smb_freemsgmem():
bounce() is using a strange method of copying a message header in memory
(not using smb_copymsgmem) and when it frees the message, ends up with a
double-free of the 2 new smbmsg_t members (not header fields): text_subtype
and text_charset.