Hello,
when unmetafied string is returned, possibly containing nulls, zsfree() cannot be used. There is probably a better way to solve this, but following method for sure works:

         /* Free key, restoring its original length */
+        set_length(umkey, umlen);
         zsfree(umkey);

+static void set_length(char *buf, int size) {
+    buf[size]='\0';
+    while ( -- size >= 0 ) {
+        buf[size]=' ';
+    }
+}

Attached is a patch, tested with TESTNUM=V11. Would be nice if also 40898 would be applied: http://www.zsh.org/mla/workers/2017/msg00568.html

--
Sebastian Gniazdowski
psprint /at/ zdharma.org