Currently valgrind reports leaks after that calls, cause returned buffers contains data pointers too, including SIDs. So the question is about LsaFreeMemory usage - should advapi track allocated structures and then free properly depending on passed pointer or caller is responsible for cleanup?