hush: Fix bogus free() call