The Cstring |f| wasn't being DELETE()d before returning from mkd_xml(), leading to a leak every time it was called.
bobsayshilol