diff -ur dhcp-4.2.4/common/options.c dhcp-4.2.4-P1/common/options.c
--- dhcp-4.2.4/common/options.c	2012-03-19 20:31:53.000000000 -0400
+++ dhcp-4.2.4-P1/common/options.c	2012-07-13 02:18:05.000000000 -0400
@@ -2359,6 +2359,8 @@
 
 	/* And let go of our references. */
       cleanup:
+	if (lbp != NULL)
+		buffer_dereference(&lbp, MDL);
 	option_dereference(&option, MDL);
 
 	return status;
diff -ur dhcp-4.2.4/server/dhcpv6.c dhcp-4.2.4-P1/server/dhcpv6.c
--- dhcp-4.2.4/server/dhcpv6.c	2012-05-15 17:07:41.000000000 -0400
+++ dhcp-4.2.4-P1/server/dhcpv6.c	2012-07-13 02:18:05.000000000 -0400
@@ -1254,6 +1254,8 @@
 	isc_boolean_t no_resources_avail = ISC_FALSE;
 #endif
 
+	memset(&packet_oro, 0, sizeof(packet_oro));
+
 	/* Locate the client.  */
 	if (shared_network_from_packet6(&reply.shared,
 					packet) != ISC_R_SUCCESS)
@@ -1276,7 +1278,6 @@
 	 * Get the ORO from the packet, if any.
 	 */
 	oc = lookup_option(&dhcpv6_universe, packet->options, D6O_ORO);
-	memset(&packet_oro, 0, sizeof(packet_oro));
 	if (oc != NULL) {
 		if (!evaluate_option_cache(&packet_oro, packet, 
 					   NULL, NULL, 
@@ -1519,6 +1520,8 @@
 		packet_dereference(&reply.packet, MDL);
 	if (reply.client_id.data != NULL)
 		data_string_forget(&reply.client_id, MDL);
+	if (packet_oro.buffer != NULL)
+		data_string_forget(&packet_oro, MDL);
 	reply.renew = reply.rebind = reply.prefer = reply.valid = 0;
 	reply.cursor = 0;
 }
