Use qemu_free() on env instead of free.