r18: Fix free of incremented pointer