Thanks for this pointer. This UB and a similar one in putenv were going to be our next report:

unsetenv:
* rewrite; this fixes UB caused by testing a free'd pointer against
  NULL on entry to subsequent loops.

In the version after your patch, we do not detect any undefined behavior with TIS Interpreter, for the tests we have (libc-testsuite plus one additional test that we wrote to make TIS Interpreter confirm the misuse of memcmp in putenv).

Pascal