rx_link_hdr() takes ownership of msg on success (rx_link() only frees it on failure). Both branches that call update_conn_file_hdr_msg() free msg, but when an identical link header was already stored neither branch ran and msg was leaked.
This happens on every duplicate PKT_LINK_HDR, e.g. a client that periodically resends its header. Free msg explicitly in that case.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Change-Id: I79344fe942342f2a736878142b3cf036fc982eef
