First of all, the code was freeing the wrong pointer (i.e. the pointer
supplied by the caller of one of the NdrFullPointer* functions, not the
PFULL_PTR_TO_REFID_ELEMENT. Second, the code wasn't following the Next
link to the next entry in the list.