When ndr decode v4 ntacl() fails, the code jumped to free n data which only freed n.data, skipping kfree(acl.sd buf) and leaking the buffer. Zero-initialize struct xattr ntacl acl, reorder error labels to out free to release acl.sd buf on all error paths.

if (acl.sd size < sizeof(struct smb ntsd)) is true, original code returned success without freeing sd buf and left stale *pntsd. Set rc = -EINVAL before jumping to out free to return error code and free buffer.