rx_link_hdr() takes ownership of msg on success (rx_link() only frees it on failure). Both branches that call update_conn_file_hdr_msg() free msg, but when an identical link header was already stored neither branch ran and msg was leaked.
This happens on every duplicate PKT_LINK_HDR, e.g. a client that periodically resends its header. Free msg explicitly in that case.
