Hello.

The final result returned by eval0() is never freed. It is a tiny
leak, so I'm not sure whether a change is worthwhile.

Best regards,
Biarder

Index: expr.c
===================================================================
RCS file: /cvs/src/bin/expr/expr.c,v
diff -u -p -r1.28 expr.c
--- expr.c	28 Jan 2022 05:15:05 -0000	1.28
+++ expr.c	30 Jun 2026 04:58:33 -0000
@@ -494,6 +494,7 @@ int
 main(int argc, char *argv[])
 {
 	struct val     *vp;
+	int		result;
 
 	if (pledge("stdio", NULL) == -1)
 		err(2, "pledge");
@@ -514,5 +515,7 @@ main(int argc, char *argv[])
 	else
 		printf("%s\n", vp->u.s);
 
-	return is_zero_or_null(vp);
+	result = is_zero_or_null(vp);
+	free_value(vp);
+	return result;
 }