_get_string(&b, NULL);
 	if (strcmp("ssh-connection", p) != 0)
 		fail++;
-	xfree(p);
+	free(p);
 
 	/* method */
 	p = buffer_get_string(&b, NULL);
 	if (strcmp("hostbased", p) != 0)
 		fail++;
-	xfree(p);
+	free(p);
 
 	/* pubkey */
 	pkalg = buffer_get_string(&b, NULL);
@@ -104,8 +104,8 @@ valid_request(struct passwd *pw, char *host, Key **ret, u_char *data,
 		fail++;
 	else if (key->type != pktype)
 		fail++;
-	xfree(pkalg);
-	xfree(pkblob);
+	free(pkalg);
+	free(pkblob);
 
 	/* client host name, handle trailing dot */
 	p = buffer_get_string(&b, &len);
@@ -116,14 +116,14 @@ valid_request(struct passwd *pw, char *host, Key **ret, u_char *data,
 		fail++;
 	else if (strncasecmp(host, p, len - 1) != 0)
 		fail++;
-	xfree(p);
+	free(p);
 
 	/* local user */
 	p = buffer_get_string(&b, NULL);
 
 	if (strcmp(pw->pw_name, p) != 0)
 		fail++;
-	xfree(p);
+	free(p);
 
 	/* end of message */
 	if (buffer_len(&b) != 0)
@@ -225,7 +225,7 @@ main(int argc, char **argv)
 	data = buffer_get_string(&b, &dlen);
 	if (valid_request(pw, host, &key, data, dlen) < 0)
 		fatal("not a valid request");
-	xfree(host);
+	free(host);
 
 	found = 0;
 	for (i = 0; i < NUM_KEYTYPES; i++) {
@@ -240,7 +240,7 @@ main(int argc, char **argv)
 
 	if (key_sign(keys[i], &signature, &slen, data, dlen) != 0)
 		fatal("key_sign failed");
-	xfree(data);
+	free(data);
 
 	/* send reply */
 	buffer_clear(&b);
diff --git a/usr.bin/ssh/ssh-pkcs11-client.c b/usr.bin/ssh/ssh-pkcs11-client.c
index d37ea48a887..104051e7adf 100644
--- a/usr.bin/ssh/ssh-pkcs11-client.c
+++ b/usr.bin/ssh/ssh-pkcs11-client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11-client.c,v 1.3 2012/01/16 20:34:09 miod Exp $ */
+/* $OpenBSD: ssh-pkcs11-client.c,v 1.4 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  *
@@ -115,7 +115,7 @@ pkcs11_rsa_private_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa,
 	buffer_put_string(&msg, blob, blen);
 	buffer_put_string(&msg, from, flen);
 	buffer_put_int(&msg, 0);
-	xfree(blob);
+	free(blob);
 	send_msg(&msg);
 	buffer_clear(&msg);
 
@@ -125,7 +125,7 @@ pkcs11_rsa_private_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa,
 			memcpy(to, signature, slen);
 			ret = slen;
 		}
-		xfree(signature);
+		free(signature);
 	}
 	buffer_free(&msg);
 	return (ret);
@@ -199,11 +199,11 @@ pkcs11_add_provider(char *name, char *pin, Key ***keysp)
 		*keysp = xcalloc(nkeys, sizeof(Key *));
 		for (i = 0; i < nkeys; i++) {
 			blob = buffer_get_string(&msg, &blen);
-			xfree(buffer_get_string(&msg, NULL));
+			free(buffer_get_string(&msg, NULL));
 			k = key_from_blob(blob, blen);
 			wrap_key(k->rsa);
 			(*keysp)[i] = k;
-			xfree(blob);
+			free(blob);
 		}
 	} else {
 		nkeys = -1;
diff --git a/usr.bin/ssh/ssh-pkcs11-helper.c b/usr.bin/ssh/ssh-pkcs11-helper.c
index 2c6db5c1051..b9fce86e7ab 100644
--- a/usr.bin/ssh/ssh-pkcs11-helper.c
+++ b/usr.bin/ssh/ssh-pkcs11-helper.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11-helper.c,v 1.5 2013/05/10 10:13:50 dtucker Exp $ */
+/* $OpenBSD: ssh-pkcs11-helper.c,v 1.6 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  *
@@ -72,7 +72,7 @@ del_keys_by_name(char *name)
 		nxt = TAILQ_NEXT(ki, next);
 		if (!strcmp(ki->providername, name)) {
 			TAILQ_REMOVE(&pkcs11_keylist, ki, next);
-			xfree(ki->providername);
+			free(ki->providername);
 			key_free(ki->key);
 			free(ki);
 		}
@@ -123,15 +123,15 @@ process_add(void)
 			key_to_blob(keys[i], &blob, &blen);
 			buffer_put_string(&msg, blob, blen);
 			buffer_put_cstring(&msg, name);
-			xfree(blob);
+			free(blob);
 			add_key(keys[i], name);
 		}
-		xfree(keys);
+		free(keys);
 	} else {
 		buffer_put_char(&msg, SSH_AGENT_FAILURE);
 	}
-	xfree(pin);
-	xfree(name);
+	free(pin);
+	free(name);
 	send_msg(&msg);
 	buffer_free(&msg);
 }
@@ -150,8 +150,8 @@ process_del(void)
 		 buffer_put_char(&msg, SSH_AGENT_SUCCESS);
 	else
 		 buffer_put_char(&msg, SSH_AGENT_FAILURE);
-	xfree(pin);
-	xfree(name);
+	free(pin);
+	free(name);
 	send_msg(&msg);
 	buffer_free(&msg);
 }
@@ -188,10 +188,9 @@ process_sign(void)
 	} else {
 		buffer_put_char(&msg, SSH_AGENT_FAILURE);
 	}
-	xfree(data);
-	xfree(blob);
-	if (signature != NULL)
-		xfree(signature);
+	free(data);
+	free(blob);
+	free(signature);
 	send_msg(&msg);
 	buffer_free(&msg);
 }
diff --git a/usr.bin/ssh/ssh-pkcs11.c b/usr.bin/ssh/ssh-pkcs11.c
index dbcefff5010..e7fb803aeec 100644
--- a/usr.bin/ssh/ssh-pkcs11.c
+++ b/usr.bin/ssh/ssh-pkcs11.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-pkcs11.c,v 1.6 2010/06/08 21:32:19 markus Exp $ */
+/* $OpenBSD: ssh-pkcs11.c,v 1.7 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2010 Markus Friedl.  All rights reserved.
  *
@@ -114,9 +114,9 @@ pkcs11_provider_unref(struct pkcs11_provider *p)
 	if (--p->refcount <= 0) {
 		if (p->valid)
 			error("pkcs11_provider_unref: %p still valid", p);
-		xfree(p->slotlist);
-		xfree(p->slotinfo);
-		xfree(p);
+		free(p->slotlist);
+		free(p->slotinfo);
+		free(p);
 	}
 }
 
@@ -174,9 +174,8 @@ pkcs11_rsa_finish(RSA *rsa)
 			rv = k11->orig_finish(rsa);
 		if (k11->provider)
 			pkcs11_provider_unref(k11->provider);
-		if (k11->keyid)
-			xfree(k11->keyid);
-		xfree(k11);
+		free(k11->keyid);
+		free(k11);
 	}
 	return (rv);
 }
@@ -255,11 +254,11 @@ pkcs11_rsa_private_encrypt(int flen, const u_char *from, u_char *to, RSA *rsa,
 			return (-1);	/* bail out */
 		if ((rv = f->C_Login(si->session, CKU_USER, pin, strlen(pin)))
 		    != CKR_OK) {
-			xfree(pin);
+			free(pin);
 			error("C_Login failed: %lu", rv);
 			return (-1);
 		}
-		xfree(pin);
+		free(pin);
 		si->logged_in = 1;
 	}
 	key_filter[1].pValue = k11->keyid;
@@ -455,7 +454,7 @@ pkcs11_fetch_keys(struct pkcs11_provider *p, CK_ULONG slotidx, Key ***keysp,
 			}
 		}
 		for (i = 0; i < 3; i++)
-			xfree(attribs[i].pValue);
+			free(attribs[i].pValue);
 	}
 	if ((rv = f->C_FindObjectsFinal(session)) != CKR_OK)
 		error("C_FindObjectsFinal failed: %lu", rv);
@@ -565,11 +564,9 @@ fail:
 	if (need_finalize && (rv = f->C_Finalize(NULL)) != CKR_OK)
 		error("C_Finalize failed: %lu", rv);
 	if (p) {
-		if (p->slotlist)
-			xfree(p->slotlist);
-		if (p->slotinfo)
-			xfree(p->slotinfo);
-		xfree(p);
+		free(p->slotlist);
+		free(p->slotinfo);
+		free(p);
 	}
 	if (handle)
 		dlclose(handle);
diff --git a/usr.bin/ssh/ssh-rsa.c b/usr.bin/ssh/ssh-rsa.c
index 5766582976f..90e0cba263b 100644
--- a/usr.bin/ssh/ssh-rsa.c
+++ b/usr.bin/ssh/ssh-rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-rsa.c,v 1.45 2010/08/31 09:58:37 djm Exp $ */
+/* $OpenBSD: ssh-rsa.c,v 1.46 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org>
  *
@@ -69,7 +69,7 @@ ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp,
 
 		error("ssh_rsa_sign: RSA_sign failed: %s",
 		    ERR_error_string(ecode, NULL));
-		xfree(sig);
+		free(sig);
 		return -1;
 	}
 	if (len < slen) {
@@ -79,7 +79,7 @@ ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp,
 		memset(sig, 0, diff);
 	} else if (len > slen) {
 		error("ssh_rsa_sign: slen %u slen2 %u", slen, len);
-		xfree(sig);
+		free(sig);
 		return -1;
 	}
 	/* encode signature */
@@ -95,7 +95,7 @@ ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp,
 	}
 	buffer_free(&b);
 	memset(sig, 's', slen);
-	xfree(sig);
+	free(sig);
 
 	return 0;
 }
@@ -128,23 +128,23 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
 	if (strcmp("ssh-rsa", ktype) != 0) {
 		error("ssh_rsa_verify: cannot handle type %s", ktype);
 		buffer_free(&b);
-		xfree(ktype);
+		free(ktype);
 		return -1;
 	}
-	xfree(ktype);
+	free(ktype);
 	sigblob = buffer_get_string(&b, &len);
 	rlen = buffer_len(&b);
 	buffer_free(&b);
 	if (rlen != 0) {
 		error("ssh_rsa_verify: remaining bytes in signature %d", rlen);
-		xfree(sigblob);
+		free(sigblob);
 		return -1;
 	}
 	/* RSA_verify expects a signature of RSA_size */
 	modlen = RSA_size(key->rsa);
 	if (len > modlen) {
 		error("ssh_rsa_verify: len %u > modlen %u", len, modlen);
-		xfree(sigblob);
+		free(sigblob);
 		return -1;
 	} else if (len < modlen) {
 		u_int diff = modlen - len;
@@ -158,7 +158,7 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
 	nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1;
 	if ((evp_md = EVP_get_digestbynid(nid)) == NULL) {
 		error("ssh_rsa_verify: EVP_get_digestbynid %d failed", nid);
-		xfree(sigblob);
+		free(sigblob);
 		return -1;
 	}
 	EVP_DigestInit(&md, evp_md);
@@ -168,7 +168,7 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
 	ret = openssh_RSA_verify(nid, digest, dlen, sigblob, len, key->rsa);
 	memset(digest, 'd', sizeof(digest));
 	memset(sigblob, 's', len);
-	xfree(sigblob);
+	free(sigblob);
 	debug("ssh_rsa_verify: signature %scorrect", (ret==0) ? "in" : "");
 	return ret;
 }
@@ -259,7 +259,6 @@ openssh_RSA_verify(int type, u_char *hash, u_int hashlen,
 	}
 	ret = 1;
 done:
-	if (decrypted)
-		xfree(decrypted);
+	free(decrypted);
 	return ret;
 }
diff --git a/usr.bin/ssh/ssh.c b/usr.bin/ssh/ssh.c
index f1c25279ed0..386991ad428 100644
--- a/usr.bin/ssh/ssh.c
+++ b/usr.bin/ssh/ssh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.377 2013/04/19 11:10:18 djm Exp $ */
+/* $OpenBSD: ssh.c,v 1.378 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -213,7 +213,7 @@ tilde_expand_paths(char **paths, u_int num_paths)
 
 	for (i = 0; i < num_paths; i++) {
 		cp = tilde_expand_filename(paths[i], original_real_uid);
-		xfree(paths[i]);
+		free(paths[i]);
 		paths[i] = cp;
 	}
 }
@@ -444,7 +444,7 @@ main(int ac, char **av)
 			if (parse_forward(&fwd, optarg, 1, 0)) {
 				stdio_forward_host = fwd.listen_host;
 				stdio_forward_port = fwd.listen_port;
-				xfree(fwd.connect_host);
+				free(fwd.connect_host);
 			} else {
 				fprintf(stderr,
 				    "Bad stdio forwarding specification '%s'\n",
@@ -572,7 +572,7 @@ main(int ac, char **av)
 			    line, "command-line", 0, &dummy, SSHCONF_USERCONF)
 			    != 0)
 				exit(255);
-			xfree(line);
+			free(line);
 			break;
 		case 's':
 			subsystem_flag = 1;
@@ -659,7 +659,7 @@ main(int ac, char **av)
 		fatal("Can't specify both -y and -E");
 	if (logfile != NULL) {
 		log_redirect_stderr_to(logfile);
-		xfree(logfile);
+		free(logfile);
 	}
 	log_init(argv0,
 	    options.log_level == -1 ? SYSLOG_LEVEL_INFO : options.log_level,
@@ -747,7 +747,7 @@ main(int ac, char **av)
 		    "p", portstr, "u", pw->pw_name, "L", shorthost,
 		    (char *)NULL);
 		debug3("expanded LocalCommand: %s", options.local_command);
-		xfree(cp);
+		free(cp);
 	}
 
 	/* force lowercase for hostkey matching */
@@ -759,24 +759,24 @@ main(int ac, char **av)
 
 	if (options.proxy_command != NULL &&
 	    strcmp(options.proxy_command, "none") == 0) {
-		xfree(options.proxy_command);
+		free(options.proxy_command);
 		options.proxy_command = NULL;
 	}
 	if (options.control_path != NULL &&
 	    strcmp(options.control_path, "none") == 0) {
-		xfree(options.control_path);
+		free(options.control_path);
 		options.control_path = NULL;
 	}
 
 	if (options.control_path != NULL) {
 		cp = tilde_expand_filename(options.control_path,
 		    original_real_uid);
-		xfree(options.control_path);
+		free(options.control_path);
 		options.control_path = percent_expand(cp, "h", host,
 		    "l", thishost, "n", host_arg, "r", options.user,
 		    "p", portstr, "u", pw->pw_name, "L", shorthost,
 		    (char *)NULL);
-		xfree(cp);
+		free(cp);
 	}
 	if (muxclient_command != 0 && options.control_path == NULL)
 		fatal("No ControlPath specified for \"-O\" command");
@@ -907,13 +907,11 @@ main(int ac, char **av)
 				sensitive_data.keys[i] = NULL;
 			}
 		}
-		xfree(sensitive_data.keys);
+		free(sensitive_data.keys);
 	}
 	for (i = 0; i < options.num_identity_files; i++) {
-		if (options.identity_files[i]) {
-			xfree(options.identity_files[i]);
-			options.identity_files[i] = NULL;
-		}
+		free(options.identity_files[i]);
+		options.identity_files[i] = NULL;
 		if (options.identity_keys[i]) {
 			key_free(options.identity_keys[i]);
 			options.identity_keys[i] = NULL;
@@ -1503,7 +1501,7 @@ load_public_identity_files(void)
 			    xstrdup(options.pkcs11_provider); /* XXX */
 			n_ids++;
 		}
-		xfree(keys);
+		free(keys);
 	}
 #endif /* ENABLE_PKCS11 */
 	if ((pw = getpwuid(original_real_uid)) == NULL)
@@ -1516,7 +1514,7 @@ load_public_identity_files(void)
 	for (i = 0; i < options.num_identity_files; i++) {
 		if (n_ids >= SSH_MAX_IDENTITY_FILES ||
 		    strcasecmp(options.identity_files[i], "none") == 0) {
-			xfree(options.identity_files[i]);
+			free(options.identity_files[i]);
 			continue;
 		}
 		cp = tilde_expand_filename(options.identity_files[i],
@@ -1524,11 +1522,11 @@ load_public_identity_files(void)
 		filename = percent_expand(cp, "d", pwdir,
 		    "u", pwname, "l", thishost, "h", host,
 		    "r", options.user, (char *)NULL);
-		xfree(cp);
+		free(cp);
 		public = key_load_public(filename, NULL);
 		debug("identity file %s type %d", filename,
 		    public ? public->type : -1);
-		xfree(options.identity_files[i]);
+		free(options.identity_files[i]);
 		identity_files[n_ids] = filename;
 		identity_keys[n_ids] = public;
 
@@ -1541,14 +1539,14 @@ load_public_identity_files(void)
 		debug("identity file %s type %d", cp,
 		    public ? public->type : -1);
 		if (public == NULL) {
-			xfree(cp);
+			free(cp);
 			continue;
 		}
 		if (!key_is_cert(public)) {
 			debug("%s: key %s type %s is not a certificate",
 			    __func__, cp, key_type(public));
 			key_free(public);
-			xfree(cp);
+			free(cp);
 			continue;
 		}
 		identity_keys[n_ids] = public;
@@ -1561,9 +1559,9 @@ load_public_identity_files(void)
 	memcpy(options.identity_keys, identity_keys, sizeof(identity_keys));
 
 	bzero(pwname, strlen(pwname));
-	xfree(pwname);
+	free(pwname);
 	bzero(pwdir, strlen(pwdir));
-	xfree(pwdir);
+	free(pwdir);
 }
 
 static void
diff --git a/usr.bin/ssh/sshconnect.c b/usr.bin/ssh/sshconnect.c
index f377cfa3b7f..8c62533b25f 100644
--- a/usr.bin/ssh/sshconnect.c
+++ b/usr.bin/ssh/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.237 2013/02/22 19:13:56 markus Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.238 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -102,7 +102,7 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
 	xasprintf(&tmp, "exec %s", proxy_command);
 	command_string = percent_expand(tmp, "h", host, "p", strport,
 	    "r", options.user, (char *)NULL);
-	xfree(tmp);
+	free(tmp);
 
 	/* Create pipes for communicating with the proxy. */
 	if (pipe(pin) < 0 || pipe(pout) < 0)
@@ -156,7 +156,7 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command)
 	close(pout[1]);
 
 	/* Free the command name. */
-	xfree(command_string);
+	free(command_string);
 
 	/* Set the connection file descriptors. */
 	packet_set_connection(pout[0], pin[1]);
@@ -305,7 +305,7 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr,
 		fatal("Bogus return (%d) from select()", rc);
 	}
 
-	xfree(fdset);
+	free(fdset);
 
  done:
  	if (result == 0 && *timeoutp > 0) {
@@ -524,7 +524,7 @@ ssh_exchange_identification(int timeout_ms)
 		debug("ssh_exchange_identification: %s", buf);
 	}
 	server_version_string = xstrdup(buf);
-	xfree(fdset);
+	free(fdset);
 
 	/*
 	 * Check that the versions match.  In future this might accept
@@ -600,8 +600,7 @@ confirm(const char *prompt)
 			ret = 0;
 		if (p && strncasecmp(p, "yes", 3) == 0)
 			ret = 1;
-		if (p)
-			xfree(p);
+		free(p);
 		if (ret != -1)
 			return ret;
 	}
@@ -809,8 +808,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
 			ra = key_fingerprint(host_key, SSH_FP_MD5,
 			    SSH_FP_RANDOMART);
 			logit("Host key fingerprint is %s\n%s\n", fp, ra);
-			xfree(ra);
-			xfree(fp);
+			free(ra);
+			free(fp);
 		}
 		break;
 	case HOST_NEW:
@@ -870,8 +869,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
 			    options.visual_host_key ? "\n" : "",
 			    options.visual_host_key ? ra : "",
 			    msg2);
-			xfree(ra);
-			xfree(fp);
+			free(ra);
+			free(fp);
 			if (!confirm(msg))
 				goto fail;
 		}
@@ -1072,8 +1071,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port,
 		}
 	}
 
-	xfree(ip);
-	xfree(host);
+	free(ip);
+	free(host);
 	if (host_hostkeys != NULL)
 		free_hostkeys(host_hostkeys);
 	if (ip_hostkeys != NULL)
@@ -1095,8 +1094,8 @@ fail:
 	}
 	if (raw_key != NULL)
 		key_free(raw_key);
-	xfree(ip);
-	xfree(host);
+	free(ip);
+	free(host);
 	if (host_hostkeys != NULL)
 		free_hostkeys(host_hostkeys);
 	if (ip_hostkeys != NULL)
@@ -1113,7 +1112,7 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
 
 	fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
 	debug("Server host key: %s %s", key_type(host_key), fp);
-	xfree(fp);
+	free(fp);
 
 	/* XXX certs are not yet supported for DNS */
 	if (!key_is_cert(host_key) && options.verify_host_key_dns &&
@@ -1178,7 +1177,7 @@ ssh_login(Sensitive *sensitive, const char *orighost,
 		ssh_kex(host, hostaddr);
 		ssh_userauth1(local_user, server_user, host, sensitive);
 	}
-	xfree(local_user);
+	free(local_user);
 }
 
 void
@@ -1196,7 +1195,7 @@ ssh_put_password(char *password)
 	strlcpy(padded, password, size);
 	packet_put_string(padded, size);
 	memset(padded, 0, size);
-	xfree(padded);
+	free(padded);
 }
 
 /* print all known host keys for a given host, but skip keys of given type */
@@ -1223,8 +1222,8 @@ show_other_keys(struct hostkeys *hostkeys, Key *key)
 		    key_type(found->key), fp);
 		if (options.visual_host_key)
 			logit("%s", ra);
-		xfree(ra);
-		xfree(fp);
+		free(ra);
+		free(fp);
 		ret = 1;
 	}
 	return ret;
@@ -1247,7 +1246,7 @@ warn_changed_key(Key *host_key)
 	    key_type(host_key), fp);
 	error("Please contact your system administrator.");
 
-	xfree(fp);
+	free(fp);
 }
 
 /*
diff --git a/usr.bin/ssh/sshconnect1.c b/usr.bin/ssh/sshconnect1.c
index 57b20845c5d..4f8bbcabe3c 100644
--- a/usr.bin/ssh/sshconnect1.c
+++ b/usr.bin/ssh/sshconnect1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect1.c,v 1.70 2006/11/06 21:25:28 markus Exp $ */
+/* $OpenBSD: sshconnect1.c,v 1.71 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -81,7 +81,7 @@ try_agent_authentication(void)
 
 		/* Try this identity. */
 		debug("Trying RSA authentication via agent with '%.100s'", comment);
-		xfree(comment);
+		free(comment);
 
 		/* Tell the server that we are willing to authenticate using this key. */
 		packet_start(SSH_CMSG_AUTH_RSA);
@@ -228,7 +228,7 @@ try_rsa_authentication(int idx)
 	 */
 	if (type == SSH_SMSG_FAILURE) {
 		debug("Server refused our key.");
-		xfree(comment);
+		free(comment);
 		return 0;
 	}
 	/* Otherwise, the server should respond with a challenge. */
@@ -267,14 +267,14 @@ try_rsa_authentication(int idx)
 				quit = 1;
 			}
 			memset(passphrase, 0, strlen(passphrase));
-			xfree(passphrase);
+			free(passphrase);
 			if (private != NULL || quit)
 				break;
 			debug2("bad passphrase given, try again...");
 		}
 	}
 	/* We no longer need the comment. */
-	xfree(comment);
+	free(comment);
 
 	if (private == NULL) {
 		if (!options.batch_mode && perm_ok)
@@ -409,7 +409,7 @@ try_challenge_response_authentication(void)
 		packet_check_eom();
 		snprintf(prompt, sizeof prompt, "%s%s", challenge,
 		    strchr(challenge, '\n') ? "" : "\nResponse: ");
-		xfree(challenge);
+		free(challenge);
 		if (i != 0)
 			error("Permission denied, please try again.");
 		if (options.cipher == SSH_CIPHER_NONE)
@@ -417,13 +417,13 @@ try_challenge_response_authentication(void)
 			    "Response will be transmitted in clear text.");
 		response = read_passphrase(prompt, 0);
 		if (strcmp(response, "") == 0) {
-			xfree(response);
+			free(response);
 			break;
 		}
 		packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
 		ssh_put_password(response);
 		memset(response, 0, strlen(response));
-		xfree(response);
+		free(response);
 		packet_send();
 		packet_write_wait();
 		type = packet_read();
@@ -456,7 +456,7 @@ try_password_authentication(char *prompt)
 		packet_start(SSH_CMSG_AUTH_PASSWORD);
 		ssh_put_password(password);
 		memset(password, 0, strlen(password));
-		xfree(password);
+		free(password);
 		packet_send();
 		packet_write_wait();
 
diff --git a/usr.bin/ssh/sshconnect2.c b/usr.bin/ssh/sshconnect2.c
index 43716f35315..30e878f06cc 100644
--- a/usr.bin/ssh/sshconnect2.c
+++ b/usr.bin/ssh/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.196 2013/05/16 02:00:34 dtucker Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.197 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -140,10 +140,10 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port)
 	if (*first != '\0')
 		debug3("%s: prefer hostkeyalgs: %s", __func__, first);
 
-	xfree(first);
-	xfree(last);
-	xfree(hostname);
-	xfree(oavail);
+	free(first);
+	free(last);
+	free(hostname);
+	free(oavail);
 	free_hostkeys(hostkeys);
 
 	return ret;
@@ -378,7 +378,7 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
 	if (packet_remaining() > 0) {
 		char *reply = packet_get_string(NULL);
 		debug2("service_accept: %s", reply);
-		xfree(reply);
+		free(reply);
 	} else {
 		debug2("buggy server: service_accept w/o service");
 	}
@@ -425,15 +425,12 @@ userauth(Authctxt *authctxt, char *authlist)
 	if (authctxt->method != NULL && authctxt->method->cleanup != NULL)
 		authctxt->method->cleanup(authctxt);
 
-	if (authctxt->methoddata) {
-		xfree(authctxt->methoddata);
-		authctxt->methoddata = NULL;
-	}
+	free(authctxt->methoddata);
+	authctxt->methoddata = NULL;
 	if (authlist == NULL) {
 		authlist = authctxt->authlist;
 	} else {
-		if (authctxt->authlist)
-			xfree(authctxt->authlist);
+		free(authctxt->authlist);
 		authctxt->authlist = authlist;
 	}
 	for (;;) {
@@ -481,10 +478,10 @@ input_userauth_banner(int type, u_int32_t seq, void *ctxt)
 		msg = xmalloc(len * 4 + 1); /* max expansion from strnvis() */
 		strnvis(msg, raw, len * 4 + 1, VIS_SAFE|VIS_OCTAL|VIS_NOSLASH);
 		fprintf(stderr, "%s", msg);
-		xfree(msg);
+		free(msg);
 	}
-	xfree(raw);
-	xfree(lang);
+	free(raw);
+	free(lang);
 }
 
 /* ARGSUSED */
@@ -495,16 +492,12 @@ input_userauth_success(int type, u_int32_t seq, void *ctxt)
 
 	if (authctxt == NULL)
 		fatal("input_userauth_success: no authentication context");
-	if (authctxt->authlist) {
-		xfree(authctxt->authlist);
-		authctxt->authlist = NULL;
-	}
+	free(authctxt->authlist);
+	authctxt->authlist = NULL;
 	if (authctxt->method != NULL && authctxt->method->cleanup != NULL)
 		authctxt->method->cleanup(authctxt);
-	if (authctxt->methoddata) {
-		xfree(authctxt->methoddata);
-		authctxt->methoddata = NULL;
-	}
+	free(authctxt->methoddata);
+	authctxt->methoddata = NULL;
 	authctxt->success = 1;			/* break out */
 }
 
@@ -593,7 +586,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
 	}
 	fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
 	debug2("input_userauth_pk_ok: fp %s", fp);
-	xfree(fp);
+	free(fp);
 
 	/*
 	 * search keys in the reverse order, because last candidate has been
@@ -609,8 +602,8 @@ input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
 done:
 	if (key != NULL)
 		key_free(key);
-	xfree(pkalg);
-	xfree(pkblob);
+	free(pkalg);
+	free(pkblob);
 
 	/* try another method if we did not send a packet */
 	if (sent == 0)
@@ -748,7 +741,7 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
 	if (oidlen <= 2 ||
 	    oidv[0] != SSH_GSS_OIDTYPE ||
 	    oidv[1] != oidlen - 2) {
-		xfree(oidv);
+		free(oidv);
 		debug("Badly encoded mechanism OID received");
 		userauth(authctxt, NULL);
 		return;
@@ -759,7 +752,7 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
 
 	packet_check_eom();
 
-	xfree(oidv);
+	free(oidv);
 
 	if (GSS_ERROR(process_gssapi_token(ctxt, GSS_C_NO_BUFFER))) {
 		/* Start again with next method on list */
@@ -788,7 +781,7 @@ input_gssapi_token(int type, u_int32_t plen, void *ctxt)
 
 	status = process_gssapi_token(ctxt, &recv_tok);
 
-	xfree(recv_tok.value);
+	free(recv_tok.value);
 
 	if (GSS_ERROR(status)) {
 		/* Start again with the next method in the list */
@@ -821,7 +814,7 @@ input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
 	(void)ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
 	    &recv_tok, &send_tok, NULL);
 
-	xfree(recv_tok.value);
+	free(recv_tok.value);
 	gss_release_buffer(&ms, &send_tok);
 
 	/* Server will be returning a failed packet after this one */
@@ -842,8 +835,8 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
 	packet_check_eom();
 
 	debug("Server GSSAPI Error:\n%s", msg);
-	xfree(msg);
-	xfree(lang);
+	free(msg);
+	free(lang);
 }
 #endif /* GSSAPI */
 
@@ -884,7 +877,7 @@ userauth_passwd(Authctxt *authctxt)
 	packet_put_char(0);
 	packet_put_cstring(password);
 	memset(password, 0, strlen(password));
-	xfree(password);
+	free(password);
 	packet_add_padding(64);
 	packet_send();
 
@@ -917,8 +910,8 @@ input_userauth_passwd_changereq(int type, u_int32_t seqnr, void *ctxt)
 	lang = packet_get_string(NULL);
 	if (strlen(info) > 0)
 		logit("%s", info);
-	xfree(info);
-	xfree(lang);
+	free(info);
+	free(lang);
 	packet_start(SSH2_MSG_USERAUTH_REQUEST);
 	packet_put_cstring(authctxt->server_user);
 	packet_put_cstring(authctxt->service);
@@ -930,7 +923,7 @@ input_userauth_passwd_changereq(int type, u_int32_t seqnr, void *ctxt)
 	password = read_passphrase(prompt, 0);
 	packet_put_cstring(password);
 	memset(password, 0, strlen(password));
-	xfree(password);
+	free(password);
 	password = NULL;
 	while (password == NULL) {
 		snprintf(prompt, sizeof(prompt),
@@ -947,16 +940,16 @@ input_userauth_passwd_changereq(int type, u_int32_t seqnr, void *ctxt)
 		retype = read_passphrase(prompt, 0);
 		if (strcmp(password, retype) != 0) {
 			memset(password, 0, strlen(password));
-			xfree(password);
+			free(password);
 			logit("Mismatch; try again, EOF to quit.");
 			password = NULL;
 		}
 		memset(retype, 0, strlen(retype));
-		xfree(retype);
+		free(retype);
 	}
 	packet_put_cstring(password);
 	memset(password, 0, strlen(password));
-	xfree(password);
+	free(password);
 	packet_add_padding(64);
 	packet_send();
 
@@ -1011,13 +1004,13 @@ jpake_password_to_secret(Authctxt *authctxt, const char *crypt_scheme,
 
 	bzero(password, strlen(password));
 	bzero(crypted, strlen(crypted));
-	xfree(password);
-	xfree(crypted);
+	free(password);
+	free(crypted);
 
 	if ((ret = BN_bin2bn(secret, secret_len, NULL)) == NULL)
 		fatal("%s: BN_bin2bn (secret)", __func__);
 	bzero(secret, secret_len);
-	xfree(secret);
+	free(secret);
 
 	return ret;
 }
@@ -1055,8 +1048,8 @@ input_userauth_jpake_server_step1(int type, u_int32_t seq, void *ctxt)
 	pctx->s = jpake_password_to_secret(authctxt, crypt_scheme, salt);
 	bzero(crypt_scheme, strlen(crypt_scheme));
 	bzero(salt, strlen(salt));
-	xfree(crypt_scheme);
-	xfree(salt);
+	free(crypt_scheme);
+	free(salt);
 	JPAKE_DEBUG_BN((pctx->s, "%s: s = ", __func__));
 
 	/* Calculate step 2 values */
@@ -1071,8 +1064,8 @@ input_userauth_jpake_server_step1(int type, u_int32_t seq, void *ctxt)
 
 	bzero(x3_proof, x3_proof_len);
 	bzero(x4_proof, x4_proof_len);
-	xfree(x3_proof);
-	xfree(x4_proof);
+	free(x3_proof);
+	free(x4_proof);
 
 	JPAKE_DEBUG_CTX((pctx, "step 2 sending in %s", __func__));
 
@@ -1083,7 +1076,7 @@ input_userauth_jpake_server_step1(int type, u_int32_t seq, void *ctxt)
 	packet_send();
 
 	bzero(x2_s_proof, x2_s_proof_len);
-	xfree(x2_s_proof);
+	free(x2_s_proof);
 
 	/* Expect step 2 packet from peer */
 	dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP2,
@@ -1123,7 +1116,7 @@ input_userauth_jpake_server_step2(int type, u_int32_t seq, void *ctxt)
 	    &pctx->h_k_cid_sessid, &pctx->h_k_cid_sessid_len);
 
 	bzero(x4_s_proof, x4_s_proof_len);
-	xfree(x4_s_proof);
+	free(x4_s_proof);
 
 	JPAKE_DEBUG_CTX((pctx, "confirm sending in %s", __func__));
 
@@ -1205,7 +1198,7 @@ sign_and_send_pubkey(Authctxt *authctxt, Identity *id)
 
 	fp = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
 	debug3("sign_and_send_pubkey: %s %s", key_type(id->key), fp);
-	xfree(fp);
+	free(fp);
 
 	if (key_to_blob(id->key, &blob, &bloblen) == 0) {
 		/* we cannot handle this key */
@@ -1240,7 +1233,7 @@ sign_and_send_pubkey(Authctxt *authctxt, Identity *id)
 	ret = identity_sign(id, &signature, &slen,
 	    buffer_ptr(&b), buffer_len(&b));
 	if (ret == -1) {
-		xfree(blob);
+		free(blob);
 		buffer_free(&b);
 		return 0;
 	}
@@ -1260,11 +1253,11 @@ sign_and_send_pubkey(Authctxt *authctxt, Identity *id)
 			buffer_put_cstring(&b, key_ssh_name(id->key));
 		buffer_put_string(&b, blob, bloblen);
 	}
-	xfree(blob);
+	free(blob);
 
 	/* append signature */
 	buffer_put_string(&b, signature, slen);
-	xfree(signature);
+	free(signature);
 
 	/* skip session id and packet type */
 	if (buffer_len(&b) < skip + 1)
@@ -1304,7 +1297,7 @@ send_pubkey_test(Authctxt *authctxt, Identity *id)
 	if (!(datafellows & SSH_BUG_PKAUTH))
 		packet_put_cstring(key_ssh_name(id->key));
 	packet_put_string(blob, bloblen);
-	xfree(blob);
+	free(blob);
 	packet_send();
 	return 1;
 }
@@ -1341,7 +1334,7 @@ load_identity_file(char *filename, int userprovided)
 				quit = 1;
 			}
 			memset(passphrase, 0, strlen(passphrase));
-			xfree(passphrase);
+			free(passphrase);
 			if (private != NULL || quit)
 				break;
 			debug2("bad passphrase given, try again...");
@@ -1418,7 +1411,7 @@ pubkey_prepare(Authctxt *authctxt)
 				/* agent keys from the config file are preferred */
 				if (key_equal(key, id->key)) {
 					key_free(key);
-					xfree(comment);
+					free(comment);
 					TAILQ_REMOVE(&files, id, next);
 					TAILQ_INSERT_TAIL(preferred, id, next);
 					id->ac = ac;
@@ -1464,9 +1457,8 @@ pubkey_cleanup(Authctxt *authctxt)
 		TAILQ_REMOVE(&authctxt->keys, id, next);
 		if (id->key)
 			key_free(id->key);
-		if (id->filename)
-			xfree(id->filename);
-		xfree(id);
+		free(id->filename);
+		free(id);
 	}
 }
 
@@ -1564,9 +1556,9 @@ input_userauth_info_req(int type, u_int32_t seq, void *ctxt)
 		logit("%s", name);
 	if (strlen(inst) > 0)
 		logit("%s", inst);
-	xfree(name);
-	xfree(inst);
-	xfree(lang);
+	free(name);
+	free(inst);
+	free(lang);
 
 	num_prompts = packet_get_int();
 	/*
@@ -1587,8 +1579,8 @@ input_userauth_info_req(int type, u_int32_t seq, void *ctxt)
 
 		packet_put_cstring(response);
 		memset(response, 0, strlen(response));
-		xfree(response);
-		xfree(prompt);
+		free(response);
+		free(prompt);
 	}
 	packet_check_eom(); /* done with parsing incoming message. */
 
@@ -1708,12 +1700,12 @@ userauth_hostbased(Authctxt *authctxt)
 	if (p == NULL) {
 		error("userauth_hostbased: cannot get local ipaddr/name");
 		key_free(private);
-		xfree(blob);
+		free(blob);
 		return 0;
 	}
 	xasprintf(&chost, "%s.", p);
 	debug2("userauth_hostbased: chost %s", chost);
-	xfree(p);
+	free(p);
 
 	service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
 	    authctxt->service;
@@ -1742,9 +1734,9 @@ userauth_hostbased(Authctxt *authctxt)
 	buffer_free(&b);
 	if (ok != 0) {
 		error("key_sign failed");
-		xfree(chost);
-		xfree(pkalg);
-		xfree(blob);
+		free(chost);
+		free(pkalg);
+		free(blob);
 		return 0;
 	}
 	packet_start(SSH2_MSG_USERAUTH_REQUEST);
@@ -1757,10 +1749,10 @@ userauth_hostbased(Authctxt *authctxt)
 	packet_put_cstring(authctxt->local_user);
 	packet_put_string(signature, slen);
 	memset(signature, 's', slen);
-	xfree(signature);
-	xfree(chost);
-	xfree(pkalg);
-	xfree(blob);
+	free(signature);
+	free(chost);
+	free(pkalg);
+	free(blob);
 
 	packet_send();
 	return 1;
@@ -1815,8 +1807,8 @@ userauth_jpake(Authctxt *authctxt)
 
 	bzero(x1_proof, x1_proof_len);
 	bzero(x2_proof, x2_proof_len);
-	xfree(x1_proof);
-	xfree(x2_proof);
+	free(x1_proof);
+	free(x2_proof);
 
 	/* Expect step 1 packet from peer */
 	dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP1,
@@ -1893,8 +1885,7 @@ authmethod_get(char *authlist)
 
 	if (supported == NULL || strcmp(authlist, supported) != 0) {
 		debug3("start over, passed a different list %s", authlist);
-		if (supported != NULL)
-			xfree(supported);
+		free(supported);
 		supported = xstrdup(authlist);
 		preferred = options.preferred_authentications;
 		debug3("preferred %s", preferred);
@@ -1915,7 +1906,7 @@ authmethod_get(char *authlist)
 		    authmethod_is_enabled(current)) {
 			debug3("authmethod_is_enabled %s", name);
 			debug("Next authentication method: %s", name);
-			xfree(name);
+			free(name);
 			return current;
 		}
 	}
diff --git a/usr.bin/ssh/sshd.c b/usr.bin/ssh/sshd.c
index ad73d94a78f..dc95008cb66 100644
--- a/usr.bin/ssh/sshd.c
+++ b/usr.bin/ssh/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.401 2013/05/16 09:08:41 dtucker Exp $ */
+/* $OpenBSD: sshd.c,v 1.402 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -951,7 +951,7 @@ recv_rexec_state(int fd, Buffer *conf)
 	cp = buffer_get_string(&m, &len);
 	if (conf != NULL)
 		buffer_append(conf, cp, len + 1);
-	xfree(cp);
+	free(cp);
 
 	if (buffer_get_int(&m)) {
 		if (sensitive_data.server_key != NULL)
@@ -1104,7 +1104,7 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
 		if (received_sighup)
 			sighup_restart();
 		if (fdset != NULL)
-			xfree(fdset);
+			free(fdset);
 		fdset = (fd_set *)xcalloc(howmany(maxfd + 1, NFDBITS),
 		    sizeof(fd_mask));
 
@@ -1432,7 +1432,7 @@ main(int ac, char **av)
 			if (process_server_config_line(&options, line,
 			    "command-line", 0, NULL, NULL) != 0)
 				exit(1);
-			xfree(line);
+			free(line);
 			break;
 		case '?':
 		default:
@@ -1454,7 +1454,7 @@ main(int ac, char **av)
 	/* If requested, redirect the logs to the specified logfile. */
 	if (logfile != NULL) {
 		log_redirect_stderr_to(logfile);
-		xfree(logfile);
+		free(logfile);
 	}
 	/*
 	 * Force logging to stderr until we have loaded the private host
@@ -2165,7 +2165,7 @@ do_ssh1_kex(void)
 		MD5_Update(&md, sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH);
 		MD5_Final(session_key + 16, &md);
 		memset(buf, 0, bytes);
-		xfree(buf);
+		free(buf);
 		for (i = 0; i < 16; i++)
 			session_id[i] = session_key[i] ^ session_key[i + 16];
 	}
diff --git a/usr.bin/ssh/umac.c b/usr.bin/ssh/umac.c
index 5a0704862fb..284c9f3b3e0 100644
--- a/usr.bin/ssh/umac.c
+++ b/usr.bin/ssh/umac.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: umac.c,v 1.4 2011/10/19 10:39:48 djm Exp $ */
+/* $OpenBSD: umac.c,v 1.5 2013/05/17 00:13:14 djm Exp $ */
 /* -----------------------------------------------------------------------
  * 
  * umac.c -- C Implementation UMAC Message Authentication
@@ -1197,7 +1197,7 @@ int umac_delete(struct umac_ctx *ctx)
     if (ctx) {
         if (ALLOC_BOUNDARY)
             ctx = (struct umac_ctx *)ctx->free_ptr;
-        xfree(ctx);
+        free(ctx);
     }
     return (1);
 }
diff --git a/usr.bin/ssh/uuencode.c b/usr.bin/ssh/uuencode.c
index 74986458ab1..5b61f016f58 100644
--- a/usr.bin/ssh/uuencode.c
+++ b/usr.bin/ssh/uuencode.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: uuencode.c,v 1.26 2010/08/31 11:54:45 djm Exp $ */
+/* $OpenBSD: uuencode.c,v 1.27 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -27,6 +27,7 @@
 #include <netinet/in.h>
 #include <resolv.h>
 #include <stdio.h>
+#include <stdlib.h>
 
 #include "xmalloc.h"
 #include "uuencode.h"
@@ -65,7 +66,7 @@ uudecode(const char *src, u_char *target, size_t targsize)
 	/* and remove trailing whitespace because __b64_pton needs this */
 	*p = '\0';
 	len = __b64_pton(encoded, target, targsize);
-	xfree(encoded);
+	free(encoded);
 	return len;
 }
 
@@ -88,5 +89,5 @@ dump_base64(FILE *fp, const u_char *data, u_int len)
 	}
 	if (i % 70 != 69)
 		fprintf(fp, "\n");
-	xfree(buf);
+	free(buf);
 }
diff --git a/usr.bin/ssh/xmalloc.c b/usr.bin/ssh/xmalloc.c
index 51a6d635dcc..7f74dff13a4 100644
--- a/usr.bin/ssh/xmalloc.c
+++ b/usr.bin/ssh/xmalloc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: xmalloc.c,v 1.27 2006/08/03 03:34:42 deraadt Exp $ */
+/* $OpenBSD: xmalloc.c,v 1.28 2013/05/17 00:13:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -71,14 +71,6 @@ xrealloc(void *ptr, size_t nmemb, size_t size)
 	return new_ptr;
 }
 
-void
-xfree(void *ptr)
-{
-	if (ptr == NULL)
-		fatal("xfree: NULL pointer given as argument");
-	free(ptr);
-}
-
 char *
 xstrdup(const char *str)
 {
diff --git a/usr.bin/ssh/xmalloc.h b/usr.bin/ssh/xmalloc.h
index fb217a45c90..261dfd612c8 100644
--- a/usr.bin/ssh/xmalloc.h
+++ b/usr.bin/ssh/xmalloc.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: xmalloc.h,v 1.13 2006/08/03 03:34:42 deraadt Exp $ */
+/* $OpenBSD: xmalloc.h,v 1.14 2013/05/17 00:13:14 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -19,7 +19,6 @@
 void	*xmalloc(size_t);
 void	*xcalloc(size_t, size_t);
 void	*xrealloc(void *, size_t, size_t);
-void     xfree(void *);
 char	*xstrdup(const char *);
 int	 xasprintf(char **, const char *, ...)
                 __attribute__((__format__ (printf, 2, 3)))