The ret variable is freed twice, but on the second time we actually want
to free ret3 instead. Don't know why this didn't explode.
Reported-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>