But it's not enough to get valgrind happy (It still reports 4 "definitely lost" blocks, all from that putenv2 function). Perhaps that's related to the comment:
/*
* Do not free envstr because it becomes part of the environment
* on some operating systems. See port/unsetenv.c::unsetenv.
*/
http://hjg.com.ar/