Hi,

to me it looks like tls_cfg is not freed when the early return happens.
This patch uses goto err like the other parts of the function.

diff --git usr.sbin/relayd/relay.c usr.sbin/relayd/relay.c
index e2aa0625572..fcb1336aeef 100644
--- usr.sbin/relayd/relay.c
+++ usr.sbin/relayd/relay.c
@@ -2156,7 +2156,7 @@ relay_tls_ctx_create(struct relay *rlay)
         }
         if ((tls_client_cfg = tls_config_new()) == NULL) {
                 log_warnx("unable to allocate TLS config");
-               return (-1);
+               goto err;
         }